docker-compose.yaml combines stacks/<app>/compose.yaml into one Compose project. Run commands from the repository root; relative paths resolve from there.
Only Nginx publishes host ports (80/443) and joins public and backend. Web applications share backend; databases use their separate application networks. These are bridge networks with outbound access, without internal: true.
Puppet manages secrets through hiera/data-lx/default/lx-docker-01.psi.ch.yaml. The service env files live under /etc/webhosting/, separately from this repo.
Env files are root-owned (0600, directories 0700) and use format: raw: keep values literal, without adding quotes or escaping dollar signs.

Puppet must provision all required env files before Compose validation or deployment. Use config --quiet to avoid printing secrets. After an update, check the application; if its container IP changed, validate and reload Nginx using the host's deployment procedure.