# Federation overlay: run LegacyHUB behind the TeamHUB gateway on the shared
# `teamhub_net`. Compared with the standalone dev compose this overlay:
#   - moves every backing service onto an internal-only network (no host ports);
#   - reaches the api ONLY via `teamhub_net` (the gateway upstream), never
#     directly from the host - so spoofing `X-TeamHub-*` is blocked by the network;
#   - turns on trusted-header identity enforcement (AUTH_REQUIRE_IDENTITY).
#
# The shared network must exist first (created by TeamHUB-Platform infra):
#   docker network create teamhub_net
#
# Usage (compose with prod hardening + this federation overlay):
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml \
#     -f docker-compose.teamhub.yml --env-file .env.prod up -d --build
#
# See RUNBOOK.md "Network model & firewall" for the matching firewall rules.

networks:
  teamhub_net:
    external: true
    name: teamhub_net
  legacyhub_db:
    internal: true

services:
  postgres:
    ports: !reset []
    networks: [legacyhub_db]

  minio:
    ports: !reset []
    networks: [legacyhub_db]

  opensearch:
    ports: !reset []
    networks: [legacyhub_db]

  qdrant:
    ports: !reset []
    networks: [legacyhub_db]

  redis:
    ports: !reset []
    networks: [legacyhub_db]

  api:
    # Not published to the host: the gateway reaches the api over teamhub_net.
    ports: !reset []
    networks: [legacyhub_db, teamhub_net]
    environment:
      AUTH_REQUIRE_IDENTITY: "true"

  worker:
    networks: [legacyhub_db, teamhub_net]