diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..5f30f7f
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+./_site
+./deploy.sh
+./Dockerfile
+./docker-compose.yml
diff --git a/Caddyfile b/Caddyfile
index c9b336f..630fde0 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,9 +1,8 @@
 {
   # acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
+  # no logging policy, don't log anything
   log {
-    output file /var/log/caddy {
-      roll_keep 16
-    }
+    output discard
   }
 }
 
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..99e18e5
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,12 @@
+FROM denoland/deno:alpine as build-stage
+WORKDIR /app
+
+COPY . /app/
+RUN apk update && apk add bash
+RUN deno run -A https://deno.land/x/lume/install.ts
+RUN ./build.sh
+
+FROM caddy:2.4.6-alpine
+
+COPY --from=build-stage /app/_site /var/www/miom.space/
+COPY --from=build-stage /app/Caddyfile /etc/caddy/Caddyfile
diff --git a/build.sh b/build.sh
index ba3af75..00d354e 100755
--- a/build.sh
+++ b/build.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+rm -rf ./_site
 lume
 cp -r ./fonts ./_site/
 rm -rf ./_site/README
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..4273e93
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# abort on first error
+set -e
+
+TAG="$1"
+
+if [[ -z "$TAG" ]]; then
+  echo
+  echo "Error: please provide a docker image tag as second argument, e.g.:"
+  echo "./deploy.sh 1.0.0"
+  echo
+  exit 1
+fi
+
+# Workaround for SSL: CERTIFICATE_VERIFY_FAILED error with docker-compose
+if [ -z "$CURL_CA_BUNDLE" ]; then
+  if [ ! -f ~/Downloads/cacert-2021-10-26.pem ]; then
+    curl https://curl.se/ca/cacert-2021-10-26.pem -o ~/Downloads/cacert-2021-10-26.pem
+  fi
+  export CURL_CA_BUNDLE=~/Downloads/cacert-2021-10-26.pem
+fi
+
+# make sure we're using the local docker host first
+eval "$(triton env --unset)"
+
+# build the image locally
+docker build --tag hub.greenbaum.cloud/miom.space:"$TAG" .
+
+# login to Greenbaum's private docker registry and push the image
+docker login hub.greenbaum.cloud
+docker push hub.greenbaum.cloud/miom.space:"$TAG"
+
+# change DOCKER_HOST env var to remote docker host (Greenbaum's docker API)
+eval "$(triton --profile lev-1-pub.solar env)"
+
+# use our tag for docker-compose
+export DEPLOY_TAG="$TAG"
+
+# deploy on Greenbaum Cloud
+docker-compose up -d
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7cfcb96
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,12 @@
+version: "2.4"
+
+services:
+  miom-website:
+    image: hub.greenbaum.cloud/miom.space:$DEPLOY_TAG
+    mem_limit: 128m
+    network_mode: My-Fabric-Network
+    ports:
+      - 80
+      - 443
+    labels:
+      - triton.cns.services=miom-website
diff --git a/shell.nix b/shell.nix
index fecb5b2..48f721e 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,10 +1,13 @@
-with (import (fetchTarball https://github.com/nixos/nixpkgs/archive/nixpkgs-unstable.tar.gz) {});
-mkShell {
+{ pkgs ? import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/feed45d391471db2ecdbe5ba7aa301ab290a0c8f.tar.gz") {},
+  nightingale-pkgs ? import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/f7949198dcff52265b322ca8abf7450610e7e49e.tar.gz") {}
+}:
+pkgs.mkShell {
   buildInputs = [
-    nodejs
-    deno
-    nodePackages.json
-    nodePackages.triton
+    nightingale-pkgs.docker-compose
+    pkgs.nodejs
+    pkgs.deno
+    pkgs.nodePackages.json
+    pkgs.nodePackages.triton
   ];
 
   shellHook = ''