diff --git a/playbooks/site.yml b/playbooks/site.yml
index 1924945..2b34aef 100644
--- a/playbooks/site.yml
+++ b/playbooks/site.yml
@@ -83,13 +83,49 @@
         - cockpit
         - nginx
         - forgejo
-    # Install System Dependencies for Nginx and Certbot    
+
     - name: Remove default Nginx site configuration
       file:
         path: /etc/nginx/sites-enabled/default
         state: absent
 
-    - name: Reload Nginx to apply changes
+    # --- NEW: NGINX REVERSE PROXY CONFIGURATION ---
+    - name: Configure Nginx reverse proxy for Forgejo
+      copy:
+        dest: "/etc/nginx/sites-available/{{ domain_name }}"
+        content: |
+          server {
+              listen 80;
+              server_name {{ domain_name }};
+
+              location / {
+                  proxy_pass http://127.0.0.1:3000;
+                  proxy_set_header Host $host;
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+              }
+          }
+
+    - name: Enable Forgejo Nginx site config symlink
+      file:
+        src: "/etc/nginx/sites-available/{{ domain_name }}"
+        dest: "/etc/nginx/sites-enabled/{{ domain_name }}"
+        state: link
+
+    - name: Reload Nginx to apply proxy routing
       service:
         name: nginx
-        state: reloaded      
\ No newline at end of file
+        state: reloaded
+
+    # --- NEW: LET'S ENCRYPT CERTIFICATE PROVISIONING ---
+    - name: Obtain SSL certificate from Let's Encrypt via Certbot
+      command: >
+        certbot --nginx
+        -d {{ domain_name }}
+        --email {{ letsencrypt_email }}
+        --agree-tos
+        --non-interactive
+        --keep-until-expiring
+      args:
+        creates: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
\ No newline at end of file