Index: .env.example
===================================================================
--- .env.example	(revision 09ee2bd19e715e798f3d2b165d1d90f9c37eba7d)
+++ .env.example	(revision 065452a3f8936e062c22bd7a85e993c57f1814cb)
@@ -1,4 +1,10 @@
 NODE_ENV=development
 PORT=3000
+
+# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
+# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
+# off the public internet). Use 0.0.0.0 only if you need direct external access
+# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
+HOST=127.0.0.1
 # Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
 # one on first start (saved to storage/.session-secret, stays stable across