---
id: CHG-20261014-RG-03
title: Port 9506, loopback-only binding, and the server deployment guide for ttok.thinkera.academy
date: 2026-10-14
author: RG
type: infra
scope: [infra, docs]
status: done
breaking: true
patterns: []
files:
  - docker-compose.yml
  - app/config.py
  - .env.example
  - README.md
  - AGENTS.md
  - DOC/API.md
  - DOC/DEPLOY.md
  - tests/conftest.py
gui_routes: []
api_endpoints: []
parity_exception: "Infrastructure and documentation only; no GUI or API behaviour changed."
api_doc_updated: yes
security_impact: "improves — the port is published on 127.0.0.1 only (Apache is the single public entry), and the session cookie is Secure + SameSite=Lax in production"
tests: []
---

## What
TikTok Manager now listens on port 9506 instead of 5002, on the loopback interface only, on the
laptop and on the server. `DOC/DEPLOY.md` describes the production deployment at
`/var/www/private/thinkera.academy/ttok.thinkera.academy` behind Apache at `https://ttok.thinkera.academy`.

## Why
The owner chose port 9506 for the server and the same port locally (14 Oct 2026), and a public
HTTPS domain is needed because TikTok's app review requires the demo to show the app on the
verified website domain, not on localhost.

## How
The compose file publishes `127.0.0.1:${PORT:-9506}:5000`, following the Publishers rule that a
tool holding account tokens binds to loopback. The redirect URI default, `.env.example`, tests and
docs move to 9506. In production Apache terminates TLS and proxies to the container over plain
HTTP; the session cookie gets `Secure` (production only, so the HTTP test client keeps working)
and `SameSite=Lax`, which still sends it on TikTok's top-level redirect back to `/auth/callback`.

## API impact
Base URL in the docs is now `https://localhost:9506/api/v1` locally and
`https://ttok.thinkera.academy/api/v1` in production; no endpoint changed.

## Security review
- Input validated? not affected
- Auth guard present on every new route? no new route
- State change on GET? no
- Secrets, tokens or personal data touched, logged or returned? no; DEPLOY.md requires fresh SECRET_KEY, API_KEY and TOKEN_ENCRYPTION_KEY on the server
- New dependency? no

## Verification
- `.venv\Scripts\python -m pytest` → 75 passed.
- `docker compose down` + `up -d --build`: `docker ps` shows `127.0.0.1:9506->5000/tcp`; `https://localhost:9506/login` → 200; `https://localhost:5002/login` → no answer; migration `0001_initial -> 0002_account_union_id` ran on start.
- `python RULEFOLDER/tools/build_changelog.py` → rebuilt from 6 fragments; `python RULEFOLDER/tools/check_rules.py` → All rule checks passed.