# Public and internal URLs

The provided Traefik instance owns host ports 80 and 443 and issues certificates
using ACME's TLS challenge. DNS and inbound TCP 443 must reach it. Set the
operator email in secrets.env. For an existing proxy, remove the `traefik`
service and connect that proxy to `dicto-reference-web`, using equivalent routes.
For internal-only installations, use your organization's trusted TLS certificate
configuration instead of assuming the public ACME challenge will work.

| Public path | Internal target | Prefix behavior |
| --- | --- | --- |
| `https://YOUR_HOST/api/*` | `server:3000` | Strip `/api` before forwarding |
| `https://YOUR_HOST/management/*` | `management:80` | Preserve `/management/` |

The API's public URL ends in `/api`, and auth base URL in `/api/auth`. Management
uses `API_URL=https://YOUR_HOST/api` and `BASE_HREF=/management/`. Do not put an
internal Docker service name into browser configuration. Use the same hostname
in server trusted origins and allowed callback URLs. A plain `/management`
request should ultimately reach the slash-terminated app root; test deep links
and `auth.html` through your chosen proxy.

Database, object store, metrics and model ports are not publicly routed.
Loopback-bound inference diagnostics are for operators on the host; use an SSH
tunnel from another machine. The Docker socket mounted by Traefik is privileged
infrastructure access even though the mount is read-only; use a suitable socket
proxy or a file-based routing provider if your environment requires isolation.