test: enforce production docker network invariants

scripts/verify-compose-invariants.mjs

@@ -0,0 +1,18 @@
+export function verifyComposeInvariants(compose) {
+  const services = compose?.services ?? {};
+
+  for (const [name, service] of Object.entries(services)) {
+    if (name !== 'edge' && Array.isArray(service.ports) && service.ports.length > 0) {
+      throw new Error(`${name} must not define ports`);
+    }
+    if (service.network_mode === 'host') {
+      throw new Error(`${name} must not use network_mode: host`);
+    }
+  }
+
+  const edge = services.edge;
+  const edgePorts = Array.isArray(edge?.ports) ? edge.ports : [];
+  if (edgePorts.length !== 1) {
+    throw new Error(`edge must publish exactly one port; found ${edgePorts.length}`);
+  }
+}