From 3dc5f4ae919fa912e417fab99c591d4dd2adf6c7 Mon Sep 17 00:00:00 2001
From: "S. Esmaeili" <jarvis7041@gmail.com>
Date: Sun, 25 Oct 2026 08:28:04 +0330
Subject: [PATCH] fix(compose): give internal services unique network aliases

On a shared Docker network (Dokploy) plain service names like web or api
also resolve to other stacks' containers, so the gateway balanced requests
across foreign containers and returned 502. Services reached by name now
carry an imen-* alias, used by the gateway upstreams and the service URLs.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 docker-compose.yml                 | 21 ++++++++++++++++++---
 docker/nginx/gateway.conf.template |  8 ++++----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 2ee65a4..8291ec3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,6 +6,9 @@
 # gateway (nginx) ─┬─ site domain  → web (Nuxt SSR)   /api → api   /media → minio
 #                  └─ admin domain → admin (static)   /api → api   /media → minio
 
+# services that other containers reach by name get an imen-* alias: on a shared network (Dokploy) plain
+# names like web or api would also resolve to other stacks' containers
+#
 # fixed project name, so this stack never shares containers or volumes with docker-compose.dev.yml
 name: imen
 
@@ -27,6 +30,9 @@ services:
 
   minio:
     image: docker.arvancloud.ir/minio/minio:latest
+    networks:
+      default:
+        aliases: [imen-minio]
     restart: unless-stopped
     command: server /data
     environment:
@@ -51,6 +57,9 @@ services:
 
   api:
     image: imen-api
+    networks:
+      default:
+        aliases: [imen-api]
     build:
       context: .
       dockerfile: docker/api.Dockerfile
@@ -67,14 +76,14 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       COOKIE_SECURE: ${COOKIE_SECURE:-true}
       TRUST_PROXY: ${TRUST_PROXY:-2}
-      S3_ENDPOINT: http://minio:9000
+      S3_ENDPOINT: http://imen-minio:9000
       S3_BUCKET: ${S3_BUCKET:-imen-media}
       S3_ACCESS_KEY: ${S3_ACCESS_KEY}
       S3_SECRET_KEY: ${S3_SECRET_KEY}
       S3_FORCE_PATH_STYLE: "true"
       S3_ENSURE_BUCKET: "true"
       MEDIA_PUBLIC_URL: /media
-      WEB_REVALIDATE_URL: http://web:3000/_internal/revalidate
+      WEB_REVALIDATE_URL: http://imen-web:3000/_internal/revalidate
       REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       ADMIN_PHONE: ${ADMIN_PHONE}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
@@ -82,6 +91,9 @@ services:
 
   web:
     image: imen-web
+    networks:
+      default:
+        aliases: [imen-web]
     build:
       context: .
       dockerfile: docker/web.Dockerfile
@@ -89,12 +101,15 @@ services:
     depends_on:
       - api
     environment:
-      NUXT_API_INTERNAL_URL: http://api:4000/api
+      NUXT_API_INTERNAL_URL: http://imen-api:4000/api
       NUXT_REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       NUXT_PUBLIC_SITE_URL: https://${SITE_DOMAIN}
 
   admin:
     image: imen-admin
+    networks:
+      default:
+        aliases: [imen-admin]
     build:
       context: .
       dockerfile: docker/admin.Dockerfile
diff --git a/docker/nginx/gateway.conf.template b/docker/nginx/gateway.conf.template
index b773171..31de5f1 100644
--- a/docker/nginx/gateway.conf.template
+++ b/docker/nginx/gateway.conf.template
@@ -2,10 +2,10 @@
 # (only ${SITE_DOMAIN}, ${ADMIN_DOMAIN} and ${S3_BUCKET} are replaced; nginx's own $vars stay).
 # TLS is expected to be terminated in front of this container (host nginx / Traefik / CDN).
 
-upstream web_upstream { server web:3000; }
-upstream api_upstream { server api:4000; }
-upstream admin_upstream { server admin:80; }
-upstream media_upstream { server minio:9000; }
+upstream web_upstream { server imen-web:3000; }
+upstream api_upstream { server imen-api:4000; }
+upstream admin_upstream { server imen-admin:80; }
+upstream media_upstream { server imen-minio:9000; }
 
 # keep the scheme reported by the TLS proxy in front, if any
 map $http_x_forwarded_proto $forwarded_proto {