diff --git a/config/icecast.env.example b/config/icecast.env.example
new file mode 100644
index 0000000..67bb394
--- /dev/null
+++ b/config/icecast.env.example
@@ -0,0 +1,4 @@
+# generate with: openssl rand -hex 24
+ADMIN_PW=replace-me-admin
+SOURCE_PW=replace-me-source
+RELAY_PW=replace-me-relay
diff --git a/config/icecast.xml.tmpl b/config/icecast.xml.tmpl
new file mode 100644
index 0000000..41d4ae7
--- /dev/null
+++ b/config/icecast.xml.tmpl
@@ -0,0 +1,51 @@
+<icecast>
+    <location>denpa.femboy.page</location>
+    <admin>admin@denpa.femboy.page</admin>
+
+    <limits>
+        <clients>100</clients>
+        <sources>16</sources>
+        <queue-size>524288</queue-size>
+        <client-timeout>30</client-timeout>
+        <header-timeout>15</header-timeout>
+        <source-timeout>10</source-timeout>
+        <burst-on-connect>1</burst-on-connect>
+        <burst-size>65535</burst-size>
+    </limits>
+
+    <authentication>
+        <source-password>${SOURCE_PW}</source-password>
+        <relay-password>${RELAY_PW}</relay-password>
+        <admin-user>admin</admin-user>
+        <admin-password>${ADMIN_PW}</admin-password>
+    </authentication>
+
+    <hostname>denpa.femboy.page</hostname>
+
+    <listen-socket>
+        <port>8000</port>
+        <bind-address>0.0.0.0</bind-address>
+    </listen-socket>
+
+    <fileserve>1</fileserve>
+
+    <paths>
+        <basedir>/usr/share/icecast2</basedir>
+        <logdir>/var/log/icecast2</logdir>
+        <webroot>/usr/share/icecast2/web</webroot>
+        <adminroot>/usr/share/icecast2/admin</adminroot>
+        <pidfile>/var/run/icecast2/icecast2.pid</pidfile>
+        <alias source="/" destination="/status.xsl"/>
+    </paths>
+
+    <logging>
+        <accesslog>-</accesslog>
+        <errorlog>-</errorlog>
+        <loglevel>3</loglevel>
+        <logsize>10000</logsize>
+    </logging>
+
+    <security>
+        <chroot>0</chroot>
+    </security>
+</icecast>
diff --git a/scripts/render-config.sh b/scripts/render-config.sh
new file mode 100755
index 0000000..9806a15
--- /dev/null
+++ b/scripts/render-config.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ ! -f config/icecast.env ]; then
+    echo "error: config/icecast.env missing — copy from icecast.env.example and fill in" >&2
+    exit 1
+fi
+
+set -a
+. ./config/icecast.env
+set +a
+
+envsubst '${ADMIN_PW} ${SOURCE_PW} ${RELAY_PW}' \
+    < config/icecast.xml.tmpl \
+    > config/icecast.xml
+
+chmod 0640 config/icecast.xml
+echo "rendered config/icecast.xml"