update

docs/deployment.md

@@ -9,14 +9,18 @@ each webserver's local HAProxy listener.
 
 Create `tapm.scity.us` in PowerDNS and point it at the existing HAProxy
 frontend. Install the certificate using the existing certificate automation.
-Set `TAPM_LISTEN_ADDR` to each node's physical address when the load balancer
-connects directly to port 8080:
+Set the broker to listen on all addresses on both webservers:
 
-- Webserver-Node1: `10.10.1.121:8080`
-- Webserver-Node2: `10.10.1.122:8080`
+```dotenv
+TAPM_LISTEN_ADDR=0.0.0.0:8080
+```
 
-Restrict port 8080 to the load-balancer addresses. If Nginx terminates TLS on
-each webserver instead, keep the broker on `127.0.0.1:8080`.
+The wildcard bind accepts connections through each node's physical address and
+through the Keepalived address `10.10.1.120` on whichever node currently owns
+it. The container health check independently uses `127.0.0.1:8080`. Restrict
+port 8080 to the load-balancer and trusted management addresses. If Nginx
+terminates TLS locally and neither direct nor Keepalived access is required,
+the broker can instead bind to `127.0.0.1:8080`.
 
 An example virtual host is in
 [`deploy/nginx/tapm.scity.us.conf`](../deploy/nginx/tapm.scity.us.conf).
@@ -111,7 +115,7 @@ On both webservers:
 
 ```sh
 docker compose up -d broker
-curl --fail "http://${TAPM_LISTEN_ADDR}/health/ready"
+curl --fail "http://127.0.0.1:8080/health/ready"
 ```
 
 There is no local application state and no session affinity requirement.