diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..df87d2c
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,38 @@
+# ══════════════════════════════════════════════════════════════════
+# AlpineConsent — environment variable template
+#
+# INSTRUCTIONS:
+#   1. Copy this file:   cp .env.example .env
+#   2. Fill in every value marked  <CHANGE_ME>
+#   3. Never commit .env to Git — it is in .gitignore
+#   4. See docs/en/INSTALLATION.md for full setup guidance
+# ══════════════════════════════════════════════════════════════════
+
+
+# ── Database ──────────────────────────────────────────────────────
+# Database Credentials
+DB_USER=alpine_user
+DB_PASSWORD=<CHANGE_ME>          # min 24 random chars; e.g.: openssl rand -base64 24
+DB_NAME=alpine_db
+POSTGRES_VERSION=16-alpine
+
+# ── Redis ─────────────────────────────────────────────────────────
+# Redis Credentials
+REDIS_PASSWORD=<CHANGE_ME>  # min 24 random chars; e.g.: openssl rand -base64 24
+REDIS_VERSION=7-alpine
+
+# ── Gitea ─────────────────────────────────────────────────────────
+# GITEA_ROOT_URL: the full public URL Gitea uses for clone links,
+# webhooks, and Push Mirror.
+# - While running on plain HTTP/IP (MVP):    http://YOUR_SERVER_IP:3000/
+# - After adding a domain + Nginx + HTTPS:   https://git.alpineconsent.eu/
+
+# Domains
+GITEA_VERSION=1.22
+GIT_DOMAIN=git.alpineconsent.site
+
+# Registration token from:
+#   Gitea → Site Administration → Actions → Runners → Registration Token
+# Rotate this token immediately if it was ever committed or shared.
+RUNNER_VERSION=0.6.1
+GITEA_RUNNER_TOKEN=TOKEN_HERE
diff --git a/dotenv.sample b/dotenv.sample
deleted file mode 100644
index b0edc85..0000000
--- a/dotenv.sample
+++ /dev/null
@@ -1,17 +0,0 @@
-# Database Credentials
-DB_USER=alpine_user
-DB_PASSWORD=PASSWORD
-DB_NAME=alpine_db
-
-# Redis Credentials
-REDIS_PASSWORD=YOUR_REDIS_PASSWORD_HERE
-
-# Domains
-GIT_DOMAIN=git.alpineconsent.site
-GITEA_RUNNER_TOKEN=TOKEN_HERE
-
-# Versions
-GITEA_VERSION=1.22
-RUNNER_VERSION=0.6.1
-POSTGRES_VERSION=16-alpine
-REDIS_VERSION=7-alpine
\ No newline at end of file