diff --git a/.env.example b/.env.example
index a55a270..2f03a7f 100644
--- a/.env.example
+++ b/.env.example
@@ -47,13 +47,18 @@ UPSTREAM_STREAM_IDLE_TIMEOUT=2m
 TRUSTED_PROXIES=
 
 # ===== Docker Compose 可选配置 =====
-# 对外暴露的代理端口（容器内固定 :8080）
+# tokenthief 的宿主机监听 IP 和端口（容器内固定 :8080）
+TOKENTHIEF_LISTEN_IP=0.0.0.0
 LISTEN_PORT=8080
 
 # Compose 内置 ClickHouse 配置
 CLICKHOUSE_USER=tokenthief
 CLICKHOUSE_PASSWORD=
 CLICKHOUSE_DB=tokenthief
+# ClickHouse 的宿主机监听 IP，以及 HTTP 和原生客户端端口
+CLICKHOUSE_LISTEN_IP=0.0.0.0
+CLICKHOUSE_HTTP_PORT=8123
+CLICKHOUSE_NATIVE_PORT=9000
 
 # 容器时区
 TZ=Asia/Shanghai
diff --git a/compose.yml b/compose.yml
index aa3e21b..f88c57a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -10,7 +10,7 @@ services:
       thief_clickhouse:
         condition: service_healthy
     ports:
-      - "${LISTEN_PORT:-8080}:8080"
+      - "${TOKENTHIEF_LISTEN_IP:-0.0.0.0}:${LISTEN_PORT:-8080}:8080"
     environment:
       LISTEN_ADDR: ":8080"
       UPSTREAM_URL: "${UPSTREAM_URL:?set UPSTREAM_URL}"
@@ -42,6 +42,9 @@ services:
     image: clickhouse/clickhouse-server:26.3
     container_name: tokenthief-clickhouse
     restart: unless-stopped
+    ports:
+      - "${CLICKHOUSE_LISTEN_IP:-0.0.0.0}:${CLICKHOUSE_HTTP_PORT:-8123}:8123"
+      - "${CLICKHOUSE_LISTEN_IP:-0.0.0.0}:${CLICKHOUSE_NATIVE_PORT:-9000}:9000"
     environment:
       CLICKHOUSE_USER: "${CLICKHOUSE_USER:-tokenthief}"
       CLICKHOUSE_PASSWORD: "${CLICKHOUSE_PASSWORD:?set a strong CLICKHOUSE_PASSWORD}"