service:
  name: kb-postgres
  owner_node: solaria
  exposure: local-only           # reachable on Tailscale; no public ingress
  dependencies: []
  ports:
    - container: 5432
      host: 5433                 # 5433 avoids clash with any co-located postgres
      protocol: tcp
  healthcheck:
    type: custom
    command: pg_isready -U kb -d kb
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    paths:
      - kb_postgres_data         # Docker named volume
  runtime:
    env_vars:
      - POSTGRES_PASSWORD