diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..968929a
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,35 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    # Coolify's Traefik connects on the container network — never publish host
+    # ports. Domain + TLS come from SERVICE_FQDN_APP_8080 substitution below.
+    expose:
+      - "8080"
+    environment:
+      # Coolify substitutes SERVICE_FQDN_<SVC>_<PORT> with the domain from
+      # docker_compose_domains and injects the Traefik router labels.
+      SERVICE_FQDN_APP_8080: /
+      ASPNETCORE_ENVIRONMENT: Production
+      ASPNETCORE_URLS: "http://+:8080"
+      DATA_DIRECTORY: /data
+      # Secrets — set values in Coolify's Environment Variables UI.
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
+      # Optional tuning; Coolify falls back to Dockerfile defaults if unset.
+      EXECUTION_RETENTION_DAYS: ${EXECUTION_RETENTION_DAYS:-7}
+      EXECUTION_KEEP_PER_WORKFLOW: ${EXECUTION_KEEP_PER_WORKFLOW:-500}
+      WEBHOOK_DEFAULT_TIMEOUT_SECONDS: ${WEBHOOK_DEFAULT_TIMEOUT_SECONDS:-30}
+      MAX_CONCURRENT_EXECUTIONS: ${MAX_CONCURRENT_EXECUTIONS:-32}
+    volumes:
+      - vc-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+volumes:
+  vc-data: