diff --git a/.gitea/workflows/site.yaml b/.gitea/workflows/site.yaml
index 562bba3..742c646 100644
--- a/.gitea/workflows/site.yaml
+++ b/.gitea/workflows/site.yaml
@@ -28,3 +28,19 @@ jobs:
         run: |
           docker run --rm --entrypoint sh rezayaghobi-site:${GITHUB_SHA::7} \
             -c 'test -f /usr/share/nginx/html/index.html && test -d /usr/share/nginx/html/assets'
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy
+        run: |
+          export TAG=${GITHUB_SHA::7}
+          docker compose -p portfolio -f deploy/compose.yaml up -d --wait
+      - name: Smoke test
+        run: |
+          curl -fsS http://portfolio:8080/ | grep -qi yaghobi
+          curl -fsSI http://portfolio:8080/ | grep -qi content-security-policy
+          test "$(curl -s -o /dev/null -w '%{http_code}' http://portfolio:8080/README.md)" = 404
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
new file mode 100644
index 0000000..6d7a265
--- /dev/null
+++ b/deploy/compose.yaml
@@ -0,0 +1,45 @@
+services:
+  portfolio:
+    image: rezayaghobi-site:${TAG:?set TAG}
+    container_name: portfolio
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+    networks: [web_net]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=web_net"
+
+      # rezayaghobi.ir
+      - "traefik.http.routers.portfolio.rule=Host(`rezayaghobi.ir`)"
+      - "traefik.http.routers.portfolio.entrypoints=websecure"
+      - "traefik.http.routers.portfolio.tls.certresolver=le"
+      - "traefik.http.routers.portfolio.middlewares=portfolio-hsts"
+      - "traefik.http.routers.portfolio.service=portfolio"
+      - "traefik.http.services.portfolio.loadbalancer.server.port=8080"
+
+      # www -> bare domain
+      - "traefik.http.routers.portfolio-www.rule=Host(`www.rezayaghobi.ir`)"
+      - "traefik.http.routers.portfolio-www.entrypoints=websecure"
+      - "traefik.http.routers.portfolio-www.tls.certresolver=le"
+      - "traefik.http.routers.portfolio-www.middlewares=portfolio-www-redirect"
+      - "traefik.http.routers.portfolio-www.service=noop@internal"
+      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.regex=^https://www\.rezayaghobi\.ir/(.*)'
+      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.replacement=https://rezayaghobi.ir/$${1}'
+      - "traefik.http.middlewares.portfolio-www-redirect.redirectregex.permanent=true"
+
+      # HSTS for this site only
+      - "traefik.http.middlewares.portfolio-hsts.headers.stsseconds=86400"
+
+networks:
+  web_net:
+    external: true