diff --git a/.env.example b/.env.example
index f181818..bee1158 100644
--- a/.env.example
+++ b/.env.example
@@ -1,13 +1,12 @@
 # Copy this file to .env for local operations only. Never commit populated values.
 
-# NAS deployment target
-DSM_HOST=
-DSM_SSH_PORT=22
+# NAS deployment target (scripts/deploy-nas.ps1, scripts/deploy-nas.sh)
+NAS_HOST=
+NAS_USER=
+NAS_SSH_PORT=22
+NAS_DEPLOY_PATH=/volume1/docker/d3ro
 DSM_SSH_USER=
 DSM_SSH_PASSWORD=
-NAS_DEPLOY_ROOT=/volume1/docker/d3ro-voice
-NAS_ADMIN_PORT=5000
-NAS_LANDING_PORT=4321
 
 # Git/Forgejo operations
 GIT_SERVER_URL=https://git.example.invalid
@@ -18,9 +17,8 @@ FORGEJO_TOKEN=
 FORGEJO_USERNAME=
 FORGEJO_PASSWORD=
 
-# Public service addresses
-APP_DOMAIN=voice.example.invalid
-ADMIN_DOMAIN=admin.voice.example.invalid
+# Public service addresses. The canonical values live in packages/core/src/web-urls.ts;
+# the NAS compose needs API_SERVER_URL for the admin login backend (https only).
 API_SERVER_URL=https://voice.example.invalid
 SITE_URL=https://voice.example.invalid
 CORS_ALLOWED_ORIGINS=https://voice.example.invalid,https://admin.voice.example.invalid
@@ -93,3 +91,21 @@ D3RO_WORKER_PUSH_DRAIN_BATCH_LIMIT=20
 # Optional authenticated mobile E2E account, stored only in CI secrets or local .env.
 MOBILE_E2E_EMAIL=
 MOBILE_E2E_PASSWORD=
+
+# Web app image build (apps/web/Dockerfile build args; public values baked into the bundle)
+NEXT_PUBLIC_SUPABASE_URL=
+NEXT_PUBLIC_SUPABASE_ANON_KEY=
+NEXT_PUBLIC_PAYPLE_CLIENT_KEY=
+
+# Supabase management (CLI / Management API without an interactive login)
+SUPABASE_PROJECT_REF=
+SUPABASE_ACCESS_TOKEN=
+
+# Payple renewal cron: same value as the Supabase function secret and the Forgejo secret
+CRON_SECRET=
+
+# Cloudflare (tunnel ingress, DNS, Pages and the site bridge worker)
+CLOUDFLARE_API_TOKEN=
+CLOUDFLARE_ACCOUNT_ID=
+CLOUDFLARE_ZONE_ID=
+CLOUDFLARE_TUNNEL_ID=
diff --git a/docs/map/02-infrastructure.md b/docs/map/02-infrastructure.md
index 3c0b828..fa54e48 100644
--- a/docs/map/02-infrastructure.md
+++ b/docs/map/02-infrastructure.md
@@ -226,3 +226,20 @@ See [`11-gap-backlog.md`](./11-gap-backlog.md) for the maintained list (`INFRA-*
 - `apps/mobile-rn` is not an npm workspace member; use `typecheck:mobile`/`lint:mobile`/`test:mobile` or `verify:all`.
 - Admin NAS deploy job disabled in GitLab CI; the `package-admin-docker`→GHCR publish step lived only in the now-deleted `.github/workflows/release.yml` (2026-09-26, dc43884) and was not ported to Forgejo, so admin image publish + NAS compose update is manual (`GAP-INFRA-02`).
 - Two identity systems (.NET JWT/SQLite vs Supabase); a canonical resolver now exists in `@d3ro/core/entitlement` but web/mobile/.NET adoption is incremental (`11` GAP-ID-02).
+
+## 운영 자격 증명 위치 (2026-09-26, 값은 적지 않는다)
+
+재로그인 없이 배포·운영하려고 모은 목록이다. 로컬 값은 루트 `.env`(gitignore), 이름 목록은 `.env.example`이 정본이다.
+
+| 용도 | 루트 `.env` 키 | 다른 곳의 같은 값 |
+|---|---|---|
+| Cloudflare 터널 ingress·DNS·Pages·브리지 워커 | `CLOUDFLARE_API_TOKEN`(토큰 이름 "D3RO Voice — tunnel + DNS"), `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_ZONE_ID`, `CLOUDFLARE_TUNNEL_ID`(kd-nas) | Forgejo 시크릿 `CF_API_TOKEN`·`CF_ACCOUNT_ID` |
+| Supabase CLI·Management API | `SUPABASE_ACCESS_TOKEN`(만료 2027-09-25), `SUPABASE_PROJECT_REF` | — |
+| Payple 정기 갱신 cron | `CRON_SECRET` | Supabase 함수 시크릿 `CRON_SECRET`, Forgejo 시크릿 `CRON_SECRET` |
+| NAS 배포(ssh 별칭 `yunchan-nas`) | `NAS_HOST`, `NAS_USER`, `NAS_SSH_PORT`, `NAS_DEPLOY_PATH` | — |
+| NAS compose 필수 값 | `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, `ADMIN_BOOTSTRAP_TOKEN`, `API_SERVER_URL` 외 | NAS `/volume1/docker/d3ro/.env` |
+| 웹앱 이미지 build arg | `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY` (`NEXT_PUBLIC_PAYPLE_CLIENT_KEY`는 보류, GAP-BILL-02) | — |
+| Forgejo API | `FORGEJO_TOKEN` | Forgejo 시크릿 `FORGEJO_TOKEN` |
+
+- 공개 라우팅: `d3ro.chanpaca.net` → 브리지 워커 → `/app`·`/api`·`/health`는 터널 kd-nas(NAS 3002·5050), 그 밖은 Pages `d3ro`. 터널 ingress `d3ro.chanpaca.net` path `^/app` → `http://192.168.0.39:3002`.
+- Supabase Auth: `site_url=https://d3ro.chanpaca.net/app`, 허용 목록에 `/app/**`.
diff --git a/scripts/deploy-nas.ps1 b/scripts/deploy-nas.ps1
index 0671287..4488328 100644
--- a/scripts/deploy-nas.ps1
+++ b/scripts/deploy-nas.ps1
@@ -199,8 +199,7 @@ $readmeContent = @"
    docker compose up -d
 
