diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -818,6 +818,10 @@
     domains:
       - deposit.staging.swh.network
       - deposit-rp.internal.staging.swh.network
+  graphql_staging:
+    domains:
+      - graphql.staging.swh.network
+      - graphql-rp.internal.staging.swh.network
   hedgedoc:
     domains:
       - hedgedoc.softwareheritage.org
@@ -1978,6 +1982,7 @@
   - enea-prod
 
 swh::deploy::deposit::reverse_proxy::backend_http_port: "%{alias('varnish::backend_http_port')}"
+swh::deploy::graphql::reverse_proxy::backend_http_port: "%{alias('varnish::backend_http_port')}"
 
 # aliases are pulled from letsencrypt::certificates[$swh::deploy::deposit::vhost::letsencrypt_cert]
 swh::deploy::deposit::vhost::letsencrypt_cert: deposit_production
diff --git a/data/deployments/staging/common.yaml b/data/deployments/staging/common.yaml
--- a/data/deployments/staging/common.yaml
+++ b/data/deployments/staging/common.yaml
@@ -140,6 +140,13 @@
 swh::deploy::webapp::vhost::letsencrypt_cert: archive_staging
 swh::deploy::webapp::reverse_proxy::backend_http_host: webapp.internal.staging.swh.network
 
+swh::deploy::graphql::vhost::letsencrypt_cert: graphql_staging
+swh::deploy::graphql::reverse_proxy::basic_auth: true
+swh::deploy::graphql::reverse_proxy::backend_http_host: graphql-worker0.internal.staging.swh.network
+# swh::deploy::graphql::reverse_proxy::basic_auth::swh-stg in private data
+swh::deploy::graphql::reverse_proxy::basic_auth::users:
+  - swh-stg
+
 swh::remote_service::objstorage::config::rw:
   cls: remote
   url: "http://storage1.internal.staging.swh.network:%{hiera('swh::remote_service::objstorage::port')}/"
@@ -176,6 +183,7 @@
   - deposit
   - webapp
   - objstorage
+  - graphql
 
 swh::postgresql::version: '12'
 swh::postgresql::port: 5433