diff --git a/.woodpecker/deploy-netbird-server.yml b/.woodpecker/deploy-netbird-server.yml
new file mode 100644
index 00000000..227d8faa
--- /dev/null
+++ b/.woodpecker/deploy-netbird-server.yml
@@ -0,0 +1,35 @@
+when:
+  - event: push
+    path:
+      - "ansible/roles/netbird-server/**"
+      - "ansible/plays/install-netbird-server.yml"
+      - ".woodpecker/deploy-netbird-server.yml"
+  - event: manual
+    evaluate: 'PIPELINE == "deploy-netbird-server"'
+
+timeout: 30
+
+steps:
+  - name: deploy-netbird-server
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-netbird-server.yml -v