mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
e16eb5728d
72fd9c870 required the onion in every variant but exempted variant 1, on the
argument that the minimal round is the one place the stack runs without it. That
argument does not hold: the onion is part of the deployment under test, not a
feature bolted onto the full shape. A round that skips it is not a smaller
deployment, it is a different one.
So the exemption is gone and 95 variant-1 entries pin the onion on. Two
exclusions remain, both read from data rather than a comment: a role with no tor
block has no onion to pin, and a role whose meta/services.yml pins tor.enabled to
a literal false has already declared it has none.
That put the rule in conflict with test_coverage, which requires both polarities
of every dynamic flag: with tor on everywhere, the false side has no variant left
to live in. 94 roles take the exemption that contract already provides for
exactly this - "flags whose group-derived value is a hard invariant that variants
must never override", the same one 4e6ef2542 used for the seaweedfs frontend.
web-app-nextcloud needs none: its variant 8 pairs the clearnet-only PeerTube and
keeps the false polarity.
Measured, because the declaration is not what CI runs. assign_tor gives the onion
to every second capable entry with the run number as the parity switch, so more
capable variants do not mean proportionally more onion jobs: across five roles
and 21 entries the count goes 8 -> 10 on an even run and 9 on an odd one. The
clearnet path also survives - checkmk reports v1=false on run 0 and v1=true on
run 1, so both states are still covered across two consecutive runs. What the
94 markers give up is a declarative guarantee in variants.yml, not the coverage
itself.
The real cost is weight, not job count. web-app-nextcloud variant 1 goes from
3.09GB reservation / 7.27GB limit to 18.26GB / 43.01GB once svc-net-tor and its
closure join, so the cheap round is no longer cheap. Every variant stays under
the 32/64GB budget, and the same effect applies to the other 94 unmeasured.
Verified: tests/lint 336 passed / 307 subtests, tests/integration/roles/meta/
variants plus the role-meta lints 39 passed. The rule was checked in both
directions - it reported the variant-1 offenders before the flips and none after.
Not measured: what the heavier rounds do to wall-clock, against swarm jobs capped
at 355 minutes and one that has hit that ceiling before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
113 lines
3.5 KiB
YAML
113 lines
3.5 KiB
YAML
---
|
|
# Matrix-deploy variant overrides for web-app-penpot.
|
|
# See docs/contributing/artefact/files/role/variants.md for the file format.
|
|
|
|
# Variant pinning every dynamic services.yml flag to true so the matrix
|
|
# exercises the in-group_names branch of web-app-penpot.
|
|
- services:
|
|
container_backup:
|
|
enabled: true
|
|
css:
|
|
enabled: true
|
|
shared: true
|
|
dashboard:
|
|
enabled: true
|
|
shared: true
|
|
email:
|
|
enabled: true
|
|
shared: true
|
|
ldap:
|
|
enabled: true
|
|
shared: true
|
|
logout:
|
|
enabled: true
|
|
shared: true
|
|
matomo:
|
|
enabled: true
|
|
shared: true
|
|
sso:
|
|
enabled: true
|
|
shared: true
|
|
postgres:
|
|
shared: true
|
|
redis:
|
|
shared: true
|
|
prometheus:
|
|
enabled: true
|
|
shared: true
|
|
seaweedfs:
|
|
enabled: true
|
|
shared: true
|
|
tor:
|
|
enabled: true
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
css:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
email:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
ldap:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
matomo:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
sso:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
postgres:
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
redis:
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
seaweedfs:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
tor:
|
|
enabled: true
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
ldap:
|
|
enabled: true
|
|
shared: true
|
|
sso:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
css:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
email:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
matomo:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
seaweedfs:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
tor:
|
|
enabled: true
|