---
openresty:
modes:
compose:
enabled: true
swarm:
enabled: true
# nocheck: default-placement-manager edge proxy + TLS terminator at a known IP; sys-front-inj-* Lua pipeline cannot ride the overlay yet (Future Extension: Traefik with Yaegi)
placement: manager
bond: 1
enabled: true
shared: true
name: openresty
ports:
internal:
http: 80
https: 443
public:
http: 80
https: 443
onion:
http: true
# nocheck: onion-flag the hidden service is already the transport encryption, and the onion address has no certificate a TLS listener could present
https: false
healthcheck:
test: ["CMD", "openresty", "-t", "-q"]
min_storage: 264MB
backup:
disabled: true
cpus: 0.5
mem_reservation: 1g
mem_limit: 2g
image: openresty/openresty
version: 1.31.8.1-alpine
custom: true
lifecycle: beta
pids_limit: 256
worker_connections: 4096
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag
# nocheck: dynamic-flag - proxy state is fully re-rendered by the deploy (configs, certs via binds), the backup consumer stays permanently off
container_backup:
enabled: false
shared: true
# nocheck: variants-coverage the role has a single variant, and the guide edge is not a dimension of it: a second round would differ only by the README replay
docs:
bond: 0.5
enabled: "{{ 'web-app-docs' in group_names }}"
shared: "{{ 'web-app-docs' in group_names }}"
