diff --git a/docker-compose.yml b/docker-compose.yml
index 056ae94..529105b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,48 +1,90 @@
+# wiki-tcg — replaces the previous docker-compose.yml, which did not describe
+# the deployment (findings-02 §5.4).
+#
+# Networks:
+#   proxy        - shared, created outside compose. NPM meets front-facing
+#                  containers here. Also used by other stacks later.
+#   tcg-internal - private. Only the backend and the database. Marked internal,
+#                  so the database has no route off this network at all.
+#
+# Deploy:  docker compose up -d --build
+# Migrate: docker compose run --rm backend alembic upgrade head
+
 services:
   db:
     image: postgres:16
     container_name: wikitcg-db
     restart: unless-stopped
     environment:
-      POSTGRES_USER: wikitcg
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: wikitcg
+      POSTGRES_USER: wikitcg
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      PGDATA: /var/lib/postgresql/data
+      TZ: Europe/Paris
     volumes:
-      - /mnt/user/appdata/wikitcg/postgres:/var/lib/postgresql/data
+      # EXACT path from the running container. /mnt/cache, NOT /mnt/user —
+      # this deliberately bypasses Unraid's FUSE layer. Do not "correct" it.
+      - /mnt/cache/appdata/postgresql16:/var/lib/postgresql/data
     networks:
-      - wikitcg
+      - tcg-internal
+    # No ports. The database is unreachable from the host and the LAN.
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U wikitcg -d wikitcg"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
 
   backend:
-    build: ./backend
+    build:
+      context: ./backend
+      dockerfile: dockerfile
+    image: wikitcg-backend
     container_name: wikitcg-backend
     restart: unless-stopped
-    depends_on:
-      - db
     environment:
-      DATABASE_URL: postgresql://wikitcg:${DB_PASSWORD}@db/wikitcg
-      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
-      RESEND_API_KEY: ${RESEND_API_KEY}
-      EMAIL_FROM: ${EMAIL_FROM}
-      FRONTEND_URL: ${FRONTEND_URL}
-      CORS_ORIGINS: ${FRONTEND_URL}
-      WIKIRANK_USER_AGENT: ${WIKIRANK_USER_AGENT}
-    ports:
-      - "8000:8000"
+      # Runtime connection — DML only, cannot alter schema.
+      DATABASE_URL: postgresql://wikitcg_app:${APP_DB_PASSWORD:?}@db:5432/wikitcg
+      # Migrations only. Owns the schema. Used by `compose run`, never by the
+      # running app. See tcg-remediation-todo.md Task 5.
+      MIGRATION_DATABASE_URL: postgresql://wikitcg:${POSTGRES_PASSWORD:?}@db:5432/wikitcg
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:?}
+      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?}
+      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:?}
+      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:?}
+      RESEND_API_KEY: ${RESEND_API_KEY:?}
+      EMAIL_FROM: noreply@tcg.gade.gg
+      FRONTEND_URL: https://tcg.gade.gg
+      CORS_ORIGINS: https://tcg.gade.gg
+      WIKIRANK_USER_AGENT: WikiTCG/1.0 (nikolaj@gade.gg)
+      TZ: Europe/Paris
     networks:
-      - wikitcg
+      - tcg-internal    # to reach db
+      - proxy           # to be reached by NPM
+    ports:
+      # STAGE 1 ONLY. Remove once NPM points at backend:8000 by name.
+      - "555:8000"
+    depends_on:
+      db:
+        condition: service_healthy
 
   frontend:
     build:
       context: ./frontend
-      args:
-        PUBLIC_API_URL: ${BACKEND_URL}
+      dockerfile: dockerfile
+    image: wikitcg-frontend
     container_name: wikitcg-frontend
     restart: unless-stopped
-    ports:
-      - "3000:80"
+    environment:
+      TZ: Europe/Paris
     networks:
-      - wikitcg
+      - proxy           # NPM only. No database access, by construction.
+    ports:
+      # STAGE 1 ONLY. Remove once NPM points at frontend:80 by name.
+      - "444:80"
 
 networks:
-  wikitcg:
-    driver: bridge
+  proxy:
+    external: true
+  tcg-internal:
+    internal: true