feat(web-svc-css): introduce canonical owner of the css service flag

Decouples the CSS service concept from its underlying transport
(currently `web-svc-cdn`) so the flag becomes opt-in via inventory
group membership instead of staying literal-`true` everywhere.

- `roles/web-svc-css/`: new role. Marker / wrapper role that owns
  the `css` entry in the service registry, declares `web-svc-cdn` as
  the upstream that serves the actual bytes, and 301-redirects its
  own canonical domain to the cdn domain so health probes return a
  valid response.
- `roles/web-svc-cdn/meta/services.yml`: drop the `css` block — the
  canonical owner is now web-svc-css; cdn keeps `javascript`.
- 51 consumer roles (web-app-* and web-svc-{coturn,file,html,
  libretranslate,logout,onlyoffice}) migrated their `css:` block from
  literal `{ enabled: true, shared: true }` to dynamic
  `{ enabled: "{{ 'web-svc-css' in group_names }}", shared: ... }`,
  with matching matrix coverage added to each role's
  `meta/variants.yml` (true-pinning + false-pinning entries) so the
  dynamic-flag variant lint stays green.
- 41 `# nocheck: playwright-service-flag` rationale strings updated
  from the now-incorrect "canonical:cdn alias of static-asset
  provider" to "css consumer, no Playwright surface (provider:
  web-svc-css)".

Bundled refactor: `roles/web-svc-asset/tasks/01_core.yml` now
includes `web-opt-rdr-domains` directly with a single-entry mapping
to redirect its canonical domain to web-svc-file, instead of having
that wiring live in the global `tasks/stages/01_constructor.yml`
constructor. The `add_redirect_if_group` filter
(`plugins/filter/redirect_filters.py`) and its unit test are dropped
as dead code — both call sites are now role-local.

Dashboard's consumption of the new pattern is intentionally not part
of this commit and follows separately.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

plugins/filter/redirect_filters.py

@@ -1,35 +0,0 @@
-from ansible.errors import AnsibleFilterError
-
-
-class FilterModule:
-    """
-    Custom filters for redirect domain mappings
-    """
-
-    def filters(self):
-        return {
-            "add_redirect_if_group": self.add_redirect_if_group,
-        }
-
-    @staticmethod
-    def add_redirect_if_group(redirect_list, group, source, target, group_names):
-        """
-        Append {"source": source, "target": target} to *redirect_list*
-        **only** if *group* is contained in *group_names*.
-
-        Usage in Jinja:
-          {{ redirect_list
-               | add_redirect_if_group('lam',
-                                       'ldap.' ~ DOMAIN_PRIMARY,
-                                       domains | get_domain('web-app-lam'),
-                                       group_names) }}
-        """
-        try:
-            # Make a copy so we don’t mutate the original list in place
-            redirects = list(redirect_list)
-
-            if group in group_names:
-                redirects.append({"source": source, "target": target})
-        except Exception as exc:
-            raise AnsibleFilterError(f"add_redirect_if_group failed: {exc}") from exc
-        return redirects

roles/web-app-akaunting/meta/services.yml

@@ -58,11 +58,10 @@ redis:
   backup:
     disabled: true
   enabled: false
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-akaunting/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides. Both auth-flow
 # variants ride the same `web-app-oauth2-proxy` sidecar in front of
 # the Akaunting web UI.
@@ -29,6 +28,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -53,6 +55,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -60,3 +65,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-baserow/meta/services.yml

@@ -53,11 +53,10 @@ baserow:
     - web-app-keycloak
     - web-app-mailu
   lifecycle: beta
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-baserow/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Both auth-flow variants ride the same
 # `web-app-oauth2-proxy` sidecar in front of the Baserow web UI.
 
@@ -28,6 +27,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -52,6 +54,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -59,3 +64,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-bigbluebutton/meta/services.yml

@@ -60,11 +60,10 @@ coturn:
 collabora:
   shared: "{{ 'web-svc-collabora' in group_names }}"
   enabled: "{{ 'web-svc-collabora' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-bigbluebutton/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-bigbluebutton.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -32,6 +31,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     collabora:
       enabled: false
@@ -57,3 +59,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-bluesky/meta/services.yml

@@ -87,11 +87,10 @@ broker:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 256
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-bluesky/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Both variants ride the same OIDC →
 # login-broker → social-app handoff (variant A+); the difference is
 # whether Keycloak's user storage is local (variant 0) or LDAP-
@@ -31,6 +30,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -53,6 +55,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -60,3 +65,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-bookwyrm/meta/services.yml

@@ -65,11 +65,10 @@ bookwyrm:
 # nocheck: playwright-service-flag — internal sub-component (multi-entity role)
 worker:
   enabled: true
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-bookwyrm/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides. Both auth-flow
 # variants ride the same `web-app-oauth2-proxy` sidecar in front of
 # the BookWyrm web UI.
@@ -32,6 +31,9 @@
     oidc:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -59,6 +61,9 @@
     oidc:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -69,3 +74,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-bridgy-fed/meta/services.yml

@@ -31,11 +31,10 @@ application:
   mem_reservation: 256m
   mem_limit: 1g
   pids_limit: 512
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-bridgy-fed/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-bridgy-fed.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-chess/meta/services.yml

@@ -38,10 +38,9 @@ chess:
     local:
       http: 8050
   lifecycle: beta
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-chess/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-chess.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -19,6 +18,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -31,3 +33,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-confluence/meta/services.yml

@@ -41,10 +41,9 @@ confluence:
     - web-app-matomo
     - web-app-mailu
   lifecycle: unsupported
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-confluence/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-confluence.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -25,6 +24,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -43,3 +45,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-decidim/meta/services.yml

@@ -44,11 +44,10 @@ redis:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 128
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 oauth2:
   enabled: false

roles/web-app-decidim/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-decidim.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-discourse/meta/services.yml

@@ -75,11 +75,10 @@ discourse:
   pids_limit: 1024
   local_login_enabled: "{{ not (lookup('config', 'web-app-discourse', 'services.oidc.enabled') | bool) or (lookup('config', 'web-app-discourse', 'services.ldap.enabled')
     | bool) }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-discourse/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-discourse.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 #
@@ -33,6 +32,9 @@
 
 # variant 1: every dynamic flag off; postgres stays shared by design
 # (pinned in services.yml — see comment above).
+    css:
+      enabled: true
+      shared: true
 - services:
     asset:
       enabled: false
@@ -55,3 +57,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-fediwall/meta/services.yml

@@ -12,11 +12,10 @@ dashboard:
 matomo:
   enabled: true
   shared: true
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: email
 email:

roles/web-app-fediwall/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role.
 #
 # Variant 0 — defaults from meta/services.yml. Single wall, polls all
@@ -37,6 +36,9 @@
 # Variant 2 (false-pinning) — siblings opted out so the
 # variant-coverage matrix exercises the out-of-group_names branch
 # of every dynamic services flag.
+    css:
+      enabled: true
+      shared: true
 - services:
     mastodon:
       enabled: false
@@ -45,6 +47,9 @@
       enabled: false
       shared: false
 
+    css:
+      enabled: false
+      shared: false
 - services:
     mastodon:
       enabled: true
@@ -56,50 +61,53 @@
       # Variants replace lists wholesale (not deep-merged), so every
       # wall.config field is restated here — no template fallbacks.
       walls:
-        - slug: default
-          config:
-            servers:
-              - "{{ lookup('domain', 'web-app-mastodon') }}"
-              - "{{ lookup('domain', 'web-app-friendica') }}"
-            tags: []
-            accounts: []
-            loadPublic: true
-            loadFederated: false
-            loadTrends: false
-            languages: []
-            badWords: []
-            hideSensitive: true
-            hideBots: true
-            hideReplies: true
-            hideBoosts: false
-            limit: 20
-            interval: 10
-            title: Fediwall
-            theme: auto
-            showInfobar: true
-            showText: true
-            showMedia: true
-            playVideos: true
-        - slug: mastodon
-          config:
-            servers:
-              - "{{ lookup('domain', 'web-app-mastodon') }}"
-            tags: []
-            accounts: []
-            loadPublic: true
-            loadFederated: false
-            loadTrends: false
-            languages: []
-            badWords: []
-            hideSensitive: true
-            hideBots: true
-            hideReplies: true
-            hideBoosts: false
-            limit: 20
-            interval: 10
-            title: Mastodon
-            theme: auto
-            showInfobar: true
-            showText: true
-            showMedia: true
-            playVideos: true
+      - slug: default
+        config:
+          servers:
+          - "{{ lookup('domain', 'web-app-mastodon') }}"
+          - "{{ lookup('domain', 'web-app-friendica') }}"
+          tags: []
+          accounts: []
+          loadPublic: true
+          loadFederated: false
+          loadTrends: false
+          languages: []
+          badWords: []
+          hideSensitive: true
+          hideBots: true
+          hideReplies: true
+          hideBoosts: false
+          limit: 20
+          interval: 10
+          title: Fediwall
+          theme: auto
+          showInfobar: true
+          showText: true
+          showMedia: true
+          playVideos: true
+      - slug: mastodon
+        config:
+          servers:
+          - "{{ lookup('domain', 'web-app-mastodon') }}"
+          tags: []
+          accounts: []
+          loadPublic: true
+          loadFederated: false
+          loadTrends: false
+          languages: []
+          badWords: []
+          hideSensitive: true
+          hideBots: true
+          hideReplies: true
+          hideBoosts: false
+          limit: 20
+          interval: 10
+          title: Mastodon
+          theme: auto
+          showInfobar: true
+          showText: true
+          showMedia: true
+          playVideos: true
+    css:
+      enabled: false
+      shared: false

roles/web-app-fider/meta/services.yml

@@ -46,11 +46,10 @@ redis:
   backup:
     disabled: true
   enabled: false
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-fider/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-fider.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-flowise/meta/services.yml

@@ -71,11 +71,10 @@ redis:
 ollama:
   enabled: "{{ 'svc-ai-ollama' in group_names }}"
   shared: "{{ 'svc-ai-ollama' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-flowise/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Both auth-flow variants ride the same
 # `web-app-oauth2-proxy` sidecar in front of the Flowise web UI;
 # variant 0 is the canonical OIDC variant (Keycloak with local user
@@ -33,6 +32,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -58,6 +60,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -65,3 +70,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-friendica/meta/services.yml

@@ -53,7 +53,7 @@ oauth2:
   enabled: "{{ 'web-app-keycloak' in group_names }}"
   shared: "{{ 'web-app-keycloak' in group_names }}"
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-fusiondirectory/meta/services.yml

@@ -44,8 +44,7 @@ fusiondirectory:
   mem_reservation: 256m
   mem_limit: 1g
   pids_limit: 512
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"

roles/web-app-fusiondirectory/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides. `ldap` is pinned in `services.yml`
 # (`enabled: true`, `shared: true`) because LDAP IS the storage backend
 # for FusionDirectory — every variant inherits it, so the variant blocks
@@ -26,6 +25,9 @@
       shared: true
 
 # variant 1: Keycloak/federation surface off; LDAP-backed only.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -47,7 +49,13 @@
       shared: false
 
 # variant 2: LDAP-only path explicitly disables oauth2.
+    css:
+      enabled: false
+      shared: false
 - services:
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-gitea/meta/services.yml

@@ -69,11 +69,10 @@ oauth2:
       - /user/login
   enabled: "{{ 'web-app-keycloak' in group_names }}"
   shared: "{{ 'web-app-keycloak' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-gitea/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-gitea.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -34,6 +33,9 @@
     oidc:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -61,6 +63,9 @@
     oidc:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -71,3 +76,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-gitlab/meta/services.yml

@@ -42,10 +42,9 @@ gitlab:
     - web-app-keycloak
     - web-app-mailu
   lifecycle: beta
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-gitlab/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-gitlab.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-hugo/meta/services.yml

@@ -20,11 +20,10 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 hugo:
   image: nginx
   version: 1.31-alpine

roles/web-app-hugo/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-hugo.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-jenkins/meta/services.yml

@@ -33,8 +33,7 @@ jenkins:
   mem_reservation: 1g
   mem_limit: 2g
   pids_limit: 1024
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"

roles/web-app-jenkins/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides. Variant 0 is
 # the canonical OIDC variant (Jenkins's `oic-auth` plugin against
 # Keycloak). Variant 1 flips the role onto the `ldap` plugin against
@@ -25,6 +24,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     oidc:
       enabled: false
@@ -44,6 +46,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -51,3 +56,6 @@
     oidc:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-jira/meta/services.yml

@@ -40,10 +40,9 @@ jira:
     - web-app-matomo
     - web-app-mailu
   lifecycle: unsupported
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-jira/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
     prometheus:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -46,3 +48,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-joomla/meta/services.yml

@@ -50,11 +50,10 @@ joomla:
   mem_reservation: 256m
   mem_limit: 1g
   pids_limit: 512
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-joomla/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Variant 0 is the canonical OIDC variant
 # (default), where Joomla speaks OIDC natively via the `plg_system_keycloak`
 # plugin shipped under `files/joomla-oidc-plugin/`. Variant 1 flips
@@ -30,6 +29,9 @@
     prometheus:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     oidc:
       enabled: false
@@ -51,3 +53,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-keycloak/meta/services.yml

@@ -59,11 +59,10 @@ keycloak:
 postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — captcha backend, infrastructural
 recaptcha:

roles/web-app-keycloak/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -29,6 +28,9 @@
     prometheus:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - credentials:
     administrator_password: "'$tr0ng€xampl3PW!"
   services:
@@ -52,3 +54,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-kix/meta/services.yml

@@ -24,7 +24,7 @@ oauth2:
     - "roles/web-app-kix/administrator"
     - "roles/web-app-kix/user"
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-lam/meta/services.yml

@@ -34,10 +34,9 @@ oauth2:
     port: 80
   allowed_groups:
     - "{{ lookup('rbac_group_path', application_id='web-app-lam', role='administrator') }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-lam/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 #
@@ -28,6 +27,9 @@
       shared: true
 
 # variant 1: Keycloak/federation surface off; LDAP-backed only.
+    css:
+      enabled: true
+      shared: true
 - credentials:
     administrator_password: "'$tr0ng€xampl3PW!"
   services:
@@ -48,7 +50,13 @@
       shared: false
 
 # variant 2: LDAP-only path explicitly disables oauth2.
+    css:
+      enabled: false
+      shared: false
 - services:
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-listmonk/meta/services.yml

@@ -41,10 +41,9 @@ listmonk:
     - web-app-keycloak
     - web-app-mailu
   lifecycle: beta
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 hcaptcha:
   enabled: "{{ HCAPTCHA_ENABLED | bool }}"

roles/web-app-listmonk/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-listmonk.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -31,6 +30,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     asset:
       enabled: false
@@ -55,3 +57,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-littlejs/meta/services.yml

@@ -20,10 +20,9 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 javascript:
   enabled: true

roles/web-app-littlejs/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-littlejs.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-magento/meta/services.yml

@@ -67,10 +67,9 @@ search:
   mem_reservation: 1g
   mem_limit: 2g
   pids_limit: 1024
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-magento/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-magento.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -26,6 +25,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -45,3 +47,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-mailu/meta/services.yml

