diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..475dc0d
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,45 @@
+# ~/docker/authelia/docker-compose.yml
+#
+# ═══════════════════════════════════════════════════════════════════════════════
+# FIRST TIME SETUP
+# ═══════════════════════════════════════════════════════════════════════════════
+#
+# 1. Generate password hashes for each user:
+#      docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'userpassword'
+#      Add the hash to config/users.yml
+#
+# 2. Start the stack:
+#      cd ~/docker/authelia && docker compose up -d
+#
+# 3. Update Caddyfile on this machine and reload:
+#      caddy reload
+#
+# Authelia portal → https://auth.localai.mydomain.com
+# ═══════════════════════════════════════════════════════════════════════════════
+
+services:
+
+  authelia:
+    image: authelia/authelia:4.39.20
+    pull_policy: missing
+    container_name: authelia
+    user: "1000:1000"
+    volumes:
+      - ./config:/config
+      - ./data:/data
+    environment:
+      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/config/secrets/jwt_secret
+      - AUTHELIA_SESSION_SECRET_FILE=/config/secrets/session_secret
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/config/secrets/storage_secret
+      - AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE=/config/secrets/smtp_password
+      - AUTHELIA_NOTIFIER_SMTP_USERNAME=${SMTP_USER}
+      - AUTHELIA_NOTIFIER_SMTP_SENDER=Local AI <${SMTP_USER}>
+    expose:
+      - 9091
+    restart: unless-stopped
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true