diff --git a/.env.example b/.env.example
index 92d8482..a8596bc 100644
--- a/.env.example
+++ b/.env.example
@@ -7,3 +7,15 @@ HOP_GITEA_WEBHOOK_SECRET=hopweb-local-webhook-secret-change-me
 # POST /api/v1/repositories/link.
 GITEA_API_TOKEN=
 
+# Optional deployment overrides. The defaults preserve localhost development.
+GITEA_DOMAIN=localhost
+GITEA_ROOT_URL=http://localhost:3000/
+GITEA_SSH_DOMAIN=localhost
+GITEA_HTTP_BIND=0.0.0.0
+GITEA_HTTP_PORT=3000
+GITEA_SSH_BIND=0.0.0.0
+GITEA_SSH_PORT=2222
+HOP_HTTP_BIND=0.0.0.0
+HOP_HTTP_PORT=8080
+GITEA_DISABLE_SSH=false
+GITEA_DISABLE_REGISTRATION=false
diff --git a/compose.yaml b/compose.yaml
index ca72ae2..e6aba17 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -30,16 +30,17 @@ services:
       GITEA__database__NAME: gitea
       GITEA__database__USER: hopweb
       GITEA__database__PASSWD: ${POSTGRES_PASSWORD}
-      GITEA__server__DOMAIN: localhost
-      GITEA__server__ROOT_URL: http://localhost:3000/
-      GITEA__server__SSH_DOMAIN: localhost
-      GITEA__server__SSH_PORT: "2222"
-      GITEA__service__DISABLE_REGISTRATION: "false"
+      GITEA__server__DOMAIN: ${GITEA_DOMAIN:-localhost}
+      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
+      GITEA__server__SSH_DOMAIN: ${GITEA_SSH_DOMAIN:-localhost}
+      GITEA__server__SSH_PORT: ${GITEA_SSH_PORT:-2222}
+      GITEA__server__DISABLE_SSH: ${GITEA_DISABLE_SSH:-false}
+      GITEA__service__DISABLE_REGISTRATION: ${GITEA_DISABLE_REGISTRATION:-false}
       GITEA__security__INSTALL_LOCK: "true"
       GITEA__webhook__ALLOWED_HOST_LIST: control-plane
     ports:
-      - "3000:3000"
-      - "2222:22"
+      - "${GITEA_HTTP_BIND:-0.0.0.0}:${GITEA_HTTP_PORT:-3000}:3000"
+      - "${GITEA_SSH_BIND:-0.0.0.0}:${GITEA_SSH_PORT:-2222}:22"
     volumes:
       - gitea-data:/data
     networks: [hopweb]
@@ -60,7 +61,7 @@ services:
       GITEA_BASE_URL: http://gitea:3000
       GITEA_API_TOKEN: ${GITEA_API_TOKEN:-}
     ports:
-      - "8080:8080"
+      - "${HOP_HTTP_BIND:-0.0.0.0}:${HOP_HTTP_PORT:-8080}:8080"
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:8080/readyz"]
       interval: 5s
diff --git a/docs/production-deployment.md b/docs/production-deployment.md
new file mode 100644
index 0000000..efdb7ad
--- /dev/null
+++ b/docs/production-deployment.md
@@ -0,0 +1,30 @@
+# Production deployment
+
+Run the Compose stack behind an HTTPS reverse proxy. Keep the Gitea HTTP port
+and Hop control-plane port bound to loopback; only publish Gitea's SSH port if
+the deployment has a DNS-only hostname that can reach it without an HTTP
+proxy.
+
+Start from `.env.example`, replace every secret, and set at least:
+
+```dotenv
+GITEA_DOMAIN=git.example.com
+GITEA_ROOT_URL=https://git.example.com/
+GITEA_HTTP_BIND=127.0.0.1
+HOP_HTTP_BIND=127.0.0.1
+GITEA_SSH_BIND=127.0.0.1
+GITEA_DISABLE_SSH=true
+GITEA_DISABLE_REGISTRATION=true
+```
+
+Start the services and install the Hop-native Gitea assets:
+
+```sh
+docker compose --env-file .env up --build -d
+./deploy/gitea/install-hop-native.sh
+```
+
+The reverse proxy should forward the public hostname to the configured
+`GITEA_HTTP_BIND:GITEA_HTTP_PORT`, preserve the `Host` header, and set
+`X-Forwarded-Proto` to `https`. Persistent repository and database data live in
+the named Compose volumes.