diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..05c8de3
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,112 @@
+name: CI
+
+on:
+  push:
+
+env:
+  REGISTRY: gitea.vodsystem.ddns.net
+  IMAGE_PREFIX: dylan/vod-system
+
+jobs:
+  unit-tests:
+    name: Maven unit tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Set up Java 21
+        uses: https://github.com/actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+
+      - name: Run unit tests
+        run: ./mvnw --batch-mode --no-transfer-progress test
+
+  build-and-push:
+    name: Build and push images
+    needs: unit-tests
+    if: gitea.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea container registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push backend image
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: .
+          file: src/main/Dockerfile
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-backend:latest
+
+      - name: Build and push frontend image
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: ./frontend
+          file: frontend/Dockerfile
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-frontend:latest
+
+      - name: Build and push rtmp image
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: ./nginx
+          file: nginx/Dockerfile
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-rtmp:latest
+
+  deploy:
+    name: Deploy to server
+    needs: build-and-push
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Copy production compose file to server
+        uses: https://github.com/appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: 22
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: docker-compose.prod.yml
+          target: ${{ vars.DEPLOY_PATH }}
+          strip_components: 0
+
+      - name: Pull latest images and restart containers
+        uses: https://github.com/appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: 22
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          envs: REGISTRY,REGISTRY_USER,REGISTRY_TOKEN,DEPLOY_PATH
+          script: |
+            set -e
+            echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+            cd "$DEPLOY_PATH"
+            docker compose -f docker-compose.prod.yml pull
+            docker compose -f docker-compose.prod.yml up -d --remove-orphans
+        env:
+          REGISTRY: ${{ env.REGISTRY }}
+          REGISTRY_USER: ${{ gitea.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
diff --git a/.gitea/workflows/unit-tests.yml b/.gitea/workflows/unit-tests.yml
deleted file mode 100644
index b3a69f4..0000000
--- a/.gitea/workflows/unit-tests.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Unit Tests
-
-on:
-  push:
-
-jobs:
-  unit-tests:
-    name: Maven unit tests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Set up Java 21
-        uses: https://github.com/actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-          cache: maven
-
-      - name: Run unit tests
-        run: ./mvnw --batch-mode --no-transfer-progress test
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..fe9c167
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,57 @@
+# Production deploy: uses pre-built images from the Gitea container registry
+# instead of building locally. Populated by CI onto the server alongside .env.
+# Usage: docker compose -f docker-compose.prod.yml pull && docker compose -f docker-compose.prod.yml up -d
+
+services:
+  postgres:
+    image: postgres:15
+    container_name: vod_postgres
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - ${POSTGRES_DATA}:/var/lib/postgresql/data
+    restart: unless-stopped
+
+  backend:
+    image: gitea.vodsystem.ddns.net/dylan/vod-system-backend:latest
+    container_name: vod_backend
+    depends_on:
+      - postgres
+    env_file:
+      - .env
+    volumes:
+      - ${MEDIA_DATA}:/app/media
+      - ${STREAM_DATA}:/app/stream
+    ports:
+      - "8089:8080"
+    restart: unless-stopped
+
+  frontend:
+    image: gitea.vodsystem.ddns.net/dylan/vod-system-frontend:latest
+    container_name: vod_frontend
+    environment:
+      VITE_API_URL: ${BACKEND_URL}
+      VITE_FRONTEND_URL: ${FRONTEND_URL}
+      VITE_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+    depends_on:
+      - backend
+    ports:
+      - "5173:5173"
+    restart: unless-stopped
+
+  rtmp:
+    image: gitea.vodsystem.ddns.net/dylan/vod-system-rtmp:latest
+    container_name: vod_rtmp
+    env_file:
+      - .env
+    environment:
+      - WEB_SERVER_URL=http://backend:8080
+    ports:
+      - "1935:1935"
+    volumes:
+      - ${STREAM_DATA}:/stream
+    restart: unless-stopped
+    depends_on:
+      - backend