From 1f11a1c24f132f28daf9410fcd55d04c7c2c97d2 Mon Sep 17 00:00:00 2001
From: Gerald Fruhmann <geraldfruhmann@gmail.com>
Date: Tue, 18 Aug 2026 13:07:17 +0200
Subject: [PATCH] refactor(docker): use dedicated external gateway networks per
 service
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the single shared `proxy` external network with three dedicated
external networks — gateway-niles, gateway-vikunja, gateway-whatsapp — so
each service is only attached to the homelab-gateway segment it needs:

- niles_core   -> gateway-niles
- vikunja      -> gateway-vikunja
- evolution_api-> gateway-whatsapp

This isolates the reverse-proxy segments (least-privilege networking) instead
of sharing one flat proxy network across all upstreams. Networks are declared
`external: true` and created/managed by homelab-gateway.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker/docker-compose.yml | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index eaa08df..7b8ae9d 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -1,6 +1,6 @@
 # Niles AI - Complete Docker Setup
 # Services: Niles Core + Evolution API + PostgreSQL
-# HTTPS termination handled by homelab-gateway (external Caddy)
+# HTTPS termination handled by homelab-gateway through dedicated external networks.
 
 services:
   # PostgreSQL for Evolution API
@@ -74,7 +74,7 @@ services:
       - evolution_instances:/evolution/instances
     networks:
       - niles_network
-      - proxy
+      - gateway-whatsapp
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/ || exit 1"]
       interval: 30s
@@ -146,7 +146,7 @@ services:
         condition: service_healthy
     networks:
       - niles_network
-      - proxy
+      - gateway-vikunja
     restart: unless-stopped
 
   # Signal (signal-cli-rest-api) — activate via Settings UI (feature_signal)
@@ -308,7 +308,7 @@ services:
       - ../config:/app/config:ro
     networks:
       - niles_network
-      - proxy
+      - gateway-niles
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s
@@ -422,5 +422,12 @@ volumes:
 networks:
   niles_network:
     driver: bridge
-  proxy:
+  gateway-niles:
     external: true
+    name: gateway-niles
+  gateway-vikunja:
+    external: true
+    name: gateway-vikunja
+  gateway-whatsapp:
+    external: true
+    name: gateway-whatsapp