Index: scripts/install.sh
===================================================================
--- scripts/install.sh	(revision bb42dfb3c61f3495f4ebd21e0066a369b7d0a202)
+++ scripts/install.sh	(revision 5eef817483804be6a13b52f068413569df6810b0)
@@ -160,4 +160,7 @@
     echo "NODE_ENV=production"
     echo "PORT=${KLONKT_PORT}"
+    # Bind to loopback only: Caddy (this host) reaches it; the internet cannot
+    # hit the app directly on its port, bypassing HTTPS.
+    echo "HOST=127.0.0.1"
     echo "SESSION_SECRET=${SECRET}"
     echo "DATABASE_PATH=./storage/database.sqlite"
@@ -168,9 +171,11 @@
   } > "$ENV"
   chown "$KLONKT_USER:$KLONKT_USER" "$ENV"; chmod 600 "$ENV"
-  ok "new .env (random SESSION_SECRET)"
+  ok "new .env (random SESSION_SECRET, app bound to 127.0.0.1)"
 else
   # sync the port in an existing .env with the chosen port
   if grep -q '^PORT=' "$ENV"; then sed -i "s/^PORT=.*/PORT=${KLONKT_PORT}/" "$ENV"; fi
-  ok "kept existing .env (port synced)"
+  # harden older installs: bind to loopback if not already configured
+  grep -q '^HOST=' "$ENV" || echo "HOST=127.0.0.1" >> "$ENV"
+  ok "kept existing .env (port synced, bound to 127.0.0.1)"
 fi