diff --git a/.env b/.env
new file mode 100644
index 0000000..675fa8b
--- /dev/null
+++ b/.env
@@ -0,0 +1,24 @@
+# ============================================================
+# Woodpecker CI — environment variables
+# Copy to .env and fill in all values before starting
+# ============================================================
+
+# --- Gitea OAuth2 app ---
+# Create at: https://<your-gitea>/user/settings/applications
+# Redirect URI: https://pecker.smulders.online/authorize
+WOODPECKER_GITEA_CLIENT=abed5b4f-39fd-4f19-9b26-7dc512964069
+WOODPECKER_GITEA_SECRET=gto_pjjvpsm7pizktfuqb4rybbephcdgq33nscg2ork7kp2t5bviwaba
+
+# URL of your Gitea instance (no trailing slash)
+WOODPECKER_GITEA_URL=https://git.smulders.online
+
+# Shared secret between server and agent — generate with:
+#   openssl rand -hex 32
+WOODPECKER_AGENT_SECRET=Bn7hP3UnSk9nUpCCLAK0O8Q31FoMWlce5WKRBVCgl9g=
+
+# Public URL of this Woodpecker instance
+WOODPECKER_HOST=https://pecker.smulders.online
+
+# Gitea usernames allowed to use Woodpecker (comma-separated)
+# Leave empty to allow all users on the Gitea instance
+WOODPECKER_ADMIN=stefan