fix(compose): give internal services unique network aliases

On a shared Docker network (Dokploy) plain service names like web or api
also resolve to other stacks' containers, so the gateway balanced requests
across foreign containers and returned 502. Services reached by name now
carry an imen-* alias, used by the gateway upstreams and the service URLs.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -6,6 +6,9 @@
 # gateway (nginx) ─┬─ site domain  → web (Nuxt SSR)   /api → api   /media → minio
 #                  └─ admin domain → admin (static)   /api → api   /media → minio
 
+# services that other containers reach by name get an imen-* alias: on a shared network (Dokploy) plain
+# names like web or api would also resolve to other stacks' containers
+#
 # fixed project name, so this stack never shares containers or volumes with docker-compose.dev.yml
 name: imen
 
@@ -27,6 +30,9 @@ services:
 
   minio:
     image: docker.arvancloud.ir/minio/minio:latest
+    networks:
+      default:
+        aliases: [imen-minio]
     restart: unless-stopped
     command: server /data
     environment:
@@ -51,6 +57,9 @@ services:
 
   api:
     image: imen-api
+    networks:
+      default:
+        aliases: [imen-api]
     build:
       context: .
       dockerfile: docker/api.Dockerfile
@@ -67,14 +76,14 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       COOKIE_SECURE: ${COOKIE_SECURE:-true}
       TRUST_PROXY: ${TRUST_PROXY:-2}
-      S3_ENDPOINT: http://minio:9000
+      S3_ENDPOINT: http://imen-minio:9000
       S3_BUCKET: ${S3_BUCKET:-imen-media}
       S3_ACCESS_KEY: ${S3_ACCESS_KEY}
       S3_SECRET_KEY: ${S3_SECRET_KEY}
       S3_FORCE_PATH_STYLE: "true"
       S3_ENSURE_BUCKET: "true"
       MEDIA_PUBLIC_URL: /media
-      WEB_REVALIDATE_URL: http://web:3000/_internal/revalidate
+      WEB_REVALIDATE_URL: http://imen-web:3000/_internal/revalidate
       REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       ADMIN_PHONE: ${ADMIN_PHONE}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
@@ -82,6 +91,9 @@ services:
 
   web:
     image: imen-web
+    networks:
+      default:
+        aliases: [imen-web]
     build:
       context: .
       dockerfile: docker/web.Dockerfile
@@ -89,12 +101,15 @@ services:
     depends_on:
       - api
     environment:
-      NUXT_API_INTERNAL_URL: http://api:4000/api
+      NUXT_API_INTERNAL_URL: http://imen-api:4000/api
       NUXT_REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       NUXT_PUBLIC_SITE_URL: https://${SITE_DOMAIN}
 
   admin:
     image: imen-admin
+    networks:
+      default:
+        aliases: [imen-admin]
     build:
       context: .
       dockerfile: docker/admin.Dockerfile

docker/nginx/gateway.conf.template

@@ -2,10 +2,10 @@
 # (only ${SITE_DOMAIN}, ${ADMIN_DOMAIN} and ${S3_BUCKET} are replaced; nginx's own $vars stay).
 # TLS is expected to be terminated in front of this container (host nginx / Traefik / CDN).
 
-upstream web_upstream { server web:3000; }
-upstream api_upstream { server api:4000; }
-upstream admin_upstream { server admin:80; }
-upstream media_upstream { server minio:9000; }
+upstream web_upstream { server imen-web:3000; }
+upstream api_upstream { server imen-api:4000; }
+upstream admin_upstream { server imen-admin:80; }
+upstream media_upstream { server imen-minio:9000; }
 
 # keep the scheme reported by the TLS proxy in front, if any
 map $http_x_forwarded_proto $forwarded_proto {