seperate port and container for external callback

docs/INSTALLATION.md

@@ -286,3 +286,33 @@ You can verify the active mount with:
 ```
 
 Images copied directly into `./data/uploads/library` are available in the AssetManager image library after reloading the page.
+
+
+## Optional dedicated callback port / DMZ listener
+
+AssetManager can expose software-job callbacks through a separate, callback-only Docker service. This is useful when remote devices must send callbacks through an Internet-facing FQDN while the normal AssetManager web interface remains internal.
+
+The optional service exposes only:
+
+- `GET /api/software-callback/health`
+- `POST /api/software-jobs/{job_id}/callback`
+
+It does not expose the AssetManager UI, login, assets, settings, static files, or administration routes.
+
+Set the desired host port in `.env`:
+
+```env
+CALLBACK_PORT=8090
+```
+
+Start the additional service:
+
+```bash
+docker compose --profile callback up -d callback
+```
+
+The internal callback container listens on port `8001`; Docker maps the configured host port to it. A reverse proxy or firewall can therefore publish only this port/service. For example, a public `https://callback.example.org` can proxy to the Docker host on port `8090`. Configure that public URL under **Software and Jobs → Settings → Callback base URL**.
+
+The standard AssetManager application continues to run on `APP_PORT` (default `8088`). The dedicated callback service is optional; installations that do not enable the `callback` profile behave as before.
+
+For image-based installations, use the same AssetManager image for both the `app` and `callback` services instead of `build: .`. The callback service must always run the same version as the main application.