From 043698a4d3cac9ddcb8fdcdf73bbb9254c0c87b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Tue, 7 Jul 2026 10:22:17 +0200
Subject: [PATCH] docs(env): document IP_GEO_ALLOW_INSECURE in .env.example

The opt-in shipped in v1.25.6 and is documented in
.env.production.example, but the dev-facing .env.example never mentioned
it. Add the commented entry with the plaintext-egress caveat. The
check-env gate reads scripts/env-manifest.json, not the example files,
so this is documentation only.
---
 .env.example | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.env.example b/.env.example
index 78698a34f..2f39edac0 100644
--- a/.env.example
+++ b/.env.example
@@ -220,3 +220,10 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # Generate with `openssl rand -hex 32`. Configure the SAME value in Coolify's
 # Notifications → Webhook custom-headers panel. See docs/audit/v1415-auto-deploy.md.
 # DEPLOY_WEBHOOK_SECRET=""
+
+
+# -----------------------------------------------------------------------------
+# IP geolocation (optional)
+# -----------------------------------------------------------------------------
+# Opt-in for a plain-HTTP IP_GEO_LOOKUP_URL provider (e.g. free ip-api.com); off by default — looked-up IPs then travel unencrypted over your server's egress.
+# IP_GEO_ALLOW_INSECURE="true"