diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..c05d685
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,13 @@
+.git
+.gitignore
+node_modules
+**/node_modules
+**/.next
+**/coverage
+**/dist
+*.md
+.env*
+!.env.example
+docker
+.vscode
+.idea
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..6f2a2af
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,42 @@
+FROM node:22-alpine AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+# ---- fetch deps (lockfile only) ----
+FROM base AS deps
+WORKDIR /app
+COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
+COPY apps/web/package.json ./apps/web/
+COPY packages/db/package.json ./packages/db/
+COPY packages/api-types/package.json ./packages/api-types/
+RUN pnpm fetch
+
+# ---- build ----
+FROM deps AS builder
+WORKDIR /app
+COPY . .
+RUN pnpm install --offline --frozen-lockfile
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN pnpm build
+
+# ---- runtime ----
+FROM node:22-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs \
+ && adduser --system --uid 1001 nextjs
+
+# standalone output mirrors monorepo path structure
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
+
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "apps/web/server.js"]
diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index 008df9f..f5feba4 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -42,6 +42,7 @@ const securityHeaders = [
 ];
 
 const nextConfig: NextConfig = {
+  output: "standalone",
   async headers() {
     return [
       {
diff --git a/docker/compose.prod.yml b/docker/compose.prod.yml
index fb2a61b..b76cd76 100644
--- a/docker/compose.prod.yml
+++ b/docker/compose.prod.yml
@@ -1,7 +1,19 @@
+# Production stack — reverse proxy via external Traefik instance
+# Required env vars (set in Portainer or .env):
+#   DOMAIN            — e.g. epicure.example.com
+#   TRAEFIK_NETWORK   — Docker network Traefik listens on (e.g. traefik_proxy)
+#   CERT_RESOLVER     — Traefik certificate resolver name (e.g. letsencrypt)
+#   POSTGRES_DB / POSTGRES_USER / POSTGRES_PASSWORD
+#   REDIS_PASSWORD
+#   MINIO_ROOT_USER / MINIO_ROOT_PASSWORD
+#   BETTER_AUTH_SECRET / BETTER_AUTH_URL
+#   GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
+#   OPENROUTER_API_KEY
+
 services:
   postgres:
     image: postgres:17-alpine
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_DB: ${POSTGRES_DB}
       POSTGRES_USER: ${POSTGRES_USER}
@@ -13,27 +25,55 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    networks:
+      - internal
 
   redis:
     image: redis:7-alpine
-    restart: always
+    restart: unless-stopped
     volumes:
       - redis_data:/data
     command: redis-server --save 60 1 --requirepass ${REDIS_PASSWORD}
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - internal
 
   minio:
     image: minio/minio:latest
-    restart: always
+    restart: unless-stopped
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - internal
+
+  migrate:
+    image: epicure-web:latest
+    command: ["node", "-e", "import('@epicure/db').then(m => m.migrate())"]
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: on-failure
+    networks:
+      - internal
 
   web:
     image: epicure-web:latest
-    restart: always
+    restart: unless-stopped
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
@@ -46,32 +86,39 @@ services:
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-    ports:
-      - "3000:3000"
     depends_on:
       postgres:
         condition: service_healthy
       redis:
-        condition: service_started
+        condition: service_healthy
       minio:
-        condition: service_started
-
-  caddy:
-    image: caddy:2-alpine
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
-      - caddy_data:/data
-      - caddy_config:/config
-    depends_on:
-      - web
+        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.epicure.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.epicure.entrypoints=websecure"
+      - "traefik.http.routers.epicure.tls.certresolver=${CERT_RESOLVER}"
+      - "traefik.http.services.epicure.loadbalancer.server.port=3000"
+      # HTTP → HTTPS redirect
+      - "traefik.http.routers.epicure-http.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.epicure-http.entrypoints=web"
+      - "traefik.http.routers.epicure-http.middlewares=epicure-redirect"
+      - "traefik.http.middlewares.epicure-redirect.redirectscheme.scheme=https"
+      - "traefik.http.middlewares.epicure-redirect.redirectscheme.permanent=true"
+    networks:
+      - internal
+      - traefik
 
 volumes:
   postgres_data:
   redis_data:
   minio_data:
-  caddy_data:
-  caddy_config:
+
+networks:
+  internal:
+    driver: bridge
+  traefik:
+    external: true
+    name: ${TRAEFIK_NETWORK}