diff --git a/secrets/entertainment.secrets.example b/secrets/entertainment.secrets.example
new file mode 100644
index 0000000..471ddea
--- /dev/null
+++ b/secrets/entertainment.secrets.example
@@ -0,0 +1,82 @@
+# entertainment Stack — Secrets Reference
+# Source: entertainment.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  entertainment_discord_token
+# Used for:               Soundbored Discord bot token
+# Env var in .env:        DISCORD_TOKEN
+entertainment_discord_token=
+
+# Woodpecker secret name:  entertainment_discord_client_secret
+# Used for:               Soundbored Discord OAuth2 client secret
+# Env var in .env:        DISCORD_CLIENT_SECRET
+entertainment_discord_client_secret=
+
+# Woodpecker secret name:  entertainment_secret_key_base
+# Used for:               Soundbored Phoenix app session signing key
+# Env var in .env:        SECRET_KEY_BASE
+entertainment_secret_key_base=
+
+# Woodpecker secret name:  entertainment_basic_auth_password
+# Used for:               Soundbored basic auth password
+# Env var in .env:        BASIC_AUTH_PASSWORD
+entertainment_basic_auth_password=
+
+# Woodpecker secret name:  entertainment_sparky_db_password
+# Used for:               SparkyFitness superuser PostgreSQL password (PGadmin)
+# Env var in .env:        SPARKY_FITNESS_DB_PASSWORD
+entertainment_sparky_db_password=
+
+# Woodpecker secret name:  entertainment_sparky_app_db_password
+# Used for:               SparkyFitness app-level PostgreSQL password
+# Env var in .env:        SPARKY_FITNESS_APP_DB_PASSWORD
+entertainment_sparky_app_db_password=
+
+# Woodpecker secret name:  entertainment_sparky_encryption_key
+# Used for:               SparkyFitness API encryption key
+# Env var in .env:        SPARKY_FITNESS_API_ENCRYPTION_KEY
+entertainment_sparky_encryption_key=
+
+# Woodpecker secret name:  entertainment_better_auth_secret
+# Used for:               SparkyFitness session signing / 2FA key
+#                         CRITICAL: Never change after users enable 2FA
+# Env var in .env:        BETTER_AUTH_SECRET
+entertainment_better_auth_secret=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# DISCORD_CLIENT_ID              Discord app client ID
+# PHX_HOST, SCHEME               Phoenix hostname config
+# COMPOSE_PROJECT_NAME           Docker Compose project name
+# SPARKY_FITNESS_DB_USER         PostgreSQL superuser name (PGadmin)
+# SPARKY_FITNESS_DB_HOST         PostgreSQL hostname
+# SPARKY_FITNESS_DB_NAME         Database name
+# SPARKY_FITNESS_DB_PORT         PostgreSQL port
+# SPARKY_FITNESS_APP_DB_USER     App DB username
+# SPARKY_FITNESS_SERVER_HOST/PORT Server connection config
+# SPARKY_FITNESS_FRONTEND_URL    Frontend URL
+# SPARKY_FITNESS_DISABLE_SIGNUP  Boolean flag
+# SPARKY_FITNESS_ADMIN_EMAIL     Admin email address
+# SPARKY_FITNESS_FORCE_EMAIL_LOGIN Boolean flag
+# NODE_ENV, TZ                   Runtime config
+# SPARKY_FITNESS_LOG_LEVEL       Log level
+# DB_PATH, SERVER_BACKUP_PATH, SERVER_UPLOADS_PATH  Volume paths
+# BASIC_AUTH_USERNAME            Username (admin — not sensitive)
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   entertainment)
+#     create_or_update_secret "entertainment_discord_token"          "$ENTERTAINMENT_DISCORD_TOKEN"
+#     create_or_update_secret "entertainment_discord_client_secret"  "$ENTERTAINMENT_DISCORD_CLIENT_SECRET"
+#     create_or_update_secret "entertainment_secret_key_base"        "$ENTERTAINMENT_SECRET_KEY_BASE"
+#     create_or_update_secret "entertainment_basic_auth_password"    "$ENTERTAINMENT_BASIC_AUTH_PASSWORD"
+#     create_or_update_secret "entertainment_sparky_db_password"     "$ENTERTAINMENT_SPARKY_DB_PASSWORD"
+#     create_or_update_secret "entertainment_sparky_app_db_password" "$ENTERTAINMENT_SPARKY_APP_DB_PASSWORD"
+#     create_or_update_secret "entertainment_sparky_encryption_key"  "$ENTERTAINMENT_SPARKY_ENCRYPTION_KEY"
+#     create_or_update_secret "entertainment_better_auth_secret"     "$ENTERTAINMENT_BETTER_AUTH_SECRET"
+#     ;;