diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7d4b4ab
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,44 @@
+services:
+  dnf-mirror:
+    build: ./mirror
+    restart: unless-stopped
+    environment:
+      MIRROR_DOMAIN: ${MIRROR_DOMAIN}
+      MIRROR_REPO_ID: ${MIRROR_REPO_ID:-company-mirror}
+      GPG_NAME: ${GPG_NAME}
+      GPG_EMAIL: ${GPG_EMAIL}
+      GPG_PASSPHRASE: ${GPG_PASSPHRASE}
+      SYNC_INTERVAL_SECONDS: ${SYNC_INTERVAL_SECONDS:-21600}
+      SOURCES_GIT_URL: ${SOURCES_GIT_URL}
+      SOURCES_GIT_REF: ${SOURCES_GIT_REF:-main}
+      SOURCES_GIT_SSH_KEY: ${SOURCES_GIT_SSH_KEY:-}
+      ALMA_RELEASEVER: ${ALMA_RELEASEVER:-10}
+      ALMA_BASEARCH: ${ALMA_BASEARCH:-x86_64}
+      ALMA_BASELINE_REPOIDS: ${ALMA_BASELINE_REPOIDS:-baseos,appstream,extras,crb,epel}
+    volumes:
+      - ./mirror/config/alma-baseline.repo.d:/etc/mirror/alma-baseline.repo.d:ro
+      - ./git-ssh:/run/secrets/git-ssh:ro
+      - ./gpg:/var/lib/mirror-gpg
+      - dnf-repo-data:/srv/dnf
+      - mirror-cache:/var/cache/mirror
+    # kein Port-Publish: der Container schreibt nur in das Volume, das nginx
+    # ausliefert. Braucht ausgehenden Internetzugriff zu den Upstream-Repos
+    # UND zum Git-Repo mit der Paketliste (SOURCES_GIT_URL), das er vor jedem
+    # Sync-Lauf neu abruft.
+
+  nginx:
+    image: nginx:alpine
+    restart: unless-stopped
+    depends_on:
+      - dnf-mirror
+    ports:
+      - "80:80"
+      # - "443:443"   # TLS: siehe README (eigene Zertifikate mounten oder
+      #                 vorgeschalteten Reverse Proxy/Load Balancer nutzen)
+    volumes:
+      - dnf-repo-data:/usr/share/nginx/html/dnf:ro
+      - ./nginx/conf.d:/etc/nginx/conf.d:ro
+
+volumes:
+  dnf-repo-data:
+  mirror-cache: