diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf
index d7ae2c6..1c417bb 100644
--- a/nginx/conf.d/default.conf
+++ b/nginx/conf.d/default.conf
@@ -59,11 +59,45 @@ server {
 	ssl_certificate /etc/nginx/certs/default.crt;
 	ssl_certificate_key /etc/nginx/certs/default.key;
 }
+# express.unboundedpress.org
+upstream express.unboundedpress.org {
+				## Can be connected with "www_default" network
+			# mongo-express
+			server 172.18.0.8:8081;
+}
+server {
+	server_name express.unboundedpress.org;
+	listen 80 ;
+	access_log /var/log/nginx/access.log vhost;
+	return 301 https://$host$request_uri;
+}
+server {
+	server_name express.unboundedpress.org;
+	listen 443 ssl http2 ;
+	access_log /var/log/nginx/access.log vhost;
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
+	ssl_prefer_server_ciphers on;
+	ssl_session_timeout 5m;
+	ssl_session_cache shared:SSL:50m;
+	ssl_session_tickets off;
+	ssl_certificate /etc/nginx/certs/express.unboundedpress.org.crt;
+	ssl_certificate_key /etc/nginx/certs/express.unboundedpress.org.key;
+	ssl_dhparam /etc/nginx/certs/express.unboundedpress.org.dhparam.pem;
+	ssl_stapling on;
+	ssl_stapling_verify on;
+	ssl_trusted_certificate /etc/nginx/certs/express.unboundedpress.org.chain.pem;
+	add_header Strict-Transport-Security "max-age=31536000" always;
+	include /etc/nginx/vhost.d/default;
+	location / {
+		proxy_pass http://express.unboundedpress.org;
+	}
+}
 # gitea.unboundedpress.org
 upstream gitea.unboundedpress.org {
 				## Can be connected with "www_default" network
 			# gitea
-			server 172.18.0.6:4000;
+			server 172.18.0.3:4000;
 }
 server {
 	server_name gitea.unboundedpress.org;
@@ -97,7 +131,7 @@ server {
 upstream nextcloud.unboundedpress.org {
 				## Can be connected with "www_default" network
 			# nextcloud
-			server 172.18.0.7:80;
+			server 172.18.0.10:80;
 }
 server {
 	server_name nextcloud.unboundedpress.org;
@@ -122,6 +156,7 @@ server {
 	ssl_stapling_verify on;
 	ssl_trusted_certificate /etc/nginx/certs/nextcloud.unboundedpress.org.chain.pem;
 	add_header Strict-Transport-Security "max-age=31536000" always;
+	include /etc/nginx/vhost.d/default;
 	location / {
 		proxy_pass http://nextcloud.unboundedpress.org;
 	}
@@ -130,7 +165,7 @@ server {
 upstream restheart.unboundedpress.org {
 				## Can be connected with "www_default" network
 			# restheart
-			server 172.18.0.9:8080;
+			server 172.18.0.6:8080;
 }
 server {
 	server_name restheart.unboundedpress.org;
@@ -155,6 +190,7 @@ server {
 	ssl_stapling_verify on;
 	ssl_trusted_certificate /etc/nginx/certs/restheart.unboundedpress.org.chain.pem;
 	add_header Strict-Transport-Security "max-age=31536000" always;
+	include /etc/nginx/vhost.d/default;
 	location / {
 		proxy_pass http://restheart.unboundedpress.org;
 	}
@@ -163,7 +199,7 @@ server {
 upstream unboundedpress.org {
 				## Can be connected with "www_default" network
 			# unboundedpress
-			server 172.18.0.10:3000;
+			server 172.18.0.11:3000;
 }
 server {
 	server_name unboundedpress.org;
@@ -188,6 +224,7 @@ server {
 	ssl_stapling_verify on;
 	ssl_trusted_certificate /etc/nginx/certs/unboundedpress.org.chain.pem;
 	add_header Strict-Transport-Security "max-age=31536000" always;
+	include /etc/nginx/vhost.d/default;
 	location / {
 		proxy_pass http://unboundedpress.org;
 	}
@@ -196,7 +233,7 @@ server {
 upstream www.unboundedpress.org {
 				## Can be connected with "www_default" network
 			# unboundedpress
-			server 172.18.0.10:3000;
+			server 172.18.0.11:3000;
 }
 server {
 	server_name www.unboundedpress.org;
@@ -221,6 +258,7 @@ server {
 	ssl_stapling_verify on;
 	ssl_trusted_certificate /etc/nginx/certs/www.unboundedpress.org.chain.pem;
 	add_header Strict-Transport-Security "max-age=31536000" always;
+	include /etc/nginx/vhost.d/default;
 	location / {
 		proxy_pass http://www.unboundedpress.org;
 	}
diff --git a/nginx/vhost.d/default b/nginx/vhost.d/default
new file mode 100644
index 0000000..a25c774
--- /dev/null
+++ b/nginx/vhost.d/default
@@ -0,0 +1,9 @@
+## Start of configuration add by letsencrypt container
+location ^~ /.well-known/acme-challenge/ {
+    auth_basic off;
+    allow all;
+    root /usr/share/nginx/html;
+    try_files $uri =404;
+    break;
+}
+## End of configuration add by letsencrypt container
diff --git a/nginx/vhost.d/gitea.unboundedpress.org b/nginx/vhost.d/gitea.unboundedpress.org
index 782022c..2eb01a6 100644
--- a/nginx/vhost.d/gitea.unboundedpress.org
+++ b/nginx/vhost.d/gitea.unboundedpress.org
@@ -1,3 +1,12 @@
+## Start of configuration add by letsencrypt container
+location ^~ /.well-known/acme-challenge/ {
+    auth_basic off;
+    allow all;
+    root /usr/share/nginx/html;
+    try_files $uri =404;
+    break;
+}
+## End of configuration add by letsencrypt container
 location = / {
      rewrite ^ http://gitea.unboundedpress.org/mwinter/ redirect;
 }