diff --git a/.env.example b/.env.example
index b97d67e..46a807b 100644
--- a/.env.example
+++ b/.env.example
@@ -36,10 +36,15 @@ REMOTE_PATH_PREFIX=
 
 
 # For deployment with traefik
-APP_NAME=management
-APP_HOST=management.example.com
+FRONTEND_APP_NAME=manage
+FRONTEND_APP_HOST=manage.example.com
+FRONTEND_APP_PORT=5173
+
+BACKEND_APP_NAME=management-api
+BACKEND_APP_HOST=management-api.example.com
+BACKEND_APP_PORT=8000
+
 CERT_RESOLVER=lets-encrypt
-APP_PORT=5173
 
 # Authentik / OIDC
 # Backend validates every API request with a Bearer JWT.
diff --git a/docker-compose.yml b/docker-compose.yml
index c0e84e2..aadc769 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,6 +11,12 @@ services:
     restart: unless-stopped
     expose:
       - "8000"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.${BACKEND_APP_NAME}.rule=Host(`${BACKEND_APP_HOST}`)"
+      - "traefik.http.routers.${BACKEND_APP_NAME}.entrypoints=websecure"
+      - "traefik.http.routers.${BACKEND_APP_NAME}.tls.certresolver=${CERT_RESOLVER}"
+      - "traefik.http.services.${BACKEND_APP_NAME}.loadbalancer.server.port=${BACKEND_APP_PORT}"
     healthcheck:
       test:
         [
@@ -43,10 +49,10 @@ services:
         condition: service_healthy
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.${APP_NAME}.rule=Host(`${APP_HOST}`)"
-      - "traefik.http.routers.${APP_NAME}.entrypoints=websecure"
-      - "traefik.http.routers.${APP_NAME}.tls.certresolver=${CERT_RESOLVER}"
-      - "traefik.http.services.${APP_NAME}.loadbalancer.server.port=${APP_PORT}"
+      - "traefik.http.routers.${FRONTEND_APP_NAME}.rule=Host(`${FRONTEND_APP_HOST}`)"
+      - "traefik.http.routers.${FRONTEND_APP_NAME}.entrypoints=websecure"
+      - "traefik.http.routers.${FRONTEND_APP_NAME}.tls.certresolver=${CERT_RESOLVER}"
+      - "traefik.http.services.${FRONTEND_APP_NAME}.loadbalancer.server.port=${FRONTEND_APP_PORT}"
     ports:
       - "8080:80"
     restart: unless-stopped