diff --git a/jobs/services/rally.hcl b/jobs/services/rally.hcl
new file mode 100644
index 0000000..ee274a0
--- /dev/null
+++ b/jobs/services/rally.hcl
@@ -0,0 +1,121 @@
+job "rally" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  group "rally-web" {
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "rally"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.rally.rule=Host(`vote.rb.dcu.ie`)",
+        "traefik.http.routers.rally.entrypoints=websecure",
+        "traefik.http.routers.rally.tls=true",
+        "traefik.http.routers.rally.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "web" {
+      driver = "docker"
+
+      config {
+        image = "lukevella/rallly:latest"
+        ports = ["http"]
+      }
+
+      template {
+        data        = <<EOH
+DATABASE_URL=postgres://{{ key "rally/db/user" }}:{{ key "rally/db/password" }}@{{ env "NOMAD_ADDR_db" }}/{{ key "rally/db/name" }}
+PG_PASSWD={{ key "rally/db/password" }}
+PG_DB={{ key "rally/db/name" }}
+
+# A random 32-character secret key used to encrypt user sessions
+SECRET_PASSWORD={{ key "rally/secret" }}
+
+# The base url where this instance is accessible, including the scheme.
+# Example: https://example.com
+NEXT_PUBLIC_BASE_URL={{ key "rally/base_url" }}
+
+# NEXTAUTH_URL should be the same as NEXT_PUBLIC_BASE_URL
+NEXTAUTH_URL={{ key "rally/base_url" }}
+
+# Toggle Self-Hosted mode
+NEXT_PUBLIC_SELF_HOSTED=true
+
+# Comma separated list of email addresses that are allowed to register and login.
+# You can use wildcard syntax to match a range of email addresses.
+# Example: "john@example.com,jane@example.com" or "*@example.com"
+ALLOWED_EMAILS={{ key "rally/email/allowed_emails" }}
+
+# EMAIL CONFIG (required for sending emails)
+
+# The email of whoever is managing this instance in case a user needs support.
+SUPPORT_EMAIL={{ key "rally/email/support" }}
+
+# The host address of your SMTP server
+SMTP_HOST={{ key "rally/email/host" }}
+
+# The port of your SMTP server
+SMTP_PORT={{ key "rally/email/port" }}
+
+# Set to "true" if SSL is enabled for your SMTP connection
+SMTP_SECURE=true
+
+# The username (if auth is enabled on your SMTP server)
+SMTP_USER={{ key "rally/email/user" }}
+
+# The password (if auth is enabled on your SMTP server)
+SMTP_PWD={{ key "rally/email/password" }}
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+
+      resources {
+        cpu    = 800
+        memory = 1000
+      }
+    }
+
+    task "db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17.2-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/rally/db:/var/lib/postgresql/data"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_PASSWORD={{ key "rally/db/password" }}
+POSTGRES_USER={{ key "rally/db/user" }}
+POSTGRES_NAME={{ key "rally/db/name" }}
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+  }
+}
+