Adding the port declaration to the docker file exposes it to other containers on the same network/machine, adding it in docker-compose exposes it to the world.
I explicitly bind the external port only to the ZeroTier interface. In fact, my configs have changed a bit:
instead of:
ports: - 5432:5432
ports: - 192.168.111.123:5432:5432
Adding the port declaration to the docker file exposes it to other containers on the same network/machine, adding it in docker-compose exposes it to the world.