feat(transport): loopback-only default port binding + reverse-proxy docs (onboarding M3)

2026-08-23 00:39:53 +01:00
parent 2ffdf77905
commit 85b4b4cd91
3 changed files with 56 additions and 3 deletions
@@ -3,7 +3,10 @@ services:
    image: maestro
    container_name: maestro
    ports:
-      - "8080:8080"
+      # Loopback-only by default (owner gate ships session cookies). Reach it
+      # via `ssh -L 8080:127.0.0.1:8080 <host>` or put a TLS reverse proxy in
+      # front — see README "Access & transport".
+      - "127.0.0.1:8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${XDG_DATA_HOME:-${HOME}}/.dcntrlized:/data/.dcntrlized"