diff --git a/checkmk/.env.example b/checkmk/.env.example
new file mode 100644
index 0000000..a57b7d2
--- /dev/null
+++ b/checkmk/.env.example
@@ -0,0 +1,2 @@
+CMK_PASSWORD=password
+TZ=Europe/Berlin
\ No newline at end of file
diff --git a/checkmk/compose.yaml b/checkmk/compose.yaml
new file mode 100644
index 0000000..5cc9cc0
--- /dev/null
+++ b/checkmk/compose.yaml
@@ -0,0 +1,50 @@
+services:
+  checkmk:
+    image: "checkmk/check-mk-raw:2.4.0-latest"
+    container_name: "checkmk"
+    environment:
+      - CMK_PASSWORD=${CMK_PASSWORD:-password}
+      - CMK_SITE_ID=cmk
+
+    volumes:
+      - sites:/omd/sites
+    tmpfs:
+      - /opt/omd/sites/cmk/tmp:uid=1000,gid=1000
+    ports:
+      - 5000:5000
+      - 6776:8000
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.checkmk.loadbalancer.server.port=5000"
+
+      # Prod Router
+      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
+      - "traefik.http.routers.checkmk.entrypoints=websecure"
+      - "traefik.http.routers.checkmk.service=checkmk"
+      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`) || Host(`cmk.internal`)"
+      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-local.service=checkmk"
+      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
+      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk-dev.service=checkmk"
+      - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-dev.tls=true"
+
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true
+volumes:
+  sites:
diff --git a/traefik/compose.yaml b/traefik/compose.yaml
index eff00c3..492f401 100644
--- a/traefik/compose.yaml
+++ b/traefik/compose.yaml
@@ -19,11 +19,14 @@ services:
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
+      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.ssh.address=:2221"
 
       # Let's Encrypt
       - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       # # STAGING
       # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
diff --git a/traefik/dynamic/middlewares.yml b/traefik/dynamic/middlewares.yml
index 0dba63f..40eddfb 100644
--- a/traefik/dynamic/middlewares.yml
+++ b/traefik/dynamic/middlewares.yml
@@ -1,5 +1,10 @@
 http:
   middlewares:
+    # HTTPS Redirect
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
     # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:
diff --git a/traefik/dynamic/redirect.yml b/traefik/dynamic/redirect.yml
index fdcea94..334325f 100644
--- a/traefik/dynamic/redirect.yml
+++ b/traefik/dynamic/redirect.yml
@@ -1,10 +1,4 @@
 http:
-  middlewares:
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
   routers:
     acme-challenge-exempt:
       rule: "PathPrefix(`/.well-known/acme-challenge`)"
@@ -12,12 +6,3 @@ http:
         - web
       service: noop@internal
       priority: 100
-
-    http-catchall:
-      rule: "HostRegexp(`{host:.+}`)"
-      entryPoints:
-        - web
-      middlewares:
-        - redirect-https
-      service: noop@internal
-      priority: 1