diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..ec091c2
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,82 @@
+name: Deploy notplanned
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+      - name: Ensure public IPs
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_INFRA }}
+        run: |
+          set -eu
+          flyctl ips allocate-v4 --shared --app notplanned || true
+          flyctl ips allocate-v6 --app notplanned || true
+      - name: Launch static machine if absent
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_INFRA }}
+        run: |
+          set -eu
+          python3 - <<'PY'
+          import base64, json, os, urllib.request, urllib.error
+          app = "notplanned"
+          token = os.environ["FLY_API_TOKEN"]
+          root = f"https://api.machines.dev/v1/apps/{app}"
+          def req(method, path, body=None):
+              data = None if body is None else json.dumps(body).encode()
+              r = urllib.request.Request(root + path, data=data, method=method, headers={
+                  "Authorization": "Bearer " + token,
+                  "Content-Type": "application/json",
+              })
+              try:
+                  with urllib.request.urlopen(r, timeout=60) as resp:
+                      raw = resp.read()
+                      return json.loads(raw or b"{}")
+              except urllib.error.HTTPError as e:
+                  print("Fly API error", e.code, e.read().decode(errors="replace"))
+                  raise
+          machines = req("GET", "/machines")
+          if machines:
+              print("machine already exists:", machines[0].get("id"))
+              raise SystemExit(0)
+          html = base64.b64encode(open("index.html","rb").read()).decode()
+          payload = {
+              "name": "notplanned-web",
+              "region": "sjc",
+              "config": {
+                  "image": "nginx:1.27-alpine",
+                  "env": {"INDEX_B64": html},
+                  "init": {"exec": [
+                      "/bin/sh","-lc",
+                      "printf '%s' \"$INDEX_B64\" | base64 -d > /usr/share/nginx/html/index.html && exec nginx -g 'daemon off;'"
+                  ]},
+                  "guest": {"cpu_kind":"shared","cpus":1,"memory_mb":256},
+                  "services": [{
+                      "protocol":"tcp",
+                      "internal_port":80,
+                      "ports":[
+                          {"port":80,"handlers":["http"]},
+                          {"port":443,"handlers":["tls","http"]}
+                      ]
+                  }]
+              }
+          }
+          m = req("POST", "/machines", payload)
+          print("created machine:", m.get("id"))
+          PY
+      - name: Verify
+        run: |
+          set -eu
+          for i in $(seq 1 40); do
+            if curl -fsS https://notplanned.fly.dev/ | grep -q "we build the features maintainers"; then
+              echo "verified https://notplanned.fly.dev/"
+              exit 0
+            fi
+            sleep 2
+          done
+          exit 1