diff --git a/deploy/docker/nginx/remnawave-minishop.conf b/deploy/docker/nginx/remnawave-minishop.conf
new file mode 100644
index 0000000..687f404
--- /dev/null
+++ b/deploy/docker/nginx/remnawave-minishop.conf
@@ -0,0 +1,102 @@
+# Example external Nginx reverse proxy for Remnawave Minishop.
+#
+# The config assumes this Nginx can resolve Docker service names from the same
+# Compose network. If Nginx runs on the host with the default compose file, use
+# the host-published ports instead:
+#   WEBHOOK_BASE_URL           -> 127.0.0.1:8080
+#   SUBSCRIPTION_MINI_APP_URL  -> 127.0.0.1:8082
+# The frontend nginx already proxies internal Web App API/auth requests to
+# backend:8081, so the external proxy does not need path-based locations.
+
+upstream remnawave_backend_webhooks {
+    server backend:8080;
+    keepalive 16;
+}
+
+upstream remnawave_frontend {
+    server frontend:80;
+    keepalive 16;
+}
+
+# TLS certificates.
+#
+# Option 1: separate Let's Encrypt certificates per domain. Keep port 80 open
+# and point DNS A/AAAA records to the host that terminates TLS. If Certbot can
+# manage that Nginx directly, run:
+#   certbot certonly --nginx -d webhooks.example.com
+#   certbot certonly --nginx -d app.example.com
+# Certbot stores them as:
+#   /etc/letsencrypt/live/webhooks.example.com/fullchain.pem
+#   /etc/letsencrypt/live/webhooks.example.com/privkey.pem
+#   /etc/letsencrypt/live/app.example.com/fullchain.pem
+#   /etc/letsencrypt/live/app.example.com/privkey.pem
+# If this Nginx is a container, mount /etc/letsencrypt into it read-only or copy
+# the issued certificates into the per-domain folders shown below.
+#
+# Option 2: keep copied certificates in per-domain folders mounted into Nginx
+# as shown in the server blocks below:
+#   /etc/nginx/ssl/webhooks.example.com/fullchain.pem
+#   /etc/nginx/ssl/webhooks.example.com/privkey.pem
+#   /etc/nginx/ssl/app.example.com/fullchain.pem
+#   /etc/nginx/ssl/app.example.com/privkey.pem
+#
+# Option 3: use one wildcard certificate for both domains. Wildcards require a
+# DNS-01 challenge, for example with Certbot manual mode or a DNS provider plugin
+# that can renew automatically:
+#   certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"
+# Then both server blocks can point to the same certificate:
+#   /etc/letsencrypt/live/example.com/fullchain.pem
+#   /etc/letsencrypt/live/example.com/privkey.pem
+
+server {
+    listen 80;
+    server_name webhooks.example.com app.example.com;
+
+    return 301 https://$host$request_uri;
+}
+
+# WEBHOOK_BASE_URL.
+# Telegram, payment providers and Remnawave panel webhooks go here.
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name webhooks.example.com;
+
+    ssl_certificate /etc/nginx/ssl/webhooks.example.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/webhooks.example.com/privkey.pem;
+
+    client_max_body_size 20m;
+
+    location / {
+        proxy_pass http://remnawave_backend_webhooks;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# SUBSCRIPTION_MINI_APP_URL.
+# The frontend nginx proxies /api, /auth and theme/logo assets to backend:8081.
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name app.example.com;
+
+    ssl_certificate /etc/nginx/ssl/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/app.example.com/privkey.pem;
+
+    client_max_body_size 20m;
+
+    location / {
+        proxy_pass http://remnawave_frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
diff --git a/docs/deployment.md b/docs/deployment.md
index 72f345d..df2a4ad 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -215,17 +215,15 @@ web.example.com {
 }
 ```
 
-Для внешнего Nginx используйте DNS-имена сервисов внутри Docker network:
+Готовый пример для внешнего Nginx лежит в
+[`deploy/docker/nginx/remnawave-minishop.conf`](../deploy/docker/nginx/remnawave-minishop.conf).
+Он рассчитан на Nginx в той же Docker network, поэтому использует DNS-имена сервисов:
 
 ```nginx
 upstream remnawave_backend_webhooks {
     server backend:8080;
 }
 
-upstream remnawave_backend_webapp {
-    server backend:8081;
-}
-
 upstream remnawave_frontend {
     server frontend:80;
 }