diff --git a/.gitignore b/.gitignore
index b2b3a62..65bf8f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-notable
+/notable
 notable.json
 *.exe
 dist/
diff --git a/cmd/notable/main.go b/cmd/notable/main.go
new file mode 100644
index 0000000..f38dfcf
--- /dev/null
+++ b/cmd/notable/main.go
@@ -0,0 +1,52 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/relentlessworks/notable/internal/api"
+	"github.com/relentlessworks/notable/internal/auth"
+	"github.com/relentlessworks/notable/internal/store"
+)
+
+func main() {
+	addr := flag.String("addr", ":8080", "listen address")
+	dbPath := flag.String("db", "notable.json", "path to data file")
+	tokenSecret := flag.String("secret", "", "secret for signing tokens (defaults to random)")
+	flag.Parse()
+
+	// Layered config: defaults < env < flags
+	// Flags take priority if explicitly set; otherwise env overrides defaults
+	if v := os.Getenv("NOTABLE_ADDR"); v != "" && *addr == ":8080" {
+		*addr = v
+	}
+	if v := os.Getenv("NOTABLE_DB"); v != "" && *dbPath == "notable.json" {
+		*dbPath = v
+	}
+	if v := os.Getenv("NOTABLE_SECRET"); v != "" && *tokenSecret == "" {
+		*tokenSecret = v
+	}
+
+	// Initialize store
+	db, err := store.New(*dbPath)
+	if err != nil {
+		log.Fatalf("failed to open database: %v", err)
+	}
+	defer db.Close()
+
+	// Initialize auth
+	authSvc := auth.New(*tokenSecret)
+
+	// Initialize API server
+	srv := api.NewServer(db, authSvc)
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", srv.Router)
+
+	log.Printf("Notable listening on %s", *addr)
+	if err := http.ListenAndServe(*addr, mux); err != nil {
+		log.Fatalf("server error: %v", err)
+	}
+}