---
sso:
  bond: 1
  enabled: "{{ 'web-app-keycloak' in group_names }}"
  shared: "{{ 'web-app-keycloak' in group_names }}"
  flavor: oauth2
  oauth2:
    origin:
      host: web
      port: 80
ldap:
  bond: 1
  enabled: "{{ 'svc-db-openldap' in group_names }}"
  shared: "{{ 'svc-db-openldap' in group_names }}"
logout:
  bond: 1
  enabled: "{{ 'web-svc-logout' in group_names }}"
  shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
  bond: 1
  enabled: "{{ 'web-app-dashboard' in group_names }}"
  shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
prometheus:
  bond: 1
  enabled: "{{ 'web-app-prometheus' in group_names }}"
  shared: "{{ 'web-app-prometheus' in group_names }}"
# nocheck: playwright-service-flag - email not used by Jitsi room flow
email:
  bond: 1
  enabled: "{{ MAIL_PROVIDER in group_names }}"
  shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag - css consumer, no Playwright surface (provider: web-svc-css)
css:
  bond: 1
  enabled: "{{ 'web-svc-css' in group_names }}"
  shared: "{{ 'web-svc-css' in group_names }}"
# nocheck: dynamic-flag - gated on services.sso.enabled, not on group_names
# nocheck: playwright-service-flag - runtime DOM patch, no probe-able surface flag
javascript:
  bond: 1
  enabled: "{{ lookup('config', 'web-app-jitsi', 'services.sso.enabled') | bool }}"
  shared: "{{ lookup('config', 'web-app-jitsi', 'services.sso.enabled') | bool }}"
# nocheck: playwright-service-flag: shared provider entity; the app itself is covered by this role's own Playwright spec
jitsi:
  healthcheck:
    flavor: tcp
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  enabled: true
  shared: true
  image: jitsi/web
  version: "stable-11031"
  min_storage: 315MB
  # nocheck: default-placement-manager  meta/volumes.yml uses type:bind config dirs staged on the stack host; a worker-scheduled task lacks the source paths (unpinning requires migrating them to nfs-backed named volumes)
  placement: manager
  ports:
    local:
      http: 8084
      sso: 16505
    public:
      media: 10000
    internal:
      http: 80
  proxy:
    service_key: web
  run_after:
    - web-app-keycloak
  lifecycle: beta
  cpus: "2.0"
  mem_reservation: 1g
  mem_limit: 3g
  pids_limit: 2048
web:
  name: jitsi-web
  cpus: "0.5"
  mem_reservation: 128m
  mem_limit: 512m
  pids_limit: 512
# nocheck: playwright-service-flag - internal sub-component (XMPP server, not a user-facing surface)
prosody:
  healthcheck:
    flavor: tcp
    port_key: http
  name: jitsi-prosody
  image: jitsi/prosody
  version: "stable-11031"
  ports:
    internal:
      xmpp: 5222
      component: 5347
      http: 5280
  cpus: "1.0"
  mem_reservation: 512m
  mem_limit: 1g
  pids_limit: 1024
# nocheck: playwright-service-flag - internal sub-component (conference focus)
# nocheck: image-healthcheck  XMPP component, no internal port declared
jicofo:
  name: jitsi-jicofo
  image: jitsi/jicofo
  version: "stable-11031"
  cpus: "1.0"
  mem_reservation: 512m
  mem_limit: 1g
  pids_limit: 1024
# nocheck: playwright-service-flag - internal sub-component (video bridge, media plane)
# nocheck: image-healthcheck  media bridge on UDP, no internal port declared
jvb:
  name: jitsi-jvb
  image: jitsi/jvb
  version: "stable-11031"
  cpus: "2.0"
  mem_reservation: 1g
  mem_limit: 2g
  pids_limit: 2048

# nocheck: playwright-service-flag
tor:
  enabled: false # nocheck: dynamic-flag
  shared: false # nocheck: dynamic-flag