diff --git a/dashboard/vite.config.js b/dashboard/vite.config.js
index 3b1b213..0616e59 100644
--- a/dashboard/vite.config.js
+++ b/dashboard/vite.config.js
@@ -4,10 +4,4 @@ import tailwindcss from '@tailwindcss/vite'
 
 export default defineConfig({
   plugins: [react(), tailwindcss()],
-  server: {
-    host: true,
-    proxy: {
-      '/api': 'http://localhost:3001',
-    },
-  },
 })
diff --git a/dashboard/vite.config.js.bak b/dashboard/vite.config.js.bak
new file mode 100644
index 0000000..3b1b213
--- /dev/null
+++ b/dashboard/vite.config.js.bak
@@ -0,0 +1,13 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+import tailwindcss from '@tailwindcss/vite'
+
+export default defineConfig({
+  plugins: [react(), tailwindcss()],
+  server: {
+    host: true,
+    proxy: {
+      '/api': 'http://localhost:3001',
+    },
+  },
+})
diff --git a/docker-compose.yml b/docker-compose.yml
index f576d7c..5362260 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,8 +2,8 @@ services:
   backend:
     build: ./server
     container_name: dashboard-backend
-    ports:
-      - "3001:3001"
+    expose:
+      - "3001"        # Remove public port, keep internal only
     environment:
       # Root path on the Docker host to mount inside the container.
       # Linux VM:              HOST_BROWSE_ROOT=/home/wnc
@@ -23,8 +23,21 @@ services:
   frontend:
     build: ./dashboard
     container_name: dashboard-frontend
-    ports:
-      - "5173:80"
+    expose:
+      - "5173"        # Remove public port, keep internal only
     depends_on:
       - backend
-    restart: unless-stopped
\ No newline at end of file
+    restart: unless-stopped
+
+  nginx:
+    image: nginx:alpine
+    container_name: dashboard-nginx
+    ports:
+      - "80:80"       # Single public entry point
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - backend
+      - frontend
+    restart: unless-stopped
+
diff --git a/docker-compose.yml.bak b/docker-compose.yml.bak
new file mode 100644
index 0000000..fc1716e
--- /dev/null
+++ b/docker-compose.yml.bak
@@ -0,0 +1,30 @@
+services:
+  backend:
+    build: ./server
+    container_name: dashboard-backend
+    ports:
+      - "3001:3001"
+    environment:
+      # Root path on the Docker host to mount inside the container.
+      # Dashboard VM:              HOST_BROWSE_ROOT=/home/wnc
+      # Windows Docker Desktop: HOST_BROWSE_ROOT=C:/Users
+      # Then enter paths under /host/... in the dashboard settings.
+      - HOST_BROWSE_ROOT=${HOST_BROWSE_ROOT:-/home/wnc}
+      - HOST_MOUNT_ROOT=/host
+    volumes:
+      - type: bind
+        source: ./server
+        target: /app
+      - type: bind
+        source: ${HOST_BROWSE_ROOT:-/home/wnc}
+        target: /host
+    restart: unless-stopped
+
+  frontend:
+    build: ./dashboard
+    container_name: dashboard-frontend
+    ports:
+      - "5173:80"
+    depends_on:
+      - backend
+    restart: unless-stopped
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..cbd6b2d
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,38 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    upstream backend {
+        server backend:3001;
+    }
+
+    upstream frontend {
+        server frontend:80;
+    }
+
+    server {
+        listen 80;
+
+        # Frontend (default)
+        location / {
+            proxy_pass http://frontend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+
+            # Required for Vite HMR (hot reload) if in dev mode
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
+        # Backend API
+        location /api/ {
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+    }
+}
+