diff --git a/.env.sample b/.env.sample
new file mode 100644
index 0000000..f968f88
--- /dev/null
+++ b/.env.sample
@@ -0,0 +1,5 @@
+SERVER_IP=
+DOMAIN=
+USERNAME=
+PASSWORD=
+EMAIL=
diff --git a/Makefile b/Makefile
index 23848ce..9f6adeb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,18 +1,11 @@
-deploy: validate files
-	scp ./*.env 192.168.1.20:/home/atomaka/docker
-	scp ./docker-compose.yml 192.168.1.20:/home/atomaka/docker
-	ssh 192.168.1.20 "cd /home/atomaka/docker && docker-compose up -d"
+include .env
+export
 
-files:
-	scp ./nginx.tmpl 192.168.1.20:/home/atomaka
-	ssh 192.168.1.20 "sudo mv /home/atomaka/nginx.tmpl /mnt/data/docker/nginx/templates/"
-	scp ./nginx.template.conf 192.168.1.20:/home/atomaka
-	ssh 192.168.1.20 "sudo mv /home/atomaka/nginx.template.conf /mnt/data/docker/haproxy/"
-	scp ./nginx.template.conf 192.168.1.20:/home/atomaka
-	ssh 192.168.1.20 "sudo mv /home/atomaka/nginx.template.conf /mnt/data/docker/hadashboardproxy/"
-
-network:
-	ssh 192.168.1.20 "docker network create nginx-proxy"
+deploy: validate
+	scp ./*.env $$SERVER_IP:/home/atomaka/docker
+	scp ./.env $$SERVER_IP:/home/atomaka/docker
+	scp ./docker-compose.yml $$SERVER_IP:/home/atomaka/docker
+	ssh $$SERVER_IP "cd /home/atomaka/docker && docker-compose up -d"
 
 validate:
 	docker-compose config > /dev/null
diff --git a/README.md b/README.md
index 8e3e3f9..a7014d3 100644
--- a/README.md
+++ b/README.md
@@ -8,3 +8,8 @@ Ports:
 * ha: 9056
 * portainer: 9057
 * unifi: 9058, 8081, 8443, 8843, 8880
+
+# Traefik Proxy into HA
+
+* Host network mode is issue.  This works with correct trusted proxy in HA
+  config but is likely to break on a fresh install.
diff --git a/docker-compose.yml b/docker-compose.yml
index 755cd15..0a4329e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,49 +1,165 @@
-version: '2'
+version: '3'
 
 services:
-  nginx:
-    image: nginx:alpine
-    container_name: nginx
+  traefik:
+    image: traefik:v2.3.1
+    container_name: traefik
+    restart: unless-stopped
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /mnt/data/docker/traefik/tls:/tls
+    environment:
+      PUID: 1000
+      PGID: 1000
+    env_file:
+    - traefik.env
+    ports:
+    - 443:443
+    command:
+    - --api
+    - --providers.docker=true
+    - --providers.docker.exposedbydefault=false
+    - --entrypoints.https.Address=:443
+    - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+    - --certificatesresolvers.letsencrypt.acme.email=${EMAIL}
+    - --certificatesresolvers.letsencrypt.acme.storage=/tls/letsencrypt.json
+    - --certificatesresolvers.ledns.acme.dnschallenge=true
+    - --certificatesresolvers.ledns.acme.dnschallenge.provider=cloudflare
+    - --certificatesresolvers.ledns.acme.email=${EMAIL}
+    - --certificatesresolvers.ledns.acme.storage=/tls/ledns.json
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.traefik.rule: Host(`traefik.${DOMAIN}`)
+      traefik.http.routers.traefik.entrypoints: https
+      traefik.http.routers.traefik.tls.certresolver: ledns
+      traefik.http.routers.traefik.service: api@internal
+      traefik.http.routers.traefik.middlewares: traefik-ips,traefik-auth
+      traefik.http.middlewares.traefik-ips.ipwhitelist.sourcerange: 127.0.0.1/32,172.16.0.0/12,192.168.1.0/24
