# Exercise 2 — Custom Networks and Isolation (medium)
#
# Model a setup with THREE services where one (internal-db) must be
# reachable ONLY by a backend service, never directly by a public-facing
# frontend — using two separate custom networks to enforce that boundary,
# rather than relying on application-level access control alone.
#
# STEP 1: declare two top-level custom networks: `public-net` and
#         `internal-net`.
# STEP 2: `frontend` service — attached ONLY to `public-net`, publishes
#         host port 8080 -> container port 80.
# STEP 3: `backend` service — attached to BOTH `public-net` (so frontend
#         can reach it) AND `internal-net` (so it can reach internal-db).
# STEP 4: `internal-db` service (postgres:16-alpine) — attached ONLY to
#         `internal-net`, NOT published to the host at all (no `ports:`
#         key) and NOT on `public-net` — meaning `frontend` has no network
#         path to reach it whatsoever, even though all three are in the
#         same compose file.
#
# No YAML interpreter self-check — verify against the CHECKLIST below.

services:
  frontend:
    build: ./frontend
    ports:
      - "8080:80"
    # TODO 1: attach ONLY to public-net
    networks:
      - TODO

  backend:
    build: ./backend
    # TODO 2: attach to BOTH networks
    networks:
      - TODO
      - TODO

  internal-db:
    image: postgres:16-alpine
    # TODO 3: attach ONLY to internal-net — no ports: key at all
    networks:
      - TODO

# TODO 4: declare both custom networks
networks:
  TODO:
  TODO:

# ---------------------------------------------------------------------------
# CHECKLIST:
# [ ] `frontend.networks` lists only `public-net`.
# [ ] `backend.networks` lists both `public-net` and `internal-net`.
# [ ] `internal-db.networks` lists only `internal-net`, and `internal-db`
#     has NO `ports:` key (not published to the host, and unreachable
#     from `public-net` entirely).
# [ ] Both `public-net` and `internal-net` are declared under the
#     top-level `networks:` key.
# [ ] `docker compose exec frontend ping -c1 internal-db` would FAIL to
#     resolve the hostname at all (not just fail to connect) — reasoned
#     about from the file: frontend is never attached to internal-net, so
#     the embedded DNS resolver on public-net has no record for
#     internal-db.
# [ ] `docker compose exec backend ping -c1 internal-db` WOULD succeed —
#     backend shares internal-net with internal-db.
# ---------------------------------------------------------------------------