diff --git a/Dockerfile b/Dockerfile
index f6ba64d..20c8517 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@ RUN npm run build
 #
 # STAGE 2: build executable binary
 #
-FROM golang:1.17-buster as builder
+FROM golang:1.18-buster as builder
 WORKDIR /app
 
 COPY . .
@@ -33,7 +33,7 @@ COPY --from=frontend /src/dist/ /var/www
 
 ENV DOCKER_API_VERSION=1.39
 ENV NEKO_ROOMS_BIND=:8080
-ENV NEKO_ROOMS_STATIC=/var/www
+ENV NEKO_ROOMS_ADMIN_STATIC=/var/www
 
 EXPOSE 8080
 
diff --git a/OpenApi.yml b/OpenApi.yml
index 330e120..42f3ea4 100644
--- a/OpenApi.yml
+++ b/OpenApi.yml
@@ -307,6 +307,7 @@ components:
         max_connections:
           type: number
           example: 10
+          description: 0 when using mux
         running:
           type: boolean
           example: true
@@ -361,6 +362,7 @@ components:
         max_connections:
           type: number
           default: 10
+          description: 0 when using mux
         user_pass:
           type: string
           example: neko
diff --git a/README.md b/README.md
index 4e9240a..bdf1277 100644
--- a/README.md
+++ b/README.md
@@ -16,70 +16,25 @@ Simple room management system for [n.eko](https://github.com/m1k1o/neko). Self h
   <img src="https://github.com/m1k1o/neko-rooms/raw/master/docs/neko.gif" alt="n.eko">
 </div>
 
-## Zero-knowledge installation
+## Zero-knowledge installation (with HTTPS and Traefik)
 
 If you don't have any clue about docker and stuff but only want to have fun with friends in a shared browser, we got you covered!
 
 - Rent a VPS with public IP and OS Ubuntu.
 - Get a domain name pointing to your IP (you can even get some for free).
 - Run install script and follow instructions.
+- Secure using HTTPs thanks to Let's Encrypt and Traefik.
 
 ```bash
-wget -O neko-rooms.sh https://raw.githubusercontent.com/m1k1o/neko-rooms/master/install
+wget -O neko-rooms.sh https://raw.githubusercontent.com/m1k1o/neko-rooms/master/traefik/install
 sudo bash neko-rooms.sh
 ```
 
 ## How to start
 
-You need to have installed `Docker` and `docker-compose`. You need to have a custom domain pointing to your server's IP.
+If you want to use Traefik as reverse proxy, visit [installation guide for traefik as reverse proxy](./traefik/).
 
-You can watch installation video provided by *Dr R1ck*:
-
-https://www.youtube.com/watch?v=cCmnw-pq0gA
-
-### Installation guide
-
-You only need `.env.example`, `docker-compose.yml` and `traefik/`.
-
-#### Do I need to use traefik?
-
-- Traefik needs to be used to forward traffic to the rooms. You can put nginx in front of it, but not replace it.
-- See example configuration for [nginx](docs/nginx).
-
-You can use `docker-compose.http.yml` that will expose this service to `8080` or any port. Authentication is optional. Start it quickly with `docker-compose -f docker-compose.http.yml up -d`.
-
-### Step 1
-
-Copy `.env.example` to `.env` and customize.
-
-```bash
-cp .env.example .env
-```
-
-### Step 2
-
-Create `usersfile` with your users:
-
-```bash
-touch traefik/usersfile
-```
-
-And add as many users as you like:
-
-```bash
-echo $(htpasswd -nb user password) >> traefik/usersfile
-```
-
-### Step 3 (HTTPS only)
-
-Create `acme.json`
-
-```bash
-touch traefik/acme.json
-chmod 600 traefik/acme.json
-```
-
-Update your email in `traefik/traefik.yml`.
+Otherwise modify variables in `docker-compose.yml` and just run `docker-compose up -d`.
 
 ### Download images / update
 
@@ -116,6 +71,7 @@ For more information visit [docs](./docs).
  - [x] add authentication provider for traefik
  - [x] allow specifying custom ENV variables
  - [x] allow mounting directories for persistent data
+ - [x] optionally remove Traefik as dependency
  - [ ] add upgrade button
  - [ ] auto pull images, that do not exist
  - [ ] add bearer token to for API
diff --git a/client/src/components/RoomInfo.vue b/client/src/components/RoomInfo.vue
index d9c07cf..ee9109e 100644
--- a/client/src/components/RoomInfo.vue
+++ b/client/src/components/RoomInfo.vue
@@ -25,10 +25,10 @@
               :rotate="270"
               :size="100"
               :width="15"
-              :value="usesMux ? 100 : ((stats.connections / settings.max_connections) * 100)"
+              :value="settings.max_connections == 0 ? 100 : ((stats.connections / settings.max_connections) * 100)"
               color="blue"
             >
-              {{ stats.connections }} <template v-if="!usesMux">/ {{ settings.max_connections }}</template>
+              {{ stats.connections }} <template v-if="settings.max_connections > 0">/ {{ settings.max_connections }}</template>
             </v-progress-circular>
           </div>
         </v-col>
@@ -99,7 +99,10 @@
                 <span>Invite link for admins</span>
               </v-tooltip>
             </td></tr>
-            <tr v-if="!usesMux"><th> Max connections </th><td>{{ settings.max_connections }}</td></tr>
+            <tr v-if="!usesMux"><th> Max connections </th><td>
+              <template v-if="settings.max_connections > 0">{{ settings.max_connections }}</template>
+              <i v-else>not limited because uses mux</i>
+            </td></tr>
             <tr><th> Control protection </th><td>{{ settings.control_protection }}</td></tr>
             <tr><th> Implicit Control </th><td>{{ settings.implicit_control }}</td></tr>
           </tbody>
@@ -275,8 +278,7 @@ export default class RoomInfo extends Vue {
   }
 
   get usesMux() {
-    // old rooms might not use mux despite enabled server wide, simple check for that
-    return this.$store.state.roomsConfig.uses_mux && this.settings?.max_connections == 1
+    return this.$store.state.roomsConfig.uses_mux
   }
 
   get allBrowserExtensions() {
diff --git a/client/src/components/RoomsCreate.vue b/client/src/components/RoomsCreate.vue
index 8546f3f..b78bd29 100644
--- a/client/src/components/RoomsCreate.vue
+++ b/client/src/components/RoomsCreate.vue
@@ -604,7 +604,7 @@ export default class RoomsCreate extends Vue {
         // eslint-disable-next-line
         admin_pass: this.data.admin_pass || randomPassword(),
         // eslint-disable-next-line
-        max_connections: Number(this.data.max_connections), // not needed when uses mux
+        max_connections: Number(this.data.max_connections), // ignored when uses mux
         // eslint-disable-next-line
         control_protection: Boolean(this.data.control_protection),
         // eslint-disable-next-line
diff --git a/client/src/components/RoomsList.vue b/client/src/components/RoomsList.vue
index 6f92daa..95afd82 100644
--- a/client/src/components/RoomsList.vue
+++ b/client/src/components/RoomsList.vue
@@ -33,8 +33,8 @@
         </v-tooltip>
       </template>
       <template v-slot:[`item.max_connections`]="{ item }">
-        <span v-if="item.max_connections">{{ item.max_connections }}</span>
-        <i v-else>--not-specified--</i>
+        <span v-if="item.max_connections > 0">{{ item.max_connections }}</span>
+        <i v-else>uses mux</i>
       </template>
       <template v-slot:[`item.status`]="{ item }">
         <v-chip :color="item.running ? 'green' : 'red'" dark small> {{ item.status }} </v-chip>
diff --git a/client/src/views/Home.vue b/client/src/views/Home.vue
index 7aa1463..73e6923 100644
--- a/client/src/views/Home.vue
+++ b/client/src/views/Home.vue
@@ -101,7 +101,7 @@ export default class Home extends Vue {
 
   get usedConnections() {
     // eslint-disable-next-line
-    return this.$store.state.rooms.reduce((sum: number, { max_connections }: RoomEntry) => sum + (max_connections || 0), 0)
+    return this.$store.state.rooms.reduce((sum: number, { max_connections }: RoomEntry) => sum + (max_connections || 1/* 0 when using mux */), 0)
   }
 
   async LoadRooms() {
diff --git a/cmd/serve.go b/cmd/serve.go
index 7a8b5b3..06ad02f 100644
--- a/cmd/serve.go
+++ b/cmd/serve.go
@@ -18,7 +18,6 @@ func init() {
 
 	configs := []config.Config{
 		nekoRooms.Service.Configs.Server,
-		nekoRooms.Service.Configs.API,
 		nekoRooms.Service.Configs.Room,
 	}
 
diff --git a/dev/serve b/dev/serve
index c3131b5..d477f08 100755
--- a/dev/serve
+++ b/dev/serve
@@ -1,24 +1,31 @@
 #!/bin/sh
 cd "$(dirname "$0")"
 
-if [ ! -f "../.env" ]
-then
-    echo "../.env file not found!"
-    exit 1
+if [ -z $APP_PORT ]; then
+    APP_PORT="8080"
 fi
 
