fix: reorganize network definitions for services in compose.yaml

nodes/heimdall/jobsquatch-alpha/compose.yaml

@@ -6,8 +6,6 @@ services:
       POSTGRES_DB: jobsquatch
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
-    networks:
-      - jobsquatch-internal
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -15,15 +13,17 @@ services:
       interval: 5s
       timeout: 5s
       retries: 10
+    networks:
+      - jobsquatch-internal
 
   redis:
     image: redis:7-alpine
     restart: unless-stopped
-    networks:
-      - jobsquatch-internal
     volumes:
       - redis_data:/data
     command: redis-server --appendonly yes
+    networks:
+      - jobsquatch-internal
 
   app:
     image: ghcr.io/teamcastaldi/jobsquatch-backend:${IMAGE_TAG:-latest}
@@ -33,8 +33,6 @@ services:
         condition: service_healthy
       redis:
         condition: service_started
-    networks:
-      - jobsquatch-internal
     environment:
       APP_ENV: production
       DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/jobsquatch
@@ -60,18 +58,24 @@ services:
       timeout: 5s
       retries: 5
       start_period: 30s
+    networks:
+      - jobsquatch-internal
 
   frontend:
     image: ghcr.io/teamcastaldi/jobsquatch-frontend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     ports:
-      - "6080:80"
-    networks:
-      - jobsquatch-internal
-      - proxy-net
+      - "80:80"
     depends_on:
       app:
         condition: service_healthy
+    labels:
+      # When a container is on multiple networks, Traefik picks one arbitrarily.
+      # Pin it to proxy-net so Traefik never tries to route via jobsquatch-internal.
+      traefik.docker.network: proxy-net
+    networks:
+      - jobsquatch-internal
+      - proxy-net
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.jobsquatch.rule=Host(`jobsquatch-alpha.castaldifamily.com`)"
@@ -80,13 +84,19 @@ services:
       - "traefik.http.routers.jobsquatch.tls.certresolver=cloudflare"
       - "traefik.http.routers.jobsquatch.middlewares=security-headers@file"
       - "traefik.http.services.jobsquatch.loadbalancer.server.port=80"
-
+      
 volumes:
   postgres_data:
   redis_data:
 
 networks:
+  # Internal bridge for service-to-service communication (db, redis, app, frontend).
+  # Named explicitly so the full Docker network name is <project>_jobsquatch-internal,
+  # where <project> is the Compose project name (COMPOSE_PROJECT_NAME or directory name).
+  # On heimdall this is jobsquatch-alpha_jobsquatch-internal.
   jobsquatch-internal:
-    internal: true
+    driver: bridge
+  # External network managed by Traefik on heimdall. The frontend must be on this
+  # network so Traefik can route inbound HTTPS traffic to it.
   proxy-net:
     external: true