From 31eaf2d6a35027c850b436845a290b07ff9a6e9c Mon Sep 17 00:00:00 2001
From: xmrcheckout <privacy@localhost>
Date: Fri, 9 Jan 2026 15:23:18 +0000
Subject: [PATCH] compose: only expose nginx by default

---
 README.md          |  2 +-
 docker-compose.yml | 12 ------------
 2 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/README.md b/README.md
index f359e06..a012352 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ docker compose up --build
 ```
 
 Open `https://localhost` for the UI (HTTP redirects to HTTPS).
-The API runs on `http://127.0.0.1:8000` and Postgres on port `5432`.
+In the default Compose configuration, only `nginx` is published to the host. The API, Postgres, and wallet-rpc services are reachable only inside the Docker network.
 
 ## Self-hosted deployment (Docker Compose)
 
diff --git a/docker-compose.yml b/docker-compose.yml
index ec07497..a3f9423 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,8 +36,6 @@ services:
       GUNICORN_WORKERS: ${GUNICORN_WORKERS:-5}
     volumes:
       - ./qr:/qr
-    ports:
-      - "8000:8000"
     depends_on:
       db:
         condition: service_healthy
@@ -121,8 +119,6 @@ services:
         "--log-level",
         "3"
       ]
-    ports:
-      - "18084:18083"
     volumes:
       - ./wallets/reconciler:/wallets
     restart: on-failure
@@ -152,8 +148,6 @@ services:
         "--log-level",
         "3"
       ]
-    ports:
-      - "18085:18083"
     volumes:
       - ./wallets/reconciler:/wallets
     restart: on-failure
@@ -183,8 +177,6 @@ services:
         "--log-level",
         "3"
       ]
-    ports:
-      - "18086:18083"
     volumes:
       - ./wallets/reconciler:/wallets
     restart: on-failure
@@ -195,8 +187,6 @@ services:
       API_BASE_URL: ${API_BASE_URL:-http://nginx/api}
       NEXT_PUBLIC_SITE_URL: ${SITE_URL:-http://localhost}
       NEXT_PUBLIC_DONATIONS_ENABLED: ${DONATIONS_ENABLED:-false}
-    ports:
-      - "3000:3000"
     depends_on:
       api:
         condition: service_started
@@ -207,8 +197,6 @@ services:
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
       POSTGRES_DB: ${POSTGRES_DB}
-    ports:
-      - "5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck: