feat(tor): add onion on/off variant coverage to domain roles

Each role's meta/variants.yml now pins the tor onion gate both ways so the matrix exercises it: variant 0 pins services.tor.enabled: true, every non-baseline variant pins enabled: false + shared: false (# nocheck: variants-static-override, since tor.shared is a static literal). This gives real test_coverage / test_bond_baseline coverage without the removed per-key code exemptions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/web-app-akaunting/meta/variants.yml

@@ -32,6 +32,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -59,3 +61,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-baserow/meta/variants.yml

@@ -31,6 +31,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-bigbluebutton/meta/variants.yml

@@ -32,6 +32,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     collabora:
       enabled: false
@@ -60,3 +62,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-bluesky/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -50,3 +52,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-bookwyrm/meta/variants.yml

@@ -32,6 +32,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -59,3 +61,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-bridgy-fed/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-checkmk/meta/variants.yml

@@ -28,6 +28,8 @@
     sso:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false
 - services:
@@ -55,6 +57,9 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only
 - services:
@@ -82,3 +87,6 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-chess/meta/variants.yml

@@ -19,6 +19,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -34,3 +36,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-confluence/meta/variants.yml

@@ -22,6 +22,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -40,3 +42,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-dashboard/meta/variants.yml

@@ -27,6 +27,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     asset:
       enabled: false
@@ -49,3 +51,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-decidim/meta/variants.yml

@@ -31,6 +31,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-discourse/meta/variants.yml

@@ -29,6 +29,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     asset:
       enabled: false
@@ -56,3 +58,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-erpnext/meta/variants.yml

@@ -32,6 +32,8 @@
       shared: true
     redis:
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false
 - services:
@@ -63,6 +65,9 @@
       shared: false
     redis:
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only
 - services:
@@ -94,3 +99,6 @@
       shared: false
     redis:
       shared: true
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-espocrm/meta/variants.yml

@@ -31,6 +31,8 @@
     ldap:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,6 +60,9 @@
     ldap:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -83,3 +88,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-fediwall/meta/variants.yml

@@ -40,6 +40,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     mastodon:
       enabled: false
@@ -51,6 +53,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     mastodon:
       enabled: true
@@ -112,3 +117,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-fider/meta/variants.yml

@@ -31,6 +31,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-flowise/meta/variants.yml

@@ -30,6 +30,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -55,3 +57,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-friendica/meta/variants.yml

@@ -31,6 +31,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,6 +60,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -83,3 +88,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-funkwhale/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -64,6 +66,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -94,3 +99,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-fusiondirectory/meta/variants.yml

@@ -29,6 +29,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -53,6 +55,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     sso:
       enabled: false
@@ -75,3 +80,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-gitea/meta/variants.yml

@@ -34,6 +34,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -64,6 +66,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -92,3 +97,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-gitlab/meta/variants.yml

@@ -31,6 +31,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-hugo/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-jellyfin/meta/variants.yml

@@ -25,6 +25,8 @@
     sso:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false
 - services:
@@ -49,6 +51,9 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only
 - services:
@@ -73,3 +78,6 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-jenkins/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     sso:
       enabled: false
@@ -50,6 +52,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -72,3 +77,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-jira/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -46,3 +48,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-jitsi/meta/variants.yml

@@ -28,6 +28,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything off, AUTH_TYPE=internal, anonymous rooms
 - services:
@@ -55,6 +57,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only — direct prosody mod_auth_ldap2 against svc-db-openldap
 - services:
@@ -82,3 +87,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-joomla/meta/variants.yml

@@ -33,6 +33,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     sso:
       enabled: false
@@ -57,3 +59,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-kix/meta/variants.yml

@@ -29,6 +29,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -54,6 +56,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -79,3 +84,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-listmonk/meta/variants.yml

@@ -34,6 +34,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     asset:
       enabled: false
@@ -64,3 +66,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-littlejs/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-magento/meta/variants.yml

@@ -29,6 +29,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -54,3 +56,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mailu/meta/variants.yml

@@ -26,6 +26,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -47,3 +49,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mastodon/meta/variants.yml

@@ -31,6 +31,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-matomo/meta/variants.yml

@@ -20,6 +20,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -35,3 +37,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mattermost/meta/variants.yml

@@ -31,6 +31,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -58,3 +60,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mediawiki/meta/variants.yml

@@ -28,6 +28,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -52,3 +54,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mig/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mini-qr/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-minio/meta/variants.yml

@@ -31,6 +31,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     sso:
       enabled: false
@@ -56,6 +58,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -81,3 +86,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-mobilizon/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -52,3 +54,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-moodle/meta/variants.yml

@@ -34,6 +34,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # LDAP-only variant: auth_ldap only, auth_oidc disabled.
 - services:
@@ -64,6 +66,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     css:
       enabled: false
@@ -91,3 +96,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-navigator/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-nextcloud/meta/variants.yml

@@ -90,6 +90,8 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: true
 # Variant 1: minimal - SSO off, no partners
 - services:
     sso:
@@ -171,6 +173,9 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 2: openwebui + flowise
 - services:
     sso:
@@ -252,6 +257,9 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 3: openproject + mattermost + matrix
 - services:
     sso:
@@ -333,6 +341,9 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 4: onlyoffice + mastodon
 - services:
     sso:
@@ -414,6 +425,9 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 5: zammad + peertube
 - services:
     sso:
@@ -495,6 +509,9 @@
     peertube:
       enabled: true
       shared: true
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 6: gitlab
 - services:
     sso:
@@ -576,6 +593,9 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # Variant 7: discourse
 - services:
     sso:
@@ -657,3 +677,6 @@
     peertube:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-odoo/meta/variants.yml

@@ -31,6 +31,8 @@
     ldap:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,6 +60,9 @@
     ldap:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -83,3 +88,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-opencloud/meta/variants.yml

@@ -29,6 +29,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # Baseline-only variant: pin every dynamic flag false so the matrix
 # also exercises the out-of-group_names branch and satisfies the
@@ -58,6 +60,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # LDAP-only variant: pin ldap.enabled true with
 # oidc.enabled false so the spec exercises the LDAP-bind login path
@@ -87,3 +92,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-openproject/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -64,6 +66,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -92,3 +97,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-opentalk/meta/variants.yml

@@ -33,6 +33,8 @@
       shared: true
     seaweedfs:
       shared: true
+    tor:
+      enabled: true
 - services:
     coturn:
       enabled: false
@@ -62,3 +64,6 @@
       shared: false
     seaweedfs:
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-openwebui/meta/variants.yml

@@ -35,6 +35,8 @@
     ldap:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -66,6 +68,9 @@
     ldap:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -97,3 +102,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-peertube/meta/variants.yml

@@ -31,6 +31,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,3 +60,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-penpot/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 # Variant pinning every dynamic services.yml flag to false.
 - services:
     css:
@@ -65,6 +67,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # LDAP-only variant: LDAP bind login on, OIDC/SSO off, so the matrix
 # exercises the LDAP authentication branch in isolation.
 - services:
@@ -95,3 +100,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-pgadmin/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -52,3 +54,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-phpldapadmin/meta/variants.yml

@@ -29,6 +29,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -50,6 +52,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     sso:
       enabled: false
@@ -69,3 +74,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-phpmyadmin/meta/variants.yml

@@ -28,6 +28,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-pihole/meta/variants.yml

@@ -25,6 +25,8 @@
     sso:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -47,3 +49,6 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-pixelfed/meta/variants.yml

@@ -31,6 +31,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,3 +60,6 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-postmarks/meta/variants.yml

@@ -29,6 +29,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -48,3 +50,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-pretix/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -52,3 +54,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-prometheus/meta/variants.yml

@@ -24,6 +24,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -43,3 +45,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-roulette-wheel/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-seaweedfs/meta/variants.yml

@@ -12,6 +12,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     sso:
       enabled: false
@@ -25,3 +27,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-semaphore/meta/variants.yml

@@ -30,6 +30,8 @@
     sso:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false
 - services:
@@ -59,6 +61,9 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only
 - services:
@@ -88,3 +93,6 @@
     sso:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-shopware/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -67,6 +69,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -97,3 +102,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-snipe-it/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -64,6 +66,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -94,3 +99,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-socialhome/meta/variants.yml

@@ -14,6 +14,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -24,3 +26,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-sphinx/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -30,3 +32,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-suitecrm/meta/variants.yml

@@ -31,6 +31,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     css:
       enabled: false
@@ -58,6 +60,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -85,3 +90,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-taiga/meta/variants.yml

@@ -34,6 +34,8 @@
     seaweedfs:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -64,6 +66,9 @@
     seaweedfs:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -94,3 +99,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-xwiki/meta/variants.yml

@@ -28,6 +28,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -52,6 +54,9 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 # LDAP-only auth backend: exercises the ldap-authenticator addon's enabled
 # branch. OIDC stays off because the two auth backends are mutually exclusive
 # (tasks/02_validation.yml); the ldap service block is a static-false opt-in by
@@ -84,3 +89,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-yourls/meta/variants.yml

@@ -25,6 +25,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     dashboard:
       enabled: false
@@ -46,3 +48,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-app-zammad/meta/variants.yml

@@ -34,6 +34,8 @@
       shared: true
     redis:
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false
 - services:
@@ -67,6 +69,9 @@
       shared: false
     redis:
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # V3: ldap only
 - services:
@@ -100,3 +105,6 @@
       shared: false
     redis:
       shared: true
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-asset/meta/variants.yml

@@ -15,6 +15,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     file:
       enabled: false
@@ -25,3 +27,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-cdn/meta/variants.yml

@@ -12,6 +12,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -19,3 +21,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-collabora/meta/variants.yml

@@ -12,6 +12,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -19,3 +21,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-coturn/meta/variants.yml

@@ -15,6 +15,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -25,3 +27,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-css/meta/variants.yml

@@ -6,7 +6,12 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-file/meta/variants.yml

@@ -15,6 +15,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -25,3 +27,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-html/meta/variants.yml

@@ -14,6 +14,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -24,3 +26,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-legal/meta/variants.yml

@@ -8,7 +8,12 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-libretranslate/meta/variants.yml

@@ -18,6 +18,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -31,3 +33,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-logout/meta/variants.yml

@@ -15,6 +15,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -25,3 +27,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-onlyoffice/meta/variants.yml

@@ -17,6 +17,8 @@
     css:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     matomo:
       enabled: false
@@ -29,3 +31,6 @@
     css:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-simpleicons/meta/variants.yml

@@ -9,7 +9,12 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 - services:
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override

roles/web-svc-xmpp/meta/variants.yml

@@ -18,6 +18,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # variant 1: every dynamic flag off — auth-coverage matrix's
 # false-pinning branch.
@@ -31,6 +33,9 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override
 
 # variant 2: LDAP-only branch — ejabberd stays bound to
 # the project LDAP store while OIDC stays opted out.
@@ -44,3 +49,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override