diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..c12867d
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,54 @@
+# Прод на ishiki: hado живёт рядом с прокси sekai, порт только на loopback —
+# Caddy (network_mode: host) ходит в 127.0.0.1:8091, наружу порт закрыт (см. deploy/Caddyfile.snippet).
+# Один env на всё: core/.env — его читают и контейнеры (env_file), и сам compose (--env-file) для postgres.
+# Запуск: docker compose --env-file core/.env -f docker-compose.prod.yml up -d --build
+services:
+  app:
+    build: ./core
+    image: hado-app
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8091:8080"
+    env_file: ./core/.env
+    environment:
+      # serversideup: миграции и кеши при старте — только здесь, чтобы не гонять их из трёх контейнеров
+      AUTORUN_ENABLED: "true"
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  scheduler:
+    image: hado-app
+    restart: unless-stopped
+    command: ["php", "/var/www/html/artisan", "schedule:work"]
+    env_file: ./core/.env
+    depends_on:
+      app:
+        condition: service_healthy
+
+  worker:
+    image: hado-app
+    restart: unless-stopped
+    command: ["php", "/var/www/html/artisan", "queue:work", "--tries=3", "--sleep=1"]
+    env_file: ./core/.env
+    depends_on:
+      app:
+        condition: service_healthy
+
+  postgres:
+    image: postgres:17
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${DB_DATABASE:-hado}
+      POSTGRES_USER: ${DB_USERNAME:-hado}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env next to this file}
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-hado} -d ${DB_DATABASE:-hado}"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+volumes:
+  pg_data: