From 06dc5073ca0f162d089fbb64bab9e6bf3646cfdc Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Fri, 5 Jun 2026 11:37:10 -0400
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20explicit=20backend=20network=20f?=
 =?UTF-8?q?or=20steward=E2=86=94db=20traffic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 compose.deploy.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/compose.deploy.yml b/compose.deploy.yml
index 175e94a..bb08e55 100644
--- a/compose.deploy.yml
+++ b/compose.deploy.yml
@@ -16,6 +16,8 @@ services:
     pull_policy: always
     ports:
       - "5000:5000"
+    networks:
+      - backend
     volumes:
       # /data holds the auto-generated secret key, third-party plugins, and the
       # Ansible playbook cache — all of which must survive image updates. No
@@ -33,13 +35,15 @@ services:
 
   db:
     image: postgres:16-alpine
+    networks:
+      - backend
     environment:
       POSTGRES_USER: steward
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
       POSTGRES_DB: steward
     volumes:
       - pgdata:/var/lib/postgresql/data
-    # No host port published — Postgres is reachable only on the compose network.
+    # No host port published — db is reachable only on the backend network.
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U steward"]
       interval: 5s
@@ -47,6 +51,9 @@ services:
       retries: 5
     restart: unless-stopped
 
+networks:
+  backend:
+
 volumes:
   pgdata:
   app_data: