Bug: Docker Compose template renders invalid empty `networks:` key for tracker service

[josecelano]

Overview

The docker-compose.yml Tera template renders an invalid empty networks: key for the tracker service when no optional services (Caddy, MySQL, Prometheus) are enabled. This produces invalid YAML that Docker Compose rejects with:

services.tracker.networks must be a list

The bug means the entire deployment workflow (create → provision → configure → release → run) succeeds until the final run command, which fails when Docker Compose validates the generated file. There is no early validation that catches this invalid template output.

Specification

See detailed specification: docs/issues/382-docker-compose-template-empty-networks-key.md

Root Cause

In templates/docker-compose/docker-compose.yml.tera (lines 103-106), the tracker service renders networks: unconditionally:

    networks:
{%- for network in tracker.networks %}
      - {{ network }}
{%- endfor %}

When tracker.networks is empty (SQLite + no domains + no Prometheus), this produces invalid YAML: networks: with no list items.

The backup service correctly guards this with {%- if backup.networks | length > 0 %} — the tracker is missing this guard.

Reproduction

Any config with SQLite, no domains, and no Prometheus triggers this. Example: envs/json-output-test.json.

Steps: create environment → provision → configure → release → run → FAILS

Implementation Plan

Phase 1: Fix the Template

• Add conditional guard around tracker's networks: block (matching backup pattern)
• Audit all service blocks for consistency

Phase 2: Add Test Coverage

• Unit test for minimal-config rendering (SQLite, no domains, no Prometheus)
• Unit test verifying no empty networks: keys in output

Phase 3: Validate Rendered docker-compose.yml After Rendering

• Run docker compose config --quiet on rendered output after template rendering
• Fail early at configure time with a clear error message

Phase 4: Documentation

• Update template documentation if needed

Acceptance Criteria

• Pre-commit checks pass: ./scripts/pre-commit.sh
• Minimal config produces valid docker-compose.yml
• run command succeeds with previously-failing config
• Template guards are consistent across all service blocks
• Rendered docker-compose.yml validated with docker compose config --quiet
• Invalid templates produce clear error at configure time (not run time)

Related

• Specification: docs/issues/382-docker-compose-template-empty-networks-key.md
• Discovered during manual E2E testing for Add JSON output to test command #380