diff --git a/.env b/.env
new file mode 100644
index 0000000000000000000000000000000000000000..f102789348f1557fbb6ac37f354ac4b3cbff0db9
--- /dev/null
+++ b/.env
@@ -0,0 +1,17 @@
+COMPOSE_FILE=docker-compose.yml:traefik.yml
+
+# prod container restart policy
+RESTART=always
+
+HTTP_FOLDER=./upload
+# hosts allowed to access ressources from $HTTP_FOLDER
+# * to allow all, http://localhost:$DEV_PORT to allow only devserver
+CORS_ALLOWED_HOSTS=*
+# This is the host used by annotot request launched by the client using mirador
+# It should be localhost on dev mode, an something like annotot.yourservice.com in production
+# For production only
+# For traefik (optionnal)
+NAME=scene-uploads
+HOST=scene-uploads.tetras-libre.fr
+HTTPD_NAME=expose-scene-uploads
+HTTPD_HOST=expose-scene-uploads.tetras-libre.fr
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000000000000000000000000000000000000..17dfffa7a40bcf75da517caf760bc90585cb9718
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,5 @@
+:80 {
+	root * /srv
+	file_server browse
+	header Access-Control-Allow-Origin "{env.CORS_ALLOWED_HOSTS}"
+}
diff --git a/package.json b/app/package.json
similarity index 100%
rename from package.json
rename to app/package.json
diff --git a/server.js b/app/server.js
similarity index 84%
rename from server.js
rename to app/server.js
index 56141f01350f28d0a352a33ed14471adffeab4c3..5d0787fd158cfb60d2287661853e9a2db3f50186 100644
--- a/server.js
+++ b/app/server.js
@@ -2,11 +2,11 @@ const express = require('express');
 const multer = require('multer');
 const app = express();
 const port = 3000;
-app.use('/static', express.static('uploads'));
+app.use('/static', express.static('upload'));
 
 const storage = multer.diskStorage({
   destination: function (req, file, cb) {
-    cb(null, 'uploads/') // Make sure this folder exists
+    cb(null, 'upload/') // Make sure this folder exists
   },
   filename: function (req, file, cb) {
     cb(null, file.fieldname + '-' + Date.now())
diff --git a/docker-compose.yml b/docker-compose.yml
index 2baf0895fc5358d6d35d453d27b890bc021c899a..15a755264200951347208b723a35c92a961d7dbd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,9 +3,20 @@ version: "3"
 services:
   front:
     build:
-      context: "docker/"
-    volumes:
-      - ${PWD}:/app
+      context: "docker/"    
     environment:
       ENV:
+    volumes:
+      - ./app:/app
+      - ./app/upload:/app/upload
 
+  httpd:
+    hostname: expose-scene-uploads
+    image: caddy:latest
+    restart: $RESTART
+    environment:
+      - CORS_ALLOWED_HOSTS
+      - WEBPACK_MODE=production
+    volumes:
+      - ./app/upload:/srv
+      - ./Caddyfile:/etc/caddy/Caddyfile
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 4f5feaa5d43f6f7dcfbe0b9e69670ec5b78046c4..ea22458cd46b708846165e2fcdc426f6d504d457 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 
 npm install
-./cli post_install
 
 if [ "$ENV" == "prod" ]; then
    cmd="npm start"
diff --git a/traefik.yml b/traefik.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d4e383914bebced41777af510fbc0c7355b83a4a
--- /dev/null
+++ b/traefik.yml
@@ -0,0 +1,30 @@
+version: "3.4"
+services:
+  httpd:
+    networks:
+      - default
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      - "traefik.http.routers.${HTTPD_NAME}.rule=Host(`${HTTPD_HOST}`)"
+      - "traefik.http.routers.${HTTPD_NAME}.tls.certresolver=myresolver"
+      - "traefik.http.routers.${HTTPD_NAME}.entrypoints=web,websecure"
+      - "traefik.http.routers.${HTTPD_NAME}.middlewares=hardening@docker"
+
+  front:
+    networks:
+      - default
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      - "traefik.http.routers.${NAME}.rule=Host(`${HOST}`)"
+      - "traefik.http.routers.${NAME}.tls.certresolver=myresolver"
+      - "traefik.http.routers.${NAME}.entrypoints=web,websecure"
+      - "traefik.http.routers.${NAME}.middlewares=hardening@docker"
+      #- "traefik.http.services.${NAME}.loadbalancer.server.port=3000"
+
+networks:
+  traefik:
+    external: true