fix(hosting): hardcode loopback outside the port variable for postgres and store

${POSTGRES_PORT:-127.0.0.1:5432} put the loopback inside the default, so
any port override (POSTGRES_PORT=5433) silently reverted to a public
bind. Use the traefik-dashboard shape (127.0.0.1:${VAR:-port}) so the
variable carries only the port and loopback survives overrides; same fix
for the new AGENTA_STORE_PORT, whose own comment promises loopback-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jp-agenta

hosting/docker-compose/ee/docker-compose.dev.yml

@@ -468,7 +468,7 @@ services:
         networks:
             - agenta-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:

hosting/docker-compose/ee/docker-compose.gh.local.yml

@@ -329,7 +329,7 @@ services:
         networks:
             - agenta-ee-gh-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -444,7 +444,7 @@ services:
         # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
         # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
         ports:
-            - "${AGENTA_STORE_PORT:-127.0.0.1:8333}:8333"
+            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
         # === LABELS =============================================== #
         labels:
             - "traefik.enable=false"

hosting/docker-compose/ee/docker-compose.gh.yml

@@ -341,7 +341,7 @@ services:
         networks:
             - agenta-ee-gh-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -456,7 +456,7 @@ services:
         # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
         # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
         ports:
-            - "${AGENTA_STORE_PORT:-127.0.0.1:8333}:8333"
+            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
         # === LABELS =============================================== #
         labels:
             - "traefik.enable=false"

hosting/docker-compose/oss/docker-compose.dev.yml

@@ -451,7 +451,7 @@ services:
         networks:
             - agenta-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:

hosting/docker-compose/oss/docker-compose.gh.local.yml

@@ -327,7 +327,7 @@ services:
         networks:
             - agenta-oss-gh-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -442,7 +442,7 @@ services:
         # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
         # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
         ports:
-            - "${AGENTA_STORE_PORT:-127.0.0.1:8333}:8333"
+            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
         # === LABELS =============================================== #
         labels:
             - "traefik.enable=false"

hosting/docker-compose/oss/docker-compose.gh.ssl.yml

@@ -351,7 +351,7 @@ services:
         networks:
             - agenta-gh-ssl-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -466,7 +466,7 @@ services:
         # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
         # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
         ports:
-            - "${AGENTA_STORE_PORT:-127.0.0.1:8333}:8333"
+            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
         # === LABELS =============================================== #
         labels:
             - "traefik.enable=false"

hosting/docker-compose/oss/docker-compose.gh.yml

@@ -358,7 +358,7 @@ services:
         networks:
             - agenta-oss-gh-network
         ports:
-            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -473,7 +473,7 @@ services:
         # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
         # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
         ports:
-            - "${AGENTA_STORE_PORT:-127.0.0.1:8333}:8333"
+            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
         # === LABELS =============================================== #
         labels:
             - "traefik.enable=false"