diff --git a/.env b/.env
new file mode 100644
index 0000000..b2c597f
--- /dev/null
+++ b/.env
@@ -0,0 +1,20 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY="03b60e94e9f05023365e8fd3f5d7f10a7f32da14049abc6d50d0ec8c1a5c9614d9"
+
+# .env
+# Image Cropper service credentials — the ONLY environment variables this app
+# uses. Everything else (URLs, port, domain catalog) is hardcoded in source.
+# Without these the rest of the app works and /cropper answers 503.
+CARVEKIT_API_KEY=encrypted:BL70oXdFVJqjTq5mr07jBda3bX5vMutHfKU+CFcsZo4eGzSQek4cP3isZCcYGq/7ahjayWhygiM3GzWH/6gLi6K3q4BxpxW2aomKvz1U2ilAzDDKzB8Ct9kcCu0i7iv8v8PpOOv8BAAWY9jnNNmF0Q==
+AZURE_STORAGE_CONNECTION_STRING="encrypted:BMuqy4ERnIE+SVW2c6BxHJGlJgj+MSeak2H3uA2yqzs1Pu9bRHB4FIIp/SURpPN7oQktEILxqdR8iMpdomBhbi8yFQlNAQSxnTU/X6W7e+WRhasdNQxunfpU5qcwHOOYQbLLavj0VYOZ04Mtz2w6EDrJLzk4EFfdMJbzcfFcWdc3EJai3EBKDdaHZe0u4IZKCQQop2MtpAPgdOiNRmCu5IGryShAAI9WtHNBd4A5HpHDNIJ86Ky8jaXWP0eiTnvj5/WvpLOTY3/PtMtvkA0fofZhyWbgVyjAaHN24Lo8zQ22Lz+QmYfhyIkCWsSdSvrbGCo92xkEqcJYKzexJn471JhNmvLXEqgYKNQjF+k0wu+f+9JZ+dOXi20="
+MINIO_ACCESS_KEY="encrypted:BLibl3dzwHEXoQ7kccFR8dX2mH/q/9vXvUOxge7UVoyrtjgqer0OHWC+yD5kBdjVkuabpvfgnmbUwL1I6gk/sJ8UTG4Q45RCfmp/CkrdmhM291HMReSbLh8JgSBAX65cZRRbAONspfa8EP9sIBzabvODBLGD"
+MINIO_SECRET_KEY="encrypted:BM0RsANOfD9vO9UNIIikBbBGmvCgW8Wm4P/i5HMdKrD8djmXV2whDlnXL8EvjF0L4tXi8jOblvmEiOXYUIqe53KdU6gAugGC3NEjoWf9MvPp8nE9lgcHFvnRSLhBWr8cOV8so6ht84AVCj2FqDdNTh5rAt+CT7vbGhKPQwcNEZ+xl5Rjd66jY+M="
+PORT=encrypted:BAjkcGez/KCnPaCKJzrUGZaxhwzy7zbFMxBiTsXj1nvu7hWQOEdM22Du6fGCrDUMCAsaWyaolzXWc7AiPOBKkVSoEuDNZjohVSU2C09jZckBSNM6lA9M4yfjqciebyI/uQ0L/qg=
+A2LOFT_API_BASE="encrypted:BCcvNs5RbTz62hkXuHwdLUyafjOrgXvWOuB/6d0hvyjV5y9MhFWbGMUgj2WiXKAOzwJnYmIMJshfVsBho7VoWq8eUns2r9piaoD1Liv5qTB5ar/ZR/gOw5UKOyKSCmKbrP/oFR7uKAiJWbL7SQ/Y9FAFBZzu20rVeQFVpzHi6wxs"
+API_BASE="encrypted:BIJm9rXCjB90I6zZFK57kTTjx2KY0+V42NF8zk38YVcSNTu4PB5Dxdz6iOEzI/84mtMmKvM+5/TvnvD3fvfbEhUyMdRAfr/EJTmcp2yM6F8g9SVRMP7F+4lTCIbT1IMzEETT0Roz0VirLRTFaDb/24EGBvziSxU="
+IMAGE_FOLDER="encrypted:BEGDDzGErTbitrApWXiq5TuUQrtJCcRq89fuagmNp92npdAubBxA1vtTQwwJ3OGKSPwDW1gQceczY3NWwaeGZbc46L1rut6oP+yE/BATMkJ/7IcoKn7S27By/00GmsbHjWqp9prtLOv5dCgCpw=="
+NODERED_HTTP_USERNAME="encrypted:BCjXvS6rg+eCpV+S4/mypzw6Xu4vablBSqEZZeQN/oCfl7P7mVWzgaLYzNYOHit+4wP5soE1jw/jdk4OqBIiulcXWbkkEJPNvSqct9iL/rNfxufNuozOSFnii7j9bfW9dvjju2egpxNb16RHLtI+"
+NODERED_HTTP_PASSWORD=encrypted:BKHA3R+VWxrEkpYhgPfXuZJroarXuIpdMSSI+cpEP6AcQS1vuE1alOtqD0sp5TFU0o5jMx9KWwE6L/WG9LdRQAyEJiotl93oYK46p1L3VgrRkUS+xpX5z5u5VYCLYdCfjhuCU75kGDmRaqId5fbgQ9NmIzJAvYUb2C4zEz0DADNy8/JHmfXKHVorexRAB0gJXoUPfLXk8gcJbdQPNoGobBIonngLREllEmGN
diff --git a/.env.production b/.env.production
new file mode 100644
index 0000000..1483964
--- /dev/null
+++ b/.env.production
@@ -0,0 +1,20 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_PRODUCTION="031f5eb90e9d47f93d12d34ff1ed062fffced510a6bf173cacb25ca4f53a6eca54"
+
+# .env.production
+# Image Cropper service credentials — the ONLY environment variables this app
+# uses. Everything else (URLs, port, domain catalog) is hardcoded in source.
