diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b0f7ee0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+FROM python:3.12-alpine
+
+RUN adduser -D -H app
+WORKDIR /app
+
+COPY app/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app/ .
+USER app
+
+ENV PORT=8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:${PORT}/health || exit 1
+
+CMD ["python", "main.py"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7f23828
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,33 @@
+services:
+  cal-funnel:
+    build: .
+    image: cal-funnel:latest
+    container_name: cal-funnel
+    restart: unless-stopped
+    env_file:
+      - .env
+    networks:
+      - proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=proxy
+
+      # HTTPS router
+      - traefik.http.routers.cal-funnel.rule=Host(`${TRAEFIK_HOST}`)
+      - traefik.http.routers.cal-funnel.entrypoints=websecure
+      - traefik.http.routers.cal-funnel.tls=true
+      - traefik.http.routers.cal-funnel.tls.certresolver=${TRAEFIK_CERT_RESOLVER}
+
+      # HTTP -> HTTPS redirect
+      - traefik.http.routers.cal-funnel-http.rule=Host(`${TRAEFIK_HOST}`)
+      - traefik.http.routers.cal-funnel-http.entrypoints=web
+      - traefik.http.routers.cal-funnel-http.middlewares=cal-funnel-redirect
+      - traefik.http.middlewares.cal-funnel-redirect.redirectscheme.scheme=https
+      - traefik.http.middlewares.cal-funnel-redirect.redirectscheme.permanent=true
+
+      # Backend
+      - traefik.http.services.cal-funnel.loadbalancer.server.port=${PORT:-8080}
+
+networks:
+  proxy:
+    external: true