diff --git a/.gitignore b/.gitignore
index 6e552f3..0742ae2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,8 @@ frontend/dist/
 .env
 .env.*
 !.env.example
+# stack.env is intentionally tracked (Portainer requires it in the repo)
+# Keep this repo private — it contains your SECRET_KEY
 
 # User data files
 channels.txt
diff --git a/stack.env b/stack.env
new file mode 100644
index 0000000..3dd1592
--- /dev/null
+++ b/stack.env
@@ -0,0 +1,2 @@
+SECRET_KEY=17ba4978de1623632e95aec61573d5402ef2a3da92a6696f6f400ef94a7676fb
+DOWNLOAD_PATH=/mnt/serverdata/youtube