wildcard address (0.0.0.0, [::])

In the Local Address column of ss -ltn, 0.0.0.0 means every IPv4 address the machine has, and [::] the same for IPv6 — usually IPv4 as well, since net.ipv6.bindv6only is 0 on Ubuntu. Neither is an address the machine owns: ip a will never show 0.0.0.0, and no packet is ever sent to it. The wildcard stands in for the whole set, including addresses added later. That is what makes the reflex expensive. HOST=0.0.0.0 on an API only a reverse proxy is meant to reach publishes it on every network the machine touches. The same move on PostgreSQL — listen_addresses = '*' — makes one refusal go away and leaves port 5432 open to scanners, which find it within hours.