odoo_net_setup fails with external attachable Swarm overlay networks (DNS_INTERNAL_FROM_DOCKER=1)

[pleirb]

Hi!

I found an issue when combining:

Docker Compose (standalone)
External attachable Swarm overlay networks
docker-whitelist-gateway-service

The stack is started with:

docker compose -f test.yaml up

The odoo service was connected to multiple networks:

networks:
  default:
  inverseproxy_shared:
  globalwhitelist_shared:
  whitelist:

Where inverseproxy_shared and globalwhitelist_shared are external attachable Swarm overlay networks.

With:

DNS_INTERNAL_FROM_DOCKER: "1"

odoo_net_setup crashes with:

RuntimeError: Could not determine the primary default network from the main container
ERROR: failed to generate internal DNS hosts from Docker

Odoo starts correctly, but the whitelist gateway setup is incomplete.

The workaround that solved the issue was:

DNS_INTERNAL_FROM_DOCKER: "0"

Additionally:

removing globalwhitelist_shared from odoo
adding globalwhitelist_shared to proxy_general

Resulting topology:

odoo
↓
proxy_general
↓
globalwhitelist_shared

Question:

Is this mixed Compose + Swarm overlay setup unsupported/expected, or could the autodetection logic eventually support multiple external overlay networks more gracefully?

Thanks!

[david-banon-tecnativa]

We don't use docker swarm, so it is currently unsupported, but if you need some changes to support it and they don't break current workflows, you can open a PR for it.
The global whitelist network is in the process of being removed, or at least, put behind a copier question as we changed the proxy system we use from docker whitelist to docker whitelist gateway, which doesn't use a global proxy, and instead every compose project defines all the proxies it needs.

[pleirb]

We don't use docker swarm, so it is currently unsupported, but if you need some changes to support it and they don't break current workflows, you can open a PR for it. The global whitelist network is in the process of being removed, or at least, put behind a copier question as we changed the proxy system we use from docker whitelist to docker whitelist gateway, which doesn't use a global proxy, and instead every compose project defines all the proxies it needs.

I’ll be keeping an eye out for when you make the changes to the copier. Personally, I’d love it if the copier could adapt to Swarm—and it would be even better if the host and port could be specified for the production environment, at least when using an external database.

For now, I use a custom shell script that converts common.yaml and prod.yaml into a Swarm stack, which in turn utilizes a high-availability PostgreSQL database built with Spilo, Consul, and HAProxy.

[pleirb]

For anyone interested, I’m sharing a script that generates the swarm-prod.yaml file to deploy Odoo production on Swarm, using haproxy (the entry point for high-availability databases) in PGHOST and the PGPORT defined in db-access.env.

Regarding the test environment that doesn't use Swarm—since it's less critical—the script is also configured to use a whitelist that does run on Swarm. Honestly, I'm still debating whether to handle it this way; initially, I wanted the tests to run on Swarm as well, but in the end, I settled on just using the whitelist so it could be shared with other testing projects.

#!/bin/bash

TARGET="swarm-prod.yaml"
ENV_FILE="prod.yaml"
TMP_COMMON="common_tmp.yaml"

# ==========================================
# VERIFICACIÓN DE REQUISITOS (yq)
# ==========================================
if command -v yq &> /dev/null; then
    YQ="yq"
elif [ -x /usr/local/bin/yq ]; then
    YQ="/usr/local/bin/yq"
else
    echo "❌ Error: 'yq' no se encontró en el PATH ni en /usr/local/bin/yq"
    echo "-------------------------------------------------------------------------------------"
    echo "Puedes instalarlo ejecutando los siguientes comandos:"
    echo "sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/local/bin/yq"
    echo "sudo chmod +x /usr/local/bin/yq"
    echo "Para verificar la instalación haz: yq --version"
    echo "-------------------------------------------------------------------------------------"
    exit 1
fi

# ==========================================
# EXTRAER EMPRESA Y VERSIÓN DE FORMA ESTRICTA (Solo versión mayor)
# ==========================================
FOUND_TOKEN=$(grep -ohE 'odoo-[a-zA-Z0-9_]+-[0-9]+' common.yaml prod.yaml test.yaml 2>/dev/null | head -n 1)
if [ -n "$FOUND_TOKEN" ]; then
  EMPRESA=$(echo "$FOUND_TOKEN" | cut -d'-' -f2)
  VERSION=$(echo "$FOUND_TOKEN" | cut -d'-' -f3)
  STACK_NAME="odoo-${EMPRESA}-${VERSION}-prod"
else
  # Fallback predictivo por si no encuentra el patrón
  STACK_NAME="odoo-empresa-xx-prod"
fi

# ==========================================
# LEER SERVICIOS ACTIVOS DE PROD
# ==========================================
ENV_SERVICES=$($YQ eval '.services | keys | .[]' "$ENV_FILE" 2>/dev/null)
if [ -z "$ENV_SERVICES" ]; then
  echo "❌ Error: No se encontraron servicios declarados en $ENV_FILE"
  exit 1
fi

# ==========================================
# PODAR EL COMMON.YAML
# ==========================================
cp common.yaml "$TMP_COMMON"
for service in $($YQ eval '.services | keys | .[]' "$TMP_COMMON" 2>/dev/null); do
  if ! echo "$ENV_SERVICES" | grep -qxF "$service"; then
    $YQ eval "del(.services.${service})" -i "$TMP_COMMON"
  fi
done

# ==========================================
# FUSIÓN CON DOCKER COMPOSE CONFIG
# ==========================================
if ! docker compose -f "$TMP_COMMON" -f "$ENV_FILE" config > "$TARGET" 2>/dev/null; then
  echo "❌ Error crítico: Docker Compose falló al fusionar la herencia para producción."
  rm -f "$TMP_COMMON"
  exit 1
fi
rm -f "$TMP_COMMON"

# ==========================================
# APLICAR LABELS Y RESTRICCIONES DE SWARM
# ==========================================
for service in $($YQ eval '.services | keys | .[]' "$TARGET" 2>/dev/null); do
  $YQ eval ".services.${service}.deploy.replicas = 1" -i "$TARGET"
  $YQ eval ".services.${service}.deploy.placement.constraints = [\"node.role == manager\"]" -i "$TARGET"

  if [ "$service" = "odoo" ]; then
    $YQ eval '.services.odoo.deploy.restart_policy.condition = "on-failure"' -i "$TARGET"
    $YQ eval 'del(.services.odoo.build)' -i "$TARGET"
  fi

  if [ "$($YQ eval ".services.${service}.labels" "$TARGET" 2>/dev/null)" != "null" ]; then
    $YQ eval ".services.${service}.deploy.labels = .services.${service}.labels" -i "$TARGET"
    $YQ eval "del(.services.${service}).labels" -i "$TARGET" 2>/dev/null
  fi
done

# ==========================================
# ELIMINAR DEPENDS_ON
# ==========================================
$YQ eval 'del(.services[].depends_on)' -i "$TARGET" 2>/dev/null

# ==========================================
# ARREGLO DE MEMORIA COMPARTIDA PARA POSTGRESQL
# ==========================================
if echo "$ENV_SERVICES" | grep -qxF "db"; then
  $YQ eval 'del(.services.db.shm_size)' -i "$TARGET"
  $YQ eval '.services.db.volumes += {"type": "tmpfs", "target": "/dev/shm", "tmpfs": {"size": 4294967296}}' -i "$TARGET"
fi

# ==========================================
# FILTRADO DE VOLÚMENES NO USADOS
# ==========================================
ENV_VOLUMES=$($YQ eval '.volumes | keys | .[]' "$ENV_FILE" 2>/dev/null)
if [ -n "$ENV_VOLUMES" ]; then
  for volume in $($YQ eval '.volumes | keys | .[]' "$TARGET" 2>/dev/null); do
    if ! echo "$ENV_VOLUMES" | grep -qxF "$volume"; then
      $YQ eval "del(.volumes.${volume})" -i "$TARGET"
    fi
  done
else
  $YQ eval 'del(.volumes)' -i "$TARGET"
fi

# ==========================================
# MODIFICACIONES DE TOPOLOGÍA SOLICITADAS
# ==========================================
for svc in odoo backup; do
  if [ "$($YQ eval ".services.${svc}" "$TARGET" 2>/dev/null)" != "null" ]; then
    $YQ eval ".services.${svc}.environment.PGHOST = \"haproxy\"" -i "$TARGET" 2>/dev/null
  fi
done

$YQ eval 'del(.services.db)' -i "$TARGET"
$YQ eval 'del(.volumes.db)' -i "$TARGET"

if [ "$($YQ eval '.services.backup' "$TARGET" 2>/dev/null)" != "null" ]; then
  $YQ eval 'del(.services.backup.networks.default)' -i "$TARGET"
  $YQ eval '.services.backup.networks.inverseproxy_shared = null' -i "$TARGET"
fi

if [ "$($YQ eval '.services.odoo_net_setup' "$TARGET" 2>/dev/null)" != "null" ]; then
  $YQ eval '.services.odoo_net_setup.environment.DNS_INTERNAL_FROM_DOCKER = "0"' -i "$TARGET" 2>/dev/null
fi

if [ "$($YQ eval '.services.odoo' "$TARGET" 2>/dev/null)" != "null" ]; then
  $YQ eval 'del(.services.odoo.networks.globalwhitelist_shared)' -i "$TARGET" 2>/dev/null
fi

if [ "$($YQ eval '.services.proxy_general' "$TARGET" 2>/dev/null)" != "null" ]; then
  $YQ eval '.services.proxy_general.networks.globalwhitelist_shared = null' -i "$TARGET" 2>/dev/null
fi

# ==========================================
# 🔥 SECCIÓN: LIMPIEZA DE PREFIJOS EXPLÍCITOS
# ==========================================
$YQ eval 'del(.name)' -i "$TARGET" 2>/dev/null
$YQ eval 'del(.networks.default.name)' -i "$TARGET" 2>/dev/null
$YQ eval 'del(.services[].volumes[].volume)' -i "$TARGET" 2>/dev/null

for volume in $($YQ eval '.volumes | keys | .[]' "$TARGET" 2>/dev/null); do
  $YQ eval "del(.volumes.${volume}.name)" -i "$TARGET" 2>/dev/null
done

if [ "$($YQ eval '.volumes | length == 0' "$TARGET" 2>/dev/null)" = "true" ]; then
  $YQ eval 'del(.volumes)' -i "$TARGET" 2>/dev/null
fi

echo "-------------------------------------------------------------------------------------"
echo "⌛ Procesando entorno de PRODUCCIÓN -> Generando $TARGET"
echo "✅ ¡Proceso completado con éxito "
echo "🚀 Despliega el entorno Produccion con: "
echo "docker stack deploy -c $TARGET --with-registry-auth $STACK_NAME"
echo "-------------------------------------------------------------------------------------"
echo "⌛ Procesando entorno de TEST -> Generando test.yaml"
echo "✅ ¡Proceso completado con éxito "
echo "🚀 Despliega el entorno Test con:"
echo "docker compose -f common.yaml -f test.yaml up -d"
echo "-------------------------------------------------------------------------------------"