Bind staging nginx to localhost for Windows Docker Desktop

Publish port 8088 on 127.0.0.1 only so netsh portproxy can expose staging
to LAN/public IPs; document the one-time portproxy setup on Windows.

Co-authored-by: Cursor <cursoragent@cursor.com>

infrastructure/STAGING-DEPLOY.md

@@ -165,6 +165,37 @@ Create token: profile → **Settings → Applications → Generate New Token**.
 New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow
 ```
 
+### 7. External access on Windows + Docker Desktop (portproxy)
+
+Gitea on **:3000** runs natively on Windows and is reachable from your Mac. Staging **:8088** runs in **Docker Desktop** — `127.0.0.1:8088` works on the PC, but `http://<public-ip>:8088` from another machine may get **Empty reply from server** unless you forward the port.
+
+Compose binds nginx to **127.0.0.1:8088** only. After deploy, run **once** in **PowerShell as Administrator**:
+
+```powershell
+netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=8088
+netsh interface portproxy show all
+```
+
+Verify on the server:
+
+```powershell
+curl http://127.0.0.1:8088/health
+```
+
+From your Mac:
+
+```bash
+curl http://178.131.50.201:8088/health
+```
+
+If the public IP still fails but LAN works, add **router port forward 8088** → Windows PC (same as Gitea **3000**).
+
+To remove portproxy later:
+
+```powershell
+netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088
+```
+
 ---
 
 ## Test the pipeline
@@ -246,7 +277,7 @@ On the Windows host, from repo `infrastructure/`:
 | `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
 | `docker login` denied | Token needs package permissions; check username/secret |
 | Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |
-| Port 8088 unreachable | Windows firewall rule; confirm nginx container is up |
+| Port 8088 unreachable from Mac / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:8088/health` must work on Windows first. |
 | Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
 | Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
 | `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |

infrastructure/docker-compose.registry.yml

@@ -91,7 +91,8 @@ services:
       frontend:
         condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      # Localhost only — Docker Desktop on Windows often breaks 0.0.0.0; use netsh portproxy for LAN/public (see STAGING-DEPLOY.md).
+      - "127.0.0.1:${STAGING_HTTP_PORT:-8088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx

infrastructure/docker-compose.staging.yml

@@ -93,7 +93,7 @@ services:
       frontend:
         condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      - "127.0.0.1:${STAGING_HTTP_PORT:-8088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx