diff --git a/nomad-jobs/traefik.nomad.hcl b/nomad-jobs/traefik.nomad.hcl
index b5c097d..bc224a6 100644
--- a/nomad-jobs/traefik.nomad.hcl
+++ b/nomad-jobs/traefik.nomad.hcl
@@ -1,9 +1,9 @@
-# Traefik Reverse Proxy
+# Traefik Reverse Proxy for hobbs.farm
 # Deploy: nomad job run traefik.nomad.hcl
 
 job "traefik" {
   datacenters = ["hf-dc1"]
-  type        = "system"  # Runs on every client node
+  type        = "system"
 
   group "traefik" {
     network {
@@ -13,27 +13,28 @@ job "traefik" {
       port "https" {
         static = 443
       }
-      port "dashboard" {
-        static = 8080
+      port "api" {
+        static = 8088
       }
     }
 
+    volume "traefik-data" {
+      type      = "host"
+      source    = "traefik-data"
+      read_only = false
+    }
+
     service {
       name = "traefik"
       port = "https"
-      
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dashboard.rule=Host(`traefik.hobbs.farm`)",
-        "traefik.http.routers.dashboard.service=api@internal",
-      ]
+      tags = ["reverse-proxy", "traefik"]
 
       check {
         type     = "http"
         path     = "/ping"
-        port     = "dashboard"
+        port     = "api"
         interval = "10s"
-        timeout  = "2s"
+        timeout  = "3s"
       }
     }
 
@@ -43,72 +44,119 @@ job "traefik" {
       config {
         image        = "traefik:v3.0"
         network_mode = "host"
-        
+
         volumes = [
           "local/traefik.yml:/etc/traefik/traefik.yml:ro",
           "local/dynamic:/etc/traefik/dynamic:ro",
         ]
       }
 
+      volume_mount {
+        volume      = "traefik-data"
+        destination = "/data"
+      }
+
       template {
         destination = "local/traefik.yml"
-        data        = <<-EOF
+        data = <<-EOF
+        api:
+          dashboard: true
+          insecure: true
+
+        ping:
+          entryPoint: api
+
+        entryPoints:
+          web:
+            address: ":80"
+            http:
+              redirections:
+                entryPoint:
+                  to: websecure
+                  scheme: https
+          websecure:
+            address: ":443"
           api:
-            dashboard: true
-            insecure: true
-          
-          ping:
-            entryPoint: dashboard
-          
-          entryPoints:
-            web:
-              address: ":80"
-              http:
-                redirections:
-                  entryPoint:
-                    to: websecure
-                    scheme: https
-            websecure:
-              address: ":443"
-            dashboard:
-              address: ":8080"
-          
-          providers:
-            consulCatalog:
-              prefix: traefik
-              exposedByDefault: false
-              endpoint:
-                address: 127.0.0.1:8500
-            file:
-              directory: /etc/traefik/dynamic
-              watch: true
-          
-          certificatesResolvers:
-            letsencrypt:
-              acme:
-                email: jeremydanielhobbs@gmail.com
-                storage: /etc/traefik/acme.json
-                dnsChallenge:
-                  provider: cloudflare
-                  resolvers:
-                    - "1.1.1.1:53"
-                    - "8.8.8.8:53"
-          
-          log:
-            level: INFO
-          
-          accessLog: {}
+            address: ":8088"
+
+        providers:
+          consulCatalog:
+            prefix: traefik
+            exposedByDefault: false
+            endpoint:
+              address: 127.0.0.1:8500
+          file:
+            directory: /etc/traefik/dynamic
+            watch: true
+
+        certificatesResolvers:
+          letsencrypt:
+            acme:
+              email: jeremy@hobbs.farm
+              storage: /data/acme.json
+              dnsChallenge:
+                provider: cloudflare
+                resolvers:
+                  - "1.1.1.1:53"
+                  - "8.8.8.8:53"
+
+        log:
+          level: INFO
+
+        accessLog: {}
         EOF
       }
 
       template {
-        destination = "local/dynamic/.keep"
-        data        = "# Dynamic config directory"
+        destination = "local/dynamic/media.yml"
+        data = <<-EOF
+        http:
+          routers:
+            jellyfin:
+              rule: "Host(`r2d2.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: jellyfin
+              tls:
+                certResolver: letsencrypt
+
+            sonarr:
+              rule: "Host(`sonarr.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: sonarr
+              tls:
+                certResolver: letsencrypt
+
+            radarr:
+              rule: "Host(`radarr.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: radarr
+              tls:
+                certResolver: letsencrypt
+
+          services:
+            jellyfin:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:8096"
+
+            sonarr:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:8989"
+
+            radarr:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:7878"
+        EOF
       }
 
+      # Cloudflare credentials for Let's Encrypt DNS challenge
       env {
-        CF_API_EMAIL = "" # Set via Nomad variables or Vault
-        CF_API_KEY   = "" # Set via Nomad variables or Vault
+        CF_DNS_API_TOKEN = "PWhuBvaYrh85S-iwBqQz4HFZV4c645znc8_eG7V9"
       }
 
       resources {