diff --git a/.editorconfig b/.editorconfig
index f483581..ec07101 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -16,12 +16,3 @@ tab_width = 2
 
 [*.md]
 trim_trailing_whitespace = false
-
-[Caddyfile]
-indent_style = tab
-indent_size = 4
-tab_width = 4
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
diff --git a/firefoxsync/docker-compose.yaml b/firefoxsync/docker-compose.yaml
index 3f5e082..ba34de7 100644
--- a/firefoxsync/docker-compose.yaml
+++ b/firefoxsync/docker-compose.yaml
@@ -9,6 +9,12 @@ services:
       - web
       - firefoxsync
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)"
+      - "traefik.http.routers.ffs.entrypoints=websecure"
+      - "traefik.http.routers.ffs.tls.certresolver=netcup"
+      - "traefik.http.routers.ffs.tls.options=intermediate@file"
+      - "traefik.http.services.ffs.loadbalancer.server.port=5000"
       - "docker.group=firefoxsync"
     restart: unless-stopped
     environment:
diff --git a/git/docker-compose.yaml b/git/docker-compose.yaml
index 2e525ef..223451c 100644
--- a/git/docker-compose.yaml
+++ b/git/docker-compose.yaml
@@ -28,6 +28,16 @@ services:
       interval: 5s
       timeout: 3s
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
+      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
+      - "traefik.http.routers.forgejo.middlewares=gitearedir"
+      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)"
+      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}"
+      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
       - "docker.group=git"
 
 
diff --git a/news/docker-compose.yaml b/news/docker-compose.yaml
index 12581cd..f63aa78 100644
--- a/news/docker-compose.yaml
+++ b/news/docker-compose.yaml
@@ -21,6 +21,12 @@ services:
     healthcheck:
       test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)"
+      - "traefik.http.routers.news.entrypoints=websecure"
+      - "traefik.http.routers.news.tls.certresolver=netcup"
+      - "traefik.http.routers.news.tls.options=intermediate@file"
+      - "traefik.http.services.news.loadbalancer.server.port=8080"
       - "docker.group=news"
 
 
diff --git a/nextcloud/docker-compose.yaml b/nextcloud/docker-compose.yaml
index 644f0fd..fa852a0 100644
--- a/nextcloud/docker-compose.yaml
+++ b/nextcloud/docker-compose.yaml
@@ -1,6 +1,6 @@
 services:
 
-  webserver-nextcloud:
+  web:
     image: nginx:stable
     depends_on:
       - app
@@ -16,6 +16,18 @@ services:
 #      interval: 5s
 #      timeout: 3s
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)"
+      - "traefik.http.routers.nextcloud.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud.tls.certresolver=netcup"
+      - "traefik.http.routers.nextcloud.tls.options=intermediate@file"
+      - "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow"
+      - "traefik.http.routers.nextcloud.middlewares=nextcloudHeader"
       - "docker.group=netxtcloud"
 
 
@@ -81,9 +93,17 @@ services:
       - ${STORAGE_PATH}/data:/var/www/html/data:ro
     environment:
       - PORT=7867
-      - NEXTCLOUD_URL=http://webserver-nextcloud
+      - NEXTCLOUD_URL=http://web
     entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)"
+      - "traefik.http.routers.ncpush.entrypoints=websecure"
+      - "traefik.http.routers.ncpush.tls.certresolver=netcup"
+      - "traefik.http.routers.ncpush.tls.options=intermediate@file"
+      - "traefik.http.services.ncpush.loadbalancer.server.port=7867"
+      - "traefik.http.routers.ncpush.middlewares=ncpushstrip"
+      - "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push"
       - "docker.group=proxy"
 
 
@@ -111,12 +131,9 @@ services:
       - nextcloud
       - mariadb
     healthcheck:
-      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
-      start_period: 1m
-      start_interval: 10s
-      interval: 1m
-      timeout: 5s
-      retries: 3
+      test: ["CMD", "mysqladmin" ,"--user" ,"$MYSQL_USER" ,"--password=$MYSQL_PASSWORD" ,"ping" ,"-h" ,"localhost"]
+      interval: 20s
+      timeout: 3s
     labels:
       - "docker.group=netxtcloud"
 
@@ -133,6 +150,13 @@ services:
 #    depends_on:
 #      - db
 #    labels:
+#      - "traefik.enable=true"
+#      - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)"
+#      - "traefik.http.routers.adminer.entrypoints=websecure"
+#      - "traefik.http.routers.adminer.tls.certresolver=netcup"
+#      - "traefik.http.routers.adminer.tls.options=intermediate@file"
+#      - "traefik.http.routers.adminer.middlewares=adminerauth"
+#      - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}"
 #      - "docker.group=netxtcloud"
 
 
@@ -172,6 +196,12 @@ services:
       - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
     restart: unless-stopped
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)"
+      - "traefik.http.routers.collabora.entrypoints=websecure"
+      - "traefik.http.routers.collabora.tls.certresolver=netcup"
+      - "traefik.http.routers.collabora.tls.options=intermediate@file"
+      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
       - "docker.group=netxtcloud"
 
 
@@ -208,6 +238,12 @@ services:
       retries: 5
       start_period: 20s
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)"
+      - "traefik.http.routers.drawio.entrypoints=websecure"
+      - "traefik.http.routers.drawio.tls.certresolver=netcup"
+      - "traefik.http.routers.drawio.tls.options=intermediate@file"
+      - "traefik.http.services.drawio.loadbalancer.server.port=8080"
       - "docker.group=netxtcloud"
 
 networks:
diff --git a/nextcloud/nginx.conf b/nextcloud/nginx.conf
index a3727d7..dd2e803 100644
--- a/nextcloud/nginx.conf
+++ b/nextcloud/nginx.conf
@@ -127,7 +127,7 @@ http {
 
             # Let Nextcloud's API for `/.well-known` URIs handle all other
             # requests by passing them to the front-end controller.
-            return 301 https://$host:443/index.php$request_uri;
+            return 301 https://$host:443/index.php$request_uri; 
         }
 
         # Rules borrowed from `.htaccess` to hide certain paths from clients
@@ -164,12 +164,12 @@ http {
 
         # Javascript mimetype fixes for nginx
         # Note: The block below should be removed, and the js|mjs section should be
-        # added to the block below this one. This is a temporary fix until Nginx
+        # added to the block below this one. This is a temporary fix until Nginx 
         # upstream fixes the js mime-type
         location ~* \.(?:js|mjs)$ {
-            types {
+            types { 
                 text/javascript js mjs;
-            }
+            } 
             default_type "text/javascript";
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463, $asset_immutable";
@@ -177,15 +177,9 @@ http {
         }
 
         # Serve static files
-        location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
+        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
             try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463$asset_immutable";
-            add_header Referrer-Policy                   "no-referrer"       always;
-            add_header X-Content-Type-Options            "nosniff"           always;
-            add_header X-Frame-Options                   "SAMEORIGIN"        always;
-            add_header X-Permitted-Cross-Domain-Policies "none"              always;
-            add_header X-Robots-Tag                      "noindex, nofollow" always;
-            add_header X-XSS-Protection                  "1; mode=block"     always;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
             access_log off;     # Optional: Don't log access to assets
 
             location ~ \.wasm$ {
diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile
deleted file mode 100644
index 8b286cf..0000000
--- a/proxy/caddy/Caddyfile
+++ /dev/null
@@ -1,117 +0,0 @@
-{
-	email {env.EMAIL}
-	log default {
-		output stdout
-		format console
-	}
-}
-
-*.{$DOMAIN} {
-	tls {
-		dns netcup {
-			customer_number {env.NETCUP_CUSTOMER_NUMBER}
-			api_key {env.NETCUP_API_KEY}
-			api_password {env.NETCUP_API_PASSWORD}
-		}
-		propagation_timeout 900s
-		propagation_delay 600s
-		resolvers 46.38.225.230 46.38.252.230
-	}
-	header Strict-Transport-Security "max-age=63072000"
-
-	@git host git.{$DOMAIN}
-	handle @git {
-		reverse_proxy forgejo:3000
-	}
-
-	@git-alt host gitea.{$DOMAIN} forgejo.{$DOMAIN}
-	handle @git-alt {
-		redir https://git.{$DOMAIN}{uri} permanent
-	}
-
-	@news host news.{$DOMAIN}
-	handle @news {
-		reverse_proxy miniflux:8080
-	}
-
-	@nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))`
-	handle @nc-push {
-		reverse_proxy push:7867
-	}
-
-	@nextcloud host cloud.{$DOMAIN}
-	handle @nextcloud {
-		reverse_proxy webserver-nextcloud:80
-	}
-
-	@oldcloud host nextcloud.{$DOMAIN} owncloud.{$DOMAIN}
-	handle @oldcloud {
-		redir https://cloud.{$DOMAIN}{uri} permanent
-	}
-
-	@office host office.{$DOMAIN}
-	handle @office {
-		reverse_proxy collabora:9980
-	}
-
-	@drawio host drawio.{$DOMAIN}
-	handle @drawio {
-		reverse_proxy drawio:8080
-	}
-
-	@whoami host whoami.{$DOMAIN}
-	handle @whoami {
-		reverse_proxy whoami:80
-	}
-
-	@push host push.{$DOMAIN}
-	handle @push {
-		reverse_proxy ntfy:80
-	}
-
-	@wallabag host wallabag.{$DOMAIN}
-	handle @wallabag {
-		reverse_proxy wallabag:80
-	}
-
-	@www host www.{$DOMAIN}
-	handle @www {
-		file_server {
-			root /usr/share/caddy
-			hide .git Readme.md
-		}
-	}
-
-	@ffsync host firefoxsync.{$DOMAIN}
-	handle @ffsync {
-		reverse_proxy syncserver:5000
-	}
-
-	@mail host mail.{$DOMAIN}
-	handle @mail {
-		reverse_proxy nginx-mailcow:8090
-	}
-
-	@meet host meet.{$DOMAIN}
-        handle @meet {
-                reverse_proxy jitsi-meet-web:80
-        }
-
-	# Fallback unhandled (sub)domains
-	handle {
-		error 404
-	}
-
-	handle_errors {
-		root * /usr/share/caddy
-		rewrite * /error.html
-		templates
-		file_server {
-			status {err.status_code}
-		}
-	}
-}
-
-{$DOMAIN} {
-	redir https://www.{$DOMAIN}{uri} permanent
-}
diff --git a/proxy/caddy/Dockerfile b/proxy/caddy/Dockerfile
deleted file mode 100644
index 7223e84..0000000
--- a/proxy/caddy/Dockerfile
+++ /dev/null
@@ -1,7 +0,0 @@
-FROM caddy:2-builder AS builder
-
-RUN xcaddy build --with github.com/caddy-dns/netcup
-
-FROM caddy:2
-
-COPY --from=builder /usr/bin/caddy /usr/bin/caddy
diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml
index 262e603..4881fd7 100755
--- a/proxy/docker-compose.yaml
+++ b/proxy/docker-compose.yaml
@@ -1,34 +1,98 @@
 services:
 
-  caddy:
-    image: florianzirker.de/caddy-netcup
-    build: ./caddy
-    networks:
-      - web
+  traefik:
+    image: traefik:${TRAEFIK_VERSION}
     restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
-    volumes:
-      - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile
-      - ${STORAGE_PATH}/caddy/data:/data
-      - ${STORAGE_PATH}/caddy/config:/config
-      - ${WWW_PATH}:/usr/share/caddy:ro
     environment:
+      - NETCUP_ENDPOINT=${NETCUP_ENDPOINT}
       - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
       - NETCUP_API_KEY=${NETCUP_API_KEY}
       - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
-      - EMAIL=${LETSENCRYPT_MAIL}
-      - DOMAIN=${DOMAIN}
-
-  whoami:
-    image: traefik/whoami
+    command:
+      - "--api.insecure=false"
+      - "--api.dashboard=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=web"
+      - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
+      #- "--log.level=DEBUG"
+      - "--log.level=INFO"
+      #- "--accesslog=true"
+      - "--ping=true"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      - "--entrypoints.websecure.address=:443"
+      - "--providers.file.filename=/etc/traefik/tls.toml"
+      - "--certificatesresolvers.netcup.acme.dnschallenge=true"
+      - "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup"
+      - "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53"
+      - "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900"
+      - "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}"
+      - "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json"
+      - "--metrics.prometheus=true"
+      - "--metrics.prometheus.addEntryPointsLabels=true"
+      - "--metrics.prometheus.addRoutersLabels=true"
+      - "--metrics.prometheus.addServicesLabels=true"
+    ports:
+      - "80:80"
+      - "443:443"
     networks:
       - web
+      - dockersocket
+    volumes:
+      - ${STORAGE_PATH}/letsencrypt:/letsencrypt
+      - $PWD/tls.toml:/etc/traefik/tls.toml
+    healthcheck:
+      test: traefik healthcheck --ping
+      interval: 3s
+      timeout: 1s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.tls.certresolver=netcup"
+      - "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}"
+      - "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}"
+      - "traefik.http.routers.dashboard.tls.options=intermediate@file"
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      - "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}"
+      - "docker.group=proxy"
+
+
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
+      - LOG_LEVEL=warning
+      - CONTAINERS=1
+      - INFO=1
+    networks:
+      - dockersocket
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
+      interval: 10s
+      timeout: 3s
+    privileged: true
     labels:
       - "docker.group=proxy"
-    restart: unless-stopped
+
+
+#  whoami:
+#    image: traefik/whoami
+#    networks:
+#      - web
+#    labels:
+#      - "traefik.enable=true"
+#      - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)"
+#      - "traefik.http.routers.whoami.entrypoints=websecure"
+#      - "traefik.http.routers.whoami.tls.certresolver=netcup"
+#      - "docker.group=proxy"
+#    restart: unless-stopped
 
 
 networks:
diff --git a/proxy/reload.sh b/proxy/reload.sh
deleted file mode 100755
index 27d9320..0000000
--- a/proxy/reload.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/bin/bash
-docker compose exec -w /etc/caddy caddy caddy reload
\ No newline at end of file
diff --git a/proxy/tls.toml b/proxy/tls.toml
new file mode 100644
index 0000000..ccfc0f3
--- /dev/null
+++ b/proxy/tls.toml
@@ -0,0 +1,14 @@
+# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration
+# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6
+
+[tls.options]
+  [tls.options.intermediate]
+    minVersion = "VersionTLS12"
+    cipherSuites = [
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
+    ]
diff --git a/push/docker-compose.yaml b/push/docker-compose.yaml
index 135df1a..ef05c1e 100644
--- a/push/docker-compose.yaml
+++ b/push/docker-compose.yaml
@@ -25,6 +25,12 @@ services:
       - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy
       - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)"
+      - "traefik.http.routers.push.entrypoints=websecure"
+      - "traefik.http.routers.push.tls.certresolver=netcup"
+      - "traefik.http.routers.push.tls.options=intermediate@file"
+      - "traefik.http.services.push.loadbalancer.server.port=80"
       - "docker.group=push"
 
 
diff --git a/start-all.sh b/start-all.sh
index 2846ba4..7d0ea6e 100755
--- a/start-all.sh
+++ b/start-all.sh
@@ -9,6 +9,7 @@ up proxy;
 up nextcloud;
 up git;
 up wallabag;
+up www;
 up firefoxsync;
 up push;
 up rustdesk;
diff --git a/wallabag/docker-compose.yaml b/wallabag/docker-compose.yaml
index 2ed38ab..d8c9970 100644
--- a/wallabag/docker-compose.yaml
+++ b/wallabag/docker-compose.yaml
@@ -1,5 +1,5 @@
 services:
-  wallabag:
+  app:
     image: wallabag/wallabag
     restart: unless-stopped
     environment:
@@ -26,6 +26,11 @@ services:
       interval: 10s
       timeout: 3s
     labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)"
+      - "traefik.http.routers.wallabag.entrypoints=websecure"
+      - "traefik.http.routers.wallabag.tls.certresolver=netcup"
+      - "traefik.http.routers.wallabag.tls.options=intermediate@file"
       - "docker.group=wallabag"
     depends_on:
       - db
diff --git a/www/docker-compose.yaml b/www/docker-compose.yaml
new file mode 100644
index 0000000..80e2e63
--- /dev/null
+++ b/www/docker-compose.yaml
@@ -0,0 +1,34 @@
+services:
+
+  app:
+    image: nginx:stable
+    volumes:
+      - ${HTML}:/usr/share/nginx/html:ro
+      - $PWD/nginx.conf:/etc/nginx/nginx.conf:ro
+    networks:
+      - web
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS
+      - "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.webroot.tls.certresolver=netcup"
+      - "traefik.http.routers.webroot.tls.options=intermediate@file"
+      - "traefik.http.routers.webroot.middlewares=redirect-to-www"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true"
+      - "traefik.http.routers.www-secure.entrypoints=websecure"
+      - "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)"
+      - "traefik.http.routers.www-secure.tls.certresolver=netcup"
+      - "traefik.http.routers.www-secure.tls.options=intermediate@file"
+      - "docker.group=www"
+
+networks:
+  web:
+    external: true
+
diff --git a/www/nginx.conf b/www/nginx.conf
new file mode 100644
index 0000000..73d1ce1
--- /dev/null
+++ b/www/nginx.conf
@@ -0,0 +1,67 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    # include /etc/nginx/conf.d/*.conf;
+    ############################################
+    server {
+        listen       80;
+        listen  [::]:80;
+        server_name  localhost;
+
+        #access_log  /var/log/nginx/host.access.log  main;
+
+        location / {
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+        }
+
+        #error_page  404              /404.html;
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/html;
+        }
+
+        # hide .git folder
+        location ~ /\.git {
+            deny all;
+            return 404;
+        }
+
+        location ~ /Readme.md {
+            deny all;
+            return 404;
+        }
+
+    }
+
+    # include /etc/nginx/conf.d/*.conf;
+}