From 24accc36472015eccc8024c98897d550c9c699c0 Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Mon, 6 Jul 2026 01:20:08 +0200
Subject: [PATCH] docs(env): make the JWT_SECRET requirement explicit in
 .env.example

Spell out that JWT_SECRET is required and must be a strong 32+ char value, and
that the empty default is intentional (docker compose fails fast rather than the
server boot-looping). Pairs with the compose-level guard added in 028005d.
---
 .env.example | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index e3db078d..61a3f6a9 100644
--- a/.env.example
+++ b/.env.example
@@ -10,7 +10,15 @@ DOMAIN=example.com
 PORT=3000
 HOST=0.0.0.0
 
-# Authentication — generate with: openssl rand -hex 32
+# ─── Authentication (REQUIRED) ──────────────────────────────
+# Secret that signs login tokens. This MUST be set to a strong random value.
+# Leaving it empty is intentional — `docker compose up` then fails immediately
+# with a clear message instead of the server boot-looping. Generate one with:
+#
+#     openssl rand -hex 32
+#
+# (./install.sh fills this in for you automatically — you only touch this when
+# configuring by hand.) Must be at least 32 characters.
 JWT_SECRET=
 
 # Registration — set to false to close signups after initial setup