diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..8c41fc5
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,4 @@
+APP_HOST=cleanstream-connector.test
+SHARED_NETWORK=ordernow-shared
+MEDIA_ROOT=/absolute/path/to/video-library
+PAIRING_SECRET=replace-with-a-long-random-secret
diff --git a/README.md b/README.md
index ef85603..27f8300 100644
--- a/README.md
+++ b/README.md
@@ -10,3 +10,17 @@ For production, place the service behind HTTPS and set `PUBLIC_BASE_URL` and
 `APPROVAL_BASE_URL` to its HTTPS address. Scanning the TV QR code opens a phone
 approval form protected by `PAIRING_SECRET`; replace that form with your own
 identity provider for a production connector.
+
+## Local OrbStack development
+
+Copy `.env.example` to `.env`, set `MEDIA_ROOT` to an absolute directory with
+video files, then start the shared-Caddy stack:
+
+```sh
+docker compose -p cleanstream-connector-local-domain -f docker-compose.local-domain.yml up -d
+```
+
+The connector is available at `https://cleanstream-connector.test`. The TV and
+phone must be on the same LAN. Because this uses Caddy's internal certificate,
+the phone must trust the local Caddy root certificate before it can open the QR
+approval URL.
diff --git a/docker-compose.local-domain.yml b/docker-compose.local-domain.yml
new file mode 100644
index 0000000..7368ffc
--- /dev/null
+++ b/docker-compose.local-domain.yml
@@ -0,0 +1,28 @@
+services:
+  connector:
+    image: node:22-alpine
+    restart: unless-stopped
+    working_dir: /app
+    command: ["node", "--watch", "server.js"]
+    environment:
+      PORT: 8787
+      PUBLIC_BASE_URL: https://${APP_HOST}
+      APPROVAL_BASE_URL: https://${APP_HOST}
+      PAIRING_SECRET: ${PAIRING_SECRET}
+      MEDIA_ROOT: /media
+    volumes:
+      - ./:/app
+      - ${MEDIA_ROOT:?Set MEDIA_ROOT in .env}:/media:ro
+    labels:
+      caddy: ${APP_HOST}
+      caddy.tls: internal
+      caddy.reverse_proxy: "{{upstreams 8787}}"
+      caddy.reverse_proxy.header_up_0: "X-Forwarded-Host {host}"
+      caddy.reverse_proxy.header_up_1: "X-Forwarded-Proto https"
+    networks:
+      - shared
+
+networks:
+  shared:
+    external: true
+    name: ${SHARED_NETWORK:-ordernow-shared}