diff --git a/docker-compose.yaml b/docker-compose.yaml
index 7289342..171b281 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -17,6 +17,7 @@ services:
     volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf
       - ./src/index.html:/usr/share/nginx/html/index.html
+      - /etc/letsencrypt/live/flowy.live:/etc/letsencrypt/live/flowy.live
     networks:
       - nginx
 
diff --git a/nginx.conf b/nginx.conf
index 71e4b26..a7ea757 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -30,6 +30,12 @@ http {
         listen 443;
         server_name flowy.live;
 
+        # RSA certificate
+        ssl_certificate /etc/letsencrypt/live/flowy.live/fullchain.pem; # managed by Certbot
+        ssl_certificate_key /etc/letsencrypt/live/flowy.live/privkey.pem; # managed by Certbot
+
+        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+
         location / {
             root /usr/share/nginx/html;
             index index.html;
@@ -52,7 +58,11 @@ http {
         listen 443;
         server_name registry.flowy.live;
 
-        # TODO: add tls termination at nginx level
+        # RSA certificate
+        ssl_certificate /etc/letsencrypt/live/flowy.live/fullchain.pem; # managed by Certbot
+        ssl_certificate_key /etc/letsencrypt/live/flowy.live/privkey.pem; # managed by Certbot
+
+        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
 
         location / {
           proxy_pass http://registry:5000;
@@ -79,6 +89,12 @@ http {
       listen 443;
       server_name rancher.flowy.live;
 
+      # RSA certificate
+      ssl_certificate /etc/letsencrypt/live/flowy.live/fullchain.pem; # managed by Certbot
+      ssl_certificate_key /etc/letsencrypt/live/flowy.live/privkey.pem; # managed by Certbot
+
+      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+
       location / {
         proxy_pass https://rancher;
         proxy_set_header Host $host;