diff --git a/secrets/git.secrets.example b/secrets/git.secrets.example
new file mode 100644
index 0000000..07de66d
--- /dev/null
+++ b/secrets/git.secrets.example
@@ -0,0 +1,56 @@
+# git Stack — Secrets Reference
+# Source: git.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# ⚠️  WARNING: This stack runs Gitea itself — the source of all CI/CD pipelines.
+#     If this stack fails to deploy, Woodpecker pipelines cannot trigger.
+#     Migrate this stack carefully. Test thoroughly before removing the .env file.
+#     Recommended: migrate AFTER all other stacks are confirmed working.
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  git_db_password
+# Used for:               Gitea PostgreSQL database password
+# Env var in .env:        GITEA__database__PASSWD
+git_db_password=
+
+# Woodpecker secret name:  git_runner_token
+# Used for:               Gitea Act Runner registration token
+#                         Find in Gitea: Admin → Actions → Runners → Create runner
+# Env var in .env:        GITEA_RUNNER_REGISTRATION_TOKEN
+git_runner_token=
+
+# Woodpecker secret name:  git_mcp_access_token
+# Used for:               Gitea MCP server API access token
+#                         Find in Gitea: User Settings → Applications → Access Tokens
+# Env var in .env:        GITEA_MCP_ACCESS_TOKEN
+git_mcp_access_token=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# GITEA__database__DB_TYPE       Database type (postgres)
+# GITEA__database__HOST          PostgreSQL hostname:port
+# GITEA__database__NAME          Database name (gitea)
+# GITEA__database__USER          Database username (gitea)
+# ENABLE_OPENID_SIGNIN           Boolean flag
+# ENABLE_OPENID_SIGNUP           Registration mode
+# WHITELISTED_URIS               OpenID whitelist
+# BLACKLIST_URLS                 OpenID blacklist
+# REGISTER_EMAIL_CONFIRM         Boolean flag
+# OPENID_CONNECT_SCOPES          OIDC scopes
+# ENABLE_AUTO_REGISTRATION       Boolean flag
+# GITEA_INSTANCE_URL             Gitea internal URL for runner
+# GITEA_RUNNER_NAME              Runner display name
+# GITEA_RUNNER_LABELS            Runner labels
+# GITEA_MCP_HOST                 Gitea public URL for MCP server
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   git)
+#     create_or_update_secret "git_db_password"     "$GIT_DB_PASSWORD"
+#     create_or_update_secret "git_runner_token"    "$GIT_RUNNER_TOKEN"
+#     create_or_update_secret "git_mcp_access_token" "$GIT_MCP_ACCESS_TOKEN"
+#     ;;