diff --git a/Deployment.md b/Deployment.md
new file mode 100644
index 0000000..8d60ae3
--- /dev/null
+++ b/Deployment.md
@@ -0,0 +1,68 @@
+# Deployment
+
+Production deployment uses Docker Compose (`compose.prod.yml`) with four services behind Nginx.
+
+## Services
+
+| Service | Image | Description |
+|---|---|---|
+| `proxy` | Nginx (custom) | TLS termination, reverse proxy |
+| `thoughts-frontend` | Built from `thoughts-frontend/Dockerfile` | Next.js SSR frontend |
+| `thoughts-backend` | Built from `thoughts-backend/Dockerfile` | Rust API server |
+| `database` | `postgres:latest` | PostgreSQL with persistent volume |
+
+## Steps
+
+### 1. Clone and configure
+
+```bash
+git clone <repo-url>
+cd thoughts
+
+# Backend env
+cp thoughts-backend/.env.example thoughts-backend/.env
+# Edit: DATABASE_URL, JWT_SECRET, etc.
+
+# Root env (shared by compose)
+cp .env.example .env
+# Edit: POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB, domain settings
+```
+
+### 2. Build and start
+
+```bash
+docker compose -f compose.prod.yml up -d --build
+```
+
+### 3. Run migrations
+
+```bash
+docker compose -f compose.prod.yml exec thoughts-backend \
+  ./migration
+```
+
+### 4. Nginx / TLS
+
+The `nginx/nginx.conf` routes traffic:
+
+- `yourdomain.com/api/*` → `thoughts-backend:3001`
+- `yourdomain.com/*` → `thoughts-frontend:3000`
+
+For TLS, add a Certbot/Let's Encrypt step or use an external TLS terminator in front of the Nginx container.
+
+## CI/CD
+
+A Gitea Actions workflow lives at `.gitea/workflows/deploy.yml`. It builds and pushes Docker images on push to `master` and triggers a redeploy on your server.
+
+## Updating
+
+```bash
+git pull
+docker compose -f compose.prod.yml up -d --build
+# Run migrations if schema changed
+docker compose -f compose.prod.yml exec thoughts-backend ./migration
+```
+
+## Data Persistence
+
+PostgreSQL data is stored in a named Docker volume. It survives container restarts and `docker compose down`. Use `docker compose down -v` only if you intentionally want to wipe the database.