diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index cc500a9..595e229 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -56,6 +56,7 @@ jobs:
       - name: Build image and (re)deploy container
         working-directory: deploy
         env:
+          AWG_CONF: ${{ secrets.AWG_CONF }}
           BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
           ACCESS_CODE: ${{ secrets.ACCESS_CODE }}
           PROJECT_LINK: ${{ vars.PROJECT_LINK }}
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 209c10a..a7da2a0 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -3,9 +3,33 @@
 # values are interpolated from Gitea Actions secrets/variables exported by the
 # deploy job. Joins the external `edge` network so the host reverse proxy can
 # route to `15-puzzle:8080`.
+#
+# Networking:
+#   - The `vpn` sidecar (developer/amneziawg-sidecar) holds an AmneziaWG
+#     tunnel and provides the netns shared by `app`. `app` joins it via
+#     network_mode: "service:vpn"; consequently `app` has no own network
+#     config — addresses, DNS and the default route belong to `vpn`.
+#   - `vpn` is the one attached to the `edge` network, with the alias
+#     `15-puzzle`, so the existing caddy → 15-puzzle:8080 reverse proxy
+#     continues to work without any caddy-side change. Port 8080 is
+#     reachable on the alias because `app` listens on it inside the
+#     shared netns.
+
 name: 15-puzzle
 
 services:
+  vpn:
+    container_name: 15-puzzle-vpn
+    image: docker.iliadenisov.ru/developer/amneziawg-sidecar:latest
+    restart: unless-stopped
+    privileged: true
+    environment:
+      AWG_CONF: ${AWG_CONF:?set AWG_CONF}
+    networks:
+      edge:
+        aliases:
+          - 15-puzzle
+
   app:
     container_name: 15-puzzle
     image: 15-puzzle:latest
@@ -13,6 +37,9 @@ services:
       context: ..
       dockerfile: Dockerfile
     restart: unless-stopped
+    depends_on:
+      - vpn
+    network_mode: "service:vpn"
     environment:
       BOT_TOKEN: ${BOT_TOKEN:?set BOT_TOKEN}
       ACCESS_CODE: ${ACCESS_CODE:?set ACCESS_CODE}
@@ -22,8 +49,6 @@ services:
       CONTEXT_ROOT: ${CONTEXT_ROOT:-/}
     volumes:
       - data:/data
-    networks:
-      - edge
 
 volumes:
   data:
@@ -31,4 +56,4 @@ volumes:
 
 networks:
   edge:
-    external: true
+    external: true
\ No newline at end of file