📋 Summary

Treat mock-bank as an external bank by moving it onto a dedicated external Docker network, isolating it from the internal datastores while keeping the withdrawal callback flow and metric scraping intact.

🎯 Motivation

mock-bank simulates a third-party bank, but it currently sits on the single default network alongside db / redis / rabbitmq / mongo, so it can reach internal infrastructure it has no business touching. Segmenting it better reflects its real-world trust boundary.

🔧 Changes

• Add an external Docker network in docker-compose.yml.
• Move mock-bank onto external only — isolated from the internal datastores on the default network.
• Multi-home app and prometheus (default + external) so the withdrawal callback flow and mock-bank metric scraping still work across the boundary.
• Document the network topology in the root CLAUDE.md.

🧪 How to Test

1. docker compose up -d --build (creates the new wallet_system_external network).
2. Run a withdrawal and confirm the app → mock-bank → /withdraw/webhook callback completes as before.
3. Check Prometheus targets — the mock-bank job at mock-bank:8081 is still UP.
4. Confirm isolation: from the mock-bank container, db / redis / rabbitmq / mongo are no longer resolvable/reachable.
5. Expected result: withdrawal + monitoring unchanged; mock-bank cannot reach the datastores.

⚠️ Notes / Risks

• Config-only change; requires a recreate (docker compose up -d --build) to apply the new network.
• Host port mappings (e.g. 8081:8081) are unaffected.
• docker-compose.prod.yml still merges cleanly (verified with docker compose config).
• No application code changed.

✅ Checklist

• Documentation updated (root CLAUDE.md)
• Validated locally (docker compose config on base + prod override)
• No hardcoded secrets or credentials
• Tests written or updated (N/A — infra/config change, no src changes)

🤖 Generated with Claude Code