diff --git a/ansible/roles/forgejo/docker-stack.yml.j2 b/ansible/roles/forgejo/docker-stack.yml.j2
index 43acade..fe4dd53 100644
--- a/ansible/roles/forgejo/docker-stack.yml.j2
+++ b/ansible/roles/forgejo/docker-stack.yml.j2
@@ -49,6 +49,8 @@ services:
         - traefik.http.routers.forgejo.service=forgejo
         - traefik.http.services.forgejo.loadbalancer.server.port=3000
         - traefik.docker.network=traefik
+        - traefik.http.middlewares.set-forwarded-for.headers.hostsProxyHeaders=X-Forwarded-For
+        - traefik.http.routers.forgejo.middlewares=set-forwarded-for
     configs:
       - source: config
         target: /data/gitea/conf/app.ini
diff --git a/ansible/roles/traefik/docker-stack.yml.j2 b/ansible/roles/traefik/docker-stack.yml.j2
index 7761c6b..95e8b60 100644
--- a/ansible/roles/traefik/docker-stack.yml.j2
+++ b/ansible/roles/traefik/docker-stack.yml.j2
@@ -23,9 +23,18 @@ services:
     networks:
       - traefik
     ports:
-      - 443:443
-      - 80:80
-      - 444:444
+      - mode: host
+        protocol: tcp
+        published: 443
+        target: 443
+      - mode: host
+        protocol: tcp
+        published: 80
+        target: 80
+      - mode: host
+        protocol: tcp
+        published: 444
+        target: 444
     deploy:
       placement:
         constraints: