From 7be049b6c10a8b7a0be4d92bed07327740169a1e Mon Sep 17 00:00:00 2001
From: arcoast <81871508+arcoast@users.noreply.github.com>
Date: Wed, 12 Aug 2026 00:44:10 +0100
Subject: [PATCH 1/2] Document Traefik configuration for TypeType

Added Traefik configuration options for TypeType container, including label-based and YAML-based setups.
---
 docs/self-hosting/reverse-proxy.md | 34 ++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/docs/self-hosting/reverse-proxy.md b/docs/self-hosting/reverse-proxy.md
index 64cad60..032738b 100644
--- a/docs/self-hosting/reverse-proxy.md
+++ b/docs/self-hosting/reverse-proxy.md
@@ -69,6 +69,40 @@ The app uses WebSockets and accepts large uploads (Takeout imports). If you drop
 break. The settings above match what the bundled web container expects.
 :::
 
+## Option C - Traefik
+
+Traefik obtains and renews TLS certificates automatically.
+
+For a label based configuration, add these labels to your TypeType container, remember to add the TypeType container to your Traefik network and change `DOMAIN.COM` as appropriate. 
+
+```yaml
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "proxy"
+      traefik.http.services.typetype.loadbalancer.server.port: "80"
+      traefik.http.routers.typetype.service: "typetype"
+      traefik.http.routers.typetype.entrypoints: "websecure"
+      traefik.http.routers.typetype.rule: "Host(`typetype.DOMAIN.COM`)"
+```
+
+Alternatively, if you use a yaml based Traefik configuration.
+
+```yaml
+http:
+  routers:
+    typetype:
+      entryPoints:
+        - websecure
+      rule: 'Host(`typetype.DOMAIN.COM`)'
+      service: typetype
+
+  services:
+    typetype:
+      loadBalancer:
+        servers:
+          - url: https://typetype:80
+```
+
 ## Remote login and WebSockets
 
 Interactive YouTube login starts with a normal HTTP request, then opens a WebSocket

From 25ca9c8049176cd1a10f66df45fb302e39123be4 Mon Sep 17 00:00:00 2001
From: Priveetee <brahim.benyoucefpro@proton.me>
Date: Sat, 5 Sep 2026 12:35:36 +0200
Subject: [PATCH 2/2] docs: fix Traefik TLS and network configuration

---
 docs/self-hosting/reverse-proxy.md | 39 +++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/docs/self-hosting/reverse-proxy.md b/docs/self-hosting/reverse-proxy.md
index 032738b..98d3195 100644
--- a/docs/self-hosting/reverse-proxy.md
+++ b/docs/self-hosting/reverse-proxy.md
@@ -71,21 +71,43 @@ break. The settings above match what the bundled web container expects.
 
 ## Option C - Traefik
 
-Traefik obtains and renews TLS certificates automatically.
+These examples assume an existing Traefik installation with a `websecure`
+entry point listening on port 443 and an
+[ACME certificate resolver](https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/)
+configured in Traefik's static configuration. Replace `YOUR_CERT_RESOLVER` with
+that resolver's name and `watch.example.com` with your domain. Traefik uses the
+resolver to obtain and renew TLS certificates; the snippets below do not create it.
 
-For a label based configuration, add these labels to your TypeType container, remember to add the TypeType container to your Traefik network and change `DOMAIN.COM` as appropriate. 
+Attach Traefik and the TypeType web service (`typetype`) to the same Docker network.
+The examples use an existing external network named `proxy`; replace that name
+with your Traefik network. Keep the web service on its existing `default` network
+as well so it can still reach the TypeType server.
+
+For Traefik's Docker provider, merge the following into your Compose configuration:
 
 ```yaml
+services:
+  typetype:
+    networks:
+      - default
+      - proxy
     labels:
       traefik.enable: "true"
       traefik.docker.network: "proxy"
       traefik.http.services.typetype.loadbalancer.server.port: "80"
       traefik.http.routers.typetype.service: "typetype"
       traefik.http.routers.typetype.entrypoints: "websecure"
-      traefik.http.routers.typetype.rule: "Host(`typetype.DOMAIN.COM`)"
+      traefik.http.routers.typetype.rule: "Host(`watch.example.com`)"
+      traefik.http.routers.typetype.tls: "true"
+      traefik.http.routers.typetype.tls.certresolver: "YOUR_CERT_RESOLVER"
+
+networks:
+  proxy:
+    external: true
 ```
 
-Alternatively, if you use a yaml based Traefik configuration.
+Alternatively, keep the same network attachments and use this dynamic YAML
+configuration with Traefik's file provider instead of the labels:
 
 ```yaml
 http:
@@ -93,16 +115,21 @@ http:
     typetype:
       entryPoints:
         - websecure
-      rule: 'Host(`typetype.DOMAIN.COM`)'
+      rule: 'Host(`watch.example.com`)'
       service: typetype
+      tls:
+        certResolver: YOUR_CERT_RESOLVER
 
   services:
     typetype:
       loadBalancer:
         servers:
-          - url: https://typetype:80
+          - url: http://typetype:80
 ```
 
+The web container serves plain HTTP on port 80; Traefik terminates HTTPS.
+Enable the Docker or file provider in Traefik according to the example you choose.
+
 ## Remote login and WebSockets
 
 Interactive YouTube login starts with a normal HTTP request, then opens a WebSocket