diff --git a/flake.lock b/flake.lock
index 4b43c5b..cf43fbd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -131,11 +131,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785483748,
-        "narHash": "sha256-M4HXpLsR7iFTNQfD/q+zK8/QeRYztYVDVIdIgCVGGZ0=",
+        "lastModified": 1785747939,
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "59ea0b1c043c463e39fcb3cfb9a5c8bcf0777c72",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
diff --git a/hosts/plato/configuration.nix b/hosts/plato/configuration.nix
index dd694a3..a374e44 100644
--- a/hosts/plato/configuration.nix
+++ b/hosts/plato/configuration.nix
@@ -23,6 +23,7 @@ in
     ../../nix/modules/minecraft
     ../../nix/modules/postgresql
     ../../nix/modules/sops
+    ../../nix/modules/traefik
   ];
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
diff --git a/nix/modules/traefik/default.nix b/nix/modules/traefik/default.nix
new file mode 100644
index 0000000..219928c
--- /dev/null
+++ b/nix/modules/traefik/default.nix
@@ -0,0 +1,51 @@
+{ config, ... }:
+
+{
+  services.traefik = {
+    enable = true;
+    group = "docker";
+    environmentFiles = [
+      config.sops.secrets.traefik.path
+    ];
+    staticConfigOptions = {
+      api = {
+        dashboard = true;
+        insecure = true;
+      };
+      certificatesResolvers = {
+        letsencrypt = {
+          acme = {
+            email = "walkah@walkah.net";
+            storage = "/var/lib/traefik/acme.json";
+            dnsChallenge = {
+              provider = "cloudflare";
+            };
+          };
+        };
+      };
+      entryPoints = {
+        web = {
+          address = ":80";
+          http = {
+            redirections = {
+              entryPoint = {
+                to = "websecure";
+                scheme = "https";
+              };
+            };
+          };
+        };
+        websecure = {
+          address = ":443";
+        };
+      };
+      providers = {
+        docker = { };
+      };
+    };
+  };
+
+  sops.secrets.traefik = {
+    owner = "traefik";
+  };
+}
diff --git a/nix/secrets/secrets.yaml b/nix/secrets/secrets.yaml
index b177853..0cb62a1 100644
--- a/nix/secrets/secrets.yaml
+++ b/nix/secrets/secrets.yaml
@@ -10,10 +10,10 @@ filesystems-parthenon: ENC[AES256_GCM,data:dYO+QjvWhR3oXrDfAEaUvTLx147NIDFcPUa7p
 upsmon: ENC[AES256_GCM,data:Rlqkhh7w8S9jD3mwUdkt3g==,iv:hiMkbAhea1f6r5gGTRw49ebepMtTYBVyH+bHwp/T61Q=,tag:cbaxIDuD4JNeCC5MiMGl6w==,type:str]
 k3s-token: ENC[AES256_GCM,data:dyyFY/ruyCfAdQmmdD1eDPKhBWkbgElbFQgMjGALrM8OeTXRiiV18AwG1ZGtw+j3CBmladwBf0+gcfC0ojKHlA==,iv:j4IOIZegDMJik6shOhUZGyI0N8TD1yMDcOacArgM05Q=,tag:t91uRzF8RgxLF/f2M+9Wgg==,type:str]
 grafana-secret-key: ENC[AES256_GCM,data:rhKhCNsAC2W8+jAUtNncdaB0GMw=,iv:idADKz1QhjWobaYz+3azH+284HxYkSLsk49eDpTIREw=,tag:bECZcH2Tzj3SHaUzllFBJw==,type:str]
+traefik: ENC[AES256_GCM,data:OgHgpC8lGAyQRuHsTO4huVAmfSRAMugQYFYNVvbprtcbJO5GJlZmMDZojv531GEoYhce3w0NWTwXP+khRZ37Y57eEi1Huxk=,iv:roIUr242rsGQhXqVyv3LE5bJroH2xFA1MPjdL7M5lsM=,tag:u5YEiDr/BxL9lGxaJ4nTeA==,type:str]
 sops:
     age:
-        - recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOT3gyL29ETGNYSTNBMHhx
             RUVNRmdpZm9TZTdJNTJCOSt5blZ3T2JLVlhVCldaTjhaanBrWTVIOWJQQ1VJUTUw
@@ -21,8 +21,8 @@ sops:
             WlhMcDM3RlF5Y3FkRXczbWNHQWNrVjAKx77NlnVTab75G2QTiuEmAyI10m2ZbMjc
             IyVWoRabZY96J/HYiZaURZY5Aq10Opa9vTp0xXL0FxLwF0Bclr7J+Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
-          enc: |
+          recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzY3hRcjZsZDBjb1FtWElx
             ODV3Q0g2Q0QveEUrMkRIZlJSbDBBdjlHZ25ZCmxvcngwN1V4RkJLL1NzWkw4bjNF
@@ -30,8 +30,8 @@ sops:
             QW0zMzJtMzNSaEJldzJITDAvZExtcFUKTovVFKkl40WdXOji8xWKZ8eZcEXU64uz
             4K7fqyhchzu+PB1xVMYeSahIYTh2oZGSKXi8nnTBwz2cPLJmy/8Biw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
-          enc: |
+          recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYlZtbC9sSXhzYUU2bnBZ
             ZmpKUk5BcHdGbTJ3b0xhRTVxMXIxOXJYSmpNCkdWQ3hJV0t0OVcwNmYwaVh5V3VJ
@@ -39,8 +39,8 @@ sops:
             eGV5Vk54dzNWSlFGTWc1akxHUmhiQ28KzAs/krsXZxcRQpefv5ncqbZ6D9Mr8HDl
             9Ir35JL2HhZv3wtMUK9TQVINmbPiPGf9mzVoiCQ7Nq9J80wzt/A53Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
-          enc: |
+          recipient: age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeDI0QXE4L0tBWDd3dmVI
             TlN3RlBNYjNCUkZMWGUwVEtkZHU4UTVYdWw4CnMvT09sU0EyVllSM1VSRXhsL2FF
@@ -48,8 +48,8 @@ sops:
             ZnBaRUJMSy9sSTIwUzR0U1JsRFhJWnMKOyIeYJquwLWqmLVqMNRCLK1U/10ILBEu
             FX+kU8c5qrpsSoMjNfy/h9QCF/5u+9CV/9wHw2HONN0CAwWlYrDgdw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
-          enc: |
+          recipient: age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6a2JmV1hQb0FHekpzVWVL
             d1RzdEoxVmZWQ25XT2hkYmtESFIrNFc1N1Y0Cmx4dEZrRnhDZDlGRXJPVGRpa0l5
@@ -57,8 +57,8 @@ sops:
             K29DeVBqWUs0ejRUVUd2SkpVYzd1UEkK0/AHkZ7gKouHi26nsZsr4CpmDu+jbKx6
             BA7VAwCI0nBP5sOgNXbsmYhgyAlaz28tybNXV+QzCnJiyTXhZM5F8w==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
-          enc: |
+          recipient: age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiS1BMUFU5T05PM2Z1Zk96
             N3FYTWp3bWtwMDZ4QVdVMEVLaTFueE9Od1JJCjdtMUNRa1JGWUkxRTZueS9vSGdx
@@ -66,8 +66,8 @@ sops:
             SStpZHdKZGN0NGNieldPY2JTcnJ4ZW8Kz5u/fJjkwi8vJh3CB7K0S7+b9gzOhsvW
             +0lfMGT+Dtbchq8O1wsCoBfe8I5kV2QlXJxTU7o4BASFKfNzX9E4gA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
-          enc: |
+          recipient: age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa2pHd2dvNHBwcW85SnNy
             aSt4ZElQdGZLMW5GNnIyc2NxY1J2MEk1c0RjCmJiMEY5cklnWVVHN25ST2JSWEhT
@@ -75,7 +75,8 @@ sops:
             WlZuY2ExWWJ1VzBpY2kzaUZCcVJMZHcKoqKBQEe+3UnAhqbc7Nq8zgEVoFFjryaY
             c8ALKqMIaMjAeA8ZU4ZTIu13pMYcJ+gAlPATt0vmsTn0Q0XIiudpJQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-01T19:54:48Z"
-    mac: ENC[AES256_GCM,data:XElBU/9U79q9GakpD6/w/YvvOzW/vekIR2Anisf8XX7b2hTSjkSW9eJb4Lu56PbqvoXiTPrprbliJEmbf2vaNkVH2trWhjHN0kznR93ZWFFZkDFJlslNmEBDJiOs4Wy5w8Q9mDRxpTpo7J+MZ+dBPp1gKAPPFi8y3I1JNzyOjvU=,iv:LFQIndLG60TE7EaMaqKhJdWU81FsE4YynchmxUzN498=,tag:Elp+q/O/Jl7veAO2qpwBqA==,type:str]
+          recipient: age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
+    lastmodified: "2026-07-31T23:40:27Z"
+    mac: ENC[AES256_GCM,data:93L4ztySckDnKKaCgjQ91V4uJVyEyBOtoVp7taY+I7XPXpAr43NgtQNiMGzBLvSMij1aL+BqYt7i8SSdrfzYF+Vp8MyV269djYEqQLAlsntj2O3mZ+4LORB8S7QSY7kdKakA4v14I0kqoBrFlqVEFLle89wMenxZG28TH4v215M=,iv:/W4vUylLtJxUUgi5MjMhVI+Lhg5w/k1NRuPlWDOMS9o=,tag:j9v6rd5Wsgh1EBxUOh40eQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.3