diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..2fae8c7
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,24 @@
+# Public site
+SITE_ADDRESS=links.example.com
+SITE_HOST=links.example.com
+
+# Database (use letters and digits only in passwords; they go into URLs and SQL)
+POSTGRES_USER=rainhub
+POSTGRES_PASSWORD=change-me-admin
+POSTGRES_DB=rainhub
+TRACKER_PASSWORD=change-me-tracker
+STATS_RO_PASSWORD=change-me-readonly
+TRACKER_SECRET=long-random-string
+
+# Where Postgres listens for read-only access over WireGuard: your WireGuard address on this server
+PG_BIND=10.8.0.1:5432
+# Uptime Kuma UI (WireGuard address or localhost)
+KUMA_BIND=127.0.0.1:3001
+
+# Nightly pg_dump at 03:00, copied here with rsync over SSH (key goes in ./backup-ssh/id_ed25519)
+BACKUP_TARGET=user@backup-host:/srv/backups/rain-hub
+BACKUP_PORT=22
+
+# Optional Uptime Kuma push monitors (create them in the Kuma UI, paste the push URLs)
+KUMA_BACKUP_PUSH_URL=
+KUMA_LINKS_PUSH_URL=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e60244b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+node_modules
+dist
+.env
+backup-ssh/id_ed25519
+geoip/*.mmdb