diff --git a/roles/traefik/templates/docker-compose.yml.j2 b/roles/traefik/templates/docker-compose.yml.j2
index 867f315..062945f 100644
--- a/roles/traefik/templates/docker-compose.yml.j2
+++ b/roles/traefik/templates/docker-compose.yml.j2
@@ -3,9 +3,12 @@ version: "3.9"
 networks:
   traefik:
 
+volumes:
+  logs:
+
 services:
   traefik:
-    image: traefik:v2.8
+    image: traefik:v2.9
     container_name: traefik
     restart: unless-stopped
     ports:
@@ -16,5 +19,7 @@ services:
     networks:
       - traefik
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - logs:/logs
+      - {{ current_svc_path }}/rules:/rules:ro
diff --git a/roles/traefik/templates/rules/app-sonarr.yml.j2 b/roles/traefik/templates/rules/app-sonarr.yml.j2
new file mode 100644
index 0000000..2e56a75
--- /dev/null
+++ b/roles/traefik/templates/rules/app-sonarr.yml.j2
@@ -0,0 +1,10 @@
+http:
+  routers:
+    sonarr:
+      rule: "Host(`sonarr.{{ domain }}`)"
+      service: sonarr
+  services:
+    sonarr:
+      loadBalancer:
+        servers:
+          - url: "http://sonarr.lab.home:8989"
diff --git a/roles/traefik/templates/traefik.yml.j2 b/roles/traefik/templates/traefik.yml.j2
index 7b71e70..53246d4 100644
--- a/roles/traefik/templates/traefik.yml.j2
+++ b/roles/traefik/templates/traefik.yml.j2
@@ -1,7 +1,24 @@
 api:
   insecure: true
 
+log:
+  filePath: /logs/traefik.log
+  level: INFO
+accessLog:
+  filePath: /logs/access.log
+  bufferingSize: 100
+
+entryPoints:
+  web:
+    address: ":80"
+    forwardedHeaders:
+      trustedIPs:
+        - "172.16.0.0/12"
+
 providers:
   docker:
     exposedByDefault: false
     network: traefik_traefik
+  file:
+    directory: /rules
+    watch: true