diff --git a/deploy/docker-compose.testing.yml b/deploy/docker-compose.testing.yml
new file mode 100644
index 0000000..ee5adfb
--- /dev/null
+++ b/deploy/docker-compose.testing.yml
@@ -0,0 +1,33 @@
+# Despliegue en testing.crm.aduanasoft.com — AUTH REAL vía Hub (SSO relay).
+# Frontend: build de PRODUCCIÓN (Dockerfile.prod → node build). Backend: uvicorn sin --reload.
+# Puertos SOLO en loopback (nginx del host hace TLS + proxy). Postgres/MinIO no se publican.
+#
+#   docker compose -f docker-compose.yml -f deploy/docker-compose.testing.yml up -d --build
+services:
+  backend:
+    ports: !override
+      - "127.0.0.1:8000:8000"
+    command: ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile.prod
+      args:
+        VITE_API_URL: ${VITE_API_URL}
+        VITE_HUB_URL: ${VITE_HUB_URL}
+        VITE_KEYCLOAK_URL: ${VITE_KEYCLOAK_URL}
+        VITE_KEYCLOAK_REALM: ${KEYCLOAK_REALM:-master}
+        VITE_KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID:-aduanasoft}
+    environment:
+      - NODE_ENV=production
+    volumes: !override []
+    command: !override ["pnpm", "start"]
+    ports: !override
+      - "127.0.0.1:5173:5173"
+
+  postgres:
+    ports: !override []
+
+  minio:
+    ports: !override []