Network

ByteBite staging exposes only HTTP (80) and HTTPS (443) on the public internet. Application and database ports remain on internal Docker networks.

Port exposure verified on 88.99.0.118: 2026-09-08

Public subnet

Public IP mapping

Request flow (staging)

Client
  -> Cloudflare DNS (A/ALIAS -> edge.getbytebite.co -> 88.99.0.118)
    -> ens18 :80 or :443
      -> dokploy-traefik (dokploy-network)
        -> target container on dokploy-network

Docker networks (staging)

ByteBite staging containers participate in multiple Docker networks. The repository defines bytebite and declares external dokploy-network; Dokploy still injects dokploy-network onto services with UI-managed domains.

Repository-defined: bytebite

Defined in compose.deploy.yml:

networks:
  bytebite:
    name: bytebite

Application services (api, storefront, dashboard, docs) and the migrate one-shot attach to this network. It enables inter-service communication (e.g. storefront → http://api:3001).

dokploy-network (external in compose + Dokploy-injected)

Traefik's Docker provider watches containers on dokploy-network. Dokploy attaches services with UI-managed domains to this network automatically.

compose.deploy.yml also declares dokploy-network as external: true so the migrate one-shot can join it. migrate has no Dokploy domain, so it would otherwise be unable to resolve the managed PostgreSQL hostname.

Runtime invariant: storefront and api must be reachable on dokploy-network for Traefik routing (including manual wildcard labels). Dokploy domain configuration currently provides this attachment.

Generated Compose default network

Dokploy creates a per-deployment default network with a generated name, for example:

bytebite-staging-oc5ach_default

Observed pattern: {project-prefix}_{default}. The suffix (oc5ach) is Dokploy-generated and not stable.

Network attachment summary

Exact attachment is confirmed via docker network inspect on the host.

Local Docker networks

Local development (compose.yml) uses:

Traefik routes via the file provider (infrastructure/traefik/dev/dynamic.yml), not Docker labels.

Public port exposure

Verified externally on 88.99.0.118 (2026-09-08):

Applications use expose: in compose.deploy.yml, not host ports: mappings. This is a deliberate security boundary — only Traefik is internet-facing.

Internal service ports

Related

• Traefik — ingress routing
• DNS — how hostnames reach the edge IP
• Security — port closure rationale
• Validation — port check commands