feat: add GitHub Actions runner workflow and fix portainer network race

- portainer-compose.yml: moves portainer from standalone container to
  compose-managed, giving the portainer_proxy network a compose owner.
  This ensures the network is reliably created before the main stack
  on fresh installs or after Docker state is wiped.
- .github/workflows/deploy.yml: self-hosted runner on valhalla runs
  dc pull + up on push to main, and hot-reloads Caddyfile.
- apply-compose.ps1: adds -Portainer flag to manage portainer-compose.yml.

.github/workflows/deploy.yml

@@ -0,0 +1,30 @@
+name: Deploy to valhalla
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Push .env
+        run: cp .env ~/valhalla-lab/.env
+
+      - name: Push and apply compose
+        run: |
+          cp docker-compose.yml ~/valhalla-lab/docker-compose.yml
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env pull
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env up -d
+
+      - name: Push and reload Caddyfile
+        run: |
+          cp Caddyfile /config/caddy/Caddyfile
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env exec -T caddy \
+            caddy reload --config /etc/caddy/Caddyfile

apply-compose.ps1

@@ -10,24 +10,27 @@
 #   powershell -File apply-compose.ps1 -EnvFile    # .env only
 #   powershell -File apply-compose.ps1 -Caddy      # Caddyfile only + hot-reload Caddy
 #   powershell -File apply-compose.ps1 -Compose    # docker-compose.yml only + pull + up -d
+#   powershell -File apply-compose.ps1 -Portainer  # portainer-compose.yml only + up -d
 
 param(
     [switch]$Compose,
     [switch]$Caddy,
-    [switch]$EnvFile
+    [switch]$EnvFile,
+    [switch]$Portainer
 )
 
 $ErrorActionPreference = "Stop"
 # Make a non-zero exit from scp/ssh abort the script instead of silently continuing.
 $PSNativeCommandUseErrorActionPreference = $true
 
-$server       = "ginnoir@valhalla"
-$composeLocal = Join-Path $PSScriptRoot "docker-compose.yml"
-$caddyLocal   = Join-Path $PSScriptRoot "Caddyfile"
-$envLocal     = Join-Path $PSScriptRoot ".env"
+$server           = "ginnoir@valhalla"
+$composeLocal     = Join-Path $PSScriptRoot "docker-compose.yml"
+$caddyLocal       = Join-Path $PSScriptRoot "Caddyfile"
+$envLocal         = Join-Path $PSScriptRoot ".env"
+$portainerLocal   = Join-Path $PSScriptRoot "portainer-compose.yml"
 
 # Default (no flags): push everything.
-if (-not $Compose -and -not $Caddy -and -not $EnvFile) {
+if (-not $Compose -and -not $Caddy -and -not $EnvFile -and -not $Portainer) {
     $EnvFile = $true; $Caddy = $true; $Compose = $true
 }
 
@@ -52,4 +55,11 @@ if ($Compose) {
     ssh $server "bash -ic 'dc up -d'"
 }
 
+if ($Portainer) {
+    Write-Host "Pushing portainer-compose.yml ..."
+    scp $portainerLocal "${server}:~/valhalla-lab/portainer-compose.yml"
+    Write-Host "Applying portainer compose ..."
+    ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml up -d"
+}
+
 Write-Host "Done."

portainer-compose.yml

@@ -0,0 +1,29 @@
+# Portainer is managed by this separate compose file so it owns the
+# portainer_proxy network. The main docker-compose.yml references it
+# as external: true. Bring this up BEFORE the main stack on fresh installs.
+#
+# On the server: ~/valhalla-lab/portainer-compose.yml
+#
+# Migration from standalone container:
+#   docker stop portainer && docker rm portainer
+#   docker network rm portainer_proxy      # remove orphaned standalone network
+#   docker compose -f portainer-compose.yml up -d
+#   dc up -d                               # reconnects caddy to new network
+
+services:
+  portainer:
+    container_name: portainer
+    image: portainer/portainer-ce:latest
+    restart: unless-stopped
+    networks:
+      - portainer_proxy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/portainer:/data
+    ports:
+      - "9100:9000"
+
+networks:
+  portainer_proxy:
+    name: portainer_proxy
+    driver: bridge