diff --git a/.gitea/workflows/build-and-push.yml b/.gitea/workflows/build-and-push.yml
new file mode 100644
index 0000000..ccee351
--- /dev/null
+++ b/.gitea/workflows/build-and-push.yml
@@ -0,0 +1,72 @@
+name: Build and push Docker image
+
+on:
+  push:
+    branches: [ "main" ]
+    tags: [ "v*" ]
+  workflow_dispatch: {}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Compute image metadata
+        id: meta
+        env:
+          REGISTRY: ${{ secrets.REGISTRY }}
+          REGISTRY_IMAGE: ${{ secrets.REGISTRY_IMAGE }}
+        run: |
+          REPO_LC="${GITHUB_REPOSITORY,,}"
+          REG="${REGISTRY:-docker.io}"
+          IMAGE="${REGISTRY_IMAGE:-${REG}/${REPO_LC}}"
+          echo "registry=${REG}" >> "$GITHUB_OUTPUT"
+          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
+          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
+            TAGS="${IMAGE}:${GITHUB_REF_NAME}"
+          else
+            SHA=$(git rev-parse --short HEAD)
+            TAGS="${IMAGE}:${SHA},${IMAGE}:latest"
+          fi
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to container registry (if credentials provided)
+        env:
+          REGISTRY: ${{ steps.meta.outputs.registry }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          if [ -n "$REGISTRY_USERNAME" ] && [ -n "$REGISTRY_PASSWORD" ]; then
+            echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
+          else
+            echo "No registry credentials provided; skipping login."
+          fi
+
+      - name: Build Docker image
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          IFS=',' read -ra TAGS_ARR <<< "$TAGS"
+          FIRST_TAG="${TAGS_ARR[0]}"
+          docker build -t "$FIRST_TAG" .
+          for TAG in "${TAGS_ARR[@]:1}"; do
+            docker tag "$FIRST_TAG" "$TAG"
+          done
+
+      - name: Push Docker image (if logged in)
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          if [ -n "$REGISTRY_USERNAME" ] && [ -n "$REGISTRY_PASSWORD" ]; then
+            IFS=',' read -ra TAGS_ARR <<< "$TAGS"
+            for TAG in "${TAGS_ARR[@]}"; do
+              docker push "$TAG"
+            done
+          else
+            echo "No registry credentials provided; skipping push."
+          fi
+
diff --git a/Dockerfile b/Dockerfile
index 89884d1..f1661e5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,13 @@
+FROM golang:alpine as builder
+
+WORKDIR /app
+COPY . .
+RUN go install github.com/gohugoio/hugo@latest
+RUN hugo --minify
+
 FROM nginx:alpine
 
-COPY ./public /usr/share/nginx/html
+COPY --from=builder /app/public /usr/share/nginx/html
 
 EXPOSE 80