diff --git a/src/app.js b/src/app.js
index 5bbde10..fecca9e 100644
--- a/src/app.js
+++ b/src/app.js
@@ -22,6 +22,18 @@ const zt_controller = require('./routes/zt_controller');
 
 const app = express();
 
+// Base path support for reverse proxy subpaths (e.g., Nginx location)
+// Example: BASE_PATH=/ztncui -> app is served under http(s)://host/ztncui
+const rawBasePath = process.env.BASE_PATH || '';
+const basePath = (function normalizeBasePath(p) {
+  if (!p) return '';
+  if (!p.startsWith('/')) p = '/' + p;
+  // trim trailing slash except root
+  if (p.length > 1 && p.endsWith('/')) p = p.slice(0, -1);
+  return p;
+})(rawBasePath);
+app.locals.basePath = basePath;
+
 const session_secret = Math.random().toString(36).substring(2,12);
 
 // view engine setup
@@ -29,7 +41,8 @@ app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'pug');
 
 app.use(helmet());
-app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
+// Mount favicon and static assets under base path
+app.use(basePath, favicon(path.join(__dirname, 'public', 'favicon.ico')));
 app.use(logger('dev'));
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({ extended: false }));
@@ -40,15 +53,23 @@ app.use(session({
 }));
 app.use(expressValidator());
 app.use(cookieParser());
-app.use(express.static(path.join(__dirname, 'public')));
-app.use('/fonts', express.static(path.join(__dirname, 'node_modules/bootstrap/fonts')));
-app.use('/bscss', express.static(path.join(__dirname, 'node_modules/bootstrap/dist/css')));
-app.use('/jqjs', express.static(path.join(__dirname, 'node_modules/jquery/dist')));
-app.use('/bsjs', express.static(path.join(__dirname, 'node_modules/bootstrap/dist/js')));
+// Inject basePath into templates
+app.use(function(req, res, next) {
+  res.locals.basePath = basePath;
+  next();
+});
 
-app.use('/', index);
-app.use('/users', users);
-app.use('/controller', zt_controller);
+// Static mounts under base path
+app.use(basePath, express.static(path.join(__dirname, 'public')));
+app.use(basePath + '/fonts', express.static(path.join(__dirname, 'node_modules/bootstrap/fonts')));
+app.use(basePath + '/bscss', express.static(path.join(__dirname, 'node_modules/bootstrap/dist/css')));
+app.use(basePath + '/jqjs', express.static(path.join(__dirname, 'node_modules/jquery/dist')));
+app.use(basePath + '/bsjs', express.static(path.join(__dirname, 'node_modules/bootstrap/dist/js')));
+
+// Route mounts under base path
+app.use(basePath + '/', index);
+app.use(basePath + '/users', users);
+app.use(basePath + '/controller', zt_controller);
 
 // catch 404 and forward to error handler
 app.use(function(req, res, next) {
diff --git a/src/controllers/auth.js b/src/controllers/auth.js
index 8e11ecb..5453869 100644
--- a/src/controllers/auth.js
+++ b/src/controllers/auth.js
@@ -42,7 +42,8 @@ exports.restrict = function(req, res, next) {
   if (req.session.user) {
     next();
   } else {
+    const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
     req.session.error = 'Access denied!';
-    res.redirect('/login?redirect=' + encodeURIComponent(req.originalUrl));
+    res.redirect(basePath + '/login?redirect=' + encodeURIComponent(req.originalUrl));
   }
 }
diff --git a/src/routes/index.js b/src/routes/index.js
index cc255fb..6c45e06 100644
--- a/src/routes/index.js
+++ b/src/routes/index.js
@@ -13,7 +13,8 @@ const router = express.Router();
 /** Redirect logged user to controler page */
 function guest_only(req, res, next) {
   if (req.session.user) {
-    res.redirect('/controller');
+    const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
+    res.redirect(basePath + '/controller');
   } else {
     next();
   }
@@ -26,7 +27,8 @@ router.get('/', guest_only, function(req, res, next) {
 
 router.get('/logout', function(req, res) {
   req.session.destroy(function() {
-    res.redirect('/');
+    const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
+    res.redirect(basePath + '/');
   });
 });
 
