compose.host-gateway.yml

Rama main · réplica de lectura del repositorio original.

# compose.host-gateway.yml — reach a loopback-published gateway with host networking.
#
# WHY THIS EXISTS
# ---------------
# The gateway's own port (`:20128`) is published on the gateway host's loopback
# and docker0 only — `make gateway-auth-mode` makes Cerulean Authentik its only
# gate, so that port's reachability is the whole control. Docker publishes a
# loopback binding to the loopback interface alone, so a bridge container cannot
# reach it at all; measured from a bridge container, all of these fail:
#
#   http://host.docker.internal:20128/v1   -> no connection
#   http://172.17.0.1:20128/v1             -> no connection
#   http://192.168.1.71:20128/v1           -> no connection
#
# Everything that is not a host-mode process on the gateway host goes through the
# SSO proxy in front of the gateway instead, `:20128`, which exempts `/v1` for API
# clients. That door IS reachable from a bridge container — it is what the base
# file's default now names — so this overlay is needed only by a caller that pins
# the *loopback* door: host networking plus
# `OMNIROUTE_BASE_URL=http://127.0.0.1:20128/v1`.
#
# WHO NEEDS IT
# ------------
# `make docker-studio-up` still uses it, and that is how the gateway host's copy
# of this stack is run. The failure it prevents is silent, and it was measured on
# this deployment — Studio was rebuilt from the base file alone, landed on the
# bridge network, and resolved its own `OMNIROUTE_BASE_URL`
# (`http://127.0.0.1:20128/v1`) to itself:
#
#   http://127.0.0.1:20128/healthz    -> FAIL ECONNREFUSED   (from inside Studio)
#   http://192.168.1.71:20128/healthz -> 200                 (the door, from the bridge network)
#
# That second probe is what identifies this case rather than a gateway that is
# simply down: the address that works is NOT the one in `OMNIROUTE_BASE_URL`.
#
# Studio stayed `healthy` throughout, because its healthcheck only asks whether
# Studio answers. The UI showed an empty pane and the gateway log showed nothing
# at all, since no request ever arrived. Use `make docker-studio-up` rather than
# `docker compose up -d studio` so a rebuild cannot drop this.
#
# WHEN NOT TO USE IT
# ------------------
# Leave it out when the door in `.env` is a routable address — `192.168.1.71:20128`
# for any other host, which is what `.50` uses, or `host.docker.internal:20128` on
# the gateway's own host — because a bridge container reaches both directly. Read
# the caveat at the top of docker-compose.yml before changing anything here.
#
# USAGE
# -----
#   docker compose -f docker-compose.yml -f compose.host-gateway.yml up -d
#
# `ports` and `extra_hosts` are cleared rather than left in place: Docker
# discards published ports in host mode and warns loudly, and host.docker.internal
# is pointless when the container already shares the host's network namespace.
# An explicit override keeps the output honest instead of papering over it.

services:
  olympus:
    network_mode: host
    ports: !override []
    extra_hosts: !override []

  studio:
    network_mode: host
    ports: !override []
    extra_hosts: !override []