diff --git a/blog.nomad.hcl b/blog.nomad.hcl
index 522212f..ba24097 100644
--- a/blog.nomad.hcl
+++ b/blog.nomad.hcl
@@ -28,11 +28,23 @@ job "blog" {
       port = "http"
 
       tags = [
+        # ----- router for the naked domain -----
         "traefik.enable=true",
-        "traefik.http.routers.domainredirect.tls=true",
-        "traefik.http.routers.domainredirect.entrypoints=websecure",
-        "traefik.http.routers.domainredirect.rule=Host(`${local.HOST}`)",
-        ]
+        "traefik.http.routers.blog.rule=Host(`${local.HOST}`)",
+        "traefik.http.routers.blog.entrypoints=websecure",
+        "traefik.http.routers.blog.tls=true",
+
+        # ----- router for the www domain (new) -----
+        "traefik.http.routers.blog-www.rule=Host(`www.${local.HOST}`)",
+        "traefik.http.routers.blog-www.entrypoints=websecure",
+        "traefik.http.routers.blog-www.tls=true",
+        "traefik.http.routers.blog-www.middlewares=redirect-www-to-root",
+
+        # ----- middleware that does the 301 redirect -----
+        "traefik.http.middlewares.redirect-www-to-root.redirectregex.regex=^https?://www\\.${local.HOST}(.*)",
+        "traefik.http.middlewares.redirect-www-to-root.redirectregex.replacement=https://${local.HOST}$${1}",
+        "traefik.http.middlewares.redirect-www-to-root.redirectregex.permanent=true"
+      ]
     }
 
     task "blog" {
diff --git a/blog.nomad.json b/blog.nomad.json
index e3d69ad..deb5756 100644
--- a/blog.nomad.json
+++ b/blog.nomad.json
@@ -102,9 +102,16 @@
                         "Name": "blog",
                         "Tags": [
                             "traefik.enable=true",
-                            "traefik.http.routers.domainredirect.tls=true",
-                            "traefik.http.routers.domainredirect.entrypoints=websecure",
-                            "traefik.http.routers.domainredirect.rule=Host(`cbraaten.dev`)"
+                            "traefik.http.routers.blog.rule=Host(`cbraaten.dev`)",
+                            "traefik.http.routers.blog.entrypoints=websecure",
+                            "traefik.http.routers.blog.tls=true",
+                            "traefik.http.routers.blog-www.rule=Host(`www.cbraaten.dev`)",
+                            "traefik.http.routers.blog-www.entrypoints=websecure",
+                            "traefik.http.routers.blog-www.tls=true",
+                            "traefik.http.routers.blog-www.middlewares=redirect-www-to-root",
+                            "traefik.http.middlewares.redirect-www-to-root.redirectregex.regex=^https?://www\\.cbraaten.dev(.*)",
+                            "traefik.http.middlewares.redirect-www-to-root.redirectregex.replacement=https://cbraaten.dev${1}",
+                            "traefik.http.middlewares.redirect-www-to-root.redirectregex.permanent=true"
                         ],
                         "CanaryTags": null,
                         "EnableTagOverride": false,