diff --git a/apps/server-core b/apps/server-core
index 103cda9..127ba7e 160000
--- a/apps/server-core
+++ b/apps/server-core
@@ -1 +1 @@
-Subproject commit 103cda99a70d169b4e76ffdf3bddbbcacdf0b23f
+Subproject commit 127ba7ed99edfdb3a39b004158f378b67f339ef0
diff --git a/docker-compose.yml b/docker-compose.yml
index 03fb0d4..b9b145d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,6 +50,8 @@ services:
       - NFTABLES_TABLE=nexusguard
       - IPAM_POOL=10.172.0.0/16
       - GIN_MODE=release
+    volumes:
+      - ./nexusguard.conf:/etc/nexusguard/nexusguard.conf:ro
     depends_on:
       postgres:
         condition: service_healthy
diff --git a/nexusguard.conf.example b/nexusguard.conf.example
new file mode 100644
index 0000000..234398f
--- /dev/null
+++ b/nexusguard.conf.example
@@ -0,0 +1,25 @@
+# NexusGuard Server Configuration
+# This file is optional. Environment variables take precedence.
+# Format: export KEY=VALUE
+
+# Database
+# export DB_HOST=127.0.0.1
+# export DB_PORT=5432
+# export DB_USER=nexusguard
+# export DB_PASSWORD=nexusguard
+# export DB_NAME=nexusguard
+
+# Redis
+# export REDIS_ADDR=127.0.0.1:6379
+
+# Security
+# export JWT_SECRET=changeme
+# export SERVER_SALT=changeme
+
+# WireGuard
+# export NFTABLES_TABLE=nexusguard
+# export IPAM_POOL=10.172.0.0/16
+
+# Logging
+# export LOG_LEVEL=info
+# export GIN_MODE=release
diff --git a/setup.sh b/setup.sh
index 94092c1..a2852f2 100755
--- a/setup.sh
+++ b/setup.sh
@@ -28,6 +28,17 @@ else
     echo "[+] .env file already exists. Skipping environment generation."
 fi
 
+# 2. Config file generation
+if [ ! -f nexusguard.conf ]; then
+    if [ -f nexusguard.conf.example ]; then
+        echo "[+] Auto-generating nexusguard.conf from nexusguard.conf.example..."
+        cp nexusguard.conf.example nexusguard.conf
+        echo "[+] Config file created. All settings are commented out (env vars take precedence)."
+    fi
+else
+    echo "[+] nexusguard.conf already exists. Skipping config generation."
+fi
+
 # Make sure Docker Compose v2 is available
 if ! docker compose version &> /dev/null; then
     echo "[-] ERROR: docker compose (v2) is not available. Please install Docker and Docker Compose plugin."