diff --git a/obico/.env.example b/obico/.env.example
new file mode 100644
index 0000000..8ec3db7
--- /dev/null
+++ b/obico/.env.example
@@ -0,0 +1,6 @@
+# Obico Server environment variables
+# Copy to .env and fill in values, OR set in Portainer stack environment
+
+# Generate after first start with:
+#   docker exec -it obico python manage.py gen_site_secret
+DJANGO_SECRET_KEY=change-me-generate-with-manage.py-gen_site_secret
diff --git a/obico/docker-compose.yml b/obico/docker-compose.yml
new file mode 100644
index 0000000..29753a0
--- /dev/null
+++ b/obico/docker-compose.yml
@@ -0,0 +1,50 @@
+services:
+  obico-redis:
+    image: redis:7.2-alpine
+    container_name: obico-redis
+    restart: unless-stopped
+    networks:
+      - obico-internal
+
+  obico:
+    # Use :cuda for NVIDIA GPU acceleration, :latest for CPU-only
+    # Note: :cuda tag has had occasional CUDNN/ONNX version issues after updates.
+    # If obico fails to start after an image update, switch to :latest temporarily.
+    image: ghcr.io/imagegenius/obico:cuda
+    container_name: obico
+    restart: unless-stopped
+    depends_on:
+      - obico-redis
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/New_York
+      - REDIS_URL=redis://obico-redis:6379
+      # HOST_IP must exactly match the URL used to access Obico (no trailing slash, no http://)
+      # Wrong value causes HTTP 500 errors on all page loads
+      - HOST_IP=obico.kolpacksoftware.com
+      - SITE_USES_HTTPS=True
+      - CSRF_TRUSTED_ORIGINS=["https://obico.kolpacksoftware.com"]
+      - DJANGO_SECRET_KEY=${DJANGO_SECRET_KEY}
+      # Set to True temporarily to register your account, then back to False
+      - ACCOUNT_ALLOW_SIGN_UP=False
+    volumes:
+      - /srv/obico/config:/config
+    ports:
+      - "3334:3334"
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]
+    networks:
+      - npm-network
+      - obico-internal
+
+networks:
+  npm-network:
+    external: true
+  obico-internal:
+    driver: bridge