{
  "_comment": "TEMPLATE for the OUTBOUND remote-desktop targets — machines this thin client connects TO. Not to be confused with wayvnc, which is the inbound channel that lets other machines control this one. Baked into the image read-only at /etc/thinclient-agent/rdp-vnc.json; on first boot thinclient_agent/remote_desktop.py copies it to /var/lib/thinclient-agent/rdp-vnc.json and reads that copy from then on, so targets can be edited on a running machine without a rebuild.",

  "_comment_no_credentials": "NO PASSWORDS IN THIS FILE, EVER — it is committed to git. 'credentials_ref' names a block in /etc/thinclient-agent/remote-desktop-credentials.env (mode 0600, gitignored, created by hand on the booted machine). See hosts/thin-client/README.md for the format. The agent reads only the username and domain out of that file; the password is never read, never written into a .remmina profile, and never put on a command line — Remmina prompts for it on first connect and stores it in its own keyring-backed store afterwards.",

  "_comment_placeholders": "The two entries below are PLACEHOLDERS. The hosts are RFC-5737-style dummies, not real machines on any LAN. Replace them (or empty the list) before first boot; an unreachable target just makes Remmina show a connection error, but leaving fake names in the HA select is confusing.",

  "targets": [
    {
      "name": "framework12",
      "host": "192.168.1.0",
      "port": 3389,
      "protocol": "rdp",
      "credentials_ref": "framework12"
    },
    {
      "name": "thinkpad",
      "host": "192.168.1.0",
      "port": 5900,
      "protocol": "vnc",
      "credentials_ref": "thinkpad"
    }
  ]
}