Bind the API port to a configurable LAN address for the reverse proxy

Publish port 8080 on ${NESTQUEST_BIND_ADDRESS:-127.0.0.1} so the shared
Traefik proxy (TLS for nestquest.cubecraftlabs.com) can reach the API
box, while an unconfigured deployment stays localhost-only. Document the
variable in deploy/.env.example and the production topology in
api/README.md.

Maestro task 9d121e76-e1ce-479f-aef5-0e5e9756fda8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/README.md

@@ -27,6 +27,14 @@ Run it with compose — the SQLite file lives on the named volume
 
 ``deploy/.env`` is git-ignored and supplies the secrets (panel service
 token, Authentik OIDC settings); ``NESTQUEST_DB_PATH`` is fixed to
-``/var/lib/nestquest/nestquest.db`` by compose. The port is bound to
-localhost only — TLS/reverse proxy, Authentik, network separation,
+``/var/lib/nestquest/nestquest.db`` by compose.
+
+The published port binds ``NESTQUEST_BIND_ADDRESS`` from
+``deploy/.env`` and defaults to ``127.0.0.1`` (localhost only). In
+production TLS is terminated by the shared Traefik reverse proxy,
+which serves ``https://nestquest.cubecraftlabs.com`` (Let's Encrypt,
+auto-renewed, HTTP redirected to HTTPS) and forwards to the API box
+on port 8080 — so on that box set ``NESTQUEST_BIND_ADDRESS`` to its
+LAN address (``10.60.1.14``). Traefik only allows
+``/api/v1/panel`` from the Home Assistant host. Network separation,
 backup and restore are later Feature 17 tasks.

deploy/.env.example

@@ -14,4 +14,10 @@ NESTQUEST_PANEL_TOKEN=
 # The Authentik OIDC settings the admin plane verifies JWTs against.
 NESTQUEST_OIDC_ISSUER=
 NESTQUEST_OIDC_AUDIENCE=
-NESTQUEST_OIDC_JWKS_URL=
+NESTQUEST_OIDC_JWKS_URL=
+
+# The host interface the API's port 8080 is published on (compose
+# interpolation, not read by the API).  Defaults to 127.0.0.1 when
+# unset; on the API box set the LAN address the reverse proxy
+# forwards to, e.g. 10.60.1.14.
+NESTQUEST_BIND_ADDRESS=

deploy/compose.yaml

@@ -7,9 +7,14 @@
 # path here, and the secret values (panel service token, Authentik
 # OIDC settings) from ``deploy/.env`` — a git-ignored file you create
 # from ``deploy/.env.example`` (placeholder names only; never commit
-# real values).  TLS/reverse proxy, Authentik wiring and network
-# separation are later Feature 17 tasks; the port is bound to
-# localhost only until those land.
+# real values).
+#
+# TLS is terminated by the shared Traefik reverse proxy on another
+# host, which forwards to this service on port 8080.  The published
+# port binds NESTQUEST_BIND_ADDRESS (read from deploy/.env, the
+# project directory's env file): it defaults to 127.0.0.1 so an
+# unconfigured deployment is never exposed; set it to the host's LAN
+# address on the API box so the proxy can reach it.
 services:
   api:
     build:
@@ -19,7 +24,7 @@ services:
     init: true
     restart: unless-stopped
     ports:
-      - "127.0.0.1:8080:8080"
+      - "${NESTQUEST_BIND_ADDRESS:-127.0.0.1}:8080:8080"
     environment:
       # The SQLite file inside the named volume; fixed, not a secret.
       NESTQUEST_DB_PATH: /var/lib/nestquest/nestquest.db