diff --git a/.forgejo/workflows/debug.yml b/.forgejo/workflows/debug.yml
deleted file mode 100644
index 99a6650..0000000
--- a/.forgejo/workflows/debug.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Debug
-
-on: push
-
-jobs:
-  debug:
-    runs-on: docker
-    steps:
-      - run: echo "GITHUB_SHA=$GITHUB_SHA"
-      - run: echo "GITHUB_REF=$GITHUB_REF"
-      - run: echo "HOME=$HOME USER=$USER PWD=$PWD"
-      - run: |
-          cd /tmp
-          git clone https://vndangkhoa:Thieugia19@git.khoavo.myds.me/vndangkhoa/kv-tube.git 2>&1
-          ls -la /tmp/kv-tube/ | head -5
diff --git a/.forgejo/workflows/docker-build.yml b/.forgejo/workflows/docker-build.yml
new file mode 100644
index 0000000..3f018d9
--- /dev/null
+++ b/.forgejo/workflows/docker-build.yml
@@ -0,0 +1,72 @@
+name: Build & Push Docker Image
+
+on:
+  push:
+    branches: [main, master]
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      api_url:
+        description: 'API URL for frontend build'
+        required: false
+        default: 'http://ut.khoavo.myds.me:8981/api'
+        type: string
+
+jobs:
+  build:
+    runs-on: docker
+    steps:
+      - name: Tools check
+        run: |
+          echo "Docker: $(docker --version)"
+          echo "Git: $(git --version)"
+
+      - name: Checkout
+        run: |
+          cd /tmp
+          rm -rf kv-tube
+          git clone https://vndangkhoa:Thieugia19@git.khoavo.myds.me/vndangkhoa/kv-tube.git
+          cd kv-tube
+          git checkout ${GITHUB_SHA:-main}
+          echo "Checked out: $(git rev-parse --short HEAD)"
+
+      - name: Login to registry
+        run: echo "Thieugia19" | docker login git.khoavo.myds.me -u vndangkhoa --password-stdin
+
+      - name: Build and push
+        run: |
+          cd /tmp/kv-tube
+          SHA_SHORT=$(git rev-parse --short HEAD)
+          IMAGE="git.khoavo.myds.me/vndangkhoa/kv-tube"
+          TAGS="${IMAGE}:${SHA_SHORT}"
+          if [ "${GITHUB_REF}" = "refs/heads/main" ] || [ "${GITHUB_REF}" = "refs/heads/master" ]; then
+            TAGS="${TAGS},${IMAGE}:main"
+          fi
+          if echo "${GITHUB_REF}" | grep -q "refs/tags/v"; then
+            VERSION=${GITHUB_REF#refs/tags/v}
+            TAGS="${TAGS},${IMAGE}:${VERSION},${IMAGE}:latest"
+          fi
+          echo "Building tags: ${TAGS}"
+
+          TAG_ARGS=""
+          IFS=',' read -ra TAG_ARRAY <<< "${TAGS}"
+          for tag in "${TAG_ARRAY[@]}"; do
+            TAG_ARGS="${TAG_ARGS} -t ${tag}"
+          done
+
+          docker build \
+            ${TAG_ARGS} \
+            --build-arg NEXT_PUBLIC_API_URL=${{ github.event.inputs.api_url || 'http://ut.khoavo.myds.me:8981/api' }} \
+            .
+
+          for tag in "${TAG_ARRAY[@]}"; do
+            echo "Pushing ${tag}..."
+            docker push "${tag}"
+          done
+
+      - name: Verify
+        run: docker images | grep kv-tube
+
+      - name: Cleanup
+        if: always()
+        run: rm -rf /tmp/kv-tube