diff --git a/.gitea/workflows/build-and-deployment.yaml b/.gitea/workflows/build-and-deployment.yaml
new file mode 100644
index 0000000..f5cc0d1
--- /dev/null
+++ b/.gitea/workflows/build-and-deployment.yaml
@@ -0,0 +1,57 @@
+name: Build and Deploy SearXNG
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "compose.yaml"
+      - "config/**" # Reagiert jetzt sauber auf deinen Ordnernamen
+      - ".gitea/workflows/build-and-deployment.yaml"
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: proxmox
+
+    env:
+      TARGET_DIR: "/home/gitea-runner/docker/searxng"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Ensure directory structure exists
+        run: |
+          mkdir -p ${{ env.TARGET_DIR }}/core-config
+
+      - name: Inject Git Secrets into .env file
+        run: |
+          echo "SEARXNG_SECRET=${{ secrets.SEARXNG_SECRET }}" > ${{ env.TARGET_DIR }}/.env
+          echo "SEARXNG_BASE_URL=${{ secrets.SEARXNG_BASE_URL }}" >> ${{ env.TARGET_DIR }}/.env
+        # Baut genau die .env, die dein Compose-File via `env_file: ./.env` erwartet
+
+      - name: Copy deployment files (Compose & Config)
+        run: |
+          cp compose.yaml ${{ env.TARGET_DIR }}/
+          cp -r core-config/* ${{ env.TARGET_DIR }}/core-config/
+
+      - name: Clean stop old containers
+        run: docker compose down || true
+        working-directory: ${{ env.TARGET_DIR }}
+
+      - name: Pull latest images
+        run: docker compose pull
+        working-directory: ${{ env.TARGET_DIR }}
+
+      - name: Start SearXNG Stack
+        run: docker compose up -d --force-recreate
+        working-directory: ${{ env.TARGET_DIR }}
+
+      - name: Verify Stack Health
+        run: |
+          sleep 5
+          docker ps
+          echo "=== Valkey Logs ==="
+          docker logs searxng-valkey --tail 10
+          echo "=== SearXNG Logs ==="
+          docker logs searxng-core --tail 10
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/compose.yaml b/compose.yaml
index bfaaa88..a1409df 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -1,25 +1,33 @@
-name: searxng
-
 services:
-  core:
+  valkey:
+    image: docker.io/valkey/valkey:8-alpine
+    container_name: searxng-valkey
+    command: valkey-server --save 30 1 --loglevel warning
+    restart: unless-stopped
+    volumes:
+      - valkey-data:/data
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETGID
+      - SETUID
+      - DAC_OVERRIDE
+
+  searxng:
+    image: docker.io/searxng/searxng:latest
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-latest}
-    restart: always
+    restart: unless-stopped
     ports:
       - "8888:8080"
-    env_file: ./.env
+    environment:
+      - SEARXNG_SECRET=${SEARXNG_SECRET}
+      - SEARXNG_BASE_URL=${SEARXNG_BASE_URL}
     volumes:
-      - ./core-config/:/etc/searxng/:Z
-      - core-data:/var/cache/searxng/
-
-  valkey:
-    container_name: searxng-valkey
-    image: docker.io/valkey/valkey:9-alpine
-    command: valkey-server --save 30 1 --loglevel warning
-    restart: always
-    volumes:
-      - valkey-data:/data/
+      - ./config:/etc/searxng:rw
+      - searxng-data:/var/cache/searxng
+    depends_on:
+      - valkey
 
 volumes:
-  core-data:
   valkey-data:
+  searxng-data:
diff --git a/core-config/settings.yml b/config/settings.yml
similarity index 100%
rename from core-config/settings.yml
rename to config/settings.yml