diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index d9a0a26..c4affc7 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -64,10 +64,9 @@ jobs:
           IMAGE="git.koppkb.com/kopkb/qms-fe-admin"
           TAGS="-t ${IMAGE}:${{ gitea.sha }}"
           API_URL="${{ secrets.VITE_API_URL }}"
-          CUSTOMER_URL="${{ secrets.VITE_CUSTOMER_APP_URL }}"
 
           if [ -z "${API_URL}" ]; then
-            echo "ERROR: Set Gitea secret VITE_API_URL (e.g. http://YOUR_SERVER_IP:8080)"
+            echo "ERROR: Set Gitea secret VITE_API_URL (e.g. https://qms-api.erahn.com.my)"
             exit 1
           fi
 
@@ -76,10 +75,10 @@ jobs:
           fi
 
           echo "Building and pushing admin: ${TAGS}"
+          echo "VITE_API_URL=${API_URL}"
           docker buildx build \
             --platform linux/amd64 \
             --build-arg VITE_API_URL="${API_URL}" \
-            --build-arg VITE_CUSTOMER_APP_URL="${CUSTOMER_URL:-http://localhost:3000}" \
             --cache-from type=registry,ref=${IMAGE}:buildcache,ignore-error=true \
             --cache-to type=registry,ref=${IMAGE}:buildcache,mode=max \
             -f fe/web/admin-app/Dockerfile \
@@ -110,7 +109,7 @@ jobs:
           API_URL="${{ secrets.VITE_API_URL }}"
 
           if [ -z "${API_URL}" ]; then
-            echo "ERROR: Set Gitea secret VITE_API_URL (e.g. http://YOUR_SERVER_IP:8080)"
+            echo "ERROR: Set Gitea secret VITE_API_URL (e.g. https://qms-api.erahn.com.my)"
             exit 1
           fi
 
@@ -155,7 +154,7 @@ jobs:
           fi
 
           if [ -z "${API_URL}" ]; then
-            echo "ERROR: Set Gitea secret NEXT_PUBLIC_API_URL or VITE_API_URL (e.g. http://YOUR_SERVER_IP:8080)"
+            echo "ERROR: Set Gitea secret NEXT_PUBLIC_API_URL or VITE_API_URL (e.g. https://qms-api.erahn.com.my)"
             exit 1
           fi
 
diff --git a/be/.env.example b/be/.env.example
index dcd7651..9f61414 100644
--- a/be/.env.example
+++ b/be/.env.example
@@ -1,6 +1,7 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-# MySQL is internal-only (not published to the host)
+# Published for DBeaver/tools (container still uses 3306 internally)
+MYSQL_HOST_PORT=3307
 
 # MySQL
 # Quote if the password contains special chars like ; # $
diff --git a/be/.env.production b/be/.env.production
index 2804314..8f20196 100644
--- a/be/.env.production
+++ b/be/.env.production
@@ -1,6 +1,7 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-# MySQL is internal-only (not published to the host)
+# Published for DBeaver/tools (container still uses 3306 internally)
+MYSQL_HOST_PORT=3307
 
 # MySQL
 MYSQL_ROOT_PASSWORD="R8qjjBJDg9NtL2IwcnoFMkn8pktwAZ;wsl"
diff --git a/be/docker-compose.yml b/be/docker-compose.yml
index 03cc2c4..d56a505 100644
--- a/be/docker-compose.yml
+++ b/be/docker-compose.yml
@@ -3,15 +3,23 @@ services:
     image: mysql:8
     container_name: qms-mysql
     restart: unless-stopped
-    # Do not publish 3306 to the host — avoids clashes with host MySQL.
-    # Backend reaches it as hostname "mysql" on the internal Docker network.
+    ports:
+      - "${MYSQL_HOST_PORT:-3307}:3306"
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-password}
       MYSQL_DATABASE: ${MYSQL_DATABASE:-qms}
     volumes:
       - qms-mysql-data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${MYSQL_ROOT_PASSWORD:-password}"]
+      test:
+        [
+          "CMD",
+          "mysqladmin",
+          "ping",
+          "-h",
+          "localhost",
+          "-p${MYSQL_ROOT_PASSWORD:-password}",
+        ]
       interval: 5s
       timeout: 5s
       retries: 20
diff --git a/fe/web/.env.domain b/fe/web/.env.domain
new file mode 100644
index 0000000..b086a63
--- /dev/null
+++ b/fe/web/.env.domain
@@ -0,0 +1,26 @@
+# Host ports (used until nginx terminates TLS on 443)
+ADMIN_HOST_PORT=5000
+TELLER_HOST_PORT=3001
+CUSTOMER_HOST_PORT=3000
+
+# Domains — also set these as Gitea secrets, then rebuild FE images
+#   VITE_API_URL / NEXT_PUBLIC_API_URL = https://qms-api.erahn.com.my
+#   VITE_CUSTOMER_APP_URL               = https://qms-customer.erahn.com.my
+VITE_API_URL=https://qms-api.erahn.com.my
+VITE_CUSTOMER_APP_URL=https://qms-customer.erahn.com.my
+NEXT_PUBLIC_API_URL=https://qms-api.erahn.com.my
+
+# Public app URLs (reference for nginx / bookmarks)
+# ADMIN:    https://qms-admin.erahn.com.my
+# TELLER:   https://qms-teller.erahn.com.my
+# CUSTOMER: https://qms-customer.erahn.com.my
+# API:      https://qms-api.erahn.com.my
+
+# Runtime (customer Next.js server)
+QR_TOKEN_SECRET=qms-branch-qr-v1
+
+# Registry images (used by compose / deploy)
+ADMIN_IMAGE=git.koppkb.com/kopkb/qms-fe-admin
+TELLER_IMAGE=git.koppkb.com/kopkb/qms-fe-teller
+CUSTOMER_IMAGE=git.koppkb.com/kopkb/qms-fe-customer
+IMAGE_TAG=local
diff --git a/fe/web/.env.example b/fe/web/.env.example
index deef96d..12c3183 100644
--- a/fe/web/.env.example
+++ b/fe/web/.env.example
@@ -1,17 +1,12 @@
-# Host ports (change if they collide on the single server)
 ADMIN_HOST_PORT=5000
 TELLER_HOST_PORT=3001
 CUSTOMER_HOST_PORT=3000
 
-# Baked into images at build time (set matching Gitea secrets too)
-VITE_API_URL=http://YOUR_SERVER_IP:8080
-VITE_CUSTOMER_APP_URL=http://YOUR_SERVER_IP:3000
-NEXT_PUBLIC_API_URL=http://YOUR_SERVER_IP:8080
+VITE_API_URL=https://qms-api.erahn.com.my
+NEXT_PUBLIC_API_URL=https://qms-api.erahn.com.my
 
-# Runtime (customer Next.js server)
 QR_TOKEN_SECRET=qms-branch-qr-v1
 
-# Registry images (used by compose / deploy)
 ADMIN_IMAGE=git.koppkb.com/kopkb/qms-fe-admin
 TELLER_IMAGE=git.koppkb.com/kopkb/qms-fe-teller
 CUSTOMER_IMAGE=git.koppkb.com/kopkb/qms-fe-customer
diff --git a/fe/web/.env.production b/fe/web/.env.production
index a34d563..2251b05 100644
--- a/fe/web/.env.production
+++ b/fe/web/.env.production
@@ -1,16 +1,12 @@
-# Host ports (change if they collide on the single server)
 ADMIN_HOST_PORT=5000
 TELLER_HOST_PORT=3001
 CUSTOMER_HOST_PORT=3000
 
