diff --git a/deploy/README.md b/deploy/README.md
index 3af7715..a5dbd50 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -5,7 +5,7 @@ The production stack lives at `/opt/tracecd` on `156.238.122.140` and is sized f
 ## Services
 
 - MySQL 8.0.40: Docker-only `tracecd-net`; no host port is published.
-- Gitea 1.22.6: host ports 3000 and 2222 are mapped, but remain blocked by the host firewall unless explicitly opened.
+- Gitea 1.22.6: host ports 3000 and 2222 are bound to loopback only until an authenticated public access method is chosen.
 - Gitea Actions runner: capacity 1, label `centos-env`, Docker socket access.
 - TraceCD: built by Gitea Actions, bound to `127.0.0.1:8080` and served by host Nginx.
 - Nginx: `t.1633292.cn` on port 80. Port 443 remains owned by Xray.
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
index 88e4efa..30e558c 100644
--- a/deploy/compose.yaml
+++ b/deploy/compose.yaml
@@ -56,8 +56,8 @@ services:
       - ./data/gitea:/data
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "3000:3000"
-      - "2222:22"
+      - "127.0.0.1:3000:3000"
+      - "127.0.0.1:2222:22"
     networks:
       - tracecd-net
     mem_limit: 256m