fix: reserve Compose proxy addresses

.github/workflows/ci.yml

@@ -204,8 +204,11 @@ jobs:
         run: |
           docker compose config --quiet
           docker compose config --format json \
-            | jq -e '.services.timescaledb.command
-              | index("max_worker_processes=24") != null' >/dev/null
+            | jq -e '
+              (.services.timescaledb.command
+                | index("max_worker_processes=24") != null)
+              and (.networks.default.ipam.config[0].ip_range
+                == "172.30.0.128/25")' >/dev/null
       - name: Build every application image and smoke an empty-volume stack
         env:
           POSTGRES_PASSWORD: ci-postgres-password

docker-compose.yml

@@ -1232,7 +1232,10 @@ networks:
     ipam:
       config:
         # Fixed proxy addresses make the backend's immediate-peer trust exact.
+        # Keep Docker's dynamic allocator away from those reserved low
+        # addresses when the full stack starts services concurrently.
         - subnet: 172.30.0.0/24
+          ip_range: 172.30.0.128/25
   meshcore-beacon-ukmesh:
     external: true
     name: meshcore-beacon-ukmesh_default