diff --git a/.env.example b/.env.example
index 615b88f..daff397 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,16 @@
+# Copy this file to .env and fill in real values.
+# .env is gitignored — never commit it.
+
+# Password to log into /admin. Change this to something you'd actually use.
 ADMIN_PASSWORD=change-me
+
+# Random string used to sign session cookies. Generate one with:
+#   python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=change-me-to-a-long-random-string
+
+# Keep "true" in production (TLS terminated by a reverse proxy in front, e.g. Pangolin).
+# Only set to "false" for local testing without any TLS in front.
 COOKIE_SECURE=true
+
+# Local port the site is reachable on (http://localhost:<HOST_PORT>).
+HOST_PORT=8080
diff --git a/docker-compose.yml b/docker-compose.yml
index fa9cf89..37fc526 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,13 @@
 services:
   honey-links:
+    # image: used when pulling on the server (docker compose pull && up -d).
+    # build: lets `docker compose build` / `docker compose push` create and
+    #        publish that same image locally, instead of manual docker
+    #        build/tag/push commands.
+    image: gitea.honeyy.duckdns.org/website/honey-links:latest
     build: .
     ports:
-      - "8080:80"
+      - "${HOST_PORT:-8080}:80"
     environment:
       - ADMIN_PASSWORD=${ADMIN_PASSWORD}
       - SECRET_KEY=${SECRET_KEY}