docs: document enable-template directive and render-config command

Author: chaptersix

tls/tls-full/README.md

@@ -55,3 +55,14 @@ To actually enforce namespace access, you'll have to build the server with a cus
 You can look in [tlsClaimMapper.go](./tlsClaimMapper.go) for an example that will work with the certs in this sample,
 and in [the authorizer sample](../../extensibility/authorizer/) for more instructions on how to build a custom server.
 
+### Custom config template
+
+This sample uses a custom `config_template.yaml` to configure per-namespace TLS host overrides. The file is a Go template rendered by the Temporal server using [sprig](https://masterminds.github.io/sprig/) functions.
+
+To enable template rendering, the file must contain `# enable-template` in the first 1KB. It is loaded via the `TEMPORAL_SERVER_CONFIG_FILE_PATH` environment variable.
+
+To preview the rendered config inside the container:
+
+```bash
+docker compose exec temporal temporal-server --config-file /etc/temporal/config/config_template.yaml render-config
+```

tls/tls-full/config_template.yaml

@@ -1,4 +1,12 @@
 # enable-template
+#
+# This comment enables Go template rendering with sprig functions when loaded
+# via TEMPORAL_SERVER_CONFIG_FILE_PATH. Environment variables are accessed with
+# the sprig env function: {{ default "fallback" (env "VAR_NAME") }}
+#
+# To preview the rendered config, run:
+#   temporal-server --config-file /path/to/this/file render-config
+#
 log:
     stdout: true
     level: {{ default "info" (env "LOG_LEVEL") }}