diff --git a/custom_helm_charts/gluetun/README.md b/custom_helm_charts/gluetun/README.md
new file mode 100644
index 0000000..67727bf
--- /dev/null
+++ b/custom_helm_charts/gluetun/README.md
@@ -0,0 +1,20 @@
+# Usenet stack (Gluetun + NZBGet)
+
+Service endpoints:
+- NZBGet UI: nzbget.default.svc.cluster.local:6789
+- Gluetun HTTP proxy: gluetun.default.svc.cluster.local:8888
+
+AirVPN WireGuard values:
+- Update `helm-values/gluetun_values.yaml`:
+  - `secret.privateKey` -> AirVPN WireGuard private key
+  - `secret.addresses` -> WireGuard tunnel address(es) (IPv4 /32 and optional IPv6)
+  - `env.SERVER_HOSTNAMES` -> stable AirVPN server hostname
+- Alternatively set `secret.create: false` and provide a Secret named `gluetun-wireguard` with keys `WIREGUARD_PRIVATE_KEY` and `WIREGUARD_ADDRESSES`.
+
+Validation:
+- ArgoCD health: `argocd app get gluetun` and `argocd app get nzbget`
+- WireGuard up: `kubectl -n default logs deploy/gluetun | rg -i "wireguard|tunnel"`
+- VPN egress from NZBGet: `kubectl -n default exec deploy/nzbget -- curl -s ifconfig.me`
+- NZBGet UI: `kubectl -n default port-forward deploy/nzbget 6789:6789`
+
+Note: NZBGet is configured to use the HTTP proxy via `HTTP_PROXY`/`HTTPS_PROXY`. If your NNTP traffic does not honor proxy settings, consider using a proxy-aware downloader or running the downloader in the same pod as Gluetun.