Add git-server to jenkins_network with static IPs

Define subnet 172.23.0.0/16 for jenkins_network with static IPs:
jenkins (172.23.0.2), git-server (172.23.0.3), gerrit (172.23.0.4).
This allows git-server to communicate directly with Jenkins for
build triggers and webhook integrations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

4 files changed, 18 insertions, 8 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index aacd3e4..e19d268 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -24,7 +24,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 ### Git Server
 - Dir: `git-server/`
 - Compose: `git-server/server.yaml`, needs `docker build -t git-server .` first
-- Network: `git-network` (172.22.0.0/16), static IP 172.22.0.2
+- Networks: `git-network` (172.22.0.0/16, static IP 172.22.0.2) and `jenkins_network` (172.23.0.0/16, static IP 172.23.0.3)
 - Ports: 22 (SSH), 9418 (git daemon)
 - Volumes: `/var/git_ssh_keys` (public keys), `/var/git/repos` (repositories)
 - Host SSH runs on a non-standard port, so port 22 is free for git
@@ -42,7 +42,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 ### Gerrit (code review)
 - Part of `git-server/server.yaml` compose stack
 - Image: `gerritcodereview/gerrit:latest` (no custom Dockerfile)
-- Networks: `git-network` (static IP 172.22.0.4) and `jenkins_network`
+- Networks: `git-network` (static IP 172.22.0.4) and `jenkins_network` (static IP 172.23.0.4)
 - Web UI on port 8080 internally, SSH on 29418
 - No host ports (accessed only via main nginx reverse proxy)
 - Volumes: `/var/gerrit` (etc, git, db, index, cache), shared `/var/git/repos`
@@ -51,7 +51,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 ### Jenkins
 - Dir: `jenkins/`
 - Compose: `jenkins/docker-compose.yaml`, builds from `jenkins/Dockerfile`
-- Network: `jenkins_network`
+- Network: `jenkins_network` (172.23.0.0/16, static IP 172.23.0.2)
 - Uses Docker-out-of-Docker (DooD): mounts `/var/run/docker.sock` to spawn sibling build containers
 - Dockerfile extends `jenkins/jenkins:lts` with Docker CLI and `docker-workflow` plugin
 - `--prefix=/jenkins` set via JENKINS_OPTS for path-based access
@@ -73,7 +73,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - `git-network` — git-server + cgit + gerrit + nginx
 - `ghost_network` — ghost + ghost-db + nginx
-- `jenkins_network` — jenkins + gerrit + nginx
+- `jenkins_network` — jenkins + git-server + gerrit + nginx
 
 ## Startup Order
 1. Portainer (standalone)
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index 3b1b5f4..295450c 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -328,9 +328,10 @@ ghost_network
 ├── activitypub (optional)
 └── nginx
 
-jenkins_network
-├── jenkins
-├── gerrit
+jenkins_network (172.23.0.0/16)
+├── jenkins        (172.23.0.2)
+├── git-server     (172.23.0.3)
+├── gerrit         (172.23.0.4)
 └── nginx
 ```
 
diff --git a/git-server/server.yaml b/git-server/server.yaml
index d05436c..39b0fa9 100644
--- a/git-server/server.yaml
+++ b/git-server/server.yaml
@@ -16,6 +16,8 @@ services:
     networks:
       git-network:
         ipv4_address: 172.22.0.2
+      jenkins_network:
+        ipv4_address: 172.23.0.3
 
   cgit:
     image: cgit
@@ -43,6 +45,7 @@ services:
       git-network:
         ipv4_address: 172.22.0.4
       jenkins_network:
+        ipv4_address: 172.23.0.4
 
 
 networks:
diff --git a/jenkins/docker-compose.yaml b/jenkins/docker-compose.yaml
index fbdd78b..843980b 100644
--- a/jenkins/docker-compose.yaml
+++ b/jenkins/docker-compose.yaml
@@ -13,8 +13,14 @@ services:
       - /var/jenkins_home:/var/jenkins_home
       - /var/run/docker.sock:/var/run/docker.sock
     networks:
-      - jenkins_network
+      jenkins_network:
+        ipv4_address: 172.23.0.2
 
 networks:
   jenkins_network:
     name: jenkins_network
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.23.0.0/16
+          gateway: 172.23.0.1