diff --git a/docker/.env-example b/docker/.env-example
index dc6f3a5..5c5c5ba 100644
--- a/docker/.env-example
+++ b/docker/.env-example
@@ -1,3 +1,80 @@
-CONFIG_REPO_URL=https://git.internal.example.com/infra/dnf-mirror-config.git
-CONFIG_REPO_BRANCH=main
-SYNC_CRON=0 */6 * * *
\ No newline at end of file
+# Copy this file to .env. docker-compose.yml loads it via env_file for both
+# containers, and docker compose itself also uses it to resolve ${VAR}
+# references inside docker-compose.yml (e.g. NGINX_PORT, LOCAL_SOURCES_YAML).
+# This file is the single place to configure everything - nothing is
+# hardcoded in docker-compose.yml itself.
+
+# ============================================================================
+# Where the sources.yaml comes from
+# ============================================================================
+
+# Option A (default): local file, bind-mounted into the syncer container.
+# Point LOCAL_SOURCES_YAML at your real file (path is relative to
+# docker-compose.yml, defaults to the bundled sources.example.yaml) and
+# leave SOURCES_GIT_REPO empty. SOURCES_YAML_FILE must then be the absolute
+# in-container path the bind mount uses (leave as-is unless you also change
+# the mount target in docker-compose.yml).
+#LOCAL_SOURCES_YAML=./sources.example.yaml
+SOURCES_GIT_REPO=https://gitea.leanderserver.de/leander19961/dnf-repo-test
+SOURCES_GIT_BRANCH=main
+SOURCES_YAML_FILE=packages.yaml
+
+# Option B: pull the list from git instead. Set SOURCES_GIT_REPO, and
+# SOURCES_YAML_FILE to the path of the YAML file *inside* that git repo
+# (relative), e.g.:
+#   SOURCES_GIT_REPO=https://git.example.com/infra/rpm-sources.git
+#   SOURCES_GIT_BRANCH=main
+#   SOURCES_YAML_FILE=sources.yaml
+# (LOCAL_SOURCES_YAML / the bind mount is then simply unused.)
+
+# ============================================================================
+# Paths inside the syncer container
+# ============================================================================
+# These map to the volumes defined in docker-compose.yml - only change them
+# if you also change the corresponding volume mounts.
+WORK_DIR=/var/cache/rpm-mirror-sync
+REPO_BASE_DIR=/srv/repo
+CLIENT_REPO_DIR=/srv/repo/client-repos
+
+# ============================================================================
+# Client-facing URL
+# ============================================================================
+# Public URL under which the nginx container serves the repo. Used to
+# generate the .repo files under /repo/client-repos/. Point this at
+# wherever the host running nginx is reachable from your AlmaLinux clients
+# (should match NGINX_PORT below).
+CLIENT_BASE_URL=http://repo.leanderserver.de/repo
+
+# ============================================================================
+# repoids of AlmaLinux's own repos inside the syncer container
+# ============================================================================
+# Check with: docker compose exec syncer dnf repolist
+ALMA_REPO_IDS=baseos appstream extras crb
+
+# ============================================================================
+# Sync schedule
+# ============================================================================
+# How often (seconds) the syncer container re-syncs. 3600 = hourly.
+SYNC_INTERVAL_SECONDS=3600
+# Set to "true" to sync once and exit instead of looping (e.g. if you'd
+# rather trigger this container from an external scheduler).
+RUN_ONCE=false
+
+# ============================================================================
+# Mirror signing key
+# ============================================================================
+# Identity used for the ONE GPG key the mirror signs every mirrored package
+# with (regardless of how many upstream sources there are). Generated once
+# on first run - together with a revocation certificate - and reused
+# forever. Both live under GPG_HOME on the sync-cache volume, so don't run
+# "docker compose down -v" unless you're fine with clients having to
+# re-trust a brand new key afterwards.
+GPG_HOME=/var/cache/rpm-mirror-sync/gnupg
+GPG_KEY_NAME=RPM Mirror
+GPG_KEY_EMAIL=rpm-mirror@example.local
+
+# ============================================================================
+# Ports
+# ============================================================================
+# Host port nginx publishes the repo on.
+NGINX_PORT=8081