What problem will this feature address?
When self-hosted, the Dokploy UI always binds to 0.0.0.0:3000 in host mode. This makes the dashboard publicly accessible at http://:3000 even if Traefik + HTTPS are set up. It exposes the login page directly to the internet and can’t be restricted with UFW due to Swarm host networking.
Describe the solution you'd like
Add a configuration option (e.g., BIND_ADDRESS=127.0.0.1) or route the UI only through the built-in Traefik. This would ensure the dashboard is only accessible via a secure domain (with HTTPS and middleware) instead of a raw public IP.
Describe alternatives you've considered
Cloud provider firewalls (Hetzner/DO): works, but adds extra complexity.
Removing the Swarm published port manually: fragile, breaks after updates.
VPN/Tunnel (Tailscale, Cloudflare): works, but not beginner-friendly and adds overhead.
Additional context
Other platforms (Portainer, CapRover, Coolify) allow localhost-only binding or force proxy access for their admin UIs. Supporting this in Dokploy would reduce the attack surface and align with security best practices.
Will you send a PR to implement it?
No
What problem will this feature address?
When self-hosted, the Dokploy UI always binds to 0.0.0.0:3000 in host mode. This makes the dashboard publicly accessible at http://:3000 even if Traefik + HTTPS are set up. It exposes the login page directly to the internet and can’t be restricted with UFW due to Swarm host networking.
Describe the solution you'd like
Add a configuration option (e.g., BIND_ADDRESS=127.0.0.1) or route the UI only through the built-in Traefik. This would ensure the dashboard is only accessible via a secure domain (with HTTPS and middleware) instead of a raw public IP.
Describe alternatives you've considered
Cloud provider firewalls (Hetzner/DO): works, but adds extra complexity.
Removing the Swarm published port manually: fragile, breaks after updates.
VPN/Tunnel (Tailscale, Cloudflare): works, but not beginner-friendly and adds overhead.
Additional context
Other platforms (Portainer, CapRover, Coolify) allow localhost-only binding or force proxy access for their admin UIs. Supporting this in Dokploy would reduce the attack surface and align with security best practices.
Will you send a PR to implement it?
No