From f39f560c7f78efe31937c49f6b762663193a7592 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Mon, 26 Oct 2026 22:38:54 +1100 Subject: [PATCH] deploy: publish on the LAN address so Caddy on .35 can reach it 127.0.0.1:8096 is unreachable from .35, which is where Caddy runs. Every other service on .13 is published this way (8095, 8092, 3909, 4200) and proxied by the same Caddy. Port is LAN-only; Caddy remains the sole public listener. --- deploy/compose.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/deploy/compose.yml b/deploy/compose.yml index 53bdc65..366ce4d 100644 --- a/deploy/compose.yml +++ b/deploy/compose.yml @@ -30,11 +30,13 @@ services: restart: unless-stopped mem_limit: 120m memswap_limit: 120m - # The app listens on 0.0.0.0 inside the container namespace; the host-side - # binding is loopback, so nothing is reachable from the LAN except through - # docker-proxy on 127.0.0.1:8096 — which is what Caddy proxies to. + # Published on this host's LAN address, not loopback. Caddy lives on .35 and + # proxies to 192.168.20.13:8096, exactly as it does for offsite (:8095), + # photo-filter (:8092), garage-ui (:3909) and prefect (:4200). The port is + # reachable inside the house only; Caddy on .35 remains the sole public + # listener, which is the intent of AGENTS.md section 4. ports: - - "127.0.0.1:8096:8096" + - "192.168.20.13:8096:8096" read_only: true security_opt: - no-new-privileges:true