# Network Segmentation in Docker Compose

**Applies when:** modifying network topology, adding new services, debugging inter-service connectivity, or reviewing compose files.

- Two custom bridge networks: `db-net` (data stores) and `app-net` (application tier).
- `db` and `redis`: only on `db-net` -- not reachable from app-net-only services.
- `minio`: on both `db-net` and `app-net` -- accessible from all services including Remotion.
- `api` and `worker`: on both `db-net` and `app-net` -- can reach data stores and be reached by Remotion.
- Remotion service joins `cofee_backend_app-net` (external network) -- can reach `minio` and `api`/`worker`, but NOT `db` or `redis` directly.
- Remotion compose references `REDIS_URL: redis://redis:6379/0` in its environment -- this will NOT resolve since `redis` is only on `db-net`. If Remotion needs Redis access, Redis must be added to `app-net` as well.
- The old default network (`cofee_backend_default`) is no longer created. Any external references to it must be updated to `cofee_backend_app-net`.