---
openresty:
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  # nocheck: default-placement-manager  edge proxy + TLS terminator at a known IP; sys-front-inj-* Lua pipeline cannot ride the overlay yet (Future Extension: Traefik with Yaegi)
  placement: manager
  bond: 1
  enabled: true
  shared: true
  name: openresty
  ports:
    internal:
      http: 80
      https: 443
    public:
      http: 80
      https: 443
    onion:
      http: true
      # nocheck: onion-flag  the hidden service is already the transport encryption, and the onion address has no certificate a TLS listener could present
      https: false
  healthcheck:
    test: ["CMD", "openresty", "-t", "-q"]
  min_storage: 264MB
  backup:
    disabled: true
  cpus: 0.5
  mem_reservation: 1g
  mem_limit: 2g
  image: openresty/openresty
  version: 1.31.8.1-alpine
  custom: true
  lifecycle: beta
  pids_limit: 256
  worker_connections: 4096

# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag
# nocheck: dynamic-flag - proxy state is fully re-rendered by the deploy (configs, certs via binds), the backup consumer stays permanently off
container_backup:
  enabled: false
  shared: true