Index: .env.example
===================================================================
--- .env.example	(revision 09ee2bd19e715e798f3d2b165d1d90f9c37eba7d)
+++ .env.example	(revision f99bbe8116e4b79bb4d4e5a814dca1b301133c64)
@@ -1,4 +1,10 @@
 NODE_ENV=development
 PORT=3000
+
+# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
+# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
+# off the public internet). Use 0.0.0.0 only if you need direct external access
+# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
+HOST=127.0.0.1
 # Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
 # one on first start (saved to storage/.session-secret, stays stable across