In a distributed setup, you can use this <host>:<service>:LISTEN_IP token to control which IPs the services bind to so that you can make sure that services are not overexposed than necessary.
By default, services bind to the IP address corresponding to the <host>:PUBLIC_FQDN token. However, you can override this using the <host>:<service>:LISTEN_IP token.
server-01:ctfcore-database:LISTEN_IP = 1.2.3.4
localhost:mail:LISTEN_IP = 1.2.3.4
myscmserver:LISTEN_IP = 1.2.3.4
localhost:LISTEN_IP = 1.2.3.4