- dev/test Postgres stays local per-machine, not exposed - prod (home Proxmox) Postgres stays private, cross-machine access via VPN/SSH tunnel - keep db + app services in a single docker-compose.yml (already uses explicit network/volume/container names, so splitting later stays cheap if a real second consumer of the DB shows up)