---
qdrant:
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  # nocheck: default-placement-manager  central vector engine, on-disk state node-local in swarm (cannot live on NFS)
  placement: manager
  enabled: true
  shared: true
  bond: 1
  image: qdrant/qdrant
  name: qdrant
  version: v1.20.0
  min_storage: 270MB
  backup:
    database_routine: true
  cpus: "2.0"
  mem_reservation: 1g
  mem_limit: 2g
  pids_limit: 1024
  healthcheck:
    test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/6333; printf \"GET /readyz HTTP/1.0\\r\\n\\r\\n\" >&3; grep -q \"200 OK\" <&3'"]
    retries: 18
  ports:
    local:
      qdrant: 6333
    internal:
      qdrant: 6333
    onion:
      # nocheck: onion-flag  the vector store is read by the svc-ai roles in this stack; its MCP sidecar is the surface meant for outside callers
      qdrant: false
  lifecycle: beta
# nocheck: playwright-service-flag  internal adapter sidecar, covered by the role's MCP integration test
# nocheck: dockerfile-custom  the Dockerfile is owned by svc-ai-mcp-adapter and staged per instance, so every adapter-backed provider shares one audited build
# nocheck: dynamic-flag  the sidecar tracks this role's own mcp flag, not another role's presence; a group_names expression would decide its exposure from an unrelated deployment
qdrantmcp:
  enabled: "{{ lookup('config', 'svc-db-qdrant', 'mcp.enabled') | bool }}"
  shared: false
  image: python
  # nocheck: docker-version  base of the self-built stdlib adapter, not the served application
  version: "3.13.15-slim"
  custom: true
  name: qdrantmcp
  cpus: "0.25"
  mem_reservation: 24m
  mem_limit: 48m
  pids_limit: 64
  ports:
    internal:
      http: 8080
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag

# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
  bond: 1
  enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
  shared: true
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
openwebui:
  bond: 0.5
  enabled: "{{ 'web-app-openwebui' in group_names }}"
  shared: "{{ 'web-app-openwebui' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
hermes:
  bond: 0.5
  enabled: "{{ 'web-app-hermes' in group_names }}"
  shared: "{{ 'web-app-hermes' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
openclaw:
  bond: 0.5
  enabled: "{{ 'web-app-openclaw' in group_names }}"
  shared: "{{ 'web-app-openclaw' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
flowise:
  bond: 0.5
  enabled: "{{ 'web-app-flowise' in group_names }}"
  shared: "{{ 'web-app-flowise' in group_names }}"