diff --git a/docker-compose.yml b/docker-compose.yml
index ba66e4e..84a278f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,6 +19,12 @@
 # break generating it in the first place — `docker compose run --rm --no-deps
 # app php artisan key:generate --show` has to work before `APP_KEY` exists.
 #
+# `app` is not published on a host port: routing is Traefik, on the external
+# `dokploy-network`, terminating TLS before anything reaches this container —
+# same reason `docker/Caddyfile` trusts `X-Forwarded-*` only from private
+# ranges. A manual deploy without Dokploy needs its own reverse proxy joined
+# to that network, or `app` added back to `default` with a published port.
+#
 # The web container is the only one that migrates, so a deploy runs them once
 # rather than once per replica.
 ###############################################################################
@@ -115,8 +121,24 @@ services:
       <<: *app-env
       # Only here: migrations run once per deploy, not once per container.
       RUN_MIGRATIONS: "true"
-    ports:
-      - "${APP_PORT:-8000}:80"
+    expose:
+      - "80"
+    networks:
+      - dokploy-network
+      - default
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=dokploy-network
+      - traefik.http.routers.landing-api-web.rule=Host(`landing-api.pireon.dev`)
+      - traefik.http.routers.landing-api-web.entrypoints=web
+      - traefik.http.routers.landing-api-web.middlewares=redirect-to-https@file
+      - traefik.http.routers.landing-api-web.service=landing-api-web
+      - traefik.http.services.landing-api-web.loadbalancer.server.port=80
+      - traefik.http.routers.landing-api-websecure.rule=Host(`landing-api.pireon.dev`)
+      - traefik.http.routers.landing-api-websecure.entrypoints=websecure
+      - traefik.http.routers.landing-api-websecure.service=landing-api-websecure
+      - traefik.http.routers.landing-api-websecure.tls.certresolver=letsencrypt
+      - traefik.http.services.landing-api-websecure.loadbalancer.server.port=80
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://localhost/up"]
       interval: 30s
@@ -206,3 +228,7 @@ services:
 volumes:
   pgdata:
   storage:
+
+networks:
+  dokploy-network:
+    external: true