diff --git a/dankclaw/hermes/quadlet/hermes-webui.container b/dankclaw/hermes/quadlet/hermes-webui.container
index b69c27b..f58c905 100644
--- a/dankclaw/hermes/quadlet/hermes-webui.container
+++ b/dankclaw/hermes/quadlet/hermes-webui.container
@@ -14,13 +14,16 @@
 # daemon binds loopback-only in the host network namespace (see
 # chrome-devtools-protocol.container). Only processes sharing that namespace
 # can drive the browser; a bridge-network client could not reach it at all.
-# The server binds LOOPBACK (HERMES_WEBUI_HOST=127.0.0.1). Host networking
-# means there is no Podman port forwarder, so the bind IS the exposure: the
-# compose service this replaced published 127.0.0.1:8787:8787, and the first
-# version of this unit bound 0.0.0.0 instead, which put the phone-facing API on
-# the whole LAN with only the password in front of it (measured 2026-09-16:
-# 192.168.0.143:8787 answered 200). The SSH tunnel (phone -> Dankclaw:22) dials
-# localhost:8787 from the host, so loopback serves it exactly as well.
+# The server binds 0.0.0.0:8787 of the host netns, and that is deliberate:
+# this unit is host-networked (the CDP daemon above needs a shared loopback), so
+# Caddy cannot reach it by container name and fronts the guarded vhost
+# hermes.franksdank.cloud with `reverse_proxy 192.168.0.143:8787` (see the
+# hermes block in dankclaw/Caddyfile, which records the same constraint). A
+# loopback bind was tried on 2026-09-16 for a tighter posture and broke that
+# vhost, because a bind is also the only way an off-host process can reach a
+# host-networked container: the LAN address and the tunnel's localhost hop are
+# both served by the wildcard, and a loopback-only bind serves only the latter.
+# Controls are the auth chain in front of the vhost plus the password.
 
 [Unit]
 Description=Hermes webui (Hermex) container
@@ -31,7 +34,7 @@ Image=localhost/hermes-agent:latest
 Pull=never
 Network=host
 EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
-Environment=HERMES_WEBUI_HOST=127.0.0.1
+Environment=HERMES_WEBUI_HOST=0.0.0.0
 Environment=HERMES_WEBUI_PORT=8787
 Environment=HERMES_WEBUI_PASSWORD=${HERMES_WEBUI_PASSWORD}
 Environment=HERMES_HOME=/data