fix: route host loopback backends

docs/deployment.md

@@ -23,12 +23,12 @@ tcp:
     example:
       loadBalancer:
         servers:
-          - address: "host.docker.internal:8443"
+          - address: "127.0.0.1:8443"
 ```
 
-If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.
+This deployment uses host networking so Traefik can reach services bound to host loopback addresses such as `127.0.0.1:8443`.
 
-HTTP-01 certificate challenges are routed separately with HTTP `Host(...)` rules on port `80`. Configure the `*-acme` services in `config/dynamic/tcp-services.yml` to point at the local port where the challenge responder listens.
+HTTP traffic is routed separately with HTTP `Host(...)` rules on port `80`. Configure the HTTP services in `config/dynamic/tcp-services.yml` to point at the local backend port that should handle redirects and ACME challenge paths.
 
 The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:
 
@@ -39,9 +39,9 @@ volumes:
 
 ## Ports
 
-- Host `80/tcp` -> container `8080/tcp`: public HTTP entrypoint for ACME HTTP-01 challenge paths.
-- Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
-- Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.
+- Host `80/tcp`: public HTTP entrypoint handled directly by Traefik through host networking.
+- Host `443/tcp`: public TCP TLS passthrough entrypoint handled directly by Traefik through host networking.
+- Host `8082/tcp`: Traefik ping entrypoint for the container healthcheck; restrict this port with host firewall rules if needed.
 
 ## Deploy