services:
  nategodd:
    build: .
    container_name: nategodd
    restart: unless-stopped
    ports:
      - "127.0.0.1:7799:7799"   # cloudflared reaches it via localhost; never exposed directly