---
# nocheck: seaweedfs-required Weblate keeps its VCS checkouts and its cache on a volume and offers no object-store backend for them
sso:
bond: 1
enabled: "{{ 'web-app-keycloak' in group_names }}"
shared: "{{ 'web-app-keycloak' in group_names }}"
flavor: oidc
logout:
bond: 1
enabled: "{{ 'web-svc-logout' in group_names }}"
shared: "{{ 'web-svc-logout' in group_names }}"
dashboard:
bond: 1
enabled: "{{ 'web-app-dashboard' in group_names }}"
shared: "{{ 'web-app-dashboard' in group_names }}"
matomo:
bond: 1
enabled: "{{ 'web-app-matomo' in group_names }}"
shared: "{{ 'web-app-matomo' in group_names }}"
email:
bond: 1
enabled: "{{ 'web-app-mailu' in group_names }}"
shared: "{{ 'web-app-mailu' in group_names }}"
design:
bond: 1
enabled: "{{ 'web-svc-design' in group_names }}"
shared: "{{ 'web-svc-design' in group_names }}"
# nocheck: playwright-service-flag — scrape target, covered by web-app-prometheus' own spec
prometheus:
bond: 1
enabled: "{{ 'web-app-prometheus' in group_names }}"
shared: "{{ 'web-app-prometheus' in group_names }}"
# nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
postgres:
bond: 1
enabled: true # nocheck: dynamic-flag
shared: "{{ 'svc-db-postgres' in group_names }}"
# nocheck: playwright-service-flag — cache engine, covered by role-local integration tests
redis:
bond: 1
enabled: true # nocheck: dynamic-flag
shared: "{{ 'svc-db-redis' in group_names }}"
# nocheck: playwright-service-flag: shared provider entity; the app itself is covered by this role's own Playwright spec
weblate:
backup:
stop_required: true
name: weblate
bond: 1
enabled: true # nocheck: dynamic-flag
shared: true
healthcheck:
flavor: http
modes:
compose:
enabled: true
swarm:
enabled: true
host:
enabled: false
image: weblate/weblate
version: "2026.9"
min_storage: 1GB
ports:
local:
http: 8100
internal:
http: 8080
lifecycle: beta
cpus: "2.0"
mem_reservation: 1g
mem_limit: 2g
pids_limit: 1024
registration_open: false
site_title: Infinito.Nexus Translations
# nocheck: playwright-service-flag — no browser surface; it runs Django's migrate and the beat scheduler
beat:
backup:
stop_required: true
name: weblate-beat
bond: 1
modes:
compose:
enabled: true
swarm:
enabled: true
host:
enabled: false
image: weblate/weblate
version: "2026.9"
min_storage: 1GB
lifecycle: beta
# nocheck: single-replica weblate-beat. It is the only task upstream lets run Django's migrate, and the beat scheduler itself must stay singular or every periodic task fires once per replica.
replicas: 1
cpus: "1.0"
mem_reservation: 512m
mem_limit: 1g
pids_limit: 512
# nocheck: playwright-service-flag — no browser surface; it drains the celery queues
worker:
backup:
stop_required: true
name: weblate-worker
bond: 1
modes:
compose:
enabled: true
swarm:
enabled: true
host:
enabled: false
image: weblate/weblate
version: "2026.9"
min_storage: 1GB
lifecycle: beta
cpus: "1.0"
mem_reservation: 512m
mem_limit: 1g
pids_limit: 512
# nocheck: playwright-service-flag — the gateway reads Weblate over its API, it has no browser surface here
translate: # nocheck: shared-provider web-svc-translate owns this service; Weblate is only its memory
bond: 0.5
enabled: "{{ 'web-svc-translate' in group_names }}"
shared: "{{ 'web-svc-translate' in group_names }}"
# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, and this role binds nothing that refuses it, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag the onion rides every variant of this role
# nocheck: playwright-service-flag infrastructure backup consumer
# nocheck: dynamic-flag there is no per-consumer backup instance, so shared stays literally true
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
bond: 1
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
shared: true
docs:
bond: 0.5
enabled: "{{ 'web-app-docs' in group_names }}"
shared: "{{ 'web-app-docs' in group_names }}"