-export $(cat ../.env | sed 's/#.*//g' | xargs)
+if [ -z $APP_HOST ]; then
+    for i in $(ifconfig -l 2>/dev/null); do
+        APP_HOST=$(ipconfig getifaddr $i)
+        if [ ! -z $APP_HOST ]; then
+            break
+        fi
+    done
+
+    if [ -z $APP_HOST ]; then
+        APP_HOST=$(hostname -i 2>/dev/null)
+    fi
+fi
+
+echo "Using app port: ${APP_PORT}"
+echo "Using IP address: ${APP_HOST}"
 
 docker run --rm -it \
-    --name="neko_rooms_client" \
-    -v "${PWD}/../client:/app" \
-	-e "TZ=${TZ}" \
-    --net="${NEKO_ROOMS_TRAEFIK_NETWORK}" \
-    -l "traefik.enable=true" \
-    -l "traefik.http.services.neko-rooms-client-fe.loadbalancer.server.port=8080" \
-    -l "traefik.http.routers.neko-rooms-client.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
-    -l "traefik.http.routers.neko-rooms-client.rule=Host(\`${NEKO_ROOMS_TRAEFIK_DOMAIN}\`)" \
+    -p 8081:8080 \
+    -e "API_PROXY=http://${APP_HOST}:${APP_PORT}" \
     --user="$(id -u):$(id -g)" \
-    --workdir="/app" \
+    --volume "${PWD}/../client:/app" \
     --entrypoint="npm" \
+    --workdir="/app" \
     node:14 run serve;
diff --git a/dev/start b/dev/start
index fbfb64e..fed2a65 100755
--- a/dev/start
+++ b/dev/start
@@ -1,13 +1,36 @@
 #!/bin/sh
 cd "$(dirname "$0")"
 
-if [ ! -f "../.env" ]
-then
-    echo "../.env file not found!"
-    exit 1
+if [ -z $NEKO_ROOMS_PORT ]; then
+    NEKO_ROOMS_PORT="8080"
 fi
 
-export $(cat ../.env | sed 's/#.*//g' | xargs)
+if [ -z $NEKO_ROOMS_EPR ]; then
+    NEKO_ROOMS_EPR="52090-52099"
+fi
+
+if [ -z $NEKO_ROOMS_NAT1TO1 ]; then
+    for i in $(ifconfig -l 2>/dev/null); do
+        NEKO_ROOMS_NAT1TO1=$(ipconfig getifaddr $i)
+        if [ ! -z $NEKO_ROOMS_NAT1TO1 ]; then
+            break
+        fi
+    done
+
+    if [ -z $NEKO_ROOMS_NAT1TO1 ]; then
+        NEKO_ROOMS_NAT1TO1=$(hostname -i 2>/dev/null)
+    fi
+fi
+
+NEKO_ROOMS_INSTANCE_NETWORK="neko-rooms-net"
+docker network create --attachable "${NEKO_ROOMS_INSTANCE_NETWORK}";
+
+trap on_exit EXIT
+
+on_exit() {
+    echo "Removing neko-rooms network"
+    docker network rm "${NEKO_ROOMS_INSTANCE_NETWORK}";
+}
 
 DATA_PATH="./data"
 mkdir -p "${DATA_PATH}"
@@ -17,24 +40,22 @@ mkdir -p "${EXTERNAL_PATH}"
 
 docker run --rm -it \
     --name="neko_rooms_server" \
+    -p "${NEKO_ROOMS_PORT}:8080" \
     -v "`realpath ..`:/app" \
     -v "`realpath ${DATA_PATH}`:/data" \
 	-e "TZ=${TZ}" \
-	-e "NEKO_ROOMS_EPR=${NEKO_ROOMS_EPR}" \
 	-e "NEKO_ROOMS_MUX=true" \
+	-e "NEKO_ROOMS_EPR=${NEKO_ROOMS_EPR}" \
 	-e "NEKO_ROOMS_NAT1TO1=${NEKO_ROOMS_NAT1TO1}" \
+	-e "NEKO_ROOMS_INSTANCE_URL=http://${NEKO_ROOMS_NAT1TO1}:${NEKO_ROOMS_PORT}/" \
+	-e "NEKO_ROOMS_INSTANCE_NETWORK=${NEKO_ROOMS_INSTANCE_NETWORK}" \
 	-e "NEKO_ROOMS_STORAGE_INTERNAL=/data" \
 	-e "NEKO_ROOMS_STORAGE_EXTERNAL=`realpath ${DATA_PATH}`" \
 	-e "NEKO_ROOMS_MOUNTS_WHITELIST=`realpath ${EXTERNAL_PATH}`" \
-	-e "NEKO_ROOMS_TRAEFIK_DOMAIN=${NEKO_ROOMS_TRAEFIK_DOMAIN}" \
-	-e "NEKO_ROOMS_TRAEFIK_ENTRYPOINT=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
-	-e "NEKO_ROOMS_TRAEFIK_NETWORK=${NEKO_ROOMS_TRAEFIK_NETWORK}" \
+	-e "NEKO_ROOMS_PATH_PREFIX=/room/" \
+	-e "NEKO_ROOMS_TRAEFIK_ENABLED=false" \
     -e 'DOCKER_API_VERSION=1.39' \
     -v "/var/run/docker.sock:/var/run/docker.sock" \
-    --net="${NEKO_ROOMS_TRAEFIK_NETWORK}" \
-    -l "traefik.enable=true" \
-    -l "traefik.http.services.neko-rooms-server-fe.loadbalancer.server.port=8080" \
-    -l "traefik.http.routers.neko-rooms-server.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
-    -l "traefik.http.routers.neko-rooms-server.rule=Host(\`${NEKO_ROOMS_TRAEFIK_DOMAIN}\`) && PathPrefix(\`/api\`)" \
+    --net="${NEKO_ROOMS_INSTANCE_NETWORK}" \
     --entrypoint="/app/bin/neko_rooms" \
     neko_rooms_img serve --bind :8080;
diff --git a/.env.example b/dev/traefik/.env.example
similarity index 100%
rename from .env.example
rename to dev/traefik/.env.example
diff --git a/dev/traefik/rebuild b/dev/traefik/rebuild
new file mode 100755
index 0000000..345525a
--- /dev/null
+++ b/dev/traefik/rebuild
@@ -0,0 +1,11 @@
+#!/bin/sh
+cd "$(dirname "$0")"
+
+set -e
+
+docker run --rm -it \
+    -v "${PWD}/../../:/app" \
+    --entrypoint="go" \
+    neko_rooms_img build -o bin/neko_rooms cmd/neko_rooms/main.go
+
+./start
diff --git a/dev/traefik/serve b/dev/traefik/serve
new file mode 100755
index 0000000..d51306e
--- /dev/null
+++ b/dev/traefik/serve
@@ -0,0 +1,25 @@
+#!/bin/sh
+cd "$(dirname "$0")"
+
+if [ ! -f ".env" ]
+then
+    echo ".env file not found!"
+    exit 1
+fi
+
+export $(cat .env | sed 's/#.*//g' | xargs)
+
+docker run --rm -it \
+    --name="neko_rooms_client" \
+    -v "${PWD}/../../client:/app" \
+	-e "TZ=${TZ}" \
+    --net="${NEKO_ROOMS_TRAEFIK_NETWORK}" \
+    -l "traefik.enable=true" \
+    -l "traefik.http.services.neko-rooms-client-fe.loadbalancer.server.port=8080" \
+    -l "traefik.http.routers.neko-rooms-client.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
+    -l "traefik.http.routers.neko-rooms-client.rule=Host(\`${NEKO_ROOMS_TRAEFIK_DOMAIN}\`)" \
+    -l "traefik.http.routers.neko-rooms-client.priority=1" \
+    --user="$(id -u):$(id -g)" \
+    --workdir="/app" \
+    --entrypoint="npm" \
+    node:14 run serve;
diff --git a/dev/traefik/start b/dev/traefik/start
new file mode 100755
index 0000000..f89b31e
--- /dev/null
+++ b/dev/traefik/start
@@ -0,0 +1,47 @@
+#!/bin/sh
+cd "$(dirname "$0")"
+
+if [ ! -f ".env" ]
+then
+    echo ".env file not found!"
+    exit 1
+fi
+
+export $(cat .env | sed 's/#.*//g' | xargs)
+
+DATA_PATH="../data"
+mkdir -p "${DATA_PATH}"
+
+EXTERNAL_PATH="../ext"
+mkdir -p "${EXTERNAL_PATH}"
+
+docker run --rm -it \
+    --name="neko_rooms_server" \
+    -v "`realpath ../../`:/app" \
+    -v "`realpath ${DATA_PATH}`:/data" \
+	-e "TZ=${TZ}" \
+	-e "NEKO_ROOMS_EPR=${NEKO_ROOMS_EPR}" \
+	-e "NEKO_ROOMS_MUX=true" \
+	-e "NEKO_ROOMS_NAT1TO1=${NEKO_ROOMS_NAT1TO1}" \
+	-e "NEKO_ROOMS_PATH_PREFIX=/room/" \
+	-e "NEKO_ROOMS_STORAGE_INTERNAL=/data" \
+	-e "NEKO_ROOMS_STORAGE_EXTERNAL=`realpath ${DATA_PATH}`" \
+	-e "NEKO_ROOMS_MOUNTS_WHITELIST=`realpath ${EXTERNAL_PATH}`" \
+	-e "NEKO_ROOMS_TRAEFIK_ENABLED=true" \
+	-e "NEKO_ROOMS_TRAEFIK_DOMAIN=${NEKO_ROOMS_TRAEFIK_DOMAIN}" \
+	-e "NEKO_ROOMS_TRAEFIK_ENTRYPOINT=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
+	-e "NEKO_ROOMS_TRAEFIK_NETWORK=${NEKO_ROOMS_TRAEFIK_NETWORK}" \
+    -e 'DOCKER_API_VERSION=1.39' \
+    -v "/var/run/docker.sock:/var/run/docker.sock" \
+    --net="${NEKO_ROOMS_TRAEFIK_NETWORK}" \
+    -l "traefik.enable=true" \
+    -l "traefik.http.services.neko-rooms-server-fe.loadbalancer.server.port=8080" \
+    -l "traefik.http.routers.neko-rooms-server.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
+    -l "traefik.http.routers.neko-rooms-server.rule=Host(\`${NEKO_ROOMS_TRAEFIK_DOMAIN}\`) && PathPrefix(\`/room\`)" \
+    -l "traefik.http.routers.neko-rooms-server.priority=2" \
+    -l "traefik.http.routers.neko-rooms-server.service=neko-rooms-server-fe" \
+    -l "traefik.http.routers.neko-rooms-server-api.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" \
+    -l "traefik.http.routers.neko-rooms-server-api.rule=Host(\`${NEKO_ROOMS_TRAEFIK_DOMAIN}\`) && PathPrefix(\`/api\`)" \
+    -l "traefik.http.routers.neko-rooms-server-api.service=neko-rooms-server-fe" \
+    --entrypoint="/app/bin/neko_rooms" \
+    neko_rooms_img serve --bind :8080;
diff --git a/dev/traefik b/dev/traefik/traefik
similarity index 85%
rename from dev/traefik
rename to dev/traefik/traefik
index 6970692..c787d74 100755
--- a/dev/traefik
+++ b/dev/traefik/traefik
@@ -1,13 +1,13 @@
 #!/bin/sh
 cd "$(dirname "$0")"
 
-if [ ! -f "../.env" ]
+if [ ! -f ".env" ]
 then
-    echo "../.env file not found!"
+    echo ".env file not found!"
     exit 1
 fi
 
-export $(cat ../.env | sed 's/#.*//g' | xargs)
+export $(cat .env | sed 's/#.*//g' | xargs)
 
 docker network create --attachable "${NEKO_ROOMS_TRAEFIK_NETWORK}";
 
@@ -22,7 +22,7 @@ docker run --rm -it \
     --name="neko_rooms_traefik" \
     -p "${1:-80}:80" \
     -p "8080:8080" \
-    -v "${PWD}/../:/app" \
+    -v "${PWD}/../../:/app" \
 	-e "TZ=${TZ}" \
     -v "/var/run/docker.sock:/var/run/docker.sock" \
     --net="${NEKO_ROOMS_TRAEFIK_NETWORK}" \
diff --git a/docker-compose.yml b/docker-compose.yml
index 909e750..cee1537 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,43 +1,24 @@
 version: "3.5"
 
-#
-# This docker compose needs .env file.
-# Copy .env.example to .env and modify.
-#
-
 networks:
   default:
-    attachable: "true"
-    name: "${NEKO_ROOMS_TRAEFIK_NETWORK}"
+    attachable: true
+    name: "neko-rooms-net"
 
 services:
-  traefik:
-    image: "traefik:2.4"
-    restart: "unless-stopped"
-    environment:
-      - "TZ"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./traefik/traefik.yml:/etc/traefik/traefik.yml:ro"
-      - "./traefik/usersfile:/usersfile:ro"
-      - "./traefik/acme.json:/acme.json"
-      - "./traefik/config:/config"
-
   neko-rooms:
     image: "m1k1o/neko-rooms:latest"
     restart: "unless-stopped"
-    env_file:
-      - ".env"
+    environment:
+      - "TZ=Europe/Vienna"
+      - "NEKO_ROOMS_MUX=true"
+      - "NEKO_ROOMS_EPR=59000-59049"
+      - "NEKO_ROOMS_NAT1TO1=127.0.0.1" # IP address of your server that is reachable from client
+      - "NEKO_ROOMS_INSTANCE_URL=http://127.0.0.1:8080/" # external URL
+      - "NEKO_ROOMS_INSTANCE_NETWORK=neko-rooms-net"
+      - "NEKO_ROOMS_TRAEFIK_ENABLED=false"
+      - "NEKO_ROOMS_PATH_PREFIX=/room/"
+    ports:
+      - "8080:8080"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.neko-rooms-frontend.loadbalancer.server.port=8080"
-      - "traefik.http.routers.neko-rooms.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}"
-      - "traefik.http.routers.neko-rooms.rule=Host(`${NEKO_ROOMS_TRAEFIK_DOMAIN}`)"
-      - "traefik.http.routers.neko-rooms.tls=true"
-      - "traefik.http.routers.neko-rooms.tls.certresolver=${NEKO_ROOMS_TRAEFIK_CERTRESOLVER}"
-      - "traefik.http.routers.neko-rooms.middlewares=basicauth@file"
diff --git a/go.mod b/go.mod
index 41a66fa..31aac8b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/m1k1o/neko-rooms
 
-go 1.17
+go 1.18
 
 require (
 	github.com/Microsoft/go-winio v0.5.2 // indirect
diff --git a/internal/api/api.go b/internal/api/api.go
index e82fda1..490f00c 100644
--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -5,7 +5,6 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 
-	"github.com/m1k1o/neko-rooms/internal/config"
 	"github.com/m1k1o/neko-rooms/internal/types"
 )
 
@@ -13,15 +12,13 @@ type ApiManagerCtx struct {
 	logger zerolog.Logger
 	rooms  types.RoomManager
 	pull   types.PullManager
-	conf   *config.API
 }
 
-func New(rooms types.RoomManager, pull types.PullManager, conf *config.API) *ApiManagerCtx {
+func New(rooms types.RoomManager, pull types.PullManager) *ApiManagerCtx {
 	return &ApiManagerCtx{
 		logger: log.With().Str("module", "api").Logger(),
 		rooms:  rooms,
 		pull:   pull,
-		conf:   conf,
 	}
 }
 
diff --git a/internal/config/api.go b/internal/config/api.go
deleted file mode 100644
index 0331d47..0000000
--- a/internal/config/api.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package config
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-type API struct {
-	Lobby bool
-}
-
-func (API) Init(cmd *cobra.Command) error {
-	cmd.PersistentFlags().Bool("lobby", true, "show lobby when room is not started yet; in order to show lobby, neko-rooms must run on the same subdomain where rooms are published")
-	if err := viper.BindPFlag("lobby", cmd.PersistentFlags().Lookup("lobby")); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *API) Set() {
-	s.Lobby = viper.GetBool("lobby")
-}
diff --git a/internal/config/room.go b/internal/config/room.go
index 272f524..b65dbfc 100644
--- a/internal/config/room.go
+++ b/internal/config/room.go
@@ -13,6 +13,14 @@ import (
 	"github.com/spf13/viper"
 )
 
+type Traefik struct {
+	Enabled      bool
+	Domain       string
+	Entrypoint   string
+	Certresolver string
+	Port         string // deprecated
+}
+
 type Room struct {
 	Mux    bool
 	EprMin uint16
@@ -30,14 +38,11 @@ type Room struct {
 
 	MountsWhitelist []string
 
-	InstanceName string
-	InstanceUrl  *url.URL
+	InstanceName    string
+	InstanceUrl     *url.URL
+	InstanceNetwork string
 
-	TraefikDomain       string
-	TraefikEntrypoint   string
-	TraefikCertresolver string
-	TraefikNetwork      string
-	TraefikPort         string // deprecated
+	Traefik Traefik
 }
 
 func (Room) Init(cmd *cobra.Command) error {
@@ -78,7 +83,7 @@ func (Room) Init(cmd *cobra.Command) error {
 		return err
 	}
 
-	cmd.PersistentFlags().String("path_prefix", "", "path prefix that is added to every room path")
+	cmd.PersistentFlags().String("path_prefix", "/", "path prefix that is added to every room path")
 	if err := viper.BindPFlag("path_prefix", cmd.PersistentFlags().Lookup("path_prefix")); err != nil {
 		return err
 	}
@@ -122,8 +127,18 @@ func (Room) Init(cmd *cobra.Command) error {
 		return err
 	}
 
+	cmd.PersistentFlags().String("instance.network", "", "docker network that will be used for this instance to communicate with rooms")
+	if err := viper.BindPFlag("instance.network", cmd.PersistentFlags().Lookup("instance.network")); err != nil {
+		return err
+	}
+
 	// Traefik
 
+	cmd.PersistentFlags().Bool("traefik.enabled", true, "traefik: enabled or disabled")
+	if err := viper.BindPFlag("traefik.enabled", cmd.PersistentFlags().Lookup("traefik.enabled")); err != nil {
+		return err
+	}
+
 	cmd.PersistentFlags().String("traefik.domain", "", "traefik: domain on which will be container hosted (if empty or '*', match all; for neko-rooms as subdomain use '*.domain.tld')")
 	if err := viper.BindPFlag("traefik.domain", cmd.PersistentFlags().Lookup("traefik.domain")); err != nil {
 		return err
@@ -139,7 +154,7 @@ func (Room) Init(cmd *cobra.Command) error {
 		return err
 	}
 
-	cmd.PersistentFlags().String("traefik.network", "traefik", "traefik: docker network name")
+	cmd.PersistentFlags().String("traefik.network", "traefik", "traefik: docker network name (deprecated, use instance.network)")
 	if err := viper.BindPFlag("traefik.network", cmd.PersistentFlags().Lookup("traefik.network")); err != nil {
 		return err
 	}
@@ -182,7 +197,7 @@ func (s *Room) Set() {
 	s.NAT1To1IPs = viper.GetStringSlice("nat1to1")
 	s.NekoImages = viper.GetStringSlice("neko_images")
 	s.NekoPrivilegedImages = viper.GetStringSlice("neko_privileged_images")
-	s.PathPrefix = viper.GetString("path_prefix")
+	s.PathPrefix = path.Join("/", path.Clean(viper.GetString("path_prefix")))
 	s.Labels = viper.GetStringSlice("labels")
 
 	s.StorageEnabled = viper.GetBool("storage.enabled")
@@ -224,18 +239,33 @@ func (s *Room) Set() {
 		}
 	}
 
-	s.TraefikDomain = viper.GetString("traefik.domain")
-	s.TraefikEntrypoint = viper.GetString("traefik.entrypoint")
-	s.TraefikCertresolver = viper.GetString("traefik.certresolver")
-	s.TraefikNetwork = viper.GetString("traefik.network")
-
-	// deprecated
-	s.TraefikPort = viper.GetString("traefik.port")
-	if s.TraefikPort != "" {
-		if s.InstanceUrl != nil {
-			log.Warn().Msg("deprecated `traefik.port` config item is ignored when `instance.url` is set")
-		} else {
-			log.Warn().Msg("you are using deprecated `traefik.port` config item, you should consider moving to `instance.url`")
+	s.InstanceNetwork = viper.GetString("instance.network")
+
+	s.Traefik.Enabled = viper.GetBool("traefik.enabled")
+	if s.Traefik.Enabled {
+		s.Traefik.Domain = viper.GetString("traefik.domain")
+		s.Traefik.Entrypoint = viper.GetString("traefik.entrypoint")
+		s.Traefik.Certresolver = viper.GetString("traefik.certresolver")
+
+		// deprecated
+		traefikNetwork := viper.GetString("traefik.network")
+		if traefikNetwork != "" {
+			if s.InstanceNetwork != "" {
+				log.Warn().Msg("deprecated `traefik.network` config item is ignored when `instance.network` is set")
+			} else {
+				log.Warn().Msg("you are using deprecated `traefik.network` config item, you should consider moving to `instance.network`")
+				s.InstanceNetwork = traefikNetwork
+			}
+		}
+
+		// deprecated
+		s.Traefik.Port = viper.GetString("traefik.port")
+		if s.Traefik.Port != "" {
+			if s.InstanceUrl != nil {
+				log.Warn().Msg("deprecated `traefik.port` config item is ignored when `instance.url` is set")
+			} else {
+				log.Warn().Msg("you are using deprecated `traefik.port` config item, you should consider moving to `instance.url`")
+			}
 		}
 	}
 }
@@ -251,17 +281,19 @@ func (s *Room) GetInstanceUrl() url.URL {
 		Path:   "/",
 	}
 
-	if s.TraefikCertresolver != "" {
-		instanceUrl.Scheme = "https"
-	}
+	if s.Traefik.Enabled {
+		if s.Traefik.Certresolver != "" {
+			instanceUrl.Scheme = "https"
+		}
 
-	if s.TraefikDomain != "" && s.TraefikDomain != "*" {
-		instanceUrl.Host = s.TraefikDomain
-	}
+		if s.Traefik.Domain != "" && s.Traefik.Domain != "*" {
+			instanceUrl.Host = s.Traefik.Domain
+		}
 
-	// deprecated
-	if s.TraefikPort != "" {
-		instanceUrl.Host += ":" + s.TraefikPort
+		// deprecated
+		if s.Traefik.Port != "" {
+			instanceUrl.Host += ":" + s.Traefik.Port
+		}
 	}
 
 	return instanceUrl
diff --git a/internal/config/server.go b/internal/config/server.go
index 7d35626..bbdf4ae 100644
--- a/internal/config/server.go
+++ b/internal/config/server.go
@@ -5,13 +5,21 @@ import (
 	"github.com/spf13/viper"
 )
 
+type Admin struct {
+	Static    string
+	ProxyAuth string
+	Username  string
+	Password  string
+}
+
 type Server struct {
-	Cert   string
-	Key    string
-	Bind   string
-	Static string
-	Proxy  bool
-	PProf  bool
+	Cert  string
+	Key   string
+	Bind  string
+	Proxy bool
+	PProf bool
+
+	Admin Admin
 }
 
 func (Server) Init(cmd *cobra.Command) error {
@@ -30,11 +38,6 @@ func (Server) Init(cmd *cobra.Command) error {
 		return err
 	}
 
-	cmd.PersistentFlags().String("static", "./www", "path to neko_rooms client files to serve")
-	if err := viper.BindPFlag("static", cmd.PersistentFlags().Lookup("static")); err != nil {
-		return err
-	}
-
 	cmd.PersistentFlags().Bool("proxy", false, "trust reverse proxy headers")
 	if err := viper.BindPFlag("proxy", cmd.PersistentFlags().Lookup("proxy")); err != nil {
 		return err
@@ -45,6 +48,28 @@ func (Server) Init(cmd *cobra.Command) error {
 		return err
 	}
 
+	// Admin
+
+	cmd.PersistentFlags().String("admin.static", "", "path to neko_rooms admin client files to serve")
+	if err := viper.BindPFlag("admin.static", cmd.PersistentFlags().Lookup("admin.static")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().String("admin.proxy_auth", "", "require auth: proxy authentication URL, only allow if it returns 200")
+	if err := viper.BindPFlag("admin.proxy_auth", cmd.PersistentFlags().Lookup("admin.proxy_auth")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().String("admin.username", "admin", "require auth: admin username")
+	if err := viper.BindPFlag("admin.username", cmd.PersistentFlags().Lookup("admin.username")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().String("admin.password", "", "require auth: admin password")
+	if err := viper.BindPFlag("admin.password", cmd.PersistentFlags().Lookup("admin.password")); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -52,7 +77,11 @@ func (s *Server) Set() {
 	s.Cert = viper.GetString("cert")
 	s.Key = viper.GetString("key")
 	s.Bind = viper.GetString("bind")
-	s.Static = viper.GetString("static")
 	s.Proxy = viper.GetBool("proxy")
 	s.PProf = viper.GetBool("pprof")
+
+	s.Admin.Static = viper.GetString("admin.static")
+	s.Admin.ProxyAuth = viper.GetString("admin.proxy_auth")
+	s.Admin.Username = viper.GetString("admin.username")
+	s.Admin.Password = viper.GetString("admin.password")
 }
diff --git a/internal/api/lobby.go b/internal/proxy/lobby.go
similarity index 72%
rename from internal/api/lobby.go
rename to internal/proxy/lobby.go
index f7a4394..fc81add 100644
--- a/internal/api/lobby.go
+++ b/internal/proxy/lobby.go
@@ -1,41 +1,12 @@
-package api
+package proxy
 
 import (
 	"net/http"
-	"strings"
-
-	"github.com/go-chi/chi"
 
 	"github.com/m1k1o/neko-rooms/internal/utils"
 )
 
-func (manager *ApiManagerCtx) RoomLobby(w http.ResponseWriter, r *http.Request) {
-	if !manager.conf.Lobby {
-		http.NotFound(w, r)
-	}
-
-	roomName := chi.URLParam(r, "roomName")
-	response, err := manager.rooms.FindByName(roomName)
-
-	if err != nil || response.Name != roomName {
-		manager.roomNotFound(w, r)
-		return
-	}
-
-	if !response.Running {
-		manager.roomNotRunning(w, r)
-		return
-	}
-
-	if strings.Contains(response.Status, "starting") {
-		manager.roomNotReady(w, r)
-		return
-	}
-
-	manager.roomReady(w, r)
-}
-
-func (manager *ApiManagerCtx) roomNotFound(w http.ResponseWriter, r *http.Request) {
+func RoomNotFound(w http.ResponseWriter, r *http.Request) {
 	utils.Swal2Response(w, `
 		<div class="swal2-header">
 			<div class="swal2-icon swal2-error">
@@ -49,7 +20,7 @@ func (manager *ApiManagerCtx) roomNotFound(w http.ResponseWriter, r *http.Reques
 	`)
 }
 
-func (manager *ApiManagerCtx) roomNotRunning(w http.ResponseWriter, r *http.Request) {
+func RoomNotRunning(w http.ResponseWriter, r *http.Request) {
 	utils.Swal2Response(w, `
 		<div class="swal2-header">
 			<div class="swal2-icon swal2-warning">
@@ -63,7 +34,7 @@ func (manager *ApiManagerCtx) roomNotRunning(w http.ResponseWriter, r *http.Requ
 	`)
 }
 
-func (manager *ApiManagerCtx) roomNotReady(w http.ResponseWriter, r *http.Request) {
+func RoomNotReady(w http.ResponseWriter, r *http.Request) {
 	utils.Swal2Response(w, `
 		<meta http-equiv="refresh" content="2">
 
@@ -83,7 +54,7 @@ func (manager *ApiManagerCtx) roomNotReady(w http.ResponseWriter, r *http.Reques
 	`)
 }
 
-func (manager *ApiManagerCtx) roomReady(w http.ResponseWriter, r *http.Request) {
+func RoomReady(w http.ResponseWriter, r *http.Request) {
 	utils.Swal2Response(w, `
 		<div class="swal2-header">
 			<div class="swal2-icon swal2-success swal2-icon-show" style="display: flex;">
diff --git a/internal/proxy/manager.go b/internal/proxy/manager.go
new file mode 100644
index 0000000..4c73974
--- /dev/null
+++ b/internal/proxy/manager.go
@@ -0,0 +1,290 @@
+package proxy
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+
+	dockerTypes "github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+type entry struct {
+	id      string
+	running bool
+	handler *httputil.ReverseProxy
+}
+
+type ProxyManagerCtx struct {
+	logger zerolog.Logger
+	mu     sync.RWMutex
+	ctx    context.Context
+	cancel func()
+
+	client       *dockerClient.Client
+	instanceName string
+	handlers     *prefixHandler[*entry]
+}
+
+func New(client *dockerClient.Client, instanceName string) *ProxyManagerCtx {
+	return &ProxyManagerCtx{
+		logger: log.With().Str("module", "proxy").Logger(),
+
+		client:       client,
+		instanceName: instanceName,
+		handlers:     &prefixHandler[*entry]{},
+	}
+}
+
+func (p *ProxyManagerCtx) Start() {
+	p.ctx, p.cancel = context.WithCancel(context.Background())
+
+	go func() {
+		err := p.Refresh()
+		if err != nil {
+			p.logger.Err(err).Msg("unable to refresh containers")
+		}
+
+		msgs, errs := p.client.Events(p.ctx, dockerTypes.EventsOptions{
+			Filters: filters.NewArgs(
+				filters.Arg("type", "container"),
+				filters.Arg("label", fmt.Sprintf("m1k1o.neko_rooms.instance=%s", p.instanceName)),
+				filters.Arg("event", "create"),
+				filters.Arg("event", "start"),
+				//filters.Arg("event", "health_status"),
+				filters.Arg("event", "stop"),
+				filters.Arg("event", "destroy"),
+			),
+		})
+
+		for {
+			select {
+			case err := <-errs:
+				p.logger.Err(err).Msg("got docker event")
+			case msg := <-msgs:
+				enabled, path, port, ok := p.parseLabels(msg.Actor.Attributes)
+				if !ok {
+					break
+				}
+
+				host := msg.ID[:12] + ":" + port
+
+				p.logger.Info().
+					Str("action", msg.Action).
+					Str("path", path).
+					Str("host", host).
+					Msg("got docker event")
+
+				p.mu.Lock()
+				switch msg.Action {
+				case "create":
+					p.handlers.Set(path, &entry{
+						id:      msg.ID,
+						running: false,
+					})
+				case "start":
+					e := &entry{
+						id:      msg.ID,
+						running: true,
+					}
+
+					// if proxying is disabled
+					if enabled {
+						e.handler = httputil.NewSingleHostReverseProxy(&url.URL{
+							Scheme: "http",
+							Host:   host,
+						})
+					}
+
+					p.handlers.Set(path, e)
+				case "stop":
+					p.handlers.Set(path, &entry{
+						id:      msg.ID,
+						running: false,
+					})
+				case "destroy":
+					p.handlers.Remove(path)
+				}
+				p.mu.Unlock()
+			}
+		}
+	}()
+}
+
+func (p *ProxyManagerCtx) Shutdown() error {
+	p.cancel()
+	return p.ctx.Err()
+}
+
+func (p *ProxyManagerCtx) Refresh() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	containers, err := p.client.ContainerList(p.ctx, dockerTypes.ContainerListOptions{
+		All: true,
+		Filters: filters.NewArgs(
+			filters.Arg("label", fmt.Sprintf("m1k1o.neko_rooms.instance=%s", p.instanceName)),
+		),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	p.handlers = &prefixHandler[*entry]{}
+
+	for _, cont := range containers {
+		enabled, path, port, ok := p.parseLabels(cont.Labels)
+		if !ok {
+			continue
+		}
+
+		host := cont.ID[:12] + ":" + port
+
+		entry := &entry{
+			id: cont.ID,
+		}
+
+		if cont.State == "running" {
+			entry.running = true
+
+			// if proxying is disabled
+			if enabled {
+				entry.handler = httputil.NewSingleHostReverseProxy(&url.URL{
+					Scheme: "http",
+					Host:   host,
+				})
+			}
+		}
+
+		p.handlers.Set(path, entry)
+	}
+
+	return nil
+}
+
+func (p *ProxyManagerCtx) parseLabels(labels map[string]string) (enabled bool, path string, port string, ok bool) {
+	enabledStr, found := labels["m1k1o.neko_rooms.proxy.enabled"]
+	if !found {
+		//
+		// workaround for legacy traefik labels
+		//
+
+		// get room name
+		var roomName string
+		roomName, ok = labels["m1k1o.neko_rooms.name"]
+		if !ok {
+			return
+		}
+
+		// get container name
+		containerName := p.instanceName + "-" + roomName
+
+		// get path
+		path, ok = labels["traefik.http.middlewares."+containerName+"-prf.stripprefix.prefixes"]
+		if !ok {
+			return
+		}
+
+		// remove last /
+		path = strings.TrimSuffix(path, "/")
+
+		// get port
+		port, ok = labels["traefik.http.services."+containerName+"-frontend.loadbalancer.server.port"]
+		if !ok {
+			return
+		}
+
+		//
+		// workaround for legacy traefik labels
+		//
+
+		return
+	}
+
+	enabledBool, err := strconv.ParseBool(enabledStr)
+	enabled = enabledBool && err == nil
+
+	path, ok = labels["m1k1o.neko_rooms.proxy.path"]
+	if !ok {
+		return
+	}
+
+	port, ok = labels["m1k1o.neko_rooms.proxy.port"]
+	return
+}
+
+func (p *ProxyManagerCtx) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// get proxy by room name
+	p.mu.RLock()
+	proxy, prefix, ok := p.handlers.Match(r.URL.Path)
+	p.mu.RUnlock()
+
+	// if room not found
+	if !ok {
+		RoomNotFound(w, r)
+		return
+	}
+
+	// redirect to room ending with /
+	if r.URL.Path == prefix {
+		r.URL.Path += "/"
+		http.Redirect(w, r, r.URL.String(), http.StatusTemporaryRedirect)
+		return
+	}
+
+	// if room not running
+	if !proxy.running {
+		RoomNotRunning(w, r)
+		return
+	}
+
+	// if not proxying, check for container readiness status
+	if proxy.handler == nil {
+		containers, err := p.client.ContainerList(p.ctx, dockerTypes.ContainerListOptions{
+			All: true,
+			Filters: filters.NewArgs(
+				filters.Arg("label", fmt.Sprintf("m1k1o.neko_rooms.instance=%s", p.instanceName)),
+				filters.Arg("id", proxy.id),
+			),
+		})
+
+		if err != nil || len(containers) != 1 {
+			p.logger.Err(err).Msg("error while getting container ready status")
+			RoomNotReady(w, r)
+			return
+		}
+
+		container := containers[0]
+		if strings.Contains(container.Status, "starting") {
+			RoomNotReady(w, r)
+		} else {
+			RoomReady(w, r)
+		}
+
+		return
+	}
+
+	// handle not ready room
+	proxy.handler.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
+		if r.URL.Path == "/" {
+			RoomNotReady(w, r)
+		}
+
+		p.logger.Err(err).Str("prefix", prefix).Msg("proxying error")
+	}
+
+	// strip prefix from proxy
+	handler := http.StripPrefix(prefix, proxy.handler)
+
+	// handle by proxy
+	handler.ServeHTTP(w, r)
+}
diff --git a/internal/proxy/prefix.go b/internal/proxy/prefix.go
new file mode 100644
index 0000000..5d895ee
--- /dev/null
+++ b/internal/proxy/prefix.go
@@ -0,0 +1,126 @@
+package proxy
+
+import (
+	"strings"
+)
+
+type prefixHandler[T any] struct {
+	Value    T
+	IsLeaf   bool
+	Children map[string]*prefixHandler[T]
+}
+
+func NewPrefixHandler[T any]() *prefixHandler[T] {
+	return &prefixHandler[T]{}
+}
+
+func (p *prefixHandler[T]) Set(prefix string, value T) {
+	arr := strings.Split(prefix, "/")
+	len := len(arr)
+
+	for i, a := range arr {
+		if a == "" {
+			continue
+		}
+
+		if p.Children == nil {
+			p.Children = map[string]*prefixHandler[T]{}
+		}
+
+		dat, ok := p.Children[a]
+		if !ok {
+			dat = &prefixHandler[T]{}
+		}
+
+		if i == len-1 {
+			dat.Value = value
+			dat.IsLeaf = true
+			dat.Children = nil
+		}
+
+		p.Children[a] = dat
+		p = dat
+	}
+}
+
+func (p *prefixHandler[T]) Get(prefix string) (value T, ok bool) {
+	arr := strings.Split(prefix, "/")
+	len := len(arr)
+
+	for i, a := range arr {
+		if a == "" {
+			continue
+		}
+
+		if p.Children == nil {
+			p.Children = map[string]*prefixHandler[T]{}
+		}
+
+		dat, found := p.Children[a]
+		if !found {
+			dat = &prefixHandler[T]{}
+		}
+
+		if i == len-1 {
+			value = dat.Value
+			ok = dat.IsLeaf
+			return
+		}
+
+		p.Children[a] = dat
+		p = dat
+	}
+
+	return
+}
+
+func (p *prefixHandler[T]) Remove(prefix string) {
+	arr := strings.Split(prefix, "/")
+	len := len(arr)
+
+	for i, a := range arr {
+		if a == "" {
+			continue
+		}
+
+		if i == len-1 {
+			delete(p.Children, a)
+		}
+
+		dat, found := p.Children[a]
+		if !found {
+			break
+		}
+		p = dat
+	}
+
+	// TODO: Remove all empty references.
+}
+
+func (p *prefixHandler[T]) Match(path string) (value T, prefix string, ok bool) {
+	arr := strings.Split(path, "/")
+	prefixArr := []string{}
+
+	for _, a := range arr {
+		if a == "" {
+			continue
+		}
+
+		pointer, found := p.Children[a]
+		if !found {
+			return
+		}
+
+		p = pointer
+		prefixArr = append(prefixArr, a)
+
+		if p.IsLeaf {
+			break
+		}
+	}
+
+	value = p.Value
+	prefix = "/" + strings.Join(prefixArr, "/")
+	ok = p.IsLeaf
+	return
+}
diff --git a/internal/room/containers.go b/internal/room/containers.go
index 6219e03..bbf41db 100644
--- a/internal/room/containers.go
+++ b/internal/room/containers.go
@@ -18,7 +18,7 @@ func (manager *RoomManagerCtx) containerToEntry(container dockerTypes.Container)
 		return nil, err
 	}
 
