diff --git a/roles/docker/files/Caddyfile b/roles/docker/files/Caddyfile
index 8540574..a4b3627 100644
--- a/roles/docker/files/Caddyfile
+++ b/roles/docker/files/Caddyfile
@@ -17,4 +17,8 @@ bookmarks.thesatelliteoflove.com {
 
 social.thesatelliteoflove.com {
     reverse_proxy gotosocial:8080
+}
+
+grist.thesatelliteoflove.com {
+    reverse_proxy grist-grist-1:8484
 }
\ No newline at end of file
diff --git a/roles/docker/tasks/grist.yml b/roles/docker/tasks/grist.yml
new file mode 100644
index 0000000..e797ba5
--- /dev/null
+++ b/roles/docker/tasks/grist.yml
@@ -0,0 +1,19 @@
+- name: make grist directories
+  ansible.builtin.file:
+    path: "{{ item}}"
+    state: directory
+  loop:
+    - /opt/stacks/grist
+
+- name: Template out the compose file
+  ansible.builtin.template:
+    src: grist-compose.yml.j2
+    dest: /opt/stacks/grist/compose.yml
+    owner: root
+    mode: 644
+
+- name: deploy grist stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/grist
+    files:
+    - compose.yml
\ No newline at end of file
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index eef5e95..dad1ad9 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -73,3 +73,5 @@
 - name: Install gotosocial
   import_tasks: gotosocial.yml
 
+- name: Install grist
+  import_tasks: grist.yml
\ No newline at end of file
diff --git a/roles/docker/templates/grist-compose.yml.j2 b/roles/docker/templates/grist-compose.yml.j2
new file mode 100644
index 0000000..d427c4a
--- /dev/null
+++ b/roles/docker/templates/grist-compose.yml.j2
@@ -0,0 +1,23 @@
+version: "3.3"
+services:
+  grist:
+    volumes:
+      - grist:/persist
+    extra_hosts:
+      - 'auth.thesatelliteoflove.com:172.20.0.2'
+    environment:
+      - GRIST_SESSION_SECRET={{ grist_session_secret }}
+      - APP_HOME_URL="https://grist.thesatelliteoflove.com"
+      - GRIST_OIDC_IDP_ISSUER="https://auth.thesatelliteoflove.com/application/o/grist/.well-known/openid-configuration"
+      - GRIST_OIDC_IDP_CLIENT_ID={{ grist_oidc_client_id }}
+      - GRIST_OIDC_IDP_CLIENT_SECRET={{ grist_oidc_client_secret }}
+    image: gristlabs/grist
+
+volumes:
+  grist:
+    driver: local
+
+networks:
+  default:
+    external: true
+    name: lava