diff --git a/gitea/compose.yaml b/gitea/compose.yaml
index b329b57..15cf5ab 100644
--- a/gitea/compose.yaml
+++ b/gitea/compose.yaml
@@ -10,12 +10,14 @@ services:
     environment:
       - USER_UID=1000
       - USER_GID=1000
-    ports:
-      - '0.0.0.0:3000:3000'
-      # - 222:22
+    networks:
+      - proxy
     restart: unless-stopped
     deploy:
       resources:
         limits:
           cpus: "1.0"
           memory: 512M
+networks:
+  proxy:
+    external: true
diff --git a/immich/compose.yaml b/immich/compose.yaml
index 376abea..9d93c9e 100644
--- a/immich/compose.yaml
+++ b/immich/compose.yaml
@@ -17,8 +17,9 @@ services:
           create_host_path: false
     env_file:
       - .env
-    ports:
-      - '0.0.0.0:2283:2283'
+    networks:
+      - default
+      - proxy
     restart: unless-stopped
     healthcheck:
       disable: false
@@ -58,7 +59,7 @@ services:
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: --data-checksums
     ports:
-      - '127.0.0.1:5432:5432'
+      - "127.0.0.1:5432:5432"
     restart: unless-stopped
     healthcheck:
       disable: false
@@ -85,3 +86,6 @@ services:
         reservations:
           cpus: "0.1"
           memory: 64M
+networks:
+  proxy:
+    external: true
diff --git a/nginx/compose.yaml b/nginx/compose.yaml
new file mode 100644
index 0000000..815c31f
--- /dev/null
+++ b/nginx/compose.yaml
@@ -0,0 +1,47 @@
+name: nginx
+services:
+  nginx:
+    image: nginx:1-alpine
+    container_name: nginx
+    volumes:
+      - /srv/data/nginx/conf.d:/etc/nginx/conf.d:ro
+      - /srv/data/nginx/snippets:/etc/nginx/snippets:ro
+      - /srv/data/nginx/certs:/etc/nginx/certs:ro
+    ports:
+      - "192.168.10.101:80:80"
+      - "192.168.10.101:443:443"
+      - "[::]:50443:443"
+    networks:
+      - proxy
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+  acme-sh:
+    image: neilpang/acme.sh:3.1.4
+    container_name: acme.sh
+    volumes:
+      - /srv/data/nginx/acme-sh:/acme.sh
+      - /srv/data/nginx/certs:/certs
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      CF_Token: ${CF_TOKEN}
+      CF_Zone_ID: ${CF_ZONE_ID}
+    command: daemon
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.2"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+networks:
+  proxy:
+    external: true
diff --git a/nginx/example.env b/nginx/example.env
new file mode 100644
index 0000000..a49ad8a
--- /dev/null
+++ b/nginx/example.env
@@ -0,0 +1,2 @@
+CF_TOKEN=<CLOUDFLARE_API_TOKEN>
+CF_ZONE_ID=<LINKWU_DE_ZONE_ID>
diff --git a/openlist/compose.yaml b/openlist/compose.yaml
index d333491..16e4c93 100644
--- a/openlist/compose.yaml
+++ b/openlist/compose.yaml
@@ -8,8 +8,8 @@ services:
       - /mnt/toshiba:/mnt/toshiba
     environment:
       - UMASK=022
-    ports:
-      - '0.0.0.0:5244:5244'
+    networks:
+      - proxy
     restart: unless-stopped
     user: 0:0
     deploy:
@@ -20,3 +20,6 @@ services:
         reservations:
           cpus: "0.2"
           memory: 64M
+networks:
+  proxy:
+    external: true