diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index d66236b..0d7d0d0 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -58,12 +58,12 @@ in {
             TARGET = " ";
 
             # Configure redirect domains - ALL domains that should be able to redirect back after challenge
-            REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org";
+            REDIRECT_DOMAINS = "prg-radio.org,anubis.prg-radio.org,git.prg-radio.org,lgbtq.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org";
 
             # Public URL for Anubis
             PUBLIC_URL = "https://anubis.prg-radio.org";
 
-            # Cookie domain for proper scoping (leading dot for all subdomains)
+            # Cookie domain for proper scoping
             COOKIE_DOMAIN = ".prg-radio.org";
 
             # Difficulty level
@@ -76,57 +76,21 @@ in {
             # Optional: webmaster email for error pages
             WEBMASTER_EMAIL = "dtu.prg@gmail.com";
 
+            # Prevents infinite loop of doom:
+            # See: https://github.com/TecharoHQ/anubis/issues/970
+            JWT_RESTRICTION_HEADER="CF-Connecting-IP";
+
             # Metrics on separate port
             METRICS_BIND_NETWORK = "tcp";
             METRICS_BIND = "127.0.0.1:8091";
+
+            SLOG_LEVEL = "DEBUG";
+
+            COOKIE_SECURE = true;
+            COOKIE_SAME_SITE = "None"; # Only if Secure=true and you need cross-site
           };
         };
 
-        # Per-service Anubis instances (reverse-proxy mode) ---------------------------
-        forgejo = {
-          enable = true;
-          settings = {
-            BIND_NETWORK = "tcp";
-            BIND = "127.0.0.1:8092";
-            TARGET = "http://10.1.1.4:3000"; # Forgejo backend
-            DIFFICULTY = 20;
-            SERVE_ROBOTS_TXT = true;
-            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
-            METRICS_BIND_NETWORK = "tcp";
-            METRICS_BIND = "127.0.0.1:8095";
-          };
-        };
-
-        /*
-        wavelog = {
-          enable = true;
-          settings = {
-            BIND_NETWORK = "tcp";
-            BIND = "127.0.0.1:8093";
-            TARGET = "http://10.1.1.249:8086"; # Wavelog backend
-            DIFFICULTY = 20;
-            SERVE_ROBOTS_TXT = true;
-            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
-            METRICS_BIND_NETWORK = "tcp";
-            METRICS_BIND = "127.0.0.1:8096";
-          };
-        };
-        */
-
-        # This part needs investigating
-        partdb = {
-          enable = true;
-          settings = {
-            BIND_NETWORK = "tcp";
-            BIND = "127.0.0.1:8094";
-            TARGET = "http://10.1.1.249:8087"; # PartDB backend
-            DIFFICULTY = 20;
-            SERVE_ROBOTS_TXT = true;
-            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
-            METRICS_BIND_NETWORK = "tcp";
-            METRICS_BIND = "127.0.0.1:8097";
-          };
-        };
       };
     };
 
@@ -190,36 +154,46 @@ in {
           }
         ];
 
-        http.routers = {
-          #anubis-api = {
-          #  rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)";
-          #  service = "anubis";
-          #   entryPoints = ["websecure"];
-          #  priority = 200;
-          #   tls = {};
-          # };
+        # Traefik middlewares: Anubis forwardAuth
+        http.middlewares = {
+          anubisForwardAuth = {
+            forwardAuth = {
+              # point at the Anubis check endpoint (the subrequest/UI instance)
+              address = "http://127.0.0.1:8090/.within.website/x/cmd/anubis/api/check";
+            };
+          };
+          redirect-to-https = {
+            redirectScheme = {
+              scheme = "https";
+            };
+          };
+        };
 
+        http.routers = {
           # Anubis router (for challenge page)
           anubis = {
             rule = "Host(`anubis.prg-radio.org`)";
             service = "anubis";
-            entryPoints = ["websecure"];
-            tls = {};
+            entryPoints = [ "websecure" ];
+            tls = {
+                certresolver = "acme";
+            };
           };
 
-          # Protected service example: Forgejo
+          # Protected service example: Forgejo (attach Anubis forwardAuth middleware)
           forgejo = {
             rule = "Host(`git.prg-radio.org`)";
             service = "forgejo";
-            entryPoints = ["websecure"];
+            entryPoints = [ "websecure" ];
             tls = {};
+            middlewares = [ "anubisForwardAuth" ];
           };
 
           # Matrix HTTP router for client requests (Element etc.)
           matrix = {
             rule = "Host(`lgbtq.prg-radio.org`)";
             service = "matrix";
-            entryPoints = ["websecure"];
+            entryPoints = [ "websecure" ];
             tls = {};
           };
 
@@ -227,7 +201,7 @@ in {
           wavelog = {
             rule = "Host(`wavelog.prg-radio.org`)";
             service = "wavelog";
-            entryPoints = ["websecure"];
+            entryPoints = [ "websecure" ];
             tls = {};
           };
 
@@ -235,8 +209,9 @@ in {
           partdb = {
             rule = "Host(`partdb.prg-radio.org`)";
             service = "partdb";
-            entryPoints = ["websecure"];
+            entryPoints = [ "websecure" ];
             tls = {};
+            middlewares = [ "anubisForwardAuth" ];
           };
         };
 
@@ -246,12 +221,11 @@ in {
             servers = [
               {url = "http://127.0.0.1:8090";}
             ];
-            #passHostHeader = true;
           };
 
           forgejo.loadBalancer = {
             servers = [
-              {url = "http://127.0.0.1:8092";}
+              {url = "http://10.1.1.4:3000";}
             ];
           };
           matrix.loadBalancer = {
@@ -267,7 +241,7 @@ in {
 
           partdb.loadBalancer = {
             servers = [
-              {url = "http://127.0.0.1:8094";}
+              {url = "http://10.1.1.249:8087";}
             ];
           };
         };
@@ -370,4 +344,4 @@ in {
 
     system.stateVersion = "25.11";
   };
-}
+}
\ No newline at end of file