diff --git a/.gitignore b/.gitignore
index 2eafc67..47d32df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 /result-*
 /bin
 /data
-/config.toml*
+/config*.toml*
diff --git a/Dockerfile b/Dockerfile
index a55d63b..3e79c29 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,7 +35,7 @@ WORKDIR /app
 RUN mkdir /app/data
 COPY conf/supervisord.conf /app/supervisord.conf
 COPY conf/Caddyfile /app/Caddyfile
-COPY conf/config.toml.example /app/config.toml
+COPY conf/config.example.toml /app/config.toml
 
 # Caddy ports:
 EXPOSE 80/tcp 443/tcp 443/udp 2019/tcp
diff --git a/conf/config.example.toml b/conf/config.example.toml
index 6c1dc54..dc6e872 100644
--- a/conf/config.example.toml
+++ b/conf/config.example.toml
@@ -1,33 +1,45 @@
-# log-format = "datetime+message"
+# Unless otherwise noted, every value in this file is the same
+# as the intrinsic default value.
 
-# [listen]
-# pages = "tcp/:3000"
-# caddy = "tcp/:3001" # or "-" to disable
-# health = "tcp/:3002"
+log-format = "datetime+message"
 
-# [[wildcard]]
-# domain = "codeberg.page"
-# clone-url = "https://codeberg.org/<user>/<project>.git"
-# index-repos = ["<user>.codeberg.page", "pages"]
-# fallback-proxy-to = "https://codeberg.page"
+[listen]
+# Use "-" to turn off the listener.
+pages = "tcp/:3000"
+caddy = "tcp/:3001"
+health = "tcp/:3002"
 
-# [backend]
-# type = "fs"
+[[wildcard]] # non-default section
+domain = "codeberg.page"
+clone-url = "https://codeberg.org/<user>/<project>.git"
+index-repos = ["<user>.codeberg.page", "pages"]
+fallback-proxy-to = "https://codeberg.page"
 
-# [backend.fs]
-# root = "./data"
+[backend]
+type = "fs"
 
-# [backend.s3]
-# endpoint = "play.min.io"
-# access-key-id = "Q3AM3UQ867SPQQA43P2F"
-# secret-access-key = "zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG"
-# region = "us-east-1"
-# bucket = "git-pages-demo"
+[backend.fs]
+root = "./data"
 
-# [limits]
-# max-site-size = "128M"
-# max-manifest-size = "1M"
-# max-inline-file-size = "256B"
-# git-large-object-threshold = "1M"
-# max-symlink-depth = 16
-# update-timeout = "60s"
+[backend.s3] # non-default bucket configuration
+endpoint = "play.min.io"
+access-key-id = "Q3AM3UQ867SPQQA43P2F"
+secret-access-key = "zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG"
+region = "us-east-1"
+bucket = "git-pages-demo"
+
+[backend.s3.blob-cache]
+max-size = "256MB"
+
+[backend.s3.site-cache]
+max-size = "16MB"
+max-age = "60s"
+
+[limits]
+max-site-size = "128M"
+max-manifest-size = "1M"
+max-inline-file-size = "256B"
+git-large-object-threshold = "1M"
+max-symlink-depth = 16
+update-timeout = "60s"
+max-heap-size-ratio = 0.5
diff --git a/fly.toml b/fly.toml
index 09a96c0..dfa5d20 100644
--- a/fly.toml
+++ b/fly.toml
@@ -1,9 +1,10 @@
 # Requires secrets to be set:
+#  - ACME_EMAIL
 #  - S3_ENDPOINT
 #  - S3_ACCESS_KEY_ID
 #  - S3_SECRET_ACCESS_KEY
 #  - S3_BUCKET
-#  - GIT_PAGES_CONFIG
+#  - PAGES_CONFIG
 
 [build]
 dockerfile = "Dockerfile"
@@ -23,7 +24,7 @@ AUTOMEMLIMIT = "0.25"
 
 [[files]]
 guest_path = "/app/config.toml"
-secret_name = "GIT_PAGES_CONFIG"
+secret_name = "PAGES_CONFIG"
 
 [[services]]
 internal_port = 80
diff --git a/src/main.go b/src/main.go
index 91af40c..1b6af78 100644
--- a/src/main.go
+++ b/src/main.go
@@ -79,9 +79,12 @@ func serve(listener net.Listener, serve func(http.ResponseWriter, *http.Request)
 func main() {
 	InitObservability()
 
-	configPath := flag.String("config", "config.toml", "path to configuration file")
-	printConfig := flag.Bool("print-config", false, "print final configuration as JSON")
-	getManifest := flag.String("get-manifest", "", "retrieve manifest for web root as ProtoJSON")
+	configPath := flag.String("config", "config.toml",
+		"path to configuration file")
+	checkConfig := flag.Bool("check-config", false,
+		"validate configuration, print it as JSON, and exit")
+	getManifest := flag.String("get-manifest", "",
+		"retrieve manifest for web root as ProtoJSON")
 	flag.Parse()
 
 	if err := ReadConfig(*configPath); err != nil {
@@ -89,7 +92,7 @@ func main() {
 	}
 	UpdateConfigEnv() // environment takes priority
 
-	if *printConfig {
+	if *checkConfig {
 		configJSON, _ := json.MarshalIndent(&config, "", "  ")
 		fmt.Println(string(configJSON))
 		return