Configure CB server to bind on private network (for everything except web admin)

Rather than set up firewall rules, I’d like to limit all CB cluster networking to an internal network. All clients will be connecting from private network.

It seems like one of the things I must do is set this ENV variable for the epmd process: ERL_EPMD_ADDRESS. Do you have any advice on how to do this?

Second, how can I make sure that everything erlang/epmd for couchbase binds to the private network address only? The above covers epmd, but what about node-node and node-client communication?