From fc6a11397bd2dff8c950844c1c40a01ba0b2ad4e Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Fri, 5 Dec 2025 04:03:24 +0100
Subject: [PATCH] refactor: move traefik configuration to docker-compose files
 via labels

---
 adguardhome/compose.yaml                      | 26 +++++++++-
 dockmon/compose.yaml                          | 42 ++++++++++++----
 gitea/compose.yaml                            | 26 +++++++++-
 glance/compose.yaml                           | 26 ++++++++--
 homepage/compose.yaml                         | 27 +++++++++-
 metube/compose.yaml                           | 26 +++++++++-
 n8n/compose.yaml                              | 39 ++++++++++++---
 nextcloud/compose.yaml                        | 48 ++++++++++++++----
 penpot/compose.yaml                           | 50 ++++++++++++-------
 portainer/compose.yaml                        | 26 +++++++++-
 termix/compose.yaml                           | 27 +++++++++-
 traefik/compose.yaml                          | 45 ++++++++++++-----
 .../{routers-dev.yml => routers-dev.yml.bak}  |  0
 ...outers-local.yml => routers-local.yml.bak} |  0
 ...{routers-prod.yml => routers-prod.yml.bak} |  0
 .../{services.yml => services.yml.bak}        |  0
 uptime-kuma/compose.yaml                      | 22 ++++++--
 17 files changed, 356 insertions(+), 74 deletions(-)
 rename traefik/dynamic/{routers-dev.yml => routers-dev.yml.bak} (100%)
 rename traefik/dynamic/{routers-local.yml => routers-local.yml.bak} (100%)
 rename traefik/dynamic/{routers-prod.yml => routers-prod.yml.bak} (100%)
 rename traefik/dynamic/{services.yml => services.yml.bak} (100%)

diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml
index 0b38acd..ac2d4a7 100644
--- a/adguardhome/compose.yaml
+++ b/adguardhome/compose.yaml
@@ -19,10 +19,32 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.entrypoints=websecure"
+      - "traefik.http.routers.adguard.middlewares=security-headers"
+      - "traefik.http.routers.adguard.service=adguard"
+      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.local`) || Host(`adguard.local`)"
+      - "traefik.http.routers.adguard-local.entrypoints=websecure"
+      - "traefik.http.routers.adguard-local.middlewares=security-headers"
+      - "traefik.http.routers.adguard-local.service=adguard"
+      - "traefik.http.routers.adguard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.local`)"
+      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
+      - "traefik.http.routers.adguard-dev.middlewares=security-headers"
+      - "traefik.http.routers.adguard-dev.service=adguard"
+      - "traefik.http.routers.adguard-dev.tls=true"
+
       - glance.name=adguard
-      # - glance.icon=si:adguard
       - glance.url=https://adguard.forust.xyz/
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/dockmon/compose.yaml b/dockmon/compose.yaml
index 6caae8d..85218bd 100644
--- a/dockmon/compose.yaml
+++ b/dockmon/compose.yaml
@@ -11,20 +11,44 @@ services:
          - ./data:/app/data
          - /var/run/docker.sock:/var/run/docker.sock
       healthcheck:
-         test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
+         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
          interval: 30s
          timeout: 10s
          retries: 3
       networks:
          - traefik-proxy
       labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
-      - glance.name=dockmon
-      # - glance.icon=sh:dockmon
-      - glance.url=https://dockmon.forust.xyz/
-      - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+         - "traefik.enable=true"
+         - "traefik.docker.network=traefik-proxy"
+
+         # Prod Router
+         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+         - "traefik.http.routers.dockmon.entrypoints=websecure"
+         - "traefik.http.routers.dockmon.middlewares=security-headers,dockmon-auth"
+         - "traefik.http.routers.dockmon.service=dockmon"
+         - "traefik.http.routers.dockmon.tls=true"
+         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+
+         # Local Router
+         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.local`) || Host(`dockmon.local`)"
+         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-local.middlewares=security-headers"
+         - "traefik.http.routers.dockmon-local.service=dockmon"
+         - "traefik.http.routers.dockmon-local.tls=true"
+
+         # Dev Router
+         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.local`)"
+         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-headers"
+         - "traefik.http.routers.dockmon-dev.service=dockmon"
+         - "traefik.http.routers.dockmon-dev.tls=true"
+
+         - glance.name=dockmon
+         - glance.url=https://dockmon.forust.xyz/
+         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
 
 networks:
-  traefik-proxy:
-    external: true
+   traefik-proxy:
+      external: true
diff --git a/gitea/compose.yaml b/gitea/compose.yaml
index 376cda9..54d4db1 100644
--- a/gitea/compose.yaml
+++ b/gitea/compose.yaml
@@ -25,11 +25,33 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.middlewares=security-headers"
+      - "traefik.http.routers.gitea.service=gitea"
+      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.local`) || Host(`gitea.local`)"
+      - "traefik.http.routers.gitea-local.entrypoints=websecure"
+      - "traefik.http.routers.gitea-local.middlewares=security-headers"
+      - "traefik.http.routers.gitea-local.service=gitea"
+      - "traefik.http.routers.gitea-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.local`)"
+      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
+      - "traefik.http.routers.gitea-dev.middlewares=security-headers"
+      - "traefik.http.routers.gitea-dev.service=gitea"
+      - "traefik.http.routers.gitea-dev.tls=true"
     ports:
       - "2221:22"
     depends_on:
       - db
-      
+
   db:
     image: docker.io/library/postgres:14
     restart: always
@@ -41,7 +63,7 @@ services:
       - gitea-db
     volumes:
       - ./gitea-db/:/var/lib/postgresql/data
-      
+
 networks:
   gitea-db:
     external: false
diff --git a/glance/compose.yaml b/glance/compose.yaml
index f393688..198c7a4 100644
--- a/glance/compose.yaml
+++ b/glance/compose.yaml
@@ -10,13 +10,31 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     env_file: .env
     labels:
-    - "traefik.enable=true"
-    - "traefik.docker.network=traefik-proxy"
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.entrypoints=websecure"
+      - "traefik.http.routers.glance.middlewares=security-headers"
+      - "traefik.http.routers.glance.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.local`) || Host(`glance.local`)"
+      - "traefik.http.routers.glance-local.entrypoints=websecure"
+      - "traefik.http.routers.glance-local.middlewares=security-headers"
+      - "traefik.http.routers.glance-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.local`)"
+      - "traefik.http.routers.glance-dev.entrypoints=websecure"
+      - "traefik.http.routers.glance-dev.middlewares=security-headers"
+      - "traefik.http.routers.glance-dev.tls=true"
     networks:
-      - traefik-proxy 
+      - traefik-proxy
     dns:
       - 1.1.1.1
       - 8.8.8.8
 networks:
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/homepage/compose.yaml b/homepage/compose.yaml
index dc5a182..83bc617 100644
--- a/homepage/compose.yaml
+++ b/homepage/compose.yaml
@@ -8,7 +8,32 @@ services:
       - ./files:/usr/share/nginx/html
     networks:
       - traefik-proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage.tls=true"
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.local`) || Host(`landing.local`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.local`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
 
 networks:
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/metube/compose.yaml b/metube/compose.yaml
index 0d0d9b4..895c685 100644
--- a/metube/compose.yaml
+++ b/metube/compose.yaml
@@ -4,7 +4,7 @@ services:
     # container_name: metube
     restart: unless-stopped
     # ports:
-      # - "8081:8081"
+    # - "8081:8081"
     environment:
       - DOWNLOAD_MODE=limited
       - MAX_CONCURRENT_DOWNLOADS=3
@@ -16,8 +16,30 @@ services:
       - traefik.enable=true
       - "traefik.docker.network=traefik-proxy"
 
+      # Prod Router
+      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
+      - "traefik.http.routers.metube.entrypoints=websecure"
+      - "traefik.http.routers.metube.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube.service=metube"
+      - "traefik.http.routers.metube.tls=true"
+      - "traefik.http.services.metube.loadbalancer.server.port=8081"
+
+      # Local Router
+      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.local`) || Host(`metube.local`)"
+      - "traefik.http.routers.metube-local.entrypoints=websecure"
+      - "traefik.http.routers.metube-local.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube-local.service=metube"
+      - "traefik.http.routers.metube-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.local`)"
+      - "traefik.http.routers.metube-dev.entrypoints=websecure"
+      - "traefik.http.routers.metube-dev.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube-dev.service=metube"
+      - "traefik.http.routers.metube-dev.tls=true"
+
     networks:
       - traefik-proxy
 networks:
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/n8n/compose.yaml b/n8n/compose.yaml
index 390dbc8..9da0dc6 100644
--- a/n8n/compose.yaml
+++ b/n8n/compose.yaml
@@ -23,17 +23,40 @@ services:
       - 1.1.1.1
       - 8.8.8.8
     networks:
-      - traefik-proxy 
+      - traefik-proxy
       - n8n
     labels:
-    - "traefik.enable=true"
-    - "traefik.docker.network=traefik-proxy"
-    - glance.name=n8n
-    - glance.icon=si:n8n
-    - glance.url=https://n8n.forust.xyz/
-    - glance.description=n8n is a workflow automation tool that enables you to connect various apps and services to automate tasks and processes.
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.middlewares=security-headers"
+      - "traefik.http.routers.n8n.service=n8n"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+      # Local Router
+      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.local`) || Host(`n8n.local`)"
+      - "traefik.http.routers.n8n-local.entrypoints=websecure"
+      - "traefik.http.routers.n8n-local.middlewares=security-headers"
+      - "traefik.http.routers.n8n-local.service=n8n"
+      - "traefik.http.routers.n8n-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.local`)"
+      - "traefik.http.routers.n8n-dev.entrypoints=websecure"
+      - "traefik.http.routers.n8n-dev.middlewares=security-headers"
+      - "traefik.http.routers.n8n-dev.service=n8n"
+      - "traefik.http.routers.n8n-dev.tls=true"
+
+      - glance.name=n8n
+      - glance.icon=si:n8n
+      - glance.url=https://n8n.forust.xyz/
+      - glance.description=n8n is a workflow automation tool that enables you to connect various apps and services to automate tasks and processes.
 networks:
   n8n:
     external: false
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/nextcloud/compose.yaml b/nextcloud/compose.yaml
index 987c542..ad2d2c6 100644
--- a/nextcloud/compose.yaml
+++ b/nextcloud/compose.yaml
@@ -8,23 +8,48 @@ services:
       - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
       - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
     # network_mode: bridge # This adds the container to the same network as docker run would do. Comment this line and uncomment the line below and the networks section at the end of the file if you want to define a custom MTU size for the docker network
-    networks: 
+    networks:
       - nextcloud-aio
       - traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work.
-    # ports:
+      # ports:
       # - 8081:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       # - 8888:8080 # This is the AIO interface, served via https and self-signed certificate. See https://github.com/nextcloud/all-in-one#explanation-of-used-ports
       # - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
     labels:
-    - "traefik.enable=true"
-    - "traefik.docker.network=traefik-proxy"
-    - glance.name=Nextcloud
-    # - glance.icon=si:nextcloud
-    - glance.url=https://nextcloud.forust.xyz/
-    - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
 
+      # Prod Router - DISABLED per user request
+      # - "traefik.http.routers.nextcloud-aio.rule=Host(`nextcloud-aio.forust.xyz`)"
+      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
+      # - "traefik.http.routers.nextcloud-aio.middlewares=security-headers"
+      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
+      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"
 
