Separate backend and proxy edge networks

deploy/vps/README.md

@@ -9,6 +9,8 @@ It is intentionally separate from the Rocky development Compose project.
 - WeatherTool host binding: `127.0.0.1:8002`
 - Authelia host binding: `127.0.0.1:9091`
 - PostgreSQL: private Docker network only; no host port
+- App-to-database traffic: internal backend network
+- Nginx-to-app/auth traffic: explicit loopback ports through a separate edge network
 - Scheduled provider jobs: disabled
 - Existing VPS applications, networks, volumes, and Nginx sites: untouched
 

deploy/vps/compose.yml

@@ -53,6 +53,7 @@ services:
       - /app/data:size=256m,mode=0770,uid=100,gid=101
     networks:
       - backend
+      - edge
     security_opt:
       - no-new-privileges:true
 
@@ -72,7 +73,7 @@ services:
       - ./secrets/session_secret:/run/secrets/session_secret:ro
       - ./secrets/storage_encryption_key:/run/secrets/storage_encryption_key:ro
     networks:
-      - backend
+      - edge
     security_opt:
       - no-new-privileges:true
 
@@ -80,3 +81,5 @@ networks:
   backend:
     driver: bridge
     internal: true
+  edge:
+    driver: bridge

docs/VPS_STAGING_PLAN.md

@@ -87,7 +87,8 @@ Proposed application root:
 WeatherTool will use:
 
 - a unique Compose project name;
-- a private application network;
+- an internal database backend network plus a separate proxy-facing edge
+  network for the two loopback-bound HTTP services;
 - its own PostgreSQL service and persistent storage;
 - its own Authelia configuration and storage;
 - an ephemeral writable application scratch filesystem while the remaining