diff --git a/backend/src/index.ts b/backend/src/index.ts
index c200841..36c67bf 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -1,19 +1,76 @@
-import fastify from 'fastify'
+import fastify from 'fastify';
+import cors from '@fastify/cors';
+import helmet from '@fastify/helmet';
+import rateLimit from '@fastify/rate-limit';
+import swagger from '@fastify/swagger';
+import swaggerUi from '@fastify/swagger-ui';
+import cookie from '@fastify/cookie';
+import jwt from '@fastify/jwt';
+import routes from './routes';
 
-const app = fastify({ logger: true })
+const app = fastify({ logger: true });
 
-app.get('/api/health', async (request, reply) => {
+// Register plugins
+app.register(cors, { origin: 'cad.media-on.de' });
+app.register(helmet);
+app.register(rateLimit, {
+  max: 100,
+  timeWindow: '1 minute',
+  allowList: ['127.0.0.1'],
+  skipOnError: true,
+  keyGenerator: (req) => req.headers['x-forwarded-for'] || req.ip || req.ips,
+});
+app.register(swagger, {
+  openapi: {
+    info: {
+      title: 'Web CAD API',
+      description: 'API for Web CAD application',
+      version: '1.0.0',
+    },
+    servers: [{
+      url: 'http://localhost:3001',
+      description: 'Development server',
+    }],
+  },
+});
+app.register(swaggerUi, {
+  routePrefix: '/api/docs',
+  uiConfig: {
+    deepLinking: false,
+  },
+  staticCSP: true,
+  transformStaticCSP: (header) => header,
+  uiHooks: {
+    onRequest: function (_request, _reply, next) { next(); },
+    preHandler: function (_request, _reply, next) { next(); }
+  },
+});
+app.register(cookie);
+app.register(jwt, {
+  secret: process.env.JWT_SECRET || 'default-secret',
+});
+
+// Register routes
+app.register(routes, { prefix: '/api' });
+
+// Health endpoint
+app.get('/api/health', async (_request, _reply) => {
   return { status: 'OK' }
-})
+});
+
+// OpenAPI spec endpoint
+app.get('/api/openapi.json', async (_request, _reply) => {
+  return app.swagger();
+});
 
 const start = async () => {
   try {
-    await app.listen({ port: 3001, host: '0.0.0.0' })
-    console.log('Server listening on port 3001')
+    await app.listen({ port: 3001, host: '0.0.0.0' });
+    console.log('Server listening on port 3001');
   } catch (err) {
-    app.log.error(err)
-    process.exit(1)
+    app.log.error(err);
+    process.exit(1);
   }
-}
+};
 
-start()
\ No newline at end of file
+start();