diff --git a/seedbox/.env.example b/seedbox/.env.example
new file mode 100644
index 0000000..1e4f734
--- /dev/null
+++ b/seedbox/.env.example
@@ -0,0 +1,20 @@
+# Gitea secrets required for seedbox deployment
+#
+# Configure these in: Gitea > Repository > Settings > Secrets and Variables > Actions
+#
+# TS_AUTHKEY        - Tailscale OAuth client secret (recommended) or auth key
+#                     Create at: https://login.tailscale.com/admin/settings/oauth
+#                     Required scopes: devices:write
+#                     Format: tskey-client-xxxxx-yyyyyyyy
+#
+# SEEDBOX_SSH_KEY   - SSH private key for deployment
+#                     Generate with: ssh-keygen -t ed25519 -f seedbox-deploy -N ""
+#                     Add public key to seedbox: ~/.ssh/authorized_keys
+#
+# TRANSMISSION_USER - Transmission WebUI username (default: admin)
+# TRANSMISSION_PASS - Transmission WebUI password
+
+# Example .env file (DO NOT COMMIT WITH REAL VALUES)
+TS_AUTHKEY=tskey-client-xxxxx-yyyyyyyy
+TRANSMISSION_USER=admin
+TRANSMISSION_PASS=changeme