diff --git a/.env.sample b/.env.sample
index 52f24d1..52b0ae9 100644
--- a/.env.sample
+++ b/.env.sample
@@ -1,5 +1,6 @@
 # GITEA CORE CONFIGURATION
 GITEA_EXTERNAL_URL=https://git.example.com   # http://<SERVER_IP_OR_DOMAIN>
+GITEA_DOMAIN=git.example.com
 GITEA_ROOT_USER=admin
 GITEA_ROOT_PASSWORD=ChangeMe123              # Initial admin password
 GITEA_ROOT_EMAIL=admin@example.com
@@ -13,7 +14,7 @@ GITEA_DB_USER=gitea
 GITEA_DB_PASSWORD=ChangeDbPass123
 
 # PORTS
-HTTP_PORT=3000   # internal Gitea HTTP (inside container)
+HTTP_PORT=3000   # internal Gitea HTTP (inside container, don't change)
 SSH_PORT=2222    # exposed SSH from host -> container
 
 # SMTP / EMAIL SETTINGS
@@ -25,10 +26,13 @@ SMTP_PASS=
 SMTP_FROM=git@example.com
 SMTP_SKIP_VERIFY=true
 
-# OPTIONAL: LETSENCRYPT / REVERSE PROXY (if you mimic GitLab style)
-LETSENCRYPT_ENABLE=false
+# ── SSL / HTTPS MODE ──────────────────────────────────
+# Options:  none | letsencrypt | custom
+SSL_MODE=none
+
+# Required when SSL_MODE=letsencrypt
 LETSENCRYPT_EMAIL=admin@example.com
 
-# OPTIONAL: Custom SSL Configuration
-SSL_CERT_PATH=/etc/letsencrypt/live/git.example.com/fullchain.pem
-SSL_KEY_PATH=/etc/letsencrypt/live/git.example.com/privkey.pem
+# Required when SSL_MODE=custom (host paths to your cert & key)
+SSL_CERT_PATH=/etc/ssl/certs/git.example.com/fullchain.pem
+SSL_KEY_PATH=/etc/ssl/certs/git.example.com/privkey.pem