---
# nocheck: playwright-service-flag
logout:
bond: 1
enabled: "{{ 'web-svc-logout' in group_names }}"
shared: "{{ 'web-svc-logout' in group_names }}"
# nocheck: playwright-service-flag
dashboard:
bond: 1
enabled: "{{ 'web-app-dashboard' in group_names }}"
shared: "{{ 'web-app-dashboard' in group_names }}"
# nocheck: playwright-service-flag
matomo:
bond: 1
enabled: "{{ 'web-app-matomo' in group_names }}"
shared: "{{ 'web-app-matomo' in group_names }}"
# nocheck: dynamic-flag
# nocheck: playwright-service-flag
email:
enabled: false
shared: false
# nocheck: dynamic-flag - gated on services.sso.enabled, not on group_names
# nocheck: playwright-service-flag - runtime DOM patch (injected logout), no probe-able surface flag
javascript:
bond: 1
enabled: "{{ lookup('config', 'web-app-pihole', 'services.sso.enabled') | bool }}"
shared: "{{ lookup('config', 'web-app-pihole', 'services.sso.enabled') | bool }}"
# nocheck: playwright-service-flag
prometheus:
bond: 1
enabled: "{{ 'web-app-prometheus' in group_names }}"
shared: "{{ 'web-app-prometheus' in group_names }}"
ready_path: admin/
# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag
design:
bond: 1
enabled: "{{ 'web-svc-design' in group_names }}"
shared: "{{ 'web-svc-design' in group_names }}"
title: "Pi-hole"
slots:
logo:
width: 256
height: 256
# nocheck: playwright-service-flag
sso:
bond: 1
enabled: "{{ 'web-app-keycloak' in group_names }}"
shared: "{{ 'web-app-keycloak' in group_names }}"
flavor: oauth2
oauth2:
origin:
host: pihole
port: "80"
allowed_groups:
- "{{ lookup('rbac_group_path', application_id='web-app-pihole', role='administrator') }}"
pihole:
backup:
stop_required: true
healthcheck:
flavor: tcp
modes:
compose:
enabled: true
swarm:
enabled: false
image: pihole/pihole
version: "2026.10.1"
upstream_dns: "{{ NETWORK_PUBLIC_DNS_RESOLVERS }}"
cpus: "0.5"
mem_reservation: "128m"
mem_limit: "256m"
min_storage: "243MB"
pids_limit: 512
ports:
internal:
http: 80
local:
http: 8078
sso: 16508
sso_onion: 16542
run_after:
- web-app-keycloak
lifecycle: beta
# nocheck: dynamic-flag
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
bond: 1
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
shared: true
docs:
bond: 0.5
enabled: "{{ 'web-app-docs' in group_names }}"
shared: "{{ 'web-app-docs' in group_names }}"