@@ -49,14 +51,18 @@ router.post('/login', async function(req, res) {
         req.session.user = user;
         req.session.success = 'Authenticated as ' + user.name;
         if (user.pass_set) {
-          res.redirect(req.query.redirect || '/controller');
+          const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
+          const redirectTarget = req.query.redirect || (basePath + '/controller');
+          res.redirect(redirectTarget);
         } else {
-          res.redirect('/users/' + user.name + '/password');
+          const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
+          res.redirect(basePath + '/users/' + user.name + '/password');
         }
       });
     } else {
       req.session.error = 'Authentication failed, please check your username and password.'
-      res.redirect('/login');
+      const basePath = req.app && req.app.locals ? (req.app.locals.basePath || '') : '';
+      res.redirect(basePath + '/login');
     }
   });
 });
diff --git a/src/views/controller_layout.pug b/src/views/controller_layout.pug
index b0f72ee..57c59e6 100644
--- a/src/views/controller_layout.pug
+++ b/src/views/controller_layout.pug
@@ -6,10 +6,10 @@
 extends head_layout
 
 block nav_items
-  +nav_item('controller_home', 'Home', '/controller')
-  +nav_item('users', 'Users', '/users')
-  +nav_item('networks', 'Networks', '/controller/networks')
-  +nav_item('add_network', 'Add network', '/controller/network/create')
+  +nav_item('controller_home', 'Home', basePath + '/controller')
+  +nav_item('users', 'Users', basePath + '/users')
+  +nav_item('networks', 'Networks', basePath + '/controller/networks')
+  +nav_item('add_network', 'Add network', basePath + '/controller/network/create')
 
 block body_content
   .container(style='margin: 50px auto 20px')
diff --git a/src/views/dns.pug b/src/views/dns.pug
index 87b08a4..19f008a 100644
--- a/src/views/dns.pug
+++ b/src/views/dns.pug
@@ -47,7 +47,7 @@ block net_content
       .col-sm-12
         button.btn.btn-primary(type='submit') Submit
         = ' '
-        a.btn.btn-default(href=('/controller/network/' + network.nwid) name='cancel' role='button') Cancel
+        a.btn.btn-default(href=(basePath + '/controller/network/' + network.nwid) name='cancel' role='button') Cancel
 
   if errors
     .row
diff --git a/src/views/head_layout.pug b/src/views/head_layout.pug
index c2be79c..97ae0c5 100644
--- a/src/views/head_layout.pug
+++ b/src/views/head_layout.pug
@@ -19,10 +19,10 @@ html(lang='en')
     title= title
     meta(charset='utf-8')
     meta(name='viewport', content='width=device-width, initial-scale=1')
-    link(rel='stylesheet', href='/bscss/bootstrap.min.css')
-    link(rel='stylesheet', href='/stylesheets/style.css')
-    script(src='/jqjs/jquery.min.js')
-    script(src='/bsjs/bootstrap.min.js')
+    link(rel='stylesheet', href=(basePath + '/bscss/bootstrap.min.css'))
+    link(rel='stylesheet', href=(basePath + '/stylesheets/style.css'))
+    script(src=(basePath + '/jqjs/jquery.min.js'))
+    script(src=(basePath + '/bsjs/bootstrap.min.js'))
   body
     nav.navbar.navbar-inverse.navbar-fixed-top
       .container-fluid
@@ -32,7 +32,7 @@ html(lang='en')
             span.icon-bar
             span.icon-bar
           a.navbar-brand(href='https://key-networks.com' target='_blank')
-            img(src='/images/key-logo.svg' alt='Key Networks logo' height='25px' width='25px' style='display: inline')
+            img(src=(basePath + '/images/key-logo.svg') alt='Key Networks logo' height='25px' width='25px' style='display: inline')
             |  Key Networks
         .collapse.navbar-collapse(id='BarNav')
           ul.nav.navbar-nav
@@ -40,7 +40,7 @@ html(lang='en')
           ul.nav.navbar-nav.navbar-right
             li
               block nav_login
-                a(href='/logout')
+                a(href=(basePath + '/logout'))
                   span.glyphicon.glyphicon-log-out
                   |  Logout
     block body_content
diff --git a/src/views/index.pug b/src/views/index.pug
index 6a77369..aae3f9f 100644
--- a/src/views/index.pug
+++ b/src/views/index.pug
@@ -19,4 +19,4 @@ block content
     h4 This network controller has a ZeroTier address of <b>#{zt_status.address}</b>
     h4 ZeroTier version <b>#{zt_status.version}</b>
     h4
-      a(href='/controller/networks') List all networks on this network controller
+      a(href=(basePath + '/controller/networks')) List all networks on this network controller
diff --git a/src/views/ipAssignmentPools.pug b/src/views/ipAssignmentPools.pug
index 7af58bf..6487358 100644
--- a/src/views/ipAssignmentPools.pug
+++ b/src/views/ipAssignmentPools.pug
@@ -16,7 +16,7 @@ block net_content
           each ipAssignmentPool in network.ipAssignmentPools
             tr
               td(width='3%')
-                a(href='/controller/network/' + network.nwid + '/ipAssignmentPools/' + ipAssignmentPool.ipRangeStart + '/' + ipAssignmentPool.ipRangeEnd + '/delete')
+                a(href=(basePath + '/controller/network/' + network.nwid + '/ipAssignmentPools/' + ipAssignmentPool.ipRangeStart + '/' + ipAssignmentPool.ipRangeEnd + '/delete'))
                   i.glyphicon.glyphicon-trash
               td= ipAssignmentPool.ipRangeStart
               td= ipAssignmentPool.ipRangeEnd
@@ -25,7 +25,7 @@ block net_content
     .col-sm-12
       h3 Add new IP Assignment Pool:
 
-  form(method='POST' action='/controller/network/' + network.nwid + '/ipAssignmentPools')
+  form(method='POST' action=(basePath + '/controller/network/' + network.nwid + '/ipAssignmentPools'))
     .form-group.row
       .col-sm-2
         label(for='ipRangeStart') IP range start:
@@ -42,7 +42,7 @@ block net_content
       .col-sm-12
         button.btn.btn-primary(type='submit') Submit
         = ' '
-        a.btn.btn-default(href='/controller/network/' + network.nwid name='cancel' role='button') Cancel
+        a.btn.btn-default(href=(basePath + '/controller/network/' + network.nwid) name='cancel' role='button') Cancel
 
   if errors
     .row
diff --git a/src/views/ipAssignments.pug b/src/views/ipAssignments.pug
index 26c3ee1..f2a7d90 100644
--- a/src/views/ipAssignments.pug
+++ b/src/views/ipAssignments.pug
@@ -32,7 +32,7 @@ block net_content
           each ipAssignment, index in member.ipAssignments
             tr
               td(width='3%')
-                a.btn.btn-link(role='button' href='/controller/network/' + network.nwid + '/member/' + member.id + '/ipAssignments/' + index + '/delete')
+                a.btn.btn-link(role='button' href=(basePath + '/controller/network/' + network.nwid + '/member/' + member.id + '/ipAssignments/' + index + '/delete'))
                   i.glyphicon.glyphicon-trash
               td
                 each digit in ipAssignment
@@ -47,7 +47,7 @@ block net_content
 
     .row
       .col-sm-12
-        a(href='/controller/network/' + network.nwid + '/routes')
+        a(href=(basePath + '/controller/network/' + network.nwid + '/routes'))
           h3 Managed routes
         table.table.table-responsive.table-striped.table-hover
           tr
@@ -57,7 +57,7 @@ block net_content
             each route in network.routes
               tr
                 td(width='3%')
-                  a.btn.btn-link(role='button' href='/controller/network/' + network.nwid + '/routes/' + route.target + '/delete')
+                  a.btn.btn-link(role='button' href=(basePath + '/controller/network/' + network.nwid + '/routes/' + route.target + '/delete'))
                     i.glyphicon.glyphicon-trash
                 td= route.target
                 td= route.via
diff --git a/src/views/login.pug b/src/views/login.pug
index 9a131ab..392fdd3 100644
--- a/src/views/login.pug
+++ b/src/views/login.pug
@@ -42,4 +42,4 @@ block login_content
         .col-sm-10
           button.btn.btn-primary(type='submit') Login
           = ' '
-          a.btn.btn-default(href='/' name='cancel' role='button') Cancel
+          a.btn.btn-default(href=(basePath + '/') name='cancel' role='button') Cancel
diff --git a/src/views/login_layout.pug b/src/views/login_layout.pug
index a9fcb5c..8cce467 100644
--- a/src/views/login_layout.pug
+++ b/src/views/login_layout.pug
@@ -6,7 +6,7 @@
 extends head_layout
 
 block nav_login
-  a(href='/login')
+  a(href=(basePath + '/login'))
     span.glyphicon.glyphicon-log-in
     |  Login
 
diff --git a/src/views/member_delete.pug b/src/views/member_delete.pug
index e6001ea..c623162 100644
--- a/src/views/member_delete.pug
+++ b/src/views/member_delete.pug
@@ -9,7 +9,7 @@ block net_content
   if member.deleted
     .alert.alert-success
       strong #{member.name} (#{member.id}) was deleted
-    a.btn.btn-default(href=('/controller/network/' + network.nwid + '#members') name='networks' role='button') Members
+    a.btn.btn-default(href=(basePath + '/controller/network/' + network.nwid + '#members') name='networks' role='button') Members
 
   else
     .alert.alert-info
@@ -21,7 +21,7 @@ block net_content
     form(method='POST' action='')
       button.btn.btn-primary(type='submit', name='delete') Delete #{member.name} (#{member.id})
       = ' '
-      a.btn.btn-default(href='/controller/network/' + network.nwid + '#members',
+      a.btn.btn-default(href=(basePath + '/controller/network/' + network.nwid + '#members'),
                                           name='cancel', role='button') Cancel
 
   if errors
diff --git a/src/views/member_detail.pug b/src/views/member_detail.pug
index 8d1369a..03a681b 100644
--- a/src/views/member_detail.pug
+++ b/src/views/member_detail.pug
@@ -12,9 +12,9 @@ block net_content
   each value, key in member
     .row
       .col-sm-2
-        a(href=('/controller/network/' + member.nwid + '/member/' + member.address + '/' + key)) #{key}:
+        a(href=(basePath + '/controller/network/' + member.nwid + '/member/' + member.address + '/' + key)) #{key}:
       .col-sm-10
         +json_value(value)
 
-  a.btn.btn-default(href=('/controller/network/' + member.nwid + "#members") name='networks' role='button' style='margin-top: 10px;')
+  a.btn.btn-default(href=(basePath + '/controller/network/' + member.nwid + "#members") name='networks' role='button' style='margin-top: 10px;')
     | Members
diff --git a/src/views/network_delete.pug b/src/views/network_delete.pug
index 00bba12..9a20733 100644
--- a/src/views/network_delete.pug
+++ b/src/views/network_delete.pug
@@ -16,7 +16,7 @@ block net_content
     form(method='POST' action='')
       button.btn.btn-danger(type='submit', name='delete') Delete #{network.name} (#{network.nwid})
       = ' '
-      a.btn.btn-default(href='/controller/networks', name='cancel', role='button') Cancel
+      a.btn.btn-default(href=(basePath + '/controller/networks'), name='cancel', role='button') Cancel
 
   if errors
     ul
diff --git a/src/views/network_detail.pug b/src/views/network_detail.pug
index 127dd6a..cd85764 100644
--- a/src/views/network_detail.pug
+++ b/src/views/network_detail.pug
@@ -19,7 +19,7 @@ block network_title
     |  (#{network.nwid}):
   script.
     $(function() {
-      var nwurl = '/controller/network/#{network.nwid}';
+      var nwurl = '#{basePath}/controller/network/#{network.nwid}';
       var name = !{JSON.stringify(network.name)};
 
       function toggleNameEditor(show) {
@@ -51,7 +51,7 @@ block network_title
     });
 
 block net_content
-  - const nwurl = '/controller/network/' + network.nwid;
+  - const nwurl = basePath + '/controller/network/' + network.nwid;
 
   a.btn.btn-primary(style="margin: 5px" href=(nwurl + '/private') role='button')
     = network.private ? "Private" : "Public"
@@ -158,4 +158,4 @@ block net_content
       .col-sm-10
         +json_value(value)
 
-  a.btn.btn-default(href='/controller/networks' name='networks' role='button' style='margin-top: 10px;') Networks
+  a.btn.btn-default(href=(basePath + '/controller/networks') name='networks' role='button' style='margin-top: 10px;') Networks
diff --git a/src/views/network_layout.pug b/src/views/network_layout.pug
index 2004c85..ff4c839 100644
--- a/src/views/network_layout.pug
+++ b/src/views/network_layout.pug
@@ -14,7 +14,7 @@ block content
         block network_title
           h2
             | Network 
-            a(href='/controller/network/' + network.nwid) #{network.name}
+            a(href=(basePath + '/controller/network/' + network.nwid)) #{network.name}
             |  (#{network.nwid}):
         block title
           if title
diff --git a/src/views/networks.pug b/src/views/networks.pug
index 6a9e5d4..7b11ee3 100644
--- a/src/views/networks.pug
+++ b/src/views/networks.pug
@@ -26,7 +26,7 @@ block content
         th(width='37%')
           = ''
       each network in networks
-        - const nwurl = '/controller/network/' + network.nwid;
+        - const nwurl = basePath + '/controller/network/' + network.nwid;
         tr
           td
             a(href=nwurl + '/delete')
diff --git a/src/views/not_implemented.pug b/src/views/not_implemented.pug
index 8e61eca..85ee1b3 100644
--- a/src/views/not_implemented.pug
+++ b/src/views/not_implemented.pug
@@ -16,5 +16,5 @@ block net_content
   h4
     | Note that you may be able to edit some properties on the 
     strong
-      a(href='/controller/network/' + network.nwid + '#members') Members
+      a(href=(basePath + '/controller/network/' + network.nwid + '#members')) Members
     |  page.
diff --git a/src/views/password.pug b/src/views/password.pug
index 09b9369..cdef7ca 100644
--- a/src/views/password.pug
+++ b/src/views/password.pug
@@ -51,7 +51,7 @@ block users_content
       .col-sm-10
         button.btn.btn-primary(type='submit') Set password
         = ' '
-        a.btn.btn-default(href='/users' name='cancel' role='button') Cancel
+        a.btn.btn-default(href=(basePath + '/users') name='cancel' role='button') Cancel
 
   if errors
     .form-group.row
diff --git a/src/views/routes.pug b/src/views/routes.pug
index d80c5e4..390579f 100644
--- a/src/views/routes.pug
+++ b/src/views/routes.pug
@@ -16,7 +16,7 @@ block net_content
           each route in network.routes
             tr
               td(width='3%')
-                a(href='/controller/network/' + network.nwid + '/routes/' + route.target + '/delete')
+                a(href=(basePath + '/controller/network/' + network.nwid + '/routes/' + route.target + '/delete'))
                   i.glyphicon.glyphicon-trash
               td= route.target
               td= route.via
@@ -25,7 +25,7 @@ block net_content
     .col-sm-12
       h3 Add new route:
 
-  form(method='POST' action='/controller/network/' + network.nwid + '/routes')
+  form(method='POST' action=(basePath + '/controller/network/' + network.nwid + '/routes'))
     .form-group.row
       .col-sm-12
         label(for='target') Target:
@@ -42,7 +42,7 @@ block net_content
       .col-sm-12
         button.btn.btn-primary(type='submit') Submit
         = ' '
-        a.btn.btn-default(href=('/controller/network/' + network.nwid) name='cancel' role='button') Cancel
+        a.btn.btn-default(href=(basePath + '/controller/network/' + network.nwid) name='cancel' role='button') Cancel
 
   if errors
     .row
diff --git a/src/views/user_delete.pug b/src/views/user_delete.pug
index d9d74b6..458eda3 100644
--- a/src/views/user_delete.pug
+++ b/src/views/user_delete.pug
@@ -24,7 +24,7 @@ block users_content
     form(method='POST' action='')
       button.btn.btn-danger(type='submit', name='delete' value='delete') Delete #{user.name}
       = ' '
-      a.btn.btn-default(href='/users', name='cancel', role='button') Cancel
+      a.btn.btn-default(href=(basePath + '/users'), name='cancel', role='button') Cancel
 
   if errors
     ul
diff --git a/src/views/users.pug b/src/views/users.pug
index 5cef684..b8451cb 100644
--- a/src/views/users.pug
+++ b/src/views/users.pug
@@ -10,12 +10,12 @@ block users_content
     each user in users
       tr
         td(width='3%')
-          a(href='/users/' + user.name + '/delete')
+          a(href=(basePath + '/users/' + user.name + '/delete'))
             i.glyphicon.glyphicon-trash
         td(width='15%')
-          a(href='/users/' + user.name + '/password') #{user.name}
+          a(href=(basePath + '/users/' + user.name + '/password')) #{user.name}
         td(width='82%')
-          a(href='/users/' + user.name + '/password') set password
+          a(href=(basePath + '/users/' + user.name + '/password')) set password
 
     else
       .alert.alert-info
diff --git a/src/views/users_layout.pug b/src/views/users_layout.pug
index bf5e73d..c0633e4 100644
--- a/src/views/users_layout.pug
+++ b/src/views/users_layout.pug
@@ -6,10 +6,10 @@
 extends head_layout
 
 block nav_items
-  +nav_item('controller_home', 'Home', '/controller')
-  +nav_item('users', 'Users', '/users')
-  +nav_item('networks', 'Networks', '/controller/networks')
-  +nav_item('create_user', 'Create user', '/users/create')
+  +nav_item('controller_home', 'Home', basePath + '/controller')
+  +nav_item('users', 'Users', basePath + '/users')
+  +nav_item('networks', 'Networks', basePath + '/controller/networks')
+  +nav_item('create_user', 'Create user', basePath + '/users/create')
 
 block body_content
   .container(style='margin-top:50px')