- insert:
    - id: dsh-remote
      name: '@local/dsh-remote'
      config:
        # master | slave | auto (auto = slave once paired with a master, else master)
        role: auto
        # Display name of this device (defaults to the hostname); its id is the slug of it.
        deviceName: ''
        # Shown in the Devices page so other machines know where to pair.
        lanUrl: ''
        publicUrl: ''
        # Extra browser origins allowed to receive the proxy session from /dsh-remote/signin
        # (loopback and private-network origins are always allowed).
        signInOrigins: []
        sync:
          # slave: pull plugins/config automatically on link-up and when the master pushes.
          auto: true
          # slave: bundle allow/deny lists (exact names or prefix*). deny wins.
          allow: []
          deny: []
          # slave: names of credential refs to accept from the master (opt-in, per secret).
          # FORGE_CREDENTIALS = the master's Gitea/Forgejo (tea) logins + git https credentials.
          secrets: []
          # master: credential refs offered to devices (each device still opts in on the master
          # Devices page AND locally via `secrets` above).
          offerSecrets: []
          # master: never sync these bundles / cordis.patch.yml entry ids.
          excludeBundles: []
          excludePatchIds: []
        agentTools:
          # Register remote_devices / remote_exec / remote_file / remote_task.
          # Unset = on for the master only; true = also on a slave.
          # tools: true
          # false = refuse agent control of THIS device (exec/files/tasks from the master).
          enabled: true
          # master: let slaves relay agent ops to other devices.
          allowPeerControl: false