деплой

docs/production_deploy.md

@@ -41,10 +41,21 @@ Back up `.moonwell_signing\dsa_priv.pem` in the project secret store. Never
 commit it, upload it to Object Storage, or send it through chat. Losing this key
 prevents released launchers from accepting future updates.
 
-## Required Environment
+## Local `.env`
 
-The script reads secrets and storage configuration only from environment
-variables:
+For local releases, copy `.env.example` to `.env` and fill in the real values.
+The repository ignores `.env` and every `.env.*` variant except the safe
+`.env.example` template.
+
+```powershell
+Copy-Item .env.example .env
+```
+
+The deploy script loads `.env` automatically. Variables already present in the
+current process or CI environment take precedence over the file. Use
+`-EnvFile C:\secure\moonwell.env` to select a different local file.
+
+The following values are supported:
 
 | Variable | Required | Purpose |
 | --- | --- | --- |
@@ -56,8 +67,8 @@ variables:
 | `AWS_BUCKET` | optional | Defaults to `warcraft-client` |
 | `AWS_USE_PATH_STYLE_ENDPOINT` | optional | Defaults to `true` |
 
-Load secrets from the team secret manager into the current PowerShell process.
-Do not put real values in a tracked `.env` file or in the script.
+Production CI should load these values from the team secret manager instead of
+creating `.env`. Never commit the real file or put its contents into logs.
 
 ## Prepare a Release