diff --git a/deploy/docker-compose.cdn-mm.yml b/deploy/docker-compose.cdn-mm.yml
index 357b529..54585b5 100644
--- a/deploy/docker-compose.cdn-mm.yml
+++ b/deploy/docker-compose.cdn-mm.yml
@@ -8,8 +8,9 @@
 #   mkdir -p /opt/cdn-mm/{data/cdn,data/mm,state,updater}
 #   cp deploy/docker-compose.cdn-mm.yml /opt/cdn-mm/docker-compose.yml
 #   cp deploy/env.cdn-mm.example /opt/cdn-mm/.env   # fill secrets
-#   # targets.json — from MikrotikManager:
-#   #   https://git.shx.one/denozord/MikrotikManager/raw/branch/main/deploy/updater/targets.json.example
+#   # targets.json:
+#   #   cp deploy/updater/targets.json.example /opt/cdn-mm/updater/targets.json
+#   #   (в CDNManager-репо скачайте тот же файл из MikrotikManager)
 #   docker login git.shx.one
 #   cd /opt/cdn-mm && docker compose pull && docker compose up -d
 #
@@ -129,6 +130,10 @@ services:
       PORT: "8000"
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET in .env}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
     volumes:
       - ./data/mm:/app/data
     networks:
diff --git a/deploy/env.cdn-mm.example b/deploy/env.cdn-mm.example
index 19ba98c..2863a56 100644
--- a/deploy/env.cdn-mm.example
+++ b/deploy/env.cdn-mm.example
@@ -29,7 +29,7 @@ CLOUDFLARE_API_TOKEN=
 LOG_LEVEL=info
 NODE_ENV=production
 
-# Portal SSO (prod default AUTH_REQUIRED=true)
+# Portal SSO — used by CDN Manager and MikrotikManager backend
 AUTH_REQUIRED=true
 # Same HS256 secret as auth-portal JWT_SECRET (required)
 AUTH_JWT_SECRET=
@@ -37,10 +37,10 @@ AUTH_JWT_SECRET=
 JWT_SECRET=
 AUTH_ISSUER=https://auth.shnt.top
 AUTH_PORTAL_URL=https://auth.shnt.top
-# Shared with auth-portal AUDIT_INGEST_SECRET (optional)
+# Shared with auth-portal AUDIT_INGEST_SECRET (optional, CDN Manager)
 AUTH_AUDIT_INGEST_SECRET=
 
-# Legacy local admin — only when AUTH_REQUIRED=false
+# Legacy local admin (CDN) — only when AUTH_REQUIRED=false
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD_HASH=