diff --git a/bxl-shp/apps/docker-compose.portfolio.yaml b/bxl-shp/apps/docker-compose.portfolio.yaml
new file mode 100644
index 0000000..ebd42c1
--- /dev/null
+++ b/bxl-shp/apps/docker-compose.portfolio.yaml
@@ -0,0 +1,22 @@
+services: 
+  portfolio:
+    container_name: portfolio
+    image: nginx:latest
+    restart: unless-stopped
+    environment:
+    - TZ=Europe/Paris
+    volumes:
+    - $DATA/portfolio:/usr/share/nginx/html:ro
+    labels:
+    - "traefik.enable=true"
+    - "traefik.http.routers.portfolio.rule=Host(`portfolio.bhasher.com`)"
+    - "traefik.http.services.portfolio.loadbalancer.server.port=80"
+    - "traefik.http.routers.portfolio.tls=true"
+    - "traefik.http.routers.portfolio.tls.certresolver=http"
+    - "traefik.http.routers.portfolio.entrypoints=internalsecure"
+    networks:
+    - external
+
+networks:
+  external:
+    external: true
diff --git a/bxl-shp/system/docker-compose.monitoring.yaml b/bxl-shp/system/docker-compose.monitoring.yaml
index 2caddeb..b40e16d 100644
--- a/bxl-shp/system/docker-compose.monitoring.yaml
+++ b/bxl-shp/system/docker-compose.monitoring.yaml
@@ -57,7 +57,7 @@ services:
     - GF_AUTH_GENERIC_OAUTH_GROUPS_ATTRIBUTE_PATH=groups
     - GF_AUTH_GENERIC_OAUTH_NAME_ATTRIBUTE_PATH=name
     - GF_AUTH_GENERIC_OAUTH_USE_PKCE=false
-    - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || 'Viewer'
+    - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admin') && 'Admin' || 'Viewer'
     - GF_AUTH_GENERIC_OAUTH_GROUPS_PATH=groups
     - GF_AUTH_GENERIC_OAUTH_ALLOWED_GROUPS=admin
     - GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true