diff --git a/.env.release.draft b/.env.release.draft
new file mode 100644
index 00000000..8a0c28e2
--- /dev/null
+++ b/.env.release.draft
@@ -0,0 +1,82 @@
+# SkillHub production draft for bare-metal deployment.
+# Copy this to .env.release and replace every value marked TODO.
+#
+# Recommended workflow:
+# 1. cp .env.release.draft .env.release
+# 2. Edit TODO values
+# 3. make validate-release-config
+# 4. docker compose --env-file .env.release -f compose.release.yml up -d
+
+# Pin a released image tag in production.
+SKILLHUB_VERSION=v0.1.0-beta.5
+SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
+SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
+
+# Public HTTPS entrypoint, no trailing slash.
+SKILLHUB_PUBLIC_BASE_URL=https://skillhub.example.com
+
+# Usually keep empty when web and api are served from the same domain.
+SKILLHUB_WEB_API_BASE_URL=
+SKILLHUB_API_UPSTREAM=http://server:8080
+
+# Keep database and redis local-only on the host unless you explicitly need remote access.
+POSTGRES_BIND_ADDRESS=127.0.0.1
+POSTGRES_PORT=5432
+POSTGRES_DB=skillhub
+POSTGRES_USER=skillhub
+POSTGRES_PASSWORD=TODO_change_to_a_strong_database_password
+
+REDIS_BIND_ADDRESS=127.0.0.1
+REDIS_PORT=6379
+
+# Host ports exposed by the app containers.
+API_PORT=8080
+WEB_PORT=80
+
+# Must stay true when the public site is behind HTTPS.
+SESSION_COOKIE_SECURE=true
+
+# External object storage. Production should use s3.
+SKILLHUB_STORAGE_PROVIDER=s3
+
+# Fill with your real S3-compatible endpoint.
+# Aliyun OSS example:
+#   https://oss-cn-shanghai.aliyuncs.com
+# AWS S3 example:
+#   https://s3.ap-east-1.amazonaws.com
+# MinIO example:
+#   https://minio.example.com
+SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-shanghai.aliyuncs.com
+
+# Optional public endpoint for presigned download URLs.
+# Leave empty if the same endpoint is externally reachable.
+SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
+
+SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
+SKILLHUB_STORAGE_S3_ACCESS_KEY=TODO_fill_real_access_key
+SKILLHUB_STORAGE_S3_SECRET_KEY=TODO_fill_real_secret_key
+SKILLHUB_STORAGE_S3_REGION=cn-shanghai
+
+# Aliyun OSS / AWS S3 typically use false.
+# Many self-hosted MinIO deployments need true.
+SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
+
+# Keep false in production unless you intentionally want the app to create the bucket.
+SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
+SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
+
+# Bootstrap admin is only for first login / first bootstrap.
+BOOTSTRAP_ADMIN_ENABLED=true
+BOOTSTRAP_ADMIN_USER_ID=docker-admin
+BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_PASSWORD=TODO_change_to_a_strong_admin_password
+BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+
+# Usually keep empty and let the backend derive it from SKILLHUB_PUBLIC_BASE_URL.
+DEVICE_AUTH_VERIFICATION_URI=
+
+# Optional GitHub OAuth.
+# Leave both empty if you are not enabling GitHub login yet.
+OAUTH2_GITHUB_CLIENT_ID=
+OAUTH2_GITHUB_CLIENT_SECRET=