diff --git a/configs/nym/.env.example b/configs/nym/.env.example
new file mode 100644
index 0000000..d403cc8
--- /dev/null
+++ b/configs/nym/.env.example
@@ -0,0 +1,25 @@
+# Copy to .env on the host (never commit .env).
+# nym-node env — see https://nym.com/docs/operators/nodes/nym-node/setup
+
+NYMNODE_ID=koopa-nym
+
+# One mode only: mixnode | entry-gateway | exit-gateway
+NYMNODE_MODE=mixnode
+
+# Public IPv4 (and IPv6 if any), comma-separated — required for bonding
+# NYMNODE_PUBLIC_IPS=203.0.113.10
+
+# Physical location (country name or ISO code)
+# NYMNODE_LOCATION=Switzerland
+
+# Optional hostname if reverse-proxy / WSS is configured
+# NYMNODE_HOSTNAME=nym.example.invalid
+
+# dVPN WireGuard path (exit/entry gateway; abuse surface — default off)
+NYMNODE_WG_ENABLED=false
+
+# Must be true for active set (operator T&Cs)
+NYMNODE_ACCEPT_OPERATOR_TERMS=true
+
+# Extra flags appended to nym-node run (space-separated)
+# NYMNODE_EXTRA_ARGS=--write-changes