diff --git a/config/schema/package.dhall b/config/schema/package.dhall
new file mode 100644
index 0000000..8c01f97
--- /dev/null
+++ b/config/schema/package.dhall
@@ -0,0 +1,12 @@
+{ Schema =
+      ./schema.dhall
+        sha256:1e8d4a3e16af1fa5b9b602a62c59440b933652c04b695095651ee04194b97138
+    ? ./schema.dhall
+, Schema/validate =
+      ./validate.dhall
+        sha256:eb0df6eb95180f502ec1fbdf62ba6010e2cfc82b3dfe75163fa686d98c31eb6b
+    ? ./validate.dhall
+, Prelude =
+    ./prelude.dhall
+      sha256:a6036bc38d883450598d1de7c98ead113196fe2db02e9733855668b18096f07b
+}
diff --git a/config/schema/prelude.dhall b/config/schema/prelude.dhall
new file mode 100644
index 0000000..d5e4db1
--- /dev/null
+++ b/config/schema/prelude.dhall
@@ -0,0 +1,8 @@
+{-
+the env env will only be resolved if this file is imported locally, i.e. for
+local development.
+for remote scenarios the env will fall back to the integrity-protected import.
+-}
+  env:DHALL_PRELUDE
+? https://prelude.dhall-lang.org/v20.2.0/package.dhall
+    sha256:a6036bc38d883450598d1de7c98ead113196fe2db02e9733855668b18096f07b
diff --git a/config/schema/schema.dhall b/config/schema/schema.dhall
new file mode 100644
index 0000000..f82d01b
--- /dev/null
+++ b/config/schema/schema.dhall
@@ -0,0 +1,24 @@
+let Schema =
+    -- | define a configuration schema.
+      { Type =
+          { Host : Text
+          , Port : Natural
+          , AppName : Text
+          , LiveMode : Bool
+          , DevelMode : Bool
+          , SessionCookieName : Optional Text
+          , SessionCookieSecret : Optional Text
+          }
+      , default =
+          -- | have sane defaults.
+          { Host = ""
+          , Port = 3000
+          , AppName = "pcmt"
+          , LiveMode = False
+          , DevelMode = False
+          , SessionCookieName = None Text
+          , SessionCookieSecret = None Text
+          }
+      }
+
+in  Schema
diff --git a/config/schema/validate.dhall b/config/schema/validate.dhall
new file mode 100644
index 0000000..f31da79
--- /dev/null
+++ b/config/schema/validate.dhall
@@ -0,0 +1,27 @@
+let Prelude =
+    {- this will have to get bumped when prelude is updated -}
+      ./prelude.dhall
+        sha256:a6036bc38d883450598d1de7c98ead113196fe2db02e9733855668b18096f07b
+
+let Schema =
+        ./schema.dhall
+          sha256:1e8d4a3e16af1fa5b9b602a62c59440b933652c04b695095651ee04194b97138
+      ? ./schema.dhall
+
+let Schema/validate
+    : Schema.Type -> Type
+    =
+      -- | define validation.
+      \(c : Schema.Type) ->
+        let expected = { validPort = True }
+
+        let actual =
+              { validPort =
+                  -- | make sure port number belongs to the <1;65535> range.
+                      Prelude.Natural.lessThanEqual 1 c.Port
+                  &&  Prelude.Natural.lessThanEqual c.Port 65535
+              }
+
+        in  expected === actual
+
+in  Schema/validate