diff --git a/host_vars/gabriel.c3heaven.de b/host_vars/gabriel.c3heaven.de
index 4bf9831643b3d13b0353a0ad66fd78b22f710630..78f2a35fdc8a94e60190eec92b40b110cba6a28a 100644
--- a/host_vars/gabriel.c3heaven.de
+++ b/host_vars/gabriel.c3heaven.de
@@ -10,6 +10,8 @@ acmetool_cert_domains:
  - wiki.c3heaven.de
  - www.c3heaven.de
 
+angelguide_deployment_path: "/var/www/angelguide"
+
 nginx_https_sites:
  - name: "c3heaven.de"
    locations:
@@ -21,7 +23,8 @@ nginx_https_sites:
       config: "return 301 https://kanboard.c3heaven.de$1?$args;"
     - location: "~ /guide/(.*).pdf$"
       config: |-
-          root /var/www/html;
+          root {{ angelguide_deployment_path }};
+          rewrite ^/guide(.*)$ $1;
           add_header Access-Control-Allow-Origin *;
     - location: "/angelguide.pdf"
       config: "rewrite .* /guide/angelguide_$lang.pdf;"
diff --git a/roles/angelguide-deployment/defaults/main.yml b/roles/angelguide-deployment/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..835ef55cdfbbc4e6629b5d85b2ee986c88d17338
--- /dev/null
+++ b/roles/angelguide-deployment/defaults/main.yml
@@ -0,0 +1,4 @@
+angelguide_deployment_user: angelguide
+angelguide_deployment_path: /var/www/angelguide
+angelguide_deployment_keys:
+ - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHf5VFP0+QmV+yzWDw+VHkJtORwJzM5dUtHV/grdRbcb
diff --git a/roles/angelguide-deployment/tasks/main.yml b/roles/angelguide-deployment/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..a85442af644e23f0887f2ba3894762ab35f52501
--- /dev/null
+++ b/roles/angelguide-deployment/tasks/main.yml
@@ -0,0 +1,16 @@
+- name: create angelguide deployment user
+  user:
+    name: "{{ angelguide_deployment_user }}"
+    home: "{{ angelguide_deployment_path }}"
+    system: yes
+    shell: /bin/sh
+
+- name: create .ssh directory for the angelguide user
+  file:
+    path: "{{ angelguide_deployment_path }}/.ssh"
+    state: directory
+
+- name: copy angelguide deployment ssh keys
+  template:
+    src: authorized_keys.j2
+    dest: "{{ angelguide_deployment_path }}/.ssh/authorized_keys"
diff --git a/roles/angelguide-deployment/templates/authorized_keys.j2 b/roles/angelguide-deployment/templates/authorized_keys.j2
new file mode 100644
index 0000000000000000000000000000000000000000..78038db033fe183f5824b902a358960adb94d228
--- /dev/null
+++ b/roles/angelguide-deployment/templates/authorized_keys.j2
@@ -0,0 +1,3 @@
+{% for key in angelguide_deployment_keys %}
+command="/usr/local/bin/rrsync {{ angelguide_deployment_path }}",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding {{ key }}
+{% endfor %}
diff --git a/web-ci-deployment.yml b/web-ci-deployment.yml
new file mode 100644
index 0000000000000000000000000000000000000000..56cc715207a63d96a5655cfd0e5311a04f371a38
--- /dev/null
+++ b/web-ci-deployment.yml
@@ -0,0 +1,8 @@
+# Add directories, users, SSH keys etc. needed for automatic web deployment
+# of e.g. the angel guide via Gitlab CI
+
+- name: allow angelguide deployment
+  hosts: gabriel.c3heaven.de
+  become: yes
+  roles:
+   - angelguide-deployment