config in a working state with backend proxy and public jellyfin access

compose.yml

@@ -3,17 +3,14 @@
 
 services:
   wg-easy:
-    image: ghcr.io/wg-easy/wg-easy:latest
+    image: ghcr.io/wg-easy/wg-easy:15
     container_name: wireguard
     restart: unless-stopped
     volumes:
       - ./etc_wireguard:/etc/wireguard
     environment:
-      - WG_HOST=wg.riverrooks.dev
-      # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=10.8.0.1
-      - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10,192.168.1.0/24
+      - PORT=51821
+      - INSECURE=true
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
@@ -23,9 +20,12 @@ services:
     ports:
       - "80:80"
       - "443:443"
-      - "51820:51820/udp" #webui
+      - "51820:51820/udp"
     networks:
       - backend
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"
@@ -52,10 +52,6 @@ services:
     network_mode: "service:wg-easy"
     depends_on:
       - wg-easy
-    # Unsure if I need DNS
-    # dns:
-    #   - 1.1.1.1
-    #   - 8.8.8.8
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
       - "./letsencrypt:/letsencrypt"
@@ -64,17 +60,6 @@ services:
     environment:
       - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
       - LEGO_DISABLE_CNAME_SUPPORT=true
-    # labels:
-      # - "traefik.enable=true"
-      # - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
-      # - "traefik.http.routers.dashboard.entrypoints=websecure"
-      # - "traefik.http.routers.dashboard.service=api@internal"
-      # - "traefik.http.routers.dashboard.tls=true"
-      # # - "traefik.http.routers.dashboard.tls.certresolver=basic"
-      # - "traefik.http.dashboard.loadbalancer.server.port=51821"
-      # #  enable auth MIDDLEWARE
-      # - "traefik.http.routers.dashboard.middlewares=auth"
-      # #  define auth type and traffic
   dns:
     image: dockurr/dnsmasq
     container_name: defenk-dns

dnsmasq.conf

@@ -4,5 +4,5 @@ server=8.8.8.8
 
 # Set custom addresses inside the container
 address=/.dfnk/10.8.0.1
-address=/proxmox.dfnk/10.8.0.4
+address=/proxmox.dfnk/10.8.0.2
 address=/media.dfnk/192.168.1.35

dynamic.yml

@@ -0,0 +1,48 @@
+http:
+  routers:
+    traefik-dashboard:
+      rule: "Host(`traefik.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "api@internal"
+      tls: {}
+    proxmox-main:
+      rule: "Host(`prox.dfnk`)"
+      entrypoints: 
+        - "websecure"
+      service: "proxmox-main-service"
+      tls: {}
+    jellyfin-private:
+      rule: "Host(`watch.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls: {}
+    jellyfin-public:
+      rule: "Host(`watch.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls:
+        certResolver: "basic"
+
+  services:
+    proxmox-main-service:
+      loadBalancer:
+        servers:
+          - url: "https://10.8.0.2:8006"
+        serversTransport: "insecure-backend"
+    jellyfin-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8096"
+        # serversTransport: "insecure-backend"
+
+  serversTransports:
+    insecure-backend:
+      insecureSkipVerify: true
+
+tls:
+  certificates:
+    - certFile: /letsencrypt/_wildcard.dfnk.pem
+      keyFile: /letsencrypt/_wildcard.dfnk-key.pem