From f2e2a3850ee969230bb30e385abb2a5ed368be7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Atakan=20Do=C4=9Fan=20=C3=96zban?=
 <1+atakan@noreply.git.atakanozban.com>
Date: Sun, 12 Jul 2026 00:08:48 +0000
Subject: [PATCH] Update README.md

---
 README.md | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 49726f0..75db2ee 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,13 @@ The platform aims organizations and individuals to show their projects which rec
 For evaluation or localized testing environments, execute the following command:
 
 ```bash
-docker run -d -p 3000:3000 --name gsv_gallery atakanozban/gsv_gallery:latest
+docker run -d -p 3000:3000 \
+-e DATABASE_URL="file:./dev.db" \
+-e ADMIN_USERNAME="admin" \
+-e ADMIN_PASSWORD="your_password" \ 
+-e SESSION_SECRET="your_session_secret" \ 
+-e GOOGLE_MAPS_API_KEY="your_api_key" \
+--name gsv_gallery atakanozban/gsv_gallery:latest
 ```
 
 ## Production Deployment (Docker Compose)
@@ -31,8 +37,7 @@ services:
       - GOOGLE_MAPS_API_KEY=YOUR_GOOGLE_MAPS_API_KEY_HERE
       - ADMIN_USERNAME=admin
       - ADMIN_PASSWORD=YOUR_SECURE_PASSWORD_HERE
-      - GOOGLE_CLIENT_ID=YOUR_GOOGLE_CLIENT_ID_HERE
-      - GOOGLE_CLIENT_SECRET=YOUR_GOOGLE_CLIENT_SECRET_HERE
+      - SESSION_SECRET="your_session_secret"
     volumes:
       - ./data:/app/data
     restart: unless-stopped
@@ -44,8 +49,12 @@ The platform utilizes environment variables for backend initialization. Ensure t
 | Variable | Description | Requirement |
 | :--- | :--- | :--- |
 | `DATABASE_URL` | The PostgreSQL connection string utilized by the Prisma ORM layer for transaction logs and metadata persistence. | **Required** |
+| `SESSION_SECRET` | Why you need it: After you log in, the app creates a signed cookie so it knows you're an admin. This secret is the key that signs and verifies that cookie. If someone doesn't know it, they can't forge a valid admin session. | **Required**
 
-Note on Client-Side Integrations: The platform eliminates compile-time API dependencies. The Google Maps JavaScript API payload is resolved and securely injected via dynamic runtime state mechanics (/api/config) post-initialization.
+### Notes 
+1- Client-Side Integrations: The platform eliminates compile-time API dependencies. The Google Maps JavaScript API payload is resolved and securely injected via dynamic runtime state mechanics (/api/config) post-initialization.
+
+2- Session Secret Generation: `node -e console.log(require('crypto').randomBytes(32).toString('hex'))` Must be at least 32 characters. Keep it secret.
 
 # Core Architecture & Features