diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ee82ad7
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,28 @@
+# Copy this to .env and fill in your values
+# .env is in .gitignore — never commit it
+
+# --- Required ---
+SITE_URL=https://blog.giersig.eu
+SITE_NAME=Sven Giersig
+AUTHOR_NAME=Sven Giersig
+
+# --- Optional but recommended ---
+SITE_DESCRIPTION=Svens Personal IndieWeb blog
+AUTHOR_BIO=pedestrian sociologist
+AUTHOR_EMAIL=sven@giersig.eu
+AUTHOR_LOCATION=
+
+# --- Social feeds (enables auto-fetching) ---
+GITHUB_USERNAME=svemagie
+MASTODON_INSTANCE=https://mastodon.social
+MASTODON_USER=
+BLUESKY_HANDLE=
+
+# --- ActivityPub (IndieKit) ---
+ACTIVITYPUB_HANDLE=
+
+# --- Optional extras ---
+AUTHOR_AVATAR=/images/avatar.jpg
+AUTHOR_TITLE=
+AUTHOR_PRONOUN=
+SITE_LOCALE=de
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 22115f7..4712720 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,10 +18,23 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build
-        run: npm run build
+      - name: Build CSS
+        run: npm run build:css
 
-      - name: Deploy via SSH
+      - name: Build site
+        run: npm run build
+        env:
+          SITE_URL: ${{ secrets.SITE_URL }}
+          SITE_NAME: ${{ secrets.SITE_NAME }}
+          SITE_DESCRIPTION: ${{ secrets.SITE_DESCRIPTION }}
+          AUTHOR_NAME: ${{ secrets.AUTHOR_NAME }}
+          AUTHOR_BIO: ${{ secrets.AUTHOR_BIO }}
+          AUTHOR_EMAIL: ${{ secrets.AUTHOR_EMAIL }}
+          GITHUB_USERNAME: ${{ secrets.GH_USERNAME }}
+          MASTODON_INSTANCE: ${{ secrets.MASTODON_INSTANCE }}
+          MASTODON_USER: ${{ secrets.MASTODON_USER }}
+
+      - name: Deploy via SCP
         uses: appleboy/scp-action@v0.1.7
         with:
           host: ${{ secrets.SSH_HOST }}
diff --git a/.gitignore b/.gitignore
index 1b6c845..2189f11 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,10 @@ css/style.css
 # Cache
 .cache/
 
+# Environment variables (never commit!)
+.env
+.env.local
+
 # Content (symlinked at runtime)
 content/
 uploads/