diff --git a/docker-compose.yml b/docker-compose.yml
index 60f8ab8..15a2e3f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,5 +4,21 @@ services:
     build: .
     container_name: blindtest
     restart: unless-stopped
-    ports:
-      - "3000:3000"
+    networks:
+        - reverse-proxy_default   # doit être le même réseau que ton conteneur traefik
+    labels:
+        - "traefik.enable=true"
+
+        # Router HTTPS uniquement
+        - "traefik.http.routers.blindtest.rule=Host(`blindtest.tuttifruitti.ddns.net`)"
+        - "traefik.http.routers.blindtest.entrypoints=websecure"
+        - "traefik.http.routers.blindtest.tls=true"
+        - "traefik.http.routers.blindtest.tls.certresolver=letsencrypt"
+        - "traefik.http.routers.blindtest.service=blindtest"
+
+        # Port interne du conteneur (Vaultwarden écoute en HTTP sur 80 en interne)
+        - "traefik.http.services.blindtest.loadbalancer.server.port=3001"
+
+networks:
+  reverse-proxy_default:
+    external: true