diff --git a/.env.docker.example b/.env.docker.example
index df35e6c..c5621f7 100644
--- a/.env.docker.example
+++ b/.env.docker.example
@@ -16,8 +16,10 @@ APP_KEY=
 APP_DEBUG=false
 APP_URL=http://localhost
 
-# Port nginx pada host (dev 8000; prod 80). Untuk tukar, hantar --env-file .env.docker
-APP_PORT=80
+# Port nginx pada host. Pada prod ia diikat ke 127.0.0.1:<APP_PORT> (loopback),
+# host nginx reverse-proxy yang dedah domain awam. Guna port UNIK (elak langgar
+# projek lain di server, cth spr2026=8007, taklimat=8008).
+APP_PORT=8009
 
 APP_LOCALE=ms
 APP_FALLBACK_LOCALE=en
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 06f754d..582dc32 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -76,7 +76,7 @@ Wajib tukar:
 |---|---|
 | `APP_KEY` | Biar kosong — entrypoint jana automatik kali pertama |
 | `APP_URL` | cth `https://mat.koipb.gov.my` |
-| `APP_PORT` | `80` (atau di belakang reverse proxy) |
+| `APP_PORT` | Port loopback unik (cth `8009`) — host nginx reverse-proxy ke sini. Elak langgar projek lain (spr2026=8007, taklimat=8008) |
 | `DB_PASSWORD` **dan** `MYSQL_PASSWORD` | password user `koipb` — **mesti sama** |
 | `MYSQL_ROOT_PASSWORD` | password root MySQL container |
 | `SEED_DEMO` | `true` = isi 200 anggota + 21 hadiah contoh; `false` = data kosong (import sendiri) |
@@ -158,17 +158,30 @@ docker compose --env-file .env.docker -f docker-compose.yml -f docker-compose.pr
 
 ---
 
-## Reverse Proxy + HTTPS (pilihan)
+## Reverse Proxy + HTTPS (host nginx)
 
-Jika ada Nginx/Caddy di host atau sijil SSL, set `APP_PORT` kepada port dalaman (cth `8080`) dan proksi ke port itu. Contoh blok Nginx host:
+Server ini sudah ada **host nginx** yang dedah domain awam dan proksi ke port loopback setiap projek (spr2026 → 8007, taklimat → 8008). KOIPB guna **8009** (`APP_PORT=8009`, diikat `127.0.0.1:8009:80`).
+
+Tambah vhost host nginx (cth `/etc/nginx/sites-available/koipb.conf`):
 
 ```nginx
 server {
     server_name mat.koipb.gov.my;
-    location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
+    location / {
+        proxy_pass         http://127.0.0.1:8009;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+    }
 }
 ```
-Kemudian pasang sijil melalui `certbot --nginx`.
+Kemudian:
+```bash
+sudo ln -s /etc/nginx/sites-available/koipb.conf /etc/nginx/sites-enabled/
+sudo nginx -t && sudo systemctl reload nginx
+sudo certbot --nginx -d mat.koipb.gov.my      # HTTPS
+```
 
 ---
 
@@ -176,7 +189,9 @@ Kemudian pasang sijil melalui `certbot --nginx`.
 
 | Masalah | Tindakan |
 |---|---|
-| `app` asyik restart | `docker compose logs app` — biasanya MySQL belum sedia atau `.env` salah |
+| `address already in use` (port) | Port `APP_PORT` dah diguna projek lain. Tukar ke port loopback bebas dalam `.env.docker` (cth `8009`) & `up` semula |
+| MySQL `CPU does not support x86-64-v2` | Guna `mariadb:11.4` (sudah ditetapkan), bukan `mysql:8` |
+| `app` asyik restart | `docker compose logs app` — biasanya DB belum sedia, `.env.docker` salah, atau cache `bootstrap/cache/config.php` basi |
 | `419 Page Expired` / log masuk gagal | `APP_KEY` kosong — `docker compose exec app php artisan key:generate --force` lalu `docker compose restart app` |
 | 502 Bad Gateway | container `app` belum naik / belum siap `composer install`; tunggu log "Aplikasi bersedia" |
 | Tukar `.env` tak berkesan | `docker compose exec app php artisan config:clear` dan restart |
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 7be088f..8ecb83a 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -35,8 +35,10 @@ services:
 
   nginx:
     restart: always
+    # Ikat ke loopback sahaja — host nginx (reverse-proxy) yang dedah domain awam.
+    # Port unik supaya tidak berlanggar dgn projek lain (spr2026=8007, taklimat=8008).
     ports:
-      - "${APP_PORT:-80}:80"
+      - "127.0.0.1:${APP_PORT:-8009}:80"
 
   # ── Node (opsional) ────────────────────────────────────────────────────────
   # UI guna CDN + CSS statik (public/css/koipb.css) — TIADA langkah build Vite.