diff --git a/deploy/convert_doc.py b/deploy/convert_doc.py
new file mode 100755
index 0000000..713930a
--- /dev/null
+++ b/deploy/convert_doc.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Конвертер .doc → .docx через libreoffice. Принимает POST с файлом, возвращает docx."""
+import subprocess, tempfile, os, sys
+
+data = sys.stdin.buffer.read()
+with tempfile.NamedTemporaryFile(suffix=".doc", delete=False) as f:
+    f.write(data)
+    doc_path = f.name
+
+tmpdir = tempfile.mkdtemp()
+try:
+    subprocess.run(["libreoffice", "--headless", "--convert-to", "docx", "--outdir", tmpdir, doc_path],
+                   timeout=30, capture_output=True)
+    docx = [x for x in os.listdir(tmpdir) if x.endswith(".docx")]
+    if docx:
+        with open(os.path.join(tmpdir, docx[0]), "rb") as f:
+            sys.stdout.buffer.write(f.read())
+    else:
+        sys.stdout.buffer.write(b"")
+finally:
+    os.unlink(doc_path)
+    for x in os.listdir(tmpdir):
+        os.unlink(os.path.join(tmpdir, x))
+    os.rmdir(tmpdir)
diff --git a/deploy/convert_server.py b/deploy/convert_server.py
new file mode 100755
index 0000000..3feda60
--- /dev/null
+++ b/deploy/convert_server.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""HTTP-сервер для конвертации .doc → .docx"""
+from http.server import HTTPServer, BaseHTTPRequestHandler
+import subprocess, tempfile, os, sys
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length", 0))
+        data = self.rfile.read(length)
+        with tempfile.NamedTemporaryFile(suffix=".doc", delete=False) as f:
+            f.write(data); doc_path = f.name
+        tmpdir = tempfile.mkdtemp()
+        try:
+            subprocess.run(["libreoffice", "--headless", "--convert-to", "docx", "--outdir", tmpdir, doc_path],
+                           timeout=30, capture_output=True)
+            docx = [x for x in os.listdir(tmpdir) if x.endswith(".docx")]
+            if docx:
+                with open(os.path.join(tmpdir, docx[0]), "rb") as f:
+                    out = f.read()
+                self.send_response(200)
+                self.send_header("Content-Type", "application/vnd.openxmlformats-officedocument.wordprocessingml.document")
+                self.send_header("Content-Length", len(out))
+                self.end_headers()
+                self.wfile.write(out)
+            else:
+                self.send_error(500, "Conversion failed")
+        finally:
+            os.unlink(doc_path)
+            for x in os.listdir(tmpdir): os.unlink(os.path.join(tmpdir, x))
+            os.rmdir(tmpdir)
+    def log_message(self, *a): pass
+
+HTTPServer(("127.0.0.1", 8766), Handler).serve_forever()
diff --git a/deploy/nginx-contracts.conf b/deploy/nginx-contracts.conf
new file mode 100644
index 0000000..ffceddc
--- /dev/null
+++ b/deploy/nginx-contracts.conf
@@ -0,0 +1,50 @@
+server {
+    server_name contracts.kube5s.ru;
+    
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://127.0.0.1:5001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 120s;
+    }
+
+    location /lucee/ {
+        rewrite ^/lucee/(.*) /$1 break;
+        proxy_pass https://contractor.luceek8s.dev.nubes.ru;
+        proxy_set_header Host contractor.luceek8s.dev.nubes.ru;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 180s;
+        client_max_body_size 100m;
+    }
+
+    location /convert-doc {
+        add_header Access-Control-Allow-Origin "*";
+        add_header Access-Control-Allow-Methods "POST, OPTIONS";
+        add_header Access-Control-Allow-Headers "*";
+        if ($request_method = OPTIONS) { return 200; }
+
+        proxy_pass http://127.0.0.1:8766;
+        client_max_body_size 50m;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/contracts.kube5s.ru/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/contracts.kube5s.ru/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = contracts.kube5s.ru) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name contracts.kube5s.ru;
+    return 404; # managed by Certbot
+
+
+}