diff --git a/modules/elk/jobspec.nomad.hcl b/modules/elk/jobspec.nomad.hcl
index 42fe827..4a01b70 100644
--- a/modules/elk/jobspec.nomad.hcl
+++ b/modules/elk/jobspec.nomad.hcl
@@ -144,7 +144,7 @@ job "elk" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.es.rule=Host(`es.brmartin.co.uk`)",
-          "traefik.http.routers.es.entrypoints=websecure",
+          "traefik.http.routers.es.entrypoints=wanwebsecure,lanwebsecure",
           "traefik.http.routers.es.service=es",
           "traefik.http.services.es.loadbalancer.server.scheme=https",
           "traefik.http.services.es.loadbalancer.serversTransport=es@file",
@@ -350,7 +350,7 @@ job "elk" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.kibana.rule=Host(`kibana.brmartin.co.uk`)",
-          "traefik.http.routers.kibana.entrypoints=websecure",
+          "traefik.http.routers.kibana.entrypoints=wanwebsecure,lanwebsecure",
         ]
       }
     }
diff --git a/modules/forgejo/jobspec.nomad.hcl b/modules/forgejo/jobspec.nomad.hcl
index 107709e..68c5663 100644
--- a/modules/forgejo/jobspec.nomad.hcl
+++ b/modules/forgejo/jobspec.nomad.hcl
@@ -250,7 +250,7 @@ job "forgejo" {
       tags = [
         "traefik.enable=true",
 
-        "traefik.http.routers.forgejo.entrypoints=websecure",
+        "traefik.http.routers.forgejo.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.forgejo.rule=Host(`git.brmartin.co.uk`)"
       ]
 
diff --git a/modules/home-assistant/jobspec.nomad.hcl b/modules/home-assistant/jobspec.nomad.hcl
index 54a0700..271e4af 100644
--- a/modules/home-assistant/jobspec.nomad.hcl
+++ b/modules/home-assistant/jobspec.nomad.hcl
@@ -45,7 +45,7 @@ job "homeassistant" {
       provider = "consul"
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.homeassistant.entrypoints=websecure",
+        "traefik.http.routers.homeassistant.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.homeassistant.rule=Host(`homeassistant.brmartin.co.uk`)"
       ]
     }
diff --git a/modules/keycloak/jobspec.nomad.hcl b/modules/keycloak/jobspec.nomad.hcl
index ea445da..b4313b3 100644
--- a/modules/keycloak/jobspec.nomad.hcl
+++ b/modules/keycloak/jobspec.nomad.hcl
@@ -99,7 +99,7 @@ job "keycloak" {
         "traefik.enable=true",
 
         "traefik.http.routers.keycloak.rule=Host(`sso.brmartin.co.uk`)",
-        "traefik.http.routers.keycloak.entrypoints=websecure",
+        "traefik.http.routers.keycloak.entrypoints=wanwebsecure,lanwebsecure",
       ]
 
       connect {
diff --git a/modules/matrix/jobspec.nomad.hcl b/modules/matrix/jobspec.nomad.hcl
index 263baba..0f6dcfa 100644
--- a/modules/matrix/jobspec.nomad.hcl
+++ b/modules/matrix/jobspec.nomad.hcl
@@ -476,7 +476,7 @@ job "matrix" {
         "traefik.enable=true",
 
         "traefik.http.routers.synapse.rule=Host(`matrix.brmartin.co.uk`)",
-        "traefik.http.routers.synapse.entrypoints=websecure",
+        "traefik.http.routers.synapse.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.synapse.middlewares=synapseHeaders,synapseBuffering",
         "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowmethods=GET,POST,PUT,DELETE,OPTIONS",
         "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowheaders=Origin,X-Requested-With,Content-Type,Accept,Authorization",
@@ -521,7 +521,7 @@ job "matrix" {
         "traefik.enable=true",
 
         "traefik.http.routers.mas.rule=Host(`mas.brmartin.co.uk`) || (Host(`matrix.brmartin.co.uk`) && PathRegexp(`^/_matrix/client/(.*)/(login|logout|refresh)`))",
-        "traefik.http.routers.mas.entrypoints=websecure",
+        "traefik.http.routers.mas.entrypoints=wanwebsecure,lanwebsecure",
       ]
 
       connect {
@@ -556,7 +556,7 @@ job "matrix" {
         "traefik.enable=true",
 
         "traefik.http.routers.matrixWellKnown.rule=PathPrefix(`/.well-known/matrix`)",
-        "traefik.http.routers.matrixWellKnown.entrypoints=websecure",
+        "traefik.http.routers.matrixWellKnown.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.matrixWellKnown.middlewares=matrixWellKnown",
         "traefik.http.middlewares.matrixWellKnown.headers.accesscontrolalloworiginlist=*",
       ]
@@ -664,7 +664,7 @@ job "matrix" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.element.rule=Host(`element.brmartin.co.uk`)",
-          "traefik.http.routers.element.entrypoints=websecure",
+          "traefik.http.routers.element.entrypoints=wanwebsecure,lanwebsecure",
         ]
 
         port         = "element"
@@ -708,7 +708,7 @@ job "matrix" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.cinny.rule=Host(`cinny.brmartin.co.uk`)",
-          "traefik.http.routers.cinny.entrypoints=websecure",
+          "traefik.http.routers.cinny.entrypoints=wanwebsecure,lanwebsecure",
         ]
 
         port         = "cinny"
diff --git a/modules/media-centre/jobspec.nomad.hcl b/modules/media-centre/jobspec.nomad.hcl
index 2597cd3..4f2bc88 100644
--- a/modules/media-centre/jobspec.nomad.hcl
+++ b/modules/media-centre/jobspec.nomad.hcl
@@ -56,7 +56,7 @@ job "media-centre" {
       port     = "jellyfin"
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.jellyfin.entrypoints=websecure",
+        "traefik.http.routers.jellyfin.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.jellyfin.rule=Host(`jellyfin.brmartin.co.uk`)"
       ]
     }
@@ -148,7 +148,7 @@ job "media-centre" {
       port     = "plex"
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.plex.entrypoints=websecure",
+        "traefik.http.routers.plex.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.plex.rule=Host(`plex.brmartin.co.uk`)"
       ]
     }
@@ -191,7 +191,7 @@ job "media-centre" {
       port     = "tautulli"
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.tautulli.entrypoints=websecure",
+        "traefik.http.routers.tautulli.entrypoints=wanwebsecure,lanwebsecure",
         "traefik.http.routers.tautulli.rule=Host(`tautulli.brmartin.co.uk`)"
       ]
     }