diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..d0ea50b
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,20 @@
+name: deploy
+on:
+  push:
+    branches:
+      - "main"
+
+concurrency:
+  group: production
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+    - uses: actions/checkout@v3
+    - uses: superfly/flyctl-actions/setup-flyctl@master
+    - run: flyctl -c etc/fly.toml deploy --remote-only
+      env:
+        FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
diff --git a/etc/fly.toml b/etc/fly.toml
new file mode 100644
index 0000000..1c72df5
--- /dev/null
+++ b/etc/fly.toml
@@ -0,0 +1,33 @@
+# This is the Fly config for my personal imageproxy instance.
+# It's probably not of much use for anyone else.
+
+app = "willnorris-imageproxy"
+
+[build]
+image = "ghcr.io/willnorris/imageproxy:main"
+
+[env]
+IMAGEPROXY_BASEURL = "https://willnorris.com/"
+IMAGEPROXY_ALLOWHOSTS = "*.willnorris.com,notsoserendipitous.com,gabenorris.com,judahnorris.com"
+IMAGEPROXY_CACHE = "/cache/"
+IMAGEPROXY_VERBOSE = true
+
+[mounts]
+source="willnorris_imageproxy_cache"
+destination="/cache"
+
+[deploy]
+strategy = "immediate"
+
+[[services]]
+  internal_port = 8080
+  protocol = "tcp"
+
+  [[services.ports]]
+    handlers = ["http"]
+    port = "80"
+    force_https = true
+
+  [[services.ports]]
+    handlers = ["tls", "http"]
+    port = "443"