From 864a2b20cd1b8998bbedfcf007d205a2897eb31a Mon Sep 17 00:00:00 2001
From: gadgethd <111318106+gadgethd@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:32:28 +0100
Subject: [PATCH] fix: reserve Compose proxy addresses

---
 .github/workflows/ci.yml | 7 +++++--
 docker-compose.yml       | 3 +++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2652e04..72c6270 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -204,8 +204,11 @@ jobs:
         run: |
           docker compose config --quiet
           docker compose config --format json \
-            | jq -e '.services.timescaledb.command
-              | index("max_worker_processes=24") != null' >/dev/null
+            | jq -e '
+              (.services.timescaledb.command
+                | index("max_worker_processes=24") != null)
+              and (.networks.default.ipam.config[0].ip_range
+                == "172.30.0.128/25")' >/dev/null
       - name: Build every application image and smoke an empty-volume stack
         env:
           POSTGRES_PASSWORD: ci-postgres-password
diff --git a/docker-compose.yml b/docker-compose.yml
index cf51483..5d0c6f4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1232,7 +1232,10 @@ networks:
     ipam:
       config:
         # Fixed proxy addresses make the backend's immediate-peer trust exact.
+        # Keep Docker's dynamic allocator away from those reserved low
+        # addresses when the full stack starts services concurrently.
         - subnet: 172.30.0.0/24
+          ip_range: 172.30.0.128/25
   meshcore-beacon-ukmesh:
     external: true
     name: meshcore-beacon-ukmesh_default