diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..91022cb
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,25 @@
+# Copy to .env and fill in. Values below are development-friendly defaults.
+
+# Required. Generate one, e.g. `python -c "import secrets; print(secrets.token_urlsafe(50))"`.
+DJANGO_SECRET_KEY=change-me
+
+# Development toggles.
+DJANGO_DEBUG=True
+
+# Hosts Django will serve. `.localhost` matches localhost and any *.localhost
+# subdomain, which the tenant middleware needs for per-club subdomains.
+DJANGO_ALLOWED_HOSTS=.localhost,127.0.0.1,[::1]
+
+# Multi-tenancy: subdomains of this base domain resolve to a club by slug,
+# e.g. http://ajax-united.localhost:8000/ -> club with slug "ajax-united".
+# In production set this to your real base domain (e.g. clubmanager.app).
+CLUBMANAGER_BASE_DOMAIN=localhost
+
+# Optional. Defaults to sqlite:///db.sqlite3 for dev; point at Postgres in prod.
+# DJANGO_DATABASE_URL=postgres://user:pass@localhost:5432/clubmanager
+
+# Optional. CSRF trusted origins (needed for subdomains in prod), comma-separated.
+# DJANGO_CSRF_TRUSTED_ORIGINS=https://*.clubmanager.app
+
+# Optional.
+# DJANGO_TIME_ZONE=Europe/Brussels