diff --git a/compose/hf-pdocker-02/couchdb/.env.example b/compose/hf-pdocker-02/couchdb/.env.example
new file mode 100644
index 0000000..a0ec207
--- /dev/null
+++ b/compose/hf-pdocker-02/couchdb/.env.example
@@ -0,0 +1,2 @@
+COUCHDB_USER=obsidian
+COUCHDB_PASSWORD=REPLACE_AT_DEPLOY
diff --git a/compose/hf-pdocker-02/couchdb/docker-compose.yml b/compose/hf-pdocker-02/couchdb/docker-compose.yml
new file mode 100644
index 0000000..d84e095
--- /dev/null
+++ b/compose/hf-pdocker-02/couchdb/docker-compose.yml
@@ -0,0 +1,27 @@
+services:
+  couchdb:
+    image: couchdb:3.4
+    container_name: couchdb
+    restart: unless-stopped
+    ports:
+      - "5984:5984"
+    environment:
+      - COUCHDB_USER=${COUCHDB_USER}
+      - COUCHDB_PASSWORD=${COUCHDB_PASSWORD}
+      - TZ=America/Chicago
+    volumes:
+      # LOCAL disk, not NFS: CouchDB's file locking breaks over NFSv3, the same
+      # way it did for guacamole-db (MySQL) and semaphore-db.
+      - /var/lib/couchdb/data:/opt/couchdb/data
+      # NOT :ro -- CouchDB 3.x writes runtime config back into the last-loaded ini.
+      # With a read-only mount it exits 1 immediately and logs NOTHING at all.
+      - /var/lib/couchdb/config/local.ini:/opt/couchdb/etc/local.d/local.ini
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    mem_limit: 1g
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:5984/_up"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
diff --git a/compose/hf-pdocker-02/couchdb/local.ini b/compose/hf-pdocker-02/couchdb/local.ini
new file mode 100644
index 0000000..68cfc43
--- /dev/null
+++ b/compose/hf-pdocker-02/couchdb/local.ini
@@ -0,0 +1,30 @@
+; CouchDB config for Obsidian LiveSync.
+; Obsidian talks to CouchDB from an app:// origin, so CORS must allow it explicitly --
+; a wildcard origin is not permitted alongside credentials.
+
+[couchdb]
+single_node = true
+max_document_size = 50000000
+
+[chttpd]
+require_valid_user = true
+; ...but leave /_up open, so the Prometheus blackbox probe can health-check it
+; without credentials. Everything else still returns 401 to anonymous callers.
+require_valid_user_except_for_up = true
+max_http_request_size = 4294967296
+bind_address = 0.0.0.0
+
+[chttpd_auth]
+require_valid_user = true
+authentication_redirect = /_utils/session.html
+
+[httpd]
+WWW-Authenticate = Basic realm="couchdb"
+enable_cors = true
+
+[cors]
+credentials = true
+; Obsidian desktop is app://obsidian.md; mobile uses capacitor://localhost.
+origins = app://obsidian.md,capacitor://localhost,http://localhost
+methods = GET,PUT,POST,HEAD,DELETE
+headers = accept,authorization,content-type,origin,referer,x-csrf-token