---
# nocheck: playwright-service-flag — CDN does not appear as a dashboard tile
# nocheck: dynamic-flag
dashboard:
  enabled: false
# nocheck: playwright-service-flag — self-provider
cdn:
  # nocheck: default-placement-manager  the one-shot npm-mirror build must write the served CDN root, a node-local host bind openresty (manager-pinned) reads
  placement: manager
  modes:
    host:
      enabled: true
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  enabled: true
  shared: true
  flavor: internal
  cpus: "0.2"
  mem_reservation: 128m
  mem_limit: 256m
  pids_limit: 128
  min_storage: "1GB"
  lifecycle: beta
# nocheck: playwright-service-flag — transient node image used only to build the npm asset mirror, never served
# nocheck: image-healthcheck  build-time image run as a one-shot, no service port
build:
  # nocheck: single-replica  one-shot npm-mirror build writing the shared served root; parallel replicas would race and duplicate work
  replicas: 1
  image: node
  version: "26-slim"
  cpus: "1.0"
  mem_reservation: 128m
  mem_limit: 256m
  pids_limit: 256
# nocheck: playwright-service-flag — CDN serves static assets, no HTML pages with tracking snippet
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
  # nocheck: matomo-track
  track: false
# nocheck: playwright-service-flag — canonical:cdn alias of self-provider
# nocheck: dynamic-flag
javascript:
  enabled: false
  shared: true
  canonical: cdn
# nocheck: playwright-service-flag — /metrics endpoint covered by web-app-prometheus's own spec
prometheus:
  bond: 1
  enabled: "{{ 'web-app-prometheus' in group_names }}"
  shared: "{{ 'web-app-prometheus' in group_names }}"
  # nocheck: prometheus-scrape
  scrape: false

# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag