diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
new file mode 100644
index 0000000..9faccad
--- /dev/null
+++ b/.gitea/workflows/deploy.yaml
@@ -0,0 +1,89 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Stack
+        run: |
+          curl -sSL https://get.haskellstack.org/ | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Cache Stack root
+        uses: actions/cache@v4
+        with:
+          path: ~/.stack
+          key: stack-${{ hashFiles('stack.yaml', 'package.yaml') }}
+          restore-keys: stack-
+
+      - name: Install fourmolu
+        run: |
+          FOURMOLU_URL=https://github.com/fourmolu/fourmolu/releases/download/v0.19.0.1/fourmolu-0.19.0.1-linux-x86_64
+          curl -fsSL "$FOURMOLU_URL" -o /usr/local/bin/fourmolu
+          chmod +x /usr/local/bin/fourmolu
+
+      - name: Check formatting
+        run: fourmolu --mode check app/ src/ test/
+
+      - name: Lint
+        run: stack exec -- hlint app/ src/ test/
+
+      - name: Build
+        run: stack build --copy-bins --local-bin-path ./dist
+
+      - name: Run tests
+        run: stack test
+
+      - name: Login to Gitea Container Registry
+        env:
+          CONTAINER_REGISTRY_TOKEN: ${{ secrets.CONTAINER_REGISTRY_TOKEN }}
+        run: |
+          if [ -z "$CONTAINER_REGISTRY_TOKEN" ]; then
+            echo "CONTAINER_REGISTRY_TOKEN not set, skipping Docker publish"
+            exit 0
+          fi
+          echo "$CONTAINER_REGISTRY_TOKEN" | docker login git.roo.lol -u ${{ github.actor }} --password-stdin
+
+      - name: Build and push Docker image
+        env:
+          CONTAINER_REGISTRY_TOKEN: ${{ secrets.CONTAINER_REGISTRY_TOKEN }}
+        run: |
+          if [ -z "$CONTAINER_REGISTRY_TOKEN" ]; then
+            echo "CONTAINER_REGISTRY_TOKEN not set, skipping Docker publish"
+            exit 0
+          fi
+          cp ./dist/roux-server .
+          docker build \
+            -t git.roo.lol/${{ github.repository }}:latest \
+            -t git.roo.lol/${{ github.repository }}:${{ github.sha }} \
+            .
+          docker push git.roo.lol/${{ github.repository }}:latest
+          docker push git.roo.lol/${{ github.repository }}:${{ github.sha }}
+
+      - name: Deploy to production
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
+        run: |
+          if [ -z "$DEPLOY_KEY" ] || [ -z "$DEPLOY_USER" ] || [ -z "$DEPLOY_HOST" ] || [ -z "$DEPLOY_DIRECTORY" ]; then
+            [ -z "$DEPLOY_KEY" ] && echo "MISSING SECRET: DEPLOY_KEY"
+            [ -z "$DEPLOY_USER" ] && echo "MISSING VAR: DEPLOY_USER"
+            [ -z "$DEPLOY_HOST" ] && echo "MISSING VAR: DEPLOY_HOST"
+            [ -z "$DEPLOY_DIRECTORY" ] && echo "MISSING VAR: DEPLOY_DIRECTORY"
+            echo "Deploy secrets not fully set, skipping deployment"
+            exit 0
+          fi
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd $DEPLOY_DIRECTORY && docker compose pull && docker compose down && docker compose up -d"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..87f21e7
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+# Build timestamp — read at runtime for diagnostics.
+RUN mkdir -p /build && date -u '+%Y-%m-%d %H:%M UTC' > /build/build-time
+
+ADD roux-server /usr/local/bin/roux-server
+
+RUN chmod +x /usr/local/bin/roux-server
+
+ENTRYPOINT ["/usr/bin/tini", "-s", "--"]
+
+# Recipes are mounted at /recipes at runtime via docker-compose volume mount.
+RUN mkdir /recipes
+WORKDIR /recipes
+
+EXPOSE 8080
+
+CMD ["/usr/local/bin/roux-server", "--host", "0.0.0.0", "--port", "8080", "--recipe-dir", "/recipes"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..481bf41
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,9 @@
+services:
+  roux-server:
+    image: git.roo.lol/jbrechtel/roux:latest
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - /srv/roux/recipes:/recipes:ro
+      - /srv/roux/data:/data