---
coturn:
modes:
compose:
enabled: true
swarm:
enabled: true
bond: 1
enabled: true
shared: true
image: coturn/coturn
version: 4.18.0
min_storage: 246MB
user_auth_enabled: false
cpus: 1.0
mem_reservation: 512m
mem_limit: 1g
pids_limit: 256
network_mode: host
ports:
internal:
http: 80
local:
http: 8064
public:
stun_turn: 3481
stun_turn_tls: 5351
relay:
start: 20000
end: 39999
lifecycle: beta
gateway:
image: nginx
version: 1.31.8-alpine
cpus: "0.3"
mem_reservation: 256m
mem_limit: 512m
pids_limit: 256
# nocheck: dynamic-flag coturn runs with user_auth_enabled false, so it keeps no credential store to back; the entry stays literal until auth is switched on and no template references redis today.
redis:
backup:
disabled: true
enabled: false
shared: "{{ 'svc-db-redis' in group_names }}"
# nocheck: variants-coverage — the tor conjunct is the clearnet-variant-tor invariant below, so no variant may pin the true polarity on an onion node
# nocheck: bond-baseline — same reason: variant 0 must not pin the scrape consumer on
prometheus:
bond: 1
enabled: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"
shared: "{{ ('web-app-prometheus' in group_names) and ('svc-net-tor' not in group_names) }}"
# nocheck: clearnet-variant-tor — STUN/TURN on UDP plus a 20000-port relay range, which no onion descriptor can publish; the only HTTP is a gateway returning a plaintext OK. No dashboard, logout, css or matomo block and no Playwright spec, so an onion round claims no visitable surface for it. Its one consumer declaration, prometheus, carries the tor gate.
tor:
enabled: false # nocheck: dynamic-flag no group can turn this on: see the clearnet-variant-tor reason above
shared: false # nocheck: dynamic-flag same
# nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
container_backup: # nocheck: bond-baseline backup host joins outside the variant topology
bond: 1
enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
shared: true
