callback container integrated fully

docker-compose.yml

@@ -40,6 +40,7 @@ services:
       LOCAL_ADMIN_USERNAME: ${LOCAL_ADMIN_USERNAME:-}
       LOCAL_ADMIN_PASSWORD: ${LOCAL_ADMIN_PASSWORD:-}
       CALLBACK_PORT: ${CALLBACK_PORT:-8090}
+      CALLBACK_BIND_IP: ${CALLBACK_BIND_IP:-127.0.0.1}
 
     ports:
       - "${APP_PORT:-8088}:8000"
@@ -50,12 +51,11 @@ services:
       - ./data/backups:/data/backups
       - ./data/scripts:/scripts
 
-  # Optional callback-only listener for Internet/DMZ scenarios.
-  # Start with: docker compose --profile callback up -d
-  # Only the callback POST endpoint and callback health endpoint are exposed.
+  # Callback-only listener for Internet/DMZ scenarios.
+  # Starts together with AssetManager and exposes only the callback POST endpoint
+  # and callback health endpoint, never the AssetManager web interface.
   callback:
     build: .
-    profiles: ["callback"]
     container_name: assetmanager-callback
     restart: unless-stopped
     depends_on:
@@ -71,7 +71,7 @@ services:
       SESSION_SECRET: ${SESSION_SECRET:-}
     command: ["uvicorn", "app.main:callback_app", "--host", "0.0.0.0", "--port", "8001"]
     ports:
-      - "${CALLBACK_PORT:-8090}:8001"
+      - "${CALLBACK_BIND_IP:-127.0.0.1}:${CALLBACK_PORT:-8090}:8001"
     volumes:
       - ./data/config:/app/config
       - ./data/logs:/app/data/logs