diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..0f631da
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,73 @@
+POSTGRES_HOST="paradedb-rw.paradedb.svc.cluster.local"
+POSTGRES_PORT="5432"
+POSTGRES_USER="sientia"
+POSTGRES_PASSWORD="password"
+POSTGRES_DBNAME="sientia"
+POSTGRES_MIN_CONNECTIONS="10"
+POSTGRES_MAX_CONNECTIONS="30"
+
+MLFLOW_HOST="http://sientia-tracker-mlflow-tracking.sientia-tracker.svc.cluster.local"
+MLFLOW_PORT="80"
+MLFLOW_USERNAME="aignosi"
+MLFLOW_PASSWORD="mlflow_password"
+
+OPC_ID="1"
+OPC_URL="opc.tcp://sientia-opc-simulator-opc.sientia.svc.cluster.local:4840"
+
+LOG_LEVEL="DEBUG"
+HTTP_METRICS_PORT="9090"
+HTTP_SDK_METRICS_PORT="9091"
+PROJECT_NAME="sientia-laborious"
+
+TEMPORAL_HOST="temporal-frontend.temporal.svc.cluster.local:7233"
+TEMPORAL_NAMESPACE="laborious"
+
+MONGODB_USERNAME="mongo_user"
+MONGODB_PASSWORD="mongo_db_password"
+MONGODB_URL="my-release-mongodb.mongodb.svc.cluster.local:27017"
+MONGODB_DATABASE="sientia"
+MONGODB_TTL_INDEX_HOURS="1"
+
+MINIO_ENDPOINT_URL="http://localhost:9000"
+MINIO_ACCESS_KEY="sientia"
+MINIO_SECRET_KEY="sientia"
+MINIO_REGION_NAME="sa-east-1"
+MINIO_DEFAULT_BUCKET="sientia"
+
+# Suffix for every Temporal task queue name; required, non-empty.
+# The import worker listens on "import_model-${RUNTIME}-queue".
+RUNTIME="local"
+
+# --- Model import (.sientia bundles) -----------------------------------------
+# The import worker is registered only when IMPORT_MODEL_ENABLED is truthy
+# (1/true/yes/on). Do not turn it on before the V12 migration is applied to
+# public.experiment_run in the BFF database.
+IMPORT_MODEL_ENABLED="false"
+
+# base64 of the 32-byte AES-256-GCM key that wraps bundle passwords.
+# Generate a throwaway one with: openssl rand -base64 32
+IMPORT_PASSWORD_KEY="replace-with-base64-of-32-random-bytes"
+
+# Where the frontend uploads the bundle. The object key must sit under the prefix.
+IMPORT_BUNDLE_BUCKET="sientia"
+IMPORT_BUNDLE_PREFIX="imported_models/"
+
+# MongoDB collection holding the model listing the import writes its document into.
+IMPORT_MODELS_COLLECTION="models"
+
+# The import log lives in the Spring Boot BFF database on the POSTGRES_* server
+# above: same host, port, user and password, another database name. Only that
+# name is configuration here; the schema (public) and the table (experiment_run)
+# are constants of the code. Set IMPORT_STATUS_DB_{HOST,PORT,USER,PASSWORD} only
+# if the log really is on a different server than POSTGRES_* — they override it.
+IMPORT_STATUS_DB_NAME="sientia-core-mlops-bff"
+
+# --- scripts/import_model_manual_run.py only ---------------------------------
+# Inputs for the manual run that stands in for the frontend. The script writes
+# one object and one row to whatever the variables above name.
+IMPORT_SCRIPT_BUNDLE_PATH="tests/fixtures/bundle/golden_model_v3.sientia"
+IMPORT_SCRIPT_BUNDLE_PASSWORD="the-password-the-bundle-was-written-with"
+IMPORT_SCRIPT_USERNAME="manual.run@example.com"
+# Cell 2's guard: restate POSTGRES_HOST here (or in the cell) after reading what cell 1
+# printed. Left empty on purpose — the script refuses to write until it matches.
+IMPORT_SCRIPT_CONFIRM_TARGET=""
\ No newline at end of file