From 344ecb33894c9725b776fb3a2639117afc558d8f Mon Sep 17 00:00:00 2001
From: Michele Bigi <mikbigi@gmail.com>
Date: Sun, 20 Sep 2026 00:37:04 +0200
Subject: [PATCH] Join railway-caddy network pinscope_pinscope after compose
 up.

Caddy reverse_proxies periscope-frontend by Docker DNS and is not on
the compose project bridge; attach the app containers so HTTPS stops 502.
---
 README.md                   | 2 +-
 docker-compose.yml          | 6 +++---
 scripts/update-periscope.sh | 9 +++++++++
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 27d5ac2..1221fb0 100644
--- a/README.md
+++ b/README.md
@@ -81,7 +81,7 @@ cd /root/periscope
 ./scripts/update-periscope.sh
 ```
 
-The script cds via `dirname "$0"/..` (no `find`). It refuses to run if the resolved root is not `/root/periscope`. Compose project name is `periscope`; the Docker network stays **`pinscope_periscope`** (legacy name) with aliases `pinscope` / `periscope-frontend` so host Caddy/nginx that joined that network keep resolving. It pulls the current branch, writes `NEXT_PUBLIC_API_URL` / `CORS_ORIGINS` for `https://periscope.michelebigi.it`, rebuilds both Docker images, and leaves `data/` alone. First run: put `DEEPSEEK_API_KEY` in `.env` at the repo root (compose reads that file). `--no-pull` skips git. `SITE=https://other.host ./scripts/update-periscope.sh` overrides the public URL.
+The script cds via `dirname "$0"/..` (no `find`). It refuses to run if the resolved root is not `/root/periscope`. Compose project name is `periscope`. After `up`, the script connects `periscope-frontend` / `periscope-backend` to Docker network **`pinscope_pinscope`** (where `railway-caddy` reverse_proxies `periscope-frontend:3000`). It pulls the current branch, writes `NEXT_PUBLIC_API_URL` / `CORS_ORIGINS` for `https://periscope.michelebigi.it`, rebuilds both Docker images, and leaves `data/` alone. First run: put `DEEPSEEK_API_KEY` in `.env` at the repo root (compose reads that file). `--no-pull` skips git. `SITE=https://other.host ./scripts/update-periscope.sh` overrides the public URL.
 
 Do not set `ENVIRONMENT=production` unless Clerk auth is configured — that flag refuses to boot with auth disabled.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 19db408..81cc02e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,8 @@
 # Canonical compose project on the VPS is "periscope" (not the GitHub
 # clone folder name "pinscope"). Bind mounts stay relative to the checkout.
-# Keep the Docker network name pinscope_periscope so host Caddy/nginx that
-# joined the pre-rename network can still reach these containers by DNS.
+# Host Caddy (railway-caddy) lives on Docker network pinscope_pinscope and
+# reverse_proxies periscope-frontend:3000 / periscope-backend:8080. The
+# update script connects these containers to that network after up.
 name: periscope
 
 services:
@@ -61,5 +62,4 @@ services:
 
 networks:
   periscope:
-    name: pinscope_periscope
     driver: bridge
diff --git a/scripts/update-periscope.sh b/scripts/update-periscope.sh
index f76721d..2b7332e 100755
--- a/scripts/update-periscope.sh
+++ b/scripts/update-periscope.sh
@@ -168,6 +168,15 @@ upsert_env NEXT_PUBLIC_AUTH_MODE "local" .env
 log "docker compose up -d --build (data/ is kept)"
 compose up -d --build
 
+# Host Caddy (railway-caddy) is on pinscope_pinscope, not the compose
+# project network. Join so reverse_proxy periscope-frontend:3000 resolves.
+log "Attach app containers to host Caddy network(s)"
+for net in pinscope_pinscope pinscope_periscope; do
+  docker network inspect "$net" >/dev/null 2>&1 || continue
+  docker network connect "$net" periscope-frontend 2>/dev/null || true
+  docker network connect "$net" periscope-backend 2>/dev/null || true
+done
+
 log "Waiting for backend"
 ok=0
 for _ in $(seq 1 30); do