-    environment: # Is needed when using any of the options below
+      # Local Router
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.local`) || Host(`nextcloud-aio.local`)"
+      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers"
+      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.local`)"
+      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers"
+      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-dev.tls=true"
+
+      - glance.name=Nextcloud
+      # - glance.icon=si:nextcloud
+      - glance.url=https://nextcloud.forust.xyz/
+      - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.
+
+    environment:
+      # Is needed when using any of the options below
       AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
       APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
@@ -53,6 +78,7 @@ networks:
   nextcloud-aio:
     driver: bridge
     external: false
-volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
+volumes:
+  # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
   nextcloud_aio_mastercontainer:
-    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
\ No newline at end of file
+    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
diff --git a/penpot/compose.yaml b/penpot/compose.yaml
index 9f5c1c4..3dde4be 100644
--- a/penpot/compose.yaml
+++ b/penpot/compose.yaml
@@ -26,12 +26,13 @@
 x-flags: &penpot-flags
   PENPOT_FLAGS: disable-email-verification enable-prepl-server disable-secure-session-cookies login-with-github
 
-x-uri: &penpot-public-uri
+x-uri: &penpot-public-urш
   PENPOT_PUBLIC_URI: http://localhost:9001
 
-x-body-size: &penpot-http-body-size
+x-body-size:
   # Max body size (30MiB); Used for plain requests, should never be
   # greater than multi-part size
+  &penpot-http-body-size
   PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 31457280
 
   # Max multipart body size (350MiB)
@@ -56,7 +57,7 @@ volumes:
   penpot_postgres_v15:
   penpot_assets:
   penpot_traefik:
-  # penpot_minio:
+    # penpot_minio:
 
 services:
   ## Traefik service declaration example. Consider using it if you are going to expose
@@ -99,19 +100,34 @@ services:
       - penpot
       - traefik-proxy
 
-    # labels:
-      # - "traefik.enable=true"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
 
-      # ## HTTPS: example of labels for the case where penpot will be exposed to the
-      # ## internet with HTTPS using traefik.
+      # Prod Router
+      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
+      - "traefik.http.routers.penpot.entrypoints=websecure"
+      - "traefik.http.routers.penpot.middlewares=security-headers"
+      - "traefik.http.routers.penpot.service=penpot"
+      - "traefik.http.routers.penpot.tls=true"
+      - "traefik.http.services.penpot.loadbalancer.server.port=8080"
 
-      # - "traefik.http.routers.penpot-https.rule=Host(`<DOMAIN_NAME>`)"
-      # - "traefik.http.routers.penpot-https.entrypoints=websecure"
-      # - "traefik.http.routers.penpot-https.tls.certresolver=letsencrypt"
-      # - "traefik.http.routers.penpot-https.tls=true"
+      # Local Router
+      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.local`) || Host(`penpot.local`)"
+      - "traefik.http.routers.penpot-local.entrypoints=websecure"
+      - "traefik.http.routers.penpot-local.middlewares=security-headers"
+      - "traefik.http.routers.penpot-local.service=penpot"
+      - "traefik.http.routers.penpot-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.local`)"
+      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
+      - "traefik.http.routers.penpot-dev.middlewares=security-headers"
+      - "traefik.http.routers.penpot-dev.service=penpot"
+      - "traefik.http.routers.penpot-dev.tls=true"
 
     environment:
-      << : [*penpot-flags, *penpot-http-body-size]
+      <<: [ *penpot-flags, *penpot-http-body-size ]
 
   penpot-backend:
     image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
@@ -132,7 +148,7 @@ services:
     ## Configuration envronment variables for the backend container.
 
     environment:
-      << : [*penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key]
+      <<: [ *penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key ]
 
       ## The PREPL host. Mainly used for external programatic access to penpot backend
       ## (example: admin). By default it will listen on `localhost` but if you are going to use
@@ -174,7 +190,6 @@ services:
 
       PENPOT_TELEMETRY_ENABLED: true
       PENPOT_TELEMETRY_REFERER: compose
-
       # PENPOT_SMTP_DEFAULT_FROM: no-reply@example.com
       # PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@example.com
       # PENPOT_SMTP_HOST: penpot-mailcatch
@@ -196,7 +211,7 @@ services:
       - penpot
 
     environment:
-      << : [*penpot-secret-key]
+      <<: [ *penpot-secret-key ]
       # Don't touch it; this uses an internal docker network to
       # communicate with the frontend.
       PENPOT_PUBLIC_URI: http://penpot-frontend:8080
@@ -210,7 +225,7 @@ services:
     stop_signal: SIGINT
 
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U penpot"]
+      test: [ "CMD-SHELL", "pg_isready -U penpot" ]
       interval: 2s
       timeout: 10s
       retries: 5
@@ -233,7 +248,7 @@ services:
     restart: always
 
     healthcheck:
-      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      test: [ "CMD-SHELL", "valkey-cli ping | grep PONG" ]
       interval: 1s
       timeout: 3s
       retries: 5
@@ -246,7 +261,6 @@ services:
       # You can increase the max memory size if you have sufficient resources,
       # although this should not be necessary.
       - VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
-
   ## A mailcatch service, used as temporal SMTP server. You can access via HTTP to the
   ## port 1080 for read all emails the penpot platform has sent. Should be only used as a
   ## temporal solution while no real SMTP provider is configured.
diff --git a/portainer/compose.yaml b/portainer/compose.yaml
index 8d255c5..9cc147b 100644
--- a/portainer/compose.yaml
+++ b/portainer/compose.yaml
@@ -14,8 +14,32 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
+      - "traefik.http.routers.portainer.entrypoints=websecure"
+      - "traefik.http.routers.portainer.middlewares=security-headers"
+      - "traefik.http.routers.portainer.service=portainer"
+      - "traefik.http.routers.portainer.tls=true"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
+      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
+      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
+
+      # Local Router
+      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.local`) || Host(`portainer.local`)"
+      - "traefik.http.routers.portainer-local.entrypoints=websecure"
+      - "traefik.http.routers.portainer-local.middlewares=security-headers"
+      - "traefik.http.routers.portainer-local.service=portainer"
+      - "traefik.http.routers.portainer-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.local`)"
+      - "traefik.http.routers.portainer-dev.entrypoints=websecure"
+      - "traefik.http.routers.portainer-dev.middlewares=security-headers"
+      - "traefik.http.routers.portainer-dev.service=portainer"
+      - "traefik.http.routers.portainer-dev.tls=true"
+
       - glance.name=Portainer
-      # - glance.icon=si:portainer
       - glance.url=https://portainer.forust.xyz/
       - glance.description=Portainer is a lightweight management UI which allows you to easily manage your Docker environments.
 
diff --git a/termix/compose.yaml b/termix/compose.yaml
index 241fa19..03d39a6 100644
--- a/termix/compose.yaml
+++ b/termix/compose.yaml
@@ -9,6 +9,31 @@ services:
       - ./termix-data:/app/data
     environment:
       PORT: "8080"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
+      - "traefik.http.routers.termix.entrypoints=websecure"
+      - "traefik.http.routers.termix.middlewares=security-headers"
+      - "traefik.http.routers.termix.service=termix"
+      - "traefik.http.routers.termix.tls=true"
+      - "traefik.http.services.termix.loadbalancer.server.port=8080"
+
+      # Local Router
+      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.local`) || Host(`termix.local`)"
+      - "traefik.http.routers.termix-local.entrypoints=websecure"
+      - "traefik.http.routers.termix-local.middlewares=security-headers"
+      - "traefik.http.routers.termix-local.service=termix"
+      - "traefik.http.routers.termix-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.local`)"
+      - "traefik.http.routers.termix-dev.entrypoints=websecure"
+      - "traefik.http.routers.termix-dev.middlewares=security-headers"
+      - "traefik.http.routers.termix-dev.service=termix"
+      - "traefik.http.routers.termix-dev.tls=true"
     networks:
       - traefik-proxy
 
@@ -18,4 +43,4 @@ networks:
 
 volumes:
   termix-data:
-    driver: local
\ No newline at end of file
+    driver: local
diff --git a/traefik/compose.yaml b/traefik/compose.yaml
index 3dcb7a9..884460b 100644
--- a/traefik/compose.yaml
+++ b/traefik/compose.yaml
@@ -7,14 +7,14 @@ services:
       # API
       - "--api.insecure=false"
       - "--api.dashboard=true"
-      
+
       # Providers
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=traefik-proxy"
       - "--providers.file.directory=/etc/traefik/dynamic"
       - "--providers.file.watch=true"
-      
+
       # EntryPoints
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
@@ -22,48 +22,69 @@ services:
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.ssh.address=:2221"
-      
+
       # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
       # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
       # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
       # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
       # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      
+
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
-      
+
       # Logging
       - "--log.level=INFO"
       - "--log.filePath=/var/log/traefik/traefik.log"
       - "--accesslog=true"
       - "--accesslog.filepath=/var/log/traefik/access.log"
-      
-    labels:
+
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router (Dashboard) - DISABLED per user request
+      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
+      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      # - "traefik.http.routers.traefik-dashboard.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.local`) || Host(`traefik.local`)"
+      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth,security-headers"
+      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.local`)"
+      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers"
+      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-dev.tls=true"
+
       - glance.name=Traefik
       - glance.url=https://traefik.forust.xyz/
       - glance.description=Traefik is a modern reverse proxy and load balancer
-      
+
     ports:
       - "80:80"
       - "443:443"
-      
+
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./dynamic:/etc/traefik/dynamic:ro
       - ./certs:/certs:ro
       - ./logs:/var/log/traefik
       # - ./traefik/letsencrypt:/letsencrypt
-      
+
     networks:
       - traefik-proxy
-      
+
     environment:
       - TZ=Europe/Bratislava
 
 networks:
   traefik-proxy:
-    external: true
\ No newline at end of file
+    external: true
diff --git a/traefik/dynamic/routers-dev.yml b/traefik/dynamic/routers-dev.yml.bak
similarity index 100%
rename from traefik/dynamic/routers-dev.yml
rename to traefik/dynamic/routers-dev.yml.bak
diff --git a/traefik/dynamic/routers-local.yml b/traefik/dynamic/routers-local.yml.bak
similarity index 100%
rename from traefik/dynamic/routers-local.yml
rename to traefik/dynamic/routers-local.yml.bak
diff --git a/traefik/dynamic/routers-prod.yml b/traefik/dynamic/routers-prod.yml.bak
similarity index 100%
rename from traefik/dynamic/routers-prod.yml
rename to traefik/dynamic/routers-prod.yml.bak
diff --git a/traefik/dynamic/services.yml b/traefik/dynamic/services.yml.bak
similarity index 100%
rename from traefik/dynamic/services.yml
rename to traefik/dynamic/services.yml.bak
diff --git a/uptime-kuma/compose.yaml b/uptime-kuma/compose.yaml
index d9d97fe..1f834ba 100644
--- a/uptime-kuma/compose.yaml
+++ b/uptime-kuma/compose.yaml
@@ -9,10 +9,26 @@ services:
       # <Host Port>:<Container Port>
       - "3001:3001"
     labels:
-    - "traefik.enable=true"
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
+      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma.tls=true"
+      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
+
+      # Local Router
+      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.local`) || Host(`uptime.local`)"
+      - "traefik.http.routers.uptime-kuma-local.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.uptime-kuma-dev.rule=Host(`uptime.gigaforust.local`)"
+      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-dev.tls=true"
     networks:
       - traefik-proxy
 networks:
   traefik-proxy:
-    external: true  
-    
\ No newline at end of file
+    external: true