mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
116115f5ca
The asset role copies its files into web-svc-file's webroot and redirects its own domain onto web-svc-file's, yet declared the provider as group-conditional. The minimal matrix variant pinned it off, so the round deployed asset alone: the redirect target had no vhost, openresty rejected the SNI, and the CSP health check failed the whole deploy after 26 retries. Making the flags literal takes the key out of the variant matrix, which variants-static-override requires -- a variant may not override a literal base flag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
46 lines
1.3 KiB
YAML
46 lines
1.3 KiB
YAML
---
|
|
asset:
|
|
modes:
|
|
host:
|
|
enabled: true
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
cpus: "0.2"
|
|
mem_reservation: 128m
|
|
mem_limit: 256m
|
|
pids_limit: 128
|
|
min_storage: "1GB"
|
|
source_directory: "{{ lookup('path_absolute', 'assets') }}"
|
|
url: "{{ (lookup('tls', 'web-svc-file', 'url.base') ~ 'assets') if ('web-svc-asset' in group_names) else ('https://file.' ~ SOFTWARE_DOMAIN ~ '/assets') }}"
|
|
run_after:
|
|
- web-svc-file
|
|
lifecycle: beta
|
|
# nocheck: dynamic-flag — the assets are copied into web-svc-file's webroot and the asset domain redirects onto its domain, so the provider is mandatory rather than group-conditional
|
|
file:
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
matomo:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-matomo' in group_names }}"
|
|
shared: "{{ 'web-app-matomo' in group_names }}"
|
|
# nocheck: matomo-track
|
|
track: false
|
|
# nocheck: dynamic-flag
|
|
css:
|
|
enabled: false
|
|
shared: false
|
|
prometheus:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-prometheus' in group_names }}"
|
|
shared: "{{ 'web-app-prometheus' in group_names }}"
|
|
# nocheck: prometheus-scrape
|
|
scrape: false
|
|
|
|
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
|
|
tor:
|
|
bond: 0.5
|
|
enabled: "{{ 'svc-net-tor' in group_names }}"
|
|
shared: true # nocheck: dynamic-flag
|