diff --git a/dynamic.yml b/dynamic.yml
old mode 100755
new mode 100644
index 301c501..d258839
--- a/dynamic.yml
+++ b/dynamic.yml
@@ -1,185 +1,31 @@
 http:
   routers:
-    traefik-dashboard:
-      rule: "Host(`traefik.dfnk`)"
+    media-fallback-public:
+      # rule: "HostRegexp(`{host:.+}`)" 
+      # rule: "Host(`whoami1.riverrooks.dev`)"
+      # rule: "Host(`*.riverrooks.dev`)"
+      rule: 'HostRegexp(`^[a-z0-9-]+\.riverrooks\.dev$`)'
+      priority: 1
       entrypoints:
-        - "websecure"
-      service: "api@internal"
-      tls: {}
-    proxmox-main:
-      rule: "Host(`prox.dfnk`)"
-      entrypoints: 
-        - "websecure"
-      service: "proxmox-main-service"
-      tls: {}
-    jellyfin-private:
-      rule: "Host(`watch.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "jellyfin-main-service"
-      tls: {}
-    jellyfin-public:
-      rule: "Host(`watch.riverrooks.dev`)"
-      entrypoints:
-        - "websecure"
-      service: "jellyfin-main-service"
+        - websecure
+      service: remote-traefik-svc
       tls:
-        certResolver: "basic"
-    homepage:
-      rule: "Host(`home.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "homepage-main-service"
-      tls: {}
-    qbittorrent:
-      rule: "Host(`tor.dfnk`)"
-      entrypoints:
-        - "websecure"
-      tls: {}
-      service: "qbittorrent-main-service"
-    seer:
-      rule: "Host(`seer.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "seer-main-service"
-      tls: {}
-    radarr:
-      rule: "Host(`radarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "radarr-main-service"
-      tls: {}
-    sonarr:
-      rule: "Host(`sonarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "sonarr-main-service"
-      tls: {}
-    lidarr:
-      rule: "Host(`lidarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "lidarr-main-service"
-      tls: {}
-    readarr:
-      rule: "Host(`readarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "readarr-main-service"
-      tls: {}
-    prowlarr:
-      rule: "Host(`prowlarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "prowlarr-main-service"
-      tls: {}
-    bazarr:
-      rule: "Host(`bazarr.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "bazarr-main-service"
-      tls: {}
-    dockge:
-      rule: "Host(`dockge.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "dockge-main-service"
-      tls: {}
-    uptime:
-      rule: "Host(`uptime.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "uptime-main-service"
-      tls: {}
-    files:
-      rule: "Host(`files.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "filebrowser-main-service"
-      tls: {}
-    truenas:
-      rule: "Host(`truenas.dfnk`)"
-      entrypoints:
-        - "websecure"
-      service: "truenas-main-service"
-      tls: {}
+        certResolver: desecresolver # Here the VPS terminates TLS
+        domains:
+          - main: "riverrooks.dev"
+            sans:
+              - "*.riverrooks.dev"
 
+    media-fallback-private:
+      rule: 'HostRegexp(`^[a-z0-9-]+\.dfnk$`)'
+      priority: 1
+      entrypoints:
+        - websecure
+      service: remote-traefik-svc
+      tls: {}
 
   services:
-    proxmox-main-service:
-      loadbalancer:
-        servers:
-          - url: "https://10.8.0.2:8006"
-        serversTransport: "insecure-backend"
-    jellyfin-main-service:
+    remote-traefik-svc:
       loadBalancer:
         servers:
-          - url: "http://192.168.1.35:8096"
-    qbittorrent-main-service:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.35:8080"
-    homepage-main-service:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.35:3000"
-    radarr-main-service:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.35:7878"
-    seer-main-service:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.35:5055"
-    sonarr-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:8989"
-    lidarr-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:8686"
-        # serversTransport: "insecure-backend"
-    readarr-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:8787"
-        # serversTransport: "insecure-backend"
-    bazarr-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:6767"
-        # serversTransport: "insecure-backend"
-    prowlarr-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:9696"
-        # serversTransport: "insecure-backend"
-    dockge-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:5001"
-        # serversTransport: "insecure-backend"
-    filebrowser-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:8085"
-        # serversTransport: "insecure-backend"
-    uptime-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.35:3002"
-    truenas-main-service:
-      loadbalancer:
-        servers:
-          - url: "http://192.168.1.34"
-        # serversTransport: "insecure-backend"
-
-  serversTransports:
-    insecure-backend:
-      insecureSkipVerify: true
-
-tls:
-  certificates:
-    - certFile: /letsencrypt/_wildcard.dfnk.pem
-      keyFile: /letsencrypt/_wildcard.dfnk-key.pem
+          - url: "http://192.168.1.35:80"
diff --git a/dynamic.yml.bkp b/dynamic.yml.bkp
new file mode 100755
index 0000000..a880383
--- /dev/null
+++ b/dynamic.yml.bkp
@@ -0,0 +1,211 @@
+http:
+  routers:
+    traefik-dashboard:
+      rule: "Host(`traefik.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "api@internal"
+      tls: {}
+    proxmox-main:
+      rule: "Host(`prox.dfnk`)"
+      entrypoints: 
+        - "websecure"
+      service: "proxmox-main-service"
+      tls: {}
+    jellyfin-private:
+      rule: "Host(`watch.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls: {}
+    jellyfin-public:
+      rule: "Host(`watch.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls:
+        certResolver: "basic"
+    homepage:
+      rule: "Host(`home.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "homepage-main-service"
+      tls: {}
+    qbittorrent:
+      rule: "Host(`tor.dfnk`)"
+      entrypoints:
+        - "websecure"
+      tls: {}
+      service: "qbittorrent-main-service"
+    seer:
+      rule: "Host(`seer.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "seer-main-service"
+      tls: {}
+    radarr:
+      rule: "Host(`radarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "radarr-main-service"
+      tls: {}
+    sonarr:
+      rule: "Host(`sonarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "sonarr-main-service"
+      tls: {}
+    lidarr:
+      rule: "Host(`lidarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "lidarr-main-service"
+      tls: {}
+    readarr:
+      rule: "Host(`readarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "readarr-main-service"
+      tls: {}
+    prowlarr:
+      rule: "Host(`prowlarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "prowlarr-main-service"
+      tls: {}
+    bazarr:
+      rule: "Host(`bazarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "bazarr-main-service"
+      tls: {}
+    dockge:
+      rule: "Host(`dockge.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "dockge-main-service"
+      tls: {}
+    uptime:
+      rule: "Host(`uptime.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "uptime-main-service"
+      tls: {}
+    files:
+      rule: "Host(`files.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "filebrowser-main-service"
+      tls: {}
+    truenas:
+      rule: "Host(`truenas.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "truenas-main-service"
+      tls: {}
+    soulseek:
+      rule: "Host(`slsk.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "soulseek-main-service"
+      tls: {}
+    navidrome:
+      rule: "Host(`music.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls: {}
+    navidrome-public:
+      rule: "Host(`music.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls:
+        certResolver: "basic"
+
+  services:
+    proxmox-main-service:
+      loadbalancer:
+        servers:
+          - url: "https://10.8.0.2:8006"
+        serversTransport: "insecure-backend"
+    jellyfin-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8096"
+    qbittorrent-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8080"
+    homepage-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:3000"
+    radarr-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:7878"
+    seer-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:5055"
+    sonarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8989"
+    lidarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8686"
+        # serversTransport: "insecure-backend"
+    readarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8787"
+        # serversTransport: "insecure-backend"
+    bazarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:6767"
+        # serversTransport: "insecure-backend"
+    prowlarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:9696"
+        # serversTransport: "insecure-backend"
+    dockge-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5001"
+        # serversTransport: "insecure-backend"
+    filebrowser-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8085"
+        # serversTransport: "insecure-backend"
+    uptime-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:3002"
+    truenas-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.34"
+        # serversTransport: "insecure-backend"
+    soulseek-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5030"
+    navidrome-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:4533"
+
+  serversTransports:
+    insecure-backend:
+      insecureSkipVerify: true
+
+tls:
+  certificates:
+    - certFile: /letsencrypt/_wildcard.dfnk.pem
+      keyFile: /letsencrypt/_wildcard.dfnk-key.pem