diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..120383c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+.git
+.nuxt
+.output
+node_modules
+*.db
+.env*
+sqlite.db
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..b7783a2
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,34 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.pihkaal.me
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: git.pihkaal.me/pihkaal/pihka-al:latest
+          cache-from: type=registry,ref=git.pihkaal.me/pihkaal/pihka-al:cache
+          cache-to: type=registry,ref=git.pihkaal.me/pihkaal/pihka-al:cache,mode=max
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..5f5960b
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+FROM node:22-alpine AS base
+RUN corepack enable pnpm
+
+FROM base AS deps
+WORKDIR /app
+RUN apk add --no-cache python3 make g++
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+
+FROM base AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN pnpm build
+
+FROM base AS runtime
+WORKDIR /app
+COPY --from=build /app/.output ./.output
+
+ENV NODE_ENV=production
+EXPOSE 3000
+CMD ["node", "./.output/server/index.mjs"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..2261e63
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,38 @@
+services:
+  app:
+    container_name: pihka-al
+    image: git.pihkaal.me/pihkaal/pihka-al:latest
+    restart: unless-stopped
+    environment:
+      - DATABASE_URL=/data/db.sqlite
+      - ADMIN_USERNAME
+      - ADMIN_PASSWORD
+      - REDIRECT_DOMAIN
+      - NUXT_SESSION_PASSWORD
+    volumes:
+      - db:/data
+    networks:
+      - web
+    labels:
+      - traefik.enable=true
+      - traefik.http.services.pihka-al.loadbalancer.server.port=3000
+
+      # dashboard domain
+      - traefik.http.routers.pihka-al-dashboard.rule=Host(`${DASHBOARD_DOMAIN}`)
+      - traefik.http.routers.pihka-al-dashboard.tls.certresolver=myresolver
+      - traefik.http.routers.pihkaal-me.tls=true
+      - traefik.http.routers.pihka-al-dashboard.service=pihka-al
+
+      # redirect domain
+      - traefik.http.routers.pihka-al-redirect.rule=Host(`${REDIRECT_DOMAIN}`)
+      - traefik.http.routers.pihka-al-redirect.tls.certresolver=myresolver
+      - traefik.http.routers.pihkaal-me.tls=true
+      - traefik.http.routers.pihka-al-redirect.service=pihka-al
+      - traefik.http.routers.pihka-al.middlewares=umami-middleware@file
+
+volumes:
+  db:
+
+networks:
+  web:
+    external: true