Allow Dokploy and traefic panel UI to bind to 127.0.0.1 (don’t publish :3000)

What problem will this feature address?

When self-hosted, the Dokploy UI always binds to 0.0.0.0:3000 in host mode. This makes the dashboard publicly accessible at http://:3000 even if Traefik + HTTPS are set up. It exposes the login page directly to the internet and can’t be restricted with UFW due to Swarm host networking.

Describe the solution you'd like

Add a configuration option (e.g., BIND_ADDRESS=127.0.0.1) or route the UI only through the built-in Traefik. This would ensure the dashboard is only accessible via a secure domain (with HTTPS and middleware) instead of a raw public IP.

Describe alternatives you've considered

Cloud provider firewalls (Hetzner/DO): works, but adds extra complexity.

Removing the Swarm published port manually: fragile, breaks after updates.

VPN/Tunnel (Tailscale, Cloudflare): works, but not beginner-friendly and adds overhead.

Additional context

Other platforms (Portainer, CapRover, Coolify) allow localhost-only binding or force proxy access for their admin UIs. Supporting this in Dokploy would reduce the attack surface and align with security best practices.

Will you send a PR to implement it?

No

Start by tracing how the self-hosted UI service is configured for Swarm host networking and how its port is published, then inspect the built-in Traefik routing. Done should mean the dashboard is not reachable through the server's raw :3000 address while remaining accessible through the secured HTTPS domain, using either configurable localhost binding or proxy-only access.