---
# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
litellm:
  bond: 0.5
  enabled: "{{ LITELLM_USABLE }}"
  shared: true
# nocheck: dockerfile-custom
sso:
  bond: 1
  enabled: "{{ 'web-app-keycloak' in group_names }}"
  shared: "{{ 'web-app-keycloak' in group_names }}"
  flavor: oidc
ldap:
  bond: 1
  enabled: "{{ 'svc-db-openldap' in group_names }}"
  shared: "{{ 'svc-db-openldap' in group_names }}"
logout:
  bond: 1
  enabled: "{{ 'web-svc-logout' in group_names }}"
  shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
  bond: 1
  enabled: "{{ 'web-app-dashboard' in group_names }}"
  shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
email:
  bond: 1
  enabled: "{{ MAIL_PROVIDER in group_names }}"
  shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag — TURN/STUN server, no Playwright surface (provider: web-svc-coturn)
coturn:
  bond: 1
  enabled: "{{ 'web-svc-coturn' in group_names }}"
  shared: "{{ 'web-svc-coturn' in group_names }}"
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force Jitsi on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin Jitsi on.
jitsi:
  bond: 1
  enabled: "{{ lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'ansible' and 'svc-net-tor' not in group_names }}" # nocheck: dynamic-flag — Matrix offers Jitsi from the ansible flavor and off tor nodes only
  shared: "{{ 'web-app-jitsi' in group_names }}"
  domains:
    - jitsi
  ports:
    internal:
      http: 8000
    local:
      http: 8098
    public:
      media: 10001
livekit:
  ports:
    internal:
      websocket: 7880
    local:
      websocket: 4005
    public:
      media: 10002
  cpus: "1.0"
  mem_reservation: 256m
  mem_limit: 1g
  pids_limit: 512
livekit_jwt:
  ports:
    internal:
      http: 8030
    local:
      http: 8099
  cpus: "0.2"
  mem_reservation: 32m
  mem_limit: 128m
  pids_limit: 64
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
postgres:
  bond: 1
  enabled: true # nocheck: dynamic-flag — matrix always needs a database
  shared: "{{ 'svc-db-postgres' in group_names }}"
synapse:
  healthcheck:
    flavor: curl
  version: v1.164.2
  image: matrixdotorg/synapse
  name: matrix-synapse
  backup:
    no_stop_required: true
  ports:
    internal:
      http: 8008
    local:
      http: 8021
    public:
      federation: 8448
    onion:
      # nocheck: onion-flag  federation is dialled by clearnet homeservers resolving this server_name; serving it on the onion needs an onion server_name, which is a different deployment
      federation: false
  min_storage: 311MB
  cpus: "1.5"
  mem_reservation: "1g"
  mem_limit: "2g"
  pids_limit: 2048
element:
  healthcheck:
    flavor: wget
  version: v1.12.33
  image: vectorim/element-web
  name: matrix-element
  force_verification: true
  ports:
    local:
      http: 8022
    internal:
      http: 80
  min_storage: 263MB
  cpus: "0.2"
  mem_reservation: 128m
  mem_limit: 256m
  pids_limit: 256
matrix-chatgpt-bot:
  version: 3.1.5
  image: ghcr.io/matrixgpt/matrix-chatgpt-bot
  min_storage: 307MB
  cpus: "0.2"
  mem_reservation: 128m
  mem_limit: 256m
  pids_limit: 256
# nocheck: playwright-service-flag — object store, no Playwright surface (provider: web-app-seaweedfs)
seaweedfs:
  bond: 1
  enabled: "{{ 'web-app-seaweedfs' in group_names }}"
  shared: "{{ 'web-app-seaweedfs' in group_names }}"
  public: true
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
css:
  bond: 1
  enabled: "{{ 'web-svc-css' in group_names }}"
  shared: "{{ 'web-svc-css' in group_names }}"
prometheus:
  bond: 1
  enabled: "{{ 'web-app-prometheus' in group_names }}"
  shared: "{{ 'web-app-prometheus' in group_names }}"
  native_metrics:
    enabled: true
    port: "{{ 9000 if lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'compose' else 9100 }}"
    service_key: "{{ 'synapse' if lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'compose' else 'matrix' }}"
  communication:
    channel: true
# nocheck: playwright-service-flag: shared provider entity; the app itself is covered by this role's own Playwright spec
matrix:
  healthcheck:
    flavor: http_status
    path: _matrix/client/versions
    retries: 10
  ports:
    internal:
      http: 8008
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  enabled: true # nocheck: dynamic-flag — matrix always needs a database
  shared: true
  name: matrix
  # nocheck: default-placement-manager  inner docker-in-docker storage; node-local in swarm
  placement: manager
  flavor: ansible
  upstream:
    repo: https://github.com/spantaleev/matrix-docker-ansible-deploy
    ref: 40179e6d4a36513eb77c4ef2eff067716ebb1821
    migration_validated_version: v2026.05.18.0
  runner:
    image: infinito/web-app-matrix-mdad-runner:1
    base_image: python
    base_version: 3.13-slim
    docker_cli_image: docker
    docker_cli_version: 28.0.4-cli
  playbook_tags: setup-all,start
  server_name: "{{ DOMAIN_PRIMARY }}"
  plugins:
    appservice_irc: false
    chatgpt: "{{ 'svc-ai-litellm' in group_names }}"
    discord: false
    gitter: false
    heisenbridge: true
    hookshot: false
    mautrix_discord: false
    mautrix_signal: false
    mautrix_slack: false
    mautrix_telegram: false
    mautrix_twitter: false
    mautrix_whatsapp: false
  conferencing:
    element_call: true
  run_after:
    - web-app-matomo
    - web-app-keycloak
    - web-app-stalwart
    - web-app-mailu
  lifecycle: beta
  min_storage: "1GB"
  cpus: "0.5"
  mem_reservation: "128m"
  mem_limit: "512m"
  pids_limit: 256

# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag
  exclusive: true
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
  bond: 1
  enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
  shared: true