diff --git a/TODO.md b/TODO.md
index 89cc2e9..edd8643 100644
--- a/TODO.md
+++ b/TODO.md
@@ -94,6 +94,21 @@ See `docs/specs/rematch`.
 
 ## Deployment
 
+- [ ] Document the deployment (e.g. `docs/deployment.md`, or a `Jenkinsfile` in the repo). Today it is a Jenkins
+      job at `ci.playmancala.app` whose shell steps live only in Jenkins; it still builds from `apps/backend` and
+      `apps/frontend` and runs `cd apps && docker compose up -d`. For the Java backend it needs:
+      - `docker build -f apps/backend/Dockerfile -t jhalitaksoy/mancala-backend:latest .` from the repo root
+      - `docker build -f apps/frontend/Dockerfile` with `--build-arg` `SERVER_ADDRESS=https://api.playmancala.app`,
+        `WS_SERVER_ADDRESS=wss://api.playmancala.app`, `KEYCLOAK_URL=https://auth.playmancala.app`
+      - `docker build -t jhalitaksoy/mancala-keycloak:latest apps/keycloak`
+      - `docker compose --env-file <path>/mancala.env up -d` in `apps`, with the env file kept outside the Jenkins
+        workspace (`POSTGRES_PASSWORD`, `KEYCLOAK_DB_PASSWORD`, `MANCALA_DB_PASSWORD`, `KEYCLOAK_ADMIN_USERNAME`,
+        `KEYCLOAK_ADMIN_PASSWORD`, `KEYCLOAK_HOSTNAME=https://auth.playmancala.app`, `LEGACY_USERKEY_AUTH`)
+      - Once, by hand: the `auth.playmancala.app` block of `config/nginx.conf` on the server and an nginx reload.
+        DNS and the certificate for `auth.playmancala.app` already exist
+      - If Jenkins runs in a container with the host's Docker socket, the `./postgres/init` bind mount points at a
+        path the host does not have and the databases are not created; check before the first deploy
+      - Which branch the job builds, and whether it builds on push
 - [ ] Build the backend and frontend images from the repo root in CI:
       `docker build -f apps/backend/Dockerfile .` and `docker build -f apps/frontend/Dockerfile .`
 - [ ] Pass `--build-arg KEYCLOAK_URL=https://auth.playmancala.app` when building the frontend image