[Medium] Default Compose deployment requires an undeclared external umami_default network

Severity: Medium (deployment blocker) Confidence: High — static deployment contract plus an executed Compose config resolution; clean-container startup not performed. Audited commit: bd4057567de8ee18d49a8b2744c9746bcd67f3e0 (master, 2026-09-13 audit).

Following the repo's own documented self-hosting instructions on a clean Docker host fails, because the default Compose file requires an externally-managed network that is never created by anything in this repository.

Evidence and mechanism

• docker-compose.yml:27-29: the web service unconditionally joins the umami_default network.
• docker-compose.yml:59-61: that network is declared external: true.
• README.md:140-150: the documented fresh-clone install path is simply docker compose up -d, with no step that creates this network.
• src/middleware.ts:20-42: the only consumer of this dependency is optional analytics (Umami), whose failures are already explicitly discarded elsewhere in the app — the core application does not need it to run.

Reproduction and observed result

Ran docker compose config --format json against the unmodified file: it resolves networks.umami_default to {"name":"umami_default","ipam":{},"external":true} as a required network for services.osiris. Per Docker's documented external-network contract, Compose does not create external networks and errors if the named network does not already exist. No tracked file in the repository creates it.

Impact

A user who clones the repo and follows the README on a Docker host that has never run the maintainer's separate Umami analytics stack cannot start the application at all — docker compose up fails outright, even though the core app has no functional dependency on analytics.

Smallest correction and acceptance criteria

• Keep the default/documented Compose deployment on the standard project-local network; move the umami_default attachment into an optional analytics-specific override file (e.g. docker-compose.analytics.yml), or document/automate creating the network as a prerequisite if it's meant to be mandatory.
• Acceptance: running the documented setup steps in a clean Docker environment with no pre-existing umami_default network must bring up all required services and leave the web UI reachable; optional analytics being absent must not block startup.

Prior-issue check: #4 and #238 (closed) concern general Docker image availability/publication; #200 (closed) concerns networking but does not name this external analytics network. No existing issue matches.