diff --git a/.env b/.env
index 209c2a6..837023a 100644
--- a/.env
+++ b/.env
@@ -8,7 +8,7 @@ INSECURE=true
 DEBUG=false
 
 ## OpenCloud
-OC_DOMAIN=cloud.maukit.com
+OC_DOMAIN=opencloud.maukit.com
 OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
 OC_DOCKER_TAG=7.5.0
 OC_CONTAINER_UID_GID=1000:1000
@@ -24,7 +24,7 @@ TIKA_IMAGE=apache/tika:latest
 START_ADDITIONAL_SERVICES=tika
 
 ## Euro Office
-EURO_OFFICE_DOMAIN=euro-office.maukit.com
+EURO_OFFICE_DOMAIN=euro-office.opencloud.maukit.com
 EURO_OFFICE_DOCKER_IMAGE=ghcr.io/euro-office/documentserver
 EURO_OFFICE_DOCKER_TAG=latest
 EURO_OFFICE_JWT_SECRET=CHANGEME-GENERATE-SECRET
diff --git a/docker-compose.yml b/docker-compose.yml
index c97400a..450c7cb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,11 @@ services:
     user: ${OC_CONTAINER_UID_GID:-1000:1000}
     networks:
       opencloud-net:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.opencloud.rule=Host(`opencloud.maukit.com`)"
+      - "traefik.http.routers.opencloud.entrypoints=websecure"
+      - "traefik.http.routers.opencloud.tls.certresolver=letsencrypt"
     entrypoint:
       - /bin/sh
     # run opencloud init to initialize a configuration file with random secrets
@@ -17,7 +22,7 @@ services:
     environment:
       # enable services that are not started automatically
       OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
-      OC_URL: https://${OC_DOMAIN:-cloud.maukit.com}${TRAEFIK_PORT_HTTPS:+:${TRAEFIK_PORT_HTTPS:-}}
+      OC_URL: https://${OC_DOMAIN:-opencloud.maukit.com}${TRAEFIK_PORT_HTTPS:+:${TRAEFIK_PORT_HTTPS:-}}
       OC_LOG_LEVEL: ${LOG_LEVEL:-info}
       OC_LOG_COLOR: "${LOG_PRETTY:-false}"
       OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
diff --git a/traefik/service.yml b/traefik/service.yml
new file mode 100644
index 0000000..706d33d
--- /dev/null
+++ b/traefik/service.yml
@@ -0,0 +1,17 @@
+  traefik:
+    image: traefik:v2.10.4
+    container_name: traefik
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
+    networks:
+      - opencloud-net
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"