LAN Access

By default, Docker publishes VidArch on all host interfaces. Set a password before other devices can reach it. Use a localhost-only port mapping when a reverse proxy on the same host should be the only entry.

Keep the port on localhost

In docker-compose.yml, change only the port mapping:

services:
  vidarch:
    ports:
      - "127.0.0.1:2508:2508"

Keep AUTH_PASSWORD=choose-a-long-unique-passphrase in the untracked .env file.

Recreate the container:

docker compose up -d --force-recreate

VidArch then answers only on http://127.0.0.1:2508 on the host. With the standard 2508:2508 mapping, other devices on the LAN can use http://<host-ip>:2508.

What not to do

Do not directly expose port 2508 to the Internet. Use an HTTPS reverse proxy, active authentication, and, ideally, a private VPN. See Security.