diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..959cd48
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,25 @@
+# OpenFUT Docker stack configuration. Copy to .env and adjust.
+# All values have sensible defaults in docker-compose.yml; override as needed.
+
+# --- Container registry (Gitea) ---
+# Images resolve to ${REGISTRY}/${NAMESPACE}/<image>:${TAG}
+# e.g. git.aleshym.co/openfut/openfut-core:latest
+REGISTRY=git.aleshym.co
+NAMESPACE=openfut
+TAG=latest
+
+# --- Networking ---
+# Where the bridge (FIFA client entry point) is published. 0.0.0.0 = all
+# interfaces so LAN clients can connect. Set to a specific IP to restrict.
+BRIDGE_PUBLISH=0.0.0.0
+# Where core's REST API is published. 127.0.0.1 keeps it host-local (the bridge
+# still reaches it over the internal docker network). Set 0.0.0.0 to expose it.
+CORE_PUBLISH=127.0.0.1
+
+# --- Behaviour ---
+# Bridge returns placeholder JSON + captures unknown routes when true.
+PLACEHOLDER_MODE=true
+
+# --- Logging (RUST_LOG filters) ---
+CORE_LOG=openfut_core=info,tower_http=info
+BRIDGE_LOG=openfut_bridge=info,tower_http=info
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..fda3997
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,93 @@
+# ============================================================================
+# ⚠️ LEGACY (FIFA 23 lineage). This compose runs core + bridge for the
+# superseded FIFA 23 direction. It is NOT the canonical server bring-up.
+#
+# Canonical server (FIFA 17):
+#   cd fifa17-recon/docker/fifa17-python && docker compose up -d
+#   (runbook: fifa17-recon/FUT-RUNBOOK.md)
+#
+# `core` (openfut-core) IS still the shared, game-independent backend and is
+# used by the FIFA 17 UTAS host (OPENFUT_CORE_URL). `bridge` (openfut-bridge)
+# is the retired FIFA 23 integration, kept for reference.
+# Status source of truth: docs/PROJECT_STATE.md
+# ============================================================================
+# OpenFUT server stack — offline FUT backend (Core) + FIFA proxy (Bridge).
+#
+#   Bring up:    docker compose up -d
+#   Tear down:   docker compose down            (keeps data/captures volumes)
+#   Wipe state:  docker compose down -v         (also drops volumes)
+#   Rebuild:     docker compose build           (or ./scripts/registry.sh build)
+#   Logs:        docker compose logs -f
+#
+# Images are pulled from / pushed to the Gitea container registry. Override the
+# registry, namespace, or tag in .env (see .env.example). When REGISTRY is set,
+# `up` pulls prebuilt images; the build: blocks let you rebuild locally too.
+
+name: openfut
+
+services:
+  core:
+    image: ${REGISTRY:-git.aleshym.co}/${NAMESPACE:-openfut}/openfut-core:${TAG:-latest}
+    build:
+      context: ./openfut-core
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: 0.0.0.0:8080
+      DATABASE_URL: sqlite:///app/db/openfut.db
+      DATA_DIR: /app/data
+      RUST_LOG: ${CORE_LOG:-openfut_core=info,tower_http=info}
+    volumes:
+      - core-db:/app/db
+    # Bound to localhost by default — the bridge reaches core over the internal
+    # network, so core need not be world-exposed. Set CORE_PUBLISH=0.0.0.0 in
+    # .env if you want to hit the REST API directly from other hosts.
+    ports:
+      - "${CORE_PUBLISH:-127.0.0.1}:8080:8080"
+    networks:
+      - openfut
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
+      interval: 15s
+      timeout: 4s
+      retries: 5
+      start_period: 10s
+
+  bridge:
+    image: ${REGISTRY:-git.aleshym.co}/${NAMESPACE:-openfut}/openfut-bridge:${TAG:-latest}
+    build:
+      context: ./openfut-bridge
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    depends_on:
+      core:
+        condition: service_healthy
+    environment:
+      BRIDGE_LISTEN_ADDR: 0.0.0.0:8443
+      CORE_URL: http://core:8080
+      CAPTURES_DIR: /app/captures
+      PLACEHOLDER_MODE: ${PLACEHOLDER_MODE:-true}
+      TLS_ENABLED: "true"
+      RUST_LOG: ${BRIDGE_LOG:-openfut_bridge=info,tower_http=info}
+    volumes:
+      - bridge-captures:/app/captures
+    # The FIFA client connects here — publish on all interfaces by default so
+    # LAN clients (e.g. 10.10.0.0/24) can reach it.
+    ports:
+      - "${BRIDGE_PUBLISH:-0.0.0.0}:8443:8443"
+    networks:
+      - openfut
+    healthcheck:
+      test: ["CMD", "curl", "-fsSk", "https://127.0.0.1:8443/_bridge/health"]
+      interval: 15s
+      timeout: 4s
+      retries: 5
+      start_period: 8s
+
+networks:
+  openfut:
+    driver: bridge
+
+volumes:
+  core-db:
+  bridge-captures: