diff --git a/nomad-jobs/traefik.nomad.hcl b/nomad-jobs/traefik.nomad.hcl
new file mode 100644
index 0000000..b5c097d
--- /dev/null
+++ b/nomad-jobs/traefik.nomad.hcl
@@ -0,0 +1,120 @@
+# Traefik Reverse Proxy
+# Deploy: nomad job run traefik.nomad.hcl
+
+job "traefik" {
+  datacenters = ["hf-dc1"]
+  type        = "system"  # Runs on every client node
+
+  group "traefik" {
+    network {
+      port "http" {
+        static = 80
+      }
+      port "https" {
+        static = 443
+      }
+      port "dashboard" {
+        static = 8080
+      }
+    }
+
+    service {
+      name = "traefik"
+      port = "https"
+      
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.dashboard.rule=Host(`traefik.hobbs.farm`)",
+        "traefik.http.routers.dashboard.service=api@internal",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/ping"
+        port     = "dashboard"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "traefik" {
+      driver = "docker"
+
+      config {
+        image        = "traefik:v3.0"
+        network_mode = "host"
+        
+        volumes = [
+          "local/traefik.yml:/etc/traefik/traefik.yml:ro",
+          "local/dynamic:/etc/traefik/dynamic:ro",
+        ]
+      }
+
+      template {
+        destination = "local/traefik.yml"
+        data        = <<-EOF
+          api:
+            dashboard: true
+            insecure: true
+          
+          ping:
+            entryPoint: dashboard
+          
+          entryPoints:
+            web:
+              address: ":80"
+              http:
+                redirections:
+                  entryPoint:
+                    to: websecure
+                    scheme: https
+            websecure:
+              address: ":443"
+            dashboard:
+              address: ":8080"
+          
+          providers:
+            consulCatalog:
+              prefix: traefik
+              exposedByDefault: false
+              endpoint:
+                address: 127.0.0.1:8500
+            file:
+              directory: /etc/traefik/dynamic
+              watch: true
+          
+          certificatesResolvers:
+            letsencrypt:
+              acme:
+                email: jeremydanielhobbs@gmail.com
+                storage: /etc/traefik/acme.json
+                dnsChallenge:
+                  provider: cloudflare
+                  resolvers:
+                    - "1.1.1.1:53"
+                    - "8.8.8.8:53"
+          
+          log:
+            level: INFO
+          
+          accessLog: {}
+        EOF
+      }
+
+      template {
+        destination = "local/dynamic/.keep"
+        data        = "# Dynamic config directory"
+      }
+
+      env {
+        CF_API_EMAIL = "" # Set via Nomad variables or Vault
+        CF_API_KEY   = "" # Set via Nomad variables or Vault
+      }
+
+      resources {
+        cpu    = 200
+        memory = 256
+      }
+    }
+  }
+}