diff --git a/.env.example b/.env.example
index cc1281b..b5cd0cd 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,7 @@
 # stalwart
 STALWART_PUBLIC_URL=https://post.example.org
 OIDC_KEY=GENERATE_STRING # openssl rand -hex 32
-OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve
+OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve # ONE LINE, IN QUOTES, SEPARATED BY \n
 
 # bulwark
 JMAP_SERVER_URL=https://post.example.org
diff --git a/README.md b/README.md
index e8ec043..3f289a2 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ specifics for everything
     <summary>further setup</summary>
 
 - settings -> security -> allowed ips
-  - added `172.18.0.0/24`; reason: `internal`
+  - added `172.18.0.0/16`; reason: `docker internal`
 - settings -> network -> http -> security
   - permissive cors policy: `true`   **[restart needed]**
 - settings -> authentication -> oidc provider
@@ -88,6 +88,12 @@ specifics for everything
     - signature algorithm: `ECDSA using P-384 and SHA-384`
     - signature key: `secret read from environment variable`
     - variable name: `OIDC_SIGNATURE_KEY`
+- management -> directory -> oauth clients
+  - create oauth client
+    - client id: `gitea`
+    - description: `Gitea`
+    - client secret: `<generate_secret>`
+    - redirect uris: `https://git.atom.town/user/oauth2/Stalwart/callback`
 </details>
 
 <details>
@@ -124,7 +130,7 @@ specifics for everything
   - gitea base url: `https://git.atom.town/`
   - enable update checker: `true`
 - email settings
-  - smtp host: `mail.atom.town`
+  - smtp host: `post.atom.town`
   - smtp port: `465`
   - send email as: `"Gitea" <system@atom.town>`
   - smtp username: `system@atom.town`
@@ -139,6 +145,19 @@ specifics for everything
   - password hash algorithm: `argon2`
 </details>
 
+<details>
+    <summary>further setup</summary>
+
+- admin settings -> identity & access -> authentication sources
+  - add authentication source
+    - authentication type: `OAuth2`
+    - authentication name: `Stalwart`
+    - oauth2 provider: `OpenID Connect`
+    - client id (key): `gitea`
+    - client secret: `<secret_from_stalwart>`
+    - openid connect auto discovery url: `https://post.atom.town/.well-known/openid-configuration`
+</details>
+
 ## backups
 
 backups are done with [vykar](https://vykar.borgbase.com) to [borgbase](https://borgbase.com)