diff --git a/.gitignore b/.gitignore
index 018255f..788dc3e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@ Thumbs.db
 .env
 .env.*
 !.env.example
+!.env.*.example
diff --git a/deploy/compose/.env.remote-speaker-tls.example b/deploy/compose/.env.remote-speaker-tls.example
new file mode 100644
index 0000000..7b12fa7
--- /dev/null
+++ b/deploy/compose/.env.remote-speaker-tls.example
@@ -0,0 +1,11 @@
+# TLS для Traefik (profile production). Скопируйте в .env.remote-speaker-tls
+
+# FQDN agent API (DNS only в Cloudflare → IP этой VPS)
+AGENT_DOMAIN=bgp-dc2.example.com
+
+# Let's Encrypt + Cloudflare DNS challenge (как evobgp-edge на CP)
+LETSENCRYPT_EMAIL=ops@example.com
+CF_DNS_API_TOKEN=
+
+# IP основного сервера (Panel) — единственный источник wake-up / health
+PANEL_IP_WHITELIST=203.0.113.1/32
diff --git a/deploy/compose/.env.remote-speaker.example b/deploy/compose/.env.remote-speaker.example
new file mode 100644
index 0000000..d9d87bd
--- /dev/null
+++ b/deploy/compose/.env.remote-speaker.example
@@ -0,0 +1,22 @@
+# Скопируйте в .env.remote-speaker рядом с docker-compose.remote-speaker.yaml
+# Значения agent_secret и node token — из Web UI после создания спикера.
+
+EVOBGP_REGISTRY=git.shts.su/denozord
+EVOBGP_IMAGE_TAG=latest
+
+# Control plane (HTTPS в prod)
+EVOBGP_CONTROL_PLANE_URL=https://cp.example.com:8080
+
+# Из карточки спикера в панели
+EVOBGP_SPEAKER_ID=00000000-0000-0000-0000-000000000001
+EVOBGP_AGENT_SECRET=change-me-from-ui-once
+EVOBGP_NODE_TOKEN=evobgp_node_token_from_access
+
+# GET /v1/bundle/signing-public-key (operator) или env CP EVOBGP_BUNDLE_SEED_HEX
+EVOBGP_BUNDLE_PUBKEY_BASE64=
+
+# Fallback polling (profile fallback)
+EVOBGP_SYNC_INTERVAL_SEC=300
+
+# Lab profile plain — порт agent на хосте
+EVOBGP_AGENT_PORT=8443
diff --git a/scripts/validate-remote-speaker-compose.sh b/scripts/validate-remote-speaker-compose.sh
index 45617ea..1c097f2 100644
--- a/scripts/validate-remote-speaker-compose.sh
+++ b/scripts/validate-remote-speaker-compose.sh
@@ -1,26 +1,42 @@
 #!/bin/sh
-# Validates docker-compose.remote-speaker.yaml with example env files.
+# Validates docker-compose.remote-speaker.yaml (same gates as CI job go).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 COMPOSE="$ROOT/deploy/compose/docker-compose.remote-speaker.yaml"
-ENV1="$ROOT/deploy/compose/.env.remote-speaker.example"
-ENV2="$ROOT/deploy/compose/.env.remote-speaker-tls.example"
 
 if ! command -v docker >/dev/null 2>&1; then
   echo "validate-remote-speaker-compose: docker not found, skipping"
   exit 0
 fi
 
-# Mock required vars for compose config (not used at runtime).
-export EVOBGP_AGENT_SECRET=ci-test-secret
-export EVOBGP_CONTROL_PLANE_URL=https://cp.example.com
-export EVOBGP_NODE_TOKEN=ci-test-token
-export EVOBGP_SPEAKER_ID=00000000-0000-0000-0000-000000000001
-export EVOBGP_BUNDLE_PUBKEY_BASE64=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-export AGENT_DOMAIN=agent.ci.example.com
-export LETSENCRYPT_EMAIL=ci@example.com
-export CF_DNS_API_TOKEN=ci-token
-export PANEL_IP_WHITELIST=127.0.0.1/32
+if [ ! -f "$COMPOSE" ]; then
+  echo "validate-remote-speaker-compose: missing $COMPOSE" >&2
+  exit 1
+fi
 
-docker compose -f "$COMPOSE" --env-file "$ENV1" --env-file "$ENV2" config >/dev/null
+# Required compose interpolation vars (CI mock values).
+export EVOBGP_REGISTRY="${EVOBGP_REGISTRY:-git.shts.su/denozord}"
+export EVOBGP_IMAGE_TAG="${EVOBGP_IMAGE_TAG:-latest}"
+export EVOBGP_AGENT_SECRET="${EVOBGP_AGENT_SECRET:-ci-test-secret}"
+export EVOBGP_CONTROL_PLANE_URL="${EVOBGP_CONTROL_PLANE_URL:-https://cp.example.com}"
+export EVOBGP_NODE_TOKEN="${EVOBGP_NODE_TOKEN:-ci-test-token}"
+export EVOBGP_SPEAKER_ID="${EVOBGP_SPEAKER_ID:-00000000-0000-0000-0000-000000000001}"
+export EVOBGP_BUNDLE_PUBKEY_BASE64="${EVOBGP_BUNDLE_PUBKEY_BASE64:-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=}"
+export AGENT_DOMAIN="${AGENT_DOMAIN:-agent.ci.example.com}"
+export LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL:-ci@example.com}"
+export CF_DNS_API_TOKEN="${CF_DNS_API_TOKEN:-ci-token}"
+export PANEL_IP_WHITELIST="${PANEL_IP_WHITELIST:-127.0.0.1/32}"
+
+# Optional: merge example env files when present (local/docs parity).
+ENV_ARGS=""
+for f in \
+  "$ROOT/deploy/compose/.env.remote-speaker.example" \
+  "$ROOT/deploy/compose/.env.remote-speaker-tls.example"; do
+  if [ -f "$f" ]; then
+    ENV_ARGS="$ENV_ARGS --env-file $f"
+  fi
+done
+
+# shellcheck disable=SC2086
+docker compose -f "$COMPOSE" $ENV_ARGS config >/dev/null
 echo "validate-remote-speaker-compose: ok"