diff --git a/.github/workflows/ci-site.yml b/.github/workflows/ci-site.yml
new file mode 100644
index 0000000..2fc449d
--- /dev/null
+++ b/.github/workflows/ci-site.yml
@@ -0,0 +1,68 @@
+name: site
+
+on:
+  push:
+    branches:
+    tags:
+    paths:
+      - ".github/workflows/ci-site.yml"
+      - "site/**"
+  pull_request:
+    paths:
+      - ".github/workflows/ci-site.yml"
+      - "site/**"
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+
+      - name: set up QEMU
+        uses: docker/setup-qemu-action@v1
+
+      - name: set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: available platforms
+        run: echo ${{ steps.buildx.outputs.platforms }}
+
+      - name: build and deploy master image to ghcr.io and dockerhub
+        if: ${{ github.ref == 'refs/heads/master' }}
+        env:
+          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
+          USERNAME: ${{ github.actor }}
+          GITHUB_SHA: ${{ github.sha}}
+          GITHUB_REF: ${{ github.ref}}
+        working-directory: ./site
+        run: |
+          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
+          echo GITHUB_REF - $ref
+          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
+          docker buildx build --push --no-cache --platform linux/amd64,linux/arm/v7,linux/arm64 \
+            -t ghcr.io/${USERNAME}/reproxy-site:${ref} .
+
+      - name: deploy tagged (latest) to ghcr.io and dockerhub
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        env:
+          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
+          USERNAME: ${{ github.actor }}
+          GITHUB_SHA: ${{ github.sha}}
+          GITHUB_REF: ${{ github.ref}}
+        working-directory: ./site
+        run: |
+          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
+          echo GITHUB_REF - $ref
+          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
+          docker buildx build --push --no-cache --platform linux/amd64,linux/arm/v7,linux/arm64 \
+            -t ghcr.io/${USERNAME}/reproxy-site:${ref} -t ghcr.io/${USERNAME}/reproxy-site:latest
+
+      - name: remote site deployment from master
+        if: ${{ github.ref == 'refs/heads/master' }}
+        env:
+          UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
+        run: curl https://jess.umputun.com/update/reproxy-site/${UPDATER_KEY}
diff --git a/Dockerfile.site b/Dockerfile.site
index 8b82dc5..6a15d4f 100644
--- a/Dockerfile.site
+++ b/Dockerfile.site
@@ -1,13 +1,15 @@
-FROM node:14-alpine
-
-WORKDIR build
+FROM node:16-alpine as build
 
+WORKDIR /build
 COPY site/ /build
 COPY README.md /build/src/index.md
 
-RUN yarn --frozen-lockfile && \
-	yarn build && \
-	ls -la /build/public
-
-CMD ["sleep", "100"]
+RUN yarn --frozen-lockfile
+RUN yarn build
+RUN	ls -la /build/public
 
+FROM ghcr.io/umputun/reproxy
+COPY --from=build /build/public /srv/site
+EXPOSE 8080
+USER app
+ENTRYPOINT ["/srv/reproxy", "--assets.location=/srv/site"]