diff --git a/configs/nym/compose.yml b/configs/nym/compose.yml
new file mode 100644
index 0000000..f639fce
--- /dev/null
+++ b/configs/nym/compose.yml
@@ -0,0 +1,45 @@
+# koopa-nym — nym-node (nym.com mixnet / NymVPN network)
+# Live host tree: ~/koopa-nym/  (copy this directory there)
+#
+# Host ports chosen to avoid Caddy 9000/9001 and Tor ORPort 8080.
+services:
+  nym:
+    build:
+      context: .
+      dockerfile: Containerfile
+    image: localhost/koopa-nym:latest
+    container_name: koopa-nym
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      NYM_HOME: /var/lib/nym
+      NYMNODE_ID: ${NYMNODE_ID:-koopa-nym}
+      NYMNODE_MODE: ${NYMNODE_MODE:-mixnode}
+      NYMNODE_PUBLIC_IPS: ${NYMNODE_PUBLIC_IPS:-}
+      NYMNODE_LOCATION: ${NYMNODE_LOCATION:-}
+      NYMNODE_HOSTNAME: ${NYMNODE_HOSTNAME:-}
+      NYMNODE_WG_ENABLED: ${NYMNODE_WG_ENABLED:-false}
+      NYMNODE_ACCEPT_OPERATOR_TERMS: ${NYMNODE_ACCEPT_OPERATOR_TERMS:-true}
+      NYMNODE_HTTP_BIND_ADDRESS: "[::]:8080"
+      NYMNODE_MIXNET_BIND_ADDRESS: "[::]:1789"
+      NYMNODE_VERLOC_BIND_ADDRESS: "[::]:1790"
+      NYMNODE_ENTRY_BIND_ADDRESS: "[::]:9000"
+      NYMNODE_EXTRA_ARGS: ${NYMNODE_EXTRA_ARGS:-}
+    volumes:
+      # identity + config.toml (bond keys live here — back up)
+      - ./data:/var/lib/nym
+    ports:
+      - "9080:8080"       # HTTP API / swagger
+      - "1789:1789/tcp"   # mixnet
+      - "1789:1789/udp"
+      - "1790:1790"       # verloc
+      # gateway / WG — uncomment when mode needs them:
+      # - "19000:9000"    # entry client websocket
+      # - "51822:51822/udp"  # WireGuard
+    labels:
+      org.hacktivism.service: nym
+      org.hacktivism.container: koopa-nym
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.network: nym.com
+      org.hacktivism.host_http_port: "9080"