diff --git a/deploy/site.nginx.conf b/deploy/site.nginx.conf
new file mode 100644
index 0000000..0649368
--- /dev/null
+++ b/deploy/site.nginx.conf
@@ -0,0 +1,51 @@
+# Host-nginx-Serverblock für die statisch deployte Seite (/var/www/sites/website).
+#
+# Installation auf 10.161.30.38:
+#   sudo cp deploy/site.nginx.conf /etc/nginx/conf.d/nsu-map.conf
+#   sudo nginx -t && sudo systemctl reload nginx
+#
+# Der Nginx Proxy Manager (Port 80/443) legt sich davor: Proxy-Host anlegen,
+# Ziel → http://127.0.0.1:8080  (Websockets nicht nötig).
+# Ohne Proxy Manager: unten einfach "listen 8080;" auf "listen 80;" ändern.
+
+server {
+    listen        8080;
+    listen        [::]:8080;
+    server_name   _;
+    root          /var/www/sites/website;
+    index         index.html;
+
+    # Sicherheits-Header
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Kompression
+    gzip              on;
+    gzip_vary         on;
+    gzip_min_length   1024;
+    gzip_types        text/plain text/css application/javascript application/json
+                      image/svg+xml application/xml application/rss+xml
+                      font/woff2 application/font-woff;
+
+    # Statische Assets lange cachen (CSS/JS sind fingerprinted)
+    location ~* \.(?:css|js|woff2?|ttf|otf|eot|svg|png|jpe?g|gif|webp|ico)$ {
+        expires 30d;
+        add_header Cache-Control "public, max-age=2592000, immutable";
+        access_log off;
+        try_files $uri =404;
+    }
+
+    # HTML nicht cachen, damit Inhaltsänderungen sofort sichtbar sind
+    location ~* \.html?$ {
+        add_header Cache-Control "no-cache";
+        try_files $uri =404;
+    }
+
+    # Pretty-URLs: /schauplaetze/ -> /schauplaetze/index.html
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # Gebrandete 404-Seite
+    error_page 404 /404.html;
+}