feat: add dual Tailscale/Headscale serve support + template improvements

- Add serve.json (Tailscale with certs) and serve.headscale.json (Headscale/HTTP-only)
- Pin Vikunja to v0.24
- Improve .env.example with comments
- Harden .gitignore (env, keys, Tailscale state)
- Add SECURITY.md
- Update README with configuration and usage instructions
- Remove all damconsulting references for generic template use

README.md

@@ -1,6 +1,6 @@
 # {{Service}} with Tailscale Integration
 
-![{{Service}} with Tailscale](https://damconsulting.llc/images/logo_yellow.svg "{{Service}}")
+![{{Service}} with Tailscale](https://example.com/logo.svg "{{Service}}")
 
 This project sets up a {{Service}} instance with Tailscale VPN integration using Docker Compose. It creates a secure, private network connection for your {{Service}} instance using Tailscale.
 
@@ -25,7 +25,7 @@ ts-{{service}}/
 
 1. **Clone the Repository**
    ```bash
-   git clone https://gitea.damconsulting.llc/DAM/ts-{{service}}
+   git clone https://gitea.example.com/org/ts-{{service}}
    cd ts-{{service}}
    ```
 2. Create Required Directories
@@ -105,4 +105,55 @@ ts-{{service}}/
     - Tailscale documentation: https://tailscale.com/kb/
     - {{Service}} [documentation]({{service_docs}})
     - {{Service}} [repository]({{service_repo}})
-    - {{Service}} [linuxserve.io]({{service_lcsr}})
+    - {{Service}} [linuxserve.io]({{service_lcsr}})
+## Tailscale Serve Configuration
+
+This repo includes two serve configuration files:
+
+- `tailscale/config/serve.json` — Default (recommended for Tailscale with MagicDNS + certs)
+- `tailscale/config/serve.headscale.json` — For Headscale or Tailscale without certs (HTTP only)
+
+### How to use
+
+**Tailscale (default):**
+- No changes needed. The default `serve.json` will be used.
+
+**Headscale:**
+1. Copy `serve.headscale.json` over `serve.json`:
+   ```bash
+   cp tailscale/config/serve.headscale.json tailscale/config/serve.json
+   ```
+2. Update the hostname in `serve.json` to match your service.
+
+After changing the serve config, restart the sidecar:
+```bash
+docker compose restart <service>-ts
+```
+
+## Configuration
+
+### Environment Variables
+
+Copy `.env.example` to `.env` and fill in your values:
+
+```bash
+cp .env.example .env
+```
+
+### Tailscale Serve Configuration
+
+This repo ships with two serve configuration options:
+
+| File | Use Case | Description |
+|------|----------|-------------|
+| `tailscale/config/serve.json` | Tailscale (default) | Supports both HTTP and HTTPS when MagicDNS + certs are configured |
+| `tailscale/config/serve.headscale.json` | Headscale / no certs | HTTP-only on port 80 |
+
+**To switch to Headscale mode:**
+
+```bash
+cp tailscale/config/serve.headscale.json tailscale/config/serve.json
+docker compose restart vikunja-ts
+```
+
+Update the hostname in `serve.headscale.json` to match your service.