diff --git a/dns-public.sh b/dns-public.sh
index 7a87dcc..6ec1a8c 100755
--- a/dns-public.sh
+++ b/dns-public.sh
@@ -32,6 +32,8 @@ ALIAS=$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{range $
 BINDS=$(docker inspect -f '{{range .HostConfig.Binds}}-v {{.}} {{end}}' "$C")
 ENVS=$(docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$C" | grep -E '^(GC_|RUST_LOG)' | sed 's/^/-e /' | tr '\n' ' ')
 REST=$(docker port "$C" 8053/tcp 2>/dev/null | head -1 || true)
+# Multi-Site: freigegebene Sekundaer-Adressen (GC_DNS_AXFR_ALLOW) uebernehmen bzw. ueberschreiben
+if [ -n "${GC_DNS_AXFR_ALLOW:-}" ]; then ENVS="$(echo "$ENVS" | sed 's/-e GC_DNS_AXFR_ALLOW=[^ ]* //g') -e GC_DNS_AXFR_ALLOW=$GC_DNS_AXFR_ALLOW"; fi
 LABELS=$(docker inspect -f '{{range $k,$v := .Config.Labels}}--label {{$k}}={{$v}} {{end}}' "$C")
 echo "Ersetze $C (Image $IMG, Netz $NET)"
 docker stop "$C" >/dev/null && docker rm "$C" >/dev/null
diff --git a/secondary/docker-compose.yml b/secondary/docker-compose.yml
new file mode 100644
index 0000000..cb48209
--- /dev/null
+++ b/secondary/docker-compose.yml
@@ -0,0 +1,24 @@
+# Zweiter Standort (Multi-Site, D-21): sekundaerer Nameserver, der die Zone per AXFR vom Primaer uebernimmt.
+# Eigenes Compose-Projekt, beruehrt nichts anderes auf dem Server.
+# Pflicht: GC_SECONDARY="zone@primaer-ip:53"   Optional: GC_BIND_IP (Standard 0.0.0.0; z. B. oeffentliche IP, wenn 127.0.0.53:53 belegt ist)
+name: ${GC_PROJECT:-gamerpub-de}
+services:
+  dns:
+    image: git1.mrmoe.de/mscadm/gc-dns-server:latest
+    container_name: ${GC_PROJECT:-gamerpub-de}-dns
+    restart: unless-stopped
+    cap_add: [NET_BIND_SERVICE]
+    ports:
+      - "${GC_BIND_IP:-0.0.0.0}:53:53/udp"
+      - "${GC_BIND_IP:-0.0.0.0}:53:53/tcp"
+    environment:
+      GC_DNS_PORT: "53"
+      GC_DNS_REST_PORT: "8553"
+      GC_DNS_DB: "/var/lib/gc-dns/zone.db"
+      GC_DNS_SECONDARY: "${GC_SECONDARY:?GC_SECONDARY=zone@primaer-ip:53 setzen}"
+      GC_DNS_REFRESH_SECS: "${GC_REFRESH_SECS:-60}"
+      RUST_LOG: "gc_dns_server=info,axum=warn,info"
+    volumes:
+      - dns-data:/var/lib/gc-dns
+volumes:
+  dns-data:
diff --git a/secondary/join.sh b/secondary/join.sh
new file mode 100644
index 0000000..393b114
--- /dev/null
+++ b/secondary/join.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Zweiten Standort beitreten (sekundaerer DNS). Ein Aufruf, idempotent.
+#   GC_SECONDARY="gamerpub.de@187.77.64.208:53" GC_BIND_IP=<oeffentliche-IP> sh join.sh
+# Das Projekt heisst gamerpub-de (GC_PROJECT aenderbar). Beruehrt keine anderen Container, Netze oder Systemeinstellungen.
+set -eu
+: "${GC_SECONDARY:?GC_SECONDARY=zone@primaer-ip:53 setzen}"
+P="${GC_PROJECT:-gamerpub-de}"
+D="${GC_DIR:-$HOME/$P}"
+mkdir -p "$D" && cd "$D"
+curl -fsSL https://git1.mrmoe.de/mscadm/ground-control-install/raw/branch/main/secondary/docker-compose.yml -o docker-compose.yml
+printf 'GC_PROJECT=%s\nGC_SECONDARY=%s\nGC_BIND_IP=%s\n' "$P" "$GC_SECONDARY" "${GC_BIND_IP:-0.0.0.0}" > .env
+IP="${GC_BIND_IP:-}"
+if [ -n "$IP" ] && ss -lun 2>/dev/null | awk '{print $5}' | grep -Eq "^($IP|0\.0\.0\.0|\*):53$"; then echo "FEHLER: $IP:53 ist belegt (nicht von uns): "; ss -lunp | grep ':53 ' ; exit 1; fi
+docker compose pull -q
+docker compose up -d
+sleep 3
+docker compose ps
+docker logs --tail 5 "${P}-dns" 2>&1 | cut -c1-160