-	return &types.RoomEntry{
+	entry := &types.RoomEntry{
 		ID:             container.ID,
 		URL:            labels.URL,
 		Name:           labels.Name,
@@ -28,7 +28,13 @@ func (manager *RoomManagerCtx) containerToEntry(container dockerTypes.Container)
 		Running:        container.State == "running",
 		Status:         container.Status,
 		Created:        time.Unix(container.Created, 0),
-	}, nil
+	}
+
+	if labels.Mux {
+		entry.MaxConnections = 0
+	}
+
+	return entry, nil
 }
 
 func (manager *RoomManagerCtx) listContainers() ([]dockerTypes.Container, error) {
diff --git a/internal/room/labels.go b/internal/room/labels.go
index ae5b0c5..34f752a 100644
--- a/internal/room/labels.go
+++ b/internal/room/labels.go
@@ -10,6 +10,7 @@ import (
 type RoomLabels struct {
 	Name      string
 	URL       string
+	Mux       bool
 	Epr       EprPorts
 	NekoImage string
 
@@ -29,7 +30,9 @@ func (manager *RoomManagerCtx) extractLabels(labels map[string]string) (*RoomLab
 
 	url, ok := labels["m1k1o.neko_rooms.url"]
 	if !ok {
-		return nil, fmt.Errorf("damaged container labels: url not found")
+		// TODO: It should be always available.
+		url = manager.config.GetRoomUrl(name)
+		//return nil, fmt.Errorf("damaged container labels: url not found")
 	}
 
 	nekoImage, ok := labels["m1k1o.neko_rooms.neko_image"]
@@ -37,24 +40,47 @@ func (manager *RoomManagerCtx) extractLabels(labels map[string]string) (*RoomLab
 		return nil, fmt.Errorf("damaged container labels: neko_image not found")
 	}
 
-	eprMinStr, ok := labels["m1k1o.neko_rooms.epr.min"]
-	if !ok {
-		return nil, fmt.Errorf("damaged container labels: epr.min not found")
-	}
+	var mux bool
+	var epr EprPorts
 
-	eprMin, err := strconv.ParseUint(eprMinStr, 10, 16)
-	if err != nil {
-		return nil, err
-	}
+	muxStr, ok := labels["m1k1o.neko_rooms.mux"]
+	if ok {
+		muxPort, err := strconv.ParseUint(muxStr, 10, 16)
+		if err != nil {
+			return nil, err
+		}
 
-	eprMaxStr, ok := labels["m1k1o.neko_rooms.epr.max"]
-	if !ok {
-		return nil, fmt.Errorf("damaged container labels: epr.max not found")
-	}
+		mux = true
+		epr = EprPorts{
+			Min: uint16(muxPort),
+			Max: uint16(muxPort),
+		}
+	} else {
+		eprMinStr, ok := labels["m1k1o.neko_rooms.epr.min"]
+		if !ok {
+			return nil, fmt.Errorf("damaged container labels: epr.min not found")
+		}
+
+		eprMin, err := strconv.ParseUint(eprMinStr, 10, 16)
+		if err != nil {
+			return nil, err
+		}
+
+		eprMaxStr, ok := labels["m1k1o.neko_rooms.epr.max"]
+		if !ok {
+			return nil, fmt.Errorf("damaged container labels: epr.max not found")
+		}
+
+		eprMax, err := strconv.ParseUint(eprMaxStr, 10, 16)
+		if err != nil {
+			return nil, err
+		}
 
-	eprMax, err := strconv.ParseUint(eprMaxStr, 10, 16)
-	if err != nil {
-		return nil, err
+		mux = false
+		epr = EprPorts{
+			Min: uint16(eprMin),
+			Max: uint16(eprMax),
+		}
 	}
 
 	var browserPolicy *BrowserPolicyLabels
@@ -79,10 +105,9 @@ func (manager *RoomManagerCtx) extractLabels(labels map[string]string) (*RoomLab
 		Name:      name,
 		URL:       url,
 		NekoImage: nekoImage,
-		Epr: EprPorts{
-			Min: uint16(eprMin),
-			Max: uint16(eprMax),
-		},
+		Mux:       mux,
+		Epr:       epr,
+
 		BrowserPolicy: browserPolicy,
 	}, nil
 }
@@ -90,13 +115,18 @@ func (manager *RoomManagerCtx) extractLabels(labels map[string]string) (*RoomLab
 func (manager *RoomManagerCtx) serializeLabels(labels RoomLabels) map[string]string {
 	labelsMap := map[string]string{
 		"m1k1o.neko_rooms.name":       labels.Name,
-		"m1k1o.neko_rooms.url":        labels.URL,
+		"m1k1o.neko_rooms.url":        manager.config.GetRoomUrl(labels.Name),
 		"m1k1o.neko_rooms.instance":   manager.config.InstanceName,
-		"m1k1o.neko_rooms.epr.min":    fmt.Sprintf("%d", labels.Epr.Min),
-		"m1k1o.neko_rooms.epr.max":    fmt.Sprintf("%d", labels.Epr.Max),
 		"m1k1o.neko_rooms.neko_image": labels.NekoImage,
 	}
 
+	if labels.Mux && labels.Epr.Min == labels.Epr.Max {
+		labelsMap["m1k1o.neko_rooms.mux"] = fmt.Sprintf("%d", labels.Epr.Min)
+	} else {
+		labelsMap["m1k1o.neko_rooms.epr.min"] = fmt.Sprintf("%d", labels.Epr.Min)
+		labelsMap["m1k1o.neko_rooms.epr.max"] = fmt.Sprintf("%d", labels.Epr.Max)
+	}
+
 	if labels.BrowserPolicy != nil {
 		labelsMap["m1k1o.neko_rooms.browser_policy"] = "true"
 		labelsMap["m1k1o.neko_rooms.browser_policy.type"] = string(labels.BrowserPolicy.Type)
diff --git a/internal/room/manager.go b/internal/room/manager.go
index f8c89d7..8ca36b4 100644
--- a/internal/room/manager.go
+++ b/internal/room/manager.go
@@ -112,6 +112,8 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 		}
 	}
 
+	containerName := manager.config.InstanceName + "-" + roomName
+
 	//
 	// Allocate ports
 	//
@@ -154,48 +156,6 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 		exposedPorts[port] = struct{}{}
 	}
 
-	//
-	// Set traefik labels
-	//
-
-	containerName := manager.config.InstanceName + "-" + roomName
-	pathPrefix := path.Join("/", manager.config.PathPrefix, roomName)
-
-	// create traefik rule
-	traefikRule := "PathPrefix(`" + pathPrefix + "`)"
-	if manager.config.TraefikDomain != "" && manager.config.TraefikDomain != "*" {
-		// match *.domain.tld as subdomain
-		if strings.HasPrefix(manager.config.TraefikDomain, "*.") {
-			traefikRule = fmt.Sprintf(
-				"Host(`%s.%s`)",
-				roomName,
-				strings.TrimPrefix(manager.config.TraefikDomain, "*."),
-			)
-		} else {
-			traefikRule += " && Host(`" + manager.config.TraefikDomain + "`)"
-		}
-	} else {
-		traefikRule += " && HostRegexp(`{host:.+}`)"
-	}
-
-	traefikLabels := map[string]string{
-		"traefik.enable": "true",
-		"traefik.http.services." + containerName + "-frontend.loadbalancer.server.port": fmt.Sprintf("%d", frontendPort),
-		"traefik.http.routers." + containerName + ".entrypoints":                        manager.config.TraefikEntrypoint,
-		"traefik.http.routers." + containerName + ".rule":                               traefikRule,
-		"traefik.http.middlewares." + containerName + "-rdr.redirectregex.regex":        pathPrefix + "$$",
-		"traefik.http.middlewares." + containerName + "-rdr.redirectregex.replacement":  pathPrefix + "/",
-		"traefik.http.middlewares." + containerName + "-prf.stripprefix.prefixes":       pathPrefix + "/",
-		"traefik.http.routers." + containerName + ".middlewares":                        containerName + "-rdr," + containerName + "-prf",
-		"traefik.http.routers." + containerName + ".service":                            containerName + "-frontend",
-	}
-
-	// optional HTTPS
-	if manager.config.TraefikCertresolver != "" {
-		traefikLabels["traefik.http.routers."+containerName+".tls"] = "true"
-		traefikLabels["traefik.http.routers."+containerName+".tls.certresolver"] = manager.config.TraefikCertresolver
-	}
-
 	//
 	// Set internal labels
 	//
@@ -210,15 +170,56 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 
 	labels := manager.serializeLabels(RoomLabels{
 		Name:      roomName,
-		URL:       manager.config.GetRoomUrl(roomName),
+		Mux:       manager.config.Mux,
 		Epr:       epr,
 		NekoImage: settings.NekoImage,
 
 		BrowserPolicy: browserPolicyLabels,
 	})
 
-	for k, v := range traefikLabels {
-		labels[k] = v
+	//
+	// Set traefik labels
+	//
+
+	pathPrefix := path.Join("/", manager.config.PathPrefix, roomName)
+
+	if t := manager.config.Traefik; t.Enabled {
+		// create traefik rule
+		traefikRule := "PathPrefix(`" + pathPrefix + "`)"
+		if t.Domain != "" && t.Domain != "*" {
+			// match *.domain.tld as subdomain
+			if strings.HasPrefix(t.Domain, "*.") {
+				traefikRule = fmt.Sprintf(
+					"Host(`%s.%s`)",
+					roomName,
+					strings.TrimPrefix(t.Domain, "*."),
+				)
+			} else {
+				traefikRule += " && Host(`" + t.Domain + "`)"
+			}
+		} else {
+			traefikRule += " && HostRegexp(`{host:.+}`)"
+		}
+
+		labels["traefik.enable"] = "true"
+		labels["traefik.http.services."+containerName+"-frontend.loadbalancer.server.port"] = fmt.Sprintf("%d", frontendPort)
+		labels["traefik.http.routers."+containerName+".entrypoints"] = t.Entrypoint
+		labels["traefik.http.routers."+containerName+".rule"] = traefikRule
+		labels["traefik.http.middlewares."+containerName+"-rdr.redirectregex.regex"] = pathPrefix + "$$"
+		labels["traefik.http.middlewares."+containerName+"-rdr.redirectregex.replacement"] = pathPrefix + "/"
+		labels["traefik.http.middlewares."+containerName+"-prf.stripprefix.prefixes"] = pathPrefix + "/"
+		labels["traefik.http.routers."+containerName+".middlewares"] = containerName + "-rdr," + containerName + "-prf"
+		labels["traefik.http.routers."+containerName+".service"] = containerName + "-frontend"
+
+		// optional HTTPS
+		if t.Certresolver != "" {
+			labels["traefik.http.routers."+containerName+".tls"] = "true"
+			labels["traefik.http.routers."+containerName+".tls.certresolver"] = t.Certresolver
+		}
+	} else {
+		labels["m1k1o.neko_rooms.proxy.enabled"] = "true"
+		labels["m1k1o.neko_rooms.proxy.path"] = pathPrefix
+		labels["m1k1o.neko_rooms.proxy.port"] = fmt.Sprintf("%d", frontendPort)
 	}
 
 	// add custom labels
@@ -226,8 +227,11 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 		// replace dynamic values in labels
 		label = strings.Replace(label, "{containerName}", containerName, -1)
 		label = strings.Replace(label, "{roomName}", roomName, -1)
-		label = strings.Replace(label, "{traefikEntrypoint}", manager.config.TraefikEntrypoint, -1)
-		label = strings.Replace(label, "{traefikCertresolver}", manager.config.TraefikCertresolver, -1)
+
+		if t := manager.config.Traefik; t.Enabled {
+			label = strings.Replace(label, "{traefikEntrypoint}", t.Entrypoint, -1)
+			label = strings.Replace(label, "{traefikCertresolver}", t.Certresolver, -1)
+		}
 
 		v := strings.SplitN(label, "=", 2)
 		if len(v) != 2 {
@@ -436,7 +440,7 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 
 	networkingConfig := &network.NetworkingConfig{
 		EndpointsConfig: map[string]*network.EndpointSettings{
-			manager.config.TraefikNetwork: {},
+			manager.config.InstanceNetwork: {},
 		},
 	}
 
@@ -569,6 +573,10 @@ func (manager *RoomManagerCtx) GetSettings(id string) (*types.RoomSettings, erro
 		Resources:      roomResources,
 	}
 
+	if labels.Mux {
+		settings.MaxConnections = 0
+	}
+
 	err = settings.FromEnv(container.Config.Env)
 	return &settings, err
 }
diff --git a/internal/server/manager.go b/internal/server/manager.go
index 5bd7e19..55a1d2d 100644
--- a/internal/server/manager.go
+++ b/internal/server/manager.go
@@ -2,9 +2,12 @@ package server
 
 import (
 	"context"
+	"io/ioutil"
+	"net"
 	"net/http"
 	"os"
 	"path"
+	"path/filepath"
 	"time"
 
 	"github.com/go-chi/chi"
@@ -24,7 +27,7 @@ type ServerManagerCtx struct {
 	config *config.Server
 }
 
-func New(ApiManager types.ApiManager, pathPrefix string, config *config.Server) *ServerManagerCtx {
+func New(ApiManager types.ApiManager, roomConfig *config.Room, config *config.Server, proxyHandler http.Handler) *ServerManagerCtx {
 	logger := log.With().Str("module", "server").Logger()
 
 	router := chi.NewRouter()
@@ -49,32 +52,167 @@ func New(ApiManager types.ApiManager, pathPrefix string, config *config.Server)
 		MaxAge:           300, // Maximum value not ignored by any of major browsers
 	}))
 
-	router.Route("/api", ApiManager.Mount)
-
-	// serve static files
-	if config.Static != "" {
-		fs := http.FileServer(http.Dir(config.Static))
-		router.Get("/*", func(w http.ResponseWriter, r *http.Request) {
-			if _, err := os.Stat(config.Static + r.URL.Path); !os.IsNotExist(err) {
-				fs.ServeHTTP(w, r)
-			} else {
-				http.NotFound(w, r)
-			}
-		})
-	}
-
-	// add simple lobby room
-	router.Get(path.Join("/", pathPrefix, "{roomName}"), ApiManager.RoomLobby)
-	router.Get(path.Join("/", pathPrefix, "{roomName}")+"/", ApiManager.RoomLobby)
-
 	// mount pprof endpoint
 	if config.PProf {
 		withPProf(router)
 		logger.Info().Msgf("with pprof endpoint at %s", pprofPath)
 	}
 
-	// we could use custom 404
-	router.NotFound(http.NotFound)
+	//
+	// admin page
+	//
+
+	protected := func(next http.Handler) http.Handler {
+		// if proxy auth is enabled
+		if config.Admin.ProxyAuth != "" {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				req, err := http.NewRequest("GET", config.Admin.ProxyAuth, nil)
+				if err != nil {
+					logger.Err(err).Msg("proxy auth request `http.NewRequest` err")
+					http.Error(w, "proxy auth failed", http.StatusForbidden)
+					return
+				}
+
+				//
+				// copy headers
+				//
+
+				for k, vv := range r.Header {
+					for _, v := range vv {
+						req.Header.Add(k, v)
+					}
+				}
+
+				//
+				// add x-forwarded headers
+				//
+
+				if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+					req.Header.Add("X-Forwarded-For", clientIP)
+				}
+
+				if r.Method != "" {
+					req.Header.Add("X-Forwarded-Method", r.Method)
+				} else {
+					req.Header.Del("X-Forwarded-Method")
+				}
+
+				if r.TLS != nil {
+					req.Header.Add("X-Forwarded-Proto", "https")
+				} else {
+					req.Header.Add("X-Forwarded-Proto", "http")
+				}
+
+				if r.Host != "" {
+					req.Header.Add("X-Forwarded-Host", r.Host)
+				} else {
+					req.Header.Del("X-Forwarded-Host")
+				}
+
+				if r.URL.RequestURI() != "" {
+					req.Header.Add("X-Forwarded-Uri", r.URL.RequestURI())
+				} else {
+					req.Header.Del("X-Forwarded-Uri")
+				}
+
+				client := &http.Client{
+					CheckRedirect: func(req *http.Request, via []*http.Request) error {
+						return http.ErrUseLastResponse
+					},
+				}
+
+				res, err := client.Do(req)
+				if err != nil {
+					logger.Err(err).Msg("proxy auth request `client.Do` err")
+					http.Error(w, "proxy auth failed", http.StatusForbidden)
+					return
+				}
+				defer res.Body.Close()
+
+				// read whole body
+				body, err := ioutil.ReadAll(res.Body)
+				if err != nil {
+					logger.Err(err).Msg("proxy auth request `ioutil.ReadAll` err")
+					http.Error(w, "proxy auth failed", http.StatusForbidden)
+					return
+				}
+
+				if res.StatusCode < 200 || res.StatusCode >= 300 {
+					// copy headers
+					for k, vv := range res.Header {
+						for _, v := range vv {
+							w.Header().Add(k, v)
+						}
+					}
+
+					// copy status & body
+					w.WriteHeader(res.StatusCode)
+					w.Write(body)
+					return
+				}
+
+				next.ServeHTTP(w, r)
+			})
+		}
+
+		// if basic auth is enabled
+		if config.Admin.Username != "" && config.Admin.Password != "" {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				user, pass, ok := r.BasicAuth()
+				if !ok || user != config.Admin.Username || pass != config.Admin.Password {
+					w.Header().Add("WWW-Authenticate", `Basic realm="neko-rooms admin"`)
+					w.WriteHeader(http.StatusUnauthorized)
+					return
+				}
+
+				next.ServeHTTP(w, r)
+			})
+		}
+
+		return next
+	}
+
+	// cache static file paths
+	staticFiles := map[string]struct{}{}
+	if config.Admin.Static != "" {
+		filepath.Walk(config.Admin.Static,
+			func(p string, info os.FileInfo, err error) error {
+				if err != nil {
+					return err
+				}
+				staticFiles[path.Clean(p)] = struct{}{}
+				return nil
+			})
+	}
+
+	// serve static files
+	router.Use(func(next http.Handler) http.Handler {
+		// if static files are disabled
+		if config.Admin.Static == "" {
+			return next
+		}
+
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			filePath := path.Join(config.Admin.Static, r.URL.Path)
+
+			// check if file exists to serve it
+			if _, ok := staticFiles[filePath]; ok {
+				// serve protected assets
+				protected(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					http.ServeFile(w, r, filePath)
+				})).ServeHTTP(w, r)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	})
+
+	// serve protected API
+	router.With(protected).Route("/api", ApiManager.Mount)
+
+	// handle all remaining paths with proxy
+	router.Handle("/*", proxyHandler)
 
 	return &ServerManagerCtx{
 		logger: logger,
diff --git a/internal/types/api.go b/internal/types/api.go
index aff7b4d..e0bfed5 100644
--- a/internal/types/api.go
+++ b/internal/types/api.go
@@ -1,13 +1,9 @@
 package types
 
 import (
-	"net/http"
-
 	"github.com/go-chi/chi"
 )
 
 type ApiManager interface {
 	Mount(r chi.Router)
-
-	RoomLobby(w http.ResponseWriter, r *http.Request)
 }
diff --git a/internal/types/proxy.go b/internal/types/proxy.go
new file mode 100644
index 0000000..f5b2cb0
--- /dev/null
+++ b/internal/types/proxy.go
@@ -0,0 +1,8 @@
+package types
+
+import "net/http"
+
+type ProxyManager interface {
+	ServeHTTP(w http.ResponseWriter, r *http.Request)
+	Shutdown() error
+}
diff --git a/internal/types/room.go b/internal/types/room.go
index e0e266d..2e7ab5a 100644
--- a/internal/types/room.go
+++ b/internal/types/room.go
@@ -38,7 +38,7 @@ type RoomEntry struct {
 	Name           string    `json:"name"`
 	NekoImage      string    `json:"neko_image"`
 	IsOutdated     bool      `json:"is_outdated"`
-	MaxConnections uint16    `json:"max_connections"` // ignored when using mux
+	MaxConnections uint16    `json:"max_connections"` // 0 when using mux
 	Running        bool      `json:"running"`
 	Status         string    `json:"status"`
 	Created        time.Time `json:"created"`
@@ -69,7 +69,7 @@ type RoomResources struct {
 type RoomSettings struct {
 	Name           string `json:"name"`
 	NekoImage      string `json:"neko_image"`
-	MaxConnections uint16 `json:"max_connections"` // ignored when using mux
+	MaxConnections uint16 `json:"max_connections"` // 0 when using mux
 
