Merge branch 'fix/compose-env-and-claims' into release/v1.39.3

.env.example

@@ -4,6 +4,9 @@
 # Copy this file to .env and fill in the values.
 #   $ cp .env.example .env
 #
+# This is a short starter. Every variable the app reads, with what it does,
+# is documented in .env.production.example.
+#
 # Required variables: DATABASE_URL or POSTGRES_PASSWORD,
 #                     ENCRYPTION_KEY, API_TOKEN_HMAC_KEY
 #
@@ -76,10 +79,9 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # -----------------------------------------------------------------------------
 # Withings OAuth (optional — for automatic scale/BP/activity sync)
 # -----------------------------------------------------------------------------
-# Register an app at https://developer.withings.com/ and paste the credentials
-# here. Per-user OAuth credentials can also be configured in Settings.
-# WITHINGS_CLIENT_ID=""
-# WITHINGS_CLIENT_SECRET=""
+# Register an app at https://developer.withings.com/ and enter its client id
+# and secret in Settings -> Integrations -> Withings. There is no environment
+# variable for them; only the redirect override and webhook secret live here.
 # WITHINGS_REDIRECT_URI="https://healthlog.example.com/api/withings/callback"
 # WITHINGS_WEBHOOK_SECRET=""  # any random string — used to harden the webhook URL
 
@@ -306,6 +308,15 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # DEPLOY_WEBHOOK_SECRET=""
 
 
+# -----------------------------------------------------------------------------
+# Outbound requests HealthLog makes on its own (optional switches)
+# -----------------------------------------------------------------------------
+# Each accepts "1", "true" or "yes". See .env.production.example for detail.
+# PASSWORD_BREACH_CHECK_DISABLED="1"   # no HaveIBeenPwned range query when a password is set
+# UPDATE_CHECK_DISABLED="1"            # no daily GitHub releases request
+# IP_GEO_LOOKUP_DISABLED="1"           # no online IP geolocation for login events
+
+
 # -----------------------------------------------------------------------------
 # IP geolocation (optional)
 # -----------------------------------------------------------------------------