diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fb58dee
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.env
+data
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a1fcef0
--- /dev/null
+++ b/README.md
@@ -0,0 +1,18 @@
+# dpsapi Deployment
+Docker PS API — [source/dpsapi](https://git.bjphoster.com/source/dpsapi).
+
+Exposes `GET /api/v1/containers` (the running containers, like `docker ps`) behind a bearer token. Needs the Docker socket and a persistent directory for its SQLite database.
+
+## Usage
+```sh
+cp env.example .env
+# edit .env
+docker compose up -d
+```
+
+Manage tokens and read the audit log with the same binary:
+```sh
+docker compose exec dpsapi /app token new "description"
+docker compose exec dpsapi /app token list
+docker compose exec dpsapi /app audit
+```
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..29e99d9
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,39 @@
+---
+services:
+  dpsapi:
+    image: git.bjphoster.com/source/dpsapi:${DPSAPI_VERSION}
+    restart: unless-stopped
+    environment:
+      - DB_PATH=/data/dpsapi.db
+      - HTTP_ADDR=0.0.0.0
+      - HTTP_PORT=${TRAEFIK_SERVICE_PORT}
+      - LOG_LEVEL=${DPSAPI_LOG_LEVEL}
+    labels:
+      ### Section Træfik
+      - traefik.enable=${TRAEFIK_ENABLED}
+      - traefik.docker.network=${TRAEFIK_NETWORK}
+      ## HTTP
+      - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
+      # redirect to HTTPS only
+      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTP_MIDDLEWARES}
+      - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
+      ## HTTPS
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
+      # configure the exposed service
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
+      # enable TLS and its certificate provider
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
+      # specify a service so a custom port can be used
+      - traefik.http.services.${TRAEFIK_SERVICE}.loadbalancer.server.port=${TRAEFIK_SERVICE_PORT}
+    networks:
+      - traefik
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${DPSAPI_DATA}:/data
+
+networks:
+  traefik:
+    external: true
+    name: ${TRAEFIK_NETWORK}
diff --git a/env.example b/env.example
new file mode 100644
index 0000000..7a87407
--- /dev/null
+++ b/env.example
@@ -0,0 +1,16 @@
+# Træfik
+TRAEFIK_ENABLED=true
+TRAEFIK_NETWORK=traefik
+TRAEFIK_ROUTER=dpsapi_example_com
+TRAEFIK_SERVICE=dpsapi_example_com
+TRAEFIK_SERVICE_PORT=80
+TRAEFIK_MATCHRULE=Host(`dpsapi.example.com`)
+TRAEFIK_TLSENABLED=true
+TRAEFIK_CERTRESOLVER=letsencrypt
+TRAEFIK_HTTP_MIDDLEWARES=http-to-https
+TRAEFIK_HTTPS_MIDDLEWARES=hsts
+
+# dpsapi
+DPSAPI_VERSION=latest
+DPSAPI_DATA=./data
+DPSAPI_LOG_LEVEL=INFO