Keep the production Vault private and reach its UI through SSH

infra/prod/README.md

@@ -25,6 +25,10 @@ Containers on `exch` join the Docker network `sxchnge` and use
 `http://vault:8200`; the alias belongs to both local nodes. A standby node
 forwards requests to the active one, so the leader may be on any server.
 
+Vault is not published to the internet. Its UI is opened through an SSH tunnel
+from an administrator's machine, for example
+`ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`.
+
 Nodes unseal themselves with the `transit` seal on the platform Vault
 (`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server
 has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git)