mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
19f4ac3390
The lookup writes overrides.get(key, effective_default), so a service that repeats what it would have inherited changes nothing and only hides the day the default moves. Forty seven such lines stood in the tree. Almost all of them came from the migration that moved the literal blocks into meta/services.yml. The values were carried over verbatim so the move could be proven lossless, which was right for the proof and left the no-ops behind. The defaults they are measured against are the effective ones, not the base class. Curl probes every minute, Connect grants a fifteen minute start window, and a prefix raises timeout, retries and start_period further. Comparing against Probe alone would have called out every service that simply agrees with its flavor. Eight services lose interval: 10s as well and fall back to their flavor's cadence, thirty seconds, or a minute for decidim's curl. Since start_interval exists, interval no longer touches convergence at all: it is steady state load for the life of the deployment. That takes the five databases, matomo, snipe-it and decidim from 360 probes an hour each to 120. It buys that with slower failure detection, 180s to 540s for the databases, which is acceptable because an unhealthy container fails the deploy whichever number stands there. Twelve deviations that do cost something now carry their reason. Where the mechanism is known it is named: ejabberdctl and rabbitmq-diagnostics start an Erlang CLI node, mmctl spawns a binary and talks to the local socket, php artisan boots Laravel on every probe, keycloak's management endpoint answers from the JVM. Two say instead that the value was carried over and never measured. './fider ping' and pgrep both fit the five second default and no reason for ten is visible, so the comment records that there is no evidence rather than inventing one. They mark where a measurement belongs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
135 lines
4.3 KiB
YAML
135 lines
4.3 KiB
YAML
---
|
|
# nocheck: playwright-service-flag — self-provider
|
|
libretranslate:
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "./venv/bin/python scripts/healthcheck.py"]
|
|
# nocheck: healthcheck-timing-override the probe starts a venv interpreter, which does not finish inside the 5s default
|
|
timeout: 10s
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: true
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
image: libretranslate/libretranslate
|
|
version: v1.9.6
|
|
custom: true
|
|
min_storage: 402MB
|
|
load_only:
|
|
- en
|
|
- de
|
|
ports:
|
|
local:
|
|
http: 8045
|
|
sso: 16493
|
|
internal:
|
|
http: 5000
|
|
proxy:
|
|
service_key: libretranslate
|
|
lifecycle: beta
|
|
cpus: "0.2"
|
|
mem_reservation: 128m
|
|
mem_limit: 256m
|
|
pids_limit: 256
|
|
sso:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-keycloak' in group_names }}"
|
|
shared: "{{ 'web-app-keycloak' in group_names }}"
|
|
flavor: oauth2
|
|
oauth2:
|
|
origin:
|
|
host: libretranslate
|
|
port: 5000
|
|
allowed_groups:
|
|
- "{{ lookup('rbac_group_path', application_id='web-svc-libretranslate', role='administrator') }}"
|
|
# nocheck: dynamic-flag
|
|
acl:
|
|
whitelist:
|
|
- /translate
|
|
- /detect
|
|
- /languages
|
|
- /spec
|
|
- /frontend/settings
|
|
- /api
|
|
# nocheck: dynamic-flag
|
|
logout:
|
|
enabled: false
|
|
shared: false
|
|
matomo:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-matomo' in group_names }}"
|
|
shared: "{{ 'web-app-matomo' in group_names }}"
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
|
|
redis:
|
|
backup:
|
|
disabled: true
|
|
enabled: false
|
|
shared: "{{ 'svc-db-redis' in group_names }}"
|
|
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
|
|
css:
|
|
bond: 1
|
|
enabled: "{{ 'web-svc-css' in group_names }}"
|
|
shared: "{{ 'web-svc-css' in group_names }}"
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag — captcha backend, infrastructural
|
|
recaptcha:
|
|
enabled: false
|
|
# nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag — canonical:cdn alias of static-asset provider
|
|
javascript:
|
|
enabled: false
|
|
shared: true
|
|
prometheus:
|
|
bond: 1
|
|
enabled: "{{ 'web-app-prometheus' in group_names }}"
|
|
shared: "{{ 'web-app-prometheus' in group_names }}"
|
|
# nocheck: playwright-service-flag internal adapter sidecar, covered by the role's MCP guest spec
|
|
# nocheck: dockerfile-custom the Dockerfile is owned by svc-ai-mcp-adapter and staged per instance, so every adapter-backed provider shares one audited build
|
|
# nocheck: dynamic-flag the sidecar tracks this role's own mcp flag, not another role's presence; a group_names expression would decide its exposure from an unrelated deployment
|
|
libretranslatemcp:
|
|
enabled: "{{ lookup('config', 'web-svc-libretranslate', 'mcp.enabled') | bool }}"
|
|
shared: false
|
|
image: python
|
|
# nocheck: docker-version base of the self-built stdlib adapter, not the served application
|
|
version: "3.13.15-slim"
|
|
custom: true
|
|
name: libretranslatemcp
|
|
cpus: "0.25"
|
|
mem_reservation: 24m
|
|
mem_limit: 48m
|
|
pids_limit: 64
|
|
ports:
|
|
internal:
|
|
http: 8080
|
|
|
|
# nocheck: playwright-service-flag
|
|
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
|
|
tor:
|
|
bond: 0.5
|
|
enabled: "{{ 'svc-net-tor' in group_names }}"
|
|
shared: true # nocheck: dynamic-flag
|
|
# nocheck: playwright-service-flag MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
|
|
openwebui:
|
|
bond: 0.5
|
|
enabled: "{{ 'web-app-openwebui' in group_names }}"
|
|
shared: "{{ 'web-app-openwebui' in group_names }}"
|
|
# nocheck: playwright-service-flag MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
|
|
hermes:
|
|
bond: 0.5
|
|
enabled: "{{ 'web-app-hermes' in group_names }}"
|
|
shared: "{{ 'web-app-hermes' in group_names }}"
|
|
# nocheck: playwright-service-flag MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
|
|
openclaw:
|
|
bond: 0.5
|
|
enabled: "{{ 'web-app-openclaw' in group_names }}"
|
|
shared: "{{ 'web-app-openclaw' in group_names }}"
|
|
# nocheck: playwright-service-flag MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
|
|
# nocheck: dynamic-flag the entry refuses this client, so the link is off on every host and no group_names gate can decide it
|
|
flowise:
|
|
enabled: false
|
|
shared: false
|
|
mcp_consumer: false
|