diff --git a/ummah-wordpress/docker-stack.yml b/ummah-wordpress/docker-stack.yml
new file mode 100644
index 0000000..791cabd
--- /dev/null
+++ b/ummah-wordpress/docker-stack.yml
@@ -0,0 +1,83 @@
+version: "3.9"
+
+# ummah2.falahos.my — WordPress on Contabo Docker Swarm
+# Deploy: docker stack deploy -c docker-stack.yml --with-registry-auth ummah2
+
+services:
+  db:
+    image: mariadb:11
+    environment:
+      MYSQL_ROOT_PASSWORD: "FalahDB_Root_2026!"
+      MYSQL_DATABASE: ummah2_wp
+      MYSQL_USER: ummah2_wp
+      MYSQL_PASSWORD: "FalahDB_WP_2026!"
+    volumes:
+      - ummah2-db-data:/var/lib/mysql
+    networks:
+      - ummah2-internal
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+
+  wordpress:
+    image: wordpress:6.7-php8.3-apache
+    depends_on:
+      - db
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_NAME: ummah2_wp
+      WORDPRESS_DB_USER: ummah2_wp
+      WORDPRESS_DB_PASSWORD: "FalahDB_WP_2026!"
+      WORDPRESS_TABLE_PREFIX: wp_umm_
+      WORDPRESS_DEBUG: "false"
+      PHP_MEMORY_LIMIT: 256M
+      WORDPRESS_CONFIG_EXTRA: |
+        define('WP_MEMORY_LIMIT', '256M');
+        define('WP_HOME', 'https://ummah2.falahos.my');
+        define('WP_SITEURL', 'https://ummah2.falahos.my');
+        $_SERVER['HTTPS'] = 'on';
+        define('FORCE_SSL_ADMIN', true);
+    volumes:
+      - ummah2-wp-data:/var/www/html
+    networks:
+      - ummah2-internal
+      - falah_traefik-net
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "traefik.enable=true"
+        - "traefik.docker.network=falah_traefik-net"
+        # HTTPS router
+        - "traefik.http.routers.ummah2wp.rule=Host(`ummah2.falahos.my`)"
+        - "traefik.http.routers.ummah2wp.entrypoints=websecure"
+        - "traefik.http.routers.ummah2wp.tls=true"
+        - "traefik.http.routers.ummah2wp.middlewares=ratelimit-public,sec-headers,compress"
+        - "traefik.http.services.ummah2wp.loadbalancer.server.port=80"
+        # HTTP router (Cloudflare handles HTTP→HTTPS)
+        - "traefik.http.routers.ummah2wp-http.rule=Host(`ummah2.falahos.my`)"
+        - "traefik.http.routers.ummah2wp-http.entrypoints=web"
+        - "traefik.http.routers.ummah2wp-http.service=ummah2wp"
+
+networks:
+  ummah2-internal:
+    driver: overlay
+    attachable: true
+  falah_traefik-net:
+    external: true
+
+volumes:
+  ummah2-db-data:
+    external: true
+    name: ummah2-db-data
+  ummah2-wp-data:
+    external: true
+    name: ummah2-wp-data