diff --git a/.gitignore b/.gitignore
index 8be8a9d..0c5f277 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,6 @@ venv/
 # Local SQLite dev database
 *.db
 wpsuite.db
+
+# Runtime directories (created by containers)
+logs/
diff --git a/docker-compose.yml b/docker-compose.yml
index e3379b4..45f1ae9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,6 @@ services:
     volumes:
       - ./html:/usr/share/nginx/html:ro
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./logs:/var/log/nginx
     restart: unless-stopped
     depends_on:
diff --git a/nginx/conf.d/wp-suite.conf b/nginx/conf.d/wp-suite.conf
new file mode 100644
index 0000000..22b8996
--- /dev/null
+++ b/nginx/conf.d/wp-suite.conf
@@ -0,0 +1,25 @@
+# Work Package Suite — NGINX site config
+# This container sits behind an external reverse proxy that handles SSL.
+# It listens on port 80 (plain HTTP on the internal Docker network).
+
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # Proxy /api/ to the FastAPI container (service name "api" on the internal network)
+    location /api/ {
+        proxy_pass http://api:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 5m;
+    }
+}