diff --git a/deploy/nginx/omnl-lxc-portal.conf b/deploy/nginx/omnl-lxc-portal.conf
new file mode 100644
index 0000000..22c663e
--- /dev/null
+++ b/deploy/nginx/omnl-lxc-portal.conf
@@ -0,0 +1,72 @@
+worker_processes auto;
+pid /var/log/omnl-bank/nginx.pid;
+error_log /var/log/omnl-bank/nginx-error.log;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include       /etc/nginx/mime.types;
+  default_type  application/octet-stream;
+  sendfile      on;
+  keepalive_timeout 65;
+
+  upstream omnl_lxc_api {
+    server 127.0.0.1:3000;
+  }
+
+  upstream omnl_lxc_settlement {
+    server 127.0.0.1:3011;
+  }
+
+  upstream omnl_lxc_exchange {
+    server 127.0.0.1:3012;
+  }
+
+  server {
+    listen 3002 default_server;
+    listen [::]:3002 default_server;
+    server_name _;
+
+    root /srv/ali-portal/frontend-dapp/dist;
+    index index.html;
+
+    location /api/v1/ {
+      proxy_pass http://omnl_lxc_api/api/v1/;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_read_timeout 120s;
+    }
+
+    location /settlement/ {
+      proxy_pass http://omnl_lxc_settlement/;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_read_timeout 120s;
+    }
+
+    location /exchange/ {
+      proxy_pass http://omnl_lxc_exchange/;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_read_timeout 120s;
+    }
+
+    location /assets/ {
+      expires 1y;
+      add_header Cache-Control "public, immutable";
+      try_files $uri =404;
+    }
+
+    location = /index.html {
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      try_files $uri =404;
+    }
+
+    location / {
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      try_files $uri $uri/ /index.html;
+    }
+  }
+}
diff --git a/scripts/deployment/deploy-omnl-banking-portal-pct.sh b/scripts/deployment/deploy-omnl-banking-portal-pct.sh
index d06bcc9..d58e86c 100755
--- a/scripts/deployment/deploy-omnl-banking-portal-pct.sh
+++ b/scripts/deployment/deploy-omnl-banking-portal-pct.sh
@@ -54,7 +54,8 @@ tar -czf "$STAGE" \
   services/dbis-exchange/dist \
   services/dbis-exchange/package.json \
   services/dbis-exchange/package-lock.json \
-  scripts/deployment/start-omnl-banking-portal.sh
+  scripts/deployment/start-omnl-banking-portal.sh \
+  deploy/nginx/omnl-lxc-portal.conf
 
 log "Push to PVE host ${OMNL_PVE_SSH_TARGET}..."
 omnl_pve_scp "$STAGE" "${OMNL_PVE_SSH_TARGET}:/tmp/omnl-portal.tar.gz"
diff --git a/scripts/deployment/start-omnl-banking-portal.sh b/scripts/deployment/start-omnl-banking-portal.sh
index 9dd318d..fcbd37a 100644
--- a/scripts/deployment/start-omnl-banking-portal.sh
+++ b/scripts/deployment/start-omnl-banking-portal.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
-# Start OMNL services from /srv/banking-portal/OMNL inside PCT
+# Start OMNL services from /srv/ali-portal inside PCT
 set -euo pipefail
 
 ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}"
 LOG_DIR="${OMNL_BANK_LOG_DIR:-/var/log/omnl-bank}"
+NGINX_TEMPLATE="${ROOT}/deploy/nginx/omnl-lxc-portal.conf"
 mkdir -p "$LOG_DIR"
 
 export SETTLEMENT_MIDDLEWARE_CONFIG="${ROOT}/config/settlement-middleware.production.v1.json"
@@ -24,6 +25,7 @@ start() {
     OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-}" \
     OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-omnl}" \
     OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
+    OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
     OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
     OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \
     bash -c "$cmd" >"${LOG_DIR}/${name}.log" 2>&1 &
@@ -39,8 +41,21 @@ sleep 2
 
 FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
 pkill -f "serve -s.*${FRONTEND_PORT}" 2>/dev/null || true
-cd "${ROOT}/frontend-dapp"
-nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
-echo $! >"${LOG_DIR}/frontend.pid"
+if [ -f "${LOG_DIR}/nginx.pid" ]; then
+  nginx -s quit -g "pid ${LOG_DIR}/nginx.pid;" 2>/dev/null || true
+fi
+fuser -k "${FRONTEND_PORT}/tcp" 2>/dev/null || true
+sleep 1
 
-echo "OMNL banking portal started under ${ROOT}"
+if command -v nginx >/dev/null 2>&1 && [ -f "$NGINX_TEMPLATE" ]; then
+  sed "s|/srv/ali-portal|${ROOT}|g" "$NGINX_TEMPLATE" > "${LOG_DIR}/nginx.conf"
+  nginx -t -c "${LOG_DIR}/nginx.conf"
+  nohup nginx -c "${LOG_DIR}/nginx.conf" >"${LOG_DIR}/frontend.log" 2>&1 &
+  echo $! >"${LOG_DIR}/frontend.pid"
+  echo "OMNL banking portal started under ${ROOT} (nginx :${FRONTEND_PORT})"
+else
+  cd "${ROOT}/frontend-dapp"
+  nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
+  echo $! >"${LOG_DIR}/frontend.pid"
+  echo "OMNL banking portal started under ${ROOT} (serve :${FRONTEND_PORT})"
+fi