+# Without these the rest of the app works and /cropper answers 503.
+CARVEKIT_API_KEY=encrypted:BHMJnQyrSN2wg2qi4zgG90ZJAU1EBxcPgWjOQEJPcv053leTtkDn9VpQ/zLfN9KnulH3Y+W+DBCEQQ1L/bSMBh15oc5kYQAEcWzPTjybWT/3/oXlwxhfhbgW+GfJxW5HjYhsCg6Ea57qDeTwV5KwBA==
+AZURE_STORAGE_CONNECTION_STRING="encrypted:BKeJx7/swk+DRvpRlHb7la0nQ3lmTJII3tKxltrVW40CfO0Iu13r1rGrMsgl3s3FTvfUjs7REJSSDzl8FUHUybxsRAYpzuMkN0E7BnTtHB3AeBoDFPkQ1c48/r3hEQRyW5sXXjLXgjLQS3FpFT2rf1wMJc9Ql5YJgtYwnnH4O4MX7w0GxSNAS2GLlijKNpPdFp+YcF8XTIz1IX4T+UXWYdoq2H82kFW9PzvR6eXteB6Xfyexge9vENnGmUCQOL1IthMWJ7qi/m6xrZYBd1wfUQTv3jSxFEmjHBmsRVVp9RRpynPkwgNfiCPtHJ5irCTOaG+GRmFhIL0X7a+Ze674revhGk6ZnoWxumvVy6QDChSxZeOthTpulR4="
+MINIO_ACCESS_KEY="encrypted:BDM7yp3ttUon8GHPJd9xJed66hsDlFprLMQIbl/5zdlv0dL54ZiVVbMx7t5SlzgnFzUv69f0heNSQ7Fuc6eB0Iy5ocGZXSgka6JROlMfnUe9sIWAgqw2CRt8dm7TKinciFtOqS6V/z/3G9Xv5ZYJRTOxGXug"
+MINIO_SECRET_KEY="encrypted:BNY/OWPF3ijhoGf9djrXiuPGPJ+JXz7ioIPfoxjJJXo8DCMBk7G7WjMYVeopuzem8Cvt9+/Astsr/cw4nBNPYZZ5Ddqsph5nTj3dn1ScxFH8NSibbODxZbOhGH+3ZNBqThFcuPOL1uNS5xIIymikxESRZWHZTAYkyQSFTOWicHLep5qsTkETSTU="
+PORT=encrypted:BFEoVT2be9sPZuObz5YdNqanEghweJYMi+Vdfd8PZFbLvrq10EP+ubWvV05Ks+eO5xFSxaRdTLgkT215RcpQdzyvS1GZdkj3M+oOX1fxw6oLWvKB7+tASUP3v+veGmkmZtdh9ag=
+A2LOFT_API_BASE="encrypted:BBOcPjzSEGOB+sYNhSc8lVdgyeKsiWzCDKVOEujRxuwO4z/66VWIh28WtBVTN9z900nAyAh5AXFh9tzNdR5+v1VhoybnymhW3ut3LUpfyOli9Gb+FXmU4XU/HcoH/doqpL5e2lZlADHrHD9u0XVg6yIm8BpW4kcHBLboqq3QJ7df"
+API_BASE="encrypted:BFVQaDK474EqpNvSw6iiP8KYjRqyXOMQLL/m5lbQHI30QCrNoMfsxmC7W2mHZ93Dgmvc/NYq6HpbelWx2IkqFRIAnuQbtSANOFYumFSfbpVQ0h96PTuekGFJWYYCKKFmYdN4md6HhTMU9AY06ba4ly75wti9s+k="
+IMAGE_FOLDER="encrypted:BDNYAfiof6lw9vYxB5jm3GZrtESoA+BNsrktU/YoWlV0HHdAOU+yWGX8FTRTq2/3Qv5AW02IO77Y7Fec9DGVHG6MmzEfuNVZ1Gz7e8XxGatmfp3X+p/REq04bZs4UXflh/YC8a9vYGpelpyVlw=="
+NODERED_HTTP_USERNAME="encrypted:BApJWB9AcOzsbkS+GxJ24uaVBBD5rAO/q3z6EIhLDutOmiIcolwdl1kHJGgkkRGVKc/PvNlMD1fAYtEblEiMdSwJPKciV4gWdVNWnVVZHK/WFpP3Rj8JLBRq5ysfFgH2PBPHZFUAnBl3FbzVuJfc"
+NODERED_HTTP_PASSWORD=encrypted:BGgnc8FDXIyZl/vjOwTiG2LLu1uwz72OCy78obR0h6yvm3NBv/pGr0ZeR1ZzDFBntN1WSg0qtroztpZxmdPcNgjO0/osmegUvNRM89uj6CsFtBe2SlDJLN66VH5ZGduB4m2CO0iNm14EZg3mLbkwCZv28Pb9uJqfPePt9EbK3Wwzu8IfJt2FImEe6nqdBng79Rbie4X7Z2WZX/m1nzcJb0WiMuzwGAT3e0aT
diff --git a/.gitignore b/.gitignore
index 412c65f..e4b239f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 .config.json
 .pyc
 node_modules/
-.env
+.env.keys
+.env.local