diff --git a/.env.example b/.env.example
index 27cfd4c..fb0652d 100644
--- a/.env.example
+++ b/.env.example
@@ -19,11 +19,15 @@ NEXT_PUBLIC_TARGET=development
 # Docker Orchestration (Traefik)
 # ────────────────────────────────────────────────────────────────────────────
 TRAEFIK_HOST=mintel.localhost
-TRAEFIK_RULE=Host("mintel.localhost")
+TRAEFIK_HOST_RULE=
+TRAEFIK_ENTRYPOINT=web
+TRAEFIK_TLS=false
+TRAEFIK_CERT_RESOLVER=
 # Use AUTH_MIDDLEWARE to enable/disable Gatekeeper locally
 # Default is empty (disabled) for local development
 # Production: mintel-me-auth
 AUTH_MIDDLEWARE=
+AUTH_MIDDLEWARE_UNPROTECTED=
 
 # ────────────────────────────────────────────────────────────────────────────
 # Directus CMS Configuration
diff --git a/docker-compose.yml b/docker-compose.yml
index 092ee94..bde140e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,24 +11,37 @@ services:
     labels:
       - "traefik.enable=true"
       # HTTP ⇒ HTTPS redirect
-      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.rule=${TRAEFIK_HOST_RULE:-Host("mintel.localhost")}'
+      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
       - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.entrypoints=web"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.middlewares=redirect-https"
+      # - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.middlewares=redirect-https"
       # HTTPS router (Standard)
-      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}.rule=${TRAEFIK_HOST_RULE:-Host("mintel.localhost")}'
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls=true"
+      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls=${TRAEFIK_TLS:-false}"
       - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.service=${PROJECT_NAME:-mintel-me}"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.middlewares=${AUTH_MIDDLEWARE:-compress,${PROJECT_NAME:-mintel-me}-forward}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.middlewares=${AUTH_MIDDLEWARE:-${PROJECT_NAME:-mintel-me}-ratelimit,${PROJECT_NAME:-mintel-me}-forward}"
       - "traefik.http.services.${PROJECT_NAME:-mintel-me}.loadbalancer.server.port=3000"
       - "traefik.docker.network=infra"
 
+      # Public Router (Whitelist for OG Images, Sitemaps, Health)
+      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.tls=${TRAEFIK_TLS:-false}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.service=${PROJECT_NAME:-mintel-me}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-${PROJECT_NAME:-mintel-me}-ratelimit,${PROJECT_NAME:-mintel-me}-forward}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-public.priority=2000"
+
+      # Middlewares
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-ratelimit.ratelimit.average=100"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-ratelimit.ratelimit.burst=50"
+
       # Gatekeeper Router (Path-based)
       - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.rule=(Host("${TRAEFIK_HOST:-mintel.localhost}") && PathPrefix("/gatekeeper"))'
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls=${TRAEFIK_TLS:-false}"
       - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.service=${PROJECT_NAME:-mintel-me}-gatekeeper"
 
       - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.address=http://${PROJECT_NAME:-mintel-me}-gatekeeper:3000/gatekeeper/api/verify"
@@ -106,11 +119,12 @@ services:
       start_period: 30s
     labels:
       - "traefik.enable=true"
-      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.rule=Host("${DIRECTUS_HOST:-cms.mintel.localhost}")'
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls=true"
-      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.middlewares=${PROJECT_NAME:-mintel-me}-forward,compress"
+      - 'traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.rule=${TRAEFIK_DIRECTUS_RULE:-Host("${DIRECTUS_HOST:-cms.mintel.localhost}")}'
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls=${TRAEFIK_TLS:-false}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.service=${PROJECT_NAME:-mintel-me}-directus"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.middlewares=${PROJECT_NAME:-mintel-me}-forward"
       - "traefik.http.services.${PROJECT_NAME:-mintel-me}-directus.loadbalancer.server.port=8055"
       - "traefik.docker.network=infra"