Index: .env.example
===================================================================
--- .env.example	(revision 2165b6d3d57ceaa8b5d1f70491868482149470cf)
+++ .env.example	(revision 7bc636b391c66ac399c33e54f7173a022c6a3cbd)
@@ -1,66 +1,5 @@
 NODE_ENV=development
 PORT=3000
-
-# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
-# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
-# off the public internet). Use 0.0.0.0 only if you need direct external access
-# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
-HOST=127.0.0.1
-# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
-# one on first start (saved to storage/.session-secret, stays stable across
-# restarts/updates). Or set your own: openssl rand -hex 32
-SESSION_SECRET=
-# Encrypts the stored Patreon secrets for paid posts. Same deal: leave EMPTY to
-# auto-generate on first use (saved to storage/.paid-secret, kept outside the DB
-# so a database dump alone stays useless). Or set your own: openssl rand -base64 32
-PAID_SECRET=
-# Web-push (notificaties) VAPID keys. Leave EMPTY to auto-generate on first use
-# (saved to storage/.vapid). Do NOT rotate: new keys break every subscription.
-VAPID_PUBLIC_KEY=
-VAPID_PRIVATE_KEY=
-VAPID_SUBJECT=
+SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
 DATABASE_PATH=./storage/database.sqlite
 MEDIA_PATH=./storage/media
-
-# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
-# https://yourdomain.com . Used to build correct links in emails (password reset)
-# and OAuth redirects instead of trusting request headers (anti-spoofing).
-# Optional: leave empty and it falls back to the request host (fine for local/dev);
-# set it for production so email/login links point at the right place.
-PUBLIC_BASE_URL=
-
-# Strict HSTS. By default Klonkt sends a plain long max-age (safe on any domain).
-# Set HSTS_STRICT=1 ONLY if Klonkt owns the whole domain incl. all its subdomains:
-# it adds `includeSubDomains; preload`, which forces every subdomain to HTTPS and can
-# get your domain baked into browsers near-permanently. Leave unset if unsure.
-# HSTS_STRICT=1
-
-# ── Administrator ───────────────────────────────────────────────────
-# The admin logs in with username + password. On first start you create your
-# admin account via /auth/register; after that, registration is closed.
-# Forgot your password? -> "Forgot password" (email, see SMTP below) or always:
-# `npm run reset-admin` on the server.
-
-# ── Email (optional) — for "forgot password" reset links ────────────
-# Not set? Then reset only works via `npm run reset-admin` on the server.
-SMTP_HOST=
-SMTP_PORT=587
-SMTP_USER=
-SMTP_PASS=
-SMTP_FROM=
-
-# ── Lite mode (optional) ────────────────────────────────────────────
-# Set to "off" to disable the whole audio feature (no built-in music hosting/
-# player, no ffmpeg needed). Klonkt then runs as a lightweight blog/photo/EPK
-# site, even on an environment without ffmpeg. Hub and Circles keep working.
-# External embeds (YouTube/SoundCloud/Spotify) keep working too.
-# Reversible: set back to "on" (or remove) and restart — no reinstall, tracks kept.
-KLONKT_AUDIO=on
-
-# ── Premium extras ──────────────────────────────────────────────────
-# The core app, all updates and Cirkels are free. A handful of extras
-# (newsletter, statistics, EPK, link-in-bio, embeddable player, show agenda,
-# release planning, download-for-email, paid posts) are unlocked by a one-time
-# Patreon supporter link — that's what funds the project:
-# klonkt.com / patreon.com/c/roboburr. Leave this on.
-KLONKT_PREMIUM_ENABLED=on