diff --git a/README.md b/README.md
index 3c315b4..16021de 100644
--- a/README.md
+++ b/README.md
@@ -332,6 +332,10 @@ make image                    # stamps the image with `git describe`; see docs/d
 docker run -p 8080:8080 noitu:latest
 ```
 
+[`compose.yml`](./compose.yml) builds the same image for Docker Compose
+deployments such as Coolify. It publishes no host port, expecting a reverse
+proxy on the compose network, and relies on the Dockerfile's health check.
+
 ## License
 
 This project is distributed under **two licenses**, applying to different artifacts.
diff --git a/compose.yml b/compose.yml
new file mode 100644
index 0000000..78e5ce6
--- /dev/null
+++ b/compose.yml
@@ -0,0 +1,21 @@
+services:
+  noitu:
+    build:
+      context: .
+    restart: unless-stopped
+    # The image sets NOITU_ADDR, NOITU_DB_PATH and NOITU_WEB_DIR, and every other
+    # NOITU_* setting has a working default (see docs/deployment.md), so nothing
+    # is declared here. Coolify injects every dashboard variable through its
+    # generated .env, so a tuning value set there still reaches the container.
+    #
+    # No volumes: the dictionary database ships inside the image and is opened
+    # read-only, and game state lives in memory only, so nothing on disk needs
+    # to survive a redeploy.
+    #
+    # The reverse proxy reaches the app over the compose network, so no host
+    # port is published; `expose` only documents the listen port.
+    expose:
+      - "8080"
+    # No healthcheck block: the Dockerfile's HEALTHCHECK (the binary's own
+    # -healthcheck flag, since the distroless image has no curl or wget) is
+    # inherited by the container.