fix(infra): pin static IPs, restart cloudflared on deploy

Root cause of intermittent 502s: cloudflared resolved 'app' once at
startup. When app container was recreated (env changes etc), it got
a new IP in compose's bridge network. Cloudflared kept dialing
stale 172.18.0.2 and got connection refused.

Fix:
- Define explicit 'spoonet' bridge network with 172.30.0.0/24
- Pin static IPs: app=.10, tunnel=.20, vector=.30
- Workflow restarts cloudflared after every app deploy as belt-and-
  suspenders even though static IPs make this unnecessary

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Zingzy

.github/workflows/deploy.yml

@@ -87,6 +87,9 @@ jobs:
             chmod 600 .env
             docker compose --env-file .env -f docker-compose.prod.yml pull
             docker compose --env-file .env -f docker-compose.prod.yml up -d --remove-orphans
+            # Restart cloudflared so it re-resolves app's IP (even though we now
+            # pin static IPs, this guarantees fresh tunnel state after deploy).
+            docker compose --env-file .env -f docker-compose.prod.yml restart cloudflared
             docker image prune -f
             docker compose --env-file .env -f docker-compose.prod.yml ps
 

docker-compose.prod.yml

@@ -21,6 +21,9 @@ services:
       start_period: 30s
     mem_limit: 3g
     mem_reservation: 512m
+    networks:
+      spoonet:
+        ipv4_address: 172.30.0.10
     logging:
       driver: json-file
       options:
@@ -39,6 +42,9 @@ services:
       app:
         condition: service_healthy
     mem_limit: 128m
+    networks:
+      spoonet:
+        ipv4_address: 172.30.0.20
     logging:
       driver: json-file
       options:
@@ -59,8 +65,18 @@ services:
       - /var/lib/docker/containers:/var/lib/docker/containers:ro
       - ./vector.toml:/etc/vector/vector.toml:ro
     mem_limit: 128m
+    networks:
+      spoonet:
+        ipv4_address: 172.30.0.30
     logging:
       driver: json-file
       options:
         max-size: "5m"
         max-file: "2"
+
+networks:
+  spoonet:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24