diff --git a/netronome/.env.example b/netronome/.env.example
new file mode 100644
index 0000000..671bd52
--- /dev/null
+++ b/netronome/.env.example
@@ -0,0 +1,29 @@
+## https://github.com/autobrr/netronome?tab=readme-ov-file#environment-variables
+
+# Server settings
+NETRONOME__HOST=0.0.0.0              # Listen address
+NETRONOME__PORT=7575                 # Web UI port
+NETRONOME__BASE_URL=/netronome                # Base URL for reverse proxy
+
+# Database (SQLite by default)
+NETRONOME__DB_TYPE=postgres            # sqlite or postgres
+NETRONOME__DB_PATH=netronome.db      # SQLite database path
+
+# PostgreSQL (when DB_TYPE=postgres)
+NETRONOME__DB_TYPE=postgres
+NETRONOME__DB_HOST=postgres
+NETRONOME__DB_PORT=5432
+NETRONOME__DB_USER=netronome
+NETRONOME__DB_PASSWORD=netronome
+NETRONOME__DB_NAME=netronome
+NETRONOME__DB_SSLMODE=disable
+
+# Authentication
+NETRONOME__AUTH_WHITELIST=127.0.0.1/32,192.168.1.0/24  # IP whitelist (comma-separated)
+NETRONOME__SESSION_SECRET=           # Session secret (auto-generated if empty)
+
+# OIDC (optional)
+NETRONOME__OIDC_ISSUER=https://accounts.google.com
+NETRONOME__OIDC_CLIENT_ID=your-client-id
+NETRONOME__OIDC_CLIENT_SECRET=your-secret
+NETRONOME__OIDC_REDIRECT_URL=https://example.com/api/auth/oidc/callback
\ No newline at end of file
diff --git a/netronome/compose.yaml b/netronome/compose.yaml
index 9aaa888..6c46a36 100644
--- a/netronome/compose.yaml
+++ b/netronome/compose.yaml
@@ -1,27 +1,39 @@
 services:
   netronome:
     image: ghcr.io/autobrr/netronome:latest
+    restart: unless-stopped
     container_name: netronome
     ports:
       - "7575:7575"
     cap_add:
-      - NET_RAW # Required for MTR and privileged ping operations
-    environment:
-      - NETRONOME__DB_TYPE=postgres
-      - NETRONOME__DB_HOST=postgres
-      - NETRONOME__DB_PORT=5432
-      - NETRONOME__DB_USER=netronome
-      - NETRONOME__DB_PASSWORD=netronome
-      - NETRONOME__DB_NAME=netronome
-      - NETRONOME__DB_SSLMODE=disable
+      - NET_RAW
+    env_file:
+      - .env
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netronome.loadbalancer.server.port=7575"
 
-      - NETRONOME__HOST=0.0.0.0
-      - NETRONOME__PORT=7575
-      - NETRONOME__AUTH_WHITELIST="127.0.0.1,192.168.1.0/24,100.64.0.0/24" # CSV
+      # Prod Router
+      - "traefik.http.routers.netronome.rule=Host(`nm.forust.xyz`)"
+      - "traefik.http.routers.netronome.entrypoints=websecure"
+      - "traefik.http.routers.netronome.middlewares=security-headers@file"
+      - "traefik.http.routers.netronome.tls=true"
+      # Local Router
+      - "traefik.http.routers.netronome-local.rule=Host(`nm.workstation.internal`)"
+      - "traefik.http.routers.netronome-local.entrypoints=websecure"
+      - "traefik.http.routers.netronome-local.middlewares=security-headers@file"
+      - "traefik.http.routers.netronome-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netronome-dev.rule=Host(`nm.gigaforust.internal`)"
+      - "traefik.http.routers.netronome-dev.entrypoints=websecure"
+      - "traefik.http.routers.netronome-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.netronome-dev.tls=true"
+    networks:
+      - proxy
+      - netronome
     depends_on:
       postgres:
         condition: service_healthy
-    restart: unless-stopped
   postgres:
     container_name: netronome-postgres
     image: postgres:17-alpine
@@ -37,5 +49,14 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+    networks:
+      - netronome
 volumes:
   data:
+
+
+networks:
+  proxy:
+    external: true
+  netronome:
+    external: false