diff --git a/docker-compose.yml b/docker-compose.yml
index 4e8307e..63cb0de 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,14 +21,33 @@ services:
       - shelfy_data:/app/data
       - shelfy_logs:/var/log/shelfy     # <--- MONTE TON FRONT (lecture seule)
  # <-- logs lus par Fail2ban
-    labels:
-      - traefik.http.routers.shelfy.middlewares=webdav-allow-methods@docker
-      - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowmethods=GET,PUT,POST,DELETE,PROPFIND,OPTIONS,LOCK,UNLOCK,HEAD
-      - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowheaders=Authorization,Depth,Content-Type,If-Modified-Since,User-Agent,Destination,Overwrite
-    dns:
-      - 8.8.8.8
-      - 1.1.1.1
-    restart: unless-stopped
+  labels:
+    - traefik.enable=true
+    - traefik.docker.network=dokploy-network
+
+    # --- HTTPS direct sur media.canguidev.fr ---
+    - traefik.http.routers.media.rule=Host(`media.canguidev.fr`)
+    - traefik.http.routers.media.entrypoints=websecure
+    - traefik.http.routers.media.tls=true
+    - traefik.http.routers.media.tls.certresolver=letsencrypt
+    - traefik.http.services.media.loadbalancer.server.port=8080
+    - traefik.http.routers.media.service=media
+
+    # --- Redirect HTTP -> HTTPS (AUCUN @file) ---
+    - traefik.http.routers.media-redirect.rule=Host(`media.canguidev.fr`)
+    - traefik.http.routers.media-redirect.entrypoints=web
+    - traefik.http.routers.media-redirect.middlewares=redirect-to-https
+    - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+
+    # --- (facultatif) tes headers WebDAV, ils ne redirigent pas ---
+    - traefik.http.routers.shelfy.middlewares=webdav-allow-methods@docker
+    - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowmethods=GET,PUT,POST,DELETE,PROPFIND,OPTIONS,LOCK,UNLOCK,HEAD
+    - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowheaders=Authorization,Depth,Content-Type,If-Modified-Since,User-Agent,Destination,Overwrite
+
+      dns:
+        - 8.8.8.8
+        - 1.1.1.1
+      restart: unless-stopped
     # ⚠️ Supprime la directive 'command:' ici, l'ENTRYPOINT du Dockerfile s'en charge.
 
   fail2ban: