refactor(healthcheck): declare probes in services.yml, render them from one lookup

Seven include templates under sys-svc-container decided how a container was
probed, and they read their inputs from template-local `{% set %}` scope.
That scope leaks: a value set for one service silently reached every service
below it, which is how taiga's front and gateway ended up probing a port
declared for a different service, and how bluesky's frontend probed a PDS
endpoint.

Probes now live in utils/docker/healthcheck.py, one class per flavor behind a
PROBES registry, and each service declares its own:

    healthcheck:
      flavor: curl
      path: health/ready
      start_period: 20m

`port_key` picks another entry under ports.internal for the services that
expose their probe elsewhere (keycloak on management, nextcloud talk on
signaling). Without a flavor the entry must carry an explicit test argv, so a
missing declaration fails loudly instead of rendering a probe against nothing.

Rendering HEAD's templates against the new output confirms 49 of 56 call
sites are byte-identical; the remaining seven are covered by an Ansible run.
Three probes change on purpose: erpnext's backend gains a check it never had,
bluesky's frontend drops the leaked PDS path, and msmtp_curl moves from a
hardcoded localhost:80 to the service's own port on 127.0.0.1 like every
other flavor.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/lookup/container_healthcheck.py

@@ -0,0 +1,128 @@
+"""Lookup `container_healthcheck`: emit a service's healthcheck block.
+
+Single SPOT for every container probe in the repo. The service name is the
+only positional argument, everything else comes from the service's
+``meta/services.yml`` entry:
+
+    myservice:
+      ports:
+        internal:
+          http: 8080
+      healthcheck:
+        flavor: curl
+        path: health/ready
+        start_period: 20m
+
+``flavor`` picks the probe shape (see utils/docker/healthcheck.py); each
+flavor brings its own interval, timeout, retries and start_period, and any
+of those may be overridden next to it. Without a ``flavor`` the entry must
+carry an explicit ``test`` argv. ``port_key`` selects another entry below
+``ports.internal`` for services that expose their probe on a second port.
+
+Examples:
+
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
+    {{ lookup('container_healthcheck', service_name, samples=3) | indent(4) }}
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ansible.errors import AnsibleError
+from ansible.plugins.loader import lookup_loader
+from ansible.plugins.lookup import LookupBase
+
+from utils.docker.healthcheck import PROBES, build, known_flavors
+
+
+class LookupModule(LookupBase):
+    def run(
+        self,
+        terms: list[Any] | None,
+        variables: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> list[str]:
+        if not terms or not str(terms[0] or "").strip():
+            raise AnsibleError(
+                "container_healthcheck: pass the service name as the first argument, "
+                "e.g. lookup('container_healthcheck', service_name)"
+            )
+        service = str(terms[0]).strip()
+
+        self._vars = (
+            variables or getattr(self._templar, "available_variables", {}) or {}
+        )
+        self._application_id = kwargs.get("application_id") or self._vars.get(
+            "application_id"
+        )
+        if not self._application_id:
+            raise AnsibleError(
+                "container_healthcheck: no application_id in the play vars; "
+                "pass application_id= explicitly"
+            )
+
+        config = self._config(f"services.{service}.healthcheck", {})
+        config = config if isinstance(config, dict) else {}
+        flavor = str(config.get("flavor", "") or "").strip()
+        where = f"'{self._application_id}' service '{service}'"
+
+        if not flavor and not config.get("test"):
+            raise AnsibleError(
+                f"container_healthcheck: {where} declares no healthcheck.flavor, so "
+                f"healthcheck.test is required. Known flavors: {known_flavors()}."
+            )
+        if flavor and flavor not in PROBES:
+            raise AnsibleError(
+                f"container_healthcheck: unknown flavor '{flavor}' for {where}. "
+                f"Known flavors: {known_flavors()}."
+            )
+
+        return [build(flavor, config, **self._context(service, flavor, config, kwargs))]
+
+    def _context(
+        self,
+        service: str,
+        flavor: str,
+        config: dict[str, Any],
+        kwargs: dict[str, Any],
+    ) -> dict[str, Any]:
+        """Collect what the chosen flavor's probe asks for.
+
+        Args:
+            service: service key inside the application's services.yml.
+            flavor: the selected probe shape, empty for an explicit test.
+            config: that service's healthcheck entry.
+            kwargs: the call site's keyword arguments.
+        """
+        hostname = config.get("hostname", self._vars.get("container_hostname"))
+        port_key = str(config.get("port_key", "http") or "http")
+        context = {
+            "test": config.get("test"),
+            "port": self._config(f"services.{service}.ports.internal.{port_key}", "")
+            or "",
+            "path": str(config.get("path", "") or ""),
+            "hostname": str(hostname) if hostname else None,
+            "samples": int(kwargs.get("samples", config.get("samples", 1)) or 1),
+        }
+        if flavor == "msmtp_curl":
+            context.update(
+                email_enabled=bool(self._config("services.email.enabled", False)),
+                domain=self._lookup("domain", self._application_id),
+                blackhole=(self._lookup("users", "blackhole") or {}).get("email", ""),
+            )
+        return context
+
+    def _config(self, path: str, default: Any) -> Any:
+        """Read one services.yml value through the config SPOT, templated.
+
+        Args:
+            path: dotted config path below the application.
+            default: value returned when the path is absent.
+        """
+        return self._lookup("config", self._application_id, path, default)
+
+    def _lookup(self, name: str, *terms: Any) -> Any:
+        return lookup_loader.get(
+            name, loader=self._loader, templar=getattr(self, "_templar", None)
+        ).run(list(terms), variables=self._vars)[0]

roles/sys-svc-container/templates/healthcheck/curl.yml.j2

@@ -1,16 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test:
-        - "CMD"
-        - "curl"
-        - "-f"
-{% if container_hostname is defined %}
-        - "-H"
-        - "Host: {{ container_hostname }}"
-{% endif %}
-        - "http://127.0.0.1{{ (":" ~ container_port) if container_port else '' }}/{{ container_healthcheck | default('') }}"
-      interval: 1m
-      timeout: 10s
-      retries: 3
-      start_period: {{ container_healthcheck_start_period | default('30s') }}
-{{ "\n" }}

roles/sys-svc-container/templates/healthcheck/http.yml.j2

@@ -1,7 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:{{ container_port }}/ >/dev/null || curl -fsS http://127.0.0.1:{{ container_port }}/ >/dev/null"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: {{ container_healthcheck_start_period | default('20s') }}

roles/sys-svc-container/templates/healthcheck/http_status.yml.j2

@@ -1,12 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test:
-        - "CMD"
-        - "bash"
-        - "-c"
-        - "exec 3<>/dev/tcp/localhost/{{ container_port }} && echo -e 'GET /{{ container_healthcheck }} HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -n1 <&3 | grep -qE '^HTTP/1\\.[01] [23][0-9][0-9]'"
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: {{ container_healthcheck_start_period | default('30s') }}
-{{ "\n" }}

roles/sys-svc-container/templates/healthcheck/msmtp_curl.yml.j2

@@ -1,28 +0,0 @@
-{#
-  This health check ensures the test email is sent only once to prevent
-  hitting SMTP rate limits due to multiple health check executions.
-  The logic checks for a temporary file (/tmp/email_sent) to determine
-  if the email has already been sent. If the file exists, the email
-  is skipped, but the health check continues by verifying the HTTP service.
-  Additional it is also checked if the host is reachable.
-
-  When the role's `services.email.enabled` flag resolves to false (the
-  operator opted out of the email provider, or the SMTP host is missing
-  for any other reason), the msmtp branch is suppressed entirely so the
-  container does not flap into `unhealthy` because of an unrelated SMTP
-  outage. The HTTP probe stays the canonical liveness signal. #}
-    healthcheck:
-      test:
-        - CMD-SHELL
-        - >
-          {%+ if (lookup('config', application_id, 'services.email.enabled', false) | bool) -%}
-          if [ ! -f /tmp/email_sent ]; then
-            echo 'Subject: testmessage from {{ lookup("domain",application_id) }}\n\nSUCCESSFULL' | msmtp -t {{ lookup('users', 'blackhole').email }} && touch /tmp/email_sent;
-          fi &&
-          {%+ endif -%}
-          curl -f http://localhost:80/ || exit 1
-      interval: 30s
-      timeout: 20s
-      retries: 5
-      start_period: 120s
-{{ "\n" }}

roles/sys-svc-container/templates/healthcheck/nc.yml.j2

@@ -1,8 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost {{ container_port }} || exit 1"]
-      interval: 30s
-      timeout: 3s
-      retries: 3
-      start_period: {{ container_healthcheck_start_period | default('10s') }}
-{{ "\n" }}

roles/sys-svc-container/templates/healthcheck/tcp.yml.j2

@@ -1,12 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test:
-        - "CMD"
-        - "bash"
-        - "-c"
-        - "exec 3<>/dev/tcp/localhost/{{ container_port }} && echo -e 'GET /{{ container_healthcheck | default('') }} HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q 'HTTP/1'"
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: {{ container_healthcheck_start_period | default('30s') }}
-{{ "\n" }}

roles/sys-svc-container/templates/healthcheck/wget.yml.j2

@@ -1,13 +0,0 @@
-{% set container_port = container_port | default(lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http', '')) %}
-    healthcheck:
-      test:
-        - "CMD"
-        - "wget"
-        - "--spider"
-        - "--proxy=off"
-        - "http://127.0.0.1{{ (":" ~ container_port) if container_port else '' }}/{{ container_healthcheck | default('') }}"
-      interval: 1m
-      timeout: 10s
-      retries: 3
-      start_period: {{ container_healthcheck_start_period | default('30s') }}
-{{ "\n" }}

roles/web-app-akaunting/meta/services.yml

@@ -36,6 +36,9 @@ ldap:
   enabled: false
   shared: false
 akaunting:
+  healthcheck:
+    flavor: tcp
+    start_period: 10m
   modes:
     compose:
       enabled: true

roles/web-app-akaunting/templates/compose.yml.j2

@@ -1,5 +1,4 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
-  {% set container_healthcheck_start_period = '10m' %}
   {% set service_name = 'akaunting' %}
   {{ service_name }}:
 
@@ -12,7 +11,7 @@
     {{ lookup('compose_only', 'pull_policy', 'never') }}
     {{ lookup('container_ports', ['akaunting', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'akaunting') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
 

roles/web-app-bluesky/meta/services.yml

@@ -44,6 +44,8 @@ sso:
 # nocheck: playwright-service-flag - internal sub-component (multi-entity role)
 web:
   enabled: true
+  healthcheck:
+    flavor: tcp
   ports:
     local:
       http: 8031
@@ -109,6 +111,9 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 api:
+  healthcheck:
+    flavor: wget
+    path: xrpc/_health
   ports:
     local:
       http: 8030

roles/web-app-bluesky/templates/compose.yml.j2

@@ -1,8 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
-  {# nocheck: container-port-set-unused #}
-  {% set container_port = BLUESKY_PDS_INTERNAL_PORT | int %}
-  {% set container_healthcheck = 'xrpc/_health' %}
   {% set service_name = 'pds' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'pds') }}
@@ -10,13 +7,11 @@
     {{ lookup('container_volumes', application_id, 'pds') | indent(4) }}
     {{ lookup('container_ports', ['api', 'http', DOCKER_BIND_HOST]) | indent(4) }}
 
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', 'api') | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
   {% if BLUESKY_WEB_ENABLED %}
   {% set service_name = 'web' %}
-  {# nocheck: container-port-set-unused #}
-  {% set container_port = BLUESKY_WEB_INTERNAL_PORT | int %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
     command: ["bskyweb","serve"]
@@ -26,7 +21,7 @@
     {{ lookup('container_image', application_id, 'web', image=BLUESKY_WEB_IMAGE_CUSTOM) }}
     {{ lookup('compose_only', 'pull_policy', 'never') }}
     {{ lookup('container_ports', ['web', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
   {% set service_name = BLUESKY_BROKER_SERVICE %}

roles/web-app-bookwyrm/meta/services.yml

@@ -47,6 +47,8 @@ redis:
   mem_limit: 512m
   pids_limit: 512
 bookwyrm:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-bookwyrm/templates/compose.yml.j2

@@ -22,7 +22,7 @@
     hostname: "{{ BOOKWYRM_HOSTNAME }}"
     {{ lookup('container_ports', ['bookwyrm', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'bookwyrm') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-bridgy-fed/meta/services.yml

@@ -39,6 +39,8 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 bridgy-fed:
+  healthcheck:
+    flavor: tcp
   modes:
     compose:
       enabled: true

roles/web-app-bridgy-fed/templates/compose.yml.j2

@@ -10,7 +10,7 @@
     {{ lookup('compose_only', 'container_name', BRIDGY_CONTAINER) }}
     hostname: "{{ container_hostname }}"
     {{ lookup('container_ports', ['bridgy-fed', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-checkmk/meta/services.yml

@@ -48,6 +48,9 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 checkmk:
+  healthcheck:
+    flavor: curl
+    path: cmk/check_mk/login.py
   modes:
     compose:
       enabled: true

roles/web-app-checkmk/templates/compose.yml.j2

@@ -1,12 +1,11 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'checkmk' %}
-  {% set container_healthcheck = 'cmk/check_mk/login.py' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'checkmk') }}
     {{ lookup('compose_only', 'container_name', CHECKMK_NAME) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_ports', ['checkmk', 'http', DOCKER_BIND_HOST], ['checkmk', 'agent', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}

roles/web-app-chess/meta/services.yml

@@ -23,6 +23,8 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 chess:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-chess/templates/compose.yml.j2

@@ -6,7 +6,7 @@
     hostname: "{{ CHESS_HOSTNAME }}"
     {{ lookup('container_ports', ['chess', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, CHESS_SERVICE) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-confluence/meta/services.yml

@@ -28,6 +28,8 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 confluence:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-confluence/templates/compose.yml.j2

@@ -11,7 +11,7 @@
     hostname: '{{ CONFLUENCE_HOSTNAME}}'
     {{ lookup('container_ports', ['confluence', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'confluence') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-dashboard/meta/services.yml

@@ -27,6 +27,9 @@ matomo:
   shared: "{{ 'web-app-matomo' in group_names }}"
 # nocheck: playwright-service-flag — self-provider
 dashboard:
+  healthcheck:
+    flavor: tcp
+    start_period: 10m
   modes:
     compose:
       enabled: true

roles/web-app-dashboard/templates/compose.yml.j2

@@ -1,6 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'dashboard' %}
-  {% set container_healthcheck_start_period = '10m' %}
   {% set container_port = lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http') %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
@@ -11,7 +10,7 @@
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {{ lookup('compose_restart') }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}
 

roles/web-app-decidim/meta/services.yml

@@ -27,6 +27,9 @@ postgres:
   shared: "{{ 'svc-db-postgres' in group_names }}"
   enabled: true # nocheck: dynamic-flag
 decidim:
+  healthcheck:
+    flavor: curl
+    path: health_check
   modes:
     compose:
       enabled: true

roles/web-app-decidim/templates/compose.yml.j2

@@ -1,7 +1,6 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
   {% set service_name = 'decidim' %}
-  {% set container_healthcheck = 'health_check' %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
@@ -23,7 +22,7 @@
       - "{{ lookup('config', 'web-app-seaweedfs', 'domains.canonical.api') }}:host-gateway"
     {% endif %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}
 {{ lookup('compose_networks') }}

roles/web-app-erpnext/meta/services.yml

@@ -81,6 +81,9 @@ erpnext:
   pids_limit: 2048
 backend:
   name: erpnext-backend
+  healthcheck:
+    flavor: tcp
+    start_period: 10m
   ports:
     internal:
       http: 8000

roles/web-app-erpnext/templates/compose.yml.j2

@@ -8,6 +8,7 @@
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     entrypoint: ["bash", "-c", "{{ ERPNEXT_CONFIG_READY_GATE }} exec /usr/local/bin/entrypoint.sh /home/frappe/frappe-bench/env/bin/gunicorn --chdir=/home/frappe/frappe-bench/sites --bind=0.0.0.0:{{ ERPNEXT_BACKEND_PORT }} --threads=4 --workers=2 --worker-class=gthread --worker-tmp-dir=/dev/shm --timeout=120 --preload frappe.app:application"]
     {{ lookup('depends_on', {'configurator': 'service_completed_successfully'}) }}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_volumes', application_id, ERPNEXT_BACKEND_CONTAINER) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-espocrm/meta/services.yml

@@ -54,6 +54,9 @@ espocrm:
     local:
       websocket: 4002
       http: 8040
+  healthcheck:
+    flavor: curl
+    start_period: 15m
   run_after:
     - web-app-keycloak
     - web-app-mailu

roles/web-app-espocrm/templates/compose.yml.j2

@@ -1,7 +1,6 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
   {% set service_name = ESPOCRM_SERVICE %}
-  {% set container_healthcheck_start_period = '15m' %}
   {{ service_name }}:
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
       args:
@@ -17,7 +16,7 @@
     stop_signal: SIGTERM
     stop_grace_period: 30s
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_ports', ['espocrm', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-fediwall/meta/services.yml

@@ -44,6 +44,8 @@ friendica:
   enabled: "{{ 'web-app-friendica' in group_names }}"
   shared: "{{ 'web-app-friendica' in group_names }}"
 fediwall:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-fediwall/templates/compose.yml.j2

@@ -9,7 +9,7 @@
         FEDIWALL_DIST_DIR_REL:  "{{ FEDIWALL_DIST_DIR_REL }}"
     {{ lookup('container_image', application_id, 'fediwall') }}
     {{ lookup('container_ports', ['fediwall', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-friendica/meta/services.yml

@@ -2,6 +2,8 @@
 # nocheck: seaweedfs-required, object storage not implemented for this role
 # nocheck: playwright-service-flag, self-provider
 friendica:
+  healthcheck:
+    flavor: msmtp_curl
   modes:
     compose:
       enabled: true

roles/web-app-friendica/templates/compose.yml.j2

@@ -16,7 +16,7 @@
     {{ lookup('container_volumes', application_id, FRIENDICA_SERVICE) | indent(4) }}
     {{ lookup('container_ports', ['friendica', 'http', DOCKER_BIND_HOST]) | indent(4) }}
 
-    {% include 'roles/sys-svc-container/templates/healthcheck/msmtp_curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
 

roles/web-app-fusiondirectory/meta/services.yml

@@ -35,6 +35,8 @@ sso:
     allowed_groups:
       - "{{ lookup('rbac_group_path', application_id='web-app-fusiondirectory', role='administrator') }}"
 fusiondirectory:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-fusiondirectory/templates/compose.yml.j2

@@ -6,7 +6,7 @@
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_ports', ['fusiondirectory', 'http', DOCKER_BIND_HOST]) | indent(4) }}
 {{ lookup('container_volumes', application_id, 'fusiondirectory') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-gitea/meta/services.yml

@@ -59,6 +59,8 @@ gitea:
   mem_reservation: 1g
   mem_limit: 2g
   pids_limit: 1024
+  healthcheck:
+    flavor: curl
   title: "{{ SOFTWARE_NAME }} Code Hub"
   configuration:
     repository:

roles/web-app-gitea/templates/compose.yml.j2

@@ -9,7 +9,7 @@
               ['gitea', 'http', DOCKER_BIND_HOST],
               ['gitea', 'ssh']) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'gitea') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
 

roles/web-app-gitlab/meta/services.yml

@@ -79,6 +79,10 @@ webservice:
   mem_limit: 6g
   pids_limit: 2048
 sidekiq:
+  healthcheck:
+    flavor: tcp
+    path: liveness
+    start_period: 300s
   image: registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce
   version: v19.1.2
   name: gitlab-sidekiq

roles/web-app-gitlab/templates/compose.yml.j2

@@ -48,8 +48,6 @@
     {{ lookup('container_networks') | indent(4) }}
 
   {% set service_name = GITLAB_SIDEKIQ_SERVICE_NAME %}
-  {% set container_healthcheck = 'liveness' %}
-  {% set container_healthcheck_start_period = '300s' %}
   {{ service_name }}:
     {{ lookup('compose_only', 'container_name', GITLAB_SIDEKIQ_CONTAINER) }}
     {{ lookup('container_image', application_id, service_name) }}
@@ -58,7 +56,7 @@
       CONFIG_TEMPLATE_DIRECTORY: "/var/opt/gitlab/config/templates"
       CONFIG_DIRECTORY: "/srv/gitlab/config"
     command: ["/scripts/wait-for-deps", "/scripts/process-wrapper"]
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_depends_on', application_id, extra={
   GITLAB_MIGRATIONS_SERVICE_NAME: {'condition': 'service_completed_successfully'},
   GITLAB_WEBSERVICE_SERVICE_NAME: {'condition': 'service_started'},

roles/web-app-hugo/meta/services.yml

@@ -24,6 +24,8 @@ css:
   enabled: "{{ 'web-svc-css' in group_names }}"
   shared: "{{ 'web-svc-css' in group_names }}"
 hugo:
+  healthcheck:
+    flavor: wget
   modes:
     compose:
       enabled: true

roles/web-app-hugo/templates/compose.yml.j2

@@ -15,7 +15,7 @@
     {{ lookup('container_ports', ['hugo', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}
 

roles/web-app-jellyfin/meta/services.yml

@@ -52,6 +52,9 @@ jellyfin:
       http: 8096
     local:
       http: 8088
+  healthcheck:
+    flavor: curl
+    path: health
   run_after:
     - web-app-keycloak
     - svc-db-openldap

roles/web-app-jellyfin/templates/compose.yml.j2

@@ -1,12 +1,11 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'jellyfin' %}
-  {% set container_healthcheck = 'health' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'jellyfin') }}
     {{ lookup('compose_only', 'container_name', JELLYFIN_NAME) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_ports', ['jellyfin', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}

roles/web-app-jenkins/meta/services.yml

@@ -25,6 +25,10 @@ ldap:
   enabled: "{{ 'svc-db-openldap' in group_names }}"
   shared: "{{ 'svc-db-openldap' in group_names }}"
 jenkins:
+  healthcheck:
+    flavor: curl
+    path: login
+    start_period: 10m
   modes:
     compose:
       enabled: true

roles/web-app-jenkins/templates/compose.yml.j2

@@ -1,6 +1,4 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
-  {% set container_healthcheck = 'login' %}
-  {% set container_healthcheck_start_period = '10m' %}
   {% set service_name = 'jenkins' %}
   {{ service_name }}:
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
@@ -15,7 +13,7 @@
       CASC_JENKINS_CONFIG: /var/jenkins_home/casc.yaml
     {{ lookup('container_ports', ['jenkins', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'jenkins') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-jira/meta/services.yml

@@ -28,6 +28,8 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 jira:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-jira/templates/compose.yml.j2

@@ -11,7 +11,7 @@
     hostname: '{{ JIRA_HOSTNAME }}'
     {{ lookup('container_ports', ['jira', 'http', DOCKER_BIND_HOST]) | indent(4) }}
 {{ lookup('container_volumes', application_id, 'jira') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-joomla/meta/services.yml

@@ -33,6 +33,9 @@ mariadb:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 joomla:
+  healthcheck:
+    flavor: curl
+    start_period: 15m
   modes:
     compose:
       enabled: true

roles/web-app-joomla/templates/compose.yml.j2

@@ -1,6 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'joomla' %}
-  {% set container_healthcheck_start_period = '15m' %}
   {{ service_name }}:
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
       args:
@@ -13,7 +12,7 @@
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {{ lookup('container_ports', ['joomla', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
 

roles/web-app-keycloak/meta/services.yml

@@ -30,6 +30,11 @@ email:
   shared: "{{ 'web-app-mailu' in group_names }}"
 # nocheck: playwright-service-flag — self-provider
 keycloak:
+  healthcheck:
+    flavor: http_status
+    path: health/ready
+    port_key: management
+    start_period: 180s
   modes:
     compose:
       enabled: true

roles/web-app-keycloak/templates/compose.yml.j2

@@ -1,9 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
-  {# nocheck: container-port-set-unused #}
-  {% set container_port = lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.management') %}
-  {% set container_healthcheck = 'health/ready' %}
-  {% set container_healthcheck_start_period = '180s' %}
   {% set service_name = 'keycloak' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'keycloak') }}
@@ -15,7 +11,7 @@
     {{ lookup('container_volumes', application_id, 'keycloak') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/http_status.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id,
 ) }}

roles/web-app-listmonk/meta/services.yml

@@ -51,6 +51,9 @@ listmonk:
       http: 9000
     local:
       http: 8019
+  healthcheck:
+    flavor: wget
+    path: health
   public_api_activated: false
   run_after:
     - web-app-matomo

roles/web-app-listmonk/templates/compose.yml.j2

@@ -1,5 +1,4 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
-  {% set container_healthcheck = 'health' %}
   {% set service_name = 'listmonk' %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
@@ -10,7 +9,7 @@
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id,
 ) }}

roles/web-app-magento/meta/services.yml

@@ -72,6 +72,8 @@ redis:
 # nocheck: shared
 # nocheck: dynamic-flag
 search:
+  healthcheck:
+    flavor: tcp
   ports:
     internal:
       http: 9200

roles/web-app-magento/templates/compose.yml.j2

@@ -37,7 +37,7 @@
       - discovery.type=single-node
       - plugins.security.disabled=true
       - OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-mastodon/meta/services.yml

@@ -65,6 +65,9 @@ mastodon:
       websocket: 4000
   proxy:
     service_key: mastodon
+  healthcheck:
+    flavor: wget
+    path: health
   run_after:
     - web-app-keycloak
   lifecycle: beta
@@ -77,8 +80,18 @@ streaming:
   mem_limit: 512m
   pids_limit: 256
   min_storage: 309MB
+  ports:
+    internal:
+      http: 4000
+  healthcheck:
+    flavor: wget
+    path: api/v1/streaming/health
 sidekiq:
   name: mastodon-sidekiq
+  healthcheck:
+    test: ["CMD-SHELL", "pgrep -f sidekiq || exit 1"]
+    interval: 1m
+    timeout: 10s
   cpus: "0.8"
   mem_reservation: 1g
   mem_limit: 1.5g

roles/web-app-mastodon/templates/compose.yml.j2

@@ -1,25 +1,15 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
-{% macro mastodon_service(name, container, image_key, command, ports_key=none, hc_port=none, hc_path=none, hc_test=none, with_volumes=false, after_migrate=true, restart=none) -%}
+{% macro mastodon_service(name, container, image_key, command, ports_key=none, healthcheck=true, with_volumes=false, after_migrate=true, restart=none) -%}
   {% set service_name = name %}
 {% if restart is not none %}{% set docker_restart_policy = restart %}{% endif %}
-{# nocheck: container-port-set-unused #}
-{% if hc_port is not none %}{% set container_port = hc_port %}{% endif %}
-{% if hc_path is not none %}{% set container_healthcheck = hc_path %}{% endif %}
   {{ service_name }}:
     {{ lookup('compose_only', 'container_name', container) }}
     {{ lookup('container_image', application_id, image_key) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     command: {{ command }}
-    {% if hc_path is not none %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
-    {% endif %}
-    {% if hc_test is not none %}
-    healthcheck:
-      test: {{ hc_test }}
-      interval: 1m
-      timeout: 10s
-      retries: 3
+    {% if healthcheck %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% endif %}
     {% if ports_key is not none %}
     {{ lookup('container_ports', ['mastodon', ports_key, DOCKER_BIND_HOST]) | indent(4) }}
@@ -37,10 +27,10 @@
     {{ lookup('container_networks') | indent(4) }}
 {% endmacro -%}
 
-{{ mastodon_service(MASTODON_SERVICE_NAME, MASTODON_CONTAINER, 'mastodon', 'bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"', ports_key='http', hc_port=3000, hc_path='health', with_volumes=true) }}
-{{ mastodon_service(MASTODON_STREAMING_SERVICE_NAME, MASTODON_STREAMING_CONTAINER, 'streaming', 'node ./streaming', ports_key='websocket', hc_port=4000, hc_path='api/v1/streaming/health') }}
-{{ mastodon_service(MASTODON_SIDEKIQ_SERVICE_NAME, MASTODON_SIDEKIQ_CONTAINER, 'mastodon', 'bundle exec sidekiq', hc_test='["CMD-SHELL", "pgrep -f sidekiq || exit 1"]', with_volumes=true) }}
-{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', after_migrate=false, restart='on-failure') }}
+{{ mastodon_service(MASTODON_SERVICE_NAME, MASTODON_CONTAINER, 'mastodon', 'bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"', ports_key='http', with_volumes=true) }}
+{{ mastodon_service(MASTODON_STREAMING_SERVICE_NAME, MASTODON_STREAMING_CONTAINER, 'streaming', 'node ./streaming', ports_key='websocket') }}
+{{ mastodon_service(MASTODON_SIDEKIQ_SERVICE_NAME, MASTODON_SIDEKIQ_CONTAINER, 'mastodon', 'bundle exec sidekiq', with_volumes=true) }}
+{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', healthcheck=false, after_migrate=false, restart='on-failure') }}
 
 {{ lookup('compose_volumes', application_id) }}
 {{ lookup('compose_networks') }}

roles/web-app-matrix/meta/services.yml

@@ -36,6 +36,8 @@ postgres:
   enabled: true # nocheck: dynamic-flag — matrix always needs a database
   shared: "{{ 'svc-db-postgres' in group_names }}"
 synapse:
+  healthcheck:
+    flavor: curl
   version: v1.156.0
   image: matrixdotorg/synapse
   name: matrix-synapse
@@ -54,6 +56,8 @@ synapse:
   mem_limit: "2g"
   pids_limit: 2048
 element:
+  healthcheck:
+    flavor: wget
   version: v1.12.23
   image: vectorim/element-web
   name: matrix-element

roles/web-app-matrix/templates/flavor/compose/services.yml.j2

@@ -17,7 +17,7 @@
       - SYNAPSE_REPORT_STATS=no
     ports:
       - "{{ DOCKER_BIND_HOST }}:{{lookup('config', 'web-app-matrix', 'services.synapse.ports.local.http')}}:{{ container_port }}"
-{% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 {% set _synapse_bridge_deps = {} %}
 {% for item in MATRIX_BRIDGES %}
 {%   set _ = _synapse_bridge_deps.__setitem__('mautrix-' ~ item.bridge_name, {'condition': 'service_healthy'}) %}
@@ -34,7 +34,7 @@
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     ports:
       - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_ELEMENT_PORT }}:{{ container_port }}"
-{% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {% for item in MATRIX_BRIDGES %}

roles/web-app-mediawiki/meta/services.yml

@@ -27,6 +27,9 @@ mariadb:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 mediawiki:
+  healthcheck:
+    flavor: tcp
+    start_period: 5m
   modes:
     compose:
       enabled: true

roles/web-app-mediawiki/templates/compose.yml.j2

@@ -1,6 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = entity_name %}
-  {% set container_healthcheck_start_period = '5m' %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
@@ -11,7 +10,7 @@
     {{ lookup('container_image', application_id, 'mediawiki') }}
     {{ lookup('container_volumes', application_id, entity_name) | indent(4) }}
     {{ lookup('container_ports', ['mediawiki', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
 

roles/web-app-mig/meta/services.yml

@@ -26,6 +26,8 @@ redis:
   backup:
     disabled: true
 mig:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-mig/templates/compose.yml.j2

@@ -6,7 +6,7 @@
     {{ lookup('compose_only', 'container_name', MIG_CONTAINER) }}
     {{ lookup('container_ports', ['mig', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 {{ lookup('compose_volumes', application_id) }}
 
 {{ lookup('compose_networks') }}

roles/web-app-mobilizon/meta/services.yml

@@ -30,6 +30,8 @@ postgres:
     - pg_trgm
     - unaccent
 mobilizon:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-mobilizon/templates/compose.yml.j2

@@ -5,7 +5,7 @@
     {{ lookup('compose_only', 'container_name', mobilizon_container) }}
     {{ lookup('container_volumes', application_id, 'mobilizon') | indent(4) }}
     {{ lookup('container_ports', ['mobilizon', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-n8n/meta/services.yml

@@ -42,6 +42,10 @@ postgres:
   enabled: true
   shared: "{{ 'svc-db-postgres' in group_names }}"
 n8n:
+  healthcheck:
+    flavor: wget
+    path: healthz
+    start_period: 5m
   modes:
     compose:
       enabled: true

roles/web-app-n8n/templates/compose.yml.j2

@@ -1,14 +1,12 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
   {% set service_name = 'n8n' %}
-  {% set container_healthcheck = 'healthz' %}
-  {% set container_healthcheck_start_period = '5m' %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_image', application_id, service_name) }}
     {{ lookup('compose_only', 'container_name', N8N_CONTAINER) }}
     {{ lookup('container_ports', ['n8n', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-nextcloud/meta/services.yml

@@ -100,6 +100,9 @@ nextcloud:
   lifecycle: beta
 proxy:
   name: nextcloud-proxy
+  healthcheck:
+    flavor: curl
+    start_period: 20m
   image: nginx
   version: 1.31.2-alpine
   backup:
@@ -141,6 +144,10 @@ talk:
   ports:
     internal:
       signaling: 8081
+  healthcheck:
+    flavor: tcp
+    port_key: signaling
+    start_period: 20m
 whiteboard:
   name: nextcloud-whiteboard
   image: ghcr.io/nextcloud-releases/whiteboard
@@ -153,6 +160,12 @@ whiteboard:
   mem_limit: 1g
   pids_limit: 1024
   min_storage: 683MB
+  ports:
+    internal:
+      http: 3002
+  healthcheck:
+    flavor: nc
+    start_period: 20m
 # nocheck: playwright-service-flag: infrastructural sub-component (collaborative editing)
 onlyoffice:
   bond: 0.5

roles/web-app-nextcloud/templates/compose.yml.j2

@@ -1,6 +1,4 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
-  {% set container_healthcheck_start_period = '20m' %}
-
   {% set service_name = NEXTCLOUD_PROXY_SERVICE %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
@@ -11,7 +9,7 @@
     {{ lookup('compose_restart') }}
     {{ lookup('container_ports', ['nextcloud', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2'  %}
+    {{ lookup('container_healthcheck', service_name, samples=(groups[application_id] | default([]) | length) if DEPLOYMENT_MODE == 'swarm' else 1) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {% if NEXTCLOUD_HPB_NETWORK_MODE == 'host' %}
     extra_hosts:
@@ -19,6 +17,7 @@
     {% endif %}
 
   {% set service_name = NEXTCLOUD_SERVICE %}
+  {% set container_healthcheck_start_period = '20m' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'nextcloud') }}
     {{ lookup('compose_only', 'container_name', NEXTCLOUD_CONTAINER) }}
@@ -46,7 +45,7 @@
   {% set container_port = NEXTCLOUD_HPB_SIGNALING_PORT %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_image', application_id, 'talk') }}
     {{ lookup('compose_only', 'container_name', NEXTCLOUD_HPB_CONTAINER) }}
     init: true
@@ -76,7 +75,7 @@
       dockerfile: {{ NEXTCLOUD_WHITEBOARD_SERVICE_DOCKERFILE }}
     {{ lookup('compose_only', 'pull_policy', 'never') }}
     {{ lookup('container_image', application_id, 'whiteboard') }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/nc.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('compose_only', 'container_name', NEXTCLOUD_WHITEBOARD_CONTAINER) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     environment:

roles/web-app-nextcloud/vars/main.yml

@@ -125,7 +125,7 @@ NEXTCLOUD_WHITEBOARD_CONTAINER: "{{ lookup('config', application_id, 'services.'
 NEXTCLOUD_WHITEBOARD_IMAGE: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'.image') }}"
 NEXTCLOUD_WHITEBOARD_VERSION: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'.version') }}"
 NEXTCLOUD_WHITEBOARD_ENABLED: "{{ lookup('config', application_id, 'addons.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'.enabled') }}"
-NEXTCLOUD_WHITEBOARD_PORT_INTERNAL: "3002"
+NEXTCLOUD_WHITEBOARD_PORT_INTERNAL: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~ '.ports.internal.http') }}"
 NEXTCLOUD_WHITEBOARD_JWT: "{{ lookup('config', application_id, 'credentials.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'_jwt_secret') }}"
 NEXTCLOUD_WHITEBOARD_LOCATION: "/whiteboard/"
 NEXTCLOUD_WHITEBOARD_URL: "{{ [ NEXTCLOUD_URL, NEXTCLOUD_WHITEBOARD_LOCATION ] | url_join }}"

roles/web-app-odoo/meta/services.yml

@@ -31,6 +31,10 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 odoo:
+  healthcheck:
+    flavor: tcp
+    path: web/health
+    start_period: 5m
   modes:
     compose:
       enabled: true

roles/web-app-odoo/templates/compose.yml.j2

@@ -1,8 +1,6 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
   {% set container_port = lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.http') %}
-  {% set container_healthcheck = 'web/health' %}
-  {% set container_healthcheck_start_period = '5m' %}
   {% set service_name = ODOO_SERVICE %}
   {{ service_name }}:
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
@@ -17,7 +15,7 @@
     stop_signal: SIGTERM
     stop_grace_period: 30s
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_ports',
               ['odoo', 'http', DOCKER_BIND_HOST],
               ['odoo', 'websocket', DOCKER_BIND_HOST]) | indent(4) }}

roles/web-app-openproject/meta/services.yml

@@ -37,6 +37,9 @@ seaweedfs:
   shared: "{{ 'web-app-seaweedfs' in group_names }}"
 web:
   name: openproject-web
+  healthcheck:
+    flavor: curl
+    path: health_checks/default
   ports:
     internal:
       http: 8080

roles/web-app-openproject/templates/compose.yml.j2

@@ -29,7 +29,6 @@ x-op-app: &app
     {{ lookup('container_volumes', application_id, 'proxy') | indent(4) }}
 
   {% set service_name = OPENPROJECT_WEB_SERVICE %}
-  {% set container_healthcheck = 'health_checks/default' %}
   {{ service_name }}:
     <<: *app
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
@@ -40,7 +39,7 @@ x-op-app: &app
   'cache': {'condition': 'service_started'},
   OPENPROJECT_SEEDER_SERVICE: {'condition': 'service_started'},
 }) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_volumes', application_id, OPENPROJECT_WEB_SERVICE) | indent(4) }}
 
   {% set service_name = 'worker' %}

roles/web-app-peertube/meta/services.yml

@@ -50,6 +50,8 @@ seaweedfs:
   public: true
 # nocheck: playwright-service-flag: shared provider entity; the app itself is covered by this role's own Playwright spec
 peertube:
+  healthcheck:
+    flavor: tcp
   modes:
     compose:
       enabled: true

roles/web-app-peertube/templates/compose.yml.j2

@@ -26,6 +26,6 @@
       nproc:  8192
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 {{ lookup('compose_volumes', application_id) }}
 {{ lookup('compose_networks') }}

roles/web-app-penpot/meta/services.yml

@@ -51,6 +51,8 @@ seaweedfs:
   enabled: "{{ 'web-app-seaweedfs' in group_names }}"
   shared: "{{ 'web-app-seaweedfs' in group_names }}"
 penpot:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-penpot/templates/compose.yml.j2

@@ -1,7 +1,5 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
-  {# nocheck: container-port-set-unused #}
-  {% set container_port = PENPOT_FRONTEND_INTERNAL_PORT %}
   {% set service_name = PENPOT_FRONTEND_SERVICE %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
@@ -13,7 +11,7 @@
       - 'until getent hosts {{ PENPOT_BACKEND_SERVICE }} >/dev/null 2>&1 && getent hosts {{ PENPOT_EXPORTER_SERVICE }} >/dev/null 2>&1; do sleep 1; done; exec nginx -g "daemon off;"'
     {{ lookup('container_ports', ['penpot', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', 'penpot') | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {{ lookup('container_depends_on', application_id, extra={
   PENPOT_BACKEND_SERVICE: {'condition': 'service_started'},

roles/web-app-penpot/vars/main.yml

@@ -13,7 +13,6 @@ PENPOT_EXPORTER_SERVICE: "exporter"
 
 PENPOT_BACKEND_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, PENPOT_BACKEND_SERVICE) }}"
 
-PENPOT_FRONTEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.penpot.ports.internal.http') }}"
 PENPOT_BACKEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.backend.ports.internal.http') }}"
 PENPOT_EXPORTER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.exporter.ports.internal.http') }}"
 

roles/web-app-pgadmin/meta/services.yml

@@ -1,6 +1,9 @@
 ---
 # nocheck: seaweedfs-required — object storage not implemented for this role
 pgadmin:
+  healthcheck:
+    flavor: wget
+    start_period: 10m
   modes:
     compose:
       enabled: true

roles/web-app-pgadmin/templates/compose.yml.j2

@@ -1,7 +1,6 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
 
   {% set service_name = entity_name %}
-  {% set container_healthcheck_start_period = '10m' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'pgadmin') }}
     {{ lookup('compose_only', 'container_name', entity_name) }}
@@ -9,7 +8,7 @@
     {{ lookup('container_ports', ['pgadmin', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_volumes', application_id, entity_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-phpmyadmin/meta/services.yml

@@ -17,6 +17,8 @@ mariadb:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 phpmyadmin:
+  healthcheck:
+    flavor: tcp
   modes:
     compose:
       enabled: true

roles/web-app-phpmyadmin/templates/compose.yml.j2

@@ -8,7 +8,7 @@
     {{ lookup('container_ports', ['phpmyadmin', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}
 

roles/web-app-pihole/meta/services.yml

@@ -54,6 +54,8 @@ sso:
     allowed_groups:
       - "{{ lookup('rbac_group_path', application_id='web-app-pihole', role='administrator') }}"
 pihole:
+  healthcheck:
+    flavor: tcp
   modes:
     compose:
       enabled: true

roles/web-app-pihole/templates/compose.yml.j2

@@ -14,7 +14,7 @@
     cap_add:
       - NET_ADMIN
     {{ lookup('container_volumes', application_id, 'pihole') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-postmarks/meta/services.yml

@@ -38,6 +38,8 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 postmarks:
+  healthcheck:
+    flavor: tcp
   modes:
     compose:
       enabled: true

roles/web-app-postmarks/templates/compose.yml.j2

@@ -10,7 +10,7 @@
     {{ lookup('compose_only', 'container_name', POSTMARKS_CONTAINER) }}
     hostname: "{{ container_hostname }}"
     {{ lookup('container_ports', ['postmarks', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/tcp.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_networks') | indent(4) }}
 

roles/web-app-pretix/meta/services.yml

@@ -40,6 +40,8 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 pretix:
+  healthcheck:
+    flavor: curl
   modes:
     compose:
       enabled: true

roles/web-app-pretix/templates/compose.yml.j2

@@ -12,7 +12,7 @@
     command: ["all"]
     {{ lookup('container_ports', ['pretix', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, 'pretix') | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-semaphore/meta/services.yml

@@ -39,6 +39,9 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 semaphore:
+  healthcheck:
+    flavor: wget
+    path: api/ping
   modes:
     compose:
       enabled: true

roles/web-app-semaphore/templates/compose.yml.j2

@@ -1,12 +1,11 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'semaphore' %}
-  {% set container_healthcheck = 'api/ping' %}
   {{ service_name }}:
     {{ lookup('container_image', application_id, 'semaphore') }}
     {{ lookup('compose_only', 'container_name', SEMAPHORE_NAME) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_ports', ['semaphore', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/wget.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}

roles/web-app-sphinx/meta/services.yml

@@ -35,6 +35,8 @@ sphinx:
       http: 8000
     local:
       http: 8036
+  healthcheck:
+    flavor: curl
   run_after:
     - web-app-matomo
   lifecycle: beta

roles/web-app-sphinx/templates/compose.yml.j2

@@ -5,7 +5,7 @@
     {{ lookup('container_image', application_id, 'sphinx') }}
     {{ lookup('compose_only', 'container_name', SPHINX_CONTAINER) }}
     {{ lookup('container_ports', ['sphinx', 'http', DOCKER_BIND_HOST]) | indent(4) }}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
 {{ lookup('compose_volumes', application_id) }}

roles/web-app-suitecrm/meta/services.yml

@@ -34,6 +34,9 @@ mariadb:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 suitecrm:
+  healthcheck:
+    flavor: curl
+    start_period: 20m
   modes:
     compose:
       enabled: true

roles/web-app-suitecrm/templates/compose.yml.j2

@@ -1,6 +1,4 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
-  {% set container_healthcheck_start_period = '20m' %}
-
   {% set service_name = SUITECRM_SERVICE %}
   {{ service_name }}:
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
@@ -21,7 +19,7 @@
     stop_signal: SIGTERM
     stop_grace_period: 30s
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_ports', ['suitecrm', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}

roles/web-app-taiga/meta/services.yml

@@ -68,6 +68,11 @@ async:
   mem_limit: 1.5g
   pids_limit: 512
 front:
+  healthcheck:
+    flavor: http
+  ports:
+    internal:
+      http: 80
   image: node
   version: 26-alpine
   cpus: "0.3"
@@ -75,6 +80,11 @@ front:
   mem_limit: 512m
   pids_limit: 256
 gateway:
+  healthcheck:
+    flavor: http
+  ports:
+    internal:
+      http: 80
   image: nginx
   version: alpine
   cpus: "0.3"

roles/web-app-taiga/templates/compose.yml.j2

@@ -80,8 +80,6 @@ build:
       taiga:
 
   {% set service_name = TAIGA_FRONT_SERVICE %}
-  {# nocheck: container-port-set-unused #}
-  {% set container_port = lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.http') %}
   {{ service_name }}:
     {{ lookup('compose_only', 'container_name', TAIGA_CONTAINER ~ '-' ~ service_name) }}
     {% if TAIGA_OIDC_ENABLED | bool %}
@@ -94,7 +92,7 @@ build:
     {{ lookup('container_image', application_id, 'front', image='taigaio/taiga-front', version=TAIGA_VERSION) }}
     {% endif %}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/http.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
@@ -152,7 +150,7 @@ build:
     {{ lookup('container_ports', ['taiga', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
-    {% include 'roles/sys-svc-container/templates/healthcheck/http.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
 
     {{ lookup('container_networks') | indent(4) }}
       taiga:

roles/web-app-wordpress/meta/services.yml

@@ -27,6 +27,8 @@ discourse:
   enabled: "{{ 'web-app-discourse' in group_names }}"
   shared: "{{ 'web-app-discourse' in group_names }}"
 wordpress:
+  healthcheck:
+    flavor: msmtp_curl
   modes:
     compose:
       enabled: true

roles/web-app-wordpress/templates/compose.yml.j2

@@ -12,7 +12,7 @@
     {{ lookup('container_ports', ['wordpress', 'http', DOCKER_BIND_HOST]) | indent(4) }}
 {{ lookup('container_volumes', application_id, 'wordpress') | indent(4) }}
 
-    {% include 'roles/sys-svc-container/templates/healthcheck/msmtp_curl.yml.j2' %}
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}