diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index f3385ceb..de58d754 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -27,3 +27,7 @@ jobs:
           context: .
           push: true
           tags: gitea.kazcloud.dev/${{ gitea.repository }}:latest
+      - name: Deploy to k3s
+        run: |
+          kubectl apply -f deployment.yaml
+          kubectl rollout restart deployment/ry-site -n default
diff --git a/deployment.yaml b/deployment.yaml
new file mode 100644
index 00000000..d38dc43c
--- /dev/null
+++ b/deployment.yaml
@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ry-site
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ry-site
+  template:
+    metadata:
+      labels:
+        app: ry-site
+    spec:
+      nodeSelector:
+        node-role: cloud
+      imagePullSecrets:
+        - name: gitea-registry
+      containers:
+        - name: ry-site
+          image: gitea.kazcloud.dev/ryan/ry.kazcloud.dev:latest
+          ports:
+            - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ry-site
+  namespace: default
+spec:
+  selector:
+    app: ry-site
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ry-site
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: ry.kazcloud.dev
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ry-site
+                port:
+                  number: 80
+  tls:
+    - secretName: ry-site-tls
+      hosts:
+        - ry.kazcloud.dev