service/static-shim.md

@@ -513,8 +513,36 @@ version.
 The CI hooks are deployed by users, which will typically include the
 above template in their own `.gitlab-ci.yml` file.
 
+### Template variables
+
+Variables used in the [`static-shim-deploy.yml` template][] which
+projects can override:
+
+  * `STATIC_GITLAB_SHIM_SSH_PRIVATE_KEY`: SSH private key for
+    deployment to the static mirror system, required for deploying to
+    `staging` and `production` environments. This variable must be
+    defined in each project's CI/CD variables settings and scoped to
+    either `staging` or `production` environments.
+
+  * `REVIEW_STATIC_GITLAB_SHIM_SSH_PRIVATE_KEY`: SSH private key for
+    deployment to the reviews environment, AKA
+    `reviews.torproject.net`. This variable is available by default to
+    projects in the GitLab [Web group][]. Projects outside of it must
+    define it in their CI/CD variables settings and scoped to the
+    `reviews/*` wildcard environment.
+
+  * `SITE_URL`: (required) Fully-qualified domain name of the
+    production deployment (eg. without leading `https://`).
+
+  * `STAGING_URL`: (optional) Fully-qualified domain name of the
+    staging deployment. When a staging URL is defined, deployments to
+    the `production` environment are **manual**.
+
+  * `SUBDIR`: (optional) Directory containing the build artifacts, by
+    default this is set to `public/`.
+
 [static mirror system]: howto/static-component
-[`static-shim-deploy.yml` template]: https://gitlab.torproject.org/tpo/tpa/ci-templates/-/blob/main/static-shim-deploy.yml
+[Web group][]: https://gitlab.torproject.org/tpo/web
 
 ### Storage