Served by the app container, proxied by Caddy, behind Cloudflare.
app
Postgres is on an internal network with no route to the internet, and no published port.