Initial curated DockDeck source from 26772208f608782e88c736dc70878e7b5abd3916

docs/EXTERNAL_ACCESS.md

@@ -0,0 +1,14 @@
+# External access
+
+DockDeck defaults to loopback publication. Keep that default unless network access is intentional.
+
+For a trusted LAN:
+
+1. Generate an operator password hash with `node scripts/hash-operator-password.mjs`.
+2. Set both `DOCKDECK_OPERATOR_USER` and `DOCKDECK_OPERATOR_PASSWORD_HASH`.
+3. Set `DOCKDECK_BIND_ADDRESS` to the intended host interface.
+4. Restrict access with host or network firewall rules.
+
+For access beyond the trusted LAN, place DockDeck behind an authenticated HTTPS reverse proxy. Do not expose the optional Docker socket proxy, AppOps, or provider APIs through that proxy. HTTP Basic credentials must not be sent over plaintext internet connections.
+
+JSON configuration exports exclude credentials but can identify services and URLs. Treat them as sensitive operational data.