diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index a7a95dd..3f443ec 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,28 +1,31 @@
 {
   "name": "dry-lab-notebook",
-  "dockerComposeFile": [
-    "docker-compose.yml"
-  ],
-  "service": "web",
-  "runServices": [
-    "web",
-    "rabbitmq"
-  ],
+  "build": {
+    "dockerfile": "../Dockerfile",
+    "context": ".."
+  },
+  "workspaceMount": "source=${localWorkspaceFolder},target=/app,type=bind",
   "workspaceFolder": "/app",
-  "shutdownAction": "stopCompose",
   "overrideCommand": true,
+  "runArgs": [
+    "--add-host=host.docker.internal:host-gateway",
+    "--name=dry-lab-notebook-devcontainer"
+  ],
+  "containerEnv": {
+    "DEBUG": "1",
+    "RABBITMQ_URL": "stomp://drylabnotebook:guest@host.docker.internal:61613",
+    "RABBITMQ_DEFAULT_USER": "drylabnotebook",
+    "RABBITMQ_DEFAULT_PASS": "guest",
+    "STOMP_BROWSER_WS_URL": "ws://localhost:15674/ws",
+    "PROJECT_TITLE": "Dry Lab Notebook (dev configuration)"
+  },
   "forwardPorts": [
-    8000,
-    15682
+    8000
   ],
   "portsAttributes": {
     "8000": {
       "label": "Django dev server",
       "onAutoForward": "notify"
-    },
-    "15682": {
-      "label": "RabbitMQ management (dev)",
-      "onAutoForward": "silent"
     }
   },
   "customizations": {
@@ -44,4 +47,4 @@
     "source=${localWorkspaceFolderBasename}-venv,target=/app/.venv,type=volume"
   ],
   "postCreateCommand": "python -m venv .venv && .venv/bin/pip install -r requirements.txt"
-}
\ No newline at end of file
+}
diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
deleted file mode 100644
index 15353ce..0000000
--- a/.devcontainer/docker-compose.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: dry-lab-notebook-dev
-
-services:
-  rabbitmq:
-    image: rabbitmq:3-management
-    ports:
-      - "15670:15670" # web STOMP examples UI
-      - "15682:15672" # main UI (shifted for dev)
-      - "15684:15674" # web STOMP (web sockets, shifted for dev)
-      - "15692:15692" # prometheus
-      - "61614:61613" # stomp (shifted for dev)
-    environment:
-      - RABBITMQ_DEFAULT_USER=${RABBITMQ_USER:-guest}
-      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD:-guest}
-    volumes:
-      - rabbitmq_data:/var/lib/rabbitmq
-      - ../rabbitmq_enabled_plugins:/etc/rabbitmq/enabled_plugins
-      - ../rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
-      - ../rabbitmq-definitions.json:/etc/rabbitmq/definitions.json:ro
-
-  web:
-    build:
-      context: ..
-    container_name: dry-lab-notebook-devcontainer
-    ports:
-      - "8000:8000"
-    volumes:
-      - ..:/app
-    environment:
-      - DEBUG=1
-      - RABBITMQ_URL=stomp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq:61613
-    env_file:
-      - ../.env
-    depends_on:
-      - rabbitmq
-    mem_limit: 4G
-    deploy:
-      resources:
-        limits:
-          cpus: '2.0'      # Max 2 cores
-          memory: 4G      # Max 4GB RAM
-        reservations:
-          cpus: '0.5'     # Guaranteed 0.5 cores
-          memory: 1G      # Guaranteed 1GB RAM
-
-volumes:
-  rabbitmq_data:
\ No newline at end of file
diff --git a/.env.example b/.env.example
index 2900e38..941d5c8 100644
--- a/.env.example
+++ b/.env.example
@@ -7,12 +7,12 @@ CLIENT_SECRET=
 SOCIAL_AUTH_GLOBUS_KEY=
 SOCIAL_AUTH_GLOBUS_SECRET=
 LOCAL_FS_BASE=
-WEBPORT=
-PROJECT_TITLE="Dry Lab Notebook"
+NGINX_PORT=
 SECRET_KEY=
 ALLOWED_HOST=
 STATICFILES_HOST_DIR=
 RABBITMQ_USER=drylabnotebook
+STOMP_PRODUCER_HOST=
 
 INDEX_1_SLUG=
 INDEX_1_NAME=
diff --git a/Dockerfile b/Dockerfile
index 078d00f..0ba2e88 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,6 +15,8 @@ RUN apt-get update && apt-get install -y \
     git \
     make \
     jq \
+    nginx \
+    supervisor \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Python dependencies
@@ -22,4 +24,9 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy project
-COPY . .
\ No newline at end of file
+COPY . .
+
+RUN chmod +x /app/scripts/start-web.sh \
+    && rm -f /etc/nginx/sites-enabled/default /etc/nginx/conf.d/default.conf \
+    && cp /app/nginx/default.conf /etc/nginx/conf.d/default.conf \
+    && cp /app/supervisor/web.conf /etc/supervisor/conf.d/web.conf
\ No newline at end of file
diff --git a/Dockerfile.ssh-tunnel b/Dockerfile.ssh-tunnel
new file mode 100644
index 0000000..2699132
--- /dev/null
+++ b/Dockerfile.ssh-tunnel
@@ -0,0 +1,7 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends autossh openssh-client sshpass tini \
+	&& rm -rf /var/lib/apt/lists/*
+
+CMD ["tail", "-f", "/dev/null"]
diff --git a/Makefile b/Makefile
index d3ab19c..961bab6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,16 +1,17 @@
 COMPOSE = podman compose
 PROJECT_NAME ?= dry-lab-notebook-app
 BASE = -p $(PROJECT_NAME) -f docker-compose.yml
-PYTHON ?= /app/.venv/bin/python
+COMPOSE_CMD = $(COMPOSE) $(BASE)
+PYTHON ?= .venv/bin/python
 
 -include .env
 export
 
 STATICFILES_HOST_DIR ?= $(PWD)/staticfiles
-STOMP_HOST ?= rabbitmq
+STOMP_HOST ?= localhost
 STOMP_PORT ?= 61613
 STOMP_VHOST ?= /
-STOMP_STREAM_QUEUE ?= /queue/test
+STOMP_STREAM_QUEUE ?= /queue/snakemake.events
 STOMP_USE_STREAM ?= 1
 STOMP_STREAM_OFFSET ?= last
 STOMP_PREFETCH_COUNT ?= 100
@@ -19,8 +20,11 @@ STOMP_IDLE_TIMEOUT_SECONDS ?= 2
 STOMP_FOLLOW ?= 0
 STOMP_DEBUG ?=
 WORKFLOW_EVENTS_OUT ?= workflow-events.jsonl
+SSH_TUNNEL_SSH_PORT ?= 22
+SSH_TUNNEL_HOST ?= $(STOMP_PRODUCER_HOST)
+STOMP_TUNNEL_REMOTE_PORT ?= 61613
 
-.PHONY: dev-up dev-down dev-logs dev-shell migrate makemigrations createsuperuser test build staticfiles-dir image-check prod-up prod-down collectstatic live-test-setup live-test-snakemake collect-workflow-events
+.PHONY: dev-up dev-down dev-logs dev-shell migrate makemigrations createsuperuser test build staticfiles-dir image-check prod-up prod-down collectstatic tunnel-helper-up tunnel-refresh tunnel-up tunnel-connect tunnel-status tunnel-stop live-test-setup live-test-snakemake collect-workflow-events
 
 db.sqlite3:
 	@echo "WARNING: db.sqlite3 not found — creating empty file to prevent Docker mount issue."
@@ -43,16 +47,16 @@ dev-shell:
 	@echo "Use the integrated terminal inside the devcontainer."
 
 migrate:
-	$(COMPOSE) $(BASE) exec web python manage.py migrate
+	$(COMPOSE_CMD) exec web python manage.py migrate
 
 makemigrations:
-	$(COMPOSE) $(BASE) exec web python manage.py makemigrations
+	$(COMPOSE_CMD) exec web python manage.py makemigrations
 
 createsuperuser:
-	$(COMPOSE) $(BASE) exec web python manage.py createsuperuser
+	$(COMPOSE_CMD) exec web python manage.py createsuperuser
 
 test:
-	$(COMPOSE) $(BASE) exec web python manage.py test
+	$(COMPOSE_CMD) exec web python manage.py test
 
 build:
 	podman build -t dry-lab-notebook .
@@ -74,10 +78,94 @@ collectstatic: image-check staticfiles-dir
 		python manage.py collectstatic --noinput
 
 prod-up: db.sqlite3
-	$(COMPOSE) $(BASE) up -d --build --force-recreate
+	$(COMPOSE_CMD) up -d --build --force-recreate
 
