From 9490a1ce5460da0dd0b135b6a86e6c93978dcc99 Mon Sep 17 00:00:00 2001
From: wuyanwanwu <104009119+wuyanwanwu@users.noreply.github.com.>
Date: Mon, 17 Aug 2026 20:32:41 +0800
Subject: [PATCH] Bind news app to localhost for reverse proxy

---
 .env.example                    | 1 +
 README.md                       | 2 ++
 docker-compose.host-network.yml | 2 ++
 docker-compose.yml              | 2 +-
 web/server.js                   | 3 ++-
 5 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 0e3b9a7..dc53587 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,7 @@
 # Application
 APP_ENV=production
 APP_PORT=
+APP_HOST=0.0.0.0
 APP_BASE_URL=
 APP_SECRET_KEY=
 APP_ADMIN_TOKEN=
diff --git a/README.md b/README.md
index 6c8f230..e010776 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,8 @@ ssh -N -L 15432:127.0.0.1:5432 <ssh-user>@<server-ip>
 
 Linux 云服务器上推荐使用 `docker-compose.host-network.yml`：SSH 隧道监听宿主机 `127.0.0.1:15432`，网页容器使用宿主机网络，`.env` 中填写 `PGHOST=127.0.0.1`、`PGPORT=15432`。这样不会把数据库隧道端口暴露到公网。模板见 `deploy/daily-news-db-tunnel.service.example`。
 
+网页服务可由 Nginx 代理到宿主机本地端口。使用 `docker-compose.host-network.yml` 时，覆盖配置会让网页只监听 `127.0.0.1:3100`；不要直接把 3100 暴露给公网。
+
 ## 配置
 
 复制 `.env.example` 为 `.env`，再在服务器上填写实际值。仓库中不提交 `.env`、密码、SMTP 授权码或 SSH 私钥。
diff --git a/docker-compose.host-network.yml b/docker-compose.host-network.yml
index 53ad218..1c56265 100644
--- a/docker-compose.host-network.yml
+++ b/docker-compose.host-network.yml
@@ -4,3 +4,5 @@ services:
   web:
     network_mode: host
     ports: []
+    environment:
+      APP_HOST: 127.0.0.1
diff --git a/docker-compose.yml b/docker-compose.yml
index 6c3ba6b..085c3fc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,6 +5,6 @@ services:
     env_file:
       - .env
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     extra_hosts:
       - "host.docker.internal:host-gateway"
diff --git a/web/server.js b/web/server.js
index 388804c..870c3d0 100644
--- a/web/server.js
+++ b/web/server.js
@@ -6,6 +6,7 @@ const { URL } = require('url');
 const { Pool } = require('pg');
 
 const PORT = Number(process.env.APP_PORT || 3000);
+const HOST = process.env.APP_HOST || '0.0.0.0';
 const PUBLIC_DIR = path.join(__dirname, 'public');
 const ADMIN_TOKEN = process.env.APP_ADMIN_TOKEN || '';
 
@@ -306,7 +307,7 @@ const server = http.createServer(async (req, res) => {
   }
 });
 
-server.listen(PORT, '0.0.0.0', () => {
+server.listen(PORT, HOST, () => {
   console.log(`Daily news digest web listening on ${PORT}`);
 });