+      traefik.http.middlewares.traefik-auth.basicauth.users: ${USERNAME}:${PASSWORD}
+
+  ha:
+    image: homeassistant/home-assistant:latest
+    depends_on:
+      - mqtt
+    container_name: ha
+    restart: unless-stopped
+    ports:
+    - 8123:8123
+    labels:
+    - traefik.enable=true
+    - traefik.backend=ha
+    - traefik.http.routers.ha.rule=Host(`ha.atomaka.com`)
+    - traefik.http.services.ha.loadbalancer.server.url=http://${SERVER_IP}:8123
+    - traefik.http.services.ha.loadbalancer.server.port=8123
+    - traefik.http.routers.ha.tls.certresolver=letsencrypt
+    - traefik.port=8123
+    volumes:
+    - /etc/localtime:/etc/localtime:ro
+    - /mnt/data/docker/ha/config:/config
+    devices:
+    - /dev/zwave:/dev/zwave:rwm
+  gitea:
+    container_name: gitea
+    image: gitea/gitea:1.8.3
+    volumes:
+    - /mnt/data/docker/gitea/data:/data
+    environment:
+    - USER_UID=1000
+    - USER_GID=1000
+    - DISABLE_REGISTRATION=true
+    ports:
+    - 3000
+    - "9062:22"
+    labels:
+    - traefik.enable=true
+    - traefik.backend=git
+    - traefik.http.routers.git.rule=Host(`git.${DOMAIN}`)
+    - traefik.http.routers.git.tls.certresolver=letsencrypt
+    - traefik.http.services.git.loadbalancer.server.port=3000
+
+  sonarr:
+    image: linuxserver/sonarr
+    container_name: sonarr
     restart: always
     ports:
-      - 443:443
-      - 80:80
-    volumes:
-      - /etc/nginx/conf.d
-      - /etc/nginx/vhost.d
-      - /usr/share/nginx/html
-      - /mnt/data/docker/nginx/htpasswd:/etc/nginx/htpasswd:ro
-      - /mnt/data/docker/nginx/certificates:/etc/nginx/certs:ro
-    networks:
-      - proxy
-  nginx-gen:
-    image: jwilder/docker-gen
-    container_name: nginx-gen
-    restart: always
-    depends_on:
-      - nginx
-    entrypoint: /usr/local/bin/docker-gen -notify-sighup nginx -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
-    volumes:
-      - /var/run/docker.sock:/tmp/docker.sock:ro
-      - /mnt/data/docker/nginx/templates/nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro
-    volumes_from:
-      - nginx
-    networks:
-      - proxy
-  letsencrypt:
-    image: jrcs/letsencrypt-nginx-proxy-companion
-    container_name: letsencrypt
-    restart: always
-    depends_on:
-      - nginx
-      - nginx-gen
-    volumes_from:
-      - nginx
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /mnt/data/docker/nginx/certificates:/etc/nginx/certs:rw
+    - 8989
     environment:
-      NGINX_DOCKER_GEN_CONTAINER: nginx-gen
+      PUID: 1000
+      PGID: 1000
+    volumes:
+    - /mnt/data/docker/sonarr/config:/config
+    - /mnt/data/downloads:/data
+    - /mnt/data/downloads:/downloads
+    - /mnt/media/series/:/media
+    - /etc/localtime:/etc/localtime:ro
+    labels:
+    - traefik.enable=true
+    - traefik.backend=sonarr
+    - traefik.http.routers.sonarr.rule=Host(`sonarr.${DOMAIN}`)
+    - traefik.http.routers.sonarr.tls.certresolver=ledns
+    - traefik.http.routers.sonarr.middlewares=sonarr@docker
+    - traefik.http.middlewares.sonarr.ipwhitelist.sourcerange=127.0.0.1/32,172.16.0.0/12,192.168.1.0/24
+  radarr:
+    image: linuxserver/radarr
+    container_name: radarr
+    restart: always
+    ports:
+    - 7878
+    environment:
+      PUID: 1000
+      PGID: 1000
+    volumes:
+    - /mnt/data/docker/radarr/config:/config
+    - /mnt/data/downloads:/data
+    - /mnt/data/downloads:/downloads
+    - /mnt/media/movies/:/media
+    - /mnt/media/movies/:/movies
+    - /etc/localtime:/etc/localtime:ro
+    labels:
+    - traefik.enable=true
+    - traefik.backend=radarr
+    - traefik.http.routers.radarr.rule=Host(`radarr.${DOMAIN}`)
+    - traefik.http.routers.radarr.tls.certresolver=ledns
+    - traefik.http.routers.radarr.middlewares=radarr@docker
+    - traefik.http.middlewares.radarr.ipwhitelist.sourcerange=127.0.0.1/32,172.16.0.0/12,192.168.1.0/24
+  sabnzbd:
+    image: linuxserver/sabnzbd
+    container_name: sabnzbd
+    restart: always
+    volumes:
+    - /mnt/data/docker/sabnzbd/config:/config
+    - /mnt/data/downloads:/data
+    - /etc/localtime:/etc/localtime:ro
+    environment:
+      PUID: 1000
+      PGID: 1000
+    ports:
+      - 9052:8080
+    labels:
+    - traefik.enable=true
+    - traefik.backend=sabnzbd
+    - traefik.http.routers.sabnzbd.rule=Host(`sabnzbd.${DOMAIN}`)
+    - traefik.http.routers.sabnzbd.tls.certresolver=ledns
+    - traefik.http.routers.sabnzbd.middlewares=sabnzbd@docker
+    - traefik.http.middlewares.sabnzbd.ipwhitelist.sourcerange=127.0.0.1/32,172.16.0.0/12,192.168.1.0/24
+  organizr:
+    image: lsiocommunity/organizr
+    container_name: organizr
+    restart: always
+    ports:
+    - 80
+    volumes:
+    - /mnt/data/docker/organizr/config:/config
+    - /etc/localtime:/etc/localtime:ro
+    labels:
+    - traefik.enable=true
+    - traefik.backend=organizr
+    - traefik.http.routers.organizr.rule=Host(`organizr.${DOMAIN}`)
+    - traefik.http.routers.organizr.tls.certresolver=ledns
+    - traefik.http.routers.organizr.middlewares=organizr@docker
+    - traefik.http.middlewares.organizr.ipwhitelist.sourcerange=127.0.0.1/32,172.16.0.0/12,192.168.1.0/24
+
+
   unifi:
     image: linuxserver/unifi
     container_name: unifi
@@ -89,69 +205,7 @@ services:
       PGID: 1000
     ports:
       - "9055:8181"
-  sonarr:
-    image: linuxserver/sonarr
-    container_name: sonarr
-    restart: always
-    ports:
-      - "9053:8989"
-    environment:
-      PUID: 1000
-      PGID: 1000
-    volumes:
-      - "/mnt/data/docker/sonarr/config:/config"
-      - "/mnt/data/downloads:/data"
-      - "/mnt/data/downloads:/downloads"
-      - "/mnt/media/series/:/media"
-      - "/etc/localtime:/etc/localtime:ro"
-  radarr:
-    image: linuxserver/radarr
-    container_name: radarr
-    restart: always
-    ports:
-      - "9054:7878"
-    environment:
-      PUID: 1000
-      PGID: 1000
-    volumes:
-      - "/mnt/data/docker/radarr/config:/config"
-      - "/mnt/data/downloads:/data"
-      - "/mnt/data/downloads:/downloads"
-      - "/mnt/media/movies/:/media"
-      - "/mnt/media/movies/:/movies"
-      - "/etc/localtime:/etc/localtime:ro"
-  readarr:
-    image: hotio/readarr:unstable-7bcd923
-    container_name: readarr
-    restart: always
-    ports:
-    - 9060:8787
-    environment:
-      PUID: 1000
-      PGID: 1000
-    volumes:
-      - "/etc/localtime:/etc/localtime:ro"
-      - "/mnt/data/docker/readarr/config:/config"
-      - "/mnt/media/books/:/books"
-      - "/mnt/data/downloads/complete/book:/downloads"
-  muximux:
-    image: linuxserver/muximux
-    container_name: muximux
-    restart: always
-    ports:
-      - "9050:80"
-    volumes:
-      - "/mnt/data/docker/muximux/config:/config"
-      - "/etc/localtime:/etc/localtime:ro"
-  organizr:
-    image: lsiocommunity/organizr
-    container_name: organizr
-    restart: always
-    ports:
-      - "9040:80"
-    volumes:
-      - "/mnt/data/docker/organizr/config:/config"
-      - "/etc/localtime:/etc/localtime:ro"
+
   duckdns:
     image: linuxserver/duckdns
     container_name: duckdns
@@ -160,88 +214,12 @@ services:
       PUID: 1000
       PGID: 1000
     env_file:
-      - duckdns.env
+    - duckdns.env
     volumes:
-      - "/etc/localtime:/etc/localtime:ro"
-  haproxy:
-    image: instal/nginx-proxy-pass-dockerize
-    container_name: haproxy
-    restart: always
-    volumes:
-      - /mnt/data/docker/haproxy/nginx.template.conf:/app/nginx.template.conf:ro
-    environment:
-      NGINX_UPSTREAM_SERVER: 192.168.1.20:8123
-      NGINX_UPSTREAM_KEEPALIVE: 0
-      NGINX_SERVER_PORT: 80
-      VIRTUAL_HOST: ha.atomaka.com
-      LETSENCRYPT_HOST: ha.atomaka.com
-      LETSENCRYPT_EMAIL: me@atomaka.com
-    networks:
-      - proxy
-  ha:
-    image: homeassistant/home-assistant:latest
-    depends_on:
-      - mqtt
-    container_name: ha
-    restart: always
-    network_mode: host
-    ports:
-      - "8123:8123"
-    volumes:
-      - "/etc/localtime:/etc/localtime:ro"
-      - "/mnt/data/docker/ha/config:/config"
-    devices:
-      - '/dev/zwave:/dev/zwave:rwm'
-  portainer:
-    image: portainer/portainer
-    container_name: portainer
-    restart: always
-    ports:
-      - "9057:9000"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
-      - "/mnt/data/docker/portainer:/data"
+    - /etc/localtime:/etc/localtime:ro
   mqtt:
     image: eclipse-mosquitto
     container_name: mqtt
     restart: always
     ports:
-      - 1883:1883
-
-  sabnzbd:
-    image: linuxserver/sabnzbd
-    container_name: sabnzbd
-    restart: always
-    volumes:
-      - "/mnt/data/docker/sabnzbd/config:/config"
-      - "/mnt/data/downloads:/data"
-      - "/etc/localtime:/etc/localtime:ro"
-    environment:
-      PUID: 1000
-      PGID: 1000
-    ports:
-      - "9052:8080"
-
-  gitea:
-    image: gitea/gitea:1.8.3
-    volumes:
-    - /mnt/data/docker/gitea/data:/data
-    environment:
-    - USER_UID=1000
-    - USER_GID=1000
-    - DISABLE_REGISTRATION=true
-    ports:
-    - "9061:3000"
-    - "9062:22"
-  irc:
-    image: thelounge/thelounge:latest
-    container_name: thelounge
-    volumes:
-    - /mnt/data/docker/thelounge/config:/var/opt/thelounge
-    ports:
-    - 9063:9000
-
-networks:
-  proxy:
-    external:
-      name: nginx-proxy
+    - 1883:1883
diff --git a/duckdns.env.sample b/duckdns.env.sample
index 6b12920..9de1ecd 100644
--- a/duckdns.env.sample
+++ b/duckdns.env.sample
@@ -1,2 +1,2 @@
-export TOKEN=
-export SUBDOMAINS=
+TOKEN=
+SUBDOMAINS=
diff --git a/nginx.template.conf b/nginx.template.conf
deleted file mode 100644
index 06a98f3..0000000
--- a/nginx.template.conf
+++ /dev/null
@@ -1,109 +0,0 @@
-#
-# A very simple example configuration showing how to launch Nginx as a non-root
-# user without sudo access.
-#
-# Adjust the paths and other settings for your specific circumstances. They are
-# currently configured for transient usage - you'd want to pick more permanent
-# locations in the filesystem if intending this to run for a while.
-#
-# Note that as Nginx is not launched as root, it cannot bind to privileged
-# ports lower than 1024.
-#
-# Usage: nginx -c /path/to/this/nginx.conf
-#
-daemon off;
-
-# This error log will be written regardless of server scope error_log
-# definitions, so we have to set this here in the main scope.
-#
-# Even doing this, Nginx will still try to create the default error file, and
-# log a non-fatal error when it fails. After that things will work, however.
-error_log /dev/stdout {{ NGINX_ERROR_LOGLEVEL }};
-
-# The pidfile will be written to /var/run unless this is set.
-pid /tmp/nginx.pid;
-
-# user nobody nogroup;
-
-worker_processes {{ NGINX_WORKER_PROCESSES }};
-
-events {
-    worker_connections {{ NGINX_WORKER_CONNECTIONS }};
-    multi_accept {{ NGINX_MULTI_ACCEPT }};
-}
-
-http {
-    log_format timed_combined '[$time_local] "$request" $status $body_bytes_sent "$http_referer" '
-                              '"$http_user_agent" $request_time $upstream_response_time $remote_addr "$http_x_forwarded_for"';
-
-    {% if NGINX_ACCESS_LOG_TO_STDOUT == "true" %}
-    access_log /dev/stdout timed_combined;
-    {% else %}
-    access_log  off;
-    {% endif %}
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        ''      close;
-    }
-
-    upstream main_upstream {
-        server {{ NGINX_UPSTREAM_SERVER }};
-        {% if NGINX_UPSTREAM_KEEPALIVE|int > 0 %}
-        keepalive {{ NGINX_UPSTREAM_KEEPALIVE }};
-        {% endif %}
-    }
-
-    server {
-        listen {{ NGINX_SERVER_PORT }};
-        {% if NGINX_HOSTNAME %}
-        server_name {{ NGINX_EXTRA_SERVER_NAMES }} {{ NGINX_HOSTNAME }};
-        {% endif %}
-        client_max_body_size {{ NGINX_CLIENT_MAX_BODY_SIZE }};
-        client_body_timeout {{ NGINX_CLIENT_BODY_TIMEOUT }};
-        fastcgi_read_timeout {{ NGINX_FASTCGI_READ_TIMEOUT }};
-        proxy_read_timeout {{ NGINX_PROXY_READ_TIMEOUT }};
-
-        location = {{ NGINX_HEALTHCHECK_PATH }} {
-            return 200;
-        }
-
-        location ~ / {
-            gzip_types {{ NGINX_GZIP_TYPES }};
-            proxy_pass http://main_upstream;
-            proxy_http_version 1.1;
-            proxy_redirect off;
-            proxy_set_header Host $host;
-            proxy_set_header Connection "";
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-
-            # https://blog.percy.io/tuning-nginx-behind-google-cloud-platform-http-s-load-balancer-305982ddb340
-            keepalive_timeout {{ NGINX_KEEPALIVE_TIMEOUT }};
-            keepalive_requests {{ NGINX_KEEPALIVE_REQUESTS }};
-
-            {% if NGINX_CORS_DOMAINS %}
-            if ($request_method ~* "(GET|POST|PUT|DELETE)") {
-              add_header "Access-Control-Allow-Origin"  {{ NGINX_CORS_DOMAINS }};
-            }
-            if ($request_method = OPTIONS ) {
-              add_header "Access-Control-Allow-Origin"  {{ NGINX_CORS_DOMAINS }};
-              add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS, DELETE";
-              add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept";
-              return 200;
-            }
-            {% endif %}
-        }
-    }
-
-    {% if NGINX_HOST_REWRITE_ENABLED %}
-    server {
-        listen {{ NGINX_SERVER_PORT }};
-        server_name   {{ NGINX_HOST_REWRITE_SERVER_NAMES }};
-        return 301 $scheme://{{ NGINX_HOSTNAME }}$request_uri;
-    }
-    {% endif %}
-}
-
diff --git a/nginx.tmpl b/nginx.tmpl
deleted file mode 100644
index b03ce6b..0000000
--- a/nginx.tmpl
+++ /dev/null
@@ -1,333 +0,0 @@
-{{ $CurrentContainer := where $ "ID" .Docker.CurrentContainerID | first }}
-
-{{ define "upstream" }}
-	{{ if .Address }}
-		{{/* If we got the containers from swarm and this container's port is published to host, use host IP:PORT */}}
-		{{ if and .Container.Node.ID .Address.HostPort }}
-			# {{ .Container.Node.Name }}/{{ .Container.Name }}
-			server {{ .Container.Node.Address.IP }}:{{ .Address.HostPort }};
-		{{/* If there is no swarm node or the port is not published on host, use container's IP:PORT */}}
-		{{ else if .Network }}
-			# {{ .Container.Name }}
-			server {{ .Network.IP }}:{{ .Address.Port }};
-		{{ end }}
-	{{ else if .Network }}
-		# {{ .Container.Name }}
-		server {{ .Network.IP }} down;
-	{{ end }}
-{{ end }}
-
-# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
-# scheme used to connect to this server
-map $http_x_forwarded_proto $proxy_x_forwarded_proto {
-  default $http_x_forwarded_proto;
-  ''      $scheme;
-}
-
-# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
-# server port the client connected to
-map $http_x_forwarded_port $proxy_x_forwarded_port {
-  default $http_x_forwarded_port;
-  ''      $server_port;
-}
-
-# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
-# Connection header that may have been passed to this server
-map $http_upgrade $proxy_connection {
-  default upgrade;
-  '' close;
-}
-
-# Apply fix for very long server names
-server_names_hash_bucket_size 128;
-
-# Default dhparam
-{{ if (exists "/etc/nginx/dhparam/dhparam.pem") }}
-ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
-{{ end }}
-
-# Set appropriate X-Forwarded-Ssl header
-map $scheme $proxy_x_forwarded_ssl {
-  default off;
-  https on;
-}
-
-gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
-
-log_format vhost '$host $remote_addr - $remote_user [$time_local] '
-                 '"$request" $status $body_bytes_sent '
-                 '"$http_referer" "$http_user_agent"';
-
-access_log off;
-
-{{ if $.Env.RESOLVERS }}
-resolver {{ $.Env.RESOLVERS }};
-{{ end }}
-
-{{ if (exists "/etc/nginx/proxy.conf") }}
-include /etc/nginx/proxy.conf;
-{{ else }}
-# HTTP 1.1 support
-proxy_http_version 1.1;
-proxy_buffering off;
-proxy_set_header Host $http_host;
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $proxy_connection;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
-proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-
-# Mitigate httpoxy attack (see README for details)
-proxy_set_header Proxy "";
-
-# Use forwarded IP
-set_real_ip_from 172.17.0.0/16;
-set_real_ip_from 172.18.0.0/16;
-set_real_ip_from 172.19.0.0/16;
-set_real_ip_from 192.168.1.0/24;
-{{ end }}
-
-{{ $enable_ipv6 := eq (or ($.Env.ENABLE_IPV6) "") "true" }}
-server {
-	server_name _; # This is just an invalid value which will never trigger on a real hostname.
-	listen 80;
-	{{ if $enable_ipv6 }}
-	listen [::]:80;
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-	return 503;
-}
-
-{{ if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
-server {
-	server_name _; # This is just an invalid value which will never trigger on a real hostname.
-	listen 443 ssl http2;
-	{{ if $enable_ipv6 }}
-	listen [::]:443 ssl http2;
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-	return 503;
-
-	ssl_session_tickets off;
-	ssl_certificate /etc/nginx/certs/default.crt;
-	ssl_certificate_key /etc/nginx/certs/default.key;
-}
-{{ end }}
-
-{{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }}
-
-{{ $host := trim $host }}
-{{ $is_regexp := hasPrefix "~" $host }}
-{{ $upstream_name := when $is_regexp (sha1 $host) $host }}
-
-# {{ $host }}
-upstream {{ $upstream_name }} {
-
-{{ range $container := $containers }}
-	{{ $addrLen := len $container.Addresses }}
-
-	{{ range $knownNetwork := $CurrentContainer.Networks }}
-		{{ range $containerNetwork := $container.Networks }}
-			{{ if (and (ne $containerNetwork.Name "ingress") (or (eq $knownNetwork.Name $containerNetwork.Name) (eq $knownNetwork.Name "host"))) }}
-				## Can be connect with "{{ $containerNetwork.Name }}" network
-
-				{{/* If only 1 port exposed, use that */}}
-				{{ if eq $addrLen 1 }}
-					{{ $address := index $container.Addresses 0 }}
-					{{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
-				{{/* If more than one port exposed, use the one matching VIRTUAL_PORT env var, falling back to standard web port 80 */}}
-				{{ else }}
-					{{ $port := coalesce $container.Env.VIRTUAL_PORT "80" }}
-					{{ $address := where $container.Addresses "Port" $port | first }}
-					{{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
-				{{ end }}
-			{{ end }}
-		{{ end }}
-	{{ end }}
-{{ end }}
-}
-
-{{ $default_host := or ($.Env.DEFAULT_HOST) "" }}
-{{ $default_server := index (dict $host "" $default_host "default_server") $host }}
-
-{{/* Get the VIRTUAL_PROTO defined by containers w/ the same vhost, falling back to "http" */}}
-{{ $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}
-
-{{/* Get the NETWORK_ACCESS defined by containers w/ the same vhost, falling back to "external" */}}
-{{ $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}
-
-{{/* Get the NETWORK_ACCESS defined by containers w/ the same vhost, falling back to "external" */}}
-{{ $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}
-
-{{/* Get the HTTPS_METHOD defined by containers w/ the same vhost, falling back to "redirect" */}}
-{{ $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) "redirect" }}
-
-{{/* Get the HSTS defined by containers w/ the same vhost, falling back to "max-age=31536000" */}}
-{{ $hsts := or (first (groupByKeys $containers "Env.HSTS")) "max-age=31536000" }}
-
-{{/* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
-{{ $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
-
-
-{{/* Get the first cert name defined by containers w/ the same vhost */}}
-{{ $certName := (first (groupByKeys $containers "Env.CERT_NAME")) }}
-
-{{/* Get the best matching cert  by name for the vhost. */}}
-{{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}}
-
-{{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
-{{ $vhostCert := trimSuffix ".crt" $vhostCert }}
-{{ $vhostCert := trimSuffix ".key" $vhostCert }}
-
-{{/* Use the cert specified on the container or fallback to the best vhost match */}}
-{{ $cert := (coalesce $certName $vhostCert) }}
-
-{{ $is_https := (and (ne $https_method "nohttps") (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert))) }}
-
-{{ if $is_https }}
-
-{{ if eq $https_method "redirect" }}
-server {
-	server_name {{ $host }};
-	listen 80 {{ $default_server }};
-	{{ if $enable_ipv6 }}
-	listen [::]:80 {{ $default_server }};
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-	return 301 https://$host$request_uri;
-}
-{{ end }}
-
-server {
-	server_name {{ $host }};
-	listen 443 ssl http2 {{ $default_server }};
-	{{ if $enable_ipv6 }}
-	listen [::]:443 ssl http2 {{ $default_server }};
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-
-	{{ if eq $network_tag "internal" }}
-	# Only allow traffic from internal clients
-	include /etc/nginx/network_internal.conf;
-	{{ end }}
-
-	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
-
-	ssl_prefer_server_ciphers on;
-	ssl_session_timeout 5m;
-	ssl_session_cache shared:SSL:50m;
-	ssl_session_tickets off;
-
-	ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
-	ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
-
-	{{ if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
-	ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
-	{{ end }}
-
-	{{ if (exists (printf "/etc/nginx/certs/%s.chain.crt" $cert)) }}
-	ssl_stapling on;
-	ssl_stapling_verify on;
-	ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.crt" $cert }};
-	{{ end }}
-
-	{{ if (and (ne $https_method "noredirect") (ne $hsts "off")) }}
-	add_header Strict-Transport-Security "{{ trim $hsts }}";
-	{{ end }}
-
-	{{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
-	include {{ printf "/etc/nginx/vhost.d/%s" $host }};
-	{{ else if (exists "/etc/nginx/vhost.d/default") }}
-	include /etc/nginx/vhost.d/default;
-	{{ end }}
-
-	location / {
-		{{ if eq $proto "uwsgi" }}
-		include uwsgi_params;
-		uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
-		{{ else if eq $proto "fastcgi" }}
-		root   {{ trim $vhost_root }};
-		include fastcgi.conf;
-		fastcgi_pass {{ trim $upstream_name }};
-		{{ else }}
-		proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
-		{{ end }}
-
-		{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
-		auth_basic	"Restricted {{ $host }}";
-		auth_basic_user_file	{{ (printf "/etc/nginx/htpasswd/%s" $host) }};
-		{{ end }}
-		{{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
-		include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
-		{{ else if (exists "/etc/nginx/vhost.d/default_location") }}
-		include /etc/nginx/vhost.d/default_location;
-		{{ end }}
-	}
-}
-
-{{ end }}
-
-{{ if or (not $is_https) (eq $https_method "noredirect") }}
-
-server {
-	server_name {{ $host }};
-	listen 80 {{ $default_server }};
-	{{ if $enable_ipv6 }}
-	listen [::]:80 {{ $default_server }};
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-
-	{{ if eq $network_tag "internal" }}
-	# Only allow traffic from internal clients
-	include /etc/nginx/network_internal.conf;
-	{{ end }}
-
-	{{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
-	include {{ printf "/etc/nginx/vhost.d/%s" $host }};
-	{{ else if (exists "/etc/nginx/vhost.d/default") }}
-	include /etc/nginx/vhost.d/default;
-	{{ end }}
-
-	location / {
-		{{ if eq $proto "uwsgi" }}
-		include uwsgi_params;
-		uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
-		{{ else if eq $proto "fastcgi" }}
-		root   {{ trim $vhost_root }};
-		include fastcgi.conf;
-		fastcgi_pass {{ trim $upstream_name }};
-		{{ else }}
-		proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
-		{{ end }}
-		{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
-		auth_basic	"Restricted {{ $host }}";
-		auth_basic_user_file	{{ (printf "/etc/nginx/htpasswd/%s" $host) }};
-		{{ end }}
-		{{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
-		include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
-		{{ else if (exists "/etc/nginx/vhost.d/default_location") }}
-		include /etc/nginx/vhost.d/default_location;
-		{{ end }}
-	}
-}
-
-{{ if (and (not $is_https) (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
-server {
-	server_name {{ $host }};
-	listen 443 ssl http2 {{ $default_server }};
-	{{ if $enable_ipv6 }}
-	listen [::]:443 ssl http2 {{ $default_server }};
-	{{ end }}
-	access_log /var/log/nginx/access.log vhost;
-	return 500;
-
-	ssl_certificate /etc/nginx/certs/default.crt;
-	ssl_certificate_key /etc/nginx/certs/default.key;
-}
-{{ end }}
-
-{{ end }}
-{{ end }}
diff --git a/traefik.env.sample b/traefik.env.sample
new file mode 100644
index 0000000..9329907
--- /dev/null
+++ b/traefik.env.sample
@@ -0,0 +1,2 @@
+CLOUDFLARE_DNS_API_TOKEN=
+CF_DNS_API_TOKEN=