diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..bb9b8b2
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+node_modules
+dist
+data
+keys
+.env
+.git
+*.log
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c823302
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,39 @@
+# ── Build stage ──────────────────────────────────────────────────────────────
+FROM node:22-slim AS builder
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci
+
+COPY nest-cli.json tsconfig*.json ./
+COPY src ./src
+RUN npm run build
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM node:22-slim AS runtime
+
+# Playwright / Chromium system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    chromium \
+    fonts-noto \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Tell Playwright to use the system Chromium instead of downloading its own
+ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci --omit=dev
+
+COPY --from=builder /app/dist ./dist
+
+# Runtime directories (keys and SQLite DB mounted via volumes)
+RUN mkdir -p data keys
+
+EXPOSE 3000
+
+CMD ["node", "dist/main"]
diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 0000000..468e010
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,15 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "13000:3000"
+    env_file:
+      - .env
+    volumes:
+      # persist SQLite database across restarts
+      - ./data:/app/data
+      # mount key files into the container
+      - ./keys:/app/keys
+    restart: unless-stopped