diff --git a/.env.cur b/.env.cur
new file mode 100644
index 0000000..42a1c77
--- /dev/null
+++ b/.env.cur
@@ -0,0 +1,49 @@
+# Copy to .env and adjust. Every value here can also be supplied as a real
+# environment variable (which takes precedence over the .env file).
+
+# --- General ---
+APP_NAME="Armament FitGuide"
+DEBUG=true
+
+# --- Security ---
+# Generate a strong value, e.g. `python -c "import secrets; print(secrets.token_urlsafe(48))"`
+SECRET_KEY="change-me-please-use-a-long-random-string"
+ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=15
+REFRESH_TOKEN_EXPIRE_DAYS=7
+
+# --- Database ---
+# SQLite (zero-setup default):
+DATABASE_URL="sqlite+aiosqlite:///./app.db"
+# Postgres example:
+# DATABASE_URL="postgresql+asyncpg://app:app@localhost:5432/app"
+
+# Create tables on startup (handy for dev/SQLite; use Alembic in production).
+AUTO_CREATE_TABLES=true
+
+# --- Web / cookies ---
+COOKIE_NAME=access_token
+# Set true when serving over HTTPS.
+COOKIE_SECURE=false
+
+# --- LDAP (optional; direct-bind) ---
+# When enabled, the login page and /api/auth/ldap-login accept a directory
+# username + password. On first login a local profile is provisioned using the
+# username and the default role (mark one in the Roles admin UI).
+LDAP_ENABLED=true
+LDAP_HOST=192.168.110.10
+LDAP_PORT=636
+LDAP_USE_SSL=true
+# "{username}" is substituted with the submitted username to form the bind DN.
+LDAP_BIND_DN_TEMPLATE="CN={username},CN=Users,DC=tenarmtan,DC=com"
+# Provisioned users get the email "<username>@<LDAP_EMAIL_DOMAIN>".
+LDAP_EMAIL_DOMAIN=armament.com
+# LDAP attribute read for the provisioned user's display name.
+LDAP_FULL_NAME_ATTR=cn
+
+# --- CORS (JSON list) ---
+CORS_ORIGINS=["*"]
+
+# --- Bootstrap superuser (used by scripts/seed.py) ---
+FIRST_SUPERUSER_EMAIL=admin@armament.com
+FIRST_SUPERUSER_PASSWORD=changethis