---
# nocheck: seaweedfs-playwright — S3 holds only recordings/whiteboard exports; needs the recorder service + a live multi-party meeting, so no single-user UI action deterministically triggers an S3 write
# nocheck: dynamic-flag — OpenTalk has no no-auth mode (controller/recorder require the OIDC client), so sso is a hard dependency.
sso:
bond: 1
enabled: true # nocheck: dynamic-flag
shared: true
flavor: oidc
oidc:
plugin: ""
# nocheck: dynamic-flag — LDAP is disabled for this role; the literal false is intentional, not group-gated.
ldap:
enabled: false # nocheck: dynamic-flag
shared: false # nocheck: dynamic-flag
logout:
bond: 1
enabled: "{{ 'web-svc-logout' in group_names }}"
shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
bond: 1
enabled: "{{ 'web-app-dashboard' in group_names }}"
shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
bond: 1
enabled: "{{ 'web-app-matomo' in group_names }}"
shared: "{{ 'web-app-matomo' in group_names }}"
email:
bond: 1
enabled: "{{ MAIL_PROVIDER in group_names }}"
shared: "{{ MAIL_PROVIDER in group_names }}"
# nocheck: playwright-service-flag — infrastructural sub-component (TURN/STUN)
coturn:
bond: 1
enabled: "{{ 'web-svc-coturn' in group_names }}"
shared: "{{ 'web-svc-coturn' in group_names }}"
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
postgres:
bond: 1
enabled: true # nocheck: dynamic-flag
shared: "{{ 'svc-db-postgres' in group_names }}"
# nocheck: shared
# nocheck: dynamic-flag
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
redis:
bond: 1
backup:
disabled: true
enabled: true # nocheck: dynamic-flag
shared: "{{ 'svc-db-redis' in group_names }}"
cpus: "0.5"
mem_reservation: 256m
mem_limit: 1g
pids_limit: 512
opentalk:
modes:
compose:
enabled: true
swarm:
enabled: true
# nocheck: default-placement-manager embedded rabbitmq engine state; node-local in swarm
placement: manager
name: opentalk
image: registry.opencode.de/opentalk/web-frontend
version: v2.9.2
update:
type: http_regex
url: https://gitlab.opencode.de/opentalk/ot-setup/-/raw/main/docker-compose.yaml
pattern: "OT_FRONTEND_IMAGE_TAG:-(v[0-9.]+)\\}"
min_storage: 234MB
backup:
no_stop_required: true
cpus: "0.5"
mem_reservation: 128m
mem_limit: 512m
pids_limit: 512
ports:
local:
http: 8073
internal:
http: 80
run_after:
- web-app-keycloak
lifecycle: beta
controller:
name: opentalk-controller
image: registry.opencode.de/opentalk/controller
version: v0.34.5
update:
type: http_regex
url: https://gitlab.opencode.de/opentalk/ot-setup/-/raw/main/docker-compose.yaml
pattern: "OPENTALK_CONTROLLER_IMAGE_TAG:-(v[0-9.]+)\\}"
min_storage: 291MB
backup:
no_stop_required: true
cpus: "1.5"
mem_reservation: 512m
mem_limit: 2g
pids_limit: 1024
ports:
local:
http: 8072
internal:
http: 11311
livekit:
name: opentalk-livekit
image: livekit/livekit-server
version: v1.13.11
min_storage: 238MB
cpus: "2.0"
mem_reservation: 512m
mem_limit: 2g
pids_limit: 1024
ports:
internal:
http: 7880
tcp: 7881
public:
stun_turn: 3479
relay:
start: 60000
end: 60999
# nocheck: playwright-service-flag — object store, no Playwright surface (provider: web-app-minio)
minio:
enabled: false # nocheck: dynamic-flag
shared: false # nocheck: dynamic-flag
min_storage: 20GB
cpus: "0.5"
mem_reservation: 256m
mem_limit: 1g
pids_limit: 512
# nocheck: playwright-service-flag — object store holds only recordings/whiteboard exports; no single-user UI write surface
seaweedfs:
bond: 1
name: opentalk-seaweedfs
enabled: true # nocheck: dynamic-flag
shared: "{{ 'web-app-seaweedfs' in group_names }}"
rabbit:
healthcheck:
test: ["CMD", "rabbitmq-diagnostics", "ping"]
# nocheck: healthcheck-timing-override rabbitmq-diagnostics starts an Erlang CLI node, which does not finish inside the 5s default
timeout: 10s
retries: 5
name: opentalk-rabbit
image: rabbitmq
version: 4.4.0
min_storage: 314MB
cpus: "0.5"
mem_reservation: 256m
mem_limit: 1g
pids_limit: 512
recorder:
name: opentalk-recorder
image: registry.opencode.de/opentalk/recorder
version: v0.17.5
update:
type: http_regex
url: https://gitlab.opencode.de/opentalk/ot-setup/-/raw/main/docker-compose.yaml
pattern: "RECORDER_IMAGE_TAG:-(v[0-9.]+)\\}"
ports:
internal:
http: 11511
min_storage: 775MB
cpus: "1.5"
mem_reservation: 512m
mem_limit: 2g
pids_limit: 1024
# nocheck: playwright-service-flag — verified by web-svc-css provider spec
css:
bond: 1
enabled: "{{ 'web-svc-css' in group_names }}"
shared: "{{ 'web-svc-css' in group_names }}"
prometheus:
bond: 1
enabled: "{{ 'web-app-prometheus' in group_names }}"
shared: "{{ 'web-app-prometheus' in group_names }}"
# nocheck: playwright-service-flag
tor:
enabled: false # nocheck: dynamic-flag
shared: false # nocheck: dynamic-flag
# nocheck: dynamic-flag
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
bond: 1
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
shared: true
