feat: improve template structure and documentation

- Add dual serve config (serve.json + serve.headscale.json)
- Add SECURITY.md with default passwords warning
- Add .env.example with clear REQUIRED / REFERENCE / CUSTOMIZE sections
- Rewrite README with clear Tailscale vs Headscale paths
- Harden .gitignore (env files, keys, Tailscale state)
- Update docker-compose.yml with clear section labels
- Make volume names service-specific ({{service}}-db-data)
- Ensure both db and app services depend on the Tailscale sidecar

docker-compose.yml

@@ -1,3 +1,6 @@
+# ==========================================
+# REQUIRED: Tailscale sidecar (all ts-* services)
+# ==========================================
 services:
   {{service}}-ts:
     image: tailscale/tailscale:latest
@@ -17,6 +20,10 @@ services:
       - net_admin
     restart: unless-stopped
 
+  # ==========================================
+  # REFERENCE: Example database (REMOVE this section if your service
+  # uses SQLite or has no database requirement)
+  # ==========================================
   db:
     image: postgres:15
     environment:
@@ -30,22 +37,29 @@ services:
     network_mode: service:{{service}}-ts
     restart: unless-stopped
 
+  # ==========================================
+  # REQUIRED: Your service container
+  # Customize the image, env vars, and volumes for your specific app
+  # ==========================================
   {{service}}:
     image: {{service}}/{{service}}:latest
     environment:
+      # Database (remove these lines if your service has no database)
       {{SERVICE}}_DATABASE_TYPE: postgres
       {{SERVICE}}_DATABASE_HOST: 127.0.0.1
       {{SERVICE}}_DATABASE_USER: ${POSTGRES_USER}
       {{SERVICE}}_DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
       {{SERVICE}}_DATABASE_DATABASE: ${POSTGRES_DB}
+
+      # Service configuration (customize these for your app)
       {{SERVICE}}_SERVICE_JWTSECRET: ${{{SERVICE}}_SERVICE_JWTSECRET}
       {{SERVICE}}_SERVICE_PUBLICURL: ${{{SERVICE}}_SERVICE_PUBLICURL}
       {{SERVICE}}_SERVICE_FRONTENDURL: ${{{SERVICE}}_SERVICE_FRONTENDURL}
+      # Add or remove more app-specific env vars here as needed
     volumes:
-      - ./files:/app/{{service}}/files
+      - ./{{service}}/files:/app/files
     depends_on:
       - {{service}}-ts
-      - db
     network_mode: service:{{service}}-ts
     restart: unless-stopped