diff --git a/traefik/docker-compose.yaml b/traefik/docker-compose.yaml
index b666dfd..10a9acc 100644
--- a/traefik/docker-compose.yaml
+++ b/traefik/docker-compose.yaml
@@ -8,6 +8,12 @@ networks:
     proxy:
         external: true
 
+secrets:
+    cloudflare_account_email_address:
+        file: /srv/secrets/traefik/email
+    cloudflare_dns_api_token:
+        file: /srv/secrets/traefik/token
+
 services:
     reverse-proxy:
         container_name: traefik
@@ -20,6 +26,9 @@ services:
             # Use the public network created to be shared between Traefik and
             # any other service that needs to be publicly available with HTTPS
             - proxy
+        secrets:
+            - cloudflare_account_email_address
+            - cloudflare_dns_api_token
         command:
             - --providers.docker # Enable Docker in Traefik, so that it reads labels from Docker services
             - --providers.docker.exposedbydefault=false # Do not expose all Docker services, only the ones explicitly exposed
@@ -31,7 +40,6 @@ services:
               # Set up LetsEncrypt
             - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
             - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
-            - --certificatesresolvers.letsencrypt.acme.email=${EMAIL_ADDRESS}
             - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
               # Set up an insecure listener that redirects all traffic to TLS
             - --entrypoints.web.address=:80
@@ -49,12 +57,13 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro # Add Docker as a mounted volume, so that Traefik can read the labels of other services
             - /srv/volumes/letsencrypt:/letsencrypt
         environment:
-            - CLOUDFLARE_EMAIL=${CLOUDFLARE_ACCOUNT_EMAIL_ADDRESS}
-            - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_TOKEN_GOES_HERE}
+            CLOUDFLARE_EMAIL_FILE: /run/secrets/cloudflare_account_email_address
+            CLOUDFLARE_DNS_API_TOKEN_FILE: /run/secrets/cloudflare_dns_api_token
+              # https://go-acme.github.io/lego/dns/cloudflare/
         labels:
             - traefik.enable=true
-            - traefik.http.routers.dashboard.service=api@internal
-            - traefik.http.routers.dashboard.rule=Host(`traefik.889217.xyz`)
+            - traefik.http.routers.dashboard.service=api@internal  # TODO: not working
+            - traefik.http.routers.dashboard.rule=Host(`traefik.golem.linux.it`)
             - traefik.http.routers.dashboard.entrypoints=websecure
             - traefik.http.routers.dashboard.tls.certresolver=letsencrypt
         healthcheck: