config in a working state with backend proxy and public jellyfin access

compose.yml

@@ -3,17 +3,14 @@
 
 services:
   wg-easy:
-    image: ghcr.io/wg-easy/wg-easy:latest
+    image: ghcr.io/wg-easy/wg-easy:15
     container_name: wireguard
     restart: unless-stopped
     volumes:
       - ./etc_wireguard:/etc/wireguard
     environment:
-      - WG_HOST=wg.riverrooks.dev
-      # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=10.8.0.1
-      - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10,192.168.1.0/24
+      - PORT=51821
+      - INSECURE=true
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
@@ -23,9 +20,12 @@ services:
     ports:
       - "80:80"
       - "443:443"
-      - "51820:51820/udp" #webui
+      - "51820:51820/udp"
     networks:
       - backend
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"
@@ -52,10 +52,6 @@ services:
     network_mode: "service:wg-easy"
     depends_on:
       - wg-easy
-    # Unsure if I need DNS
-    # dns:
-    #   - 1.1.1.1
-    #   - 8.8.8.8
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
       - "./letsencrypt:/letsencrypt"
@@ -64,17 +60,6 @@ services:
     environment:
       - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
       - LEGO_DISABLE_CNAME_SUPPORT=true
-    # labels:
-      # - "traefik.enable=true"
-      # - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
-      # - "traefik.http.routers.dashboard.entrypoints=websecure"
-      # - "traefik.http.routers.dashboard.service=api@internal"
-      # - "traefik.http.routers.dashboard.tls=true"
-      # # - "traefik.http.routers.dashboard.tls.certresolver=basic"
-      # - "traefik.http.dashboard.loadbalancer.server.port=51821"
-      # #  enable auth MIDDLEWARE
-      # - "traefik.http.routers.dashboard.middlewares=auth"
-      # #  define auth type and traffic
   dns:
     image: dockurr/dnsmasq
     container_name: defenk-dns