From 7221981389a565b7d5844741fb4cbb87ae1d83e0 Mon Sep 17 00:00:00 2001
From: thethreemagi <thethreemagi@outlook.com>
Date: Tue, 1 Sep 2026 13:35:53 -0400
Subject: [PATCH] compose: bind 8132 to localhost only

NPM proxies to scout-website:8000 over arrstack_arr_net, so the 0.0.0.0 publish
only provided a LAN path that bypassed the proxy, its exploit blocking and its
real-client-IP logging.
---
 docker-compose.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 59f930f..129ae19 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,7 +19,9 @@ services:
     container_name: scout-website
     restart: unless-stopped
     ports:
-      - "8132:8000"
+      # localhost only: NPM reaches this as scout-website:8000 over the docker
+      # network, so publishing on 0.0.0.0 only bought a LAN path around the proxy.
+      - "127.0.0.1:8132:8000"
     environment:
       - NTFY_URL=${NTFY_URL}
       - SHEET_ID=${SHEET_ID}