diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 2088ddf..4c8a3dc 100755
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -653,7 +653,8 @@ bootstrap_trino() {
   # Endpoint dari sisi HOST — dapat diarahkan ke layanan EXISTING lewat .env:
   # TRINO_URL / OPA_URL / NESSIE_HOST+NESSIE_PORT (lihat config/environment.defaults.sh)
   local trino_url="${TRINO_URL:-https://localhost:${TRINO_HTTPS_PORT:-12443}}"
-  local nessie_url="http://${NESSIE_HOST:-localhost}:${NESSIE_PORT:-12120}"
+  local nessie_url
+  nessie_url="$(sicabe_host_url NESSIE_URL NESSIE_HOST "${NESSIE_PORT:-12120}")"
   local opa_url="${OPA_URL:-http://localhost:${OPA_PORT:-12181}}"
 
   # Tunggu Trino siap
diff --git a/deploy/lib/common.sh b/deploy/lib/common.sh
index a041763..b535d94 100644
--- a/deploy/lib/common.sh
+++ b/deploy/lib/common.sh
@@ -199,6 +199,18 @@ sicabe_keycloak_url() {
   sicabe_local_url http KEYCLOAK_HOST "${KEYCLOAK_PORT:-12080}" KEYCLOAK_URL
 }
 
+# ─── Helper: URL komponen yang REACHABLE dari HOST ──────────────────────────
+# Pakai <url_var> bila menunjuk ALAMAT (mengandung titik: IP/FQDN — komponen EKSTERNAL
+# atau lintas-host); nilai itu sudah memuat port yang benar. Selebihnya (nama service
+# seperti `nessie:19120`, yang TAK resolve dari host / single-host) → <scheme>://host:port
+# TERBIT (port host, mis. NESSIE_PORT). Dipakai gate/bootstrap agar tak salah port saat
+# komponen eksternal memakai NESSIE_INTERNAL_PORT (mis. 19120) sementara port host 12120.
+sicabe_host_url() { # <url_var> <host_var> <port> [scheme=http]
+  local _shu_u="${!1:-}" _shu_h="${!2:-}" _shu_p="${3:-}" _shu_s="${4:-http}"
+  if [[ "${_shu_u}" == *//*.* ]]; then printf '%s' "${_shu_u%/}"; return 0; fi
+  printf '%s://%s:%s' "${_shu_s}" "${_shu_h:-localhost}" "${_shu_p}"
+}
+
 # ─── Helper: HOST endpoint efektif (sadar EXTERNAL & multi-host) ────────────
 # Urutan: (1) <fallback_var> bila NON-localhost (override operator / komponen EXTERNAL);
 #         (2) multi-host (SICABE_HOST_NAME) → <host_var>;
diff --git a/deploy/scripts/test-generate.sh b/deploy/scripts/test-generate.sh
index 461a207..2253ac6 100755
--- a/deploy/scripts/test-generate.sh
+++ b/deploy/scripts/test-generate.sh
@@ -399,6 +399,30 @@ else
   bad "minio eksternal: minio-init masih ditempatkan → ${_qr}"
 fi
 
+# ─── 0r. Nessie host-facing: port benar lewat sicabe_host_url ─────────────────
+# Regresi: verify-phase2/bootstrap membentuk `http://${NESSIE_HOST}:${NESSIE_PORT}` →
+# untuk Nessie EKSTERNAL (NESSIE_URL = http://<ip>:<NESSIE_INTERNAL_PORT>, mis. 19120)
+# port jadi SALAH (12120 = port TERBIT lokal) → gate FAIL walau layanan sehat.
+_nr=1
+grep -q 'sicabe_host_url()' "${DEPLOY_DIR}/lib/common.sh" || _nr=0
+grep -q 'sicabe_host_url NESSIE_URL NESSIE_HOST' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" || _nr=0
+grep -q 'sicabe_host_url NESSIE_URL NESSIE_HOST' "${DEPLOY_DIR}/bootstrap.sh" || _nr=0
+grep -q 'NESSIE_HOST_API="http://${NESSIE_HOST}:${NESSIE_PORT}"' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" && _nr=0
+_nr_beh="$(bash -c '
+  # shellcheck disable=SC1091
+  source "'"${DEPLOY_DIR}"'/lib/common.sh" >/dev/null 2>&1 || exit 9
+  NESSIE_HOST=localhost NESSIE_PORT=12120
+  NESSIE_URL=http://nessie:19120; a="$(sicabe_host_url NESSIE_URL NESSIE_HOST "$NESSIE_PORT")"
+  NESSIE_URL=http://100.93.54.108:19120 NESSIE_HOST=100.93.54.108
+  b="$(sicabe_host_url NESSIE_URL NESSIE_HOST "$NESSIE_PORT")"
+  printf "%s|%s" "$a" "$b"' 2>/dev/null)"
+[[ "${_nr_beh}" == "http://localhost:12120|http://100.93.54.108:19120" ]] || _nr=0
+if [[ "${_nr}" == "1" ]]; then
+  ok "Nessie host-facing: pakai sicabe_host_url (alamat → NESSIE_URL apa adanya; lokal → host:port terbit)"
+else
+  bad "Nessie host-facing: port bisa salah untuk Nessie eksternal (beh='${_nr_beh}')"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
diff --git a/deploy/scripts/verify-phase2-storage.sh b/deploy/scripts/verify-phase2-storage.sh
index 8731b40..816cb8a 100755
--- a/deploy/scripts/verify-phase2-storage.sh
+++ b/deploy/scripts/verify-phase2-storage.sh
@@ -50,7 +50,10 @@ WAREHOUSE="${ICEBERG_WAREHOUSE:-warehouse}"
 NESSIE_URL="${NESSIE_URL:-http://nessie:19120}"
 NESSIE_HOST="${NESSIE_HOST:-localhost}"
 NESSIE_PORT="${NESSIE_PORT:-12120}"
-NESSIE_HOST_API="http://${NESSIE_HOST}:${NESSIE_PORT}"
+# API host-facing. Bila NESSIE_URL menunjuk ALAMAT (IP/FQDN — Nessie EKSTERNAL/lintas-host),
+# pakai apa adanya (sudah memuat port benar: generator memakai NESSIE_INTERNAL_PORT, mis.
+# 19120). Selebihnya (nama service `nessie:19120` / single-host) → host:port terbit (NESSIE_PORT).
+NESSIE_HOST_API="$(sicabe_host_url NESSIE_URL NESSIE_HOST "${NESSIE_PORT:-12120}")"
 NESSIE_DB="${NESSIE_DB:-nessie}"
 
 # Mode --deep: ikut menguji KONSUMEN (Trino) — komponennya harus sudah ada (fase 3+).