diff --git a/modules/server/containers/defs/traefik.nix b/modules/server/containers/defs/traefik.nix
index 1b86b60..8510068 100644
--- a/modules/server/containers/defs/traefik.nix
+++ b/modules/server/containers/defs/traefik.nix
@@ -23,6 +23,10 @@ in {
         "traefik.http.routers.${containerCfg.subdomain}.priority" = "10";
         "traefik.http.routers.${containerCfg.subdomain}.service" = "api@internal";
         "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "authentik";
+
+        "traefik.http.middlewares.authentik.forwardauth.address" = "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik";
+        "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+        "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
       };
       overrides = {
         cmd = [ 
@@ -30,7 +34,7 @@ in {
           "--providers.docker=true"
           "--global.checknewversion=false"
           "--global.sendanonymoususage=false"
-          "--api.debug=false"
+          "--api.debug=true"
           "--api.insecure=true"
           "--api.dashboard=true"
           "--providers.docker.exposedByDefault=false"
@@ -40,6 +44,11 @@ in {
           "--entrypoints.web.http.redirections.entrypoint.scheme=https"
           "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
           "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
+          "--certificatesresolvers.default.acme.email=acme@${serverCfg.domain}"
+          "--certificatesresolvers.default.acme.storage=/acme.json"
+          "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra}"
+          "--certificatesresolvers.default.acme.domains[0].main=*.${serverCfg.domain}"
+          "--certificatesresolvers.default.acme.domains[0].sans=${serverCfg.domain}"
         ];
         ports = [ "443:443" "80:80" ];
         volumes = [ 
diff --git a/modules/shared/syscfg/default.nix b/modules/shared/syscfg/default.nix
index ea946ad..fbaf6e8 100644
--- a/modules/shared/syscfg/default.nix
+++ b/modules/shared/syscfg/default.nix
@@ -103,7 +103,7 @@ let
           subdomain = mkOption { type = types.nullOr types.str; default=null;};
           port = mkOption { type = types.nullOr types.port; default = null; };
           pubPort = mkOption { type = types.nullOr types.port; default = null; };
-          extraParam = mkOption { type = types.str; default = ""; };
+          extra = mkOption { type = types.attrs; default = {}; };
         };
       });
       default = {};
diff --git a/systems/sandbox/cfg.nix b/systems/sandbox/cfg.nix
index c207d63..c90216c 100644
--- a/systems/sandbox/cfg.nix
+++ b/systems/sandbox/cfg.nix
@@ -32,6 +32,7 @@
           enable = true;
           sops = true;
           subdomain = "traefik";
+          extra={provider="infomaniak";};
         };
         authentik = {
           enable = true;