diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..4cc9f54
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,3 @@
+DB_PASS=Eavne,e1m
+STRIPE_SECRET_KEY=sk_test_PON_TU_NUEVA_CLAVE_AQUI
+STRIPE_WEBHOOK_SECRET=whsec_PON_TU_NUEVO_SECRET_AQUI
diff --git a/.gitignore b/.gitignore
index 667aaef..63a625a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,11 @@ target/
 !**/src/main/**/target/
 !**/src/test/**/target/
 
+### Credenciales (nunca subir al repo) ###
+.env
+*.env
+application-local.properties
+
 ### STS ###
 .apt_generated
 .classpath
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..4257877
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,15 @@
+# ── Fase 1: compilar ────────────────────────────────────────────
+FROM eclipse-temurin:21-jdk-alpine AS build
+WORKDIR /app
+COPY .mvn/ .mvn/
+COPY mvnw pom.xml ./
+RUN ./mvnw dependency:go-offline -q
+COPY src ./src
+RUN ./mvnw clean package -DskipTests -q
+
+# ── Fase 2: imagen final (solo JRE) ─────────────────────────────
+FROM eclipse-temurin:21-jre-alpine
+WORKDIR /app
+COPY --from=build /app/target/*.jar app.jar
+EXPOSE 8081
+ENTRYPOINT ["java", "-jar", "app.jar"]
diff --git a/pom.xml b/pom.xml
index bc1ebc8..0c8568e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,6 +55,7 @@
 		<dependency>
 			<groupId>com.mysql</groupId>
 			<artifactId>mysql-connector-j</artifactId>
+			<version>8.3.0</version>
 			<scope>runtime</scope>
 		</dependency>
 		<dependency>
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index d856787..710b87a 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -1,10 +1,10 @@
 spring.application.name=taiage
 server.port=8081
 
-# ── Base de datos MySQL ─────────────────────────────────────────
-spring.datasource.url=jdbc:mysql://localhost:3306/taiage?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=Europe/Madrid
-spring.datasource.username=root
-spring.datasource.password=Eavne,e1m
+# ── Base de datos ───────────────────────────────────────────────
+spring.datasource.url=${DB_URL:jdbc:mysql://localhost:3306/taiage?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=Europe/Madrid}
+spring.datasource.username=${DB_USER:root}
+spring.datasource.password=${DB_PASS}
 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
 
 # ── JPA / Hibernate ─────────────────────────────────────────────
@@ -16,8 +16,7 @@ spring.jpa.open-in-view=false
 spring.thymeleaf.cache=false
 
 # ── Stripe ──────────────────────────────────────────────────────
-# Sustituye estos valores por los de tu cuenta en dashboard.stripe.com
-stripe.secret-key=pk_live_51PDO7CH8SX3oYZHa9viPsZl5qxTxGQkyFw1uoiOqJCiPemxAWPbzTt0Rd3FFBx4vSJlkK7vNP7GV5XKxooMI6Bkc00cVk3lUOL
-stripe.webhook-secret=whsec_MkJcSnVYRXrTXzFR45hwuBaGTs59A3iv
-stripe.price-amount=2900
+stripe.secret-key=${STRIPE_SECRET_KEY}
+stripe.webhook-secret=${STRIPE_WEBHOOK_SECRET}
+stripe.price-amount=${STRIPE_PRICE_AMOUNT:2900}
 stripe.currency=eur
diff --git a/src/main/resources/static/css/style.css b/src/main/resources/static/css/style.css
index 80f2351..6fb1e57 100644
--- a/src/main/resources/static/css/style.css
+++ b/src/main/resources/static/css/style.css
@@ -1152,7 +1152,7 @@ a:hover { text-decoration: underline; }
   border-radius: 8px;
   text-decoration: none;
   text-align: center;
-  transition: border-color .13s, background .13s;
+  transition: border-color .13s, background-color .13s;
 }
 .ccaa-card:hover {
   border-color: var(--accent);
@@ -1213,7 +1213,7 @@ a:hover { text-decoration: underline; }
   font-size: 1rem;
   padding: .25rem .4rem;
   border-radius: 4px;
-  transition: color .15s, background .15s;
+  transition: color .15s, background-color .15s;
   flex-shrink: 0;
 }
 .inap-banner-close:hover { color: var(--fg); background: color-mix(in srgb, var(--fg) 10%, transparent); }