security: bind service ports to localhost only

Bind navidrome, n8n, immich, openclaw, gitea web ports to 127.0.0.1
to prevent direct LAN access bypassing Caddy/Authelia.

Tailscale userspace networking on Synology proxies through localhost,
so VPS Caddy access via Tailscale IP continues to work.

Gitea SSH port (2222) remains on all interfaces for external git push.

gitea/docker-compose.yml

@@ -30,7 +30,7 @@ services:
       - /etc/TZ:/etc/TZ:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "3300:3000"
+      - "127.0.0.1:3300:3000"
       - "2222:22"
     depends_on:
       - db

immich/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: immich-server
     restart: unless-stopped
     ports:
-      - "2283:2283"
+      - "127.0.0.1:2283:2283"
     volumes:
       - ${UPLOAD_LOCATION}:/usr/src/app/upload
       - /volume1/photo:/mnt/photo:ro

n8n/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: n8n
     restart: unless-stopped
     ports:
-      - "5678:5678"
+      - "127.0.0.1:5678:5678"
     volumes:
       - ./data:/home/node/.n8n
     environment:

navidrome/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: navidrome
     restart: unless-stopped
     ports:
-      - "4533:4533"
+      - "127.0.0.1:4533:4533"
     environment:
       ND_SCANSCHEDULE: 1h
       ND_LOGLEVEL: info

openclaw/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: openclaw-gateway
     restart: unless-stopped
     ports:
-      - "3100:18789"
+      - "127.0.0.1:3100:18789"
     environment:
       HOME: /home/node
       TERM: xterm-256color