tldr; I have split the stack into separate stacks talking over an overlay network.  Each one can have a drone.

I think I need to split my application stack into a number of separate stacks.  It will all still need to be proxied by one nginx service that creates and renews the lets encrypt certificates for TLS.  That service will proxy to various different services running on different stacks. This way I can deploy bits of it individually rather than one big lump.  One component of - like a drone server and runners would run in its own stack with its database etc.

Then there would be one TLS reverse proxy service which proxied over a docker network to these stacks.  Adding a stack to the system would add to the reverse proxy configuration.

I can also make the various sub stacks optional.

Currently all my services sit on an overlay network called appnet. It's defined here.

containers

containers on the manager node

~# docker ps
CONTAINER ID        IMAGE                                   COMMAND                  CREATED             STATUS              PORTS               NAMES
32cdf34448d9        rocketchat/rocket.chat:3.0.7            "node main.js"           15 hours ago        Up 15 hours         3000/tcp            gitea_chat.1.okaap823bntuoo78oemcerrrv
01d6e61d2c99        drone/drone-runner-docker:1             "/bin/drone-runner-d…"   15 hours ago        Up 15 hours         3000/tcp            gitea_drone-docker-runner.1.f7mcd91bzyddlslnmt6xrk2iu
1c58590f6163        portainer/agent:1.5.1                   "./agent"                15 hours ago        Up 15 hours                             gitea_portainer-agent.6txjj394cr6hrofmskto2h0hf.ts8svpby3w94y4cnvmalcmvhl
9825503188bb        drone/drone:1.7.0                       "/bin/drone-server"      15 hours ago        Up 15 hours         80/tcp, 443/tcp     gitea_drone-server.1.j5rwnsba08i8ueu0g3wzmts6c
71ffeb710dac        nginx:alpine                            "nginx -g 'daemon of…"   15 hours ago        Up 15 hours         80/tcp              gitea_matomo-web.1.km04tr12c44ddz4j2gt9yn4fm
fc4270756994        registry:2                              "/entrypoint.sh /etc…"   15 hours ago        Up 15 hours         5000/tcp            gitea_registry.1.buwios3wlkl6x4dvv3vus1kj9
1aa7703d8070        matomo:fpm-alpine                       "/entrypoint.sh php-…"   15 hours ago        Up 15 hours         9000/tcp            gitea_matomo.1.zbuy75l8vn5soqxkmx9rr0qdj
395c59ee927c        guacamole/guacamole:latest              "/opt/guacamole/bin/…"   15 hours ago        Up 15 hours         8080/tcp            gitea_guacamole.1.nrp9oq5d49tw6kgvm2u8k5kua
dc6a3485e266        registry:2                              "/entrypoint.sh /etc…"   15 hours ago        Up 15 hours         5000/tcp            gitea_registry-cache.1.jwwc6z2i5w4fl9jwffalyv1l3
e70d6ce017de        guacamole/guacd:latest                  "/bin/sh -c '/usr/lo…"   15 hours ago        Up 15 hours         4822/tcp            gitea_guacd.1.ev8366oz3bh9kfn8cfan2afyv
5f7bb7da5aec        portainer/portainer:1.23.2              "/portainer -H tcp:/…"   15 hours ago        Up 15 hours         9000/tcp            gitea_portainer.1.0tsdelfom0j9mmzcwwhsf78px
91f4379b7c5f        sigyl.com:5001/gitea:latest             "/usr/bin/entrypoint…"   15 hours ago        Up 15 hours         22/tcp, 3000/tcp    gitea_gitea.1.sbw4avbtmhwgtnnbbkx7uyzdq
82b03cf75ce7        sigyl.com:5001/ghost:latest             "docker-entrypoint.s…"   15 hours ago        Up 15 hours         2368/tcp            gitea_ghost.1.y3m4n7m5xisxpk3bcxjtwr620
3360ceaf01b7        jasonrivers/nagios:latest               "/usr/local/bin/star…"   15 hours ago        Up 15 hours         80/tcp              gitea_nagios.1.xo2n6z7pnjm06o3gxvz9h7vye
aa8fcb636570        sigyl.com:5001/letsencrypt-git:latest   "/bin/sh -c 'sh /run…"   15 hours ago        Up 15 hours         80/tcp, 443/tcp     gitea_letsencrypt-git.1.edp3i4sln6xwfr0kg9ibjpp41
d8e4b35b46f8        registry:2                              "/entrypoint.sh /etc…"   15 hours ago        Up 15 hours         5000/tcp            gitea_registry-1.1.jvdlqxp5jb64wzqnhqhjsrmho
d86db604a3c9        sigyl.com:5001/drone-starlark:latest    "/bin/sh -c 'sh /run…"   15 hours ago        Up 15 hours         3000/tcp            gitea_drone-starlark.1.77edy8xfx2t4yjn7qa9i73gve

containers on the worker node

~# docker ps
CONTAINER ID        IMAGE                                          COMMAND                  CREATED             STATUS              PORTS                 NAMES
b96bc3d538e0        portainer/agent:1.5.1                          "./agent"                15 hours ago        Up 15 hours                               gitea_portainer-agent.mfyuu28eeqllqqh98usok27zo.qkt5r9ny81sl9g9r7ag6w7qd2
232636c81a9b        mariadb:10                                     "docker-entrypoint.s…"   15 hours ago        Up 15 hours         3306/tcp              gitea_zabbix-mariadb.1.jdizp025zppxc0frhab0v1vl0
c08b2cff6256        zabbix/zabbix-server-mysql:latest              "/sbin/tini -- /usr/…"   15 hours ago        Up 15 hours         10051/tcp             gitea_zabbix-server.1.v5ujdb9gsfz92zlp3ngryhp0u
2c5d35554064        postgres:11-alpine                             "docker-entrypoint.s…"   15 hours ago        Up 15 hours         5432/tcp              gitea_commento-postgres.1.mpdbq4ltqb89bnv7keh4e35tn
e524c0f8cb5e        mongo:4.0                                      "docker-entrypoint.s…"   15 hours ago        Up 15 hours         27017/tcp             gitea_chat-mongo.1.fuzy35ejlt41c98knaae372dl
d42587b45cbd        registry.gitlab.com/commento/commento:latest   "/commento/commento"     15 hours ago        Up 15 hours         8080/tcp              gitea_commento.1.rwgbs2a4sh6d53xrr0l1y1rsm
bff75bad6eb2        zabbix/zabbix-web-nginx-mysql:latest           "docker-entrypoint.sh"   15 hours ago        Up 15 hours         8080/tcp, 8443/tcp    gitea_zabbix-web.1.tt75frwor9oaco7c90xsigizt
a2c87d478942        mariadb:10                                     "docker-entrypoint.s…"   15 hours ago        Up 15 hours         3306/tcp              gitea_matomo-mariadb.1.qsqew99bjexdao9imrn86s8rl
0b58dbeabb6c        sigyl.com:5001/guacamole-postgresql:latest     "docker-entrypoint.s…"   15 hours ago        Up 15 hours         5432/tcp              gitea_guacamole-postgresql.1.lknscbxsnkyn69wtasnhbqnb8
9757855a391c        mysql:5.7                                      "docker-entrypoint.s…"   15 hours ago        Up 15 hours         3306/tcp, 33060/tcp   gitea_ghost-mysql.1.2e9i3al7fcgl0gy0mv49b57cx

networks

networks on the swarm manager node:

~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
797079bb656e        bridge              bridge              local
840c7a1c1992        docker_gwbridge     bridge              local
ce57pmslcykh        gitea_appnet        overlay             swarm
5781b3cc2b8e        host                host                local
rf0h1lcdiwo0        ingress             overlay             swarm
8d5d74432155        none                null                local

networks on the worker node:

~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
e6291fc95622        bridge              bridge              local
a4f32195ecbb        docker_gwbridge     bridge              local
ce57pmslcykh        gitea_appnet        overlay             swarm
ebbc4d399a89        host                host                local
rf0h1lcdiwo0        ingress             overlay             swarm
ee3458764aaa        none                null                local

Bridge

This is the default docker bridge network started when docker starts.  Containers connect to this by default.

on the swarm manager

:~# docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "797079bb656eb281822b0c0837e0fbaf8e9b6d0514b1511f88c37e2784573e1b",
        "Created": "2020-05-06T07:26:18.335025118Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

on the swarm worker

~# docker inspect bridge
[
    {
        "Name": "bridge",
        "Id": "e6291fc956221990cc65b9926d6e40149eb8e8ec57783e33bb365aea38e3d6c9",
        "Created": "2020-05-06T09:01:24.650226689Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

Ingress

According to docker this

handles control and data traffic related to swarm services. When you create a swarm service and do not connect it to a user-defined overlay network, it connects to the ingress network by default.

The containers which are on this network are those which expose their ports.  Ie they are configured with

    ports:
      - 10050:10050
      - 10051:10051

on the manager

~# docker network inspect ingress
[
    {
        "Name": "ingress",
        "Id": "rf0h1lcdiwo0ok87dmt6jmg0g",
        "Created": "2020-05-06T07:26:22.960057637Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.0.0/24",
                    "Gateway": "10.0.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": true,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "91f4379b7c5fbb1d59c459b0eb2089ed81620edaa28e24d02b362a3e3a589e17": {
                "Name": "gitea_gitea.1.sbw4avbtmhwgtnnbbkx7uyzdq",
                "EndpointID": "4a0e79491f9be5e19610e253186f41b1ec8b95190fe7163c5435558194c14a86",
                "MacAddress": "02:42:0a:00:00:71",
                "IPv4Address": "10.0.0.113/24",
                "IPv6Address": ""
            },
            "aa8fcb636570139cfbecb74c772ebf239121c9214e4ce825442b3c469d6093de": {
                "Name": "gitea_letsencrypt-git.1.edp3i4sln6xwfr0kg9ibjpp41",
                "EndpointID": "5a70856de96b1aa7412d23e64fa349023834e280e5f7fa53c0bd17b6b46f7bd9",
                "MacAddress": "02:42:0a:00:00:6f",
                "IPv4Address": "10.0.0.111/24",
                "IPv6Address": ""
            },
            "dc6a3485e2662092e1bb75ecf140e70ca119153d804d1219bb1e33dfe1bce720": {
                "Name": "gitea_registry-cache.1.jwwc6z2i5w4fl9jwffalyv1l3",
                "EndpointID": "ef7600e7311b4e4332360fb5c974f6c0ddd8fbbc1f83e0f311a886c8affcd385",
                "MacAddress": "02:42:0a:00:00:73",
                "IPv4Address": "10.0.0.115/24",
                "IPv6Address": ""
            },
            "fc4270756994deb14ec3eb324788b4de0f2fe61da5df50ba095817178f90eb72": {
                "Name": "gitea_registry.1.buwios3wlkl6x4dvv3vus1kj9",
                "EndpointID": "ace57817fcced788f03ef7036dedf368f16a43234cd34dc87d923d77f5548cfd",
                "MacAddress": "02:42:0a:00:00:76",
                "IPv4Address": "10.0.0.118/24",
                "IPv6Address": ""
            },
            "ingress-sbox": {
                "Name": "ingress-endpoint",
                "EndpointID": "362bebfc7481df886ef07d3fadde147a5d591763e60f53c9896ab0e3bf284688",
                "MacAddress": "02:42:0a:00:00:02",
                "IPv4Address": "10.0.0.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4096"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "d1537d9928cc",
                "IP": "10.106.0.2"
            },
            {
                "Name": "11752133a519",
                "IP": "10.106.0.3"
            }
        ]
    }
]

on the worker

~# docker network inspect ingress
[
    {
        "Name": "ingress",
        "Id": "rf0h1lcdiwo0ok87dmt6jmg0g",
        "Created": "2020-05-06T09:01:25.925747921Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.0.0/24",
                    "Gateway": "10.0.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": true,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "c08b2cff625680b57f1e6a3ac062d10dab3ff5ae4818f27a075fbd2311d67c8f": {
                "Name": "gitea_zabbix-server.1.v5ujdb9gsfz92zlp3ngryhp0u",
                "EndpointID": "5e2685dcdc171b25ddc4136442dc6337d5974a8c2ac907d390ac3f8f7e7396a4",
                "MacAddress": "02:42:0a:00:00:78",
                "IPv4Address": "10.0.0.120/24",
                "IPv6Address": ""
            },
            "ingress-sbox": {
                "Name": "ingress-endpoint",
                "EndpointID": "bdc8688a4f4d726af4dceef860a68001eb1dccc11e82ffd25058236827c93dbc",
                "MacAddress": "02:42:0a:00:00:03",
                "IPv4Address": "10.0.0.3/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4096"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "d1537d9928cc",
                "IP": "10.106.0.2"
            },
            {
                "Name": "11752133a519",
                "IP": "10.106.0.3"
            }
        ]
    }
]

docker_gwbridge

According to docker this

connects the individual Docker daemon to the other daemons participating in the swarm.

and

The docker_gwbridge is a virtual bridge that connects the overlay networks (including the ingress network) to an individual Docker daemon’s physical network.

on the manager

~# docker network inspect docker_gwbridge
[
    {
        "Name": "docker_gwbridge",
        "Id": "840c7a1c1992dbd49810db9b53afae15b0cc5dbefbfb42306c3775842db01ef3",
        "Created": "2020-04-01T10:46:52.613631407Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "01d6e61d2c999cb104af624abfd14afc041b2a701b73fc0818c5a024c976c08a": {
                "Name": "gateway_a52b2bcc5814",
                "EndpointID": "f985a3b3890d16b3b08ac6f6d495dad5fe599e3ce4748ee98453c2aa521ef06d",
                "MacAddress": "02:42:ac:12:00:12",
                "IPv4Address": "172.18.0.18/16",
                "IPv6Address": ""
            },
            "1aa7703d807033c471157e2439c879450c91e0289e6d4cf5458cc642295d5d43": {
                "Name": "gateway_47ec3b1c0748",
                "EndpointID": "db4242df84b7f4fe71784de01f965deeb834bf7f5a6ea8c31ff0b0559049d646",
                "MacAddress": "02:42:ac:12:00:0d",
                "IPv4Address": "172.18.0.13/16",
                "IPv6Address": ""
            },
            "1c58590f6163cbd0e4a0c717cf5af76828a93cf4fa27500dcbc0861c986d0f76": {
                "Name": "gateway_6f63bf85349d",
                "EndpointID": "f7dcb2ad874f3745b3ef7e4f5ab0ae5b3f861aa73b9c8ad7aa37a35a76aefbde",
                "MacAddress": "02:42:ac:12:00:11",
                "IPv4Address": "172.18.0.17/16",
                "IPv6Address": ""
            },
            "32cdf34448d96261f0920d0cf40739e909b670eab6cce75be1daabf872c4a869": {
                "Name": "gateway_363b2300752d",
                "EndpointID": "8ca09034d86ddc02ecabcff26dc7bc707358c91ed853191d64b996e8c37e590e",
                "MacAddress": "02:42:ac:12:00:13",
                "IPv4Address": "172.18.0.19/16",
                "IPv6Address": ""
            },
            "3360ceaf01b75c84fac0b0bf0d2f2024cf74f9d99149146ee4ddbf5bea7bbb49": {
                "Name": "gateway_e829677c1e44",
                "EndpointID": "7a9f75f8a95bce6be1b2dfaa8cc7b755bb16744e224e356b217833cb4fbd41b4",
                "MacAddress": "02:42:ac:12:00:06",
                "IPv4Address": "172.18.0.6/16",
                "IPv6Address": ""
            },
            "395c59ee927c7c46bf2dc25f5539af21c4ed3d7840db4037d24c43042a6dd9ec": {
                "Name": "gateway_bdb76acd94cb",
                "EndpointID": "e642142975091e820f6188a87c768d15b49f1b1db7b5806bee49c2eca501408d",
                "MacAddress": "02:42:ac:12:00:0c",
                "IPv4Address": "172.18.0.12/16",
                "IPv6Address": ""
            },
            "5f7bb7da5aecc075a9699b2be4a642d80ffb8b16e74303b36e2e11c5ce5d9583": {
                "Name": "gateway_f205e9f02d52",
                "EndpointID": "b4ce54297a35942c42c7bf0fbaae2f5a7788b5705db4476527fbfef89a5e089b",
                "MacAddress": "02:42:ac:12:00:08",
                "IPv4Address": "172.18.0.8/16",
                "IPv6Address": ""
            },
            "71ffeb710dac31c4176328ea6d915fc0be4d58b95b3785dad20a17d23805a594": {
                "Name": "gateway_d0039ba65e9c",
                "EndpointID": "a12994580a5db8f6531c49e7a8c5944a7b3b6cf41a0e7cb5d02ed616ce33e111",
                "MacAddress": "02:42:ac:12:00:0f",
                "IPv4Address": "172.18.0.15/16",
                "IPv6Address": ""
            },
            "82b03cf75ce762f1c232d0c85c94c8fddcfd9526237e6009596fadbeae075d8e": {
                "Name": "gateway_1f42e2336127",
                "EndpointID": "e01a68eeb400900b3d31cf021305be490912966600c861c3422d43014ed22648",
                "MacAddress": "02:42:ac:12:00:07",
                "IPv4Address": "172.18.0.7/16",
                "IPv6Address": ""
            },
            "91f4379b7c5fbb1d59c459b0eb2089ed81620edaa28e24d02b362a3e3a589e17": {
                "Name": "gateway_6e81d695a8d7",
                "EndpointID": "a36068fdbb33ca9738013852c4550a14ebd262c64ec4aced50bbf33670cb4959",
                "MacAddress": "02:42:ac:12:00:09",
                "IPv4Address": "172.18.0.9/16",
                "IPv6Address": ""
            },
            "9825503188bb2a29c229bf69df208eaeba41ad2291843ce4a3e8bd57643b17ee": {
                "Name": "gateway_fdae33b2fcab",
                "EndpointID": "a7be5de08e0ef421201621155b8b7e79f42c0fdeca01a2b0ea5e07f666b0ffeb",
                "MacAddress": "02:42:ac:12:00:10",
                "IPv4Address": "172.18.0.16/16",
                "IPv6Address": ""
            },
            "aa8fcb636570139cfbecb74c772ebf239121c9214e4ce825442b3c469d6093de": {
                "Name": "gateway_5b7bef368fe7",
                "EndpointID": "b3f06cf1888db1237c81f8ac1a2543eb99f60ca1f08d8cc56fc740c318191a02",
                "MacAddress": "02:42:ac:12:00:05",
                "IPv4Address": "172.18.0.5/16",
                "IPv6Address": ""
            },
            "d86db604a3c9162a29748607eca705d4adca34ba4b4178efb263960c9ebb9ade": {
                "Name": "gateway_7f8824b5a3e1",
                "EndpointID": "ff7879ec3865d231d5f58226375660c1ffa245bd0f8ad4f2113d14129cb49173",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "d8e4b35b46f8763c101dd41b5cf5706d52a016d9df56ff2da2d41d732a1b7daa": {
                "Name": "gateway_15044c538c49",
                "EndpointID": "36daeb4eb2b79b5b3679780e3e707e7ecbd0835d2ccad7d8dee3c42fc527c7f4",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            },
            "dc6a3485e2662092e1bb75ecf140e70ca119153d804d1219bb1e33dfe1bce720": {
                "Name": "gateway_e67dc46ab8e0",
                "EndpointID": "d817490afa9a74893d3cf6cab583255955174c9d3a070b6fba34a105c2f08f72",
                "MacAddress": "02:42:ac:12:00:0b",
                "IPv4Address": "172.18.0.11/16",
                "IPv6Address": ""
            },
            "e70d6ce017dee42e52ec0b2198daee6c18f84557c8744d8e702524f159f5057d": {
                "Name": "gateway_d45694026b61",
                "EndpointID": "a1a98b36e7e0606992cf63aefe604e74e2665ea5e4d25c40c6ba35674a217dfc",
                "MacAddress": "02:42:ac:12:00:0a",
                "IPv4Address": "172.18.0.10/16",
                "IPv6Address": ""
            },
            "fc4270756994deb14ec3eb324788b4de0f2fe61da5df50ba095817178f90eb72": {
                "Name": "gateway_36751cca21a4",
                "EndpointID": "3e159c0f3a96495d8c6b438fc7e7b5c229dcc9bee1b02dedebe4bb76d5c0ec5e",
                "MacAddress": "02:42:ac:12:00:0e",
                "IPv4Address": "172.18.0.14/16",
                "IPv6Address": ""
            },
            "ingress-sbox": {
                "Name": "gateway_ingress-sbox",
                "EndpointID": "faaa426230bddfc50f3fac803ab8dcd6f37a1065c0ad0030d3e41be89034bd0c",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.enable_icc": "false",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.name": "docker_gwbridge"
        },
        "Labels": {}
    }
]

on the worker

~# docker network inspect docker_gwbridge
[
    {
        "Name": "docker_gwbridge",
        "Id": "a4f32195ecbb3f277b7166596b5fe35110d7a737970da7d70f9cdda714807077",
        "Created": "2020-04-02T09:37:53.959919705Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "0b58dbeabb6ce512db6e486eab3b22d6c55d4194526d6020b902cc68561ec998": {
                "Name": "gateway_3fe55de0ccf0",
                "EndpointID": "b3e4cd0f36460cb906048727d67814a2010598178e32faf2fc6d8e3caa3c9abf",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "232636c81a9b502107391d5746ce8f75569ff721731d2d455a330f6abad582f2": {
                "Name": "gateway_3f9821280463",
                "EndpointID": "b71c0b2e81ed545f9973e7b9f12911a200400adbbcd8d24ac941d51484f6460a",
                "MacAddress": "02:42:ac:12:00:0b",
                "IPv4Address": "172.18.0.11/16",
                "IPv6Address": ""
            },
            "2c5d355540641fd1fc5c0ce9cf497b05b44bde1040b52851e7a34c231c372e0d": {
                "Name": "gateway_d93c0ebf2174",
                "EndpointID": "864d1c56fbef82673f9884ce7c4f905ecb655eb809482907910b22f15e5bf76e",
                "MacAddress": "02:42:ac:12:00:09",
                "IPv4Address": "172.18.0.9/16",
                "IPv6Address": ""
            },
            "9757855a391c719b5865c8f7a4fea4135d982d4d0cd788b7db6ade122de00b7a": {
                "Name": "gateway_e386d5f51a7d",
                "EndpointID": "1a3af86e3e59680cb4cde2a0cbf9d340e4814786b57a0eae6dff9cf03ed023ad",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            },
            "a2c87d4789427f0ba6cf291018588a9f9a48dd478ef50647bbfa9550eb618ad0": {
                "Name": "gateway_3bcf29dfd834",
                "EndpointID": "30ad224e4d57388d352c2372446e2d184c64fc631786efeee1799b7dce1a2be1",
                "MacAddress": "02:42:ac:12:00:05",
                "IPv4Address": "172.18.0.5/16",
                "IPv6Address": ""
            },
            "b96bc3d538e0eb0753ed3f4047cd13d15ec1c74e89d152663e0dbe83bbe2d049": {
                "Name": "gateway_b7caf33f0f77",
                "EndpointID": "4f1477749debd3d2464804bb7112cdb95318e66bfc948a57d299361f0cb5d129",
                "MacAddress": "02:42:ac:12:00:0c",
                "IPv4Address": "172.18.0.12/16",
                "IPv6Address": ""
            },
            "bff75bad6eb268d9d24c326eb6bb0728516df144492786f5671cf9a6b303bc93": {
                "Name": "gateway_291b2c9475e4",
                "EndpointID": "4ad49d867d912ee22524ad9b8ec56f8db048fdaa93baf8e7176223788379e59e",
                "MacAddress": "02:42:ac:12:00:06",
                "IPv4Address": "172.18.0.6/16",
                "IPv6Address": ""
            },
            "c08b2cff625680b57f1e6a3ac062d10dab3ff5ae4818f27a075fbd2311d67c8f": {
                "Name": "gateway_1ba553ebe973",
                "EndpointID": "43a03a2a8148071d2537df366f1c007a1f3959f76506663073881c88b14ff9ea",
                "MacAddress": "02:42:ac:12:00:0a",
                "IPv4Address": "172.18.0.10/16",
                "IPv6Address": ""
            },
            "d42587b45cbd8301b6a0ccc6498e26c1ef756fcd63bc36b83178a5455f7523e4": {
                "Name": "gateway_6d1ba895b4df",
                "EndpointID": "f07819c49a9a5a84bbd6147e64fef321ce19aebeab44171e230d859bd8e4921c",
                "MacAddress": "02:42:ac:12:00:07",
                "IPv4Address": "172.18.0.7/16",
                "IPv6Address": ""
            },
            "e524c0f8cb5e4bb23efce172c43914ab321858ba351cd6ddab2c88d18dc0450e": {
                "Name": "gateway_b71227dc6e00",
                "EndpointID": "1ee82c5b98fc0053ee440927d5d6d6bd875bee124d755b595ae2c22885038b40",
                "MacAddress": "02:42:ac:12:00:08",
                "IPv4Address": "172.18.0.8/16",
                "IPv6Address": ""
            },
            "ingress-sbox": {
                "Name": "gateway_ingress-sbox",
                "EndpointID": "627de76e17cb15f540842fe1efdacda5d5f1a9b814d291485ae89afeac35cb10",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.enable_icc": "false",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.name": "docker_gwbridge"
        },
        "Labels": {}
    }
]

host

This is the host network - if containers use this they sit straight on the host network.

on the manager

~# docker network inspect host
[
    {
        "Name": "host",
        "Id": "5781b3cc2b8e53287d4f50dfeb46263c224a6d8ef29d8abe68497742a2e40a0e",
        "Created": "2020-04-01T08:22:58.640362216Z",
        "Scope": "local",
        "Driver": "host",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": []
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

on the worker

~# docker network inspect host
[
    {
        "Name": "host",
        "Id": "ebbc4d399a89b94f653f8878bb77a650efd71467b0818247d332ae117ef81259",
        "Created": "2020-04-02T09:37:52.322444872Z",
        "Scope": "local",
        "Driver": "host",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": []
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

gitea_appnet

This is the user defined overlay network for the gitea stack.

on the manager

~# docker network inspect gitea_appnet
[
    {
        "Name": "gitea_appnet",
        "Id": "vo1hfpz74awtddj7hy9awgoxb",
        "Created": "2020-05-07T14:07:38.566184937Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.15.0/24",
                    "Gateway": "10.0.15.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "02a8121fc4630e7378a06b6bbf5547de536806a94187dca53b129e1589b66598": {
                "Name": "gitea_drone-starlark.1.31vazpb07k8g97r0a0u4o6g61",
                "EndpointID": "1eb0faea90bfaa2d3c067a7639a07ef7a85392d9ad4fd0c01cfcb00f6a71f8f3",
                "MacAddress": "02:42:0a:00:0f:39",
                "IPv4Address": "10.0.15.57/24",
                "IPv6Address": ""
            },
            "05db336a0c72ddc711c660c2b2c94dcde8b99181027af429ce872c53c9eb5745": {
                "Name": "gitea_nagios.1.t9rn2r361rees3hzxo74v514u",
                "EndpointID": "7c14121819e4a806ac15085e074b8c5bfc12e099c2635594cfdcd69044ece93a",
                "MacAddress": "02:42:0a:00:0f:18",
                "IPv4Address": "10.0.15.24/24",
                "IPv6Address": ""
            },
            "1c0c82f8306ea4e04550861cf592dfeee4d78951071ae226e8a1825e7bbab1f4": {
                "Name": "gitea_registry-1.1.7kulxluagp9bwqlup78inf4o2",
                "EndpointID": "05c8bfcd715dcb83f7ab97c2af909c210d24e6e426fe4f014371892cce46060a",
                "MacAddress": "02:42:0a:00:0f:3b",
                "IPv4Address": "10.0.15.59/24",
                "IPv6Address": ""
            },
            "1e2ba391cf10b238b1e19d603b74cd8e2ea3d032ecd3136dbb8d630ea4387b1a": {
                "Name": "gitea_chat.1.nbrfj6sc1bxb8hkcaaqpv4q3o",
                "EndpointID": "d5aa48ce7d1e454a726209841d4374d57afc4b93810c88cc47d2bce45ba26e2c",
                "MacAddress": "02:42:0a:00:0f:3e",
                "IPv4Address": "10.0.15.62/24",
                "IPv6Address": ""
            },
            "460cf2c1f6eadca8f1360fa6f83005dd5fb250c4261e969fe8bd15ad320059b0": {
                "Name": "gitea_portainer.1.ql1vti3vujy5qcee86jswaifn",
                "EndpointID": "61ebcfec60f5ced29cdc38c3ecc8b55f1d3bdf530f8e9b97db83d5d53fec3f98",
                "MacAddress": "02:42:0a:00:0f:2d",
                "IPv4Address": "10.0.15.45/24",
                "IPv6Address": ""
            },
            "5d831a041c51155090e467c28a73a8715b3568713d93f8d71b41d822e2ac96bb": {
                "Name": "gitea_registry-cache.1.jvnj1qkd1qcgz0c5k1mbizf82",
                "EndpointID": "e1a2dcb9deebe7476820b7feffb3016215610ff2850e1570c7ea2ce3afb138a7",
                "MacAddress": "02:42:0a:00:0f:11",
                "IPv4Address": "10.0.15.17/24",
                "IPv6Address": ""
            },
            "68847b6ca513f3c2467d7707426f3cf2bf03f750c1199c489384b0de17200e19": {
                "Name": "gitea_gitea.1.sfkhc0p59akcy9a7wno02o7be",
                "EndpointID": "1cefad1a35f2cd741fe5eab85fec16c8b8968a151439f024a0cf6bcaa6f1ad8f",
                "MacAddress": "02:42:0a:00:0f:03",
                "IPv4Address": "10.0.15.3/24",
                "IPv6Address": ""
            },
            "7974f53d33999f71bda58c2c772611bfeb53c31acda92b18ed0ee1885db0cee5": {
                "Name": "gitea_ghost.1.wfrdahyjq7p902k9n5klv5lx1",
                "EndpointID": "06f8e682985d2460ee3430d2750f1d088aca1857e1e4fbd48708aba75ea3fecb",
                "MacAddress": "02:42:0a:00:0f:22",
                "IPv4Address": "10.0.15.34/24",
                "IPv6Address": ""
