diff --git a/.forgejo/workflows/site.yml b/.forgejo/workflows/site.yml
new file mode 100644
index 0000000..9cd96f0
--- /dev/null
+++ b/.forgejo/workflows/site.yml
@@ -0,0 +1,72 @@
+# Auto-deploy the landing site (tane.comunes.org) on push to main.
+#
+# Replicates `ansible-playbook tane-landing.yml`: rsync site/ to groucho and
+# rebuild the Hugo->nginx container there. The runner (aaron) and groucho are on
+# the same internal subnet (10.20.20.x), so it deploys over direct SSH.
+#
+# Derived content (legal pages, screenshots) is still regenerated by hand and
+# committed — same as before; see site/DEPLOY.md. This workflow only ships what
+# is already in the repo.
+#
+# One-time setup (see site/DEPLOY.md):
+#   - Generate a deploy keypair; add the PUBLIC key to groucho:/root/.ssh/authorized_keys.
+#   - Store the PRIVATE key as the Forgejo repo secret GROUCHO_DEPLOY_KEY.
+
+name: site
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'site/**'
+      - 'docs/**'
+  workflow_dispatch:
+
+concurrency:
+  group: site-deploy
+  cancel-in-progress: false
+
+env:
+  GROUCHO_HOST: "10.20.20.116"
+  SITE_DEST: "/data/tane-landing/src/"
+
+jobs:
+  deploy:
+    runs-on: docker
+    container:
+      image: debian:bookworm-slim
+    steps:
+      - name: Install tools
+        run: apt-get update -qq && apt-get install -y -qq git rsync openssh-client curl
+
+      - name: Checkout (manual git, Node-free)
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure SSH deploy key
+        env:
+          GROUCHO_DEPLOY_KEY: ${{ secrets.GROUCHO_DEPLOY_KEY }}
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$GROUCHO_DEPLOY_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "$GROUCHO_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Sync site source to groucho
+        run: |
+          rsync -az --delete \
+            --exclude=public --exclude=resources --exclude=.hugo_build.lock \
+            site/ "root@${GROUCHO_HOST}:${SITE_DEST}"
+
+      - name: Rebuild the Hugo -> nginx container on groucho
+        run: |
+          ssh "root@${GROUCHO_HOST}" 'cd /data/tane-landing && docker compose up -d --build'
+
+      - name: Verify
+        run: curl -sI https://tane.comunes.org/ | head -1