diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index c640d1b..c765a2c 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,47 +1,60 @@
-name: Deploy
+name: Deploy to Swarm
+
 on:
-  workflow_call:
-    inputs:
-      application:
-        description: Name of the path/application to deploy
-        type: string
-        required: true
-      image_version:
-        description: Docker image tag of the application to deploy
-        type: string
-        required: true
-      target:
-        description: Target overlay of deployment
-        type: string
-        required: true
-    secrets:
-      ACTIONS_GITHUB_TOKEN:
-        description: PAT with permission public_repo
-        required: true
-permissions:
-  contents: write
+  push:
+    paths:
+      - 'docker/**'
+
 jobs:
+  fact-finding:
+    name: Detect changed environments
+    runs-on: ubuntu-latest
+    outputs:
+      changed_envs: ${{ steps.detect.outputs.changed_envs }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Determine which environments changed
+        id: detect
+        run: |
+          echo "changed_envs=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep '^docker/' | cut -d/ -f2 | sort -u | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
+    needs: fact-finding
+    strategy:
+      matrix:
+        env: [ test ]
+    if: contains(needs.fact-finding.outputs.changed_envs, matrix.env)
+    environment: ${{ matrix.env }}
     steps:
       - uses: actions/checkout@v4
+      - name: Build & push Nginx image to GHCR
+        if: steps.detect.outputs.changed_envs != ''
+        run: |
+          docker build -t ghcr.io/2martens/docker-nginx:${{ matrix.env }} docker/${{ matrix.env }}/nginx
+          echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u 2martens --password-stdin
+          docker push ghcr.io/2martens/docker-nginx:${{ matrix.env }}
+      - name: Copy files to remote
+        if: steps.detect.outputs.changed_envs != ''
+        uses: burnett01/rsync-deployments@7.0.2
         with:
-          repository: 2martens/cloud-configuration
-          ref: main
-          token: ${{ secrets.ACTIONS_GITHUB_TOKEN }}
-      - name: Update image version
-        run: |
-          mkdir $HOME/bin
-          wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O $HOME/bin/yq && chmod +x $HOME/bin/yq
-          sed -i -r "s/(tag:).*/\1\ \"${{ inputs.image_version }}\"/" argocd/${{ inputs.application }}/${{ inputs.target }}/overwrite_values.yaml
-          cd argocd/${{ inputs.application }}/${{ inputs.target }} && $HOME/bin/yq '. *= load("overwrite_values.yaml")' default_values.yaml > values.yaml
-      - name: setup git config
-        run: |
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config user.name "github-actions[bot]"
-      - name: Save modified variable file
-        run: |
-          git add argocd/${{ inputs.application}}/${{ inputs.target }}/*
-          git diff-index --quiet HEAD || git commit -m "chore: Change ${{ inputs.application }}_image_version to ${{ inputs.image_version }}"
-          git push
\ No newline at end of file
+          switches: -az -r --del
+          path: docker/${{ matrix.env }}/stack-config/.
