diff --git a/.envrc.sample b/.envrc.sample
index 8ba93fb..0ddba27 100644
--- a/.envrc.sample
+++ b/.envrc.sample
@@ -1,4 +1,5 @@
 export DOMAIN=drone.autonomic.zone
 export GITEA_CLIENT_ID=barfoo
 export GITEA_CLIENT_SECRET=foobar
+export LETS_ENCRYPT_ENV=production
 export STACK_NAME=drone
diff --git a/compose.yml b/compose.yml
index 8dcf919..ef915a9 100644
--- a/compose.yml
+++ b/compose.yml
@@ -20,6 +20,17 @@ services:
       - DRONE_SERVER_HOST: "${DOMAIN}"
       - DRONE_SERVER_PORT: ":8042"
       - DRONE_SERVER_PROTO: "https"
+    networks:
+      - proxy
+    deploy:
+      update_config:
+        failure_action: rollback
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.drone.rule=Host(`${DOMAIN}`)"
+        - "traefik.http.routers.drone.entrypoints=web-secure"
+        - "traefik.http.services.drone.loadbalancer.server.port=8042"
+        - "traefik.http.routers.drone.tls.certresolver=${LETS_ENCRYPT_ENV}"
 
 volumes:
   data: