security: harden webhooks and session secrets

.env.example

@@ -3,8 +3,8 @@ BOT_TOKEN=your_bot_token_here                                                 #
 ADMIN_IDS=comma_separated_admin_ids                                           # Your telegram ID
 
 # PostgreSQL Database Connection Settings
-POSTGRES_USER=postgres                                                        # Database user name
-POSTGRES_PASSWORD=postgres                                                    # Database password
+POSTGRES_USER=                                                               # Required: database user name
+POSTGRES_PASSWORD=                                                           # Required: database password
 POSTGRES_HOST=remnawave-tg-shop-db                                            # Database container name
 POSTGRES_PORT=5432                                                            # Port
 POSTGRES_DB=postgres                                                          # Database name
@@ -31,6 +31,7 @@ REQUIRED_CHANNEL_LINK=https://t.me/your_channel                               #
 
 # Webhook Base URL (used for Telegram and payment providers)
 WEBHOOK_BASE_URL=https://webhooks.yourdomain.tld
+TRUSTED_PROXIES=127.0.0.1,::1                                                 # Reverse proxies trusted for X-Forwarded-For
 
 # Subscription Mini App (same container, separate port)
 WEBAPP_ENABLED=True                                                           # Run Mini App HTTP server
@@ -39,7 +40,9 @@ WEBAPP_SERVER_PORT=8081                                                       #
 WEBAPP_TITLE="Моя подписка"                                                   # Mini App title
 WEBAPP_PRIMARY_COLOR="#00fe7a"                                                # Main UI color
 WEBAPP_LOGO_URL=                                                              # Optional logo URL; shown in the header and login screen, leave empty to hide
-WEBAPP_SESSION_TTL_SECONDS=2592000                                            # Web App session lifetime
+WEBAPP_SESSION_SECRET=                                                        # Optional: HMAC secret for webapp sessions; generated if empty
+WEBHOOK_SECRET_TOKEN=                                                         # Optional: Telegram webhook secret token; generated if empty
+WEBAPP_SESSION_TTL_SECONDS=86400                                              # Web App session lifetime (24h)
 WEBAPP_AUTH_MAX_AGE_SECONDS=86400                                             # Max Telegram initData age
 WEBAPP_LOGIN_TOKEN_TTL_SECONDS=600                                            # External browser login link lifetime
 
@@ -92,6 +95,7 @@ FREEKASSA_API_KEY=your_api_key                                                #
 FREEKASSA_SECOND_SECRET=your_second_secret                                    # Secret word #2 (used to verify notifications)
 FREEKASSA_PAYMENT_IP=                                                         # Public IP address reported to FreeKassa
 FREEKASSA_PAYMENT_METHOD_ID=44                                                # Payment method ID, you can get it from https://merchant.freekassa.net/settings/currencies
+FREEKASSA_TRUSTED_IPS=168.119.157.136,168.119.60.227,178.154.197.79,51.250.54.238 # FreeKassa webhook source IP allowlist
 
 # CryptoBot Payment Gateway Configuration
 CRYPTOPAY_TOKEN=                                                              # API token for CryptoPay