diff --git a/docker/wkd/docker-compose.toml b/docker/wkd/docker-compose.toml
new file mode 100644
index 0000000..7e3a707
--- /dev/null
+++ b/docker/wkd/docker-compose.toml
@@ -0,0 +1,21 @@
+[services.wkd]
+image = "nginx"
+container_name = "wkd"
+volumes = [
+  "/var/www/wkd:/wkd:ro",
+  "./nginx.conf:/etc/nginx/conf.d/default.conf",
+]
+networks = ["proxy"]
+restart = "unless-stopped"
+labels = [
+  "traefik.enable=true",
+  "traefik.docker.network=proxy",
+  "traefik.http.routers.wkd.entrypoints=https",
+  "traefik.http.routers.wkd.middlewares=secHeaders@file,compress@file",
+  "traefik.http.routers.wkd.rule=Host(`openpgpkey.korhonen.cc`)",
+  "traefik.http.routers.wkd.service=wkd",
+  "traefik.http.services.wkd.loadbalancer.server.port=80",
+]
+
+[networks.proxy]
+external = true
diff --git a/docker/wkd/nginx.conf b/docker/wkd/nginx.conf
new file mode 100644
index 0000000..bab4f16
--- /dev/null
+++ b/docker/wkd/nginx.conf
@@ -0,0 +1,10 @@
+server {
+  listen       80;
+  listen  [::]:80;
+
+  location /.well-known/openpgpkey/hu/ {
+    default_type        "application/octet-stream";
+    add_header          Access-Control-Allow-Origin * always;
+  }
+}
+