diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e773b4b
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,3 @@
+WEBGUI_BIND_ADDR=127.0.0.1
+JOBS_API_BIND_ADDR=127.0.0.1
+JOBS_API_ALLOWED_ORIGINS=http://localhost:5580,http://127.0.0.1:5580
diff --git a/.gitignore b/.gitignore
index 0f8ce84..a027df0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 config/rclone/rclone.conf
 
 # Docker build artifacts / runtime
+.env
 .docker/
 webgui/data/
 
diff --git a/README.md b/README.md
index fd3eccd..f2fbf97 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,25 @@ docker compose up -d
 # 3. 打开 http://localhost:5580
 ```
 
+### 局域网访问
+
+如果要从另一台机器访问，例如 `http://10.0.0.138:5580`，需要同时让
+`rclone` 和 `jobs-api` 两个端口监听这个地址，并把页面 Origin 加进
+jobs-api 白名单：
+
+```bash
+cp .env.example .env
+cat > .env <<'EOF'
+WEBGUI_BIND_ADDR=10.0.0.138
+JOBS_API_BIND_ADDR=10.0.0.138
+JOBS_API_ALLOWED_ORIGINS=http://localhost:5580,http://127.0.0.1:5580,http://10.0.0.138:5580
+EOF
+docker compose up -d
+```
+
+前端页面会从 `10.0.0.138:5580` 调用 `10.0.0.138:5581`，所以只改
+`JOBS_API_ALLOWED_ORIGINS` 不够，`5581` 也必须发布到同一个可访问地址。
+
 ## 架构
 
 Docker 编排包含两个服务：
diff --git a/docker-compose.yml b/docker-compose.yml
index 97fb622..2cb7461 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,9 @@
 # The jobs-api sidecar stores recurring task definitions in SQLite and starts
 # scheduled runs through rclone RC. The browser calls it on port 5581.
 # Default port bindings are loopback-only because the RC API runs without auth.
-# For LAN/public access, put TLS and authentication in a reverse proxy first.
+# For LAN/public access, either put TLS/authentication in a reverse proxy first,
+# or set WEBGUI_BIND_ADDR, JOBS_API_BIND_ADDR, and JOBS_API_ALLOWED_ORIGINS in
+# a local .env file.
 #
 # rclone config lives in ./config/rclone/rclone.conf (bind-mounted).
 # If it doesn't exist yet, create your remotes with:
@@ -51,7 +53,7 @@ services:
       - XDG_CONFIG_HOME=/config
       - RCLONE_CACHE_DIR=/cache
     ports:
-      - "127.0.0.1:5580:8080"
+      - "${WEBGUI_BIND_ADDR:-127.0.0.1}:5580:8080"
     restart: unless-stopped
 
   jobs-api:
@@ -68,10 +70,10 @@ services:
       - JOBS_API_HOST=0.0.0.0
       - JOBS_API_PORT=8081
       - JOBS_SCHEDULER_INTERVAL=15
-      - JOBS_API_ALLOWED_ORIGINS=http://localhost:5580,http://127.0.0.1:5580
+      - JOBS_API_ALLOWED_ORIGINS=${JOBS_API_ALLOWED_ORIGINS:-http://localhost:5580,http://127.0.0.1:5580}
       - RCLONE_RC_URL=http://rclone:8080
     ports:
-      - "127.0.0.1:5581:8081"
+      - "${JOBS_API_BIND_ADDR:-127.0.0.1}:5581:8081"
     restart: unless-stopped
 
 volumes: