---
sso:
  bond: 1
  enabled: "{{ 'web-app-keycloak' in group_names }}"
  shared: "{{ 'web-app-keycloak' in group_names }}"
  flavor: oauth2
  oauth2:
    origin:
      host: prometheus
      port: "9090"
    allowed_groups:
      - "{{ lookup('rbac_group_path', application_id='web-app-prometheus', role='administrator') }}"
logout:
  bond: 1
  enabled: "{{ 'web-svc-logout' in group_names }}"
  shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
  bond: 1
  enabled: "{{ 'web-app-dashboard' in group_names }}"
  shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
email:
  bond: 1
  enabled: "{{ MAIL_PROVIDER in group_names }}"
  shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
css:
  bond: 1
  enabled: "{{ 'web-svc-css' in group_names }}"
  shared: "{{ 'web-svc-css' in group_names }}"
# nocheck: dynamic-flag — gated on services.sso.enabled, not on group_names
# nocheck: playwright-service-flag — runtime DOM patch, no probe-able surface flag
javascript:
  bond: 1
  enabled: "{{ lookup('config', 'web-app-prometheus', 'services.sso.enabled') | bool }}"
  shared: "{{ lookup('config', 'web-app-prometheus', 'services.sso.enabled') | bool }}"
# nocheck: playwright-service-flag — self-provider
prometheus:
  healthcheck:
    flavor: wget
    path: -/healthy
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  # nocheck: default-placement-manager  TSDB on-disk data; node-local in swarm
  placement: manager
  enabled: true
  shared: true
  provides:
    - prometheus
  image: prom/prometheus # nocheck: volumes-path-single-spot: the repository path of an image name, not a mount target
  version: v3.15.1
  name: prometheus
  cpus: "0.5"
  mem_reservation: 512m
  mem_limit: 1536m
  pids_limit: 256
  alerting:
    telegram:
      chat_id: 0
  ports:
    local:
      sso: 16492
      http: 8066
    internal:
      http: 9090
  run_after:
    - web-app-keycloak
  lifecycle: beta
  min_storage: 307MB
alertmanager:
  healthcheck:
    flavor: wget
    path: -/healthy
  image: prom/alertmanager # nocheck: volumes-path-single-spot: the repository path of an image name, not a mount target
  version: v0.34.2
  name: prometheus-alertmanager
  cpus: "0.25"
  mem_reservation: 64m
  mem_limit: 128m
  pids_limit: 64
  min_storage: 240MB
  ports:
    internal:
      http: 9093
blackbox-exporter:
  healthcheck:
    flavor: wget
    path: -/healthy
  image: prom/blackbox-exporter
  version: v0.29.1
  name: prometheus-blackbox
  cpus: "0.1"
  mem_reservation: 16m
  mem_limit: 24m
  pids_limit: 64
  min_storage: 218MB
  ports:
    internal:
      http: 9115
cadvisor:
  image: gcr.io/cadvisor/cadvisor
  version: v0.55.1
  update:
    type: registry_tags
    image: gcr.io/cadvisor/cadvisor
  name: prometheus-cadvisor
  cpus: "0.25"
  mem_reservation: 128m
  mem_limit: 1g
  pids_limit: 64
  min_storage: 234MB
  ports:
    internal:
      http: 8080
node-exporter:
  healthcheck:
    flavor: wget
    path: metrics
  image: prom/node-exporter
  version: v1.12.1
  name: prometheus-node-exporter
  cpus: "0.1"
  mem_reservation: 32m
  mem_limit: 128m
  pids_limit: 64
  min_storage: 214MB
  ports:
    internal:
      http: 9100

# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag
# nocheck: dynamic-flag — gated on services.sso.enabled, not on group_names
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
  bond: 1
  enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
  shared: true
# nocheck: playwright-service-flag  internal adapter sidecar, covered by the role's MCP guest spec
# nocheck: dockerfile-custom  the Dockerfile is owned by svc-ai-mcp-adapter and staged per instance, so every adapter-backed provider shares one audited build
# nocheck: dynamic-flag  the sidecar tracks this role's own mcp flag, not another role's presence; a group_names expression would decide its exposure from an unrelated deployment
prometheusmcp:
  enabled: "{{ lookup('config', 'web-app-prometheus', 'mcp.enabled') | bool }}"
  shared: false
  image: python
  # nocheck: docker-version  base of the self-built stdlib adapter, not the served application
  version: "3.13.15-slim"
  custom: true
  name: prometheusmcp
  cpus: "0.25"
  mem_reservation: 16m
  mem_limit: 24m
  pids_limit: 64
  ports:
    internal:
      http: 8080
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
openwebui:
  bond: 0.5
  enabled: "{{ 'web-app-openwebui' in group_names }}"
  shared: "{{ 'web-app-openwebui' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
hermes:
  bond: 0.5
  enabled: "{{ 'web-app-hermes' in group_names }}"
  shared: "{{ 'web-app-hermes' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
openclaw:
  bond: 0.5
  enabled: "{{ 'web-app-openclaw' in group_names }}"
  shared: "{{ 'web-app-openclaw' in group_names }}"
# nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
flowise:
  bond: 0.5
  enabled: "{{ 'web-app-flowise' in group_names }}"
  shared: "{{ 'web-app-flowise' in group_names }}"