diff --git a/README.md b/README.md
index 816fe64..2fb259d 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,14 @@
-# infra
+# infra: deployment files for git.ssw590-g1.tech
 
-Non-secret deployment files for git.ssw590-g1.tech
\ No newline at end of file
+Non-secret files that run the Group 1 Gitea (SQLite) behind a Caddy reverse proxy on one AWS EC2 instance.
+No passwords, tokens or keys are stored here.
+
+| File | Purpose |
+|---|---|
+| `docker-compose.yml` | Gitea `gitea/gitea:1.27.3` and Caddy `caddy:2.11.7`; only Caddy publishes ports 80 and 443 |
+| `Caddyfile` | Automatic HTTPS (Let's Encrypt) and reverse proxy to `gitea:3000` |
+| `.env.example` | Image versions and the hostname; copy to `.env` |
+| `aws/ec2-user-data.sh` | First-boot script for Amazon Linux 2023: 2 GB swap, Docker, git, pinned Docker Compose |
+
+Deploy: `cp .env.example .env`, then `docker compose config -q && docker compose pull && docker compose up -d`.
+The security group allows 443 and 80 from anyone and 22 only from the administrators' address.