diff --git a/.env.sample b/.env.sample
index 0820db7..23dbfd1 100644
--- a/.env.sample
+++ b/.env.sample
@@ -11,8 +11,10 @@ SECRET_BASIC_AUTH_VERSION=v1
 # Username sent along with SECRET_BASIC_AUTH_VERSION above (default: admin)
 # WRITE_BASIC_AUTH_USERNAME=admin
 
-# Enable Live Debugging
-LIVE_DEBUGGING=false
+# Expose Alloy's web UI publicly (behind basic-auth) at alloy.$DOMAIN.
+# COMPOSE_FILE="$COMPOSE_FILE:compose.alloy-webui.yml"
+# Enable Live Debugging in web ui
+# LIVE_DEBUGGING=false
 
 # Enable this to send metrics to a Prometheus server, adapt DOMAIN if
 # server is remote
diff --git a/compose.alloy-webui.yml b/compose.alloy-webui.yml
new file mode 100644
index 0000000..a0693ca
--- /dev/null
+++ b/compose.alloy-webui.yml
@@ -0,0 +1,16 @@
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - ALLOY_HTTP_LISTEN_ADDR=0.0.0.0
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.swarm.network=proxy"
+        - "traefik.http.services.${STACK_NAME}-alloy.loadbalancer.server.port=12345"
+        - "traefik.http.routers.${STACK_NAME}-alloy.rule=Host(`alloy.${DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}-alloy.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}-alloy.tls=true"
+        - "traefik.http.routers.${STACK_NAME}-alloy.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}-alloy.middlewares=basicauth@file"
diff --git a/compose.yml b/compose.yml
index a2b0e42..035b5bc 100644
--- a/compose.yml
+++ b/compose.yml
@@ -15,17 +15,24 @@ services:
       - /var/lib/docker:/var/lib/docker:ro
       - "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}:/run/containerd/containerd.sock"
       - alloy-data:/var/lib/alloy/data
+    # runs through a shell so ALLOY_HTTP_LISTEN_ADDR (set by
+    # compose.alloy-webui.yml) is resolved from the container's own
+    # environment at startup, not by compose at deploy time.
+    # $$ escapes it from compose's own interpolation
+    entrypoint: ["/bin/sh", "-c"]
     command:
-      - "run"
-      - "--storage.path=/var/lib/alloy/data"
-      - "--server.http.listen-addr=0.0.0.0:12345"
-      - "/etc/alloy/config.alloy"
+      - >-
+        exec alloy run
+        --storage.path=/var/lib/alloy/data
+        --server.http.listen-addr=$${ALLOY_HTTP_LISTEN_ADDR:-127.0.0.1}:12345
+        /etc/alloy/config.alloy
     networks:
       - proxy
       - internal
     environment:
       - SCRAPE_BASIC_AUTH_USERNAME=${SCRAPE_BASIC_AUTH_USERNAME:-alloy}
       - WRITE_BASIC_AUTH_USERNAME=${WRITE_BASIC_AUTH_USERNAME:-admin}
+      - LIVE_DEBUGGING=${LIVE_DEBUGGING:-false}
       - NODE_ID={{.Node.ID}}
     secrets:
       - basic_auth
@@ -35,14 +42,6 @@ services:
       labels:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "coop-cloud.${STACK_NAME}.version=1.6.0+v1.8.1"
-        - "traefik.enable=true"
-        - "traefik.swarm.network=proxy"
-        - "traefik.http.services.${STACK_NAME}-alloy.loadbalancer.server.port=12345"
-        - "traefik.http.routers.${STACK_NAME}-alloy.rule=Host(`alloy.${DOMAIN}`)"
-        - "traefik.http.routers.${STACK_NAME}-alloy.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}-alloy.tls=true"
-        - "traefik.http.routers.${STACK_NAME}-alloy.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.http.routers.${STACK_NAME}-alloy.middlewares=basicauth@file"
 configs:
   config_alloy:
     template_driver: golang