docker: document how to properly bind on port 80

Add more documentation around merging in Docker. The previous
documentation was incorrect.

console/data/docs/04-operations.md

@@ -723,10 +723,13 @@ complete setup. Look at the comments for some guidance. You should avoid to
 modify any existing files, except `docker/docker-compose-local.yml`, which
 should contain your local setup.
 
-This file can override parts of the configuration. You can check the final
-configuration with `docker compose config`. Scalars and lists are replaced,
-while dictionaries are merged. This makes removing values from a dictionary
-difficult.
+This file can override parts of the configuration. The [merge
+rules](https://docs.docker.com/reference/compose-file/merge/) are a bit complex:
+the general rule of thumb is that scalars are replaced, while lists and mappings
+are merged. However, exceptions exist.
+
+> [!TIP]
+> Always check if the final configuration matches your expectations with `docker compose config`.
 
 You can disable some services by using profiles:
 
@@ -736,6 +739,25 @@ services:
     profiles: ["disabled"]
 ```
 
+It is possible to remove a value with the `!reset` tag:
+
+```yaml
+services:
+  akvorado-outlet:
+    environment:
+      AKVORADO_CFG_OUTLET_METADATA_CACHEPERSISTFILE: !reset null
+```
+
+With Docker Compose v2.24.4 or later, it is possible to override a value:
+
+```yaml
+services:
+  traefik:
+    ports: !override
+      - 127.0.0.1:8080:8080/tcp
+      - 80:8081/tcp
+```
+
 ### Networking
 
 The default setup comes with both IPv4 and IPv6 enabled, using the NAT setup.
@@ -746,11 +768,7 @@ If you prefer to keep Docker default configuration, you can add this snippet to
 `docker/docker-compose-local.yml`:
 
 ```yaml
-networks:
-  default:
-    ipv6_enable: false
-    ipam:
-      config: []
+networks: !reset {}
 ```
 
 If you can route an IPv6 network to the Docker host, you can use the following

docker/docker-compose-local.yml

@@ -1,3 +1,4 @@
+---
 # If possible, overrides should go there!
 
 # If you prefer to use geo IP databases from host, uncomment this block.
@@ -6,3 +7,11 @@
 #   akvorado-orchestrator:
 #     volumes:
 #       - /usr/share/GeoIP:/usr/share/GeoIP:ro
+
+# If you want to expose the service directly on port 80, uncomment this block.
+
+# services:
+#   traefik:
+#     ports: !override
+#       - 127.0.0.1:8080:8080/tcp
+#       - 80:8081/tcp

docker/docker-compose.yml

@@ -239,9 +239,8 @@ services:
     ports:
       # Port 8080 is considered private as it exposes sensible unauthenticated
       # services (ClickHouse, configuration, ...). Therefore, it is only exposed
-      # on the loopback. Port 8081 is the one you can expose to users. If you
-      # want to change these ports, leave "8080/tcp" and "8081/tcp" unchanged:
-      # you can modify the IP/port on the left.
+      # on the loopback. Port 8081 is the one you can expose to users. Check
+      # docker-compose-local.yml if you want to expose directly on port 80.
       - 127.0.0.1:8080:8080/tcp
       - 8081:8081/tcp
     volumes: