---
# nocheck: playwright-service-flag — CDN does not appear as a dashboard tile
# nocheck: dynamic-flag
dashboard:
enabled: false
# nocheck: playwright-service-flag — self-provider
cdn:
# nocheck: default-placement-manager the one-shot npm-mirror build must write the served CDN root, a node-local host bind openresty (manager-pinned) reads
placement: manager
modes:
host:
enabled: true
compose:
enabled: true
swarm:
enabled: true
bond: 1
enabled: true
shared: true
flavor: internal
cpus: "0.2"
mem_reservation: 128m
mem_limit: 256m
pids_limit: 128
min_storage: "1GB"
lifecycle: beta
# nocheck: playwright-service-flag — transient node image used only to build the npm asset mirror, never served
# nocheck: image-healthcheck build-time image run as a one-shot, no service port
build:
# nocheck: single-replica one-shot npm-mirror build writing the shared served root; parallel replicas would race and duplicate work
replicas: 1
image: node
version: "26-slim"
cpus: "1.0"
mem_reservation: 128m
mem_limit: 256m
pids_limit: 256
# nocheck: playwright-service-flag — CDN serves static assets, no HTML pages with tracking snippet
matomo:
bond: 1
enabled: "{{ 'web-app-matomo' in group_names }}"
shared: "{{ 'web-app-matomo' in group_names }}"
# nocheck: matomo-track
track: false
# nocheck: playwright-service-flag — canonical:cdn alias of self-provider
# nocheck: dynamic-flag
javascript:
enabled: false
shared: true
canonical: cdn
# nocheck: playwright-service-flag — /metrics endpoint covered by web-app-prometheus's own spec
prometheus:
bond: 1
enabled: "{{ 'web-app-prometheus' in group_names }}"
shared: "{{ 'web-app-prometheus' in group_names }}"
# nocheck: prometheus-scrape
scrape: false
# nocheck: playwright-service-flag
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
tor:
bond: 0.5
enabled: "{{ 'svc-net-tor' in group_names }}"
shared: true # nocheck: dynamic-flag
