diff --git a/.env.example b/.env.example
index 2f029f1..170b635 100644
--- a/.env.example
+++ b/.env.example
@@ -1,9 +1,28 @@
+# Splunk admin password used on FIRST boot (persists in splunk-etc/var volumes)
 SPLUNK_PASSWORD=Str0ngP@ss!9
+
+# HEC token the seeder/curl will use (already accepted by the Splunk container)
 SPLUNK_HEC_TOKEN=dev-0123456789abcdef
-# Optional Azure (enable later)
-# SINK=blob
-# AZURE_STORAGE_CONNECTION_STRING=
-# AZURE_STORAGE_CONTAINER=bank-logs
-# AZURE_SERVICEBUS_CONNECTION_STRING=
-# AZURE_SERVICEBUS_QUEUE=log-chunks
-# AZURE_COMPRESS=true
+
+# Azure (optional; only needed if SINK=blob or blob+sb)
+AZURE_STORAGE_CONNECTION_STRING=
+AZURE_SERVICEBUS_CONNECTION_STRING=
+
+AZURE_OPENAI_ENDPOINT="https://tf-in-dev-clz-core-aif.cognitiveservices.azure.com/"
+AZURE_OPENAI_API_KEY=""
+AZURE_OPENAI_API_VERSION="2025-01-01-preview"
+AZURE_OPENAI_CHAT_DEPLOYMENT="gpt-4o-mini"
+
+# --- Mail (Mailtrap SMTP Sandbox) ---
+MAIL_ENABLED=true
+SMTP_HOST=sandbox.smtp.mailtrap.io
+SMTP_PORT=2525
+SMTP_USER=
+SMTP_PASS=
+MAIL_FROM=alerts@intesa-pipeline.local
+MAIL_TO=you@company.com
+
+# (optional) where your chunks are:
+CHUNK_DIR="./out"
+
+