diff --git a/backend/ecosystem.config.cjs b/backend/ecosystem.config.cjs
new file mode 100644
index 0000000..1560928
--- /dev/null
+++ b/backend/ecosystem.config.cjs
@@ -0,0 +1,55 @@
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Helper function to read variables from .env file synchronously if it exists.
+ * This prevents hardcoding credentials in this config file which gets tracked by git.
+ */
+function readEnv() {
+  const envPath = path.join(__dirname, '.env');
+  if (!fs.existsSync(envPath)) return {};
+  const lines = fs.readFileSync(envPath, 'utf8').split('\n');
+  const env = {};
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const idx = trimmed.indexOf('=');
+    if (idx === -1) continue;
+    const key = trimmed.substring(0, idx).trim();
+    let val = trimmed.substring(idx + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    env[key] = val;
+  }
+  return env;
+}
+
+const localEnv = readEnv();
+
+module.exports = {
+  apps: [{
+    name: 'cshare-api',
+    script: 'node_modules/.bin/tsx',
+    args: 'src/server.ts',
+    cwd: '/srv/CShare/backend',
+    instances: 1,
+    autorestart: true,
+    watch: false,
+    max_memory_restart: '400M',
+    env: {
+      NODE_ENV: process.env.NODE_ENV || localEnv.NODE_ENV || 'production',
+      PORT: process.env.PORT || localEnv.PORT || '4001',
+      DATA_DIR: process.env.DATA_DIR || localEnv.DATA_DIR || '/srv/CShare/data',
+      PUBLIC_APP_URL: process.env.PUBLIC_APP_URL || localEnv.PUBLIC_APP_URL || 'https://file.asabbagh.com',
+      FRONTEND_URL: process.env.FRONTEND_URL || localEnv.FRONTEND_URL || 'https://file.asabbagh.com',
+      JWT_ACCESS_SECRET: process.env.JWT_ACCESS_SECRET || localEnv.JWT_ACCESS_SECRET,
+      JWT_REFRESH_SECRET: process.env.JWT_REFRESH_SECRET || localEnv.JWT_REFRESH_SECRET,
+      ADMIN_API_KEY: process.env.ADMIN_API_KEY || localEnv.ADMIN_API_KEY,
+      GDRIVE_CLIENT_ID: process.env.GDRIVE_CLIENT_ID || localEnv.GDRIVE_CLIENT_ID,
+      GDRIVE_CLIENT_SECRET: process.env.GDRIVE_CLIENT_SECRET || localEnv.GDRIVE_CLIENT_SECRET,
+      GDRIVE_REFRESH_TOKEN: process.env.GDRIVE_REFRESH_TOKEN || localEnv.GDRIVE_REFRESH_TOKEN,
+      GDRIVE_FOLDER_ID: process.env.GDRIVE_FOLDER_ID || localEnv.GDRIVE_FOLDER_ID,
+    },
+  }],
+};