diff --git a/.env.example b/.env.example
deleted file mode 100644
index 2983e35..0000000
--- a/.env.example
+++ /dev/null
@@ -1,115 +0,0 @@
-# intercom-manager environment variables
-#
-# Copy this file to `.env` and adjust the values for your setup.
-# Do NOT commit your real `.env` — it is gitignored. Only this example is tracked.
-# All values below are placeholders/examples, not real secrets.
-
-# =============================================================================
-# Required
-# =============================================================================
-
-# Base URL of the Symphony Media Bridge (SMB) REST API the manager connects to.
-# If unset the server falls back to http://localhost:8080 and logs a warning,
-# so set this explicitly in any real deployment.
-SMB_ADDRESS=http://localhost:8080
-
-# =============================================================================
-# Optional (defaults shown)
-# =============================================================================
-
-# Port the Fastify server listens on. Default: 8000
-PORT=8000
-
-# Public base URL used to build absolute links (e.g. WHIP endpoints).
-# Default: http://localhost:8000
-PUBLIC_HOST=http://localhost:8000
-
-# Database connection string. REQUIRED — the manager fails fast at startup if
-# neither this nor MONGODB_CONNECTION_STRING is set (there is no hardcoded
-# localhost fallback in production code). Both mongodb(+srv) and http(s)
-# (CouchDB) protocols are supported. DB_CONNECTION_STRING takes precedence over
-# MONGODB_CONNECTION_STRING. The localhost value below is a sensible default for
-# local development.
-DB_CONNECTION_STRING=mongodb://localhost:27017/intercom-manager
-# Legacy/alternate name for the database connection string (used if
-# DB_CONNECTION_STRING is not set).
-MONGODB_CONNECTION_STRING=mongodb://localhost:27017/intercom-manager
-
-# API key sent to the SMB REST API. Optional; leave empty if SMB requires no key.
-SMB_APIKEY=
-
-# Idle timeout (seconds) for SMB endpoints before they are torn down. Default: 60
-ENDPOINT_IDLE_TIMEOUT_S=60
-
-# Comma-separated list of ICE servers. STUN entries as `stun:host:port` and TURN
-# entries as `turn:username:credential@host`. A Google STUN server is always
-# included by default. Example:
-# ICE_SERVERS=stun:stun.l.google.com:19302,turn:user:pass@turn.example.com:3478
-ICE_SERVERS=
-
-# Comma-separated list of allowed CORS origins. Optional; if unset CORS is not
-# restricted to a specific origin.
-CORS_ORIGIN=http://localhost:5173
-
-# Comma-separated allowlist of trusted origins for CSRF protection. When set,
-# state-mutating requests (POST/PUT/PATCH/DELETE) that carry an Origin (or, if
-# absent, Referer) header whose origin is NOT in this list are rejected with
-# 403. Requests with no Origin/Referer header (native/server-to-server clients)
-# are always allowed. Optional; when unset/empty the check is a no-op and
-# nothing is blocked. Example: CSRF_TRUSTED_ORIGINS=https://app.example.com
-CSRF_TRUSTED_ORIGINS=
-
-# --- Roles & permissions (#123) ---
-
-# Role passwords. A client exchanges one of these for a role (and the set of
-# frontend feature flags for that role) via POST /api/v1/permissions. Each role
-# is only available when its password is set here; a role with an unset/empty
-# password can never be obtained. All optional. Use strong, unique secrets.
-ROLE_ADMIN_PASSWORD=
-ROLE_EDITOR_PASSWORD=
-ROLE_PARTICIPANT_PASSWORD=
-
-# Opt-in authentication of ALL incoming requests. When set to the literal
-# string "true", every request (except the health check, the Swagger docs and
-# POST /api/v1/permissions) must present `Authorization: Bearer <role-password>`
-# matching one of the ROLE_*_PASSWORD values above, otherwise it is rejected
-# with 401. When unset/anything-else (the default) this is a no-op and existing
-# unauthenticated clients are unaffected. CORS preflight (OPTIONS) is always
-# allowed. Optional. Default: disabled.
-REQUIRE_AUTH=false
-
-# Shared auth key required to publish WHIP ingest streams. Optional; if set,
-# WHIP clients must present it.
-WHIP_AUTH_KEY=
-
-# --- WHIP ingest lifecycle tuning (all optional, milliseconds unless noted) ---
-
-# Warm-up grace period before a new WHIP endpoint is considered active.
-# Default: 15000
-WHIP_WARMUP_MS=15000
-
-# How long a WHIP endpoint may stay inactive before being expired. Default: 10000
-WHIP_INACTIVE_ALLOW_MS=10000
-
-# How long an absent WHIP endpoint is tolerated before being expired.
-# Default: 30000
-WHIP_ABSENCE_ALLOW_MS=30000
-
-# Number of retries before expiring a WHIP endpoint. Default: 3
-WHIP_EXPIRE_RETRIES=3
-
-# Consecutive missed checks before expiring a WHIP endpoint. Default: 3
-WHIP_EXPIRE_CONSECUTIVE_MISSES=3
-
-# --- Eyevinn Open Source Cloud (OSC) integration (optional) ---
-
-# OSC personal access token used for share/re-auth features. Optional.
-OSC_ACCESS_TOKEN=
-
-# OSC environment to target. Default: prod
-OSC_ENVIRONMENT=prod
-
-# --- Logging ---
-
-# Set to any truthy value to enable debug-level logging. Optional; unset = off.
-DEBUG=
diff --git a/.env.sample b/.env.sample
index 3c504de..423f9e2 100644
--- a/.env.sample
+++ b/.env.sample
@@ -1,9 +1,63 @@
-PORT=<PORT>
-SMB_ADDRESS=<SMB_ADDRESS>
-SMB_APIKEY=<SMB_APIKEY>
-WHIP_AUTH_KEY=<WHIP_AUTH_KEY>
-DB_CONNECTION_STRING=<DB_CONNECTION_STRING>
-PUBLIC_HOST=<PUBLIC_HOST>
-OSC_ACCESS_TOKEN=<OSC_ACCESS_TOKEN>
-ICE_SERVERS=turn:username:password@turn.example.com,stun:stun.example.com
+# Copy to `.env` and adjust. Values below are placeholders, not real secrets.
+
+# --- Required ---
+
+# Base URL of the Symphony Media Bridge (SMB) REST API.
+SMB_ADDRESS=http://localhost:8080
+# DB connection string; mongodb(+srv) or http(s) (CouchDB). Startup fails without it.
+DB_CONNECTION_STRING=mongodb://localhost:27017/intercom-manager
+
+# --- Optional (defaults shown) ---
+
+# Port the Fastify server listens on.
+PORT=8000
+# Public base URL used to build absolute links (e.g. WHIP endpoints).
+PUBLIC_HOST=http://localhost:8000
+# Legacy alias for DB_CONNECTION_STRING; used only if that one is unset.
+MONGODB_CONNECTION_STRING=mongodb://localhost:27017/intercom-manager
+# API key for the SMB REST API; leave empty if SMB requires none.
+SMB_APIKEY=
+# Idle timeout (seconds) before SMB endpoints are torn down.
+ENDPOINT_IDLE_TIMEOUT_S=60
+# Comma-separated ICE servers, e.g. turn:user:pass@turn.example.com,stun:stun.example.com
+ICE_SERVERS=
+# Comma-separated allowed CORS origins; unset = not restricted to an origin.
 CORS_ORIGIN=http://localhost:5173,http://localhost:5174
+# Comma-separated origins allowed to make state-mutating requests; unset = no CSRF check.
+CSRF_TRUSTED_ORIGINS=
+
+# --- Roles & permissions (#123) ---
+
+# Role passwords exchanged for a role via POST /api/v1/permissions; unset = role unavailable.
+ROLE_ADMIN_PASSWORD=
+ROLE_EDITOR_PASSWORD=
+ROLE_PARTICIPANT_PASSWORD=
+# "true" requires `Authorization: Bearer <role-password>` on all requests.
+REQUIRE_AUTH=false
+
+# --- WHIP ingest ---
+
+# Shared auth key WHIP clients must present to publish.
+WHIP_AUTH_KEY=
+# Warm-up grace period (ms) before a new WHIP endpoint counts as active.
+WHIP_WARMUP_MS=15000
+# How long (ms) a WHIP endpoint may stay inactive before expiring.
+WHIP_INACTIVE_ALLOW_MS=10000
+# How long (ms) an absent WHIP endpoint is tolerated before expiring.
+WHIP_ABSENCE_ALLOW_MS=30000
+# Retries before expiring a WHIP endpoint.
+WHIP_EXPIRE_RETRIES=3
+# Consecutive missed checks before expiring a WHIP endpoint.
+WHIP_EXPIRE_CONSECUTIVE_MISSES=3
+
+# --- Eyevinn Open Source Cloud (OSC) ---
+
+# OSC personal access token used for share/re-auth features.
+OSC_ACCESS_TOKEN=
+# OSC environment to target.
+OSC_ENVIRONMENT=prod
+
+# --- Logging ---
+
+# Any truthy value enables debug-level logging.
+DEBUG=
diff --git a/.gitignore b/.gitignore
index 1576285..8817789 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,6 @@
 node_modules/
 .DS_Store
 .env
-!.env.example
 
 .terraform/
 *.tfstate
diff --git a/src/server.ts b/src/server.ts
index bfba17b..6775622 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -97,7 +97,7 @@ export function validateRequiredEnv(): void {
   // A database connection string is required; no hardcoded localhost fallback is
   // provided so that a missing value fails fast at startup rather than silently
   // connecting to a local MongoDB. Local development supplies the localhost
-  // default via .env/.env.example/docker-compose, not in production code.
+  // default via .env/.env.sample/docker-compose, not in production code.
   if (
     !process.env.DB_CONNECTION_STRING &&
     !process.env.MONGODB_CONNECTION_STRING