WebSocket port Problem

I deployed MatterMost 10.0 on my NAS using Docker-Compose. The local IP address of the NAS is 192.168.3.3 and the public IP address is bound to the domain names <domain.com> and <www.domain.top>.
I can access to MatterMost using http://192.168.3.3:8065/ or http://domain.top:8065/. However, Every time logging into MatterMost like 20 to 30 seconds, I am prompted with the message “Please check connection, Mattermost unreachable. If issue persists, ask administrator to check WebSocket port.”
The NAS is connected to the router, and I have set up port forwarding on the router: 8065tcp → 8065tcp, 8443tcp → 8443tcp, and 8443udp → 8443udp.
Here’s my docker-compose config:

# https://docs.docker.com/compose/environment-variables/

version: "3.9"

services:
  postgres:
    image: postgres:alpine3.20
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    pids_limit: 100
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    volumes:
      - /Volume2/@apps/docker/db/var/lib/postgresql/data:/var/lib/postgresql/data
    environment:
      # timezone inside container
      - TZ=HKT

      # necessary Postgres options/variables
      - POSTGRES_USER=mmuser
      - POSTGRES_PASSWORD=mmuser_password
      - POSTGRES_DB=mattermost

  mattermost:
    depends_on:
      - postgres
    image: mattermost:10.0
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    pids_limit: 200
    read_only: false
    tmpfs:
      - /tmp
    volumes:
      - /Volume2/@apps/docker/mattermost/config:/mattermost/config:rw
      - /Volume2/@apps/docker/mattermost/data:/mattermost/data:rw
      - /Volume2/@apps/docker/mattermost/logs:/mattermost/logs:rw
      - /Volume2/@apps/docker/mattermost/plugins:/mattermost/plugins:rw
      - /Volume2/@apps/docker/mattermost/client/plugins:/mattermost/client/plugins:rw
      - /Volume2/@apps/docker/mattermost/bleve-indexes:/mattermost/bleve-indexes:rw
      # When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine
      # to avoid Token request failed: certificate signed by unknown authority 
      # (link: https://github.com/mattermost/mattermost-server/issues/13059 and https://github.com/mattermost/docker/issues/34)
      # - ${GITLAB_PKI_CHAIN_PATH}:/etc/ssl/certs/pki_chain.pem:ro
    environment:
      # timezone inside container
      - TZ=HKT

      # necessary Mattermost options/variables (see env.example)
      - MM_SQLSETTINGS_DRIVERNAME=postgres
      - MM_SQLSETTINGS_DATASOURCE=postgres://mmuser:mmuser_password@postgres:5432/mattermost?sslmode=disable&connect_timeout=10

      # necessary for bleve
      - MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes

      # additional settings
      - MM_SERVICESETTINGS_SITEURL=http://www.xxxxxxxxxx.top:8065
      
    ports:
      - 8065:8065
      - 8443:8443/udp
      - 8443:8443/tcp

Additional question, if I want to use HTTPS, can I just change the MM_SERVICESETTINGS_SITEURL to http://www.xxxxxxxxxx.top:8065, or should I do anything else?

Start by reviewing the docker-compose service definition, especially the published 8065 and 8443 ports and the MM_SERVICESETTINGS_SITEURL environment setting. Reproduce the login connection failure and verify the WebSocket connection remains available; document the required configuration for the reported HTTPS setup when the connection works reliably.