 	ControlProtection bool `json:"control_protection"`
 	ImplicitControl   bool `json:"implicit_control"`
diff --git a/internal/utils/array.go b/internal/utils/array.go
index 20b4f8d..a84853b 100644
--- a/internal/utils/array.go
+++ b/internal/utils/array.go
@@ -1,22 +1,12 @@
 package utils
 
-import (
-	"reflect"
-)
+func ArrayIn[T comparable](val T, array []T) (exists bool, index int) {
+	exists, index = false, -1
 
-func ArrayIn(val interface{}, array interface{}) (exists bool, index int) {
-	exists = false
-	index = -1
-
-	switch reflect.TypeOf(array).Kind() {
-	case reflect.Slice:
-		s := reflect.ValueOf(array)
-		for i := 0; i < s.Len(); i++ {
-			if reflect.DeepEqual(val, s.Index(i).Interface()) {
-				index = i
-				exists = true
-				return
-			}
+	for i, a := range array {
+		if a == val {
+			exists, index = true, i
+			return
 		}
 	}
 
diff --git a/neko.go b/neko.go
index 07ca2c3..da8c7d6 100644
--- a/neko.go
+++ b/neko.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/m1k1o/neko-rooms/internal/api"
 	"github.com/m1k1o/neko-rooms/internal/config"
+	"github.com/m1k1o/neko-rooms/internal/proxy"
 	"github.com/m1k1o/neko-rooms/internal/pull"
 	"github.com/m1k1o/neko-rooms/internal/room"
 	"github.com/m1k1o/neko-rooms/internal/server"
@@ -62,7 +63,6 @@ func init() {
 		Configs: &Configs{
 			Root:   &config.Root{},
 			Server: &config.Server{},
-			API:    &config.API{},
 			Room:   &config.Room{},
 		},
 	}
@@ -100,7 +100,6 @@ func (i *Version) Details() string {
 type Configs struct {
 	Root   *config.Root
 	Server *config.Server
-	API    *config.API
 	Room   *config.Room
 }
 
@@ -112,6 +111,7 @@ type MainCtx struct {
 	roomManager   *room.RoomManagerCtx
 	pullManager   *pull.PullManagerCtx
 	apiManager    *api.ApiManagerCtx
+	proxyManager  *proxy.ProxyManagerCtx
 	serverManager *server.ServerManagerCtx
 }
 
@@ -140,20 +140,31 @@ func (main *MainCtx) Start() {
 	main.apiManager = api.New(
 		main.roomManager,
 		main.pullManager,
-		main.Configs.API,
 	)
 
+	main.proxyManager = proxy.New(
+		client,
+		main.Configs.Room.InstanceName,
+	)
+	main.proxyManager.Start()
+
 	main.serverManager = server.New(
 		main.apiManager,
-		main.Configs.Room.PathPrefix,
+		main.Configs.Room,
 		main.Configs.Server,
+		main.proxyManager,
 	)
 	main.serverManager.Start()
 }
 
 func (main *MainCtx) Shutdown() {
-	err := main.serverManager.Shutdown()
+	var err error
+
+	err = main.serverManager.Shutdown()
 	main.logger.Err(err).Msg("server manager shutdown")
+
+	err = main.proxyManager.Shutdown()
+	main.logger.Err(err).Msg("proxy manager shutdown")
 }
 
 func (main *MainCtx) ServeCommand(cmd *cobra.Command, args []string) {
diff --git a/traefik/.env.example b/traefik/.env.example
new file mode 100644
index 0000000..be6d773
--- /dev/null
+++ b/traefik/.env.example
@@ -0,0 +1,9 @@
+NEKO_ROOMS_EPR=59000-59049
+NEKO_ROOMS_NAT1TO1=192.168.1.20
+
+NEKO_ROOMS_TRAEFIK_DOMAIN=neko-rooms.server.lan
+NEKO_ROOMS_TRAEFIK_ENTRYPOINT=websecure
+NEKO_ROOMS_TRAEFIK_NETWORK=neko-rooms-traefik
+NEKO_ROOMS_TRAEFIK_CERTRESOLVER=lets-encrypt
+
+TZ=Europe/Vienna
diff --git a/traefik/README.md b/traefik/README.md
new file mode 100644
index 0000000..a4a6f45
--- /dev/null
+++ b/traefik/README.md
@@ -0,0 +1,67 @@
+# Installation guide for traefik as reverse proxy
+
+## Zero-knowledge installation
+
+If you don't have any clue about docker and stuff but only want to have fun with friends in a shared browser, we got you covered!
+
+- Rent a VPS with public IP and OS Ubuntu.
+- Get a domain name pointing to your IP (you can even get some for free).
+- Run install script and follow instructions.
+
+```bash
+wget -O neko-rooms.sh https://raw.githubusercontent.com/m1k1o/neko-rooms/master/traefik/install
+sudo bash neko-rooms.sh
+```
+
+## How to start
+
+You need to have installed `Docker` and `docker-compose`. You need to have a custom domain pointing to your server's IP.
+
+You can watch installation video provided by *Dr R1ck*:
+
+https://www.youtube.com/watch?v=cCmnw-pq0gA
+
+### Installation guide
+
+You only need `.env.example`, `docker-compose.yml` and `traefik/`.
+
+#### Do I need to use traefik?
+
+- This project started with Traefik as a needed dependency. That, however, changed. Traefik must not be used but the original setup can still be used.
+- Traefik is used to forward traffic to the rooms. You can put nginx in front of it.
+- See example configuration for [nginx](./nginx).
+
+You can use `docker-compose.http.yml` that will expose this service to `8080` or any port. Authentication is optional. Start it quickly with `docker-compose -f docker-compose.http.yml up -d`.
+
+### Step 1
+
+Copy `.env.example` to `.env` and customize.
+
+```bash
+cp .env.example .env
+```
+
+### Step 2
+
+Create `usersfile` with your users:
+
+```bash
+touch usersfile
+```
+
+And add as many users as you like:
+
+```bash
+echo $(htpasswd -nb user password) >> usersfile
+```
+
+### Step 3 (HTTPS only)
+
+Create `acme.json`
+
+```bash
+touch acme.json
+chmod 600 acme.json
+```
+
+Update your email in `traefik.yml`.
diff --git a/docker-compose.http.yml b/traefik/docker-compose.http.yml
similarity index 100%
rename from docker-compose.http.yml
rename to traefik/docker-compose.http.yml
diff --git a/traefik/docker-compose.yml b/traefik/docker-compose.yml
new file mode 100644
index 0000000..67fe6f1
--- /dev/null
+++ b/traefik/docker-compose.yml
@@ -0,0 +1,43 @@
+version: "3.5"
+
+#
+# This docker compose needs .env file.
+# Copy .env.example to .env and modify.
+#
+
+networks:
+  default:
+    attachable: "true"
+    name: "${NEKO_ROOMS_TRAEFIK_NETWORK}"
+
+services:
+  traefik:
+    image: "traefik:2.4"
+    restart: "unless-stopped"
+    environment:
+      - "TZ"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "./traefik.yml:/etc/traefik/traefik.yml:ro"
+      - "./usersfile:/usersfile:ro"
+      - "./acme.json:/acme.json"
+      - "./config:/config"
+
+  neko-rooms:
+    image: "m1k1o/neko-rooms:latest"
+    restart: "unless-stopped"
+    env_file:
+      - ".env"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.neko-rooms-frontend.loadbalancer.server.port=8080"
+      - "traefik.http.routers.neko-rooms.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}"
+      - "traefik.http.routers.neko-rooms.rule=Host(`${NEKO_ROOMS_TRAEFIK_DOMAIN}`)"
+      - "traefik.http.routers.neko-rooms.tls=true"
+      - "traefik.http.routers.neko-rooms.tls.certresolver=${NEKO_ROOMS_TRAEFIK_CERTRESOLVER}"
+      - "traefik.http.routers.neko-rooms.middlewares=basicauth@file"
diff --git a/install b/traefik/install
similarity index 99%
rename from install
rename to traefik/install
index 74627d9..20e0d4a 100755
--- a/install
+++ b/traefik/install
@@ -239,7 +239,7 @@ echo "[Y] Downloading traefik config..."
 # Download docker compose file
 #
 
-wget -O "./docker-compose.yml" "https://raw.githubusercontent.com/m1k1o/neko-rooms/master/docker-compose.yml"
+wget -O "./docker-compose.yml" "https://raw.githubusercontent.com/m1k1o/neko-rooms/master/traefik/docker-compose.yml"
 
 # Pull neko images
 for NEKO_IMAGE in "${NEKO_IMAGES[@]}"; do
diff --git a/docs/nginx/docker-compose.yml b/traefik/nginx/docker-compose.yml
similarity index 100%
rename from docs/nginx/docker-compose.yml
rename to traefik/nginx/docker-compose.yml
diff --git a/docs/nginx/nginx.conf b/traefik/nginx/nginx.conf
similarity index 100%
rename from docs/nginx/nginx.conf
rename to traefik/nginx/nginx.conf