A Compose stack that publishes PostgreSQL, the MinIO S3 API and console, and
pgAdmin through Caddy, which is the only container with public ports. The data
services sit on an internal network.
Caddy is built with the pinned caddy-l4 module so it can terminate TLS on the
PostgreSQL wire protocol itself (SSLRequest), not only HTTP. MinIO is built from
its pinned upstream security release, which has no published image. Every
secret comes from .env, which is ignored; .env.example documents it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
