diff --git a/doc/config.md b/doc/config.md
new file mode 100644
index 0000000..548852c
--- /dev/null
+++ b/doc/config.md
@@ -0,0 +1,44 @@
+# Pkgsite - Environment Variables
+
+Pkgsite uses these environment variables:
+
+| Environment Variable                 | Description                                                                                                                                                                                                                                                                                                                        |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| GO_DISCOVERY_AUTH_VALUES             | Set of values that could be set on the AuthHeader, in order to bypass checks by the cache.                                                                                                                                                                                                                                         |
+| GO_DISCOVERY_CONFIG_BUCKET           | Bucket use for dynamic configuration (gs://bucket/object) GO_DISCOVERY_CONFIG_DYNAMIC must be set if GO_DISCOVERY_CONFIG_BUCKET is set.                                                                                                                                                                                            |
+| GO_DISCOVERY_CONFIG_DYNAMIC          | File that experiments are read from. Can be set locally using devtools/cmd/create_experiment_config/main.go.                                                                                                                                                                                                                       |
+| GO_DISCOVERY_DATABASE_HOST           | Database server hostname.                                                                                                                                                                                                                                                                                                          |
+| GO_DISCOVERY_DATABASE_NAME           | Name of database within the server.                                                                                                                                                                                                                                                                                                |
+| GO_DISCOVERY_DATABASE_PASSWORD       | Password for database.                                                                                                                                                                                                                                                                                                             |
+| GO_DISCOVERY_DATABASE_SECONDARY_HOST | If `GO_DISCOVERY_DATABASE_HOST` is unreachable, use this host. Used only by prod and beta frontends.                                                                                                                                                                                                                               |
+| GO_DISCOVERY_DATABASE_USER           | Used for frontend, worker and scripts.                                                                                                                                                                                                                                                                                             |
+| GO_DISCOVERY_DISABLE_ERROR_REPORTING | Disables calls to GCP errorreporting API. Set only in dev.                                                                                                                                                                                                                                                                         |
+| GO_DISCOVERY_E2E_AUTHORIZATION       | Auth token for e2e tests.                                                                                                                                                                                                                                                                                                          |
+| GO_DISCOVERY_E2E_BASE_URL            | Prefix for URLs in e2e tests.                                                                                                                                                                                                                                                                                                      |
+| GO_DISCOVERY_E2E_QUOTA_BYPASS        | Special value for bypassing quota limitations in e2e test.                                                                                                                                                                                                                                                                         |
+| GO_DISCOVERY_E2E_TEST_PORT           | Port of headless browser in e2e test.                                                                                                                                                                                                                                                                                              |
+| GO_DISCOVERY_ENABLE_QUOTA            | Whether the quota check is enabled. Set in all environments (except exp). The motivation for keeping this is that if the quota system somehow breaks in a way that restricts a lot of traffic unintentionally, we could quickly disable it. That seems unlikely (the quota system fails open, not closed) so we could remove this. |
+| GO_DISCOVERY_EXCLUDED_FILENAME       | Path to the file of excluded prefixes. Read by the worker to populate the DB. We could hardcode this.                                                                                                                                                                                                                              |
+| GO_DISCOVERY_FRONTEND_TASK_QUEUE     | Task queue used by frontend service for frontend fetch.                                                                                                                                                                                                                                                                            |
+| GO_DISCOVERY_GAE_LOCATION_ID         | LocationID is essentially hard-coded until we figure out a good way to determine it programmatically, but we check an environment variable in case it needs to be overridden.                                                                                                                                                      |
+| GO_DISCOVERY_GOOGLE_TAG_MANAGER_ID   | Used by frontend templates to send data to GTM.                                                                                                                                                                                                                                                                                    |
+| GO_DISCOVERY_LARGE_MODULES_LIMIT     | Represents the number of large modules that we are willing to enqueue at a given time.                                                                                                                                                                                                                                             |
+| GO_DISCOVERY_LOG_LEVEL               | Used to set the log level output from servers when developing to reduce noise. Defaults to debug.                                                                                                                                                                                                                                  |
+| GO_DISCOVERY_MAX_IN_FLIGHT_ZIP_MI    | Used for load shedding. Hardcoded in worker docker file and prevents workers from getting overloaded and crashing.                                                                                                                                                                                                                 |
+| GO_DISCOVERY_MAX_MODULE_ZIP_MI       | Used for load shedding - doesn’t seem to ever be set. Useful if worker is always dying on a specific large module. Set to stop this module.                                                                                                                                                                                        |
+| GO_DISCOVERY_NPX_CMD                 | Used for local development to set npx command location.                                                                                                                                                                                                                                                                            |
+| GO_DISCOVERY_ON_GKE                  | Used to figure out what to set for cfg.MonitoredResource.                                                                                                                                                                                                                                                                          |
+| GO_DISCOVERY_PROBER_AUTH_VALUE       | Used to set the prober auth value in order to bypass quota.                                                                                                                                                                                                                                                                        |
+| GO_DISCOVERY_QUEUE_AUDIENCE          | QueueAudience is used to allow the Cloud Tasks queue to authorize itself to the worker. It should be the OAuth 2.0 client ID associated with the IAP that is gating access to the worker.                                                                                                                                          |
+| GO_DISCOVERY_QUEUE_URL               | QueueURL is the URL that the Cloud Tasks queue should send requests to. It should be used when the worker is not on AppEngine.                                                                                                                                                                                                     |
+| GO_DISCOVERY_QUOTA_QPS               | Part of QuotaSettings -- allowed queries per second, per IP block.                                                                                                                                                                                                                                                                 |
+| GO_DISCOVERY_QUOTA_RECORD_ONLY       | Part of QuotaSettings -- Record data about blocking, but do not actually block. This is a \*bool, so we can distinguish "not present" from "false" in an override.                                                                                                                                                                 |
+| GO_DISCOVERY_REDIS_HOST              | Configuration for redis page cache.                                                                                                                                                                                                                                                                                                |
+| GO_DISCOVERY_REDIS_PORT              | Configuration for redis page cache.                                                                                                                                                                                                                                                                                                |
+| GO_DISCOVERY_SERVE_STATS             | ServeStats determines whether the server has an endpoint that serves statistics for benchmarking or other purposes.                                                                                                                                                                                                                |
+| GO_DISCOVERY_SERVICE                 | GAE app service ID. Used for Kubernetes in the private repo. Set in run_local in queue configuration in private repo. Used to identify service in the logs.                                                                                                                                                                        |
+| GO_DISCOVERY_TESTDB                  | When running `go test ./...`, database tests will not run if you don't have postgres running. To run these tests, set `GO_DISCOVERY_TESTDB=true`.                                                                                                                                                                                  |
+| GO_DISCOVERY_USE_EXP_AUTH            | Tell the auth client in the prober to use exp project credentials.                                                                                                                                                                                                                                                                 |
+| GO_DISCOVERY_USE_PROFILER            | UseProfiler specifies whether to enable Stackdriver Profiler.                                                                                                                                                                                                                                                                      |
+| GO_DISCOVERY_WORKER_TASK_QUEUE       | Name of the worker task queue.                                                                                                                                                                                                                                                                                                     |
+| GO_DISCOVERY_WORKER_TIMEOUT_MINUTES  | Timeout for the worker source client.                                                                                                                                                                                                                                                                                              |