update env example

.env.example

@@ -1,26 +1,76 @@
-CSRF_ALLOWED_HOST=""
+# =============================================================================
-DJANGO_DEBUG=
+# Django
+# =============================================================================
 SECRET_KEY=""
-POSTGRES_DATABASE=
+# DEBUG defaults to True if unset. Set False in production.
-POSTGRES_USER=
+DJANGO_DEBUG=True
-POSTGRES_PASSWORD=
+# Comma-separated. Include the backend service name for the compose network.
-POSTGRES_HOST=
+ALLOWED_HOSTS="localhost,127.0.0.1,backend"
-POSTGRES_PORT=
-DJANGO_SECURE_SSL_REDIRECT=
-ALLOWED_HOSTS=""
-CSRF_TRUSTED_ORIGINS=""
-CSRF_COOKIE_DOMAIN=""
 
+# --- Only read when DJANGO_DEBUG=False (production) ---
+DJANGO_SECURE_SSL_REDIRECT=
+SECURE_HSTS_SECONDS=
+# Comma-separated absolute origins, e.g. https://portal.sarlink.net
+CSRF_TRUSTED_ORIGINS=""
+
+# =============================================================================
+# Database (PostgreSQL) — matches the `database` service in compose.yml
+# =============================================================================
+POSTGRES_DATABASE=sarlink
+POSTGRES_USER=sarlink
+POSTGRES_PASSWORD=changeme
+POSTGRES_HOST=database
+POSTGRES_PORT=5432
+
+# =============================================================================
+# Redis — currently optional (CACHES is disabled in settings.py)
+# =============================================================================
+REDIS_HOST=redis
+
+# =============================================================================
+# Frontend — used to build links in password-reset emails
+# =============================================================================
+FRONTEND_URL="http://localhost:3000"
+
+# =============================================================================
+# Email / SMTP — password-reset and notification mail
+# =============================================================================
 EMAIL_HOSTNAME=""
 EMAIL_PORT=
 EMAIL_USERNAME=
 EMAIL_PASSWORD=
 
-
+# =============================================================================
-OMADA_PROXY_URL=""
+# SMS gateway — OTP + notifications
-PAYMENT_BASE_URL=""
+# =============================================================================
-PERSON_VERIFY_BASE_URL=""
+SMS_API_URL=""
-FRONTEND_URL=""
-
 SMS_API_KEY=""
-SMS_API_URL=""
+
+# =============================================================================
+# ID / person verification — GET {PERSON_VERIFY_BASE_URL}/api/person/{id_card}
+# =============================================================================
+PERSON_VERIFY_BASE_URL=""
+
+# =============================================================================
+# MIB payments — POST {PAYMENT_BASE_URL}/verify-payment
+# =============================================================================
+PAYMENT_BASE_URL=""
+
+# =============================================================================
+# Omada (TP-Link) proxy — device access control (block/unblock)
+# =============================================================================
+OMADA_PROXY_URL=""
+OMADA_PROXY_API_KEY=""
+OMADA_SITE_ID=""
+OMADA_GROUP_ID=""
+
+# =============================================================================
+# MAC vendor lookup — REQUIRED, no default: the "add device" flow errors if unset
+# =============================================================================
+MACVENDOR_API_URL=""
+
+# =============================================================================
+# Telegram bot — admin alerts (optional; falls back to no-op if unset)
+# =============================================================================
+TG_BOT_TOKEN=""
+TG_CHAT_ID=""