diff --git a/README.md b/README.md
index 3cd5658..390720d 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,17 @@
-# gitops-apps
-
-Argo CD Application manifests for cluster redeploy
\ No newline at end of file
+# GitOps scaffold for Rancher-managed Kubernetes
+#
+# Flow: Developers/CI -> Forgejo -> Argo CD -> Rancher-managed clusters.
+# Kubernetes itself is NOT the backup. This repo (in Forgejo, backed up
+# by /root/forgejo/backup.sh) plus container images are the source of truth.
+#
+# Layout:
+#   bootstrap/     one-time Argo CD install + root App-of-Apps
+#   apps/          one Argo CD Application per workload
+#   clusters/      per-cluster config (registered Rancher clusters)
+#
+# Usage on a NEW cluster:
+#   1. kubectl apply -f bootstrap/argocd-namespace.yaml
+#   2. kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+#   3. kubectl apply -f bootstrap/repo-forgejo.yaml       # registers THIS Forgejo repo
+#   4. kubectl apply -f bootstrap/root-app.yaml           # app-of-apps -> redeploys everything
+#   5. (Rancher) cluster auto-registers; workloads converge from Git.
diff --git a/apps/example-app.yaml b/apps/example-app.yaml
new file mode 100644
index 0000000..7f389b3
--- /dev/null
+++ b/apps/example-app.yaml
@@ -0,0 +1,22 @@
+# Example workload Application. Copy per app; point `path` (or chart) at
+# your app manifests (also stored in Forgejo). Replace repoURL/server.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: example-app
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://localhost:3000/forgejoadmin/gitops-apps.git
+    targetRevision: main
+    path: clusters/default/example-app
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: example-app
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/bootstrap/argocd-namespace.yaml b/bootstrap/argocd-namespace.yaml
new file mode 100644
index 0000000..a040f2b
--- /dev/null
+++ b/bootstrap/argocd-namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
diff --git a/bootstrap/repo-forgejo.yaml b/bootstrap/repo-forgejo.yaml
new file mode 100644
index 0000000..faedac5
--- /dev/null
+++ b/bootstrap/repo-forgejo.yaml
@@ -0,0 +1,15 @@
+# Registers the Forgejo repo with Argo CD.
+# For SSH access, create a secret with the deploy key instead:
+#   kubectl -n argocd create secret generic forgejo-repo-creds \
+#     --from-file=sshPrivateKey=/path/to/deploy_key
+apiVersion: v1
+kind: Secret
+metadata:
+  name: repo-forgejo-gitops
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+stringData:
+  type: git
+  url: http://localhost:3000/forgejoadmin/gitops-apps.git
+  # username/password or sshPrivateKey go here when the repo is private
diff --git a/bootstrap/root-app.yaml b/bootstrap/root-app.yaml
new file mode 100644
index 0000000..6431a78
--- /dev/null
+++ b/bootstrap/root-app.yaml
@@ -0,0 +1,22 @@
+# App-of-Apps: applying this one Application redeploys every workload
+# defined under apps/ onto the target cluster.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root-app
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://localhost:3000/forgejoadmin/gitops-apps.git
+    targetRevision: main
+    path: apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/clusters/default/example-app/deployment.yaml b/clusters/default/example-app/deployment.yaml
new file mode 100644
index 0000000..c65fdcf
--- /dev/null
+++ b/clusters/default/example-app/deployment.yaml
@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: example-app
+  namespace: example-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: example-app
+  template:
+    metadata:
+      labels:
+        app: example-app
+    spec:
+      containers:
+        - name: app
+          image: nginx:1.27-alpine
+          ports:
+            - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: example-app
+  namespace: example-app
+spec:
+  selector:
+    app: example-app
+  ports:
+    - port: 80
+      targetPort: 80