diff --git a/.dockerignore b/.dockerignore
index e69de29..81a38be 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -0,0 +1 @@
+.env*
diff --git a/Dockerfile b/Dockerfile
index e69de29..f611bc8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -0,0 +1,70 @@
+# Stage 1: Build the application
+FROM rust:1.95 as builder
+
+# Set the working directory inside the container
+WORKDIR /usr/src/app
+
+# Install build dependencies if needed (e.g., git for cloning)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libssl3 \
+    ca-certificates \
+    openssh-client git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create .ssh/ directory for internal dependencies
+RUN mkdir -p -m 0700 ~/.ssh && \
+    echo "Host git.kundeng.us" >> ~/.ssh/config && \
+    echo "    User git" >> ~/.ssh/config && \
+    chmod 600 ~/.ssh/config
+
+# << --- ADD HOST KEY HERE --- >>
+RUN ssh-keyscan git.kundeng.us >> ~/.ssh/known_hosts
+
+# Copy Cargo manifests
+COPY Cargo.toml Cargo.lock ./
+
+# Build *only* dependencies to leverage Docker cache
+# This dummy build caches dependencies as a separate layer
+RUN --mount=type=ssh mkdir src && \
+    echo "fn main() {println!(\"if you see this, the build broke\")}" > src/main.rs && \
+    cargo build --release --quiet && \
+    rm -rf src target/release/deps/textsender_api* # Clean up dummy build artifacts (replace textsender_api)
+
+# Copy the actual source code
+COPY src ./src
+# If you have other directories like `templates` or `static`, copy them too
+COPY .env ./.env
+COPY migrations ./migrations
+
+# << --- SSH MOUNT ADDED HERE --- >>
+# Build *only* dependencies to leverage Docker cache
+# This dummy build caches dependencies as a separate layer
+# Mount the SSH agent socket for this command
+RUN --mount=type=ssh \
+    cargo build --release --quiet
+
+# Stage 2: Create the final, smaller runtime image
+# Use a minimal base image like debian-slim or even distroless for security/size
+FROM debian:trixie-slim
+
+# Install runtime dependencies if needed (e.g., SSL certificates)
+RUN apt-get update && apt-get install -y ca-certificates libssl-dev libssl3 && rm -rf /var/lib/apt/lists/*
+
+# Set the working directory
+WORKDIR /usr/local/bin
+
+# Copy the compiled binary from the builder stage
+# Replace 'textsender_api' with the actual name of your binary (usually the crate name)
+COPY --from=builder /usr/src/app/target/release/textsender_api .
+
+# Copy other necessary files like .env (if used for runtime config) or static assets
+# It's generally better to configure via environment variables in Docker though
+COPY --from=builder /usr/src/app/.env .
+COPY --from=builder /usr/src/app/migrations ./migrations
+
+# Expose the port your Axum app listens on (e.g., 3000 or 8000)
+EXPOSE 9081
+
+# Set the command to run your application
+# Ensure this matches the binary name copied above
+CMD ["./textsender_api"]
diff --git a/docker-compose.yml b/docker-compose.yml
index e69de29..74ea8b9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,128 @@
+version: '3.8' # Use a recent version
+
+services:
+  # --- Web API ---
+  api:
+    build: # Tells docker-compose to build the Dockerfile in the current directory
+      context: .
+      ssh: ["default"]  # Uses host's SSH agent
+    container_name: textsender_api # Optional: Give the container a specific name
+    ports:
+      # Map host port 8000 to container port 3000 (adjust as needed)
+      - "9081:9081"
+    env_file:
+      - .env
+    depends_on:
+      main_db:
+        condition: service_healthy
+    networks:
+      - textsender_api-network
+    restart: unless-stopped # Optional: Restart policy
+
+  # --- Web API auth ---
+  auth_api:
+    build:
+      context: ../textsender_auth # IMPORTANT: Relative path to the local checkout of your web API repo (containing the Dockerfile)
+      ssh: ["default"]  # Uses host's SSH agent
+      dockerfile: Dockerfile # Optional: Specify if your Dockerfile has a non-standard name
+    container_name: auth_api
+    restart: unless-stopped
+    ports:
+      - "9080:9080"
+    # environment:
+      # Environment variables your API needs, e.g., database connection
+      # Add other necessary environment variables
+    env_file:
+     - ../textsender_auth/.env
+    depends_on:
+      auth_db:
+        condition: service_healthy
+    networks:
+      - textsender_api-network
+    # Optional: Mount local code for development (live reload)
+    # volumes:
+    #  - ./path/to/your/web-api-repo:/app
+
+  # --- songparser service ---
+  catapult:
+    build:
+      context: ../catapult
+      ssh: ["default"]
+      dockerfile: Dockerfile
+    container_name: catapult
+    restart: unless-stopped
+    env_file:
+      - ../catapult/.env
+    depends_on:
+      - api
+      - main_db
+      - auth_api
+      - auth_db
+    networks:
+      - textsender_api-network
+
+
+  # PostgreSQL Database Service
+  # --- textsender_api web api db ---
+  main_db:
+    image: postgres:18.3-alpine # Use an official Postgres image (Alpine variant is smaller)
+    container_name: textsender_api_db # Optional: Give the container a specific name
+    environment:
+      # These MUST match the user, password, and database name in the DATABASE_URL above
+      POSTGRES_USER: ${POSTGRES_MAIN_USER:-textsender_api}
+      POSTGRES_PASSWORD: ${POSTGRES_MAIN_PASSWORD:-password}
+      POSTGRES_DB: ${POSTGRES_MAIN_DB:-textsender_api_db}
+    volumes:
+      # Persist database data using a named volume
+      - postgres_data:/var/lib/postgresql
+    ports:
+      # Optional: Expose port 5432 ONLY if you need to connect directly from your host machine (e.g., for debugging)
+      - "5432:5432"
+    healthcheck:
+        # Checks if Postgres is ready to accept connections
+        test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+        interval: 10s
+        timeout: 5s
+        retries: 5
+        start_period: 10s
+    restart: always # Optional: Restart policy
+    networks:
+      - textsender_api-network
+
+  # --- textsender_api web auth api db ---
+  auth_db:
+    image: postgres:18.4-alpine # Use an official Postgres image (Alpine variant is smaller)
+    container_name: textsender_api_auth_db # Optional: Give the container a specific name
+    environment:
+      # These MUST match the user, password, and database name in the DATABASE_URL above
+      POSTGRES_USER: ${POSTGRES_AUTH_USER:-textsender_api_op}
+      POSTGRES_PASSWORD: ${POSTGRES_AUTH_PASSWORD:-password}
+      POSTGRES_DB: ${POSTGRES_AUTH_DB:-textsender_api_auth_db}
+    volumes:
+      # Persist database data using a named volume
+      - postgres_data_auth:/var/lib/postgresql
+    ports: 
+      # Optional: Expose port 5432 ONLY if you need to connect directly from your host machine (e.g., for debugging)
+      - "5433:5432"
+    healthcheck:
+        # Checks if Postgres is ready to accept connections
+        test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+        interval: 10s
+        timeout: 5s
+        retries: 5
+        start_period: 10s
+    restart: always # Optional: Restart policy
+    networks:
+      - textsender_api-network
+
+# Define the named volume for data persistence
+volumes:
+  postgres_data:
+    driver: local # Use the default local driver
+  postgres_data_auth:
+    driver: local # Use the default local driver
+
+# Define the network (optional, but good practice)
+networks:
+  textsender_api-network:
+    driver: bridge