diff --git a/docs/cooler-env.template b/docs/cooler-env.template
new file mode 100644
index 0000000..0b27dd0
--- /dev/null
+++ b/docs/cooler-env.template
@@ -0,0 +1,71 @@
+# ============================================================
+# MEGA Infrastructure — Deployment env template
+# ============================================================
+# Copy this file to `cooler.env` (which is gitignored) and fill in
+# your real values. `cooler.env` is the file you copy-paste into
+# Coolify / Vercel / PocketBase env config when deploying.
+#
+# Generate N8N_INGEST_SECRET with: openssl rand -hex 32
+# Then mirror the same string into the n8n workflow's
+# Send PDF Callback / Send Image Callback x-ingest-secret header.
+#
+# Before going to production, rotate every CHANGE_ME line below.
+# ============================================================
+
+
+# ----------------------------------------------------------
+# NEXT.JS DASHBOARD (Vercel / host env)
+# ----------------------------------------------------------
+
+APP_URL=https://CHANGE_ME.example.com
+
+NEXT_PUBLIC_POCKETBASE_URL=https://CHANGE_ME.example.com
+
+NEXT_PUBLIC_DEFAULT_THEME=light
+
+# 4-digit PIN users enter on the login screen.
+NEXT_PUBLIC_APP_PIN=CHANGE_ME
+
+# PocketBase admin auth (server-side only). Use email + password
+# OR a pre-set admin token — not both.
+POCKETBASE_ADMIN_EMAIL=CHANGE_ME@example.com
+POCKETBASE_ADMIN_PASSWORD=CHANGE_ME
+# POCKETBASE_ADMIN_TOKEN=
+
+# n8n workflow webhook URL. Use the production /webhook/... variant
+# once the workflow is Published; /webhook-test/... works without
+# publishing for local iteration.
+N8N_PO_INGEST_URL=https://CHANGE_ME.example.com/webhook/purchase-order-upload
+
+# Shared secret between Next.js /api/purchase-orders/ingest and the
+# n8n callback. MUST match the value in the n8n workflow's Send
+# Callback x-ingest-secret header (same value, hardcoded — self-hosted
+# Coolify n8n has no $env.* runtime).
+N8N_INGEST_SECRET=CHANGE_ME_generate_with_openssl_rand_hex_32
+
+
+# ----------------------------------------------------------
+# POCKETBASE (PocketBase host env, not the dashboard)
+# ----------------------------------------------------------
+# PB_ADMIN_EMAIL / PB_ADMIN_PASSWORD are used by the dashboard's
+# server-side pbAdmin() client (must match POCKETBASE_ADMIN_* above).
+# PB_URL is the public-facing PocketBase URL (must match
+# NEXT_PUBLIC_POCKETBASE_URL).
+
+PB_URL=https://CHANGE_ME.example.com
+PB_ADMIN_EMAIL=CHANGE_ME@example.com
+PB_ADMIN_PASSWORD=CHANGE_ME
+
+
+# ----------------------------------------------------------
+# POCKETBASE  (Next.js process-batch + n8n cron)
+# ----------------------------------------------------------
+# Used by:
+#  - Next.js /api/purchase-orders/process-batch to fetch the batch's
+#    file from PB when moving it onto the purchase_orders row.
+#  - n8n (hardcoded into the workflow's HTTP nodes — see
+#    docs/n8n/purchase-order-ingest-implementation.md).
+#
+# Generate via PocketBase admin > Settings > Admins > "Generate token".
+# Both sides must match (Next.js env + n8n workflow hardcoded value).
+POCKETBASE_ADMIN_TOKEN=CHANGE_ME_generate_via_PocketBase_admin_ui_Generate_token
\ No newline at end of file