            },
            "7fb4c9684cc5a2d84b669b899927d73dddd2581c94228cfc564c85987fd1ec93": {
                "Name": "gitea_registry.1.zsqhz4o8qafafhh1irh0mbmrh",
                "EndpointID": "5d7a5626fc1cb05ecc033a0621baa39894ca5714ad312aa2ebfbf3c850f228b2",
                "MacAddress": "02:42:0a:00:0f:3d",
                "IPv4Address": "10.0.15.61/24",
                "IPv6Address": ""
            },
            "a6255c1cbcaa9fdad1a3644d9f0c291d17c80b040fc98a279d3bd88c09145afc": {
                "Name": "gitea_guacamole.1.7jh2cvfuzdmhuga4v37vvv4v8",
                "EndpointID": "d50799b5391f872bcc1d9386f97f6e4cfde82a9e8d083b8ec9858a335be96b33",
                "MacAddress": "02:42:0a:00:0f:29",
                "IPv4Address": "10.0.15.41/24",
                "IPv6Address": ""
            },
            "adef079c5fdc17f89a5389ab9cb919ec8f0a0a3cfdd81c3279004bca8bc119ba": {
                "Name": "gitea_drone-docker-runner.1.wnljuj5blfta5fp8cg8lmeurq",
                "EndpointID": "91336cc2cadf312cf1d9117b271237c4ae9a19babfdf32397c8b15bed0ccbb16",
                "MacAddress": "02:42:0a:00:0f:35",
                "IPv4Address": "10.0.15.53/24",
                "IPv6Address": ""
            },
            "b4fccdf056862c47237207d7547ae6170460290bce317c5366256652fd0a8d75": {
                "Name": "gitea_matomo.1.3jihxuic2i88o88y8n0kav7lk",
                "EndpointID": "c5d4054c1789e603175cf8d2c62acf09404ba5f136acb083c90db0b2028a5376",
                "MacAddress": "02:42:0a:00:0f:27",
                "IPv4Address": "10.0.15.39/24",
                "IPv6Address": ""
            },
            "bb13ddf2a5c2af3584ab9a008fffa4c462e99fd79a3fad4251d9391992ac7af6": {
                "Name": "gitea_drone-server.1.ieerx9x2xifuic18yz6baok9t",
                "EndpointID": "f89fefffb2d6628c84e7c7f247cb18508ced0828f7dfd3058ad9a4653078ccaa",
                "MacAddress": "02:42:0a:00:0f:37",
                "IPv4Address": "10.0.15.55/24",
                "IPv6Address": ""
            },
            "d1560480f342c45b09d9d72183e16e8833654814ca65b34b32b0d9fb6c37ff9f": {
                "Name": "gitea_portainer-agent.6txjj394cr6hrofmskto2h0hf.oha8hwxaovqc3gra4ppwd5ymw",
                "EndpointID": "44da55fb42563ca1f3474d766a6fb95b4c827e76455ac1aa4acad86316a3dde5",
                "MacAddress": "02:42:0a:00:0f:13",
                "IPv4Address": "10.0.15.19/24",
                "IPv6Address": ""
            },
            "db5371fb7b29120a47bcde05445141f89130059cf5f51a3e4bfefb432b0f7c68": {
                "Name": "gitea_matomo-web.1.qyl53xj9haenvr8phqc5715rw",
                "EndpointID": "4103054dad05aabbd47dbac1c7bd8f33a82f4d4aabe2b9267bb3ff084ba3809f",
                "MacAddress": "02:42:0a:00:0f:42",
                "IPv4Address": "10.0.15.66/24",
                "IPv6Address": ""
            },
            "f59e5b5396795c97c5f893306d951b8c2ca3da48229b19e64da870660eca0121": {
                "Name": "gitea_letsencrypt-git.1.n4x2r3jz6dgt57iylqeynga91",
                "EndpointID": "d7a796598d2075bd395c29c4d60cc21c504b967c7fa52d5adcfb6496693bb98a",
                "MacAddress": "02:42:0a:00:0f:41",
                "IPv4Address": "10.0.15.65/24",
                "IPv6Address": ""
            },
            "f7f1fac2655c0c20d803eed8af4f166f5f6f9973b2d5b8192feb5331f218d248": {
                "Name": "gitea_guacd.1.enfmqahr1q2difpeguadmjqf1",
                "EndpointID": "88d4edf309e914b4187a693e335db68798498e8ebae6cc67b9e0be29d140dfe4",
                "MacAddress": "02:42:0a:00:0f:33",
                "IPv4Address": "10.0.15.51/24",
                "IPv6Address": ""
            },
            "lb-gitea_appnet": {
                "Name": "gitea_appnet-endpoint",
                "EndpointID": "9f73ed1722a2868c203971580c23e5443bcd37e5c30603a4daa3bf3719dd0bc8",
                "MacAddress": "02:42:0a:00:0f:04",
                "IPv4Address": "10.0.15.4/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4111"
        },
        "Labels": {
            "com.docker.stack.namespace": "gitea"
        },
        "Peers": [
            {
                "Name": "d1537d9928cc",
                "IP": "10.106.0.2"
            },
            {
                "Name": "11752133a519",
                "IP": "10.106.0.3"
            }
        ]
    }
]

on the worker

~# docker network inspect gitea_appnet
[
    {
        "Name": "gitea_appnet",
        "Id": "vo1hfpz74awtddj7hy9awgoxb",
        "Created": "2020-05-07T14:07:39.986746632Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.15.0/24",
                    "Gateway": "10.0.15.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "0b87386170b30668de2e92f8ccd1e3e05578cae6c7188779c4638fd659e6d35f": {
                "Name": "gitea_portainer-agent.mfyuu28eeqllqqh98usok27zo.p7qy4pmribs33lu3e5g7hfdlj",
                "EndpointID": "8b28d0db793644c418cf84ef53a8dcdbd20501bf59c026eddc82b23d7b90a4cb",
                "MacAddress": "02:42:0a:00:0f:14",
                "IPv4Address": "10.0.15.20/24",
                "IPv6Address": ""
            },
            "477c76301fa390d6606d738752c20b3b97c1f3e39cf46489f45bcdb5cd1c7826": {
                "Name": "gitea_commento.1.0j0fvuo1xg8v5d1wi4oe3wnfc",
                "EndpointID": "8f442832642142fe05b066b2e4c7537cfb1f5f754743b0c161fcb5bf1078d59e",
                "MacAddress": "02:42:0a:00:0f:0b",
                "IPv4Address": "10.0.15.11/24",
                "IPv6Address": ""
            },
            "4886d825278976cae99c880d841addf99eb762e104ea62a0c0d5562895a61def": {
                "Name": "gitea_matomo-mariadb.1.nmrjjyuz98enckgfsk0rwix5r",
                "EndpointID": "4512dc8f7e3de9ca909532f2d9db4774daa1521e1429c5d9f2ad30f55a70b19c",
                "MacAddress": "02:42:0a:00:0f:1c",
                "IPv4Address": "10.0.15.28/24",
                "IPv6Address": ""
            },
            "698a01110b969aa1a77681f5f129fdff1279cb10499c02ec2b6c8bad7f765253": {
                "Name": "gitea_zabbix-mariadb.1.ui9te7ktzyd90twymvhl4nocc",
                "EndpointID": "fac1e203ec6c1d0a388bf01f10091e87cc4c3c255d5a938ea0c131b529373ad4",
                "MacAddress": "02:42:0a:00:0f:25",
                "IPv4Address": "10.0.15.37/24",
                "IPv6Address": ""
            },
            "92c1c085d12e37637db946e4aea21eca3fe5492fd687c523316af1d70c10b7fe": {
                "Name": "gitea_guacamole-postgresql.1.sfk9ex8iphwtwz1peqwgkkf8m",
                "EndpointID": "38a31307b7794d6f5312b37144eb0ae4a88c01dc17c2753596293a5e8a6fdba4",
                "MacAddress": "02:42:0a:00:0f:2b",
                "IPv4Address": "10.0.15.43/24",
                "IPv6Address": ""
            },
            "9728eaa01c10bbb2e7c50b96ef07c9fc7aaa5626bda01ea9da36e4704aaf8cbf": {
                "Name": "gitea_ghost-mysql.1.k62t5nzh7im3q63715dwyqsxt",
                "EndpointID": "342ed3f823c2b831502e1fdf0a385c549a3bc68495b0e7962c3b2cadd26fd248",
                "MacAddress": "02:42:0a:00:0f:1a",
                "IPv4Address": "10.0.15.26/24",
                "IPv6Address": ""
            },
            "99ad8c1310f3e3da8d0491d1ab6198ace01b225b8273a5732a5371e04162838a": {
                "Name": "gitea_zabbix-web.1.xl68oqhdkarud6dne5kxrth28",
                "EndpointID": "dc9f9569843937a48d1a5050a613521d81230db1f8ee3c5a26263193815347ad",
                "MacAddress": "02:42:0a:00:0f:1f",
                "IPv4Address": "10.0.15.31/24",
                "IPv6Address": ""
            },
            "af7aa928116d62b1cd7646238e342efb4fc3588f51dc5ce547adde7e3ef1f48b": {
                "Name": "gitea_commento-postgres.1.w74kof67icbaauwqcq55x8mt7",
                "EndpointID": "a42a3ce8996384b7af9c7144c4a5b0907259a48219c7be7ee48fcdd2488baec4",
                "MacAddress": "02:42:0a:00:0f:30",
                "IPv4Address": "10.0.15.48/24",
                "IPv6Address": ""
            },
            "b195bbd4d007a8664a710b11cfd39add13146331e9038cecb66ae895ea1e4fb5": {
                "Name": "gitea_chat-mongo.1.56q6tnfm8lbb0j05cbltjh6e9",
                "EndpointID": "c5914ca2673d765ed6a60c675a5b26c3edc2e74673235e4323eda77f71d8cf16",
                "MacAddress": "02:42:0a:00:0f:06",
                "IPv4Address": "10.0.15.6/24",
                "IPv6Address": ""
            },
            "f0083d3a88a70276af881a30dba1d4393a0fde4033315fe0fad0be2a4ccd062d": {
                "Name": "gitea_zabbix-server.1.2ipivif2rkavqsrt5l3lwjl8q",
                "EndpointID": "0685013e91d9aae681129cfa2627d630fd12d323d058ed611370ecb8a163117a",
                "MacAddress": "02:42:0a:00:0f:16",
                "IPv4Address": "10.0.15.22/24",
                "IPv6Address": ""
            },
            "lb-gitea_appnet": {
                "Name": "gitea_appnet-endpoint",
                "EndpointID": "f3488fc420ec424cd19bf76a2bc8856e6a0522e48339cce5eadaa8394a6cd8e2",
                "MacAddress": "02:42:0a:00:0f:07",
                "IPv4Address": "10.0.15.7/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4111"
        },
        "Labels": {
            "com.docker.stack.namespace": "gitea"
        },
        "Peers": [
            {
                "Name": "d1537d9928cc",
                "IP": "10.106.0.2"
            },
            {
                "Name": "11752133a519",
                "IP": "10.106.0.3"
            }
        ]
    }
]

Reading this I think I have to create an external overlay network.

Like this

$ docker network create --driver=overlay --attachable externalnet
ce4g2gpx25b76mcu99o6ahbi2

I've added this as an external overlay network externalnet to the stack.

And I'm going to run another stack with this:

$ cat docker-compose-3.yml
version: "3.7"
services:
  d:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: alpine
    networks:
      - externalnet
    command: tail -f /dev/null
networks:
  externalnet:
    driver: overlay
    external: true

So now I get:

$ docker network inspect externalnet
[
    {
        "Name": "externalnet",
        "Id": "ce4g2gpx25b76mcu99o6ahbi2",
        "Created": "2020-05-07T19:07:11.723342109Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.26.0/24",
                    "Gateway": "10.0.26.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": true,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "9f88502efb549422a71e9480d0e77ce332fce7261c1a157b86cef99001bf67e7": {
                "Name": "stack_matomo-web.1.fskouwxajowz82nb6hz9lanxv",
                "EndpointID": "13476ded18a44b0306abf384c6df31b0aff5758d0c69621bf32459cd8aa33677",
                "MacAddress": "02:42:0a:00:1a:1c",
                "IPv4Address": "10.0.26.28/24",
                "IPv6Address": ""
            },
            "f705975e9d8c27829f532d4f8491edc4b361192ec4b4b91632341b7cc178ab98": {
                "Name": "stack-2_d.1.our05upgbimjurp2lo5c9waeo",
                "EndpointID": "ffa08d912aa891e3bf917e143f4c3fa6dc2aebdb7d52941fd7c2b8e3230ef749",
                "MacAddress": "02:42:0a:00:1a:06",
                "IPv4Address": "10.0.26.6/24",
                "IPv6Address": ""
            },
            "lb-externalnet": {
                "Name": "externalnet-endpoint",
                "EndpointID": "2c2635241f849cf54cd5f409bccca9c2c923e0d1b8486aca1a10a9ce027ea35c",
                "MacAddress": "02:42:0a:00:1a:04",
                "IPv4Address": "10.0.26.4/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4122"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "da193020666e",
                "IP": "192.168.2.1"
            }
        ]
    }
]

So now from the stack-2 container I can access the stack matomo service

# curl http://stack_matomo-web
<!DOCTYPE html>
<html id="ng-app"  ng-app="piwikApp">
    <head>
                        <meta charset="utf-8">
            <title>Sign in - Matomo</title>
            <meta http-equiv="X-U

The new split stacks

This creates a 'proxy' stack containing the nginx reverse proxies proxying to the main stack over externalnet.  Now I will be able to hive off each application into its own repository and separately deployed stack.

Here's the new externalnet with all the services and the proxy servers on it:

$ docker network inspect externalnet
[
    {
        "Name": "externalnet",
        "Id": "ce4g2gpx25b76mcu99o6ahbi2",
        "Created": "2020-05-07T19:07:11.723342109Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.26.0/24",
                    "Gateway": "10.0.26.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": true,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "09782cae31aa2b115ce2ce88308671a43544039de4d288e3a1106314d5f43473": {
                "Name": "stack_ghost.1.i18welcsp2c8kye2sktgsga0s",
                "EndpointID": "298b7208e95847bcd513383c367137f5af9956506ff9e38f88233d117215712b",
                "MacAddress": "02:42:0a:00:1a:e7",
                "IPv4Address": "10.0.26.231/24",
                "IPv6Address": ""
            },
            "20d946f2a7b246d90dfab42e6b249d8a58ff918154b6cd128a6d3b922c4fcc1a": {
                "Name": "proxy_registry-1.1.nwqahic3bgspcxamqjximwt51",
                "EndpointID": "2345c7989c55da7997a2fb63723822b8f5f538da11b632c4bc5d14db36fb5930",
                "MacAddress": "02:42:0a:00:1a:ce",
                "IPv4Address": "10.0.26.206/24",
                "IPv6Address": ""
            },
            "20ede618eec4f4769f61f290268400f2ef938c192e94d49a3395273e638925f2": {
                "Name": "stack_guacamole.1.pmt1veprsxt1ccc1hwgumy7w3",
                "EndpointID": "3adc20c7e0f3a42aee5792ef9f4bd0db0eb9535ff9d8d02a6c4b862f2b10799d",
                "MacAddress": "02:42:0a:00:1a:d9",
                "IPv4Address": "10.0.26.217/24",
                "IPv6Address": ""
            },
            "31840320231f50ba3f83df65601e6b566444387b50af6f899177ab27f029fdee": {
                "Name": "stack_drone-server.1.nsc24p9cww9vpsykhvm22gqad",
                "EndpointID": "e4285254df5ab5580926b9334a5289e96b546be4fb9ceb517f8732e33c905c2b",
                "MacAddress": "02:42:0a:00:1a:d5",
                "IPv4Address": "10.0.26.213/24",
                "IPv6Address": ""
            },
            "3faff264e75d33534b180b84ab158ce4f3c00cbb1a2c89f42d7316f5a22db1bc": {
                "Name": "stack_gitea.1.wjo0jc63i84vulv8y1v0esr7r",
                "EndpointID": "d07d2077ce43e625dc1bb9853c705db8dd22384fed47eb7f28ad095dcce61b29",
                "MacAddress": "02:42:0a:00:1a:e5",
                "IPv4Address": "10.0.26.229/24",
                "IPv6Address": ""
            },
            "53bd3e69f98b81f0495fda2b67182b6f05b7e5329b9a258bfbe6897cc61b2a7d": {
                "Name": "stack_commento.1.ai4yz1kiruy10m8yoht1uf82a",
                "EndpointID": "62f05454af953064bc9cd1ef31808c8545e9243dce34ad928a9dc8ecfb8f2c8d",
                "MacAddress": "02:42:0a:00:1a:57",
                "IPv4Address": "10.0.26.87/24",
                "IPv6Address": ""
            },
            "5b9c5a5d60a14337b184f505d31d7c4043c103b1413906434d3336f0520c13c8": {
                "Name": "proxy_letsencrypt-drone.1.sbq2lo8s9au7queniqrasdtnx",
                "EndpointID": "0b0cff6d0f2857bf251b5cc58d9b2329fcae72566033c5095c24e380920354a5",
                "MacAddress": "02:42:0a:00:1a:f5",
                "IPv4Address": "10.0.26.245/24",
                "IPv6Address": ""
            },
            "72b6d590b6f3d662933a9206c9603b70680ae832ab3974e343be364b714b5330": {
                "Name": "stack_matomo-web.1.vymsd2mb7y8716q6y8dol5pwk",
                "EndpointID": "a15144abffa56c6a7469b61a5ab1140681ce512969a82c1317631869b951dce3",
                "MacAddress": "02:42:0a:00:1a:ec",
                "IPv4Address": "10.0.26.236/24",
                "IPv6Address": ""
            },
            "776e01b4d0b62ef32d4e30f7cfa5dad4a5962f8146b8ebd22930ffc104409684": {
                "Name": "stack_chat.1.k3j9auf9ul7vtzycwdstk8nlj",
                "EndpointID": "32f1ade3126f81037fda52ffcca10191510c191c3c2ba65cd48656584079d770",
                "MacAddress": "02:42:0a:00:1a:f2",
                "IPv4Address": "10.0.26.242/24",
                "IPv6Address": ""
            },
            "b80c3d440dbbfa8b96caba45dbfb659351a592e8ebaa4315f6bc54a276a5ef6d": {
                "Name": "proxy_letsencrypt-git.1.s4hzhwtu4686g546nhwxw8b5z",
                "EndpointID": "aac66f20099bd5143900121bcb51daf2c3ca4ce50a96b03cabf96b3b5b587e24",
                "MacAddress": "02:42:0a:00:1a:d0",
                "IPv4Address": "10.0.26.208/24",
                "IPv6Address": ""
            },
            "d928b3072a4d263d1e1c084edac0bee4ab01ab33099c9bc9d0b3a535cfc76da7": {
                "Name": "stack_portainer.1.40ynqyyfpe3x17shtqh8vc44x",
                "EndpointID": "308e93f22d8f833efe5381674454bcfb91376a6f6610a9500a142243f760aaf1",
                "MacAddress": "02:42:0a:00:1a:db",
                "IPv4Address": "10.0.26.219/24",
                "IPv6Address": ""
            },
            "f635aace8915e37537ac7609928e7cf9767a3a48e2c78b8b5094d5a9ec874d82": {
                "Name": "stack_zabbix-web.1.5ggr94ern9cl63mu9eu64stan",
                "EndpointID": "770e5996cc3fa26634f10756159179b8d6694919ee785cf5fc0a4dd18e5d6222",
                "MacAddress": "02:42:0a:00:1a:e2",
                "IPv4Address": "10.0.26.226/24",
                "IPv6Address": ""
            },
            "lb-externalnet": {
                "Name": "externalnet-endpoint",
                "EndpointID": "2c2635241f849cf54cd5f409bccca9c2c923e0d1b8486aca1a10a9ce027ea35c",
                "MacAddress": "02:42:0a:00:1a:04",
                "IPv4Address": "10.0.26.4/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4122"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "da193020666e",
                "IP": "192.168.2.1"
            }
        ]
    }
]

I've made an organisation with all my sub stacks here.