diff --git a/docker/Dockerfile b/docker/Dockerfile
index f7c7604..2c9c1a2 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -42,11 +42,9 @@ COPY --from=build /usr/local/bin/repoguard /home/git/repoguard
 COPY docker/rootfs/ .
 
 RUN chown root:root /usr/local/libexec/tangled-keyfetch && \
-    chmod 755 /usr/local/libexec/tangled-keyfetch && \
-    chown git:git /home/git/repoguard && \
-    chown git:git /app && chown git:git /home/git/repositories
+    chmod 755 /usr/local/libexec/tangled-keyfetch
 
 EXPOSE 22
 EXPOSE 5555
 
-ENTRYPOINT ["/init"]
+ENTRYPOINT ["/bin/sh", "-c", "chown git:git /home/git/repoguard && chown git:git /app && chown git:git /home/git/repositories && /init"]
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 04a5793..7a1ad94 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -13,5 +13,21 @@ services:
       - "./repositories:/home/git/repositories"
       - "./server:/app"
     ports:
-      - "5555:5555"
       - "2222:22"
+  frontend:
+    image: caddy:2-alpine
+    command: >
+      caddy
+      reverse-proxy
+      --from ${KNOT_SERVER_HOSTNAME}
+      --to knot:5555
+    depends_on:
+      - knot
+    ports:
+      - "443:443"
+      - "443:443/udp"
+    volumes:
+      - caddy_data:/data
+    restart: always
+volumes:
+  caddy_data: