diff --git a/Dockerfile b/Dockerfile
index e49dcd3..03c21c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,8 +29,8 @@ ENV \
     DB_NAME=wordpress \
     DB_USER=wordpress \
     DB_PASSWORD=changeme \
-    WORDPRESS_HOME=http://localhost \
-    WORDPRESS_SITEURL=http://localhost/wp \
+    INGRESS_HOSTNAMES=localhost \
+    INGRESS_SCHEME=http \
     WORDPRESS_SITE_TITLE=WordPress \
     WORDPRESS_ADMIN_USERNAME=admin \
     WORDPRESS_ADMIN_EMAIL=admin@example.com \
@@ -38,7 +38,6 @@ ENV \
     WORDPRESS_LOCALE=en_US \
     WORDPRESS_TABLE_PREFIX=wp_ \
     WORDPRESS_BLOG_PUBLIC=0 \
-    WORDPRESS_ENABLE_HTTPS=false \
     WORDPRESS_AUTH_KEY=changeme \
     WORDPRESS_SECURE_AUTH_KEY=changeme \
     WORDPRESS_LOGGED_IN_KEY=changeme \
diff --git a/README.md b/README.md
index 64fe066..4c730d6 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,8 @@ sitectl set ingress enabled --trusted-ip 203.0.113.10/32 --max-upload-size 2G --
 sitectl converge
 ```
 
+The ingress component writes `INGRESS_HOSTNAMES` as comma-separated hostnames and `INGRESS_SCHEME` as `http` or `https` into the app container. Runtime config is rendered from those values during container startup, so generated sites should not carry separate app URL env vars for the same public route.
+
 Run WordPress-specific helpers documented in the [WordPress plugin docs](https://sitectl.libops.io/plugins/wordpress):
 
 ```bash
diff --git a/conf/traefik/wordpress.yml b/conf/traefik/wordpress.yml
index 5cea960..d66784b 100644
--- a/conf/traefik/wordpress.yml
+++ b/conf/traefik/wordpress.yml
@@ -12,7 +12,7 @@ http:
         permanent: true
   routers:
     wordpress-uploads-web:
-      rule: 'Host(`localhost`) && PathPrefix(`/wp-content/uploads/`)'
+      rule: 'PathPrefix(`/wp-content/uploads/`)'
       entryPoints:
         - web
       priority: 100
@@ -20,7 +20,7 @@ http:
         - wordpress-uploads-redirect
       service: noop@internal
     wordpress-web:
-      rule: 'Host(`localhost`)'
+      rule: 'PathPrefix(`/`)'
       entryPoints:
         - web
       service: wordpress
diff --git a/config/application.php b/config/application.php
index 57780bb..5bb2079 100644
--- a/config/application.php
+++ b/config/application.php
@@ -3,35 +3,7 @@
 $root_dir = dirname(__DIR__);
 $webroot_dir = $root_dir . '/web';
 
-function s6_env($name, $default = '') {
-    $path = '/var/run/s6/container_environment/' . $name;
-    if (is_readable($path)) {
-        return rtrim((string) file_get_contents($path), "\r\n");
-    }
-    return $default;
-}
-
-define('WP_ENV', s6_env('WP_ENV', 'production'));
-define('WP_HOME', s6_env('WORDPRESS_HOME', 'http://localhost'));
-define('WP_SITEURL', s6_env('WORDPRESS_SITEURL', WP_HOME . '/wp'));
-
-define('DB_NAME', s6_env('DB_NAME', 'wordpress'));
-define('DB_USER', s6_env('DB_USER', 'wordpress'));
-define('DB_PASSWORD', s6_env('DB_PASSWORD', 'changeme'));
-define('DB_HOST', s6_env('DB_HOST', 'mariadb') . ':' . s6_env('DB_PORT', '3306'));
-define('DB_CHARSET', 'utf8mb4');
-define('DB_COLLATE', '');
-
-$table_prefix = s6_env('WORDPRESS_TABLE_PREFIX', 'wp_');
-
-define('AUTH_KEY', s6_env('WORDPRESS_AUTH_KEY', 'changeme'));
-define('SECURE_AUTH_KEY', s6_env('WORDPRESS_SECURE_AUTH_KEY', 'changeme'));
-define('LOGGED_IN_KEY', s6_env('WORDPRESS_LOGGED_IN_KEY', 'changeme'));
-define('NONCE_KEY', s6_env('WORDPRESS_NONCE_KEY', 'changeme'));
-define('AUTH_SALT', s6_env('WORDPRESS_AUTH_SALT', 'changeme'));
-define('SECURE_AUTH_SALT', s6_env('WORDPRESS_SECURE_AUTH_SALT', 'changeme'));
-define('LOGGED_IN_SALT', s6_env('WORDPRESS_LOGGED_IN_SALT', 'changeme'));
-define('NONCE_SALT', s6_env('WORDPRESS_NONCE_SALT', 'changeme'));
+require __DIR__ . '/libops-runtime.php';
 
 define('WP_CONTENT_DIR', $webroot_dir . '/app');
 define('WP_CONTENT_URL', WP_HOME . '/app');
diff --git a/docker-compose.yaml b/docker-compose.yaml
index dfce14c..947a621 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -76,9 +76,8 @@ services:
       LIBOPS_SMTP_HOST: "${LIBOPS_SMTP_HOST:-host.docker.internal}"
       LIBOPS_SMTP_PORT: "${LIBOPS_SMTP_PORT:-25}"
       SMTP_FROM: "${SMTP_FROM:-}"
-      WORDPRESS_ENABLE_HTTPS: "false"
-      WORDPRESS_HOME: "http://localhost"
-      WORDPRESS_SITEURL: "http://localhost/wp"
+      INGRESS_HOSTNAMES: "localhost"
+      INGRESS_SCHEME: "http"
     secrets:
       - source: DB_ROOT_PASSWORD
       - source: WORDPRESS_AUTH_KEY