Restore self-hosting as the primary setup path

docs/setup_own_server.md

@@ -15,7 +15,7 @@
       - [4. Starting Docker Compose in background](#4-run-the-docker-compose-file-in-the-background)
     - [C. Install CouchDB directly](#c-install-couchdb-directly)
   - [2. Run couchdb-init.sh for initialise](#2-run-couchdb-initsh-for-initialise)
-  - [3. Expose CouchDB to the Internet](#3-expose-couchdb-to-the-internet)
+  - [3. Make CouchDB reachable from your devices](#3-make-couchdb-reachable-from-your-devices)
   - [4. Client Setup](#4-client-setup)
     - [1. Generate the setup URI on a desktop device or server](#1-generate-the-setup-uri-on-a-desktop-device-or-server)
     - [2. Setup Self-hosted LiveSync to Obsidian](#2-setup-self-hosted-livesync-to-obsidian)
@@ -143,12 +143,16 @@ If you are using Docker Compose and the above command does not work or displays
 curl -s https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/couchdb/couchdb-init.sh | hostname='http://<YOUR SERVER IP>:5984' username='<INSERT COUCHDB ADMINISTRATOR USERNAME HERE>' password='<INSERT COUCHDB ADMINISTRATOR PASSWORD HERE>' database=obsidiannotes bash
 ```
 
-## 3. Expose CouchDB to the Internet
+<a id="3-expose-couchdb-to-the-internet"></a>
 
-- You can skip this instruction if you using only in intranet and only with desktop devices.
-  - For mobile devices, Obsidian requires a valid SSL certificate. Usually, it needs exposing the internet.
+## 3. Make CouchDB reachable from your devices
 
-For temporary testing, create a Cloudflare Quick Tunnel by following the [Quick Tunnels instructions](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/). It prints a random hostname which changes each time you create a tunnel, and the URL stops working when the `cloudflared` process stops. Quick Tunnels are intended for testing and development, not production. See the [Cloudflare Tunnel guide](https://developers.cloudflare.com/tunnel/get-started/) for durable use.
+- You can skip this step if you use CouchDB only on a trusted local network with desktop devices.
+  - For mobile devices, Obsidian requires HTTPS with a valid certificate. HTTPS does not require making CouchDB publicly accessible.
+
+Choose how your devices reach your CouchDB server. You can use a [reverse proxy you operate](#reverse-proxies), private-network access, or a tunnel service of your choice. The [Docker profiles](../docker/README.md#profile-details) provide examples.
+
+Cloudflare is one optional choice. The following example uses a [Quick Tunnel](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) for temporary testing. It prints a random hostname which changes each time you create a tunnel, and the URL stops working when the `cloudflared` process stops. Quick Tunnels are intended for testing and development, not production. For ongoing use, configure your chosen connection method; the [Cloudflare Tunnel guide](https://developers.cloudflare.com/tunnel/get-started/) applies if you choose that provider.
 
 ```
 cloudflared tunnel --url http://localhost:5984
@@ -178,8 +182,10 @@ Use the URL printed by your tunnel as the server address. Keep the tunnel proces
 
 The `LIVESYNC_USER` and `LIVESYNC_PASS` here are the credentials which Self-hosted LiveSync will store for routine access to this database. They may be the administrator credentials from step 2. If you have separately configured a CouchDB account with the required access to this database, use that account instead. Neither the provisioning wrapper nor the Setup URI generator creates that separate account.
 
+Use the server URL through which your devices reach CouchDB. For the temporary Quick Tunnel example above, use the URL printed by your own running tunnel.
+
 ```bash
-export LIVESYNC_HOST='<YOUR QUICK-TUNNEL URL>'
+export LIVESYNC_HOST='<YOUR COUCHDB SERVER URL>'
 export LIVESYNC_DB=obsidiannotes
 export LIVESYNC_USER='<INSERT COUCHDB USERNAME FOR LIVESYNC>'
 export LIVESYNC_PASS='<INSERT THE COUCHDB PASSWORD>'