diff --git a/flake.lock b/flake.lock
index b08777d..d2e348d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -476,11 +476,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1781738124,
-        "narHash": "sha256-fff++SWoSeZJk9wwns/XzCHGU5ZOTDie821At68gH9I=",
+        "lastModified": 1784411728,
+        "narHash": "sha256-gC9WWL9FBGG2wm+cmeeYLuHmhfaj7Py15iSkKkeSWLE=",
         "ref": "refs/heads/main",
-        "rev": "fdf7619e52d6bea25224f19da87b6946a6f23cf7",
-        "revCount": 41,
+        "rev": "2cf90c5c7ad4d13f2116ae7e77febfe64b717850",
+        "revCount": 42,
         "type": "git",
         "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
       },
diff --git a/hosts/srv03/default.nix b/hosts/srv03/default.nix
index d53ba85..d2cacb1 100644
--- a/hosts/srv03/default.nix
+++ b/hosts/srv03/default.nix
@@ -31,7 +31,7 @@
   services = {
     traefik-docker = {
       enable = true;
-      dashboardUrl = "traefik.netbird.jfreudenberger.de";
+      dashboardUrl = "traefik.srv03.jfreudenberger.de";
       dnsChallengeProvider = "inwx";
       dnsSecrets = [
         config.age.secrets.inwx
diff --git a/hosts/srv03/secrets.nix b/hosts/srv03/secrets.nix
index e7368f7..fde83dc 100644
--- a/hosts/srv03/secrets.nix
+++ b/hosts/srv03/secrets.nix
@@ -5,5 +5,6 @@
     pocket-id.file = "${inputs.secrets}/secrets/srv03/pocket-id";
     netbird-server.file = "${inputs.secrets}/secrets/srv03/netbird-server";
     netbird-proxy.file = "${inputs.secrets}/secrets/srv03/netbird-proxy";
+    traefik-basic-auth.file = "${inputs.secrets}/secrets/srv03/traefik-basic-auth";
   };
 }
diff --git a/modules/traefik.nix b/modules/traefik.nix
index 5aaf78c..971d14b 100644
--- a/modules/traefik.nix
+++ b/modules/traefik.nix
@@ -64,6 +64,13 @@ in {
           "traefik"
           "docker-socket"
         ];
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.dashboard.rule" = "Host(`${cfg.dashboardUrl}`)";
+          "traefik.http.routers.dashboard.entrypoints" = "websecure";
+          "traefik.http.routers.dashboard.service" = "api@internal";
+          "traefik.http.routers.dashboard.middlewares" = "auth@file";
+        };
         environmentFiles = lib.forEach cfg.dnsSecrets (secret: secret.path);
         volumes = let
           traefik-providers-config = (pkgs.formats.yaml {}).generate "traefik-providers-config" {
@@ -72,6 +79,7 @@ in {
         in [
           "/var/run/docker.sock:/var/run/docker.sock"
           "${traefik-providers-config}:/dynamic-config/providers.yaml:ro"
+          "/run/traefik/basicAuth.yaml:/dynamic-config/basicAuth.yaml:ro"
         ];
         extraOptions = [
           ''--mount=type=volume,source=certs,target=/certs,volume-driver=local''
@@ -110,6 +118,30 @@ in {
       ];
     };
 
+    systemd.services.generate-traefik-config = {
+      description = "Generate Traefik basic auth config";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "docker-traefik.service" ];
+
+      serviceConfig.Type = "oneshot";
+
+      script = ''
+        set -eu
+        mkdir -p /run/traefik
+
+        BASIC_AUTH="$(cat ${config.age.secrets.traefik-basic-auth.path})"
+
+        cat > /run/traefik/basicAuth.yaml <<EOF
+http:
+  middlewares:
+    auth:
+      basicAuth:
+        users:
+          - "$BASIC_AUTH"
+EOF
+      '';
+    };
+
     systemd.services."docker-network-traefik" = {
       path = [ pkgs.docker_29 ];
       serviceConfig = {