diff --git a/ai/Dockerfile b/ai/Dockerfile
new file mode 100644
index 0000000..39b8eb3
--- /dev/null
+++ b/ai/Dockerfile
@@ -0,0 +1,23 @@
+FROM debian:13.4
+
+# Install uv (Python package manager), curl, poppler-utils, and imagemagick
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        curl \
+        poppler-utils \
+        imagemagick && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install uv if not already present (debian:13.4 doesn't ship it)
+COPY --from=ghcr.io/astral-sh/uv:latest /usr/local/bin/uv /usr/local/bin/uv
+RUN uv --version
+
+# Verify all expected tools are available
+RUN curl --version && \
+    pdftotext -v 2>&1 | head -1 && \
+    pdfinfo -v 2>&1 | head -1 && \
+    pdftoppm -v 2>&1 | head -1 && \
+    convert --version | head -1 && \
+    identify --version | head -1
+
+CMD ["/bin/bash"]
diff --git a/env/.env.example.paperclip b/env/.env.example.paperclip
new file mode 100644
index 0000000..a80936f
--- /dev/null
+++ b/env/.env.example.paperclip
@@ -0,0 +1,26 @@
+# Paperclip Environment Variables
+# Copy this file to your .env (at the compose root or docker-compose working directory)
+# and fill in the secrets.
+#
+#   cp env/.env.example.paperclip .env
+#
+# Then reference it from compose.yml:
+#   env_file:
+#     - path: .env
+#       required: true
+
+# ---------------------------------------------------------------------------
+# Database
+# ---------------------------------------------------------------------------
+# PostgreSQL password for the paperclip-db service.
+# Generate a strong random password:
+#   openssl rand -base64 32
+PAPERCLIP_DB_PASSWORD=change_me_to_a_strong_random_password
+
+# ---------------------------------------------------------------------------
+# Authentication
+# ---------------------------------------------------------------------------
+# Secret key used by Better Auth for signing and verifying tokens.
+# Generate a strong random secret:
+#   openssl rand -base64 32
+PAPERCLIP_AUTH_SECRET=change_me_to_a_strong_random_secret