@@ -153,7 +153,7 @@ front:
   mem_limit: 1g
   pids_limit: 512
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-mastodon/meta/services.yml

@@ -62,10 +62,9 @@ sidekiq:
   mem_reservation: 1g
   mem_limit: 1.5g
   pids_limit: 512
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-mastodon/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-mastodon.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-matomo/meta/services.yml

@@ -62,7 +62,7 @@ redis:
     disabled: true
   enabled: false
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-matrix/meta/services.yml

@@ -54,11 +54,10 @@ matrix-chatgpt-bot:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 256
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-matrix/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-matrix.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-mattermost/meta/services.yml

@@ -48,11 +48,10 @@ redis:
   backup:
     disabled: true
   enabled: false
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-mattermost/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-mattermost.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-mig/meta/services.yml

@@ -40,11 +40,10 @@ mig:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 256
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-mig/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-mig.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-mini-qr/meta/services.yml

@@ -37,10 +37,9 @@ redis:
   backup:
     disabled: true
   enabled: false
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-mini-qr/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-mini-qr.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-minio/meta/services.yml

@@ -35,11 +35,10 @@ redis:
   backup:
     disabled: true
   enabled: false
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-minio/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Variant 0 is the canonical OIDC variant
 # (default). Variant 1 flips the role onto the LDAP variant so the
 # `oidc`/`ldap` Playwright variants both run end-to-end.
@@ -28,6 +27,9 @@
     ldap:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     oidc:
       enabled: false
@@ -50,6 +52,9 @@
     ldap:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -57,3 +62,6 @@
     oidc:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-mobilizon/meta/services.yml

@@ -35,10 +35,9 @@ mobilizon:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 256
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-mobilizon/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-mobilizon.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-moodle/meta/services.yml

@@ -68,7 +68,7 @@ cron:
   mem_limit: 256m
   pids_limit: 256
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-navigator/meta/services.yml

@@ -20,10 +20,9 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-navigator/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-navigator.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-nextcloud/meta/services.yml

@@ -252,7 +252,7 @@ talk_recording:
   pids_limit: 1024
   min_storage: 1GB
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-oauth2-proxy/meta/services.yml

@@ -10,10 +10,9 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 oauth2-proxy:
   image: quay.io/oauth2-proxy/oauth2-proxy
   version: latest

roles/web-app-oauth2-proxy/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-oauth2-proxy.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     logout:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-odoo/meta/services.yml

@@ -62,7 +62,7 @@ redis:
   mem_limit: 512m
   pids_limit: 256
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-opencloud/meta/services.yml

@@ -36,7 +36,7 @@ opencloud:
     - web-app-keycloak
   lifecycle: alpha
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-opentalk/meta/services.yml

@@ -113,7 +113,7 @@ recorder:
   mem_limit: 2g
   pids_limit: 1024
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-openwebui/meta/services.yml

@@ -41,7 +41,7 @@ redis:
     disabled: true
   enabled: false
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-peertube/meta/services.yml

@@ -47,7 +47,7 @@ peertube:
     - web-app-keycloak
   lifecycle: beta
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-pgadmin/meta/services.yml

@@ -37,10 +37,9 @@ oauth2:
     port: "80"
   allowed_groups:
     - "{{ lookup('rbac_group_path', application_id='web-app-pgadmin', role='administrator') }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-pgadmin/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-pgadmin.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -25,6 +24,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -43,3 +45,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-phpldapadmin/meta/services.yml

@@ -35,10 +35,9 @@ oauth2:
     port: 8080
   allowed_groups:
     - "{{ lookup('rbac_group_path', application_id='web-app-phpldapadmin', role='administrator') }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-phpldapadmin/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-phpldapadmin.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 #
@@ -26,6 +25,9 @@
       shared: true
 
