diff --git a/docker/compose.prod.yml b/docker/compose.prod.yml
index b76cd76..85bd095 100644
--- a/docker/compose.prod.yml
+++ b/docker/compose.prod.yml
@@ -1,15 +1,3 @@
-# Production stack — reverse proxy via external Traefik instance
-# Required env vars (set in Portainer or .env):
-#   DOMAIN            — e.g. epicure.example.com
-#   TRAEFIK_NETWORK   — Docker network Traefik listens on (e.g. traefik_proxy)
-#   CERT_RESOLVER     — Traefik certificate resolver name (e.g. letsencrypt)
-#   POSTGRES_DB / POSTGRES_USER / POSTGRES_PASSWORD
-#   REDIS_PASSWORD
-#   MINIO_ROOT_USER / MINIO_ROOT_PASSWORD
-#   BETTER_AUTH_SECRET / BETTER_AUTH_URL
-#   GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
-#   OPENROUTER_API_KEY
-
 services:
   postgres:
     image: postgres:17-alpine
@@ -74,6 +62,8 @@ services:
   web:
     image: epicure-web:latest
     restart: unless-stopped
+    ports:
+      - "${APP_PORT:-3000}:3000"
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
@@ -95,21 +85,8 @@ services:
         condition: service_healthy
       migrate:
         condition: service_completed_successfully
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.epicure.rule=Host(`${DOMAIN}`)"
-      - "traefik.http.routers.epicure.entrypoints=websecure"
-      - "traefik.http.routers.epicure.tls.certresolver=${CERT_RESOLVER}"
-      - "traefik.http.services.epicure.loadbalancer.server.port=3000"
-      # HTTP → HTTPS redirect
-      - "traefik.http.routers.epicure-http.rule=Host(`${DOMAIN}`)"
-      - "traefik.http.routers.epicure-http.entrypoints=web"
-      - "traefik.http.routers.epicure-http.middlewares=epicure-redirect"
-      - "traefik.http.middlewares.epicure-redirect.redirectscheme.scheme=https"
-      - "traefik.http.middlewares.epicure-redirect.redirectscheme.permanent=true"
     networks:
       - internal
-      - traefik
 
 volumes:
   postgres_data:
@@ -119,6 +96,3 @@ volumes:
 networks:
   internal:
     driver: bridge
-  traefik:
-    external: true
-    name: ${TRAEFIK_NETWORK}