# Per-recipe harness config for cryptpad (recipe #3 — stateful, no external DB; data on disk
# volumes). Enrolling needs NO shared-harness change (D5): the SANDBOX_DOMAIN quirk is handled by
# the generic EXTRA_ENV mechanism in lifecycle.deploy_app.
HEALTH_PATH = "/"
HEALTH_OK = (200, 301, 302)
DEPLOY_TIMEOUT = 600
HTTP_TIMEOUT = 600


def EXTRA_ENV(ctx):
    """cryptpad needs a SANDBOX_DOMAIN distinct from the main DOMAIN (it serves user content from a
    separate origin; the web router routes both). Derive a sibling subdomain under the same wildcard
    (covered by the wildcard cert, so no cert work)."""
    label, _, rest = ctx.domain.partition(".")
    return {"SANDBOX_DOMAIN": f"{label}-sb.{rest}"}


# canon §2.B: enroll as a DATA-WARM canonical (all recipes enrolled — operator 2026-06-17).
# The weekly sweep promotes this recipe's canonical to its latest green RELEASE TAG.
WARM_CANONICAL = True