diff --git a/README.md b/README.md
index ee6670e..92fd4f6 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,30 @@
 # hcloud-k8s
 
+My Kubernetes cluster on Hetzner Cloud. Uses [hcloud-k8s/kubernetes/hcloud](https://registry.terraform.io/modules/hcloud-k8s/kubernetes/hcloud/latest) terraform module which runs Talos Linux (no SSH, API-only, immutable OS).
+
+## What's in here
+
+- 1 control plane + 2 workers (cx23, Helsinki)
+- Cilium CNI with WireGuard encryption
+- cert-manager for TLS
+- Traefik ingress
+- State stored in Hetzner Object Storage (S3)
+
+## Setup
+
+```bash
+cp terraform.tfvars.example terraform.tfvars
+# fill in your hcloud token
+
+cp backend.conf.example backend.conf
+# fill in s3 access_key and secret_key
+
+terraform init -backend-config=backend.conf
+terraform apply
+```
+
+Kubeconfig gets written to `./kubeconfig` after apply.
+
+## Scaling to HA
+
+Change control plane `count` from 1 to 3 in `main.tf` and re-apply. Talos handles etcd member joining automatically.
diff --git a/backend.conf.example b/backend.conf.example
new file mode 100644
index 0000000..24a9be9
--- /dev/null
+++ b/backend.conf.example
@@ -0,0 +1,2 @@
+access_key = ""
+secret_key = ""