Based on this StackOverflow, the only difference between ports and expose is that ports exposes the port on the host machine, whereas expose only exposes it to other services in the same Docker Compose config.
Since we intend for this Docker Compose config to be publicly deployable, I think it would be good to have a bit stronger security here and avoid exposing the Redis port publicly on the host machine.
It may make debugging a bit more complicated... we could consider creating a separate docker-compose.yml for dev, but to be honest I don't think we even need to run dev in Docker (we're aiming to use Nix for that) so it's probably not a big deal.