diff --git a/ansible/group_vars/cluster/settings.yml.example b/ansible/group_vars/cluster/settings.yml.example
index 2006549e16a2424a0646d6e9a6ff3bb461baa1f9..30b6ab2592ba03ba45651258773c2ef16df5f314 100644
--- a/ansible/group_vars/cluster/settings.yml.example
+++ b/ansible/group_vars/cluster/settings.yml.example
@@ -6,5 +6,12 @@ domain: "example.com"
 admin_email: "admin@example.com"
 # Label of this deployment.
 release_name: "test"
+# Keycloak administrator password. If you do not change this value, it gets
+# generated and stored in ./secrets/keycloak_admin_password. You can also choose
+# your own password and fill it in here instead.
 keycloak_password: "{{ lookup('password', './secrets/keycloak_admin_password') }}"
-acme_staging: "true"
+# If this is "true" TLS certificates will be requested at the Let's Encrypt
+# staging server. If this is "false", you use Let's Encrypt's production server.
+# Note that LE's production server has stricter rate limits, so set this to
+# "true" when you are testing something.
+acme_staging: false