diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..c7568ff8
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,65 @@
+# Connection to the LIVE/COPY emulator MySQL/MariaDB database.
+# The schema is owned by the Arcturus emulator — this app reads/writes data,
+# it does NOT own or migrate the emulator tables. Format:
+DATABASE_URL=mysql://user:password@127.0.0.1:3306/atomcms
+
+# Optional pool tuning (defaults shown)
+DATABASE_POOL_SIZE=40
+DATABASE_IDLE_TIMEOUT_MS=300000
+DATABASE_CONNECT_TIMEOUT_MS=10000
+
+# Used by SSO ticket generation ({HOTEL_NAME}-{uuid})
+HOTEL_NAME=Atom
+APP_URL=http://localhost:3000
+
+# NextAuth (>=32 chars) + Laravel APP_KEY (base64:...) for existing 2FA secrets
+AUTH_SECRET=
+APP_KEY=
+CONVERT_PASSWORDS=false
+
+# Password hashing for NEW/upgraded passwords: "bcrypt" (default; 60-char $2y$,
+# fits a varchar(64) users.password) or "argon2id" (~97 chars, needs a wider
+# column). Existing accounts in either format still verify on login.
+PASSWORD_HASH=bcrypt
+
+# Filesystem directory the badge uploader (/admin/badges) writes <code>.gif into
+# — the emulator's badge image folder (e.g. .../assets/c_images/album1584).
+# Leave unset to disable badge uploads.
+BADGE_UPLOAD_DIR=
+
+# Emulator JAR backup job (jobs-worker, runs host-side). When both are set, the
+# worker copies the JAR daily into the backup dir, keeping the newest N.
+EMULATOR_JAR_PATH=
+EMULATOR_BACKUP_DIR=
+EMULATOR_BACKUP_KEEP=7
+
+# RCON link to the Arcturus emulator
+RCON_HOST=127.0.0.1
+RCON_PORT=3001
+
+# Optional OAuth (enabled when both id+secret are set)
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Optional SMTP (password reset / alert emails)
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=
+
+# Optional alerting (jobs worker / alert service)
+DISCORD_WEBHOOK_URL=
+ALERT_EMAIL=
+
+# Optional AI content moderation (user comments / guestbook).
+# When set, posts are checked against the OpenAI Moderations endpoint in
+# addition to the website_wordfilter blocklist. Fail-open if unset/erroring.
+OPENAI_API_KEY=
+
+# Optional PayPal top-up (sandbox by default)
+PAYPAL_CLIENT_ID=
+PAYPAL_SECRET=
+PAYPAL_API=https://api-m.sandbox.paypal.com