The operator asked why `THOUGHTSYNC_BIND` isn't just defaulted to the safe value.
Fair question, and the answer exposed that my own advice was incomplete: I told
them to set it to 127.0.0.1 without asking where their proxy runs, and for a
proxy inside Docker that is the wrong fix.
There are three shapes, not two:
1. **LAN, no proxy** — the default. Binds every interface so a phone and a desktop
can reach the server. This is why the default is NOT the locked-down value: a
server reachable only from the machine it runs on isn't hardened, it's broken,
and that is the primary documented use of this app.
2. **Proxy in Docker** — delete the `ports:` block entirely. The proxy reaches the
app over the compose network; publishing a host port is a second,
unauthenticated way in that bypasses whatever the proxy does about TLS. Safer
than 127.0.0.1, because there is no host port to reach even from the host.
3. **Proxy on the host** — `THOUGHTSYNC_BIND=127.0.0.1`.
The compose file now spells out all three where the decision is made, and
`docs/public-hosting.md` item 4 asks where your proxy runs before telling you what
to do, plus how to check: `curl http://<lan-ip>:5000/api/health` from another
machine should NOT answer once you're proxied.
No default changed. Changing it would silently break every LAN install on the next
`docker compose pull` — the phone would just stop syncing, with nothing saying why.
bvandeusen
abe01da5f7