diff --git a/app/frontend/deploy/frontend-tricot-neptune.hcl b/app/frontend/deploy/frontend-tricot-neptune.hcl
new file mode 100644
index 0000000..903a0ed
--- /dev/null
+++ b/app/frontend/deploy/frontend-tricot-neptune.hcl
@@ -0,0 +1,66 @@
+job "frontend" {
+  datacenters = ["neptune"]
+  type = "service"
+  priority = 90
+
+  group "tricot" {
+    constraint {
+      attribute = "${attr.unique.hostname}"
+      operator = "="
+      value = "carcajou"
+    }
+
+    network {
+      port "http_port" { static = 80 }
+      port "https_port" { static = 443 }
+      port "admin_port" { static = 8082 }
+    }
+
+    task "server" {
+      driver = "docker"
+
+      config {
+        image = "lxpz/amd64_tricot:17"
+        network_mode = "host"
+        readonly_rootfs = true
+        ports = [ "http_port", "https_port", "admin_port" ]
+      }
+
+      resources {
+        cpu = 1000
+        memory = 100
+      }
+
+      restart {
+        interval = "30m"
+        attempts = 2
+        delay    = "15s"
+        mode     = "delay"
+      }
+
+      template {
+        data = <<EOH
+TRICOT_NODE_NAME={{ env "attr.unique.hostname" }}
+TRICOT_LETSENCRYPT_EMAIL=alex@adnab.me
+RUST_LOG=tricot=trace
+EOH
+        destination = "secrets/env"
+        env = true
+      }
+
+      service {
+        name = "tricot-http"
+        port = "http_port"
+        tags = [ "(diplonat (tcp_port 80))" ]
+        address_mode = "host"
+      }
+
+      service {
+        name = "tricot-https"
+        port = "https_port"
+        tags = [ "(diplonat (tcp_port 443))" ]
+        address_mode = "host"
+      }
+    }
+  }
+}