diff --git a/.gitignore b/.gitignore
index ca8dacf..44af383 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,4 +22,6 @@
 !.env.*.example
 !*.env.example
 !*.env.*.example
+*.swp
+.DS_Store
 # END reset-history environment exclusions
diff --git a/README.md b/README.md
index 53f9a49..6c455bf 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,24 @@
-# grafana
+# Grafana
 
+Self-hosted visualization and alerting service for dashboards built from configured monitoring data sources.
+
+## Deployment layout
+
+- **Compose:** `/srv/docker/grafana/docker-compose.yml`
+- **Static configuration/source:** no additional static configuration or build source
+- **Non-secret environment:** embedding, cookie, content-security-policy, and anonymous Viewer settings are declared
+inline in Compose; there is no project-local `.env`
+- **Secrets:** none
+- **NVMe application state:** `/srv/appdata/grafana/data`
+- **Bulk HDD data:** none
+- **Other mounts:** none
+
+Secrets are never committed to this repository. No standalone secret file is
+declared; credentials entered through Grafana are retained in its protected application-managed state.
+
+## Dependencies and recovery
+
+- **Networks/dependencies:** external `npm_proxy` network at `192.168.96.13`; monitoring data sources are configured
+within Grafana and were not inspected
+- **Back up:** `/srv/appdata/grafana/data`
+- **Re-creatable:** the Grafana container; no separate cache or temporary-data mount is declared