diff --git a/.gitignore b/.gitignore
index f8268b5..ea894d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ master.xprv.enc
 .pytest_cache/
 *.egg-info/
 logs/
+data/
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..2274cef
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,11 @@
+# SITE_ADDRESS is the domain to serve (e.g. lottery.example.com) — Caddy
+# automatically requests a Let's Encrypt certificate for it.
+#
+# Left at the default "localhost" (dev mode, no domain), Caddy detects it's
+# not a public hostname and issues a locally-trusted self-signed certificate
+# instead, via its internal CA. Browsers will still warn on first visit
+# unless that CA is explicitly trusted — expected for local/dev use.
+{$SITE_ADDRESS:localhost} {
+	encode gzip
+	reverse_proxy app:8123
+}
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7009713
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,33 @@
+services:
+  app:
+    build: .
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      - DATABASE_URL=sqlite+aiosqlite:////app/db_data/plm_lottery.db
+      - MASTER_KEY_PATH=/app/key_data/master.xprv.enc
+    volumes:
+      - ./data/db:/app/db_data
+      - ./data/keys:/app/key_data
+      - ./data/logs:/app/logs
+    expose:
+      - "8123"
+
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - SITE_ADDRESS=${SITE_ADDRESS:-localhost}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - app
+
+volumes:
+  caddy_data:
+  caddy_config: