diff --git a/.gitignore b/.gitignore
index c18dd8d..00d2826 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
 __pycache__/
+.env
+sunrise-sounds/
diff --git a/install.sh b/install.sh
index 847fb4c..b343297 100755
--- a/install.sh
+++ b/install.sh
@@ -186,6 +186,29 @@ for cam in "${CAMERAS[@]}"; do
     fi
 done
 
+# ── Generate .env.example ────────────────────────────────────────────────────
+env_example="$HERE/.env.example"
+{
+    echo "# sky-cam credentials — copy to .env and fill in real values."
+    echo "# .env is gitignored and never checked in."
+    echo ""
+    echo "# RTSP stream URLs — one line per camera (variable name = CAM_RTSP_<camname>)"
+    for cam in "${CAMERAS[@]}"; do
+        echo "CAM_RTSP_${cam}=rtsp://admin:PASSWORD@192.168.1.XXX:554/stream1"
+    done
+    echo ""
+    echo "# Mattermost upload"
+    echo "mattermost_url=https://your-mattermost-server.example.com"
+    echo "access_token=your-access-token-here"
+    echo "channel_id=your-daily-upload-channel-id-here"
+    echo ""
+    echo "# Notifications (uncomment whichever you use)"
+    echo "#NTFY_URL=https://ntfy.sh/your-topic"
+    echo "#EMAIL_TO=you@example.com"
+    echo "#MM_NOTIFY_CHANNEL_ID=your-notify-channel-id-here"
+} > "$env_example"
+echo "  wrote .env.example  (cp .env.example .env  then fill in real values)"
+
 # ── Reload and enable ─────────────────────────────────────────────────────────
 echo ""
 $SC daemon-reload
diff --git a/sky-cam.conf b/sky-cam.conf
index 1c4e8a3..fe6a7b6 100644
--- a/sky-cam.conf
+++ b/sky-cam.conf
@@ -245,8 +245,7 @@ MONTAGE_ATTR_FADE=1    # attribution fade-in and fade-out length (seconds)
 # Find the URL in your camera's web UI (usually under Network → Video → RTSP)
 # or check your camera's manual.
 #
-#CAM_RTSP_sunrise=rtsp://admin:password@192.168.1.100:554/stream1
-#CAM_RTSP_north=rtsp://admin:password@192.168.1.101:554/stream1
+# CAM_RTSP_<cam> goes in .env (see bottom of this file), not here.
 
 # Seconds between captured frames (applies to all cameras).
 # 10 = one frame every 10 s → 8640 frames/day → good timelapse density.
@@ -263,9 +262,7 @@ AUDIO_PRE_BUFFER_MIN=2        # extra minutes to start before the capture window
 CAPTURE_AUDIO_BITRATE=96k     # bitrate for the sunrise audio recording
 
 # ── Mattermost — daily sunrise upload ─────────────────────────────────────────
-mattermost_url=https://your-mattermost-server.example.com
-access_token=your-access-token-here
-channel_id=your-daily-upload-channel-id-here
+# mattermost_url, access_token, channel_id go in .env (see bottom of this file).
 
 # ── Notifications — montage / year-end complete + any job failure ─────────────
 # Notifications fire when a movement montage or the year video finishes,
@@ -288,3 +285,18 @@ channel_id=your-daily-upload-channel-id-here
 # Can be the same daily channel or a separate admin/private channel.
 #MM_NOTIFY_ENABLED=true
 #MM_NOTIFY_CHANNEL_ID=your-notify-channel-id-here
+
+# ── Credentials (.env override) ───────────────────────────────────────────────
+# Sensitive values (RTSP URLs with passwords, API tokens) can be kept out of
+# this file — and out of git — by placing them in a .env file in the same
+# directory.  install.sh generates .env.example showing exactly which variables
+# to define for your camera list.
+#
+# To use:
+#   cp .env.example .env
+#   $EDITOR .env          ← fill in real values
+#   (never commit .env)
+#
+_conf_dir="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
+[ -f "$_conf_dir/.env" ] && source "$_conf_dir/.env"
+unset _conf_dir