diff --git a/internal/types/room_api_v2.go b/internal/types/room_api_v2.go
index 03768ec..ed452ba 100644
--- a/internal/types/room_api_v2.go
+++ b/internal/types/room_api_v2.go
@@ -29,12 +29,14 @@ var blacklistedEnvsV2 = []string{
 	"NEKO_TCPMUX",
 	"NEKO_NAT1TO1",
 	"NEKO_ICELITE",
+	"NEKO_PROXY",
 }
 
 func (settings *RoomSettings) toEnvV2(config *config.Room, ports PortSettings) []string {
 	env := []string{
 		fmt.Sprintf("NEKO_BIND=:%d", ports.FrontendPort),
 		"NEKO_ICELITE=true",
+		"NEKO_PROXY=true",
 
 		// from settings
 		fmt.Sprintf("NEKO_PASSWORD=%s", settings.UserPass),
diff --git a/internal/types/room_api_v3.go b/internal/types/room_api_v3.go
index 50cd86a..d1b2d6a 100644
--- a/internal/types/room_api_v3.go
+++ b/internal/types/room_api_v3.go
@@ -28,6 +28,7 @@ var blacklistedEnvsV3 = []string{
 
 	// ignore bunch of envs managed by neko-rooms
 	"NEKO_SERVER_BIND",
+	"NEKO_SERVER_PROXY",
 	"NEKO_SESSION_API_TOKEN",
 	"NEKO_MEMBER_PROVIDER",
 	"NEKO_WEBRTC_EPR",
@@ -41,6 +42,7 @@ func (settings *RoomSettings) toEnvV3(config *config.Room, ports PortSettings) [
 	env := []string{
 		fmt.Sprintf("NEKO_SERVER_BIND=:%d", ports.FrontendPort),
 		"NEKO_WEBRTC_ICELITE=true",
+		"NEKO_SERVER_PROXY=true",
 
 		// from settings
 		"NEKO_MEMBER_PROVIDER=multiuser",
diff --git a/traefik/docker-compose.http.yml b/traefik/docker-compose.http.yml
index b40ba05..732e58b 100644
--- a/traefik/docker-compose.http.yml
+++ b/traefik/docker-compose.http.yml
@@ -18,7 +18,10 @@ services:
       - "--providers.docker.network=neko-rooms-traefik"
       - "--entrypoints.web.address=:8080"
     ports:
-      - "8080:8080"
+      - target: 8080
+        published: 8080
+        protocol: "tcp"
+        mode: "host"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       # OPTIONAL: Enable authentication.
diff --git a/traefik/docker-compose.yml b/traefik/docker-compose.yml
index 67fe6f1..f63e063 100644
--- a/traefik/docker-compose.yml
+++ b/traefik/docker-compose.yml
@@ -7,7 +7,7 @@ version: "3.5"
 
 networks:
   default:
-    attachable: "true"
+    attachable: true
     name: "${NEKO_ROOMS_TRAEFIK_NETWORK}"
 
 services:
@@ -17,8 +17,14 @@ services:
     environment:
       - "TZ"
     ports:
-      - "80:80"
-      - "443:443"
+      - target: 80
+        published: 80
+        protocol: "tcp"
+        mode: "host"
+      - target: 443
+        published: 443
+        protocol: "tcp"
+        mode: "host"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "./traefik.yml:/etc/traefik/traefik.yml:ro"
diff --git a/traefik/nginx/docker-compose.yml b/traefik/nginx/docker-compose.yml
index 7689b18..03e2651 100644
--- a/traefik/nginx/docker-compose.yml
+++ b/traefik/nginx/docker-compose.yml
@@ -2,7 +2,7 @@ version: "3.5"
 
 networks:
   default:
-    attachable: "true"
+    attachable: true
     name: "neko-rooms-traefik"
 
 services:
diff --git a/traefik/traefik.yml b/traefik/traefik.yml
index ef55a0c..9feb1de 100644
--- a/traefik/traefik.yml
+++ b/traefik/traefik.yml
@@ -3,6 +3,11 @@ entryPoints:
     address: ":80"
   websecure:
     address: ":443"
+    forwardedHeaders:
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
 
 providers:
   file: