diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..aade1d7
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,42 @@
+name: Deploy Dolibarr
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: debian-host
+
+    env:
+      PATH: /usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/bin:/snap/bin
+      NOMAD_ADDR: "https://nomad.i80.dk:4646"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Validate Nomad job
+        run: nomad job validate nomad-job.hcl
+
+      - name: Deploy to Nomad
+        run: nomad job run nomad-job.hcl
+
+      - name: Check deployment status
+        run: |
+          echo "=== Job Status ==="
+          nomad job status dolibarr
+
+          echo "=== Allocations ==="
+          nomad job allocs dolibarr
+
+          echo "=== Logs ==="
+          for alloc in $(nomad job allocs dolibarr -short | tail -n +2 | awk '{print $1}'); do
+            echo "--- app logs ($alloc) ---"
+            nomad alloc logs $alloc app || true
+          done
+
+      - name: Done
+        run: echo "Dolibarr deployed — https://portal.i80.dk"
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..9f3c7b8
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,31 @@
+NOMAD_ADDR ?= https://nomad.i80.dk:4646
+JOB        := nomad-job.hcl
+
+.PHONY: help secrets plan deploy status logs stop
+
+help:
+	@echo "Dolibarr på portal.i80.dk (kører på autobox.i80.dk)"
+	@echo ""
+	@echo "  make plan    — valider job spec"
+	@echo "  make deploy  — deploy/opdater Dolibarr"
+	@echo "  make status  — vis job status"
+	@echo "  make logs    — follow app logs"
+	@echo "  make stop    — stop job"
+	@echo ""
+	@echo "Secrets sættes via SSH på autobox:"
+	@echo "  ssh autobox.i80.dk 'consul kv put dolibarr/db_password ...'"
+
+plan:
+	NOMAD_ADDR=$(NOMAD_ADDR) nomad job plan $(JOB)
+
+deploy:
+	NOMAD_ADDR=$(NOMAD_ADDR) nomad job run $(JOB)
+
+status:
+	NOMAD_ADDR=$(NOMAD_ADDR) nomad job status dolibarr
+
+logs:
+	NOMAD_ADDR=$(NOMAD_ADDR) nomad alloc logs -f -job dolibarr app
+
+stop:
+	NOMAD_ADDR=$(NOMAD_ADDR) nomad job stop dolibarr
diff --git a/nomad-job.hcl b/nomad-job.hcl
new file mode 100644
index 0000000..cda6e60
--- /dev/null
+++ b/nomad-job.hcl
@@ -0,0 +1,139 @@
+job "dolibarr" {
+  datacenters = ["dc1"]
+  type        = "service"
+
+  group "dolibarr" {
+    count = 1
+
+    constraint {
+      attribute = "${node.unique.name}"
+      value     = "autobox.i80.dk"
+    }
+
+    network {
+      mode = "bridge"
+      port "http" {
+        to = 80
+      }
+    }
+
+    volume "dolibarr-db" {
+      type      = "host"
+      source    = "dolibarr-db"
+      read_only = false
+    }
+
+    volume "dolibarr-documents" {
+      type      = "host"
+      source    = "dolibarr-documents"
+      read_only = false
+    }
+
+    task "mariadb" {
+      driver = "docker"
+
+      config {
+        image = "mariadb:10.11"
+      }
+
+      volume_mount {
+        volume      = "dolibarr-db"
+        destination = "/var/lib/mysql"
+      }
+
+      template {
+        data = <<EOH
+MARIADB_ROOT_PASSWORD="{{ key "dolibarr/db_root_password" }}"
+MARIADB_DATABASE="dolibarr"
+MARIADB_USER="dolibarr"
+MARIADB_PASSWORD="{{ key "dolibarr/db_password" }}"
+EOH
+        destination = "secrets/mariadb.env"
+        env         = true
+      }
+
+      resources {
+        cpu    = 256
+        memory = 512
+      }
+
+      restart {
+        attempts = 5
+        delay    = "15s"
+        interval = "2m"
+        mode     = "fail"
+      }
+    }
+
+    task "app" {
+      driver = "docker"
+
+      config {
+        image = "dolibarr/dolibarr:latest"
+        ports = ["http"]
+      }
+
+      volume_mount {
+        volume      = "dolibarr-documents"
+        destination = "/var/www/documents"
+      }
+
+      template {
+        data = <<EOH
+DOLI_DB_PASSWORD="{{ key "dolibarr/db_password" }}"
+DOLI_ADMIN_PASSWORD="{{ key "dolibarr/admin_password" }}"
+EOH
+        destination = "secrets/dolibarr.env"
+        env         = true
+      }
+
+      env {
+        DOLI_DB_HOST      = "127.0.0.1"
+        DOLI_DB_PORT      = "3306"
+        DOLI_DB_NAME      = "dolibarr"
+        DOLI_DB_USER      = "dolibarr"
+        DOLI_URL_ROOT     = "https://portal.i80.dk"
+        DOLI_ADMIN_LOGIN  = "admin"
+        DOLI_INSTALL_AUTO = "1"
+        DOLI_COMPANY_NAME = "i80"
+      }
+
+      resources {
+        cpu    = 512
+        memory = 512
+      }
+
+      restart {
+        attempts = 5
+        delay    = "20s"
+        interval = "3m"
+        mode     = "fail"
+      }
+
+      service {
+        name     = "dolibarr"
+        port     = "http"
+        provider = "consul"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.dolibarr.rule=Host(`portal.i80.dk`)",
+          "traefik.http.routers.dolibarr.tls=true",
+          "traefik.http.routers.dolibarr.tls.certresolver=letsencrypt",
+        ]
+
+        check {
+          type     = "http"
+          path     = "/"
+          interval = "30s"
+          timeout  = "10s"
+
+          check_restart {
+            limit = 3
+            grace = "60s"
+          }
+        }
+      }
+    }
+  }
+}