diff --git a/docker-compose.yaml b/docker-compose.yaml
index 1dd3679..329f728 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -2,8 +2,7 @@ services:
   keycloak:
     image: hub.anxietyprime.de/swa-jodel/keycloak:latest
     container_name: swa-keycloak
-    command:
-      - start-dev
+    command: ["start-dev"]
     env_file:
       - ./.keycloak-env
     environment:
@@ -11,13 +10,21 @@ services:
       KC_DB_SCHEMA: public
       KC_DB_URL: jdbc:postgresql://keycloak-db/keycloak
       #KC_HTTP_RELATIVE_PATH: /auth
-    ports:
-      - 9000:8080
+    expose:
+      - 8080
     networks:
+      swa-public:
       swa-keycloak:
-        ipv4_address: 10.42.1.2
+        ipv4_address: 10.42.0.3
       swa-keycloak-db:
-        ipv4_address: 10.42.2.3
+        ipv4_address: 10.42.0.10
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.keycloak.rule=Host(`keycloak.local.anxietyprime.de`)"
+      - "traefik.http.routers.keycloak.entrypoints=websecure"
+      - "traefik.http.routers.keycloak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
+      - "traefik.http.routers.keycloak.service=keycloak"
     healthcheck:
       test: echo ""
       interval: 5s
@@ -39,7 +46,7 @@ services:
       - 5432
     networks:
       swa-keycloak-db:
-        ipv4_address: 10.42.2.2
+        ipv4_address: 10.42.0.11
     healthcheck:
       test: pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB
       start_period: 5s
@@ -51,11 +58,17 @@ services:
   frontend:
    image: hub.anxietyprime.de/swa-jodel/frontend:latest
    container_name: swa-frontend
-   ports:
-     - 80:80
+   expose:
+     - 80
    networks:
      swa-public:
-       ipv4_address: 10.42.0.2
+   labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.jodel.rule=Host(`jodel.local.anxietyprime.de`)"
+      - "traefik.http.routers.jodel.entrypoints=websecure"
+      - "traefik.http.routers.jodel.tls.certresolver=letsencrypt"
+      - "traefik.http.services.jodel.loadbalancer.server.port=80"
+      - "traefik.http.routers.jodel.service=jodel"
    healthcheck:
      test: ["CMD", "service", "nginx", "status"]
      interval: 5s
@@ -71,15 +84,21 @@ services:
     container_name: swa-backend
     env_file:
       - ./.backend-env
-    ports:
-      - 3000:8080
+    expose:
+      - 8080
     networks:
       swa-public:
-        ipv4_address: 10.42.0.3
       swa-keycloak:
-        ipv4_address: 10.42.1.3
+        ipv4_address: 10.42.0.2
       swa-database:
-        ipv4_address: 10.42.3.3
+        ipv4_address: 10.42.0.18
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api-jodel.rule=Host(`api.jodel.local.anxietyprime.de`)"
+      - "traefik.http.routers.api-jodel.entrypoints=websecure"
+      - "traefik.http.routers.api-jodel.tls.certresolver=letsencrypt"
+      - "traefik.http.services.api-jodel.loadbalancer.server.port=8080"
+      - "traefik.http.routers.api-jodel.service=api-jodel"
     healthcheck:
       test: echo ""
       interval: 5s
@@ -103,7 +122,7 @@ services:
       - 5432
     networks:
       swa-database:
-        ipv4_address: 10.42.3.2
+        ipv4_address: 10.42.0.19
     healthcheck:
       test: pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB
       start_period: 5s
@@ -117,25 +136,26 @@ networks:
     external: false
 
   swa-public:
-    name: swa-public
-    ipam:
-      config:
-        - subnet: 10.42.0.0/24
+    external:
+      name: traefik
 
   swa-keycloak:
     name: swa-keycloak
     ipam:
       config:
-        - subnet: 10.42.1.0/24
+        - subnet: 10.42.0.0/29
+    internal: true
 
   swa-keycloak-db:
     name: swa-keycloak-db
     ipam:
       config:
-        - subnet: 10.42.2.0/24
+        - subnet: 10.42.0.8/29
+    internal: true
 
   swa-database:
     name: swa-database
     ipam:
       config:
-        - subnet: 10.42.3.0/24
+        - subnet: 10.42.0.16/29
+    internal: true