+          remote_path: ~/tmp/stack-config
+          remote_host: ${{ secrets.DEPLOY_HOST }}
+          remote_port: ${{ secrets.DEPLOY_PORT }}
+          remote_user: ${{ secrets.DEPLOY_USER }}
+          remote_key: ${{ secrets.DEPLOY_KEY }}
+      - name: Deploy applications
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_KEY }}
+          script: |
+            docker pull ghcr.io/2martens/docker-nginx:${{ matrix.env }}
+            docker service update --image ghcr.io/2martens/docker-nginx:${{ matrix.env }} nginx-proxy
+            for f in ~/tmp/stack-config/*.yaml; do
+              NAME=$(basename "$f" .yaml)
+              docker stack deploy -c "$f" "$NAME"
+            done
\ No newline at end of file
diff --git a/.github/workflows/update-image-version.yaml b/.github/workflows/update-image-version.yaml
new file mode 100644
index 0000000..f8cd9c9
--- /dev/null
+++ b/.github/workflows/update-image-version.yaml
@@ -0,0 +1,44 @@
+name: Update image version
+on:
+  workflow_call:
+    inputs:
+      application:
+        description: Name of the path/application to deploy
+        type: string
+        required: true
+      image_version:
+        description: Docker image tag of the application to deploy
+        type: string
+        required: true
+      target:
+        description: Target overlay of deployment
+        type: string
+        required: true
+    secrets:
+      ACTIONS_GITHUB_TOKEN:
+        description: PAT with permission public_repo
+        required: true
+permissions:
+  contents: write
+jobs:
+  update-image-version:
+    name: Update image version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: 2martens/cloud-configuration
+          ref: main
+          token: ${{ secrets.ACTIONS_GITHUB_TOKEN }}
+      - name: Update image version
+        run: |
+          sed -i -r "s/(image:.*:).*/\1${{ inputs.image_version }}/" docker/stack-config/${{ inputs.target }}/${{ inputs.application }}.yaml
+      - name: setup git config
+        run: |
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+      - name: Save modified variable file
+        run: |
+          git add docker/stack-config/${{ inputs.target }}/${{ inputs.application}}.yaml
+          git diff-index --quiet HEAD || git commit -m "chore: Change ${{ inputs.application }}_image_version to ${{ inputs.image_version }}"
+          git push
\ No newline at end of file
diff --git a/docker/test/nginx/Dockerfile b/docker/test/nginx/Dockerfile
new file mode 100644
index 0000000..c40627d
--- /dev/null
+++ b/docker/test/nginx/Dockerfile
@@ -0,0 +1,4 @@
+FROM nginx:mainline-alpine
+
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY paths-enabled /etc/nginx/paths-enabled.d
\ No newline at end of file
diff --git a/docker/test/nginx/nginx.conf b/docker/test/nginx/nginx.conf
new file mode 100644
index 0000000..c0bae3b
--- /dev/null
+++ b/docker/test/nginx/nginx.conf
@@ -0,0 +1,31 @@
+user nginx;
+worker_processes auto;
+events { worker_connections 1024; }
+http {
+    include mime.types;
+    default_type application/octet-stream;
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    # HTTP -> HTTPS redirect
+    server {
+      listen 80;
+      server_name api.2martens.de;
+      location /.well-known/acme-challenge/ { root /var/www/certbot; }
+      location / { return 301 https://$host$request_uri; }
+    }
+
+    server {
+      listen 443 ssl;
+      server_name api.2martens.de;
+
+      ssl_certificate     /etc/letsencrypt/live/api.2martens.de/fullchain.pem;
+      ssl_certificate_key /etc/letsencrypt/live/api.2martens.de/privkey.pem;
+
+      include /etc/nginx/paths-enabled.d/*.conf;
+
+      location / { return 404; }
+    }
+}
\ No newline at end of file
diff --git a/docker/test/nginx/paths-enabled/wahlrecht.conf b/docker/test/nginx/paths-enabled/wahlrecht.conf
new file mode 100644
index 0000000..51a2410
--- /dev/null
+++ b/docker/test/nginx/paths-enabled/wahlrecht.conf
@@ -0,0 +1,7 @@
+location /wahlrecht/ {
+    proxy_pass http://wahlrecht:12000/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
\ No newline at end of file
diff --git a/docker/test/stack-config/wahlrecht.yaml b/docker/test/stack-config/wahlrecht.yaml
new file mode 100644
index 0000000..54e28ec
--- /dev/null
+++ b/docker/test/stack-config/wahlrecht.yaml
@@ -0,0 +1,11 @@
+services:
+  wahlrecht:
+    image: 2martens/wahlrecht:0.3.8
+    networks:
+      - internal_net
+    deploy:
+      replicas: 1
+
+networks:
+  internal_net:
+    external: true
\ No newline at end of file