diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3ed55c9
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+.env
+.env.*
+!.env.example
+data/
diff --git a/README.md b/README.md
index e893d18..6669a1a 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,9 @@
 # ct110-pocket-id
 
-Pocket-ID OIDC IdP compose (CT 110)
\ No newline at end of file
+Pocket-ID OIDC IdP compose for CT 110 (192.168.1.5, id.nuclide.systems).
+
+Auto-synced daily at 03:15 from CT 110.
+
+Stack location: `/opt/stacks/pocketid/`
+
+SQLite DB + signing keys are backed up via Backrest (CT 103, services-backup-plan).
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..359831b
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,32 @@
+services:
+  pocketid:
+    image: ghcr.io/pocket-id/pocket-id:latest
+    container_name: pocket-id
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 512M
+        reservations:
+          cpus: "0.25"
+          memory: 256M
+    env_file: .env
+    ports:
+      - 11000:1411
+    volumes:
+      - /opt/stacks/pocketid/data:/app/data
+    # Optional healthcheck  
+    healthcheck:
+      test: curl -f http://localhost:1411/healthz
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    labels:
+      - "homepage.group=infrastructure"
+      - "homepage.name=PocketID"
+      - "homepage.icon=sh-pocket-id"
+      - "homepage.href=https://id.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:11000"
+      - "homepage.instance.public.href=https://id.nuclide.systems"