docker port maps leak to external interface...

Unless they are explicitly bound to loopback, which I thought was the
default, but it is not. likely related to the interface between
bridges and ip tables in the Linux kernel, but anyhow, get literal
about the portmap interface address to prevent exposing the database
to the entire internet. With thanks to the friendly heads up email
from the German Federal Republic via Hetzner.

docker/docker-compose.yml

@@ -43,7 +43,7 @@ services:
       - POSTGRES_USER=${ASTEROID_DB_USER:-asteroid}
       - POSTGRES_PASSWORD=${ASTEROID_DB_PASSWORD:-asteroid_db_2025}
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres-data:/var/lib/postgresql/data
       - ./init-db.sql:/docker-entrypoint-initdb.d/init-db.sql:ro