diff --git a/README.md b/README.md
index 6c766ad..ad3375a 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,20 @@ the nodes already joined to the mesh cluster.
 
 ## Configuration options
 
+All options can be passed either as command-line flags or environment variables:
+
+| Option | Env | Description | Default |
+|---|---|---|---|
+| --cluster-key | WESHER_CLUSTER_KEY | shared key for cluster membership; must be 32 bytes base64 encoded; will be generated if not provided |  |
+| --join | WESHER_JOIN | comma separated list of hostnames or IP addresses to existing cluster members; if not provided, will attempt resuming any known state or otherwise wait for further members |  |
+| --bind-addr | WESHER_BIND_ADDR | IP address to bind to for cluster membership | `0.0.0.0` |
+| --cluster-port | WESHER_CLUSTER_PORT | port used for membership gossip traffic (both TCP and UDP); must be the same across cluster | `7946` |
+| --wireguard-port | WESHER_WIREGUARD_PORT | port used for wireguard traffic (UDP); must be the same across cluster | `51820` |
+| --overlay-net | WESHER_OVERLAY_NET | the network in which to allocate addresses for the overlay mesh network (CIDR format); smaller networks increase the chance of IP collision | `10.0.0.0/8` |
+| --interface | WESHER_INTERFACE | name of the wireguard interface to create and manage | `wgoverlay` |
+| --log-level | WESHER_LOG_LEVEL | set the verbosity (debug/info/warn/error) | `warn` |
+
+
 ## Security considerations
 
 The decision of whom to allow in the mesh is made by [memberlist](github.com/hashicorp/memberlist) and is secured by a
diff --git a/config.go b/config.go
index a635779..728b61b 100644
--- a/config.go
+++ b/config.go
@@ -10,14 +10,14 @@ import (
 const clusterKeyLen = 32
 
 type config struct {
-	LogLevel      string   `desc:"set the verbosity (debug/info/warn/error)" default:"warn"`
-	ClusterKey    []byte   `desc:"shared key for cluster membership; must be 32 bytes base64 encoded; will be generated if not provided"`
-	JoinAddrs     []string `desc:"comma separated list of IP addresses to at least one existing cluster member; if not provided, will attempt resuming any known state or otherwise wait for further members."`
-	BindAddr      string   `desc:"IP address to bind to for cluster membership" default:"0.0.0.0"`
-	ClusterPort   int      `desc:"port used for membership gossip traffic (both TCP and UDP); must be the same across cluster" default:"7946"`
-	WireguardPort int      `desc:"port used for wireguard traffic (UDP); must be the same across cluster" default:"51820"`
-	OverlayNet    *network `desc:"the network in which to allocate addresses for the overlay mesh network (CIDR format); smaller networks increase the chance of IP collision" default:"10.0.0.0/8"`
-	InterfaceName string   `desc:"name of the wireguard interface to create and manage" default:"wgoverlay"`
+	ClusterKey    []byte   `id:"cluster-key" desc:"shared key for cluster membership; must be 32 bytes base64 encoded; will be generated if not provided"`
+	Join          []string `desc:"comma separated list of hostnames or IP addresses to existing cluster members; if not provided, will attempt resuming any known state or otherwise wait for further members."`
+	BindAddr      string   `id:"bind-addr" desc:"IP address to bind to for cluster membership" default:"0.0.0.0"`
+	ClusterPort   int      `id:"cluster-port" desc:"port used for membership gossip traffic (both TCP and UDP); must be the same across cluster" default:"7946"`
+	WireguardPort int      `id:"wireguard-port" desc:"port used for wireguard traffic (UDP); must be the same across cluster" default:"51820"`
+	OverlayNet    *network `id:"overlay-net" desc:"the network in which to allocate addresses for the overlay mesh network (CIDR format); smaller networks increase the chance of IP collision" default:"10.0.0.0/8"`
+	Interface     string   `desc:"name of the wireguard interface to create and manage" default:"wgoverlay"`
+	LogLevel      string   `id:"log-level" desc:"set the verbosity (debug/info/warn/error)" default:"warn"`
 
 	// for easier local testing
 	UseIPAsName bool `default:"false" opts:"hidden"`
diff --git a/main.go b/main.go
index 619d1fa..30e38d9 100644
--- a/main.go
+++ b/main.go
@@ -19,7 +19,7 @@ func main() {
 	}
 	logrus.SetLevel(logLevel)
 
-	wg, err := newWGConfig(config.InterfaceName, config.WireguardPort)
+	wg, err := newWGConfig(config.Interface, config.WireguardPort)
 	if err != nil {
 		logrus.Fatal(err)
 	}
@@ -30,7 +30,7 @@ func main() {
 	}
 
 	nodec, errc := cluster.members() // avoid deadlocks by starting before join
-	if err := cluster.join(config.JoinAddrs); err != nil {
+	if err := cluster.join(config.Join); err != nil {
 		logrus.Fatalf("could not join cluster: %s", err)
 	}