diff --git a/.gitignore b/.gitignore
index 4728ca4..178329b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -64,6 +64,8 @@ photoprism/backup/
 photoprism/config/hub.yml
 photoprism/serial
 photoprism/sidecar/
+postgres/*.pem
+postgres/data/
 postgis/PG_VERSION
 postgis/base/
 postgis/core
diff --git a/compose.postgres.yaml b/compose.postgres.yaml
new file mode 100644
index 0000000..3c80847
--- /dev/null
+++ b/compose.postgres.yaml
@@ -0,0 +1,23 @@
+services:
+  postgres:
+    container_name: postgres
+    image: postgres:17.5-alpine3.22
+    user: postgres
+    ports:
+      - 11111:5432
+    environment:
+      - POSTGRES_PASSWORD=postgres
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=postgres
+    volumes:
+      - /opt/postgres/entrypoint.sh:/entrypoint.sh
+      - /opt/postgres/postgresql.conf:/etc/postgresql/postgresql.conf
+      - /opt/postgres/data:/var/lib/postgresql/data
+      - /opt/postgres/cert.pem:/cert.pem
+      - /opt/postgres/key.pem:/key.pem
+    entrypoint: ["/bin/bash", "/entrypoint.sh"]
+
+    command:
+        - postgres
+        - -c
+        - config_file=/etc/postgresql/postgresql.conf
diff --git a/compose.yaml b/compose.yaml
index 91825ec..e53330d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -50,3 +50,4 @@ include:
 - compose.postgis.yaml
 - compose.timescaledb.yaml
 - compose.influxdb.yaml
+- compose.postgres.yaml
diff --git a/postgres/entrypoint.sh b/postgres/entrypoint.sh
new file mode 100644
index 0000000..5171ffd
--- /dev/null
+++ b/postgres/entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+chmod 0400 /cert.pem
+chown postgres:postgres /cert.pem
+
+chmod 0400 /key.pem
+chown postgres:postgres /key.pem
+
+exec "$@"
diff --git a/postgres/postgresql.conf b/postgres/postgresql.conf
new file mode 100644
index 0000000..67b5b87
--- /dev/null
+++ b/postgres/postgresql.conf
@@ -0,0 +1,4 @@
+ssl = on
+ssl_cert_file = '/cert.pem'
+ssl_key_file = '/key.pem'
+listen_addresses = '0.0.0.0'