diff --git a/README.md b/README.md
index 208f89b..2401e46 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,236 @@
-# EnvSync
\ No newline at end of file
+
+
+# π EnvSync
+## π§ Under Development
+
+### Encrypted `.env` Collaboration β Git for your secrets.
+
+[](https://nextjs.org/)
+[](https://spring.io/projects/spring-boot)
+[](https://www.postgresql.org/)
+[](https://redis.io/)
+[](https://min.io/)
+[](https://www.keycloak.org/)
+[](https://nginx.org/)
+[](https://www.docker.com/)
+
+> Stop sending `.env` files over Slack. Stop wondering if your teammate has the latest secrets. EnvSync is a CLI + web dashboard that gives your team a single encrypted source of truth for environment variables β with diffing, versioning, and real-time notifications. **100% self-hosted. Zero cloud dependencies.**
+
+
+
+---
+
+## π¨ The Problem
+
+Every dev team has this conversation:
+
+> _"Hey did you add the new `STRIPE_WEBHOOK_SECRET` to your `.env`?"_
+> _"Wait there's a new one? Since when?"_
+
+Environment variable drift causes bugs that are impossible to reproduce, broken local setups, and secrets leaking through Slack DMs. EnvSync fixes this β and keeps everything on your own infrastructure.
+
+---
+
+## β¨ Features
+
+- **CLI-first workflow** β `envsync push`, `envsync pull`, `envsync diff` β feels like git for your `.env`
+- **End-to-end encryption** β secrets encrypted client-side with `libsodium` before ever hitting the server
+- **Real-time notifications** β teammates get notified instantly via Redis pub/sub when variables change
+- **Environment scoping** β separate vaults for `development`, `staging`, `production`
+- **Audit log** β full history of who changed what, when, and from where
+- **`.env` diff viewer** β visual diff in the web dashboard showing exactly what changed between versions
+- **Org & project management** β multi-team support with role-based access control (Admin, Editor, Viewer)
+- **MinIO backups** β encrypted vault snapshots stored in self-hosted S3-compatible object storage
+- **Keycloak SSO** β enterprise-grade identity: OIDC login, MFA, LDAP, team provisioning
+
+---
+
+## ποΈ Architecture
+
+```
+βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+β CLI Tool β
+β envsync push / pull / diff β
+ββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββ
+ β HTTPS (via NGINX)
+ β E2E Encrypted Payload
+ββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββ
+β NGINX β
+β Reverse Proxy / TLS termination β
+ββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββ
+ β
+ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββ
+β Spring Boot API β
+β Auth Β· Vault CRUD Β· Audit Logging β
+ββββββββ¬βββββββββββββββββββ¬βββββββββββββββββββ¬βββββββββββββ
+ β β β
+ββββββββΌβββββββ βββββββββΌβββββββ ββββββββΌβββββββ
+β PostgreSQL β β Redis β β MinIO β
+β Vaults & β β Pub/Sub β β Encrypted β
+β Audit Logs β β Notificationsβ β Backups β
+βββββββββββββββ ββββββββββββββββ βββββββββββββββ
+
+βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+β Keycloak β
+β SSO Β· OIDC Β· Role Management Β· User Provisioning β
+βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+ β
+ββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββ
+β Next.js Dashboard β
+β Web UI Β· Real-time updates Β· Diff viewer β
+βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+```
+
+---
+
+## π οΈ Tech Stack
+
+| Layer | Technology | Self-Hosted Replaces |
+|---|---|---|
+| **Frontend** | Next.js 15 (App Router) | β |
+| **Backend** | Spring Boot 3 (Java) | β |
+| **Database** | PostgreSQL 16 | AWS RDS |
+| **Cache / Pub-Sub** | Redis 7 | AWS ElastiCache / SQS |
+| **Object Storage** | MinIO | AWS S3 |
+| **Identity / Auth** | Keycloak (OIDC) | AWS IAM / Cognito |
+| **Reverse Proxy** | NGINX | AWS CloudFront |
+| **Encryption** | libsodium / TweetNaCl.js | AWS KMS |
+| **ORM** | Hibernate / Spring Data JPA | β |
+| **CLI** | Node.js (npm package) | β |
+| **Containerization** | Docker Compose | AWS ECS / Fargate |
+
+---
+
+## π Getting Started
+
+### Prerequisites
+
+- Docker & Docker Compose
+- Java 21+
+- Node.js 20+
+
+### 1. Clone & Start Infrastructure
+
+```bash
+git clone https://github.com/yourusername/envsync.git
+cd envsync
+docker compose up -d
+# Starts: PostgreSQL, Redis, MinIO, Keycloak, NGINX
+```
+
+### 2. Configure Keycloak
+
+```
+Open http://localhost:8180
+Admin console β Create realm: "envsync"
+Create client: "envsync-api"
+Set redirect URIs: http://localhost:3000/*
+```
+
+### 3. Configure MinIO
+
+```
+Open http://localhost:9001 (MinIO Console)
+Create bucket: "envsync-backups"
+Generate access key β paste into backend .env
+```
+
+### 4. Start the Backend
+
+```bash
+cd backend
+cp .env.example .env # fill in Keycloak + MinIO credentials
+./mvnw spring-boot:run
+# API at http://localhost:8080
+```
+
+### 5. Start the Frontend
+
+```bash
+cd frontend
+npm install
+npm run dev
+# Dashboard at http://localhost:3000
+```
+
+### 6. Install the CLI
+
+```bash
+npm install -g envsync-cli
+
+envsync login # OIDC flow via Keycloak
+envsync init # initialize in your project
+envsync push # push your .env to the vault
+envsync pull # pull latest secrets
+envsync diff # see what changed
+```
+
+---
+
+## π CLI Reference
+
+```bash
+envsync init --project my-app --env development
+envsync push # push local .env β vault
+envsync pull # pull vault β local .env
+envsync diff # diff local vs vault
+envsync log # view audit log
+envsync set DATABASE_URL "postgres://..."
+envsync unset OLD_API_KEY
+envsync envs # list environments (dev/staging/prod)
+envsync history # version history of the vault
+envsync rollback --version 12 # restore a previous vault version
+```
+
+---
+
+## π Project Structure
+
+```
+envsync/
+βββ frontend/ # Next.js 15 dashboard
+β βββ app/
+β β βββ (auth)/ # Keycloak OIDC login flow
+β β βββ dashboard/ # Overview & notifications
+β β βββ projects/ # Project vault management
+β β βββ audit/ # Audit log viewer
+β βββ components/
+β βββ DiffViewer/ # .env diff component
+β βββ VaultEditor/ # Secret CRUD UI
+β
+βββ backend/ # Spring Boot API
+β βββ src/main/java/
+β βββ auth/ # Keycloak + Spring Security OIDC
+β βββ vault/ # Vault CRUD & versioning
+β βββ audit/ # Audit log service
+β βββ notification/ # Redis pub/sub notifications
+β βββ storage/ # MinIO backup service
+β
+βββ cli/ # Node.js CLI tool
+β βββ src/
+β βββ commands/ # push, pull, diff, set, unset, rollback
+β βββ crypto/ # libsodium client-side encryption
+β
+βββ nginx/
+β βββ nginx.conf # Reverse proxy + TLS config
+β
+βββ docker-compose.yml # Full self-hosted stack
+```
+
+---
+
+## π Security Model
+
+EnvSync uses a **zero-knowledge encryption** model:
+
+1. Secret key derived locally from your password using **Argon2**
+2. Secrets encrypted **before** leaving your machine using **XChaCha20-Poly1305**
+3. Server only ever stores ciphertext β it physically cannot read your secrets
+4. Team sharing via asymmetric encryption β each member's public key wraps the vault key
+5. Identity via **Keycloak** β supports MFA, LDAP federation, and social login out of the box
+
+---
+
+
+Built to solve a real problem every dev team faces. No cloud required.
+