diff --git a/.env.example b/.env.example
index 3265bf2..b82ff7d 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,8 @@
 BROKER_DOMAIN=broker.example.com
 GITEA_DOMAIN=git.example.com
 LETSENCRYPT_EMAIL=admin@example.com
+HTTP_PORT=8680
+HTTPS_PORT=8643
 GITEA_SSH_PORT=2222
 
 TAPM_LISTEN_ADDR=:8080
diff --git a/compose.yaml b/compose.yaml
index fa91e73..3ed1b31 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -33,8 +33,8 @@ services:
     networks:
       - edge
     ports:
-      - "80:80"
-      - "443:443"
+      - "${HTTP_PORT:-8680}:80"
+      - "${HTTPS_PORT:-8643}:443"
     volumes:
       - ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
       - ./config/letsencrypt:/etc/letsencrypt:ro
diff --git a/docs/deployment.md b/docs/deployment.md
index f5d8a83..1ea2512 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -1,10 +1,8 @@
 # Single-VM deployment
 
-The production deployment lives at:
-
-```text
-/opt/idssys/TA-Deployment-Access
-```
+The deployment is relocatable. Compose paths and management commands are
+resolved relative to the repository checkout, so it can live anywhere on the
+VM. `/opt/idssys/TA-Deployment-Access` is only one possible example.
 
 It consists of four containers:
 
@@ -13,32 +11,38 @@ It consists of four containers:
 - Nginx, terminating TLS for the broker and Gitea
 - Certbot, run on demand for certificate issuance and renewal
 
-Only Nginx ports 80 and 443 and Gitea SSH port 2222 are published. The broker
-and Gitea HTTP services are reachable only on the private `tapm-edge` Docker
-network.
+Only the configured Nginx HTTP/HTTPS ports and Gitea SSH port are published.
+They default to 8680, 8643, and 2222. Inside Docker, Nginx continues to listen
+on ports 80 and 443. The broker and Gitea HTTP services are reachable only on
+the private `tapm-edge` Docker network.
 
 ## 1. VM and network
 
-Install Docker Engine with Compose v2. Permit inbound TCP 80, 443, and 2222.
-Forward those ports from the datacenter edge to this VM. Create public DNS A/AAAA
-records for both application names before requesting the certificate.
+Install Docker Engine with Compose v2. Permit the selected HTTP, HTTPS, and SSH
+ports and forward public TCP 80, 443, and the selected SSH port from the
+datacenter edge to them. Create public DNS A/AAAA records for both application
+names before requesting the certificate.
 
-Port 80 must remain reachable for HTTP-01 certificate renewal. If IPv6 is
-published, it must reach this same VM.
+Public port 80 must reach the container's port 80 for HTTP-01 certificate
+renewal. For example, if `HTTP_PORT=8080`, the edge must forward public port 80
+to VM port 8080. If IPv6 is published, it must reach this same VM.
 
 ## 2. Install the repository
 
 ```sh
-sudo mkdir -p /opt/idssys
-sudo git clone GITEA-REPOSITORY-URL /opt/idssys/TA-Deployment-Access
-sudo chown -R 1000:1000 /opt/idssys/TA-Deployment-Access
-cd /opt/idssys/TA-Deployment-Access
+sudo mkdir -p /YOUR/INSTALL/PARENT
+sudo git clone GITEA-REPOSITORY-URL /YOUR/INSTALL/PARENT/TA-Deployment-Access
+sudo chown -R 1000:1000 /YOUR/INSTALL/PARENT/TA-Deployment-Access
+cd /YOUR/INSTALL/PARENT/TA-Deployment-Access
 cp .env.example .env
 chmod 600 .env
 ```
 
-Set `BROKER_DOMAIN`, `GITEA_DOMAIN`, and `LETSENCRYPT_EMAIL` first. Replace all
-example domains in the TAPM variables. Generate the cookie secret with:
+Set `BROKER_DOMAIN`, `GITEA_DOMAIN`, and `LETSENCRYPT_EMAIL` first. `HTTP_PORT`
+and `HTTPS_PORT` control the VM-side Docker bindings and default to 8680 and
+8643. The datacenter edge should therefore forward public ports 80 and 443 to
+VM ports 8680 and 8643. Replace all example domains in the TAPM variables.
+Generate the cookie secret with:
 
 ```sh
 openssl rand -base64 48
@@ -121,7 +125,7 @@ the transition.
 Run renewal twice daily from root's crontab:
 
 ```cron
-17 3,15 * * * cd /opt/idssys/TA-Deployment-Access && ./manage.sh renew
+17 3,15 * * * cd /YOUR/INSTALL/PARENT/TA-Deployment-Access && ./manage.sh renew
 ```
 
 Create an application-consistent local snapshot with:
@@ -137,7 +141,7 @@ datacenter loss. Also back up `.env` through a secrets-aware system.
 ## 7. Updates
 
 ```sh
-cd /opt/idssys/TA-Deployment-Access
+cd /YOUR/INSTALL/PARENT/TA-Deployment-Access
 git pull --ff-only
 docker compose --env-file .env -f deploy/gitea/compose.yaml pull
 ./manage.sh start