diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..45d7514
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+node_modules
+dist
+data
+uploads
+.env
+.git
+docs
+assets-src
+tests
+*.md
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a5963b9
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,23 @@
+# Stage 1: build
+FROM node:22-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# Stage 2: runtime
+FROM node:22-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+COPY --from=build /app/dist ./dist
+COPY scripts ./scripts
+
+ENV HOST=0.0.0.0 \
+    PORT=4321 \
+    DB_PATH=/app/data/insanitylab.db \
+    UPLOADS_DIR=/app/uploads
+EXPOSE 4321
+CMD ["node", "./dist/server/entry.mjs"]
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..0c9faeb
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,29 @@
+services:
+  insanitylab:
+    build: .
+    image: insanitylab-website:latest
+    container_name: insanitylab
+    restart: always
+    env_file:
+      - .env
+    environment:
+      - HOST=0.0.0.0
+      - PORT=4321
+      - DB_PATH=/app/data/insanitylab.db
+      - UPLOADS_DIR=/app/uploads
+    volumes:
+      - /opt/docker/insanitylab/data:/app/data
+      - /opt/docker/insanitylab/uploads:/app/uploads
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.insanitylab.rule=Host(`insanitylab.tielogic.xyz`)
+      - traefik.http.routers.insanitylab.tls=true
+      - traefik.http.routers.insanitylab.entrypoints=websecure
+      - traefik.http.routers.insanitylab.tls.certresolver=mytlschallenge
+      - traefik.http.services.insanitylab.loadbalancer.server.port=4321
+    networks:
+      - traefik
+
+networks:
+  traefik:
+    external: true