diff --git a/CLAUDE.md b/CLAUDE.md
index e1c95ef..ab1eed0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -48,7 +48,7 @@ docker build -t m1730-scale:latest .
 kubectl apply -f k8s/
 ```
 
-NPM should proxy `https://works.baumann.gr/M1730-generator/` → `http://m1730-generator/` **with the prefix stripped** (trailing slash on `proxy_pass`). The frontend uses a relative `fetch('generate', ...)` URL so it works correctly under any subpath.
+`k8s/ingress.yaml` adds a Traefik `IngressRoute` for `works.baumann.gr/M1730-generator` and a `stripPrefix` middleware. Adjust `certResolver` in the file if your Traefik instance uses a different name.
 
 ## Editing SVG files directly
 
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index a6804c5..c6432cc 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: m1730-generator
-  namespace: default
+  namespace: works
 spec:
   replicas: 1
   selector:
diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
new file mode 100644
index 0000000..585be20
--- /dev/null
+++ b/k8s/ingress.yaml
@@ -0,0 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: m1730-strip-prefix
+  namespace: works
+spec:
+  stripPrefix:
+    prefixes:
+      - /M1730-generator
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: m1730-generator
+  namespace: works
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`works.baumann.gr`) && PathPrefix(`/M1730-generator`)
+      kind: Rule
+      middlewares:
+        - name: m1730-strip-prefix
+      services:
+        - name: m1730-generator
+          port: 80
+  tls:
+    certResolver: letsencrypt
diff --git a/k8s/service.yaml b/k8s/service.yaml
index 7ae3623..3a570e1 100644
--- a/k8s/service.yaml
+++ b/k8s/service.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: m1730-generator
-  namespace: default
+  namespace: works
 spec:
   selector:
     app: m1730-generator