diff --git a/README.md b/README.md
index 7f6a89b..578cb4b 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,8 @@ Copier template for a Python backend, either as a `backend/` part next to other
 
 Ships `backend/docker-compose.yml` with root-relative paths and profiles per service, `docker-compose.override.yml.example` (published ports and the `caddy` network aliases, copied by `make env`), a `Makefile` with `fmt`, `check`, `build` and service-specific targets, `.env.example` and `CLAUDE.md`. Applied on top of the `infra` template, `layout: parts` or `layout: single` respectively.
 
+`DB__HOST`/`DB__PORT` and `REDIS__HOST`/`REDIS__PORT` say where the service really is. The bundled container takes the host as its network alias and listens on the port, the override publishes it on the machine. For an external database, point them at it and leave its profile out of `COMPOSE_PROFILES`.
+
 ```sh
 copier copy --trust -d project_name="My Thing" <this-repo> <dest>
 copier update -a .copier/backend.yml
diff --git a/template/{{ part_dir }}/Makefile.jinja b/template/{{ part_dir }}/Makefile.jinja
index bcde17a..399ae18 100644
--- a/template/{{ part_dir }}/Makefile.jinja	
+++ b/template/{{ part_dir }}/Makefile.jinja	
@@ -49,8 +49,15 @@ post-deploy:
 	fi
 {% endif %}{% if layout == 'root' %}
 env:
-	@test -f .env || cp .env.example .env
-	@test -f docker-compose.override.yml || cp docker-compose.override.yml.example docker-compose.override.yml
+	@fresh=; test -f .env || { cp .env.example .env; fresh=1; }; \
+	if ! test -f docker-compose.override.yml; then \
+		cp docker-compose.override.yml.example docker-compose.override.yml; \
+		for port in $$(sed -n 's/.*127\.0\.0\.1:\([0-9]*\):.*/\1/p' docker-compose.override.yml | sort -u); do \
+			random=$$((20000 + $$(od -An -N2 -tu2 /dev/urandom) % 40000)); \
+			sed "s/127\.0\.0\.1:$$port:/127.0.0.1:$$random:/" docker-compose.override.yml > docker-compose.override.yml.tmp && mv docker-compose.override.yml.tmp docker-compose.override.yml; \
+			test -z "$$fresh" || { sed "s|localhost:$$port/|localhost:$$random/|" .env > .env.tmp && mv .env.tmp .env; }; \
+		done; \
+	fi
 
 recreate:
 	$(COMPOSE) up -d --force-recreate
diff --git a/template/{{ part_dir }}/docker-compose.override.yml.example.jinja b/template/{{ part_dir }}/docker-compose.override.yml.example.jinja
index 123484f..c534c72 100644
--- a/template/{{ part_dir }}/docker-compose.override.yml.example.jinja	
+++ b/template/{{ part_dir }}/docker-compose.override.yml.example.jinja	
@@ -11,15 +11,17 @@ services:{% if not entries %} {}{% endif %}
       caddy:
         aliases:
           - {{ dash }}-api
+#    ports:
+#      - "127.0.0.1:8080:${API__PORT}"
 {% elif entry == 'mongodb' %}  mongodb:
-    ports:
-      - "127.0.0.1:${DB__PORT:-27017}:${DB__PORT:-27017}"
+#    ports:
+#      - "127.0.0.1:27017:${DB__PORT}"
 {% elif entry == 'postgres' %}  postgres:
-    ports:
-      - "127.0.0.1:${DB__PORT:-5432}:5432"
+#    ports:
+#      - "127.0.0.1:5432:${DB__PORT}"
 {% elif entry == 'redis' %}  redis:
-    ports:
-      - "127.0.0.1:${REDIS__PORT:-6379}:6379"
+#    ports:
+#      - "127.0.0.1:6379:${REDIS__PORT}"
 {% endif %}{% if not loop.last %}
 {% endif %}{% endfor %}{% if 'api' in backend_services %}
 networks:
diff --git a/template/{{ part_dir }}/docker-compose.yml.jinja b/template/{{ part_dir }}/docker-compose.yml.jinja
index fbe3861..829ab2e 100644
--- a/template/{{ part_dir }}/docker-compose.yml.jinja	
+++ b/template/{{ part_dir }}/docker-compose.yml.jinja	
@@ -50,18 +50,18 @@ services:
     environment:
       MONGO_INITDB_ROOT_USERNAME: ${DB__USER}
       MONGO_INITDB_ROOT_PASSWORD: ${DB__PASSWORD}
-    command: mongod --port ${DB__PORT:-27017}
+    command: mongod --port ${DB__PORT}
     volumes:
       - database:/data/db
     healthcheck:
-      test: ["CMD", "mongosh", "--quiet", "--port", "${DB__PORT:-27017}", "--eval", "db.adminCommand('ping')"]
+      test: ["CMD", "mongosh", "--quiet", "--port", "${DB__PORT}", "--eval", "db.adminCommand('ping')"]
       interval: 5s
       timeout: 5s
       retries: 5
     networks:
       database:
         aliases:
-          - ${DB__HOST:-mongodb}
+          - ${DB__HOST}
 {% endif %}
 {%- if database == 'postgres' %}
   postgres:
@@ -72,6 +72,7 @@ services:
       POSTGRES_USER: ${DB__USER}
       POSTGRES_PASSWORD: ${DB__PASSWORD}
       POSTGRES_DB: ${DB__DB_NAME}
+      PGPORT: ${DB__PORT}
     volumes:
       - database:/var/lib/postgresql/data
     healthcheck:
@@ -82,7 +83,7 @@ services:
     networks:
       database:
         aliases:
-          - ${DB__HOST:-postgres}
+          - ${DB__HOST}
 
   migrator:
     build: {{ part_dir }}
@@ -114,9 +115,9 @@ services:
     image: redis:7-alpine
     profiles: [redis, external]
     restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes"]
+    command: ["redis-server", "--port", "${REDIS__PORT}", "--appendonly", "yes"]
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-p", "${REDIS__PORT}", "ping"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -125,7 +126,7 @@ services:
     networks:
       redis:
         aliases:
-          - ${REDIS__HOST:-redis}
+          - ${REDIS__HOST}
 {% endif %}
 {%- if database != 'none' or use_redis %}
 volumes: