diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..54b6d53
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,35 @@
+name: build-and-deploy
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+env:
+  HARBOR: harbor.wace.me
+  PROJECT: dev-pilots
+  APP: jskim
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: tools
+        run: |
+          apt-get update -qq
+          apt-get install -y ca-certificates curl git docker.io docker-compose-v2 >/dev/null 2>&1 || apt-get install -y ca-certificates curl git docker.io >/dev/null
+      - name: checkout
+        run: |
+          rm -rf src && git clone --depth 1 --branch "$GITHUB_REF_NAME" http://oauth2:${{ github.token }}@gitea:3000/${GITHUB_REPOSITORY}.git src
+      - name: build
+        run: |
+          cd src && docker build -t $HARBOR/$PROJECT/$APP:latest .
+      - name: push
+        env:
+          HUSER: ${{ secrets.HARBOR_USER }}
+          HSECRET: ${{ secrets.HARBOR_SECRET }}
+        run: |
+          echo "$HSECRET" | docker login $HARBOR -u "$HUSER" --password-stdin
+          docker push $HARBOR/$PROJECT/$APP:latest
+      - name: deploy
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+        run: |
+          cd src && docker compose -f deploy/docker-compose.yml up -d --pull always --force-recreate