---
# nocheck: seaweedfs-playwright — the console stores no objects of its own; this flag exists to join
# the engine's shared_net (meta/networks.yml consumer key), and files/playwright/test-storage-buckets.js
# already asserts every consumer bucket through the filer it serves.
# nocheck: playwright-service-flag — engine provider, covered by the web-svc-seaweedfs CLI test
# nocheck: dynamic-flag the flag's only job is joining the engine's shared_net, and its false branch yields a console container that cannot start
seaweedfs:
bond: 1
enabled: true
shared: true
# nocheck: variants-coverage the onion gate is a hard invariant; no variant may force this consumer on a tor node.
# nocheck: bond-baseline same reason: variant 0 must not pin this consumer on.
sso:
bond: 1
enabled: "{{ lookup('network_served', 'clearnet', 'web-app-keycloak') }}"
shared: "{{ lookup('network_served', 'clearnet', 'web-app-keycloak') }}"
flavor: oauth2
oauth2:
origin:
host: seaweedfs-console
port: "80"
allowed_groups:
- "{{ lookup('rbac_group_path', application_id='web-app-seaweedfs', role='administrator') }}"
# nocheck: dynamic-flag — LDAP is disabled for this role; the literal false is intentional, not group-gated.
ldap:
enabled: false
shared: false
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force this consumer on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin this consumer on.
logout:
bond: 1
enabled: "{{ lookup('network_served', 'clearnet', 'web-svc-logout') }}"
shared: "{{ lookup('network_served', 'clearnet', 'web-svc-logout') }}"
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force this consumer on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin this consumer on.
dashboard:
bond: 1
enabled: "{{ lookup('network_served', 'clearnet', 'web-app-dashboard') }}"
shared: "{{ lookup('network_served', 'clearnet', 'web-app-dashboard') }}"
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force this consumer on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin this consumer on.
prometheus:
bond: 1
enabled: "{{ lookup('network_served', 'clearnet', 'web-app-prometheus') }}"
shared: "{{ lookup('network_served', 'clearnet', 'web-app-prometheus') }}"
# nocheck: playwright-service-flag — design consumer, no Playwright surface (provider: web-svc-design)
# nocheck: variants-coverage the onion gate of the sso flag above reaches here: without that gate the vhost answers 403 and carries no design surface, so no variant may force it on a tor node.
# nocheck: bond-baseline same reason: variant 0 must not pin this surface on.
design:
bond: 1
enabled: "{{ lookup('network_served', 'clearnet', 'web-svc-design') }}"
shared: "{{ lookup('network_served', 'clearnet', 'web-svc-design') }}"
slots:
logo:
width: 50
height: 50
# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag
# nocheck: image-healthcheck no internal port declared, so no probe can address it
# nocheck: dynamic-flag — the role's own console container, not a partner integration.
# nocheck: playwright-service-flag — self-provider
# nocheck: variants-coverage — the onion gate is a hard invariant; no variant may force the console on a tor node.
# nocheck: bond-baseline — same reason: variant 0 must not pin the console on.
seaweedfs-console:
name: seaweedfs-console
image: nginx
version: 1.31-alpine
enabled: "{{ lookup('network_served', 'clearnet') }}"
shared: false
domains:
- filer
- master
modes:
compose:
enabled: true
swarm:
enabled: true
ports:
local:
sso: 16507
sso_onion: 16549
internal:
http: 80
healthcheck:
flavor: http
path: healthz
min_storage: 128MB
cpus: "0.2"
mem_reservation: 64m
mem_limit: 128m
pids_limit: 128
run_after:
- web-svc-seaweedfs
- web-app-keycloak
lifecycle: beta
docs:
bond: 0.5
enabled: "{{ 'web-app-docs' in group_names }}"
shared: "{{ 'web-app-docs' in group_names }}"
