diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
new file mode 100644
index 0000000..30608af
--- /dev/null
+++ b/.gitea/workflows/ci-cd.yml
@@ -0,0 +1,58 @@
+name: CI/CD - erp auth
+
+on:
+  pull_request:
+    branches:
+      - production
+    types:
+      - closed
+
+jobs:
+  build-and-deploy:
+    name: Build & Deploy
+    runs-on: linux
+    if: github.event.pull_request.merged == true
+
+    steps:
+      - name: Checkout code
+        run: |
+          git clone \
+            --depth 1 \
+            --branch production \
+            https://oauth2:${{ secrets.ERPAUTH }}@gitea.hexdive.com/New_REP_SYSTEM/ERP_Auth_Service.git \
+            .
+
+      - name: Restore
+        run: dotnet restore AuthHex.sln
+
+      - name: Publish
+        run: |
+          dotnet publish AuthHex.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained true \
+            -o /tmp/authhex-deploy
+
+      - name: Stop service
+        run: systemctl stop erpAuth.service || true
+
+      - name: Deploy
+        run: |
+          cp -r /tmp/authhex-deploy/* /var/www/internalServices/erpAuth/publish/
+
+      - name: Fix ownership and permissions
+        run: |
+          chown -R hexafitauth:hexafitauth /var/www/internalServices/erpAuth/publish/
+          find /var/www/internalServices/erpAuth/publish/ -type d -exec chmod 755 {} +
+          find /var/www/internalServices/erpAuth/publish/ -type f -exec chmod 644 {} +
+          chmod +x /var/www/internalServices/erpAuth/publish/AuthHex
+
+      - name: Start service
+        run: systemctl start erpAuth.service
+
+      - name: Verify
+        run: |
+          sleep 3
+          systemctl is-active erpAuth.service \
+            && echo "Service running" \
+            || (journalctl -u erpAuth.service -n 30 --no-pager && exit 1)
\ No newline at end of file
diff --git a/appsettings.json b/appsettings.json
index e2a4ab2..edf23e4 100644
--- a/appsettings.json
+++ b/appsettings.json
@@ -18,10 +18,7 @@
   "Kestrel": {
     "Endpoints": {
       "Http": {
-        "Url": "http://0.0.0.0:5011"
-      },
-      "Https": {
-        "Url": "https://0.0.0.0:7111"
+        "Url": "http://0.0.0.0:6703"
       }
     },
     "AllowedOrigins": [ "*" ]