 prod-down:
-	$(COMPOSE) $(BASE) down
+	$(COMPOSE_CMD) down
+
+# Internal helper: ensure helper services are up and ssh-tunnel accepts exec.
+tunnel-helper-up:
+	@test -n "$(SSH_TUNNEL_HOST)" || { echo "ERROR: SSH_TUNNEL_HOST is not set in .env"; exit 1; }
+	$(COMPOSE_CMD) up -d rabbitmq ssh-tunnel
+	@ready=0; \
+	for i in 1 2 3 4 5 6 7 8 9 10; do \
+		if $(COMPOSE_CMD) exec ssh-tunnel true >/dev/null 2>&1; then \
+			ready=1; \
+			break; \
+		fi; \
+		sleep 1; \
+	done; \
+	if [ "$$ready" -ne 1 ]; then \
+		echo "ERROR: ssh-tunnel helper did not become ready in time."; \
+		$(COMPOSE_CMD) ps rabbitmq ssh-tunnel; \
+		exit 1; \
+	fi
+
+tunnel-refresh:
+	@test -n "$(SSH_TUNNEL_HOST)" || { echo "ERROR: SSH_TUNNEL_HOST is not set in .env"; exit 1; }
+	$(COMPOSE_CMD) up -d --force-recreate rabbitmq ssh-tunnel
+	$(MAKE) tunnel-helper-up
+
+tunnel-up: tunnel-helper-up
+	$(COMPOSE_CMD) ps rabbitmq ssh-tunnel
+
+tunnel-connect: tunnel-helper-up
+	@if $(COMPOSE_CMD) exec ssh-tunnel sh -lc 'pidfile=/tmp/autossh.pid; [ -f "$${pidfile}" ] || exit 1; pid=$$(cat "$${pidfile}" 2>/dev/null) || exit 1; case "$${pid}" in ""|*[!0-9]*) exit 1;; esac; [ -d "/proc/$${pid}" ] || exit 1; state=$$(awk "{print \$$3}" "/proc/$${pid}/stat" 2>/dev/null) || exit 1; [ "$${state}" != "Z" ] || exit 1; tr "\000" " " <"/proc/$${pid}/cmdline" | grep -Eq "(^|/)autossh([[:space:]]|$$)" || exit 1; kill -0 "$${pid}"' >/dev/null 2>&1; then \
+		echo "autossh already running; reusing existing process."; \
+		echo "PID: $$($(COMPOSE_CMD) exec ssh-tunnel sh -lc 'cat /tmp/autossh.pid')"; \
+		exit 0; \
+	fi
+	@if [ -z "$$TMUX" ]; then \
+		echo "WARNING: Not running inside tmux. Tmux is only way (for now) to detach after performing interactive ssh auth."; \
+	fi
+	@read -r -p "SSH username: " SSH_USER; \
+	if [ -z "$$SSH_USER" ]; then echo "ERROR: SSH username is required."; exit 1; fi; \
+	read -r -p "SSH host [$(SSH_TUNNEL_HOST)]: " SSH_HOST; \
+	SSH_HOST=$${SSH_HOST:-$(SSH_TUNNEL_HOST)}; \
+	if [ -z "$$SSH_HOST" ]; then echo "ERROR: SSH host is required."; exit 1; fi; \
+	read -r -p "SSH port [$(SSH_TUNNEL_SSH_PORT)]: " SSH_PORT; \
+	SSH_PORT=$${SSH_PORT:-$(SSH_TUNNEL_SSH_PORT)}; \
+	echo "Starting autossh. SSH may prompt for credentials once."; \
+	$(COMPOSE_CMD) exec \
+		-e AUTOSSH_PIDFILE="/tmp/autossh.pid" \
+		-e AUTOSSH_LOGFILE="/tmp/autossh.log" \
+		-e SSH_TUNNEL_RUNTIME_USER="$$SSH_USER" \
+		-e SSH_TUNNEL_RUNTIME_HOST="$$SSH_HOST" \
+		-e SSH_TUNNEL_RUNTIME_PORT="$$SSH_PORT" \
+		ssh-tunnel sh -lc 'rm -f /tmp/autossh.pid /tmp/autossh.log; autossh -M 0 -N -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ServerAliveInterval=10 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R 0.0.0.0:$(STOMP_TUNNEL_REMOTE_PORT):rabbitmq:61613 -p "$${SSH_TUNNEL_RUNTIME_PORT}" "$${SSH_TUNNEL_RUNTIME_USER}@$${SSH_TUNNEL_RUNTIME_HOST}"'
+
+tunnel-status: tunnel-helper-up
+	@if $(COMPOSE_CMD) exec ssh-tunnel sh -lc 'pidfile=/tmp/autossh.pid; [ -f "$${pidfile}" ] || exit 1; pid=$$(cat "$${pidfile}" 2>/dev/null) || exit 1; case "$${pid}" in ""|*[!0-9]*) exit 1;; esac; [ -d "/proc/$${pid}" ] || exit 1; state=$$(awk "{print \$$3}" "/proc/$${pid}/stat" 2>/dev/null) || exit 1; [ "$${state}" != "Z" ] || exit 1; tr "\000" " " <"/proc/$${pid}/cmdline" | grep -Eq "(^|/)autossh([[:space:]]|$$)" || exit 1; kill -0 "$${pid}"' >/dev/null 2>&1; then \
+		echo "autossh running. PID: $$($(COMPOSE_CMD) exec ssh-tunnel sh -lc 'cat /tmp/autossh.pid')"; \
+	else \
+		echo "autossh is not running."; \
+	fi
+	@echo "Recent autossh log:"; \
+	if $(COMPOSE_CMD) exec ssh-tunnel sh -lc "tail -n 40 /tmp/autossh.log" >/dev/null 2>&1; then \
+		$(COMPOSE_CMD) exec ssh-tunnel sh -lc "tail -n 40 /tmp/autossh.log"; \
+	else \
+		echo "ssh-tunnel helper container not running yet or no log file present."; \
+	fi
+
+tunnel-stop: tunnel-helper-up
+	@if $(COMPOSE_CMD) exec ssh-tunnel sh -lc 'pidfile=/tmp/autossh.pid; [ -f "$${pidfile}" ] || exit 1; pid=$$(cat "$${pidfile}" 2>/dev/null) || exit 1; case "$${pid}" in ""|*[!0-9]*) exit 1;; esac; [ -d "/proc/$${pid}" ] || exit 1; state=$$(awk "{print \$$3}" "/proc/$${pid}/stat" 2>/dev/null) || exit 1; [ "$${state}" != "Z" ] || exit 1; tr "\000" " " <"/proc/$${pid}/cmdline" | grep -Eq "(^|/)autossh([[:space:]]|$$)" || exit 1; kill -0 "$${pid}"' >/dev/null 2>&1; then \
+		$(COMPOSE_CMD) exec ssh-tunnel sh -lc "kill $$(cat /tmp/autossh.pid) && rm -f /tmp/autossh.pid"; \
+		echo "autossh stopped."; \
+	else \
+		echo "autossh is not running."; \
+	fi
+
+check:
+	$(PYTHON) manage.py check
+
+deploy:
+	@test -n "$(DEPLOY_PATH)" || { echo "ERROR: DEPLOY_PATH is not set in .env"; exit 1; }
+	@test -n "$(WEB_IMAGE)" || { echo "ERROR: WEB_IMAGE is not set in .env"; exit 1; }
+	cd $(DEPLOY_PATH) && \
+	git pull && \
+	sed -i 's|^WEB_IMAGE=.*|WEB_IMAGE=$(WEB_IMAGE)|' .env && \
+	podman compose pull web && \
+	podman compose up -d; \
 
 live-test-setup:
 	$(PYTHON) -m pip install -r requirements-live-test.txt
@@ -85,7 +173,7 @@ live-test-setup:
 live-test-snakemake: live-test-setup
 	$(PYTHON) scripts/live_snakemake_stomp_test.py
 
-collect-workflow-events: live-test-setup
+collect-workflow-events:
 	$(PYTHON) scripts/collect_workflow_events.py \
 		--host "$(STOMP_HOST)" \
 		--port "$(STOMP_PORT)" \
diff --git a/README.md b/README.md
index 420f06e..935f599 100644
--- a/README.md
+++ b/README.md
@@ -3,29 +3,6 @@ Place to find records and results of dry lab activities.
 
 ## Deployment
 
-### Container
-
-A `Dockerfile` has been prepared for serving the `django` app.
-Using `docker compose`, two separate containers can be deployed, one for development and one for production.
-The main difference is that the dev server is `manage.py runserver` and the prod server is `gunicorn` and `nginx`.
-At the time of writing, `nginx` is not included in the container.
-See instructions below on how to configure your system for `nginx` integration.
-
-To make sure the prod container persists, you may need to prevent your host system will not kill your processes when your session ends.
-One way to do this is to enable "lingering" for your user with `loginctl enable-linger $USER`.
-Then, when you start a container tied to your user, it will not be killed as soon as you log out.
-
-### Static files for `nginx`
-
-`gunicorn` doesn't serve static files.
-Instead, delegate the task to `nginx` in two steps:
-1. Deposit the project's static files using `python manage.py collectstatic`. 
-The location must be accessible by `nginx`, e.g. under `/var/www/dry-lab-notebook/staticfiles/`.
-The `Makefile` has a target for this `collectstatic`.
-This target depends on env var `STATICFILE_HOST_DIR` to put the static files in the right place.
-If you update any static files, remember to re-collect.
-2. Point `nginx` to these files by putting `location /static/ { alias /var/www/dry-lab-notebook/staticfiles/; }` in the appropriate `server` block (remember, order matters!).
-
 ## Configuring Globus
 
 One of the attractive features of Dry Lab Notebook is that is provides unauthenicated access to certain Globus resources.
@@ -51,3 +28,11 @@ As opposed to authorizing a client to access a specific collection, access to da
 Each "entry" (a sub-record of a given "subject") in a Search index is associated with a principal (or list of principals) which defines who gets to access that data.
 Therefore, for your client to be able to see any of your Search data, you must assign each record with a principal URN which includes your client.
 This could be the principal URN of your client itself, however it is more practical to create a group which has access and use the group's URN.
+
+## Troubleshooting
+
+### Container persistence
+
+To make sure the prod container persists, you may need to prevent your host system will not kill your processes when your session ends.
+One way to do this is to enable "lingering" for your user with `loginctl enable-linger $USER`.
+Then, when you start a container tied to your user, it will not be killed as soon as you log out.
\ No newline at end of file
diff --git a/config/settings.py b/config/settings.py
index 6e54ba0..553c2a5 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -167,6 +167,7 @@ def _load_dotenv(dotenv_path: Path) -> None:
 SOCIAL_AUTH_GLOBUS_SECRET = os.environ.get("SOCIAL_AUTH_GLOBUS_SECRET")
 
 STOMP_STREAM_QUEUE = os.environ.get("STOMP_STREAM_QUEUE", "/queue/snakemake.events")
+STOMP_BROWSER_WS_URL = os.environ.get("STOMP_BROWSER_WS_URL")
 RABBITMQ_DEFAULT_USER = os.environ.get("RABBITMQ_DEFAULT_USER", "guest")
 RABBITMQ_DEFAULT_PASS = os.environ.get("RABBITMQ_DEFAULT_PASS", "guest")
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 118dff9..96eeb01 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,6 +19,8 @@ services:
   web:
     image: ${WEB_IMAGE:-dry-lab-notebook:latest}
     build: .
+    ports:
+      - "${NGINX_PORT:-8080}:80"
     volumes:
       - ./db.sqlite3:/app/db.sqlite3
       - staticfiles_data:/app/staticfiles
@@ -31,17 +33,21 @@ services:
       - .env
     depends_on:
       - rabbitmq
-    command: sh -c "python manage.py collectstatic --noinput && python manage.py migrate --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8000"
+    command: ["/app/scripts/start-web.sh"]
 
-  nginx:
-    image: nginx:1.27-alpine
-    ports:
-      - "${WEBPORT}:80"
-    volumes:
-      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-      - staticfiles_data:/staticfiles:ro
+  ssh-tunnel:
+    build:
+      context: .
+      dockerfile: Dockerfile.ssh-tunnel
+    entrypoint: ["/usr/bin/tini", "--", "tail"]
+    command: ["-f", "/dev/null"]
+    environment:
+      - SSH_TUNNEL_HOST=${STOMP_PRODUCER_HOST}
+      - SSH_TUNNEL_SSH_PORT=${SSH_TUNNEL_SSH_PORT:-22}
+      - STOMP_TUNNEL_REMOTE_PORT=${STOMP_TUNNEL_REMOTE_PORT:-61613}
     depends_on:
-      - web
+      - rabbitmq
+    restart: unless-stopped
 
 volumes:
   rabbitmq_data:
diff --git a/dry_lab_notebook/templates/stomp-logs.html b/dry_lab_notebook/templates/stomp-logs.html
index f2db6a0..01d9aaf 100644
--- a/dry_lab_notebook/templates/stomp-logs.html
+++ b/dry_lab_notebook/templates/stomp-logs.html
@@ -3,6 +3,19 @@
 
 {%block headextras%}
   <link rel="stylesheet" type="text/css" href="{% static 'css/search.css' %}" />
+  <style>
+    .run-selected {
+      border-left: 4px solid #007bff !important;
+      background-color: #f0f6ff !important;
+      color: inherit !important;
+    }
+    .run-selected .text-muted {
+      color: #555 !important;
+    }
+    .run-selected .badge {
+      color: #fff;
+    }
+  </style>
 {% endblock %}
 
 {% block breadcrumbs %}{{block.super}}{% endblock %}
@@ -28,7 +41,6 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
               <span>Recent Workflows</span>
               <div class="d-flex align-items-center">
                 <span id="runCountBadge" class="badge badge-secondary mr-2">0</span>
-                <button id="clearBtn" class="btn btn-outline-secondary btn-sm" type="button">Clear</button>
               </div>
             </div>
             <div class="card-body p-0">
@@ -40,9 +52,9 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
                   <option value="21600">Last 6 hours</option>
                   <option value="86400">Last 24 hours</option>
                 </select>
-                <label for="workflowFilter" class="mb-1">Workflow Filter</label>
-                <select id="workflowFilter" class="form-control form-control-sm">
-                  <option value="">All Workflows</option>
+                <label for="userFilter" class="mb-1">User Filter</label>
+                <select id="userFilter" class="form-control form-control-sm">
+                  <option value="">All Users</option>
                 </select>
               </div>
               <div id="runList" class="list-group list-group-flush" style="max-height: 45vh; overflow: auto;"></div>
@@ -100,6 +112,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
 <script>
   (() => {
     const STREAM_DESTINATION = '{{ STOMP_STREAM_QUEUE|default:"/queue/snakemake.events" }}';
+    const CONFIGURED_BROKER_URL = '{{ STOMP_BROWSER_WS_URL|default:""|escapejs }}';
     const DEFAULT_LOG_START = 'next';
     const MAX_LOG_EVENTS = 2000;
     const BROKER_LOGIN = '{{ RABBITMQ_DEFAULT_USER|default:"guest" }}';
@@ -109,15 +122,15 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     const HEARTBEAT_REFRESH_MS = 1000;
 
     function resolveBrokerUrl() {
-      const hostname = window.location.hostname;
-      const isLocalDevHost = hostname === 'localhost' || hostname === '127.0.0.1';
+      if (CONFIGURED_BROKER_URL) {
+        return CONFIGURED_BROKER_URL;
+      }
+
+      const hostname = window.location.hostname || 'localhost';
       const scheme = window.location.protocol === 'https:' ? 'wss' : 'ws';
-      const port = isLocalDevHost ? 15684 : 15674;
-      const targetHost = isLocalDevHost ? 'localhost' : hostname;
-      return `${scheme}://${targetHost}:${port}/ws`;
+      return `${scheme}://${hostname}:15674/ws`;
     }
 
-    const clearBtn = document.getElementById('clearBtn');
     const showFromBeginningBtn = document.getElementById('showFromBeginningBtn');
     const connectionError = document.getElementById('connectionError');
     const connectionErrorMsg = document.getElementById('connectionErrorMsg');
@@ -125,7 +138,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     const brokerQueue = document.getElementById('brokerQueue');
     const offsetHelp = document.getElementById('offsetHelp');
     const liveInterval = document.getElementById('liveInterval');
-    const workflowFilter = document.getElementById('workflowFilter');
+    const userFilter = document.getElementById('userFilter');
     const levelFilter = document.getElementById('levelFilter');
     const ruleFilter = document.getElementById('ruleFilter');
     const messageFilter = document.getElementById('messageFilter');
@@ -141,6 +154,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     let appliedLogOffset = 'next';
 
     const liveRuns = new Map();
+    const pendingHeartbeats = new Map(); // keyed by workingDirectory, for heartbeats without a workflow_id
     const selectedRunLogs = [];
 
     const streamCounts = {
@@ -219,6 +233,18 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
       return segments.length ? segments[segments.length - 1] : '';
     }
 
+    function dirnameJsPath(pathValue) {
+      const normalized = safeValue(pathValue).replace(/\\/g, '/').replace(/\/+$/, '');
+      if (!normalized || !normalized.includes('/')) {
+        return '';
+      }
+      return normalized.slice(0, normalized.lastIndexOf('/')) || '/';
+    }
+
+    function normalizeDirectoryPath(pathValue) {
+      return safeValue(pathValue).replace(/\\/g, '/').replace(/\/+$/, '');
+    }
+
     function getLiveIntervalSeconds() {
       const parsed = Number.parseInt(liveInterval.value, 10);
       return Number.isFinite(parsed) && parsed > 0 ? parsed : 3600;
@@ -230,16 +256,33 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
 
     function runIsInsideLiveWindow(run) {
       const cutoff = getLiveWindowCutoffMs();
-      const candidateTimes = [
-        run.lastHeartbeatAt,
+      const primaryTimes = [
         run.lastSeenAt,
         run.terminalAt,
+        run.workflowStartTimestamp,
       ];
 
-      return candidateTimes.some((ts) => {
+      const hasPrimaryInWindow = primaryTimes.some((ts) => {
         const t = new Date(ts || 0).getTime();
         return Number.isFinite(t) && t >= cutoff;
       });
+
+      if (hasPrimaryInWindow) {
+        return true;
+      }
+
+      // Only use heartbeat time for workflows that have no lifecycle/start signal yet.
+      const hasPrimarySignal = primaryTimes.some((ts) => {
+        const t = new Date(ts || 0).getTime();
+        return Number.isFinite(t) && t > 0;
+      });
+
+      if (hasPrimarySignal) {
+        return false;
+      }
+
+      const heartbeatMs = new Date(run.lastHeartbeatAt || 0).getTime();
+      return Number.isFinite(heartbeatMs) && heartbeatMs >= cutoff;
     }
 
     function normalizeEventType(value) {
@@ -257,7 +300,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     }
 
     function isHeartbeatEvent(event) {
-      return event.eventType === 'CONSUMER_HEARTBEAT' || event.heartbeat === true;
+      return event.isHeartbeat === true;
     }
 
     function parseStructuredEvent(message) {
@@ -269,80 +312,66 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         return null;
       }
 
-      const workflowId = safeValue(
-        parsed.workflow_id
-          || parsed.workflowId
-          || parsed?.source?.workflow_id
-          || parsed?.source?.workflowId
-          || parsed?.event_details?.workflow_id
-          || message.headers['x-workflow-id']
-      );
+      const rawEvent = parsed?.event;
+      const eventDetails = (rawEvent && typeof rawEvent === 'object' && !Array.isArray(rawEvent))
+        ? rawEvent
+        : {};
+      const isHeartbeatMessage = rawEvent === null;
+
+      const workflowId = safeValue(parsed.workflow_id);
+
+      const eventType = isHeartbeatMessage
+        ? 'CONSUMER_HEARTBEAT'
+        : normalizeEventType(
+          eventDetails.event
+            || eventDetails.type
+            || 'LOG'
+        );
 
       if (!workflowId) {
         return null;
       }
 
       const fallbackWorkflow = safeValue(
-        parsed.workflow_name
-          || parsed.workflow
-          || parsed.pipeline
-          || parsed?.event_details?.workflow_name
-          || parsed?.source?.workflow_name
-          || workflowId
-          || parsed?.source?.workflow_id
-          || message.headers['x-workflow'],
+        eventDetails.workflow_name
+          || eventDetails.workflow
+          || eventDetails.pipeline
+          || workflowId,
         workflowId
       );
       const workingDirectory = safeValue(
-        parsed.working_directory
-          || parsed.workingDirectory
-          || parsed?.event_details?.working_directory
-          || parsed?.event_details?.workingDirectory
-          || parsed?.source?.working_directory
-          || parsed?.source?.workingDirectory
+        parsed.workflow_directory
+          || parsed.working_directory
       );
+      const normalizedWorkingDirectory = normalizeDirectoryPath(workingDirectory);
       const workflow = basenamePath(workingDirectory) || fallbackWorkflow;
-      const producer = safeValue(
-        parsed.producer
-          || parsed?.event_details?.producer
-          || parsed?.source?.producer
-          || message.headers['x-producer']
-      );
-      const eventType = normalizeEventType(parsed.event_type || parsed.type || parsed.event || 'LOG');
-      const level = safeValue(
-        parsed.level
-          || parsed.severity
-          || parsed?.payload?.level
-          || message.headers['x-level'],
-        'INFO'
-      ).toUpperCase();
+      const user = safeValue(parsed.user);
+      const level = safeValue(parsed.level || parsed.severity, 'INFO').toUpperCase();
       const heartbeatIntervalSeconds = parseNumeric(parsed.heartbeat_interval_seconds);
       const rawWorkflowStartTimestamp = (
-        parsed.workflow_start_timestamp
-          || parsed.workflowStartTimestamp
-          || parsed?.event_details?.workflow_start_timestamp
-          || parsed?.event_details?.workflowStartTimestamp
+        parsed.workflow_initiated
+          || parsed.workflow_start_timestamp
       );
       const workflowStartTimestamp = rawWorkflowStartTimestamp
         ? toIsoTimestamp(rawWorkflowStartTimestamp)
-        : '';
+        : (eventType === 'WORKFLOW_STARTED' ? toIsoTimestamp(parsed.timestamp || parsed.ts) : '');
 
       return {
         workflowId,
         workflow,
-        workingDirectory,
-        producer,
+        workingDirectory: normalizedWorkingDirectory,
+        user,
         level,
         eventType,
-        rule: safeValue(parsed.rule_name || parsed.rule || parsed.job_rule || parsed?.payload?.name),
-        jobId: safeValue(parsed.job_id || parsed.job || parsed.task_id || parsed?.payload?.jobid),
-        timestamp: toIsoTimestamp(parsed.event_ts || parsed.event_time || parsed.timestamp || parsed.ts),
-        message: safeValue(parsed.message || parsed.msg || parsed.log || parsed?.payload?.msg || parsed.body || ''),
-        summary: safeValue(parsed.summary || parsed?.event_details?.summary || ''),
+        rule: safeValue(eventDetails.rule_name || eventDetails.rule || eventDetails.job_rule || eventDetails.name),
+        jobId: safeValue(eventDetails.job_id || eventDetails.job || eventDetails.task_id || eventDetails.jobid),
+        timestamp: toIsoTimestamp(parsed.timestamp || parsed.ts),
+        message: safeValue(eventDetails.message || eventDetails.msg || eventDetails.log || eventDetails.body || ''),
+        summary: safeValue(eventDetails.summary || ''),
         destination: safeValue(message.headers.destination, ''),
-        sourceType: safeValue(parsed.source_type || parsed.source_type || parsed?.source?.agent_id || parsed.source || 'workflow'),
+        sourceType: safeValue(parsed.source_type || 'workflow'),
         streamOffset: safeValue(message.headers['x-stream-offset'] || message.headers['x-stream-offset'.toLowerCase()], ''),
-        heartbeat: Boolean(parsed.heartbeat) || eventType === 'CONSUMER_HEARTBEAT',
+        isHeartbeat: isHeartbeatMessage,
         workflowStartTimestamp,
         heartbeatIntervalSeconds,
         terminalStatus: mapEventTypeToTerminalStatus(eventType),
@@ -405,15 +434,17 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     }
 
     function getRunLastEventTimestamp(run) {
-      const candidateTimes = [run.lastSeenAt, run.lastHeartbeatAt, run.terminalAt]
+      const primaryTimes = [run.lastSeenAt, run.terminalAt]
         .map((ts) => new Date(ts || 0).getTime())
         .filter((ts) => Number.isFinite(ts) && ts > 0);
 
-      if (!candidateTimes.length) {
-        return 0;
+      if (primaryTimes.length) {
+        return Math.max(...primaryTimes);
       }
 
-      return Math.max(...candidateTimes);
+      // Fallback for runs that have only heartbeat traffic so far.
+      const heartbeatMs = new Date(run.lastHeartbeatAt || 0).getTime();
+      return Number.isFinite(heartbeatMs) && heartbeatMs > 0 ? heartbeatMs : 0;
     }
 
     function computeRunStatus(run) {
@@ -448,21 +479,25 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
       return 'badge badge-light';
     }
 
-    function updateWorkflowFilterOptions() {
-      const workflows = Array.from(new Set(Array.from(liveRuns.values()).map((run) => run.workflow))).sort();
-      const currentValue = workflowFilter.value;
+    function updateUserFilterOptions() {
+      const users = Array.from(new Set(
+        Array.from(liveRuns.values())
+          .map((run) => safeValue(run.user))
+          .filter(Boolean)
+      )).sort();
+      const currentValue = userFilter.value;
 
-      workflowFilter.innerHTML = '<option value="">All Workflows</option>';
+      userFilter.innerHTML = '<option value="">All Users</option>';
 
-      workflows.forEach((workflow) => {
+      users.forEach((user) => {
         const option = document.createElement('option');
-        option.value = workflow;
-        option.textContent = workflow;
-        workflowFilter.appendChild(option);
+        option.value = user;
+        option.textContent = user;
+        userFilter.appendChild(option);
       });
 
-      if (workflows.includes(currentValue)) {
-        workflowFilter.value = currentValue;
+      if (users.includes(currentValue)) {
+        userFilter.value = currentValue;
       }
     }
 
@@ -513,7 +548,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
 
       const filtered = selectedRunLogs.filter(passesFilters);
       if (!filtered.length) {
-        logOutput.textContent = `Waiting for non-heartbeat events for workflow ${selectedWorkflowId} from ${appliedLogOffset}.`;
+        logOutput.textContent = `Waiting for next event.`;
         return;
       }
 
@@ -545,10 +580,10 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     }
 
     function renderRunList() {
-      const workflowNeedle = workflowFilter.value;
+      const userNeedle = userFilter.value;
       const runs = Array.from(liveRuns.values())
         .filter((run) => runIsInsideLiveWindow(run))
-        .filter((run) => !workflowNeedle || run.workflow === workflowNeedle)
+        .filter((run) => !userNeedle || safeValue(run.user) === userNeedle)
         .sort((a, b) => getRunSortTimestamp(b) - getRunSortTimestamp(a));
 
       runCountBadge.textContent = String(runs.length);
@@ -566,7 +601,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         const statusValue = computeRunStatus(run);
         const button = document.createElement('button');
         button.type = 'button';
-        button.className = `list-group-item list-group-item-action${selectedWorkflowId === run.workflowId ? ' active' : ''}`;
+        button.className = `list-group-item list-group-item-action${selectedWorkflowId === run.workflowId ? ' run-selected' : ''}`;
 
         const headerRow = document.createElement('div');
         headerRow.className = 'd-flex w-100 justify-content-between align-items-center';
@@ -594,7 +629,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         button.appendChild(headerRow);
         button.appendChild(identifier);
         button.appendChild(createRunMetaLine(`started ${startedAge} ago | last event ${lastEventAge} ago`));
-        button.appendChild(createRunMetaLine(`producer=${safeValue(run.producer, '--')}`));
+        button.appendChild(createRunMetaLine(`user=${safeValue(run.user, '--')}`));
 
         if (run.terminalStatus) {
           button.appendChild(createRunMetaLine(`terminal=${run.terminalStatus} @ ${safeValue(run.terminalAt, '--')}`));
@@ -615,10 +650,11 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
     function upsertRunHeartbeat(event) {
       const current = liveRuns.get(event.workflowId) || {
         workflowId: event.workflowId,
+        workingDirectory: event.workingDirectory,
         workflow: event.workflow,
-        producer: event.producer,
-        workflowStartTimestamp: event.workflowStartTimestamp,
-        lastSeenAt: event.timestamp,
+        user: event.user,
+        workflowStartTimestamp: event.workflowStartTimestamp || '',
+        lastSeenAt: '',
         lastHeartbeatAt: event.timestamp,
         heartbeatIntervalSeconds: event.heartbeatIntervalSeconds,
         lastStreamOffset: event.streamOffset,
@@ -627,10 +663,14 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         terminalAt: '',
       };
 
+      current.workingDirectory = event.workingDirectory || current.workingDirectory;
       current.workflow = (event.workingDirectory ? event.workflow : null) || current.workflow;
-      current.producer = event.producer || current.producer;
-      current.workflowStartTimestamp = event.workflowStartTimestamp || current.workflowStartTimestamp;
-      current.lastSeenAt = event.timestamp;
+      current.user = event.user || current.user;
+      // Keep the first known start timestamp for a run; heartbeats should enrich,
+      // but not rewrite start time once established.
+      if (!current.workflowStartTimestamp && event.workflowStartTimestamp) {
+        current.workflowStartTimestamp = event.workflowStartTimestamp;
+      }
       current.lastHeartbeatAt = event.timestamp;
       current.heartbeatIntervalSeconds = event.heartbeatIntervalSeconds || current.heartbeatIntervalSeconds;
       current.lastStreamOffset = event.streamOffset || current.lastStreamOffset;
@@ -639,12 +679,47 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
       liveRuns.set(event.workflowId, current);
     }
 
+    function applyOrphanHeartbeat(event) {
+      if (!event.workingDirectory) {
+        return;
+      }
+
+      const orphanKey = normalizeDirectoryPath(event.workingDirectory);
+      if (!orphanKey) {
+        return;
+      }
+
+      let applied = false;
+      for (const run of liveRuns.values()) {
+        if (normalizeDirectoryPath(run.workingDirectory) === orphanKey) {
+          run.user = event.user || run.user;
+          if (!run.workflowStartTimestamp && event.workflowStartTimestamp) {
+            run.workflowStartTimestamp = event.workflowStartTimestamp;
+          }
+          run.lastHeartbeatAt = event.timestamp;
+          run.heartbeatIntervalSeconds = event.heartbeatIntervalSeconds || run.heartbeatIntervalSeconds;
+          applied = true;
+        }
+      }
+
+      if (!applied) {
+        // Cache for later — applied when a run with this working directory is created
+        pendingHeartbeats.set(orphanKey, {
+          ...event,
+          workingDirectory: orphanKey,
+        });
+      }
+    }
+
     function applyLifecycleEvent(event) {
       const current = liveRuns.get(event.workflowId) || {
         workflowId: event.workflowId,
+        workingDirectory: event.workingDirectory,
         workflow: event.workflow,
-        producer: event.producer,
-        workflowStartTimestamp: event.workflowStartTimestamp,
+        user: event.user,
+        // If explicit workflow start metadata is missing, anchor start time to
+        // the first lifecycle event observed for this run.
+        workflowStartTimestamp: event.workflowStartTimestamp || event.timestamp,
         lastSeenAt: event.timestamp,
         lastHeartbeatAt: '',
         heartbeatIntervalSeconds: null,
@@ -654,9 +729,12 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         terminalAt: '',
       };
 
+      current.workingDirectory = event.workingDirectory || current.workingDirectory;
       current.workflow = (event.workingDirectory ? event.workflow : null) || current.workflow;
-      current.producer = event.producer || current.producer;
-      current.workflowStartTimestamp = event.workflowStartTimestamp || current.workflowStartTimestamp;
+      current.user = event.user || current.user;
+      if (!current.workflowStartTimestamp && event.workflowStartTimestamp) {
+        current.workflowStartTimestamp = event.workflowStartTimestamp;
+      }
       current.lastSeenAt = event.timestamp;
       current.lastStreamOffset = event.streamOffset || current.lastStreamOffset;
       current.lastDestination = event.destination || current.lastDestination;
@@ -665,6 +743,24 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
         current.terminalAt = event.timestamp;
       }
 
+      // Apply any cached orphan heartbeat that matches this run's working directory.
+      // Allow backfill when user/start/interval are missing even if heartbeat already exists.
+      const currentWorkingDirectoryKey = normalizeDirectoryPath(current.workingDirectory);
+      const needsHeartbeatBackfill = !current.lastHeartbeatAt
+        || !current.user
+        || !current.workflowStartTimestamp
+        || !current.heartbeatIntervalSeconds;
+      if (currentWorkingDirectoryKey && needsHeartbeatBackfill) {
+        const pending = pendingHeartbeats.get(currentWorkingDirectoryKey);
+        if (pending) {
+          current.user = pending.user || current.user;
+          current.workflowStartTimestamp = pending.workflowStartTimestamp || current.workflowStartTimestamp;
+          current.heartbeatIntervalSeconds = pending.heartbeatIntervalSeconds || current.heartbeatIntervalSeconds;
+          current.lastHeartbeatAt = pending.timestamp;
+          pendingHeartbeats.delete(currentWorkingDirectoryKey);
+        }
+      }
+
       liveRuns.set(event.workflowId, current);
     }
 
@@ -724,13 +820,17 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
 
         if (isHeartbeatEvent(event)) {
           streamCounts.live += 1;
-          upsertRunHeartbeat(event);
-          updateWorkflowFilterOptions();
-          renderRunList();
+          if (event.workflowId) {
+            upsertRunHeartbeat(event);
+          } else {
+            applyOrphanHeartbeat(event);
+          }
         } else {
           applyLifecycleEvent(event);
-          renderRunList();
         }
+
+        updateUserFilterOptions();
+        renderRunList();
       } else {
         streamCounts.raw += 1;
       }
@@ -815,6 +915,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
 
     function resetState() {
       liveRuns.clear();
+      pendingHeartbeats.clear();
       clearSelectedLogs();
       selectedWorkflowId = null;
       appliedLogOffset = DEFAULT_LOG_START;
@@ -824,7 +925,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
       streamCounts.live = 0;
       streamCounts.logs = 0;
       updateSelectedRunLabel();
-      updateWorkflowFilterOptions();
+      updateUserFilterOptions();
       updateOffsetHelp();
       renderRunList();
       renderLogs();
@@ -878,17 +979,7 @@ <h2 class="mb-0 mr-3">Snakemake logs</h2>
       client.activate();
     }
 
-    clearBtn.addEventListener('click', () => {
-      unsubscribeAll(liveSubscriptions);
-      unsubscribeAll(logSubscriptions);
-      resetState();
-
-      if (client && client.connected) {
-        subscribeLiveRuns();
-      }
-    });
-
-    workflowFilter.addEventListener('change', renderRunList);
+    userFilter.addEventListener('change', renderRunList);
     liveInterval.addEventListener('change', () => {
       renderRunList();
       if (client && client.connected) {
diff --git a/dry_lab_notebook/views.py b/dry_lab_notebook/views.py
index 3fb53d4..5857527 100644
--- a/dry_lab_notebook/views.py
+++ b/dry_lab_notebook/views.py
@@ -368,6 +368,7 @@ def __init__(self, template=None):
     def get_context_data(self):
         return {
             "STOMP_STREAM_QUEUE": settings.STOMP_STREAM_QUEUE,
+            "STOMP_BROWSER_WS_URL": settings.STOMP_BROWSER_WS_URL,
             "RABBITMQ_DEFAULT_USER": settings.RABBITMQ_DEFAULT_USER,
             "RABBITMQ_DEFAULT_PASS": settings.RABBITMQ_DEFAULT_PASS,
         }
diff --git a/nginx/default.conf b/nginx/default.conf
index fc2f1d6..44d4500 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -3,16 +3,18 @@ server {
     server_name _;
 
     client_max_body_size 100m;
+    access_log /dev/stdout;
+    error_log /dev/stderr warn;
 
     location /static/ {
-        alias /staticfiles/;
+        alias /app/staticfiles/;
         access_log off;
         expires 7d;
         add_header Cache-Control "public, max-age=604800";
     }
 
     location / {
-        proxy_pass http://web:8000;
+        proxy_pass http://127.0.0.1:8000;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/rabbitmq-definitions.json b/rabbitmq-definitions.json
index c593dc9..16fc2a0 100644
--- a/rabbitmq-definitions.json
+++ b/rabbitmq-definitions.json
@@ -39,9 +39,20 @@
       "durable": true,
       "auto_delete": false,
       "arguments": {
-        "x-queue-type": "stream",
-        "x-max-age": "7D"
+        "x-queue-type": "stream"
       }
     }
+  ],
+  "policies": [
+    {
+      "name": "retention",
+      "pattern": "snakemake.events",
+      "vhost": "/",
+      "definition": {
+        "max-age": "7D"
+      },
+      "priority": 0,
+      "apply-to": "streams"
+    }
   ]
 }
diff --git a/scripts/collect_workflow_events.py b/scripts/collect_workflow_events.py
index f39e2e8..c6f6713 100644
--- a/scripts/collect_workflow_events.py
+++ b/scripts/collect_workflow_events.py
@@ -191,7 +191,13 @@ def on_message(self, frame: stomp.utils.Frame) -> None:
         if not self.quiet:
             event_name = None
             if isinstance(parsed_body, dict):
-                event_name = parsed_body.get("event_type")
+                raw_event = parsed_body.get("event")
+                if raw_event is None:
+                    event_name = "CONSUMER_HEARTBEAT"
+                elif isinstance(raw_event, dict):
+                    event_name = raw_event.get("event") or raw_event.get("type")
+                elif isinstance(raw_event, str):
+                    event_name = raw_event
             summary = f"event={event_name}" if event_name else "event=unknown"
             print(f"[{current_count}] Captured message ({summary}).")
 
diff --git a/scripts/start-web.sh b/scripts/start-web.sh
new file mode 100644
index 0000000..ffa00ad
--- /dev/null
+++ b/scripts/start-web.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -eu
+
+python manage.py collectstatic --noinput
+python manage.py migrate --noinput
+
+exec /usr/bin/supervisord -c /etc/supervisor/conf.d/web.conf
\ No newline at end of file
diff --git a/supervisor/web.conf b/supervisor/web.conf
new file mode 100644
index 0000000..b8d7100
--- /dev/null
+++ b/supervisor/web.conf
@@ -0,0 +1,27 @@
+[supervisord]
+nodaemon=true
+logfile=/dev/null
+pidfile=/tmp/supervisord.pid
+
+[program:gunicorn]
+command=/usr/local/bin/gunicorn config.wsgi:application --bind 127.0.0.1:8000
+directory=/app
+autostart=true
+autorestart=true
+startsecs=5
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/fd/2
+stderr_logfile_maxbytes=0
+priority=10
+
+[program:nginx]
+command=/usr/sbin/nginx -g 'daemon off;'
+autostart=true
+autorestart=true
+startsecs=5
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/fd/2
+stderr_logfile_maxbytes=0
+priority=20
\ No newline at end of file