---
coturn:
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  enabled: true
  shared: true
  image: coturn/coturn
  version: 4.18.0
  min_storage: 246MB
  user_auth_enabled: false
  cpus: 1.0
  mem_reservation: 512m
  mem_limit: 1g
  pids_limit: 256
  network_mode: host
  ports:
    internal:
      http: 80
    local:
      http: 8064
    public:
      stun_turn: 3481
      stun_turn_tls: 5351
      relay:
        start: 20000
        end: 39999
  lifecycle: beta
gateway:
  image: nginx
  version: 1.31.8-alpine
  cpus: "0.3"
  mem_reservation: 256m
  mem_limit: 512m
  pids_limit: 256
# nocheck: dynamic-flag  coturn runs with user_auth_enabled false, so it keeps no credential store to back; the entry stays literal until auth is switched on and no template references redis today.
redis:
  backup:
    disabled: true
  enabled: false
  shared: "{{ 'svc-db-redis' in group_names }}"
# nocheck: variants-coverage — the tor conjunct is the clearnet-variant-tor invariant below, so no variant may pin the true polarity on an onion node
# nocheck: bond-baseline — same reason: variant 0 must not pin the scrape consumer on
prometheus:
  bond: 1
  enabled: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"
  shared: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"

# nocheck: clearnet-variant-tor — STUN/TURN on UDP plus a 20000-port relay range, which no onion descriptor can publish; the only HTTP is a gateway returning a plaintext OK. No dashboard, logout, css or matomo block and no Playwright spec, so an onion round claims no visitable surface for it. Its one consumer declaration, prometheus, carries the tor gate.
tor:
  enabled: false # nocheck: dynamic-flag  no group can turn this on: see the clearnet-variant-tor reason above
  shared: false # nocheck: dynamic-flag  same
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
  bond: 1
  enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
  shared: true