diff --git a/docker-compose.monitoring.yml b/docker-compose.monitoring.yml
index d255730..ebe739e 100644
--- a/docker-compose.monitoring.yml
+++ b/docker-compose.monitoring.yml
@@ -70,7 +70,7 @@ services:
       GF_SMTP_FROM_NAME: ${GF_SMTP_FROM_NAME:-Rythmify Monitoring}
       GF_SMTP_STARTTLS_POLICY: MandatoryStartTLS
       ALERT_EMAIL_TO: ${ALERT_EMAIL_TO:-}
-      GF_SERVER_ROOT_URL: https://rythmify.duckdns.org/grafana/
+      GF_SERVER_ROOT_URL: https://rythmify-back.duckdns.org/grafana/
       GF_SERVER_SERVE_FROM_SUB_PATH: "true"
     volumes:
       - grafana_data:/var/lib/grafana
@@ -99,7 +99,7 @@ services:
     container_name: rythmify_nginx_exporter
     restart: unless-stopped
     command:
-      - '--nginx.scrape-uri=http://host.docker.internal/nginx_status'
+      --nginx.scrape-uri=http://host.docker.internal:8081/nginx_status
     extra_hosts:
       - host.docker.internal:host-gateway
     ports:
diff --git a/nginx/rythmify.conf b/nginx/rythmify.conf
new file mode 100644
index 0000000..59a4f6c
--- /dev/null
+++ b/nginx/rythmify.conf
@@ -0,0 +1,49 @@
+# Backend — rythmify-back.duckdns.org
+geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb {
+    $geoip2_data_country_code country iso_code;
+}
+
+server {
+    server_name rythmify-back.duckdns.org;
+
+    location /grafana {
+        proxy_pass         http://localhost:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /health {
+        proxy_pass http://localhost:8080;
+    }
+
+    location / {
+        proxy_pass         http://localhost:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade           $http_upgrade;
+        proxy_set_header Connection        'upgrade';
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Country-Code    $geoip2_data_country_code;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/rythmify.duckdns.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/rythmify.duckdns.org/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+# Internal stub_status for nginx-prometheus-exporter
+server {
+    listen 172.17.0.1:8081;
+    location /nginx_status {
+        stub_status;
+        allow all;
+    }
+}