---
# nocheck: seaweedfs-required — object storage not implemented for this role
sso:
  bond: 1
  enabled: "{{ 'web-app-keycloak' in group_names }}"
  shared: "{{ 'web-app-keycloak' in group_names }}"
  flavor: oidc
  oidc:
    email_by_username: true
    enable_user_creation: true
logout:
  bond: 1
  enabled: "{{ 'web-svc-logout' in group_names }}"
  shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
  bond: 1
  enabled: "{{ 'web-app-dashboard' in group_names }}"
  shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
# nocheck: dynamic-flag
email:
  bond: 1
  enabled: "{{ MAIL_PROVIDER in group_names }}"
  shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag — self-provider
mailu:
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  # nocheck: default-placement-manager  mail edge at a known IP: MX A-record, PTR and SPF bind inbound/outbound SMTP to the stack host IP (a floating task's egress IP breaks deliverability); postfix /queue and dovecot mail+index state are NFS-hostile and ARE the app (no central-service equivalent); cert renewals land in a node-local bind via a manager-side systemd timer
  placement: manager
  enabled: true # nocheck: dynamic-flag
  shared: true
  covers:
    - email
  # nocheck: unwatched-version  Reason: Mailu ships its images under the release-series tag while its git tags are patch level (2024.06.58), so the series is the pin and moves only on a deliberate migration
  version: "2024.06"
  name: mailu
  backup:
    project_hard_restart: true
  min_storage: 20GB
  domain: "{{ lookup('email').domain }}"
  dmarc:
    rua_user: administrator
  ports:
    local:
      http: 8007
    public:
      smtp: 25
      smtps: 465
      submission: 587
      pop3: 110
      pop3s: 995
      imap: 143
      imaps: 993
      sieve: 4190
    internal:
      http: 80
      smtp: 25
      smtps: 465
      submission: 587
      pop3: 110
      pop3s: 995
      imap: 143
      imaps: 993
      sieve: 4190
    onion:
      smtp: true
      submission: true
      imap: true
      pop3: true
      # nocheck: onion-flag  ManageSieve edits server-side filters, which is administration rather than the sending and receiving the onion transport is for
      sieve: false
  proxy:
    service_key: front
  run_after:
    - web-app-matomo
    - web-app-stalwart
  lifecycle: eol
  cpus: "1.0"
  mem_reservation: 512m
  mem_limit: 2g
  pids_limit: 1024
# nocheck: shared
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
redis:
  bond: 1
  name: mailu-redis
  backup:
    disabled: true
  enabled: true # nocheck: dynamic-flag
  # Exception: central redis overlay adds VIP pressure on manager-pinned mailu; embedded redis avoids it.
  shared: "{{ ('svc-db-redis' in group_names) and (DEPLOYMENT_MODE == 'compose') }}"
  cpus: "0.2"
  mem_reservation: 256m
  mem_limit: 512m
  pids_limit: 256
# nocheck: playwright-service-flag - central DNS resolver, infrastructural (no Playwright surface)
# nocheck: dynamic-flag  enabled+shared (not the `in group_names` form) marks svc-dns-unbound `required` so the loader deploys it every compose round; reverting reintroduces the admin DNS hang.
unbound:
  bond: 1
  enabled: "{{ DEPLOYMENT_MODE == 'compose' }}"
  shared: true
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
mariadb:
  bond: 1
  enabled: true # nocheck: dynamic-flag
  shared: "{{ 'svc-db-mariadb' in group_names }}"
  cpus: "0.8"
  mem_reservation: 1g
  mem_limit: 2g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
admin:
  name: mailu-admin
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.3"
  mem_reservation: 256m
  mem_limit: 2g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
imap:
  name: mailu-imap
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.5"
  mem_reservation: 512m
  mem_limit: 1.5g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
smtp:
  name: mailu-smtp
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.5"
  mem_reservation: 512m
  mem_limit: 1.5g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
antispam:
  name: mailu-antispam
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.6"
  mem_reservation: 512m
  mem_limit: 1.5g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
antivirus:
  name: mailu-antivirus
  enabled: true # nocheck: dynamic-flag
  shared: false
  image: clamav/clamav-debian
  version: 1.5.4
  cpus: "0.6"
  mem_reservation: 2g
  mem_limit: 3g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
oletools:
  name: mailu-oletools
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.2"
  mem_reservation: 256m
  mem_limit: 512m
  pids_limit: 256
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
webdav:
  name: mailu-webdav
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.2"
  mem_reservation: 256m
  mem_limit: 512m
  pids_limit: 256
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
fetchmail:
  name: mailu-fetchmail
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.2"
  mem_reservation: 256m
  mem_limit: 512m
  pids_limit: 256
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
webmail:
  name: mailu-webmail
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.3"
  mem_reservation: 256m
  mem_limit: 1g
  pids_limit: 512
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — internal sub-component
front:
  name: mailu-front
  enabled: true # nocheck: dynamic-flag
  shared: false
  cpus: "0.3"
  mem_reservation: 256m
  mem_limit: 1g
  pids_limit: 512
# nocheck: playwright-service-flag — verified by web-svc-css provider spec
css:
  bond: 1
  enabled: "{{ 'web-svc-css' in group_names }}"
  shared: "{{ 'web-svc-css' in group_names }}"
prometheus:
  bond: 1
  enabled: "{{ 'web-app-prometheus' in group_names }}"
  shared: "{{ 'web-app-prometheus' in group_names }}"

# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag
# nocheck: dynamic-flag
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
  bond: 1
  enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
  shared: true