diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 0000000..c995e29
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,66 @@
+# Coolify / local stack — 3 services, 0 managed DBs (2 SQLite en volumen)
+#
+# Secretos OBLIGATORIOS (sin default en compose): defínelos en Coolify o en un
+# archivo .env local (gitignored). Si faltan, `docker compose` falla al arrancar.
+services:
+  api:
+    build:
+      context: .
+      dockerfile: Dockerfile.api
+    restart: unless-stopped
+    environment:
+      PORT: ${PORT:-8000}
+      SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET is required}
+      DOCS_KEY: ${DOCS_KEY:?DOCS_KEY is required (64 hex chars)}
+      SEED_PASSWORD: ${SEED_PASSWORD:?SEED_PASSWORD is required}
+      API_KEY: ${API_KEY:-}
+      PANEL_LOGIN_URL: ${PANEL_LOGIN_URL:?PANEL_LOGIN_URL is required}
+      COOKIE_SECURE: ${COOKIE_SECURE:-true}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
+      VCARD_BASE: ${VCARD_BASE:-}
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-587}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASS: ${SMTP_PASS:-}
+      SMTP_FROM: ${SMTP_FROM:-}
+    volumes:
+      - panel-data:/app/data
+    expose:
+      - "8000"
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "deno",
+          "eval",
+          "const r=await fetch('http://127.0.0.1:'+(Deno.env.get('PORT')||'8000')+'/v1/health'); if(!r.ok) Deno.exit(1)",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 45s
+
+  web-panel:
+    build:
+      context: .
+      dockerfile: Dockerfile.web-panel
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+    expose:
+      - "80"
+
+  web-saas:
+    build:
+      context: .
+      dockerfile: Dockerfile.web-saas
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+    expose:
+      - "80"
+
+volumes:
+  panel-data: