diff --git a/README.md b/README.md
new file mode 100644
index 0000000..09bd60c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,49 @@
+How to build the web site
+=========================
+
+You need hugo to build the website.  On Debian, install it from the
+'hugo' package:
+
+  # apt install hugo
+
+Furthermore, you need to checkout the submodules:
+
+  website-content $ git submodule init
+  website-content $ git submodule update
+
+Now you can build the site using 'make', it will be put into 'public'.
+'make server' will launch a local server that is useful while editing
+the web site.
+
+Server setup
+------------
+
+On the server, the website is built using gitlab's ci runner, see
+`.gitlab-ci.yml`.  To deploy the site, the ci job rsyncs it to the
+host.  For this purpose, a restricted user is created:
+
+  # adduser --system --home /var/www/www-data-rsync --shell /bin/sh --disabled-password --ingroup www-data www-data-rsync
+
+Create a key and restrict it to invoke the restricted-rsync script:
+
+  # mkdir /var/www/www-data-rsync/.ssh
+  # chmod 700 /var/www/www-data-rsync/.ssh
+  # ssh-keygen -t ed25519 -C 'Used for website deployment.' -f www-data-rsync-id_ed25519
+  # echo 'command="/usr/local/bin/rrsync /var/www/html --safe-links",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOBBpthbSQ3HgOkhoBwsrZCA9VMX7hRftB5t6LePqtr3 Used for website deployment.' > /var/www/www-data-rsync/.ssh/authorized_keys
+  # chmod 400 /var/www/www-data-rsync/.ssh/authorized_keys
+  # chown -R www-data-rsync:www-data /var/www/www-data-rsync/.ssh
+
+Copy the restricted-rsync script from the docs and make it executable:
+
+  # cp /usr/share/doc/rsync/scripts/rrsync /usr/local/bin/
+  # chmod +x /usr/local/bin/rrsync
+
+Finally, allow www-data-rsync to write to the document root:
+
+  # chown root:www-data /var/www/html
+  # chmod g+w /var/www/html
+
+The last bit is to supply the generated secret to gitlab's ci runner
+via RSYNC_TARGET_SECRET_KEY.  Other information that needs to be
+provided are RSYNC_TARGET_HOST, RSYNC_TARGET_PORT,
+RSYNC_TARGET_HOST_KEY, and RSYNC_TARGET_USER.