seperate port and container for external callback

app/main.py

@@ -212,6 +212,15 @@ if not ldap_logger.handlers:
     ldap_logger.addHandler(ldap_console_handler)
 
 app = FastAPI(title=os.getenv("APP_TITLE", "AssetManager"))
+# Dedicated callback-only ASGI application. It deliberately exposes only the
+# software callback endpoint and its health endpoint so deployments may publish
+# callbacks through a separate port/FQDN without exposing the AssetManager UI.
+callback_app = FastAPI(
+    title=f"{os.getenv('APP_TITLE', 'AssetManager')} Callback",
+    docs_url=None,
+    redoc_url=None,
+    openapi_url=None,
+)
 _session_cfg = load_config().get("authentication", {})
 _session_env = _session_cfg.get("session_secret_env", "SESSION_SECRET")
 _session_secret = os.getenv(_session_env) or os.getenv("SESSION_SECRET") or "assetmanager-change-this-session-secret"
@@ -4870,6 +4879,7 @@ def category_delete(category_id: int, request: Request, db: Session = Depends(ge
 
 
 @app.get("/api/software-callback/health")
+@callback_app.get("/api/software-callback/health")
 def software_callback_health():
     return {
         "ok": True,
@@ -6397,6 +6407,7 @@ def _process_software_job_callback(
 
 
 @app.post("/api/software-jobs/{job_id}/callback")
+@callback_app.post("/api/software-jobs/{job_id}/callback")
 async def software_job_callback(job_id: int, request: Request, token: str = ""):
     client_host = request.client.host if request.client else "-"
     content_type = request.headers.get("content-type", "-")
@@ -7775,6 +7786,7 @@ def settings_software_page(request: Request):
             "callback_health_url": f"{callback_base}/api/software-callback/health" if callback_base else "",
             "debug_log": _software_debug_tail(),
             "debug_log_path": str(SOFTWARE_CALLBACK_DEBUG_LOG),
+            "callback_dedicated_port": str(os.getenv("CALLBACK_PORT", "8090") or "8090"),
         },
     )