# Auto-merged by `docker compose up`. Exposes Postgres for LOCAL tooling only —
# bound to 127.0.0.1 so that even when this committed file lands on the prod host
# the DB is NOT reachable on the public IP (a `0.0.0.0` publish would also bypass
# ufw). Never widen this to 0.0.0.0.
services:
  db:
    ports:
      - "127.0.0.1:5432:5432"