diff --git a/libs/config/lib.rs b/libs/config/lib.rs
index e2ca702..dce6424 100644
--- a/libs/config/lib.rs
+++ b/libs/config/lib.rs
@@ -22,7 +22,8 @@ impl AppConfig {
                 }
             }
         }
-        env = env.into_iter().chain(std::env::vars()).collect();
+        // Environment variables (e.g. K8s injected APP_DOMAIN_URL) take precedence over .env files
+        env = std::env::vars().chain(env).collect();
         let this = AppConfig { env };
         if let Err(config) = GLOBAL_CONFIG.set(this) {
             eprintln!("Failed to set global config: {:?}", config);
@@ -47,3 +48,4 @@ pub mod qdrant;
 pub mod redis;
 pub mod smtp;
 pub mod ssh;
+pub mod storage;
diff --git a/libs/config/storage.rs b/libs/config/storage.rs
new file mode 100644
index 0000000..8f2584c
--- /dev/null
+++ b/libs/config/storage.rs
@@ -0,0 +1,39 @@
+use crate::AppConfig;
+
+impl AppConfig {
+    pub fn storage_path(&self) -> String {
+        self.env
+            .get("STORAGE_PATH")
+            .cloned()
+            .unwrap_or_else(|| "/data/files".to_string())
+    }
+
+    pub fn storage_public_url(&self) -> String {
+        self.env
+            .get("STORAGE_PUBLIC_URL")
+            .cloned()
+            .unwrap_or_else(|| "/files".to_string())
+    }
+
+    pub fn storage_max_file_size(&self) -> usize {
+        self.env
+            .get("STORAGE_MAX_FILE_SIZE")
+            .and_then(|s| s.parse::<usize>().ok())
+            .unwrap_or(10 * 1024 * 1024) // 10MB default
+    }
+
+    pub fn vapid_public_key(&self) -> Option<String> {
+        self.env.get("VAPID_PUBLIC_KEY").cloned()
+    }
+
+    pub fn vapid_private_key(&self) -> Option<String> {
+        self.env.get("VAPID_PRIVATE_KEY").cloned()
+    }
+
+    pub fn vapid_sender_email(&self) -> String {
+        self.env
+            .get("VAPID_SENDER_EMAIL")
+            .cloned()
+            .unwrap_or_else(|| "mailto:admin@example.com".to_string())
+    }
+}