diff --git a/.woodpecker/deploy.yml b/.woodpecker/deploy.yml
new file mode 100644
index 0000000..93a2bdf
--- /dev/null
+++ b/.woodpecker/deploy.yml
@@ -0,0 +1,295 @@
+when:
+  - event: push
+    branch: main
+
+steps:
+  validate:
+    image: alpine:latest
+    commands:
+      - apk add --no-cache docker-cli docker-cli-compose
+      - |
+        # Collect changed stacks — both flat files and folder-based
+        CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
+
+        # Flat: any root-level *.yaml
+        FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true)
+
+        # Folder: any file under a subfolder (e.g. immich/immich.yml)
+        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
+
+        [ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0
+
+        for f in $FLAT; do
+          [ -f "$f" ] || continue
+          docker compose -f "$f" --no-interpolate config -q \
+            && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
+        done
+
+        for d in $FOLDERS; do
+          [ -d "$d" ] || continue
+          # Build -f flags for all compose files in folder, main first
+          MAIN=""
+          EXTRAS=""
+          for ext in yml yaml; do
+            [ -f "$d/$d.$ext" ] && MAIN="$d/$d.$ext" && break
+          done
+          [ -z "$MAIN" ] && echo "  SKIP $d (no main compose file)" && continue
+          for cf in $(find "$d" -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) | sort); do
+            [ "$cf" = "$MAIN" ] && continue
+            EXTRAS="$EXTRAS -f $cf"
+          done
+          docker compose -f "$MAIN" $EXTRAS --no-interpolate config -q \
+            && echo "  OK $d/" || { echo "  FAIL $d/"; exit 1; }
+        done
+
+  provision-secrets:
+    image: alpine:latest
+    environment:
+      SSH_KEY:
+        from_secret: ssh_key
+      SWARM_MANAGER_IP:
+        from_secret: swarm_manager_ip
+      3DPRINT_DB_PASSWORD:
+        from_secret: 3dprint_db_password
+      GAMMA_AUTH_TOKEN:
+        from_secret: gamma_auth_token
+      GIT_DB_PASSWORD:
+        from_secret: git_db_password
+      GIT_RUNNER_TOKEN:
+        from_secret: git_runner_token
+      GIT_MCP_ACCESS_TOKEN:
+        from_secret: git_mcp_access_token
+      HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
+        from_secret: homeassistant_frigate_rtsp_password
+      HOMEASSISTANT_IMMICH_API_KEY:
+        from_secret: homeassistant_immich_api_key
+      IMMICH_DB_PASSWORD:
+        from_secret: immich_db_password
+      IMMICH_KIOSK_BASICAUTH:
+        from_secret: immich_kiosk_basicauth
+      MEALIE_DB_PASSWORD:
+        from_secret: mealie_db_password
+      MEALIE_LDAP_QUERY_PASSWORD:
+        from_secret: mealie_ldap_query_password
+      MESHCENTRAL_BACKUP_PASSWORD:
+        from_secret: meshcentral_backup_password
+      N8N_DB_PASSWORD:
+        from_secret: n8n_db_password
+      N8N_ENCRYPTION_KEY:
+        from_secret: n8n_encryption_key
+      POSTGRESQL_PASSWORD:
+        from_secret: postgresql_password
+      POSTGRESQL_PGADMIN_PASSWORD:
+        from_secret: postgresql_pgadmin_password
+      PRODUCTIVITY_PAPERLESS_SECRET_KEY:
+        from_secret: productivity_paperless_secret_key
+      PRODUCTIVITY_DB_PASSWORD:
+        from_secret: productivity_db_password
+      PRODUCTIVITY_OIDC_PROVIDERS:
+        from_secret: productivity_oidc_providers
+      VAULTWARDEN_ADMIN_TOKEN:
+        from_secret: vaultwarden_admin_token
+      VAULTWARDEN_DATABASE_URL:
+        from_secret: vaultwarden_database_url
+      ENTERTAINMENT_DISCORD_TOKEN:
+        from_secret: entertainment_discord_token
+      ENTERTAINMENT_DISCORD_CLIENT_SECRET:
+        from_secret: entertainment_discord_client_secret
+      ENTERTAINMENT_SECRET_KEY_BASE:
+        from_secret: entertainment_secret_key_base
+      ENTERTAINMENT_BASIC_AUTH_PASSWORD:
+        from_secret: entertainment_basic_auth_password
+      ENTERTAINMENT_SPARKY_DB_PASSWORD:
+        from_secret: entertainment_sparky_db_password
+      ENTERTAINMENT_SPARKY_APP_DB_PASSWORD:
+        from_secret: entertainment_sparky_app_db_password
+      ENTERTAINMENT_SPARKY_ENCRYPTION_KEY:
+        from_secret: entertainment_sparky_encryption_key
+      ENTERTAINMENT_BETTER_AUTH_SECRET:
+        from_secret: entertainment_better_auth_secret
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p ~/.ssh
+      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
+      - chmod 600 ~/.ssh/id_rsa
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - |
+        CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
+        FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
+        ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
+        [ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0
+      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh
+      - |
+        CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
+        FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
+        ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
+
+        for STACK in $ALL_STACKS; do
+          echo "Provisioning: $STACK"
+          case "$STACK" in
+            maintenance|media|unifi|guacamole|security|auth|traefik|meshcentral|ddm)
+              echo "  No Docker secrets for $STACK — secrets in host .env";;
+            immich)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'immich_db_password'     '${IMMICH_DB_PASSWORD}'
+                create_or_update_secret 'immich_kiosk_basicauth' '${IMMICH_KIOSK_BASICAUTH}'";;
+            woodpecker)
+              echo "  Manual only — skipping";;
+            3dprint)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
+            gamma)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
+            git)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'git_db_password'       '${GIT_DB_PASSWORD}'
+                create_or_update_secret 'git_runner_token'      '${GIT_RUNNER_TOKEN}'
+                create_or_update_secret 'git_mcp_access_token'  '${GIT_MCP_ACCESS_TOKEN}'";;
+            homeassistant)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
+                create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
+            mealie)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'
+                create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
+            n8n)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'n8n_db_password'     '${N8N_DB_PASSWORD}'
+                create_or_update_secret 'n8n_encryption_key'  '${N8N_ENCRYPTION_KEY}'";;
+            postgresql)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'postgresql_password'         '${POSTGRESQL_PASSWORD}'
+                create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
+            productivity)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
+                create_or_update_secret 'productivity_db_password'          '${PRODUCTIVITY_DB_PASSWORD}'
+                create_or_update_secret 'productivity_oidc_providers'       '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
+            vaultwarden)
+              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}"  | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token  2>/dev/null; docker secret create vaultwarden_admin_token -"
+              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
+            ai)
+              echo "  No Docker secrets for ai -- secrets in host .env";;
+            entertainment)
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'entertainment_discord_token'          '${ENTERTAINMENT_DISCORD_TOKEN}'
+                create_or_update_secret 'entertainment_discord_client_secret'  '${ENTERTAINMENT_DISCORD_CLIENT_SECRET}'
+                create_or_update_secret 'entertainment_secret_key_base'        '${ENTERTAINMENT_SECRET_KEY_BASE}'
+                create_or_update_secret 'entertainment_basic_auth_password'    '${ENTERTAINMENT_BASIC_AUTH_PASSWORD}'
+                create_or_update_secret 'entertainment_sparky_db_password'     '${ENTERTAINMENT_SPARKY_DB_PASSWORD}'
+                create_or_update_secret 'entertainment_sparky_app_db_password' '${ENTERTAINMENT_SPARKY_APP_DB_PASSWORD}'
+                create_or_update_secret 'entertainment_sparky_encryption_key'  '${ENTERTAINMENT_SPARKY_ENCRYPTION_KEY}'
+                create_or_update_secret 'entertainment_better_auth_secret'     '${ENTERTAINMENT_BETTER_AUTH_SECRET}'";;
+            *)
+              echo "  No secrets case for $STACK";;
+          esac
+        done
+
+  deploy:
+    image: alpine:latest
+    environment:
+      SSH_KEY:
+        from_secret: ssh_key
+      SWARM_MANAGER_IP:
+        from_secret: swarm_manager_ip
+    commands:
+      - apk add --no-cache openssh-client rsync
+      - mkdir -p ~/.ssh
+      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
+      - chmod 600 ~/.ssh/id_rsa
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - |
+        CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
+        FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
+        ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
+        [ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0
+
+        # Always sync deploy/ scripts first
+        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
+          deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
+
+        for STACK in $ALL_STACKS; do
+          echo "--- Deploying: $STACK ---"
+          # Sync files to host first (always, even for bootstrap stacks)
+          if [ -d "$STACK" ]; then
+            rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
+              "$STACK/" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/$STACK/
+          elif [ -f "${STACK}.yaml" ]; then
+            rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
+              "${STACK}.yaml" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
+          fi
+
+          # Bootstrap-tier guard: file synced to host, deploy is MANUAL
+          case "$STACK" in
+            traefik|woodpecker|postgresql)
+              echo "  [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
+              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
+              continue ;;
+          esac
+
+          # Tier 2: auto-deploy
+          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
+            "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
+            && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
+        done
+
+  verify:
+    image: alpine:latest
+    environment:
+      SSH_KEY:
+        from_secret: ssh_key
+      SWARM_MANAGER_IP:
+        from_secret: swarm_manager_ip
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p ~/.ssh
+      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
+      - chmod 600 ~/.ssh/id_rsa
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - |
+        CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
+        FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
+        ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
+        [ -z "$ALL_STACKS" ] && exit 0
+        sleep 5
+        for STACK in $ALL_STACKS; do
+          echo "--- $STACK ---"
+          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
+            "docker stack ps $STACK --filter desired-state=running \
+            --format '  {{.Name}} {{.CurrentState}}'"
+        done
+
+  notify-success:
+    image: alpine:latest
+    environment:
+      TEAMS_WEBHOOK:
+        from_secret: teams_webhook
+    commands:
+      - apk add --no-cache curl
+      - |
+        CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
+        PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
+        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
+    when:
+      - status: success
+
+  notify-failure:
+    image: alpine:latest
+    environment:
+      TEAMS_WEBHOOK:
+        from_secret: teams_webhook
+      WOODPECKER_HOST:
+        from_secret: woodpecker_host
+    commands:
+      - apk add --no-cache curl
+      - |
+        PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://%s","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE" "$WOODPECKER_HOST")
+        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
+    when:
+      - status: failure