From fdbcc5c03331f55795bc9d6fbd54fef5feeffd83 Mon Sep 17 00:00:00 2001
From: Jiang <huarch97@outlook.com>
Date: Thu, 20 Aug 2026 16:19:44 +0800
Subject: [PATCH] docs: clarify production configuration handling

---
 .env.example | 2 +-
 AGENTS.md    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 75f7c1b..212753a 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,6 @@
 # TJWater Server 环境变量配置模板
 # 复制此文件为 .env 并填写实际值
-# CI/CD: 将生产 .env 的完整内容保存为 Gitea 仓库密钥 TJWATER_SERVER_ENV。
+# CI/CD: 生产环境变量由 Dev 主机的受控 backend.env 注入，不要将完整 .env 保存为 Gitea 仓库密钥。
 ENVIRONMENT="production"
 NETWORK_NAME="tjwater"
 # ============================================
diff --git a/AGENTS.md b/AGENTS.md
index 31f61e7..398c4e5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,4 +35,4 @@ Pull requests should describe the behavior change, list verification commands, m
 
 ## Security & Configuration Tips
 
-Do not commit `.env`, database dumps, generated caches, or local project data. Use `.env.example` as the configuration template. Secrets for CI/CD belong in Gitea repository secrets such as `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`, and deploy webhook credentials.
+Do not commit `.env`, database dumps, generated caches, or local project data. Use `.env.example` as the configuration template. CI/CD only uses Gitea repository secrets `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`, and `DEV_DEPLOY_SSH_KEY`; production application settings are injected on the Dev host.