diff --git a/deploy/production.env.example b/deploy/production.env.example
index 8b4a05a..1959c17 100644
--- a/deploy/production.env.example
+++ b/deploy/production.env.example
@@ -26,3 +26,10 @@ SMTP_PORT=465
 SMTP_USER=
 SMTP_PASSWORD=
 MAIL_FROM=musicshare <app@musicshare.binarygnome.com>
+
+# Only with docker-compose.behind-proxy.yml (an existing proxy like NPMplus owns 80/443):
+# the ports the proxy forwards to. Use 127.0.0.1 if the proxy runs with host networking,
+# otherwise this server's LAN IP.
+PROXY_BIND=127.0.0.1
+WEB_PORT=3737
+API_PORT=3738
diff --git a/docker-compose.behind-proxy.yml b/docker-compose.behind-proxy.yml
new file mode 100644
index 0000000..fa44eec
--- /dev/null
+++ b/docker-compose.behind-proxy.yml
@@ -0,0 +1,22 @@
+# Production behind an existing reverse proxy (e.g. NPMplus / Nginx Proxy Manager)
+# that owns ports 80/443 and handles HTTPS. No Caddy: the web app and API are
+# published on the host for the proxy to reach.
+#
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.behind-proxy.yml \
+#     --env-file deploy/production.env up -d --build
+#
+# In the proxy, for your domain:
+#   /        -> http://127.0.0.1:3737   (WEB_PORT)
+#   /api/    -> http://127.0.0.1:3738/  (API_PORT; strip the /api prefix, websockets on)
+
+services:
+  caddy:
+    profiles: ["caddy"] # not started
+
+  web:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${WEB_PORT:-3737}:3737"
+
+  api:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${API_PORT:-3738}:4000"