# Opt-in overlay, layered ON TOP of docker-compose.openzaak.yml (never alone):
#
#   docker compose -f docker-compose.openzaak.yml -f docker-compose.openzaak.bff.yml up -d
#
# Gives this harness's `web` (the OpenZaak API) an extra, dotted hostname alias
# (`openzaak.local`) on its OWN network, so the root project's `api` container (joined in via
# `docker-compose.openzaak.yml` at the repo root, as an EXTERNAL network) can reach it. See
# `scripts/openzaak-ui-up.sh` for the one-command version that brings both projects up
# together, seeds the catalogus, and grants the extra authorization scope this alias needs.
#
# Three real things this works around, each discovered empirically (curl against the
# running containers), not guessed:
#
# 1. Why container-to-container instead of `http://localhost:8000`: this dev environment's
#    rootless Podman drops container→host-port traffic through `host.docker.internal`
#    (confirmed for the notifications overlay's celery worker — DNS resolves it, every
#    TCP connect times out).
#
# 2. Why the ROOT project's `api` joins INTO this project's network (below), not the other way
#    around: the root project's frontend service is also called `web`. Docker Compose always
#    adds a service's own name as a network alias on every network it joins — so if THIS `web`
#    joined the root project's network, "web" would resolve to two different containers there.
#    Only `api` crosses into this network, under its own already-unique name.
#
# 3. Why the alias has a dot in it (`openzaak.local`, not e.g. `openzaak`): Django's built-in
#    URLValidator rejects a bare, dotless hostname in a URL field (it special-cases exactly
#    "localhost"; anything else needs a dot or to be a valid IP). OpenZaak's `zaaktype` field
#    (and others) run through this validator — confirmed with a POST referencing
#    `http://<dotless-alias>:8000/...` failing "Voer een geldige URL in" (enter a valid URL)
#    before any authorization check even runs.
services:
  web:
    environment:
      # Django rejects any request whose Host header isn't in ALLOWED_HOSTS.
      ALLOWED_HOSTS: localhost,127.0.0.1,web,openzaak.local
    networks:
      default:
        aliases: [openzaak.local]