 # variant 1: Keycloak/federation surface off; LDAP-backed only.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -44,7 +46,13 @@
       shared: false
 
 # variant 2: LDAP-only path explicitly disables oauth2.
+    css:
+      enabled: false
+      shared: false
 - services:
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-pixelfed/meta/services.yml

@@ -56,7 +56,7 @@ worker:
   pids_limit: 512
   min_storage: 5GB
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true

roles/web-app-postmarks/meta/services.yml

@@ -16,11 +16,10 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: email
 # nocheck: dynamic-flag
 email:

roles/web-app-postmarks/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for this role. Postmarks has no first-party OIDC or
 # LDAP integration, both auth-flow variants ride the same
 # `web-app-oauth2-proxy` sidecar in front of the Postmarks web UI.
@@ -26,6 +25,9 @@
     prometheus:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -42,3 +44,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-pretix/meta/services.yml

@@ -45,10 +45,9 @@ pretix:
     - web-app-keycloak
     - web-app-mailu
   lifecycle: beta
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-pretix/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-pretix.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -28,6 +27,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -49,3 +51,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-prometheus/meta/services.yml

@@ -22,11 +22,10 @@ matomo:
 email:
   enabled: "{{ 'web-app-mailu' in group_names }}"
   shared: "{{ 'web-app-mailu' in group_names }}"
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag — gated on services.oauth2.enabled, not on group_names
 # nocheck: playwright-service-flag — runtime DOM patch, no probe-able surface flag
 javascript:

roles/web-app-prometheus/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-prometheus.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -21,6 +20,9 @@
     oauth2:
       enabled: true
       shared: true
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -37,3 +39,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-roulette-wheel/meta/services.yml

@@ -20,10 +20,9 @@ dashboard:
 matomo:
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 roulette-wheel:
   image: node
   version: latest

roles/web-app-roulette-wheel/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-roulette-wheel.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-shopware/meta/services.yml

@@ -124,10 +124,9 @@ opensearch:
   mem_limit: 4g
   min_storage: 10GB
   pids_limit: 1024
-# nocheck: dynamic-flag
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"

roles/web-app-shopware/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-shopware.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -31,6 +30,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -58,6 +60,9 @@
 
 # LDAP-only variant: ldap on, oauth2 off so the
 # Playwright spec exercises the LDAP-bind login path.
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -65,3 +70,6 @@
     oauth2:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-sphinx/meta/services.yml

@@ -38,11 +38,10 @@ sphinx:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 256
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: email
 # nocheck: dynamic-flag
 email:

roles/web-app-sphinx/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-sphinx.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -17,6 +16,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -27,3 +29,6 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-taiga/meta/services.yml

@@ -94,11 +94,10 @@ protected:
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 128
-# nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
-  enabled: true
-  shared: true
+  enabled: "{{ 'web-svc-css' in group_names }}"
+  shared: "{{ 'web-svc-css' in group_names }}"
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
 javascript:

roles/web-app-taiga/meta/variants.yml

@@ -1,4 +1,3 @@
----
 # Matrix-deploy variant overrides for web-app-taiga.
 # See docs/contributing/artefact/files/role/variants.md for the file format.
 
@@ -31,6 +30,9 @@
 
 # variant pinning every dynamic services.yml flag to false so the
 # matrix also exercises the out-of-group_names branch.
+    css:
+      enabled: true
+      shared: true
 - services:
     dashboard:
       enabled: false
@@ -55,6 +57,9 @@
     prometheus:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false
 - services:
     ldap:
       enabled: true
@@ -62,3 +67,6 @@
     oidc:
       enabled: false
       shared: false
+    css:
+      enabled: false
+      shared: false

roles/web-app-wordpress/meta/services.yml

@@ -47,7 +47,7 @@ wordpress:
     - web-app-keycloak
   lifecycle: beta
 # nocheck: dynamic-flag
-# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
+# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
 css:
   enabled: false
   shared: true