diff --git a/app/.env.prod.example b/app/.env.prod.example
new file mode 100644
index 0000000..ea67f06
--- /dev/null
+++ b/app/.env.prod.example
@@ -0,0 +1,57 @@
+# Teknav production backend env template.
+# Copy to /etc/teknav/backend.env on the Linux host and fill real secrets there.
+# Never commit a filled production env file.
+
+DATABASE_URL="postgresql://teknav:CHANGE_ME_STRONG_DB_PASSWORD@127.0.0.1:5432/teknav?schema=public"
+REDIS_URL="redis://127.0.0.1:6379"
+
+SESSION_SECRET="CHANGE_ME_48_BYTE_RANDOM_SECRET"
+COOKIE_DOMAIN=".teknav.ir"
+CORS_ORIGINS="https://www.teknav.ir,https://teknav.ir"
+OAUTH_CALLBACK_BASE="https://www.teknav.ir"
+NODE_ENV="production"
+PORT=3010
+UPLOAD_DIR="/var/lib/teknav/uploads"
+BACKUP_DIR="/var/backups/teknav"
+LOG_LEVEL="info"
+
+# OAuth providers are optional. Leave blank to hide/disable the provider.
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# Email delivery. If SMTP_HOST is blank, mail jobs log instead of sending.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM="no-reply@teknav.ir"
+# Email to receive daily client error digest (leave empty to disable)
+ADMIN_ALERT_EMAIL=
+
+# SMS OTP / 2FA.
+SMS_PROVIDER="kavenegar"
+SMS_API_KEY=
+SMS_SENDER=
+
+# Web push. Generate once on the server:
+# node -e "const wp=require('web-push');const k=wp.generateVAPIDKeys();console.log(JSON.stringify(k,null,2))"
+VAPID_PUBLIC_KEY=
+VAPID_PRIVATE_KEY=
+VAPID_SUBJECT="mailto:admin@teknav.ir"
+
+# Zarinpal membership payments. Until merchant id is set, subscribe returns payment_unavailable.
+ZARINPAL_MERCHANT_ID=
+ZARINPAL_SANDBOX=0
+MEMBERSHIP_PRICE_IRR=5000000
+MEMBERSHIP_DURATION_DAYS=365
+
+# Local disk is the production default.
+STORAGE_BACKEND="local"
+
+# Future S3-compatible storage. Only set STORAGE_BACKEND=s3 after wiring a real client.
+S3_ENDPOINT=
+S3_BUCKET=
+S3_ACCESS_KEY=
+S3_SECRET_KEY=