diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9f9004b..ae40a3e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -27,11 +27,36 @@ jobs:
           username: ${{ secrets.SERVER_USER }}
           key: ${{ secrets.SERVER_SSH_KEY }}
           script: |
-            cd /opt/apps/${{ github.event.repository.name }}
+            APP_NAME="${{ github.event.repository.name }}"
+            cd /opt/apps/${APP_NAME}
             git pull origin main
+
+            # Verify app .env exists
+            if [ ! -f deploy/.env ]; then
+              echo "ERROR: deploy/.env not found. Create it from deploy/env.template first."
+              exit 1
+            fi
+
+            # Create app-specific database if it doesn't exist
+            APP_DB=$(echo "${APP_NAME}" | tr '-' '_')_db
+            docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
+              psql -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${APP_DB}'" | grep -q 1 \
+              || docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
+              psql -U postgres -c "CREATE DATABASE ${APP_DB}"
+
+            # Build and start app containers
             docker compose -f deploy/docker-compose.yml up -d --build
+
+            # Run database migrations
             docker compose -f deploy/docker-compose.yml exec -T app alembic -c app/alembic.ini upgrade head
+
+            # Health check
             bash scripts/health-check.sh https://${{ secrets.APP_DOMAIN }}/health
-            # Register app with platform Caddy
-            ln -sf /opt/apps/${{ github.event.repository.name }}/deploy/Caddyfile /opt/platform/caddy-apps/${{ github.event.repository.name }}.caddy
+
+            # Generate rendered Caddyfile for platform Caddy
+            cat > /opt/platform/caddy-apps/${APP_NAME}.caddy <<CADDYEOF
+            ${{ secrets.APP_DOMAIN }} {
+                reverse_proxy ${APP_NAME}-app-1:8000
+            }
+            CADDYEOF
             docker compose -f /opt/platform/docker-compose.yml exec -T caddy caddy reload --config /etc/caddy/Caddyfile
diff --git a/deploy/env.template b/deploy/env.template
index b1ed466..f2e543c 100644
--- a/deploy/env.template
+++ b/deploy/env.template
@@ -1,7 +1,10 @@
+# Copy this file to .env and fill in real values before first deploy.
+# Credentials come from /opt/platform/.env on the server.
+
 APP_DOMAIN=app.example.com
-DATABASE_URL=postgresql://postgres:password@postgres:5432/app_db
+DATABASE_URL=postgresql://postgres:<password>@postgres:5432/<app_name>_db
 REDIS_URL=redis://redis:6379
 S3_ENDPOINT=http://minio:9000
-S3_BUCKET=uploads
-S3_ACCESS_KEY=minioadmin
-S3_SECRET_KEY=minioadmin
+S3_BUCKET=<app_name>-uploads
+S3_ACCESS_KEY=<minio_root_user>
+S3_SECRET_KEY=<minio_root_password>