diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..935faaf
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,58 @@
+version: '3.8'
+
+services:
+  veille-reglementaire:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: veille-reglementaire-app
+    container_name: veille-reglementaire
+    restart: unless-stopped
+    env_file:
+      - .env
+    networks:
+      - web
+      - veille-internal
+    labels:
+      # HTTP → HTTPS redirect
+      - "traefik.enable=true"
+      - "traefik.http.routers.veille.rule=Host(`veille.santinova-soft.org`)"
+      - "traefik.http.routers.veille.entrypoints=web"
+      - "traefik.http.routers.veille.middlewares=redirect-to-https"
+      # HTTPS
+      - "traefik.http.routers.veille-secure.rule=Host(`veille.santinova-soft.org`)"
+      - "traefik.http.routers.veille-secure.entrypoints=websecure"
+      - "traefik.http.routers.veille-secure.tls=true"
+      - "traefik.http.routers.veille-secure.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.veille-secure.service=veille-svc"
+      # Service
+      - "traefik.http.services.veille-svc.loadbalancer.server.port=3000"
+      - "traefik.docker.network=web"
+  veille-db:
+    image: mysql:8.0
+    container_name: veille-db
+    restart: unless-stopped
+    environment:
+      - MYSQL_ROOT_PASSWORD=VeilleRootDB2026!
+      - MYSQL_DATABASE=veille_reglementaire
+      - MYSQL_USER=veille_user
+      - MYSQL_PASSWORD=VeilleDB2026Secure!
+    volumes:
+      - veille-db-data:/var/lib/mysql
+    networks:
+      - veille-internal
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-pVeilleRootDB2026!"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+volumes:
+  veille-db-data:
+
+networks:
+  web:
+    external: true
+  veille-internal:
+    driver: bridge