mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
61 lines
2.1 KiB
YAML
61 lines
2.1 KiB
YAML
---
|
|
coturn:
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: true
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
image: coturn/coturn
|
|
version: 4.18.0
|
|
min_storage: 246MB
|
|
user_auth_enabled: false
|
|
cpus: 1.0
|
|
mem_reservation: 512m
|
|
mem_limit: 1g
|
|
pids_limit: 256
|
|
network_mode: host
|
|
ports:
|
|
internal:
|
|
http: 80
|
|
local:
|
|
http: 8064
|
|
public:
|
|
stun_turn: 3481
|
|
stun_turn_tls: 5351
|
|
relay:
|
|
start: 20000
|
|
end: 39999
|
|
lifecycle: beta
|
|
gateway:
|
|
image: nginx
|
|
version: 1.31.8-alpine
|
|
cpus: "0.3"
|
|
mem_reservation: 256m
|
|
mem_limit: 512m
|
|
pids_limit: 256
|
|
# nocheck: dynamic-flag coturn runs with user_auth_enabled false, so it keeps no credential store to back; the entry stays literal until auth is switched on and no template references redis today.
|
|
redis:
|
|
backup:
|
|
disabled: true
|
|
enabled: false
|
|
shared: "{{ 'svc-db-redis' in group_names }}"
|
|
# nocheck: variants-coverage — the tor conjunct is the clearnet-variant-tor invariant below, so no variant may pin the true polarity on an onion node
|
|
# nocheck: bond-baseline — same reason: variant 0 must not pin the scrape consumer on
|
|
prometheus:
|
|
bond: 1
|
|
enabled: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"
|
|
shared: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"
|
|
|
|
# nocheck: clearnet-variant-tor — STUN/TURN on UDP plus a 20000-port relay range, which no onion descriptor can publish; the only HTTP is a gateway returning a plaintext OK. No dashboard, logout, css or matomo block and no Playwright spec, so an onion round claims no visitable surface for it. Its one consumer declaration, prometheus, carries the tor gate.
|
|
tor:
|
|
enabled: false # nocheck: dynamic-flag no group can turn this on: see the clearnet-variant-tor reason above
|
|
shared: false # nocheck: dynamic-flag same
|
|
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
|
|
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
|
|
bond: 1
|
|
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
|
|
shared: true
|