-VITE_API_URL=http://172.16.6.200:8080
-VITE_CUSTOMER_APP_URL=http://172.16.6.200:3000
-NEXT_PUBLIC_API_URL=http://172.16.6.200:8080
+VITE_API_URL=https://qms-api.erahn.com.my
+NEXT_PUBLIC_API_URL=https://qms-api.erahn.com.my
 
-# Runtime (customer Next.js server)
 QR_TOKEN_SECRET=qms-branch-qr-v1
 
-# Registry images (used by compose / deploy)
 ADMIN_IMAGE=git.koppkb.com/kopkb/qms-fe-admin
 TELLER_IMAGE=git.koppkb.com/kopkb/qms-fe-teller
 CUSTOMER_IMAGE=git.koppkb.com/kopkb/qms-fe-customer
diff --git a/fe/web/admin-app/.env.example b/fe/web/admin-app/.env.example
new file mode 100644
index 0000000..7fb485e
--- /dev/null
+++ b/fe/web/admin-app/.env.example
@@ -0,0 +1 @@
+VITE_API_URL=https://qms-api.erahn.com.my
diff --git a/fe/web/admin-app/.env.production b/fe/web/admin-app/.env.production
new file mode 100644
index 0000000..acb3260
--- /dev/null
+++ b/fe/web/admin-app/.env.production
@@ -0,0 +1,2 @@
+# Baked into the admin image at build time (Gitea secret VITE_API_URL)
+VITE_API_URL=https://qms-api.erahn.com.my
diff --git a/fe/web/admin-app/Dockerfile b/fe/web/admin-app/Dockerfile
index 35ea182..e1efb68 100644
--- a/fe/web/admin-app/Dockerfile
+++ b/fe/web/admin-app/Dockerfile
@@ -3,9 +3,7 @@ FROM node:20-bookworm AS build
 WORKDIR /app
 
 ARG VITE_API_URL=http://localhost:8080
-ARG VITE_CUSTOMER_APP_URL=http://localhost:3000
 ENV VITE_API_URL=$VITE_API_URL
-ENV VITE_CUSTOMER_APP_URL=$VITE_CUSTOMER_APP_URL
 
 COPY package.json package-lock.json ./
 RUN npm ci
diff --git a/fe/web/admin-app/src/constants.js b/fe/web/admin-app/src/constants.js
index 5fb7548..4e843e9 100644
--- a/fe/web/admin-app/src/constants.js
+++ b/fe/web/admin-app/src/constants.js
@@ -1,10 +1,8 @@
-export const SERVER_URL =
-    import.meta.env.VITE_API_URL ?? 'http://localhost:8080';
+export const SERVER_URL = import.meta.env.VITE_API_URL;
 
-export const CUSTOMER_APP_URL =
-    import.meta.env.VITE_CUSTOMER_APP_URL ?? 'http://localhost:3000';
+export const CUSTOMER_APP_URL = 'https://qms-customer.erahn.com.my';
 
 export const ROLES = {
-    ROLE_SUPER_ADMIN : "ROLE_SUPER_ADMIN",
-    ROLE_BRANCH_ADMIN : "ROLE_BRANCH_ADMIN"
-}
+    ROLE_SUPER_ADMIN: 'ROLE_SUPER_ADMIN',
+    ROLE_BRANCH_ADMIN: 'ROLE_BRANCH_ADMIN',
+};
diff --git a/fe/web/docker-compose.yml b/fe/web/docker-compose.yml
index f27c26c..5c155ac 100644
--- a/fe/web/docker-compose.yml
+++ b/fe/web/docker-compose.yml
@@ -6,7 +6,6 @@ services:
       dockerfile: Dockerfile
       args:
         VITE_API_URL: ${VITE_API_URL:-http://localhost:8080}
-        VITE_CUSTOMER_APP_URL: ${VITE_CUSTOMER_APP_URL:-http://localhost:3000}
     container_name: qms-fe-admin
     restart: unless-stopped
     ports: