diff --git a/infrastructure.org b/infrastructure.org
index 7e67d49..930c456 100644
--- a/infrastructure.org
+++ b/infrastructure.org
@@ -1215,66 +1215,72 @@
   1214|Tube Archivist routes through Gluetun VPN to avoid YouTube geo-blocking.
   1215|
   1216|#+BEGIN_SRC yaml :tangle /docker/compose/services/tubearchivist.yaml
-  1217|services:
-  1218|  tubearchivist:
-  1219|    image: bbilly1/tubearchivist:latest
-  1220|    container_name: tubearchivist
-  1221|    restart: unless-stopped
-  1222|    depends_on:
-  1223|      gluetun:
-  1224|        condition: service_healthy
-  1225|        restart: true
-  1226|    network_mode: service:gluetun
-  1227|    volumes:
-  1228|      - ${FOLDER_FOR_MORE:?err}/media/youtube:/youtube
-  1229|      - ${FOLDER_FOR_DATA:?err}/tubearchivist/cache:/cache
-  1230|    environment:
-  1231|      - TZ=${TIMEZONE:?err}
-  1232|      - TA_USERNAME=${TA_USERNAME:?err}
-  1233|      - TA_PASSWORD=${TA_PASSWORD:?err}
-  1234|      - ES_URL=http://tubearchivist-es:9200
+services:
+  tubearchivist:
+    image: bbilly1/tubearchivist:latest
+    container_name: tubearchivist
+    restart: unless-stopped
+    depends_on:
+      gluetun:
+        condition: service_healthy
+        restart: true
+    network_mode: service:gluetun
+    volumes:
+      - ${FOLDER_FOR_MORE:?err}/media/youtube:/youtube
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/cache:/cache
+    environment:
+      - TZ=${TIMEZONE:?err}
+      - TA_USERNAME=${TA_USERNAME:?err}
+      - TA_PASSWORD=${TA_PASSWORD:?err}
+      - ES_URL=http://tubearchivist-es:9200
       - REDIS_CON=redis://tubearchivist-redis:6379
       - TA_HOST=https://tubearchivist.gharbeia.net
       - ELASTIC_PASSWORD=tubearchivist
       - HOST_UID=${PUID:?err}
       - HOST_GID=${PGID:?err}
     labels:
-  1257|      - traefik.http.services.tubearchivist.loadbalancer.server.port=8000
-  1258|
-  1259|  tubearchivist-es:
-  1260|    image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
-  1261|    container_name: tubearchivist-es
-  1262|    restart: unless-stopped
-  1263|    networks:
-  1264|      - networking
-  1265|    environment:
-  1266|      - discovery.type=single-node
-  1267|      - ES_JAVA_OPTS=-Xms512m -Xmx512m
-  1268|      - xpack.security.enabled=false
-  1269|      - path.repo=/usr/share/elasticsearch/data/snapshot
-  1270|    volumes:
-  1271|      - ${FOLDER_FOR_DATA:?err}/tubearchivist/es:/usr/share/elasticsearch/data
-  1272|    healthcheck:
-  1273|      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
-  1274|      interval: 30s
-  1275|      timeout: 10s
-  1276|      retries: 3
-  1277|
-  1278|  tubearchivist-redis:
-  1279|    image: redis:7-alpine
-  1280|    container_name: tubearchivist-redis
-  1281|    restart: unless-stopped
-  1282|    networks:
-  1283|      - networking
-  1284|    command: --save 60 1 --loglevel warning
-  1285|    volumes:
-  1286|      - ${FOLDER_FOR_DATA:?err}/tubearchivist/redis:/data
-  1287|    healthcheck:
-  1288|      test: redis-cli ping | grep PONG
-  1289|      interval: 30s
-  1290|      timeout: 10s
-  1291|      retries: 3
-  1292|#+END_SRC
+      - traefik.enable=true
+      - traefik.http.routers.tubearchivist.service=tubearchivist
+      - traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.${CLOUDFLARE_DNS_ZONE:?err}`)
+      - traefik.http.routers.tubearchivist.entrypoints=tunnel
+      - traefik.http.routers.tubearchivist.middlewares=authentik-forwardauth@file,security-headers@file,traefik-bouncer@file
+      - traefik.http.services.tubearchivist.loadbalancer.server.scheme=http
+      - traefik.http.services.tubearchivist.loadbalancer.server.port=8000
+
+  tubearchivist-es:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
+    container_name: tubearchivist-es
+    restart: unless-stopped
+    networks:
+      - networking
+    environment:
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+      - xpack.security.enabled=false
+      - path.repo=/usr/share/elasticsearch/data/snapshot
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/es:/usr/share/elasticsearch/data
+    healthcheck:
+      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  tubearchivist-redis:
+    image: redis:7-alpine
+    container_name: tubearchivist-redis
+    restart: unless-stopped
+    networks:
+      - networking
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/redis:/data
+    healthcheck:
+      test: redis-cli ping | grep PONG
+      interval: 30s
+      timeout: 10s
+      retries: 3
+#+END_SRC
   1293|
   1294|** Remaining Services
   1295|