initial deploy stack

.env.example

@@ -0,0 +1,13 @@
+# Copy to /opt/stacks/myapp/.env ON THE HOST. Never commit the real .env -
+# the deploy rsyncs this repo over the host with --delete and excludes .env
+# precisely so the host copy survives.
+
+# The WireGuard address every service publishes on. A published port with no
+# host_ip binds 0.0.0.0, and ufw cannot close it (Docker's iptables chain runs
+# first). The deploy refuses to start if this is unset.
+WG_IP=127.0.0.1
+
+# puhososik JWT signing key. app.py falls back to a hardcoded default if this
+# is missing, which lets anyone forge a session - so the deploy fails instead.
+# Generate with: openssl rand -hex 32
+SECRET_KEY=024d71dd6f09c48e60603d3b9b299e53dd532b9d6a7b2a93e7e3c8c697d17457