diff --git a/ansible/roles/netbird-server/defaults/main.yml b/ansible/roles/netbird-server/defaults/main.yml
index 88263ac2..f3d5f9ff 100644
--- a/ansible/roles/netbird-server/defaults/main.yml
+++ b/ansible/roles/netbird-server/defaults/main.yml
@@ -25,5 +25,7 @@ netbird_datastore_key: "{{ vault_netbird_datastore_key }}"
 netbird_relay_secret: "{{ vault_netbird_relay_secret }}"
 
 # Reverse proxy configuration
-netbird_proxy_domain: "proxy.netbird.renner.uno"
+# IMPORTANT: Proxy domain must NOT be a subdomain of the management domain
+# (netbird.renner.uno) per NetBird docs - causes TLS/routing conflicts
+netbird_proxy_domain: "proxy.renner.uno"
 netbird_proxy_token: "{{ vault_netbird_proxy_token }}"
diff --git a/ansible/roles/netbird-server/templates/proxy.env.j2 b/ansible/roles/netbird-server/templates/proxy.env.j2
index 9ec6d10a..c0b1e53f 100644
--- a/ansible/roles/netbird-server/templates/proxy.env.j2
+++ b/ansible/roles/netbird-server/templates/proxy.env.j2
@@ -6,3 +6,4 @@ NB_PROXY_ADDRESS=:8443
 NB_PROXY_ACME_CERTIFICATES=true
 NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
 NB_PROXY_CERTIFICATE_DIRECTORY=/certs
+NB_PROXY_DEBUG=true