diff --git a/.env.example b/.env.example
index 769fb7f..2567dbb 100644
--- a/.env.example
+++ b/.env.example
@@ -2,6 +2,9 @@
 # required values. Replace every credential before any public deployment.
 HTTP_PORT=4010
 MAILPIT_PORT=8027
+# Comma-separated proxy IP/CIDR values whose X-Forwarded-* headers Traefik
+# accepts. Keep loopback locally; set the exact VPN proxy address for staging.
+TRAEFIK_TRUSTED_IPS=127.0.0.1/32
 PHX_HOST=localhost
 PHX_SCHEME=http
 PHX_URL_PORT=4010
diff --git a/compose.yaml b/compose.yaml
index 582f641..84f05d3 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -33,6 +33,7 @@ services:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
       - --entrypoints.web.address=:80
+      - --entrypoints.web.forwardedheaders.trustedips=${TRAEFIK_TRUSTED_IPS:-127.0.0.1/32}
     ports:
       - "${HTTP_PORT:-4010}:80"
     volumes:
diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md
new file mode 100644
index 0000000..e5ec89f
--- /dev/null
+++ b/deploy/nginx/README.md
@@ -0,0 +1,44 @@
+# Staging reverse proxy
+
+`whoneedhelp.imalto.site.conf` is the HTTP vhost consumed by Certbot's Nginx
+installer on the VPN gateway. It forwards HTTP and LiveView WebSocket traffic
+to the workstation at `10.8.0.14:4010`.
+
+The workstation's ignored `.env` must use:
+
+```dotenv
+PHX_HOST=whoneedhelp.imalto.site
+PHX_SCHEME=https
+PHX_URL_PORT=443
+TRAEFIK_TRUSTED_IPS=10.8.0.1/32
+```
+
+The last setting allows forwarded headers only from the observed VPN address of
+the gateway. Do not replace it with Traefik's insecure forwarded-header mode.
+
+The checked server currently uses the standard Ubuntu Nginx/Certbot layout.
+After copying the vhost to `/home/simple/whoneedhelp.imalto.site.conf`, install
+and enable it with root privileges:
+
+```bash
+sudo install -o root -g root -m 0644 \
+  /home/simple/whoneedhelp.imalto.site.conf \
+  /etc/nginx/sites-available/whoneedhelp.imalto.site
+sudo ln -s \
+  /etc/nginx/sites-available/whoneedhelp.imalto.site \
+  /etc/nginx/sites-enabled/whoneedhelp.imalto.site
+sudo nginx -t
+sudo systemctl reload nginx
+sudo certbot --nginx --redirect -d whoneedhelp.imalto.site
+sudo nginx -t
+```
+
+If validation fails before certificate issuance, remove only the new symlink
+and file, validate the previous configuration, and reload:
+
+```bash
+sudo rm -f /etc/nginx/sites-enabled/whoneedhelp.imalto.site
+sudo rm -f /etc/nginx/sites-available/whoneedhelp.imalto.site
+sudo nginx -t
+sudo systemctl reload nginx
+```
diff --git a/deploy/nginx/whoneedhelp.imalto.site.conf b/deploy/nginx/whoneedhelp.imalto.site.conf
new file mode 100644
index 0000000..d37db30
--- /dev/null
+++ b/deploy/nginx/whoneedhelp.imalto.site.conf
@@ -0,0 +1,19 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name whoneedhelp.imalto.site;
+
+    location / {
+        proxy_pass http://10.8.0.14:4010;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        client_max_body_size 100M;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+}