diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2e34f13
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+.git
+.zig-cache
+zig-out
+dev/*.sqlite3
+dev/*.sqlite3-*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..931ccd3
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,37 @@
+FROM debian:bookworm-slim AS build
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl git xz-utils libc6-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG ZIG_VERSION=0.16.0
+ARG ZIG_TARGET=x86_64-linux
+RUN curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-${ZIG_TARGET}-${ZIG_VERSION}.tar.xz" -o /tmp/zig.tar.xz \
+    && mkdir -p /opt/zig \
+    && tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1 \
+    && rm /tmp/zig.tar.xz
+
+ENV PATH="/opt/zig:${PATH}"
+
+WORKDIR /work
+RUN git clone --depth=1 https://tangled.org/zat.dev/zat /work/zat.dev/zat
+
+WORKDIR /work/zzstoatzz.io/zds
+COPY . .
+RUN zig build -Doptimize=ReleaseSafe
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY --from=build /work/zzstoatzz.io/zds/zig-out/bin/zds /usr/local/bin/zds
+
+ENV ZDS_HOST=0.0.0.0
+ENV ZDS_PORT=2583
+ENV ZDS_DB=/data/zds.sqlite3
+
+EXPOSE 2583
+CMD ["zds", "--host", "0.0.0.0", "--port", "2583", "--db", "/data/zds.sqlite3"]
diff --git a/fly.toml b/fly.toml
new file mode 100644
index 0000000..e1f1bbf
--- /dev/null
+++ b/fly.toml
@@ -0,0 +1,29 @@
+app = "zds-zzstoatzz-io"
+primary_region = "ord"
+
+[build]
+  dockerfile = "Dockerfile"
+
+[env]
+  ZDS_HOST = "0.0.0.0"
+  ZDS_DB = "/data/zds.sqlite3"
+  ZDS_PUBLIC_URL = "https://zds-zzstoatzz-io.fly.dev"
+  ZDS_SERVER_DID = "did:web:zds-zzstoatzz-io.fly.dev"
+  ZDS_HANDLE_DOMAINS = ".zds-zzstoatzz-io.fly.dev,zds-zzstoatzz-io.fly.dev"
+  ZDS_BLOB_UPLOAD_LIMIT = "100000000"
+
+[[mounts]]
+  source = "zds_data"
+  destination = "/data"
+
+[http_service]
+  internal_port = 2583
+  force_https = true
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 1
+
+[[vm]]
+  memory = "1gb"
+  cpu_kind = "shared"
+  cpus = 1
diff --git a/src/main.zig b/src/main.zig
index 891cfd0..8d8556b 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -2,11 +2,12 @@ const std = @import("std");
 const zds = @import("zds");
 
 pub fn main(init: std.process.Init) !void {
+    var host: []const u8 = cGetenv("ZDS_HOST") orelse "127.0.0.1";
     var port: u16 = 2583;
     var db_path: []const u8 = "dev/zds.sqlite3";
-    var public_url: ?[]const u8 = null;
-    var server_did: ?[]const u8 = null;
-    var plc_directory: ?[]const u8 = null;
+    var public_url: ?[]const u8 = cGetenv("ZDS_PUBLIC_URL");
+    var server_did: ?[]const u8 = cGetenv("ZDS_SERVER_DID");
+    var plc_directory: ?[]const u8 = cGetenv("ZDS_PLC_DIRECTORY");
     var email_from: ?[]const u8 = cGetenv("ZDS_EMAIL_FROM");
     var resend_api_key: ?[]const u8 = cGetenv("ZDS_RESEND_API_KEY");
     var blob_upload_limit: ?usize = try envUsize("ZDS_BLOB_UPLOAD_LIMIT");
@@ -25,6 +26,10 @@ pub fn main(init: std.process.Init) !void {
             port = try std.fmt.parseInt(u16, value, 10);
             continue;
         }
+        if (std.mem.eql(u8, arg, "--host")) {
+            host = args.next() orelse return error.MissingHost;
+            continue;
+        }
         if (std.mem.eql(u8, arg, "--db")) {
             db_path = args.next() orelse return error.MissingDatabasePath;
             continue;
@@ -66,6 +71,10 @@ pub fn main(init: std.process.Init) !void {
             port = try std.fmt.parseInt(u16, arg["--port=".len..], 10);
             continue;
         }
+        if (std.mem.startsWith(u8, arg, "--host=")) {
+            host = arg["--host=".len..];
+            continue;
+        }
         if (std.mem.startsWith(u8, arg, "--db=")) {
             db_path = arg["--db=".len..];
             continue;
@@ -115,12 +124,12 @@ pub fn main(init: std.process.Init) !void {
     if (jwt_secret) |value| zds.core.config.setJwtSecret(value);
 
     try zds.storage.store.init(init.io, db_path);
-    try zds.http.server.listen(init.io, .{ .port = port });
+    try zds.http.server.listen(init.io, .{ .host = host, .port = port });
 }
 
 fn usage() void {
     std.debug.print(
-        \\usage: zds [--port PORT] [--db PATH] [--public-url URL] [--server-did DID]
+        \\usage: zds [--host HOST] [--port PORT] [--db PATH] [--public-url URL] [--server-did DID]
         \\           [--blob-upload-limit BYTES] [--handle-domains DOMAINS] [--jwt-secret SECRET]
         \\
         \\Runs a local PDS-shaped HTTP server.