diff --git a/module.yml b/module.yml
new file mode 100644
index 0000000..c96cc0d
--- /dev/null
+++ b/module.yml
@@ -0,0 +1,14 @@
+manifest: 2
+name: f1-circuits
+version: "1.0.0"
+description: "F1 track layout CDN — serves SVG/PNG circuit maps by grand prix and year"
+
+env:
+  DOMAIN:
+    from: node.domain
+    default: localhost
+
+docker:
+  - image: f1-circuits
+    context: .
+    dockerfile: service/Dockerfile
diff --git a/service/Dockerfile b/service/Dockerfile
new file mode 100644
index 0000000..7764488
--- /dev/null
+++ b/service/Dockerfile
@@ -0,0 +1,13 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir fastapi uvicorn fastf1 python-slugify
+
+COPY cdn-api.py circuits_service.py ergast_service.py ./
+COPY models/ ./models/
+COPY circuits/ ./circuits/
+
+EXPOSE 8000
+
+CMD ["uvicorn", "cdn-api:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/service/docker-compose.yml b/service/docker-compose.yml
new file mode 100644
index 0000000..f43864e
--- /dev/null
+++ b/service/docker-compose.yml
@@ -0,0 +1,20 @@
+services:
+  f1-circuits:
+    image: registry-api.novox.be/novox/f1-circuits:latest
+    container_name: f1-circuits
+    restart: unless-stopped
+    volumes:
+      - ./cache:/app/cache
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.f1-circuits.rule: "Host(`f1-circuits.${DOMAIN:-localhost}`)"
+      traefik.http.routers.f1-circuits.entrypoints: websecure
+      traefik.http.routers.f1-circuits.tls.certresolver: le
+      traefik.http.services.f1-circuits.loadbalancer.server.port: "8000"
+      # CDN cache headers are set by the app itself
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true