diff --git a/.env.example b/.env.example
index 1025436..255307f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,18 +1,22 @@
 # GnuTaler Docker Setup
 
+# Core Postgres
 POSTGRES_HOST=postgres
 POSTGRES_PORT=5432
-POSTGRES_PASSWORD=taler
 POSTGRES_ADMIN_USER=postgres
+POSTGRES_PASSWORD=taler
 
+# Exchange DB
 TALER_EXCHANGE_DB=talerexchange
 TALER_EXCHANGE_DB_USER=talerexchange
 TALER_EXCHANGE_DB_PASSWORD=taler
 
+# Merchant DB
 TALER_MERCHANT_DB=talermerchant
 TALER_MERCHANT_DB_USER=talermerchant
 TALER_MERCHANT_DB_PASSWORD=taler
 
+# LibEuFin / Bank DB + users
 LIBEUFIN_DB_NAME=libeufinbank
 LIBEUFIN_DB_USER=libeufinbank
 LIBEUFIN_DB_PASSWORD=taler
@@ -25,60 +29,60 @@ LIBEUFIN_USER=demogeld
 LIBEUFIN_USER_PASSWORD=
 LIBEUFIN_DEBIT_THRESHOLD=DEMOGELD:1000000
 
-# Sync service
+# Sync service DB + URL
 TALER_SYNC_DB=talersync
 TALER_SYNC_DB_USER=talersync
 TALER_SYNC_DB_PASSWORD=talersync
 SYNC_BASE_URL=https://sync.domain.tld/
 SYNC_HOST=sync.domain.tld
 SYNC_PORT=8087
-SYNC_TARBALL_URL=
+
+# Service URLs / hosts
+TALER_DOMAIN=localhost
+BANK_HOST=bank.domain.tld
+EXCHANGE_HOST=exchange.domain.tld
+MERCHANT_HOST=merchant.domain.tld
+WORDPRESS_HOST=wordpress.domain.tld
+EXCHANGE_BASE_URL=https://exchange.domain.tld/
+EXCHANGE_SHOPPING_URL=https://exchange.domain.tld/
+BANK_BASE_URL=https://bank.domain.tld/
+OPEN_BANKING_GATEWAY_URL=https://bank.domain.tld
+PAYTO_URI=payto://x-taler-bank/yourbank.domain.tld/demogeld?receiver-name=demogeld
+TALER_CURRENCY=DEMOGELD
+TALER_EXCHANGE_PORT=8081
+TALER_MERCHANT_PORT=9966
+LIBEUFIN_BANK_PORT=8080
+
+# Reverse proxy (Caddy)
+CADDY_ACME_EMAIL=ops@example.com
+
+# Build sources (refs or tarballs)
+GNUNET_REF=v0.26.1
+EXCHANGE_REF=master
+MERCHANT_REF=master
+LIBEUFIN_REF=master
 SYNC_REF=master
+GNUNET_TARBALL_URL=
+EXCHANGE_TARBALL_URL=
+MERCHANT_TARBALL_URL=
+LIBEUFIN_TARBALL_URL=
+SYNC_TARBALL_URL=
+
+# Secrets / master keys
+EXCHANGE_SECRETS_PATH=./exchange/secrets
+MASTER_PUBLIC_KEY=
 
 # Exchange offline account enablement
 ENABLE_EXCHANGE_ACCOUNT=0
-PAYTO_URI=payto://x-taler-bank/yourbank.domain.tld/demogeld?receiver-name=demogeld
 EXCHANGE_KEYS_URL=http://exchange.internal:8081/keys
 EXCHANGE_WAIT_RETRIES=60
 EXCHANGE_WAIT_INTERVAL=2
 # Optional curl flags for HTTPS with custom certs, etc. Example: "-k"
 EXCHANGE_CURL_OPTS=
 
-# Caddy reverse proxy
-CADDY_ACME_EMAIL=ops@example.com
-BANK_HOST=bank.domain.tld
-EXCHANGE_HOST=exchange.domain.tld
-MERCHANT_HOST=merchant.domain.tld
-WORDPRESS_HOST=wordpress.domain.tld
-GNUNET_REF=v0.26.1
-EXCHANGE_REF=master
-MERCHANT_REF=master
-LIBEUFIN_REF=master
-GNUNET_TARBALL_URL=
-EXCHANGE_TARBALL_URL=
-MERCHANT_TARBALL_URL=
-LIBEUFIN_TARBALL_URL=
-
-# Secrets path (host path mounted into /etc/taler/secrets)
-EXCHANGE_SECRETS_PATH=./exchange/secrets
-
-# Master key (public) for exchange/merchant configs
-MASTER_PUBLIC_KEY=
-
 # Optional token provisioning output path
 TOKEN_OUTPUT=bank/token-info.txt
 
-TALER_DOMAIN=localhost
-TALER_EXCHANGE_PORT=8081
-TALER_MERCHANT_PORT=9966
-LIBEUFIN_BANK_PORT=8080
-EXCHANGE_BASE_URL=https://exchange.domain.tld/
-EXCHANGE_SHOPPING_URL=https://exchange.domain.tld/
-OPEN_BANKING_GATEWAY_URL=https://bank.domain.tld
-BANK_BASE_URL=https://bank.domain.tld/
-
-TALER_CURRENCY=DEMOGELD
-
 # WordPress / WooCommerce
 WP_DB_ROOT_PASSWORD=wordpressroot
 WP_DB_NAME=wordpress