diff --git a/.env b/.env
new file mode 100644
index 0000000..eb8b839
--- /dev/null
+++ b/.env
@@ -0,0 +1,31 @@
+# ─── Required ───────────────────────────────────────────────────────────────
+# PostgreSQL connection string
+DATABASE_URL=postgres://forgebucket:password@localhost:5432/forgebucket?sslmode=disable
+
+# Session cookie signing key — must be at least 32 characters
+# Generate: openssl rand -hex 32
+SESSION_SECRET=f54c1aac0320e75febc068d6f4c67daae1d7de97cf9e1f1027ccae25f85d3efb
+
+# CSRF protection key — must be exactly 32 characters
+# Generate: openssl rand -hex 16
+CSRF_SECRET=a5458481e4903286e26f4332751a9446
+
+# ─── Server ──────────────────────────────────────────────────────────────────
+PORT=8080
+
+# Absolute path where bare git repositories are stored on disk
+REPO_ROOT=/var/lib/forgebucket/repos
+
+# ─── Federation (ActivityPub) ─────────────────────────────────────────────────
+# Public URL of this instance (no trailing slash)
+INSTANCE_URL=https://forgebucket.asgardlabs.net
+INSTANCE_NAME=ForgeBucket
+
+# ─── OIDC / OAuth2 (optional) ────────────────────────────────────────────────
+# OIDC_ISSUER=https://accounts.google.com
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+
+# ─── Dev only ─────────────────────────────────────────────────────────────────
+# Set to true to disable Secure cookies and enable verbose logging
+DEBUG=false