ehoandClaude Sonnet 5
8560746d15
The backend half of the sweep RD-18 did for the front end. git blame holds the provenance and stays correct when the code moves; the comment names a closed ticket and tells the reader nothing the sentence around it does not. public/letter.css and LetterHtml.golden.html change together, because the renderer inlines the CSS and the golden file snapshots the result. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
2.2 KiB
YAML
39 lines
2.2 KiB
YAML
# Opt-in overlay, layered ON TOP of docker-compose.openzaak.yml (never alone):
|
|
#
|
|
# docker compose -f docker-compose.openzaak.yml -f docker-compose.openzaak.bff.yml up -d
|
|
#
|
|
# Gives this harness's `web` (the OpenZaak API) an extra, dotted hostname alias
|
|
# (`openzaak.local`) on its OWN network, so the root project's `api` container (joined in via
|
|
# `docker-compose.openzaak.yml` at the repo root, as an EXTERNAL network) can reach it. See
|
|
# `scripts/openzaak-ui-up.sh` for the one-command version that brings both projects up
|
|
# together, seeds the catalogus, and grants the extra authorization scope this alias needs.
|
|
#
|
|
# Three real things this works around, each discovered empirically (curl against the
|
|
# running containers), not guessed:
|
|
#
|
|
# 1. Why container-to-container instead of `http://localhost:8000`: this dev environment's
|
|
# rootless Podman drops container→host-port traffic through `host.docker.internal`
|
|
# (confirmed for the notifications overlay's celery worker — DNS resolves it, every
|
|
# TCP connect times out).
|
|
#
|
|
# 2. Why the ROOT project's `api` joins INTO this project's network (below), not the other way
|
|
# around: the root project's frontend service is also called `web`. Docker Compose always
|
|
# adds a service's own name as a network alias on every network it joins — so if THIS `web`
|
|
# joined the root project's network, "web" would resolve to two different containers there.
|
|
# Only `api` crosses into this network, under its own already-unique name.
|
|
#
|
|
# 3. Why the alias has a dot in it (`openzaak.local`, not e.g. `openzaak`): Django's built-in
|
|
# URLValidator rejects a bare, dotless hostname in a URL field (it special-cases exactly
|
|
# "localhost"; anything else needs a dot or to be a valid IP). OpenZaak's `zaaktype` field
|
|
# (and others) run through this validator — confirmed with a POST referencing
|
|
# `http://<dotless-alias>:8000/...` failing "Voer een geldige URL in" (enter a valid URL)
|
|
# before any authorization check even runs.
|
|
services:
|
|
web:
|
|
environment:
|
|
# Django rejects any request whose Host header isn't in ALLOWED_HOSTS.
|
|
ALLOWED_HOSTS: localhost,127.0.0.1,web,openzaak.local
|
|
networks:
|
|
default:
|
|
aliases: [openzaak.local]
|