diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ef63d50
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,79 @@
+# ============================================================================
+# Mintel.me - Environment Configuration
+# ============================================================================
+# Copy this file to .env for local development
+# For production, use .env.production as a template
+# ============================================================================
+
+# ────────────────────────────────────────────────────────────────────────────
+# Application Configuration
+# ────────────────────────────────────────────────────────────────────────────
+PROJECT_NAME=mintel-me
+NODE_ENV=development
+NEXT_PUBLIC_BASE_URL=http://mintel.me.localhost
+# TARGET is used to differentiate between environments (testing, staging, production)
+TARGET=development
+NEXT_PUBLIC_TARGET=development
+
+# ────────────────────────────────────────────────────────────────────────────
+# Docker Orchestration (Traefik)
+# ────────────────────────────────────────────────────────────────────────────
+TRAEFIK_HOST=mintel.me.localhost
+TRAEFIK_RULE=Host(`mintel.me.localhost`)
+# Use AUTH_MIDDLEWARE to enable/disable Gatekeeper locally
+# Default is empty (disabled) for local development
+# Production: mintel-me-auth
+AUTH_MIDDLEWARE=
+
+# ────────────────────────────────────────────────────────────────────────────
+# Directus CMS Configuration
+# ────────────────────────────────────────────────────────────────────────────
+DIRECTUS_URL=https://cms.mintel.me
+DIRECTUS_HOST=cms.mintel.me.localhost
+DIRECTUS_KEY=some-random-key
+DIRECTUS_SECRET=some-random-secret
+DIRECTUS_DB_NAME=directus
+DIRECTUS_DB_USER=directus
+DIRECTUS_DB_PASSWORD=directus
+
+# ────────────────────────────────────────────────────────────────────────────
+# Analytics (Umami)
+# ────────────────────────────────────────────────────────────────────────────
+UMAMI_WEBSITE_ID=
+UMAMI_API_ENDPOINT=https://analytics.infra.mintel.me
+
+# ────────────────────────────────────────────────────────────────────────────
+# Error Tracking (Sentry)
+# ────────────────────────────────────────────────────────────────────────────
+SENTRY_DSN=
+
+# ────────────────────────────────────────────────────────────────────────────
+# Gatekeeper (Standard Auth)
+# ────────────────────────────────────────────────────────────────────────────
+GATEKEEPER_PASSWORD=mintel
+GATEKEEPER_ORIGIN=https://mintel.me/gatekeeper
+COOKIE_DOMAIN=.mintel.me
+AUTH_COOKIE_NAME=mintel_gatekeeper_session
+
+# ────────────────────────────────────────────────────────────────────────────
+# Deployment Configuration (CI/CD only)
+# ────────────────────────────────────────────────────────────────────────────
+IMAGE_TAG=latest
+ENV_FILE=.env
+LOG_LEVEL=info
+
+# ============================================================================
+# IMPORTANT NOTES
+# ============================================================================
+#
+# Networking:
+# ──────────
+# • The project uses a project-prefixed internal network: ${PROJECT_NAME}-internal
+# • All inter-service communication should use Docker aliases
+#
+# Authentication:
+# ───────────────
+# • Gatekeeper is managed via Traefik ForwardAuth
+# • Set AUTH_MIDDLEWARE=${PROJECT_NAME}-auth in .env.production to enable it
+#
+# ============================================================================
diff --git a/docker-compose.yml b/docker-compose.yml
index 91004ba..6c36e5e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,31 +3,41 @@ services:
     image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
     restart: always
     networks:
+      - default
       - infra
     env_file:
       - ${ENV_FILE:-.env}
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
-      - "traefik.http.routers.${PROJECT_NAME}.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}.tls=true"
-      - "traefik.http.services.${PROJECT_NAME}.loadbalancer.server.port=3000"
-      - "traefik.http.routers.${PROJECT_NAME}.middlewares=${TRAEFIK_MIDDLEWARES:-${PROJECT_NAME}-auth}"
+      # HTTP ⇒ HTTPS redirect
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.entrypoints=web"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.middlewares=redirect-https"
+      # HTTPS router (Standard)
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.service=${PROJECT_NAME:-mintel-me}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.middlewares=${AUTH_MIDDLEWARE:-compress,${PROJECT_NAME:-mintel-me}-forward}"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}.loadbalancer.server.port=3000"
       - "traefik.docker.network=infra"
 
       # Gatekeeper Router (Path-based)
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.rule=(Host(`${TRAEFIK_HOST}`) && PathPrefix(`/gatekeeper`))"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls=true"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.service=${PROJECT_NAME}-gatekeeper"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.rule=(Host(`${TRAEFIK_HOST:-mintel.me}`) && PathPrefix(`/gatekeeper`))"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.service=${PROJECT_NAME:-mintel-me}-gatekeeper"
 
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/gatekeeper/api/verify"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
-      - "traefik.docker.network=infra"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.address=http://${PROJECT_NAME:-mintel-me}-gatekeeper:3000/gatekeeper/api/verify"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.authResponseHeaders=X-Auth-User"
+
+      # Forwarded Headers
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
 
   gatekeeper:
     profiles: ["gatekeeper"]
@@ -41,7 +51,7 @@ services:
     env_file:
       - ${ENV_FILE:-.env}
     environment:
-      PORT: ${PORT:-3000}
+      PORT: 3000
       PROJECT_NAME: ${PROJECT_NAME:-Mintel.me}
       PROJECT_COLOR: ${PROJECT_COLOR:-#ff00ff}
       COOKIE_DOMAIN: ${COOKIE_DOMAIN:-.mintel.me}
@@ -50,15 +60,15 @@ services:
       NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
     labels:
       - "traefik.enable=true"
-      - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-gatekeeper.loadbalancer.server.port=3000"
       - "traefik.docker.network=infra"
 
   directus:
     image: registry.infra.mintel.me/mintel/directus:latest
     restart: always
     networks:
+      - default
       - infra
-      - backend
     env_file:
       - ${ENV_FILE:-.env}
     environment:
@@ -71,9 +81,14 @@ services:
       DB_USER: ${DIRECTUS_DB_USER:-directus}
       DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
       PUBLIC_URL: ${DIRECTUS_URL:-https://cms.mintel.me}
+      SENTRY_DSN: ${SENTRY_DSN}
+      SENTRY_ENVIRONMENT: ${TARGET:-development}
+      LOGGER_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - ./directus/uploads:/directus/uploads
       - ./directus/extensions:/directus/extensions
+      - ./directus/schema:/directus/schema
+      - ./directus/migrations:/directus/migrations
     healthcheck:
       test:
         [
@@ -90,20 +105,19 @@ services:
       start_period: 30s
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.rule=Host(`${DIRECTUS_HOST:-cms.mintel.me.localhost}`)"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.tls=true"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,compress"
-      - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
-      - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.rule=Host(`${DIRECTUS_HOST:-cms.mintel.me.localhost}`)"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.middlewares=${PROJECT_NAME:-mintel-me}-forward,compress"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-directus.loadbalancer.server.port=8055"
       - "traefik.docker.network=infra"
 
   directus-db:
     image: postgres:15-alpine
     restart: always
     networks:
-      - backend
+      - default
     env_file:
       - ${ENV_FILE:-.env}
     environment:
@@ -114,10 +128,10 @@ services:
       - directus-db-data:/var/lib/postgresql/data
 
 networks:
+  default:
+    name: ${PROJECT_NAME:-mintel-me}-internal
   infra:
     external: true
-  backend:
-    internal: true
 
 volumes:
   directus-db-data: