updated build/instructions

.env.example

@@ -1,37 +1,33 @@
-# --- App Hosting ---
-# A comma-separated list of hostnames that the Vite dev server will accept.
-# Required if you are accessing the frontend via a custom domain.
-# Example: VITE_ALLOWED_HOSTS=holy.narl.io,localhost
-VITE_ALLOWED_HOSTS=localhost
+# --- Application Security ---
+# Set to a long, random string in production
+SECRET_KEY=django-insecure-replace-this-in-production
 
-# A comma-separated list of domains that can access the backend API.
-# Example: CORS_ALLOWED_ORIGINS=http://localhost:5173,https://holy.narl.io
-CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
-
-# A comma-separated list of hostnames that the Django backend will serve.
-# Example: ALLOWED_HOSTS=localhost,backend,api.holy.narl.io
-ALLOWED_HOSTS=localhost,127.0.0.1,backend
-
-# Set to "false" in production
+# Set to "false" in production for security and performance
 DEBUG=true
 
+# Custom URL for the Django Admin interface (e.g., secret-admin/)
+ADMIN_URL=admin/
 
-# A comma-separated list of domains that Django will trust for CSRF purposes.
-# This should match your frontend domain.
-# Example: CSRF_TRUSTED_ORIGINS=https://holy.narl.io,http://localhost:5173
+# --- Hosting & Networking ---
+# The primary domain where your app is hosted (e.g., holy.narl.io)
+# Comma-separated list for backend to allow requests
+ALLOWED_HOSTS=localhost,127.0.0.1,backend
+
+# CSRF protection: Comma-separated list of trusted origins (must start with http:// or https://)
 CSRF_TRUSTED_ORIGINS=http://localhost:5173
 
-# --- SMTP Configuration ---
-# Rename this file to .env and fill in your details to enable email sending.
+# CORS protection: Comma-separated list of allowed origins (must match your frontend domain)
+CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
 
-# --- Required for SMTP ---
-EMAIL_HOST=smtp.example.com
+# --- SMTP Configuration (Required for Email Verification) ---
+# For development, if EMAIL_HOST is empty, emails are printed to the console.
+EMAIL_HOST=smtp.gmail.com
 EMAIL_PORT=587
-EMAIL_HOST_USER=your-email@example.com
-# Do not wrap the password in quotes or backticks
-EMAIL_HOST_PASSWORD=your-app-password
+EMAIL_USE_TLS=true
+EMAIL_HOST_USER=your-email@gmail.com
+EMAIL_HOST_PASSWORD=your-app-specific-password
 
-# --- Optional (defaults are usually fine) ---
-# EMAIL_USE_TLS=true
-# For providers like Gmail using port 465, you might need to set this to true
-# EMAIL_USE_SSL=true
+# --- Frontend Configuration ---
+# The base URL of the backend API (e.g., https://holy.narl.io/api/)
+VITE_API_URL=http://localhost:8000/api/
+VITE_ALLOWED_HOSTS=localhost