diff --git a/.env b/.env
new file mode 100644
index 0000000..fca288f
--- /dev/null
+++ b/.env
@@ -0,0 +1,55 @@
+# Navi — deployment .env template.
+# install.sh copies this to .env (repo root) on first run and fills in
+# NAVI_DB_PASSWORD. Edit the placeholders marked TODO, then restart:
+#   systemctl restart navi
+
+# ── LLM: Ollama Cloud ────────────────────────────────────────────────
+# Profiles' config.json already carry cloud-first model priority lists.
+OLLAMA_HOST=https://ollama.com
+# TODO: your Ollama Cloud API key (https://ollama.com/settings/keys)
+OLLAMA_API_KEY=
+OLLAMA_DEFAULT_MODEL=glm-5.3-flash:cloud
+OLLAMA_NUM_CTX=65536
+OLLAMA_THINK=true
+OLLAMA_REQUEST_TIMEOUT=30
+
+# Embeddings for memory vector search. Empty host falls back to OLLAMA_HOST
+# (ollama.com). If the cloud account has no embedding model, leave empty —
+# the server starts with a warning and memory search degrades gracefully.
+EMBEDDING_OLLAMA_HOST=
+EMBEDDING_OLLAMA_API_KEY=
+EMBEDDING_MODEL=nomic-embed-text:latest
+
+# ── Database (dockerized postgres, see deploy/docker-compose.yml) ────
+# install.sh generates NAVI_DB_PASSWORD and keeps this URL in sync.
+DATABASE_URL=postgresql://navi:CHANGEME@127.0.0.1:5432/navi
+NAVI_DB_PASSWORD=CHANGEME
+
+# ── Deployment shape: terminal client only, web UI off ───────────────
+# To re-enable the web panel later: set true and `systemctl restart navi`.
+NAVI_WEBCLIENT_ENABLED=false
+# navi_ui MCP serves the webclient only — off together with it.
+NAVI_UI_MCP_ENABLED=false
+# Trusted single-server module: auth off. The server binds 127.0.0.1 only
+# (NAVI_HOST below); remote terminals connect via SSH tunnel.
+NAVI_AUTH_ENABLED=false
+
+# Server bind (used by navi-server / the systemd unit)
+NAVI_HOST=127.0.0.1
+NAVI_PORT=8099
+
+# ─── Client profile ──────────────────────────────────────────────────
+NAVI_DEFAULT_PROFILE_ID=navi_code
+
+# ─── Misc ────────────────────────────────────────────────────────────
+LOG_LEVEL=INFO
+SESSION_MESSAGES_WINDOW=1000
+WS_REPLAY_BUFFER_SIZE=500
+CONTEXT_COMPRESSION_ENABLED=true
+# ─── Swarm / hive registry (see hive/README.md) ─────────────────────
+# Empty HIVE_URL = standalone machine: no announcements, nothing blocked.
+# To join a swarm: copy .swarm-key from the hive host, uncomment, restart.
+#HIVE_URL=http://192.168.1.168:8087
+ANNOUNCE_INTERVAL_SEC=120
+PEER_ASK_PROFILE=server_admin
+PEER_ASK_TIMEOUT_SEC=120