diff --git a/.gitignore b/.gitignore
index 36d0546..807de7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,10 +2,11 @@
 .terraform/
 *.tfstate
 *.tfstate.backup
-*.tfvars
-*.tfvars.json
 .terraform.lock.hcl
 
+# Secrets
+.env
+
 # Ansible
 ansible/inventory.ini
 
diff --git a/terraform/.env.example b/terraform/.env.example
new file mode 100644
index 0000000..901c1bf
--- /dev/null
+++ b/terraform/.env.example
@@ -0,0 +1,4 @@
+# Copy this to `.env` and fill in real values
+TF_VAR_domain_name=domain.tld
+TF_VAR_hcloud_token=abc123
+TF_VAR_cloudflare_api_token=abc123
diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars
new file mode 100644
index 0000000..5c81a5d
--- /dev/null
+++ b/terraform/terraform.tfvars
@@ -0,0 +1,11 @@
+project_name = "dokploy"
+
+hcloud_server_type  = "cx23"
+hcloud_image        = "debian-13"
+hcloud_location     = "nbg1"
+
+record_name          = "dokploy"
+cloudflare_proxied   = true
+
+# Note: Use file() to easily read your local SSH public key
+ssh_public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILidEpbcANpqqK0K5pe4gkqSr0R+1qAo8QWTXtojGQxB"