 5. 브라우저에서 접속 확인:
-   - 포털 메인: http://<NAS_IP>:$Port/
-   - 관리자 백오피스: http://<NAS_IP>:$Port/admin
+   - 관리자: http://<NAS_IP>:3001 (공개 주소 https://admin.chanpaca.net)
    - API Swagger: http://<NAS_IP>:$Port/swagger
    - 헬스체크: http://<NAS_IP>:$Port/health
    - 웹앱: http://<NAS_IP>:3002/app/login (공개 주소 https://d3ro.chanpaca.net/app 는 사이트 브리지 워커 경유)
diff --git a/scripts/deploy-nas.sh b/scripts/deploy-nas.sh
index fb7fd2c..629e46f 100644
--- a/scripts/deploy-nas.sh
+++ b/scripts/deploy-nas.sh
@@ -140,8 +140,7 @@ cat <<EOF > "$OUT_DIR/README.txt"
    ./nas-control.sh start  (또는 docker compose up -d)
 
 5. 브라우저에서 접속 확인:
-   - 포털 메인: http://<NAS_IP>:$PORT/
-   - 관리자 백오피스: http://<NAS_IP>:$PORT/admin
+   - 관리자: http://<NAS_IP>:3001 (공개 주소 https://admin.chanpaca.net)
    - API Swagger: http://<NAS_IP>:$PORT/swagger
    - 헬스체크: http://<NAS_IP>:$PORT/health
    - 웹앱: http://<NAS_IP>:3002/app/login (공개 주소 https://d3ro.chanpaca.net/app 는 사이트 브리지 워커 경유)