diff --git a/.gitignore b/.gitignore
index f68c7211..0e2d5c6a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
+# Docker secrets
+.env
+Server/.env
+
 # Claude Code local config
 .claude/
 Client/.claude/
diff --git a/Server/.env.example b/Server/.env.example
new file mode 100644
index 00000000..add59365
--- /dev/null
+++ b/Server/.env.example
@@ -0,0 +1,7 @@
+# Copy this file to .env and fill in your values.
+# .env is gitignored — never commit real secrets.
+
+# LiveKit credentials — generate strong random values (min 32 chars for secret)
+# These must match the keys: section in livekit.yaml
+LIVEKIT_API_KEY=change-me-api-key
+LIVEKIT_API_SECRET=change-me-api-secret-must-be-at-least-32-characters
diff --git a/Server/docker-compose.yml b/Server/docker-compose.yml
new file mode 100644
index 00000000..ac45fa1c
--- /dev/null
+++ b/Server/docker-compose.yml
@@ -0,0 +1,54 @@
+# OwnCord server stack — chat server + LiveKit voice/video
+#
+# Quick start:
+#   1. cp .env.example .env  && edit .env (set secrets + public IP)
+#   2. cp livekit.yaml.example livekit.yaml  && edit livekit.yaml (same keys)
+#   3. docker compose up -d
+#
+# LiveKit runs as a separate container on the same internal network.
+# The OwnCord server reaches it at ws://livekit:7880 (Docker DNS).
+# Browser clients reach LiveKit directly via the ports published below,
+# so your firewall must allow TCP 7880-7881 and UDP 50000-60000.
+
+services:
+
+  owncord:
+    image: ghcr.io/j3vb/owncord-server:latest
+    restart: unless-stopped
+    ports:
+      - "8443:8443"
+    environment:
+      # Secrets injected from .env — never hardcode these
+      OWNCORD_VOICE_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY}
+      OWNCORD_VOICE_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET}
+    volumes:
+      # Mount your config.yaml for non-secret settings (server name, TLS, etc.)
+      # See the example config at: https://github.com/J3vb/OwnCord#configuration
+      - ./config.yaml:/app/config.yaml:ro
+      # Persistent data (SQLite DB + uploaded files)
+      - owncord-data:/app/data
+    depends_on:
+      - livekit
+    networks:
+      - owncord-net
+
+  livekit:
+    image: livekit/livekit-server:v1
+    restart: unless-stopped
+    # LiveKit config file — copy livekit.yaml.example → livekit.yaml and fill in
+    command: --config /etc/livekit/livekit.yaml
+    ports:
+      - "7880:7880"            # WebSocket API (OwnCord server + browser signalling)
+      - "7881:7881"            # TCP fallback for WebRTC (clients behind strict NAT)
+      - "50000-60000:50000-60000/udp"  # WebRTC UDP media streams
+    volumes:
+      - ./livekit.yaml:/etc/livekit/livekit.yaml:ro
+    networks:
+      - owncord-net
+
+networks:
+  owncord-net:
+    driver: bridge
+
+volumes:
+  owncord-data:
diff --git a/Server/livekit.yaml.example b/Server/livekit.yaml.example
new file mode 100644
index 00000000..31001e55
--- /dev/null
+++ b/Server/livekit.yaml.example
@@ -0,0 +1,24 @@
+# LiveKit server configuration for OwnCord
+# Copy this file to livekit.yaml and fill in your values.
+# The api_key and api_secret here MUST match the values in your .env file.
+
+port: 7880
+
+rtc:
+  tcp_port: 7881
+  port_range_start: 50000
+  port_range_end: 60000
+
+  # Your server's public IP address — required so browser WebRTC clients can
+  # reach LiveKit directly for media. Leave blank only if running entirely on
+  # localhost (development). On cloud VMs with a metadata service (AWS, GCP,
+  # DigitalOcean) you can set use_external_ip: true instead.
+  node_ip: "YOUR_SERVER_PUBLIC_IP"
+  # use_external_ip: true   # uncomment on cloud VMs instead of node_ip
+
+keys:
+  # Must match LIVEKIT_API_KEY / LIVEKIT_API_SECRET in your .env file
+  YOUR_API_KEY: YOUR_API_SECRET
+
+logging:
+  level: info