I hadn’t actually noticed those checks uses a different structure for their Postgres app. That would indeed be helpful to know if that’s available to all apps:
While you wait for someone to Fly to answer that question, you can simply not provide an external port. The docs don’t say that explicitly but I’ve done that e.g for a demo Fastify app using a TCP healthcheck. And I would assume given that no external port is specified, it must therefore be private. You could double-down on that by not assigning the app a public IP. Anyway, this was what I used, if you want to try something while waiting: