diff --git a/infra/nginx/gateway.conf b/infra/nginx/gateway.conf
new file mode 100644
index 0000000..eab03d1
--- /dev/null
+++ b/infra/nginx/gateway.conf
@@ -0,0 +1,37 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        # React single-page application fallback.
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api/ {
+        proxy_pass http://api:8080;
+        # The API is reachable only through this same-origin gateway. Do not
+        # forward the browser Origin header while legacy API images allow only
+        # the Vite development origin.
+        proxy_set_header Origin "";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+    }
+
+    location /rtc/ {
+        proxy_pass http://livekit:7880;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_read_timeout 3600s;
+    }
+
+    location /twirp/ {
+        proxy_pass http://livekit:7880;
+        proxy_set_header Host $host;
+    }
+}