diff --git a/.env.example b/.env.example
index ef85acd..1ed141e 100644
--- a/.env.example
+++ b/.env.example
@@ -9,5 +9,6 @@ WEBHOOK_SECRET=
 REPO_DIR=/home/djoser/webgpu-portfolio
 
 # Bind address and port for the webhook listener
-LISTEN_HOST=0.0.0.0
+# Must be 127.0.0.1 — the webhook is served through system nginx proxy
+LISTEN_HOST=127.0.0.1
 LISTEN_PORT=9000
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..ee2f44a
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test-and-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npm run typecheck
+
+      - name: Tests
+        run: npm test
+
+      - name: Build
+        run: npm run build
diff --git a/webhook/gitea-runner.service b/webhook/gitea-runner.service
new file mode 100644
index 0000000..8a79248
--- /dev/null
+++ b/webhook/gitea-runner.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Gitea Actions Runner (webgpu-portfolio)
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=djoser
+ExecStart=/usr/local/bin/act_runner daemon --config /home/djoser/.gitea-act-runner/config.yaml
+WorkingDirectory=/home/djoser/.gitea-act-runner
+Restart=always
+RestartSec=5
+
+# Security
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/djoser/.gitea-act-runner /home/djoser/.cache/actcache /var/run/docker.sock
+
+[Install]
+WantedBy=multi-user.target
diff --git a/webhook/webhook.service b/webhook/webhook.service
index 2923bf4..f9d32f3 100644
--- a/webhook/webhook.service
+++ b/webhook/webhook.service
@@ -17,8 +17,7 @@ NoNewPrivileges=yes
 PrivateTmp=yes
 ProtectSystem=strict
 ProtectHome=read-only
-ReadWritePaths=/home/djoser/webgpu-portfolio
-ReadOnlyPaths=/var/run/docker.sock
+ReadWritePaths=/home/djoser/webgpu-portfolio /var/run/docker.sock /home/djoser/.docker
 
 [Install]
 WantedBy=multi-user.target