Make the Airflow UI bind address configurable

.env.example

@@ -8,6 +8,7 @@ PIPELINE_ENV_FILE=./pipeline.env
 AIRFLOW_IMAGE=etl-workbench:local
 
 AIRFLOW_UI_PORT=18080
+AIRFLOW_UI_HOST=127.0.0.1
 MINIO_API_PORT=59000
 MINIO_CONSOLE_PORT=59001
 ETL_LOCAL_BUCKET=etl-local

README.md

@@ -43,6 +43,10 @@ docker compose exec airflow \
   cat /var/lib/airflow/simple_auth_manager_passwords.json.generated
 ```
 
+To expose only the authenticated Airflow UI on a trusted local network, set
+`AIRFLOW_UI_HOST=0.0.0.0` when starting the launcher. Database and object-store
+ports keep their localhost-only defaults.
+
 Useful options:
 
 ```text

compose.yaml

@@ -26,7 +26,7 @@ services:
     environment:
       <<: *airflow-environment
     ports:
-      - "127.0.0.1:${AIRFLOW_UI_PORT:-18080}:8080"
+      - "${AIRFLOW_UI_HOST:-127.0.0.1}:${AIRFLOW_UI_PORT:-18080}:8080"
     volumes:
       - airflow-home:/var/lib/airflow
     depends_on: