diff --git a/astro.config.mjs b/astro.config.mjs
index 32b7959..646f2cd 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -2,12 +2,18 @@ import { defineConfig } from 'astro/config';
 import node from '@astrojs/node';
 
 export default defineConfig({
-  site: 'https://insanitylab.tielogic.xyz',
+  site: 'https://insanitylab.it',
   output: 'server',
   // Dietro Traefik il TLS termina al proxy: senza allowedDomains Astro ignora
   // X-Forwarded-Proto/Host e il checkOrigin CSRF respinge i POST (403).
+  // Dominio ufficiale insanitylab.it (canonico apex); www e il vecchio
+  // sottodominio tielogic.xyz redirigono all'apex a livello Traefik.
   security: {
-    allowedDomains: [{ hostname: 'insanitylab.tielogic.xyz', protocol: 'https' }],
+    allowedDomains: [
+      { hostname: 'insanitylab.it', protocol: 'https' },
+      { hostname: 'www.insanitylab.it', protocol: 'https' },
+      { hostname: 'insanitylab.tielogic.xyz', protocol: 'https' },
+    ],
   },
   adapter: node({ mode: 'standalone' }),
   // La sezione "Programmi" è stata rinominata "Servizi": redirect permanenti dai vecchi URL.
diff --git a/compose.yaml b/compose.yaml
index 0c9faeb..15f07a9 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -16,11 +16,23 @@ services:
       - /opt/docker/insanitylab/uploads:/app/uploads
     labels:
       - traefik.enable=true
-      - traefik.http.routers.insanitylab.rule=Host(`insanitylab.tielogic.xyz`)
+      # Router principale: apex ufficiale + vecchio sottodominio (servono entrambi durante
+      # la transizione DNS, così non c'è downtime finché insanitylab.it non è propagato).
+      - traefik.http.routers.insanitylab.rule=Host(`insanitylab.it`) || Host(`insanitylab.tielogic.xyz`)
       - traefik.http.routers.insanitylab.tls=true
       - traefik.http.routers.insanitylab.entrypoints=websecure
       - traefik.http.routers.insanitylab.tls.certresolver=mytlschallenge
       - traefik.http.services.insanitylab.loadbalancer.server.port=4321
+      # Router redirect: www.insanitylab.it → 301 apex (canonico senza www)
+      - traefik.http.routers.insanitylab-redir.rule=Host(`www.insanitylab.it`)
+      - traefik.http.routers.insanitylab-redir.tls=true
+      - traefik.http.routers.insanitylab-redir.entrypoints=websecure
+      - traefik.http.routers.insanitylab-redir.tls.certresolver=mytlschallenge
+      - traefik.http.routers.insanitylab-redir.service=insanitylab
+      - traefik.http.routers.insanitylab-redir.middlewares=insanitylab-tocanon
+      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.regex=^https?://[^/]+/(.*)
+      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.replacement=https://insanitylab.it/$${1}
+      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.permanent=true
     networks:
       - traefik