---
# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
litellm:
bond: 0.5
enabled: "{{ LITELLM_USABLE }}"
shared: true
# nocheck: dockerfile-custom
sso:
bond: 1
enabled: "{{ 'web-app-keycloak' in group_names }}"
shared: "{{ 'web-app-keycloak' in group_names }}"
flavor: oidc
ldap:
bond: 1
enabled: "{{ 'svc-db-openldap' in group_names }}"
shared: "{{ 'svc-db-openldap' in group_names }}"
logout:
bond: 1
enabled: "{{ 'web-svc-logout' in group_names }}"
shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
bond: 1
enabled: "{{ 'web-app-dashboard' in group_names }}"
shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
bond: 1
enabled: "{{ 'web-app-matomo' in group_names }}"
shared: "{{ 'web-app-matomo' in group_names }}"
email:
bond: 1
enabled: "{{ MAIL_PROVIDER in group_names }}"
shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag — TURN/STUN server, no Playwright surface (provider: web-svc-coturn)
coturn:
bond: 1
enabled: "{{ 'web-svc-coturn' in group_names }}"
shared: "{{ 'web-svc-coturn' in group_names }}"
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force Jitsi on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin Jitsi on.
jitsi:
bond: 1
enabled: "{{ lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'ansible' and 'svc-net-tor' not in group_names }}" # nocheck: dynamic-flag — Matrix offers Jitsi from the ansible flavor and off tor nodes only
shared: "{{ 'web-app-jitsi' in group_names }}"
domains:
- jitsi
ports:
internal:
http: 8000
local:
http: 8098
public:
media: 10001
livekit:
ports:
internal:
websocket: 7880
local:
websocket: 4005
public:
media: 10002
cpus: "1.0"
mem_reservation: 256m
mem_limit: 1g
pids_limit: 512
livekit_jwt:
ports:
internal:
http: 8030
local:
http: 8099
cpus: "0.2"
mem_reservation: 32m
mem_limit: 128m
pids_limit: 64
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
postgres:
bond: 1
enabled: true # nocheck: dynamic-flag — matrix always needs a database
shared: "{{ 'svc-db-postgres' in group_names }}"
synapse:
healthcheck:
flavor: curl
version: v1.164.2
image: matrixdotorg/synapse
name: matrix-synapse
backup:
no_stop_required: true
ports:
internal:
http: 8008
local:
http: 8021
public:
federation: 8448
onion:
# nocheck: onion-flag federation is dialled by clearnet homeservers resolving this server_name; serving it on the onion needs an onion server_name, which is a different deployment
federation: false
min_storage: 311MB
cpus: "1.5"
mem_reservation: "1g"
mem_limit: "2g"
pids_limit: 2048
element:
healthcheck:
flavor: wget
version: v1.12.33
image: vectorim/element-web
name: matrix-element
force_verification: true
ports:
local:
http: 8022
internal:
http: 80
min_storage: 263MB
cpus: "0.2"
mem_reservation: 128m
mem_limit: 256m
pids_limit: 256
matrix-chatgpt-bot:
version: 3.1.5
image: ghcr.io/matrixgpt/matrix-chatgpt-bot
min_storage: 307MB
cpus: "0.2"
mem_reservation: 128m
mem_limit: 256m
pids_limit: 256
# nocheck: playwright-service-flag — object store, no Playwright surface (provider: web-app-seaweedfs)
seaweedfs:
bond: 1
enabled: "{{ 'web-app-seaweedfs' in group_names }}"
shared: "{{ 'web-app-seaweedfs' in group_names }}"
public: true
# nocheck: playwright-service-flag — css consumer, no Playwright surface (provider: web-svc-css)
css:
bond: 1
enabled: "{{ 'web-svc-css' in group_names }}"
shared: "{{ 'web-svc-css' in group_names }}"
prometheus:
bond: 1
enabled: "{{ 'web-app-prometheus' in group_names }}"
shared: "{{ 'web-app-prometheus' in group_names }}"
native_metrics:
enabled: true
port: "{{ 9000 if lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'compose' else 9100 }}"
service_key: "{{ 'synapse' if lookup('config', 'web-app-matrix', 'services.matrix.flavor') == 'compose' else 'matrix' }}"
communication:
channel: true
# nocheck: playwright-service-flag: shared provider entity; the app itself is covered by this role's own Playwright spec
matrix:
healthcheck:
flavor: http_status
path: _matrix/client/versions
retries: 10
ports:
internal:
http: 8008
modes:
compose:
enabled: true
swarm:
enabled: true
bond: 1
enabled: true # nocheck: dynamic-flag — matrix always needs a database
shared: true
name: matrix
# nocheck: default-placement-manager inner docker-in-docker storage; node-local in swarm
placement: manager
flavor: ansible
upstream:
repo: https://github.com/spantaleev/matrix-docker-ansible-deploy
ref: 40179e6d4a36513eb77c4ef2eff067716ebb1821
migration_validated_version: v2026.05.18.0
runner:
image: infinito/web-app-matrix-mdad-runner:1
base_image: python
base_version: 3.13-slim
docker_cli_image: docker
docker_cli_version: 28.0.4-cli
playbook_tags: setup-all,start
server_name: "{{ DOMAIN_PRIMARY }}"
plugins:
appservice_irc: false
chatgpt: "{{ 'svc-ai-litellm' in group_names }}"
discord: false
gitter: false
heisenbridge: true
hookshot: false
mautrix_discord: false
mautrix_signal: false
mautrix_slack: false
mautrix_telegram: false
mautrix_twitter: false
mautrix_whatsapp: false
conferencing:
element_call: true
run_after:
- web-app-matomo
- web-app-keycloak
- web-app-stalwart
- web-app-mailu
lifecycle: beta
min_storage: "1GB"
cpus: "0.5"
mem_reservation: "128m"
mem_limit: "512m"
pids_limit: 256
# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag
exclusive: true
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
bond: 1
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
shared: true
