diff --git a/.env.docker.example b/.env.docker.example
index e053449..8d7aaea 100644
--- a/.env.docker.example
+++ b/.env.docker.example
@@ -3,7 +3,6 @@ APP_ENV=production
 APP_KEY=
 APP_DEBUG=false
 APP_URL=https://domain-anda.test
-APP_PORT=8000
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
@@ -24,7 +23,6 @@ DB_DATABASE=webgis_miskin
 DB_USERNAME=webgis
 DB_PASSWORD=change-this-password
 MYSQL_ROOT_PASSWORD=change-this-root-password
-MYSQL_HOST_PORT=3307
 
 SESSION_DRIVER=database
 SESSION_LIFETIME=120
diff --git a/Dockerfile b/Dockerfile
index 6ea2a3d..a1d975e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,5 +25,7 @@ COPY docker/app/entrypoint.sh /usr/local/bin/webgis-entrypoint
 
 RUN chmod +x /usr/local/bin/webgis-entrypoint
 
+EXPOSE 8000
+
 ENTRYPOINT ["webgis-entrypoint"]
 CMD ["php", "artisan", "serve", "--host=0.0.0.0", "--port=8000"]
diff --git a/README.md b/README.md
index 210aed3..3baa82f 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ Jika domain diisi dengan `https://`, Coolify akan mengurus sertifikat SSL dan re
 - Docker Engine
 - Docker Compose plugin
 - Domain atau subdomain yang diarahkan ke server
-- Reverse proxy hosting ke port aplikasi, misalnya `APP_PORT=8000`
+- Coolify reverse proxy yang diarahkan ke service `app` port internal `8000`
 
 Document root tidak perlu diarahkan manual ke `public` karena aplikasi berjalan di container Laravel.
 
@@ -48,7 +48,6 @@ cp .env.docker.example .env
 APP_ENV=production
 APP_DEBUG=false
 APP_URL=https://domain-anda.com
-APP_PORT=8000
 
 DB_CONNECTION=mysql
 DB_HOST=mysql
@@ -57,7 +56,6 @@ DB_DATABASE=webgis_miskin
 DB_USERNAME=webgis
 DB_PASSWORD=password-kuat
 MYSQL_ROOT_PASSWORD=password-root-kuat
-MYSQL_HOST_PORT=3307
 ```
 
 Jika project di-upload dari mesin development dan `.env` lama ikut terbawa, ubah nilainya ke konfigurasi production di atas. Docker Compose otomatis membaca file `.env` di root project.
@@ -172,7 +170,7 @@ Untuk development yang butuh Vite dev server:
 docker compose --profile dev up --build -d
 ```
 
-Vite akan tersedia di port `5173`. Untuk production deploy, jangan gunakan profile `dev`.
+Service Vite hanya diexpose di network Docker. Jika butuh akses langsung dari host saat development lokal, tambahkan override compose lokal untuk publish port Vite. Untuk production deploy, jangan gunakan profile `dev`.
 
 ## Akun Awal
 
@@ -202,7 +200,7 @@ Ganti password akun awal setelah deploy.
 
 - Jangan commit `.env` ke repository.
 - Pastikan `APP_URL` sesuai domain production.
-- Pastikan reverse proxy hosting meneruskan traffic ke `APP_PORT`.
+- Di Coolify, jangan publish host port manual. Set domain ke service `app` dan internal port `8000`.
 - Volume `webgis_mysql_data` menyimpan data MySQL.
 - Folder project dimount ke `/var/www/html`, jadi perubahan file di server langsung terbaca container.
 - Jika hosting punya backup volume, backup volume MySQL dan folder project.
diff --git a/docker-compose.yml b/docker-compose.yml
index 82af69d..fb55419 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,8 +5,8 @@ services:
       dockerfile: Dockerfile
     container_name: webgis_miskin_app
     working_dir: /var/www/html
-    ports:
-      - "${APP_PORT:-8000}:8000"
+    expose:
+      - "8000"
     volumes:
       - ./:/var/www/html
       - webgis_vendor:/var/www/html/vendor
@@ -30,8 +30,8 @@ services:
     working_dir: /var/www/html
     entrypoint: ["sh", "/var/www/html/docker/node/entrypoint.sh"]
     command: ["npm", "run", "dev", "--", "--host=0.0.0.0", "--port=5173"]
-    ports:
-      - "5173:5173"
+    expose:
+      - "5173"
     volumes:
       - ./:/var/www/html
       - webgis_node_modules:/var/www/html/node_modules
@@ -44,8 +44,8 @@ services:
   mysql:
     image: mysql:8.4
     container_name: webgis_miskin_mysql
-    ports:
-      - "${MYSQL_HOST_PORT:-3307}:3306"
+    expose:
+      - "3306"
     environment:
       MYSQL_DATABASE: ${DB_DATABASE:-webgis_miskin}
       MYSQL_USER: ${DB_USERNAME:-webgis}