Well, it works just fine for Docker containers, but trying to point it at other services is what is making my head hurt. With NPM it is literally "this IP at this port with this certificate = https://service.domain.tld"

version: "3.3"

services:
  traefik:
    image: "traefik:latest"
    container_name: "traefik"
    networks:
      - npm_bridge
    command:
      #- "--log.level=DEBUG"
      - "--providers.docker.exposedbydefault=false"
    ports:
      - "443:443"
      - "80:80"
      - "8180:8080"
    volumes:
      - "/docker/containers/traefik/letsencrypt:/letsencrypt"
      - "/docker/containers/traefik/:/etc/traefik"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
networks:
  npm_bridge:
    external: true


traefik.toml

[entryPoints]
  [entryPoints.web]
    address = ":80"
    #[entryPoints.web.http.redirections.entryPoint]
      #to = "websecure"
      #scheme = "https"

  [entryPoints.websecure]
    address = ":443"

[api]
  dashboard = true
  insecure = true

[certificatesResolvers.letsencrypt.acme]
  email = "[redacted]"
  storage = "/letsencrypt/acme.json"
  #caserver = "https://acme-staging-v02.api.letsencrypt.org/directory"
  caserver = "https://acme-v02.api.letsencrypt.org/directory"
  [certificatesResolvers.letsencrypt.acme.tlsChallenge]

[providers]
  [providers.docker]
    watch = true
    network = "npm_bridge"
  [providers.file]
    directory = "/etc/traefik/dynamic"
    watch = true

traefik_dynamic.toml

[tls.options]
  [tls.options.default]
    sniStrict = true
    minVersion = "VersionTLS12"
    curvePreferences = [
      "secp521r1",
      "secp384r1"
    ]
    cipherSuites = [
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
    ]
    [tls.options.mintls13]
      minVersion = "VersionTLS13"

[http]
  [http.routers]
    [http.routers.jellyfin]
      rule = "Host(`jellyfin.[redacted].com`) && PathPrefix(`/`)"
      service = "jellyfin"
      entrypoints = "websecure"
        [http.routers.librespeed]
      rule = "Host(`librespeed.[redacted].com`) && PathPrefix(`/`)"
      service = "librespeed"
      entrypoints = "websecure"

  [http.services]
    [http.services.jellyfin.loadBalancer]
      [[http.services.jellyfin.loadBalancer.servers]]
        url = "http://10.0.1.201:8096"
    [http.services.librespeed.loadBalancer]
      [[http.services.librespeed.loadBalancer.servers]]
        url = "http://10.0.1.201:10016"

This setup sadly ends up with ERR_SSL_UNRECOGNIZED_NAME_ALERT for both services. These URLs are NOT proxied through Cloudflare. I'm trying to move from Truecharts + Traefik into manual docker + traefik