diff --git a/crates/frontend/src/services/websocket.rs b/crates/frontend/src/services/websocket.rs
index cfb215e..0fde8c0 100644
--- a/crates/frontend/src/services/websocket.rs
+++ b/crates/frontend/src/services/websocket.rs
@@ -15,8 +15,15 @@ pub struct WebsocketService {
 
 impl WebsocketService {
     pub fn connect() -> Self {
-        let hostname = web_sys::window().unwrap().location().hostname().unwrap();
-        let ws_addr = format!("ws://{hostname}:4000/ws");
+        let window = web_sys::window().expect("no global `window` exists");
+        let location = window.location();
+        let hostname = location.hostname().expect("should have a hostname");
+        let protocol = match location.protocol().expect("should have a protocol").as_str() {
+            "https:" => "wss",
+            _ => "ws",
+        };
+
+        let ws_addr = format!("{protocol}://{hostname}:4000/ws");
         let ws = WebSocket::open(&ws_addr).unwrap();
         log::info!("Opened websocket connection to {ws_addr}");
 
diff --git a/justfile b/justfile
index 25e18b0..221846e 100644
--- a/justfile
+++ b/justfile
@@ -30,3 +30,9 @@ subscribe-ws:
 
 trunk-serve:
     trunk serve --address=0.0.0.0 crates/frontend/index.html
+
+deploy-frontend:
+    trunk build --release --dist=dist crates/frontend/index.html
+    ssh root@ajb.dk rm -r /var/www/achievements
+    rsync -avz dist/ root@ajb.dk:/var/www/achievements
+
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..4041e08
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,28 @@
+# Backend
+server {
+    listen 4000 ssl http2;
+    listen [::]:4000 ssl http2;
+    server_name achievements.ajb.dk;
+
+    ssl_certificate /etc/letsencrypt/live/ajb.dk/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/ajb.dk/privkey.pem;
+
+    location / {
+        proxy_pass http://localhost:4001/;
+    }
+}
+
+# Frontend (serve yew app static files)
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name achievements.ajb.dk;
+
+    ssl_certificate /etc/letsencrypt/live/ajb.dk/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/ajb.dk/privkey.pem;
+
+    location / {
+        alias /var/www/achievements/;
+        try_files $uri $uri/ /index.html;
+    }
+}