[kmcginnes]

Summary

The docs never said which ways of hosting Graph Explorer are supported, and some pages suggested serving plain HTTP on every network interface.

User-facing: The security reference now has a "Supported Hosting" section, and the other pages agree with it.

Supported
  HTTPS: Graph Explorer's own certificate, or a reverse proxy that terminates TLS
  Access control you provide: authentication, or network rules
  Plain HTTP: behind a TLS-terminating reverse proxy, or on your own machine
Not supported
  Plain HTTP that other machines can reach

• docs/references/security.md: new "Supported Hosting" section. "Disabling HTTPS" becomes "Serving HTTP Behind a Reverse Proxy", and the old #disabling-https anchor still works. Access Control adds a caveat to confirm your network rules apply to the port you publish.
• docs/references/configuration.md, docs/guides/troubleshooting.md, docs/development.md, docs/getting-started/README.md: aligned with the model. Plain HTTP examples publish on 127.0.0.1 only, and the old #http-only anchor still works.
• docs/guides/deploy-with-docker.md: no more dead -p 80:80 mapping.
• REVIEW.md: reviewers flag hosting examples outside the model.
• docs/adr/20261022-document-supported-hosting-model.md: records the decision.

Upgrade note for the 3.4 changelog: Plain HTTP that other machines can reach isn't supported. Graph Explorer behaves as before, but the security reference now states the supported hosting setups: HTTPS, from Graph Explorer's own certificate or a reverse proxy that terminates TLS, plus access control you provide. Plain HTTP is supported only behind a reverse proxy that terminates TLS, or to try Graph Explorer on your own machine. If your deployment serves HTTP to other machines, turn HTTPS back on, or put a reverse proxy that terminates TLS in front of it and let only that proxy reach Graph Explorer.

Merge Danger

Door: two-way

Impact: docs only

Related

• Closes Document the supported hosting model #2459
• Related to Clarify that deployment guides are examples #2460
• Related to Phase 2: Publish the docs site from main #2425

[kmcginnes]

Approved