diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..7f9eff4
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,22 @@
+name: Deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build (frontend + API via make)
+        run: make web server
+
+      - name: Deploy to box
+        run: |
+          mkdir -p ~/apps/hub/dist
+          cp -r web/dist/* ~/apps/hub/dist/
+          cp bin/hub-api ~/apps/hub/hub-api
+          chmod +x ~/apps/hub/hub-api
+          systemctl --user restart hub-api
diff --git a/Makefile b/Makefile
index cf02c15..4ebcb28 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: proto web server dev test
+.PHONY: proto web server release dev test
 
 proto:  ## Regenerate Go + TS code from proto
 	PATH="$(shell go env GOPATH)/bin:$$PATH" protoc \
@@ -12,10 +12,13 @@ proto:  ## Regenerate Go + TS code from proto
 web:  ## Build frontend into web/dist (tsc + vite)
 	cd web && pnpm install --frozen-lockfile && pnpm build
 
-server:  ## Build Go binary
-	go build -o bin/server ./server
+server:  ## Build Go binary → bin/hub-api
+	go build -o bin/hub-api ./server
 
-dev:  ## Dev: Go server on :8080 + Vite on :5173 (use http://localhost:5173)
+release:  ## CI build: static binary for the box (run on the box itself, native arch)
+	CGO_ENABLED=0 go build -o bin/hub-api ./server
+
+dev:  ## Dev: Go server + Vite on :5173 (use http://localhost:5173)
 	go run ./server & cd web && pnpm dev
 
 dev-srv:
@@ -25,8 +28,8 @@ dev-web:
 	cd web && pnpm dev
 
 test:  ## Smoke-test the RPC endpoints
-	@go build -o bin/server ./server
-	@./bin/server & sleep 1; \
+	@go build -o bin/hub-api ./server
+	@./bin/hub-api & sleep 1; \
 	curl -sf -X POST localhost:8080/homelab.v1.HomelabService/ListSections -H 'Content-Type: application/json' -d '{}' | grep -q '"cpu"' || exit 1; \
 	curl -sf -X POST localhost:8080/homelab.v1.HomelabService/RunScript -H 'Content-Type: application/json' -d '{"name":"greet","args":["pony","42"]}' | grep -q 'arg1: pony' || exit 1; \
 	kill %1; echo OK
diff --git a/server/main.go b/server/main.go
index a9b76f9..50ffc02 100644
--- a/server/main.go
+++ b/server/main.go
@@ -219,5 +219,12 @@ func main() {
 		HTML5: true,
 	}))
 
-	e.Logger.Fatal(e.Start(":8080"))
+	e.Logger.Fatal(e.Start(port()))
+}
+
+func port() string {
+	if p := os.Getenv("PORT"); p != "" {
+		return ":" + p
+	}
+	return ":8080"
 }