fix(compose): run locally without the edge and xenforo_internal networks

[SyniRon]

Summary

The repo's compose file stops declaring external networks, so docker compose up starts on a fresh host:

 services:
   cavbot2:
     networks:
-      - xenforo_internal
       - cavbot2_internal
-      - edge
 networks:
-  xenforo_internal:
-    external: true
-  edge:
-    external: true
   cavbot2_internal:

README step 4 says the file is for local runs. Production's stack lives on the production host, and a deploy sends that host only a version tag. The step names the networks the bot joins there:

Network	What it carries for the bot
edge	Nginx Proxy Manager's requests to the panel on 8080, and a route to the 7Cav API
xenforo_internal	A route to the 7Cav API

7cav-api is on both, so dropping xenforo_internal from production's stack leaves lookups working over edge. The CAV_API_BASE_URL and PANEL_ADDR notes in the README and .env.example now describe production's stack and point to step 4. The troubleshooting row for a missing xenforo_internal is gone.

Closes #799
Refs #652
Refs #798

Evidence

On a host with neither edge nor xenforo_internal, after docker build -t cavbot2:latest .:

• Before: docker compose up --no-start stops with network xenforo_internal declared as external, but could not be found, exit 1. docker compose config --format json | jq '[.networks[] | select(.external)] | map(.name)' prints ["edge","xenforo_internal"].
  After: docker compose up --no-start creates cavbot2 and cavbot2-db, exit 0 in 0.7s. The jq check prints []. docker compose up with the .env.example compose BOT_DB_DSN and placeholder Discord values logs Bot database migrated applied=22.

Two mutants of docker-compose.yml show the checks catch a regression:

declare an external network this host already has
  up --no-start   passes   (only a fresh host would fail)
  jq check        fails    -> catches it on every host
take cavbot2 off cavbot2_internal
  up --no-start   passes
  bot log         "Bot database not answering, retrying"  -> caught

.github/scripts/gate.sh passed on 7cbb61a with a clean tree.

Merge Danger

Door: two-way

A revert puts back the old compose file and README text.

Blast Radius: local

Production never reads this file. Someone who ran the repo's compose file on a host that has edge loses the proxy's route to the panel, and CAV_API_BASE_URL=http://7cav-api:11000 stops resolving for them. No member or panel user sees a change, so the PR doesn't carry needs-smoke.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: 7Cav/cavbot2/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6a0c3935-9bed-452e-b739-a4bc9281c5f3

📥 Commits

Reviewing files that changed from the base of the PR and between f0396ac and 7cbb61a.

📒 Files selected for processing: 3

• .env.example
• README.md
• docker-compose.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Clarified production API and panel network setup, and updated environment-variable guidance.
  • Updated local Docker instructions to use the compose-managed internal network.
  • Removed the troubleshooting guidance for a missing external xenforo_internal network.
• Chores
  • Local Docker setup no longer connects the service to the external xenforo_internal or edge networks.

The local Compose service now uses only cavbot2_internal. The README and environment example distinguish local networking from production networks and document the production API and panel settings.

Changes: Network setup

Layer / File(s)	Summary
Compose networking and setup documentation docker-compose.yml, README.md, .env.example	Compose connects cavbot2 only to cavbot2_internal and removes the external network declarations. The README describes local and production network paths and removes the xenforo_internal troubleshooting entry. The README and environment example identify the production API and panel settings.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 7cbb6

Local Compose runs no longer require externally created production networks. The production networks are documented as host-managed, and no concrete merge-blocking risk remains.

Security architecture risk: 🔵 Low · up to 7cbb6

The local configuration removes access to shared production networks without adding exposed ports or changing credentials or persistent storage. No introduced security concern was identified. Production routing assurances depend on host-maintained configuration that was unavailable for verification.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The direct network change is bounded to installations consuming the repository Compose file. Removing shared-network attachments narrows their network adjacency rather than granting new authority. The unchanged tag-only deployment path does not directly apply this topology change to production.

Trust Boundaries and Controls

• inferred — Network membership supplies reachability, not caller identity. The README's assertion that the proxy is the only production ingress cannot be established from an unpublished port alone; the host stack and other network members were unavailable. This is an unverified deployment assertion, not evidence of a PR-introduced authentication bypass.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: local Compose runs no longer require the external edge and xenforo_internal networks.
Description check		The description directly explains the Compose, README, and environment-documentation changes, including local and production network behavior and reported validation results.
Linked Issues check		Issue [#799] requires local setup to declare only networks used by the bot, document each network purpose, and identify the production network path to the 7Cav API. docker-compose.yml now declares o…
Out of Scope Changes check		The changes stay within issue [#799]. The .env.example edits clarify the documented production API and panel network configuration. The README edits update local Compose instructions, production net…

Full details: Linked Issues check

Explanation

Issue [#799] requires local setup to declare only networks used by the bot, document each network purpose, and identify the production network path to the 7Cav API. docker-compose.yml now declares only cavbot2_internal and removes the external edge and xenforo_internal requirements. README step 4 documents the local network and the production edge and xenforo_internal paths. It states that 7cav-api is on both networks and that production lookups remain available through edge. .env.example points to this documentation. The reported compose checks and .github/scripts/gate.sh run support the change.

Full details: Out of Scope Changes check

Explanation

The changes stay within issue [#799]. The .env.example edits clarify the documented production API and panel network configuration. The README edits update local Compose instructions, production network documentation, environment-variable references, and the obsolete troubleshooting entry. The Compose edit removes only the external network requirements and updates the related comment. No unrelated behavior or production stack configuration changes are present.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}