---
# nocheck: playwright-service-flag — Tor Browser users need third-party assets
# served first-party; deploying tor therefore always deploys the mirror.
# nocheck: dynamic-flag — hard dependency: every tor deployment serves the mirror.
mirror:
  bond: 1
  enabled: true
  shared: true
tor: # nocheck: category-modes
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  # nocheck: default-placement-manager  node onion ingress: host-published SOCKS/DNS/Trans ports and the HiddenService loopback forward must live on the stack host
  placement: manager
  bond: 0.5
  enabled: true
  shared: true
  exclusive: true
  primary: true
  image: debian
  version: 13.7-slim
  custom: true
  name: tor
  node: ""
  use_entry_guards: true
  flavor: public
  forwards:
    ssh: true
    http: true
  egress:
    enabled: true
  timeout_multipliers:
    chutney: 2
    public: 5
  ports:
    local:
      socks: 9050
      trans: 9040
      dns: 9053
    onion:
      # nocheck: onion-flag  a SOCKS port anyone can reach is an open proxy, and SocksPolicy cannot refuse it because the forward arrives from the node's own address
      socks: false
      # nocheck: onion-flag  the transparent port takes its destination from the caller's routing, which an onion client does not share
      trans: false
      # nocheck: onion-flag  publishing the resolver would answer recursive queries for anyone holding the onion address
      dns: false
  min_storage: 100MB
  cpus: "0.25"
  mem_reservation: 128m
  mem_limit: 256m
  pids_limit: 128
  lifecycle: beta