diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..a258247
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,13 @@
+# L2 Server Configuration
+
+# Domain for this ActivityPub server
+ARTDAG_DOMAIN=artdag.rose-ash.com
+
+# Default username (for actor endpoints)
+ARTDAG_USER=giles
+
+# L1 server URL (for fetching run data)
+ARTDAG_L1=https://l1.artdag.rose-ash.com
+
+# JWT secret for token signing (generate with: openssl rand -hex 32)
+JWT_SECRET=your-secret-here-generate-with-openssl-rand-hex-32
diff --git a/docker-compose.yml b/docker-compose.yml
index ee1ba1a..c895e0d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,10 +6,8 @@ services:
     env_file:
       - .env
     environment:
-      - ARTDAG_DOMAIN=artdag.rose-ash.com
-      - ARTDAG_USER=giles
       - ARTDAG_DATA=/data/l2
-      - ARTDAG_L1=http://celery_l1-server:8100
+      # ARTDAG_DOMAIN, ARTDAG_USER, ARTDAG_L1, JWT_SECRET from .env file
     volumes:
       - l2_data:/data/l2
     networks:
diff --git a/docker-stack.yml b/docker-stack.yml
index f8c84df..ead4f0c 100644
--- a/docker-stack.yml
+++ b/docker-stack.yml
@@ -24,9 +24,12 @@ services:
     image: git.rose-ash.com/art-dag/l1-server:latest
     ports:
       - "8100:8100"
+    env_file:
+      - .env
     environment:
       - REDIS_URL=redis://redis:6379/5
       - CACHE_DIR=/data/cache
+      # L2_SERVER and L2_DOMAIN from .env file
     volumes:
       - l1_cache:/data/cache
     depends_on:
@@ -45,6 +48,7 @@ services:
     environment:
       - REDIS_URL=redis://redis:6379/5
       - CACHE_DIR=/data/cache
+      - C_FORCE_ROOT=true
     volumes:
       - l1_cache:/data/cache
     depends_on:
@@ -61,11 +65,11 @@ services:
     image: git.rose-ash.com/art-dag/l2-server:latest
     ports:
       - "8200:8200"
+    env_file:
+      - .env
     environment:
-      - ARTDAG_DOMAIN=artdag.rose-ash.com
-      - ARTDAG_USER=giles
       - ARTDAG_DATA=/data/l2
-      - ARTDAG_L1=http://l1-server:8100
+      # ARTDAG_DOMAIN, ARTDAG_USER, ARTDAG_L1, JWT_SECRET from .env file
     volumes:
       - l2_data:/data/l2
     depends_on: