diff --git a/deploy/stack/env.example b/deploy/stack/env.example
index c1019ce..369e059 100644
--- a/deploy/stack/env.example
+++ b/deploy/stack/env.example
@@ -9,19 +9,19 @@
 # ── Image dari registry (WAJIB) ──────────────────────────────────────────────
 # Hasil: ./scripts/build-image.sh --all --push --registry <registry>
 # Kosongkan SICABE_REGISTRY bila memakai image lokal (mis. saat uji).
-#SICABE_REGISTRY=registry.example.com/sicabe
+SICABE_REGISTRY=registry.sicabe.com
 SICABE_TAG=latest
 
 # ── Gateway (WAJIB, semua host) ──────────────────────────────────────────────
 # Satu API key untuk docker-proxy + config-agent (diperiksa nginx).
-GATEWAY_API_KEY=
+GATEWAY_API_KEY=test_123
 # Bind ke 127.0.0.1 (default, aman) atau IP internal. JANGAN ke internet.
-GATEWAY_BIND_IP=127.0.0.1
+GATEWAY_BIND_IP=0.0.0.0
 GATEWAY_PORT=22375
 
 # ── Config-agent (WAJIB, semua host) ─────────────────────────────────────────
 # Direktori deploy sicabe-doc di host ini (berisi .env, config/trino/catalog, ...).
-SICABE_DEPLOY_DIR=/path/ke/sicabe-doc/deploy
+SICABE_DEPLOY_DIR=/home/user/sicabe-core/deploy
 # UID/GID host yang menulis file (katalog/OPA) — agar tidak root-owned.
 AGENT_UID=1000
 AGENT_GID=1000
@@ -29,7 +29,7 @@ AGENT_GID=1000
 # (self-signed). Isi direktori yang memuat PEM-nya (dihasilkan
 # ./scripts/export-trino-ca.sh → <panel>/.ca/trino.crt).
 # Di host NON-panel boleh dikosongkan (panel-lah yang butuh CA).
-AGENT_CA_HOST_PATH=/path/ke/sicabe-control-panel/.ca
+AGENT_CA_HOST_PATH=/home/user/sicabe-control-panel/.ca
 AGENT_CA_FILE=/ca/trino.crt
 
 # =============================================================================
@@ -42,14 +42,14 @@ AGENT_CA_FILE=/ca/trino.crt
 PANEL_URL=http://localhost:3000
 PANEL_PORT=3000
 # openssl rand -base64 32
-NEXTAUTH_SECRET=
+NEXTAUTH_SECRET=dVOt6xOYjiYfh/paNQdFsf0QxoQTI87TcHPKy7P9fG4=
 
 # ── Login lokal (hybrid dengan SSO) — OPSIONAL ───────────────────────────────
 # Akun lokal tanpa Keycloak; password = bcrypt hash. Pakai varian _B64 di sini
 # karena Compose meng-interpolasi '$' (bcrypt selalu memuat '$').
 #   node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
 #PANEL_LOCAL_USER=admin
-#PANEL_LOCAL_PASSWORD_HASH_B64=
+#PANEL_LOCAL_PASSWORD_HASH_B64=JDJiJDEwJGZ3WFVUdUdRbnUuYjlhUkkzRkNTcE95SG90aXFBMHhQcDNCajJFdkJDcXRoM1VPWWtZQWhH
 #PANEL_LOCAL_ROLE=data-admin
 # Identitas Trino utk sesi lokal (tanpa JWT) — service account (Basic).
 #TRINO_SERVICE_ACCOUNT=svc_dbt