mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
b9669fcaa5
A container without a healthcheck is accepted the moment its process starts. The restore drill asks the host's health service for its verdict, so a service that came back empty passes as long as it is running - which is how an empty volume survives a drill unnoticed. Twenty-one services get a probe and thirteen get a marker naming why none is possible: a one-shot client that exits, a build image with no service port, a media bridge on UDP. The flavor comes from each image's own layer history, read from the registry through the mirror, so no image had to be pulled to find out whether it ships curl, wget or a shell. Two entries carry more weight than the rest. The central Postgres, which every replay of the recover chain lands in, had no probe at all; it gets the pg_isready line that sys-svc-rdbms already runs for the per-app engine. And the matrix runner starts systemd within a second while its inner daemon is still pulling every image of the deployment, so it counted as healthy long before anything served - it now waits for Synapse to answer. No probe replaces one: nineteen of the twenty-one images ship no HEALTHCHECK, and the two that do already carried a declaration before this change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
120 lines
3.3 KiB
YAML
120 lines
3.3 KiB
YAML
---
|
|
sso:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-keycloak' in group_names }}"
|
|
shared: "{{ 'web-app-keycloak' in group_names }}"
|
|
flavor: oidc
|
|
ldap:
|
|
bond: 1
|
|
enabled: "{{ 'svc-db-openldap' in group_names }}"
|
|
shared: "{{ 'svc-db-openldap' in group_names }}"
|
|
logout:
|
|
bond: 1
|
|
enabled: "{{ 'web-svc-logout' in group_names }}"
|
|
shared: "{{ 'web-svc-logout' in group_names }}"
|
|
dashboard:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-dashboard' in group_names }}"
|
|
shared: "{{ 'web-app-dashboard' in group_names }}"
|
|
matomo:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-matomo' in group_names }}"
|
|
shared: "{{ 'web-app-matomo' in group_names }}"
|
|
# nocheck: playwright-service-flag — central object-store provider entity
|
|
# nocheck: image-healthcheck no internal port declared, so no probe can address it
|
|
minio:
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: true
|
|
# nocheck: single-replica
|
|
replicas: 1
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
backup:
|
|
no_stop_required: false
|
|
image: quay.io/minio/minio
|
|
version: "RELEASE.2025-09-07T16-13-09Z" # nocheck: docker-version
|
|
name: minio
|
|
api_port: 9000
|
|
region: us-east-1
|
|
min_storage: 263MB
|
|
cpus: "2.0"
|
|
mem_reservation: 2g
|
|
mem_limit: 4g
|
|
pids_limit: 2048
|
|
run_after:
|
|
- web-app-keycloak
|
|
- web-app-matomo
|
|
lifecycle: eol
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
|
|
redis:
|
|
backup:
|
|
disabled: true
|
|
enabled: false
|
|
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
|
|
css:
|
|
bond: 1
|
|
enabled: "{{ 'web-svc-css' in group_names }}"
|
|
shared: "{{ 'web-svc-css' in group_names }}"
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
|
|
javascript:
|
|
enabled: false
|
|
shared: true
|
|
# nocheck: playwright-service-flag — AI backend, infrastructural
|
|
ollama:
|
|
bond: 1
|
|
enabled: "{{ 'svc-ai-ollama' in group_names }}"
|
|
shared: "{{ 'svc-ai-ollama' in group_names }}"
|
|
prometheus:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-prometheus' in group_names }}"
|
|
shared: "{{ 'web-app-prometheus' in group_names }}"
|
|
# nocheck: playwright-service-flag
|
|
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
|
|
tor:
|
|
bond: 0.5
|
|
enabled: "{{ 'svc-net-tor' in group_names }}"
|
|
shared: true # nocheck: dynamic-flag
|
|
api:
|
|
ports:
|
|
local:
|
|
http: 8057
|
|
internal:
|
|
http: 9000
|
|
min_storage: 5GB
|
|
cpus: "0.5"
|
|
mem_reservation: 256m
|
|
mem_limit: 1g
|
|
pids_limit: 512
|
|
console:
|
|
ports:
|
|
local:
|
|
http: 8058
|
|
internal:
|
|
http: 9001
|
|
min_storage: 1GB
|
|
cpus: "0.2"
|
|
mem_reservation: 128m
|
|
mem_limit: 256m
|
|
pids_limit: 256
|
|
# nocheck: playwright-service-flag — mc admin client, run as a one-shot, no Playwright surface
|
|
# nocheck: image-healthcheck mc is a one-shot client, it exits
|
|
client:
|
|
image: quay.io/minio/mc
|
|
version: "RELEASE.2025-08-13T08-35-41Z" # nocheck: docker-version
|
|
cpus: "0.2"
|
|
mem_reservation: 128m
|
|
mem_limit: 256m
|
|
pids_limit: 256
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
|
|
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
|
|
bond: 1
|
|
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
|
|
shared: true
|