services.yml

---
# nocheck: seaweedfs-required — object storage not implemented for this role
# nocheck: dynamic-flag
# nocheck: logout
logout:
  enabled: false
  shared: false
# nocheck: dynamic-flag  cluster-wide LDAP federation keys on inventory groups[]; host-scoped group_names is cross-host cache-poisoned for this destructive flag
ldap:
  bond: 1
  enabled: "{{ (groups['svc-db-openldap'] | default([]) | length) > 0 }}"
  shared: "{{ (groups['svc-db-openldap'] | default([]) | length) > 0 }}"
  connection_pooling: false
  sync:
    period:
      changes: 900
      full: 86400
dashboard:
  bond: 1
  enabled: "{{ 'web-app-dashboard' in group_names }}"
  shared: "{{ 'web-app-dashboard' in group_names }}"
  iframe: false
matomo:
  bond: 1
  enabled: "{{ 'web-app-matomo' in group_names }}"
  shared: "{{ 'web-app-matomo' in group_names }}"
email:
  bond: 1
  enabled: "{{ MAIL_PROVIDER in group_names }}"
  shared: "{{ MAIL_PROVIDER in group_names }}"
javascript:
  bond: 1
  enabled: "{{ 'web-svc-logout' in group_names }}"
  shared: "{{ 'web-svc-logout' in group_names }}"
# nocheck: playwright-service-flag — self-provider
keycloak:
  healthcheck:
    flavor: http_status
    path: health/ready
    port_key: management
    # nocheck: healthcheck-timing-override  the management endpoint answers from the JVM, which does not reply inside the 5s default while the realm is still importing
    timeout: 15s
    retries: 5
  modes:
    compose:
      enabled: true
    swarm:
      enabled: true
  bond: 1
  enabled: true # nocheck: dynamic-flag
  shared: true
  provides: sso
  image: quay.io/keycloak/keycloak
  version: "26.8.2"
  name: keycloak
  min_storage: 468MB
  cpus: "2.0"
  mem_reservation: 2g
  mem_limit: 4g
  pids_limit: 1024
  realm:
    import_enabled: true
    totp_enabled: true
  users:
    emails_verified: true
  scopes:
    nextcloud: nextcloud
    moodle: moodle
  accounts:
    bootstrap:
      username: administrator
    system:
      username: "{{ SOFTWARE_NAME | replace('.', '_') | lower }}"
  admin:
    allowed_networks: []
  ports:
    local:
      http: 8032
    internal:
      http: 8080
      management: 9000
  proxy:
    service_key: keycloak
  run_after:
    - web-app-matomo
    - web-app-stalwart
    - web-app-mailu
  lifecycle: beta
# Exception: sso-proxy sidecar; upstream artefact names (oauth2-proxy image, oauth2-proxy-keycloak.cfg) stay literal, project identifiers use the sso_proxy namespace
# nocheck: dynamic-flag — per-consumer fan-out
# nocheck: playwright-service-flag — sidecar shape, no probe-able surface flag
sso_proxy:
  image: quay.io/oauth2-proxy/oauth2-proxy
  version: "v7.15.6"
  min_storage: 220MB
  configuration_file: oauth2-proxy-keycloak.cfg
  ports:
    internal:
      http: 4180
  cpus: "0.25"
  mem_reservation: "64m"
  mem_limit: "128m"
  pids_limit: 256
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
postgres:
  bond: 1
  enabled: true # nocheck: dynamic-flag
  shared: "{{ 'svc-db-postgres' in group_names }}"
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
css:
  bond: 1
  enabled: "{{ 'web-svc-css' in group_names }}"
  shared: "{{ 'web-svc-css' in group_names }}"
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — captcha backend, infrastructural
recaptcha:
  enabled: "{{ RECAPTCHA_ENABLED | bool }}"
prometheus:
  bond: 1
  enabled: "{{ 'web-app-prometheus' in group_names }}"
  shared: "{{ 'web-app-prometheus' in group_names }}"

# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
  bond: 0.5
  enabled: "{{ 'svc-net-tor' in group_names }}"
  shared: true # nocheck: dynamic-flag