Default Traefik route exposes Dokploy UI on port 80 via dokploy.docker.localhost Host header

To reproduce

1. Use a Dokploy installation with the built-in Traefik and the generated default dynamic configuration.
2. Make the directly published Dokploy port (port 3000) unavailable from the Internet, for example by removing its published port or filtering it at the network firewall.
3. From a remote machine, send an HTTP request to the public Traefik entrypoint while manually setting the default hostname:

curl -i -H 'Host: dokploy.docker.localhost' http://SERVER_ADDRESS/

4. The Dokploy UI is returned through Traefik, even though port 3000 itself is not externally reachable.

The generated configuration currently creates this router on the public web entrypoint:

rule: Host(`dokploy.docker.localhost`) && PathPrefix(`/`)
service: dokploy-service-app
entryPoints:
  - web

The implementation can be seen in the current source:
https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/setup/traefik-setup.ts#L213-L240

Current vs. expected behavior

Current behavior

The .localhost hostname may suggest that the route is local-only, but the HTTP Host header is entirely client-controlled. Since the router listens on Traefik's public web entrypoint, any remote client that knows or guesses the hostname can reach the Dokploy login surface through port 80.

Removing or filtering the published port 3000 therefore does not fully prevent direct access to the Dokploy UI.

Expected behavior

The default dokploy.docker.localhost route should not expose the administration UI through a public entrypoint by default. Possible approaches include:

• removing this production route once an explicit domain is configured;
• attaching it to a local/private entrypoint only;
• requiring an explicit opt-in;
• protecting it with an IP allowlist or authentication middleware;
• documenting clearly that disabling public access to port 3000 does not disable this Traefik route.

Security impact

This report does not claim an authentication bypass. However, it unexpectedly exposes the administration login surface and any unauthenticated endpoints through public ports 80/443, increasing the attack surface even when operators believe the UI is unavailable because port 3000 is blocked.

This is related to the general exposure concern in #2661, but differs because it remains reachable through Traefik after direct access to port 3000 has been disabled.

Environment

This is based on Dokploy's generated default Traefik configuration and is not tied to a specific hosting provider, server address, or private deployment configuration.

Which area is affected?

Traefik / Dokploy administration UI

Start in packages/server/src/setup/traefik-setup.ts around lines 213-240 and inspect how the default router and entrypoints are generated. Reproduce the behavior with the documented curl request and review related exposure concern #2661. Done means the default administration route is not publicly reachable through Traefik unless explicitly configured, with the chosen behavior covered by appropriate tests or documentation.