diff --git a/.env.example b/.env.example
index 502415c..9fe3fbe 100644
--- a/.env.example
+++ b/.env.example
@@ -2,7 +2,7 @@
 # Copy this to .env on the droplet and fill in the values
 
 # PocketBase public URL (the Traefik-routed domain)
-VITE_POCKETBASE_URL=https://pb.thob.studio
+VITE_POCKETBASE_URL=https://pb.ar.thob.studio
 
 # Frontend public URL
 VITE_FRONTEND_URL=https://ar.thob.studio
diff --git a/build-and-push.sh b/build-and-push.sh
new file mode 100755
index 0000000..585c5ef
--- /dev/null
+++ b/build-and-push.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -e
+
+REGISTRY="registry.digitalocean.com/thob-blr1"
+SHA=$(git rev-parse --short=10 HEAD)
+
+echo "Building commit: $SHA"
+
+# Login
+doctl registry login
+
+# App
+echo "Building AR App..."
+docker buildx build \
+  --platform linux/amd64 \
+  --build-arg VITE_POCKETBASE_URL=$VITE_POCKETBASE_URL \
+  --build-arg VITE_FRONTEND_URL=$VITE_FRONTEND_URL \
+  -f Dockerfile \
+  --load \
+  -t $REGISTRY/ar:$SHA \
+  -t $REGISTRY/ar:latest .
+docker push $REGISTRY/ar:$SHA
+docker push $REGISTRY/ar:latest
+
+echo "✅ All images built and pushed successfully"
diff --git a/docker-compose.yml b/docker-compose.yml
index 4d0aca4..6dd6ba1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,45 +1,77 @@
-# =============================================================================
-# AR TEST — Application services
-# Deploy path on droplet: /projects/ar-test/
-#
-# Traefik runs in a separate compose (shared infra project) and owns ports 80/443.
-# This project only joins the shared external network `traefik_public`.
-# =============================================================================
+version: "3.9"
+
+networks:
+  traefik:
+    external: true
+
+volumes:
+  pb_data:
 
 services:
+  traefik:
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+    command:
+      - "--api.dashboard=true"
+      - "--api.insecure=true"
+      - "--log.level=DEBUG"
+      - "--accesslog=true"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--certificatesresolvers.letsencrypt.acme.email=tech@thob.studio"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "./configs/traefik/acme.json:/etc/traefik/acme.json"
+    networks:
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.traefik.service=api@internal"
+      - "traefik.http.routers.traefik.entrypoints=websecure"
+      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.traefik.rule=Host(`traefik.ar.thob.studio`)"
+
   app:
-    container_name: ar-test-app
-    image: registry.digitalocean.com/bop/ar-test:latest
+    container_name: ar-app
+    image: registry.digitalocean.com/thob-blr1/ar:latest
     pull_policy: always
     restart: unless-stopped
     build:
       context: .
       dockerfile: Dockerfile
       args:
-        - VITE_POCKETBASE_URL=${VITE_POCKETBASE_URL:-https://pb.thob.studio}
+        - VITE_POCKETBASE_URL=${VITE_POCKETBASE_URL:-https://pb.ar.thob.studio}
     expose:
       - "3000"
     environment:
-      - VITE_POCKETBASE_URL=${VITE_POCKETBASE_URL:-https://pb.thob.studio}
+      - VITE_POCKETBASE_URL=${VITE_POCKETBASE_URL:-https://pb.ar.thob.studio}
       - VITE_FRONTEND_URL=${VITE_FRONTEND_URL:-https://ar.thob.studio}
     depends_on:
       - pocketbase
     networks:
-      - traefik_public
+      - traefik
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik_public"
-      - "traefik.http.routers.ar-test-app.rule=Host(`ar.thob.studio`)"
-      - "traefik.http.routers.ar-test-app.entrypoints=websecure"
-      - "traefik.http.routers.ar-test-app.tls.certresolver=defaultresolver"
-      - "traefik.http.services.ar-test-app.loadbalancer.server.port=3000"
-      - "traefik.http.routers.ar-test-app-http.rule=Host(`ar.thob.studio`)"
-      - "traefik.http.routers.ar-test-app-http.entrypoints=web"
-      - "traefik.http.routers.ar-test-app-http.middlewares=ar-test-app-https-redirect"
-      - "traefik.http.middlewares.ar-test-app-https-redirect.redirectscheme.scheme=https"
+      - "traefik.docker.network=traefik"
+      - "traefik.http.routers.ar-app.rule=Host(`ar.thob.studio`)"
+      - "traefik.http.routers.ar-app.entrypoints=websecure"
+      - "traefik.http.routers.ar-app.tls=true"
+      - "traefik.http.routers.ar-app.tls.certresolver=letsencrypt"
+      - "traefik.http.services.ar-app.loadbalancer.server.port=3000"
 
   pocketbase:
-    container_name: ar-test-pb
+    container_name: ar-pb
     image: ghcr.io/muchobien/pocketbase:latest
     restart: unless-stopped
     command:
@@ -51,22 +83,12 @@ services:
       - pb_data:/pb_data
       - ./pb_migrations:/pb_migrations
     networks:
-      - traefik_public
+      - traefik
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik_public"
-      - "traefik.http.routers.ar-test-pb.rule=Host(`pb.thob.studio`)"
-      - "traefik.http.routers.ar-test-pb.entrypoints=websecure"
-      - "traefik.http.routers.ar-test-pb.tls.certresolver=defaultresolver"
-      - "traefik.http.services.ar-test-pb.loadbalancer.server.port=8090"
-      - "traefik.http.routers.ar-test-pb-http.rule=Host(`pb.thob.studio`)"
-      - "traefik.http.routers.ar-test-pb-http.entrypoints=web"
-      - "traefik.http.routers.ar-test-pb-http.middlewares=ar-test-pb-https-redirect"
-      - "traefik.http.middlewares.ar-test-pb-https-redirect.redirectscheme.scheme=https"
-
-networks:
-  traefik_public:
-    external: true
-
-volumes:
-  pb_data:
+      - "traefik.docker.network=traefik"
+      - "traefik.http.routers.ar-pb.rule=Host(`pb.ar.thob.studio`)"
+      - "traefik.http.routers.ar-pb.entrypoints=websecure"
+      - "traefik.http.routers.ar-pb.tls=true"
+      - "traefik.http.routers.ar-pb.tls.certresolver=letsencrypt"
+      - "traefik.http.services.ar-pb.loadbalancer.server.port=8090"