From 914fd6570d57c604b10514146ac69d359a3f9356 Mon Sep 17 00:00:00 2001
From: Admin <1+admin@noreply.git.dcntrlized.org>
Date: Mon, 19 Oct 2026 02:52:02 +0100
Subject: [PATCH] [fix](alarm): label the debug compose for the data plane

Maestro resolves a service through the org.dcntrlized.service and org.dcntrlized.port labels; without them the single data plane answers unknown service for the dev stack, which is the only supported client path. Allow AUTH_SERVICE_URL to be overridden so the dev fleet can point at auth-debug.
---
 docker-compose.debug.yaml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/docker-compose.debug.yaml b/docker-compose.debug.yaml
index cd59248..eb3fe10 100644
--- a/docker-compose.debug.yaml
+++ b/docker-compose.debug.yaml
@@ -12,6 +12,15 @@ services:
     image: alarm:debug
     container_name: alarm-debug
 
+    # Discovery labels — exactly what Maestro's install path injects
+    # (`lib/containers/compose.go`): the service name and the port it listens on
+    # inside `dcntrlized_net`. Without them the single data plane answers
+    # `unknown service "alarm"` and a phone cannot reach this service through
+    # the only supported path, so the dev stack would be invisible to it.
+    labels:
+      org.dcntrlized.service: "alarm"
+      org.dcntrlized.port: "8080"
+
     # Cold `docker compose -f docker-compose.debug.yaml up -d` builds this image
     # directly — no pre-build step needed. Do NOT add `network: host` here:
     # `docker compose up`/`build` cannot grant the `network.host` build
@@ -57,8 +66,11 @@ services:
       # longer gates any listener — this listener is ALWAYS plaintext now.
       - DCNTRLIZED_DEBUG=true
 
-      # Shared auth service target (dcntrlized-auth on the dcntrlized network)
-      - AUTH_SERVICE_URL=http://dcntrlized-auth:8080
+      # Shared auth service target (dcntrlized-auth on the dcntrlized network).
+      # Overridable because the dev fleet runs the hub as `auth-debug`
+      # (`dcntrlized-auth/docker-compose.debug.yaml`) rather than under its
+      # production DNS name, and an alarm nobody can log in to is untestable.
+      - AUTH_SERVICE_URL=${AUTH_SERVICE_URL:-http://dcntrlized-auth:8080}
 
       # Service identity (inert in v1 — no /config edge — kept for fleet parity)
       - DCNTRLIZED_SERVICE_NAME=alarm