diff --git a/roles/netbootxyz/defaults/main.yml b/roles/netbootxyz/defaults/main.yml
new file mode 100644
index 00000000..068e3294
--- /dev/null
+++ b/roles/netbootxyz/defaults/main.yml
@@ -0,0 +1,20 @@
+---
+netbootxyz_enabled: false
+netbootxyz_available_externally: "false"
+
+# directories
+netbootxyz_config_directory: "{{ docker_home }}/netbootxyz/config"
+netbootxyz_assets_directory: "{{ docker_home }}/netbootxyz/assets"
+
+# network
+netbootxyz_hostname: netbootxyz
+netbootxyz_port_http: "3002"
+netbootxyz_port_http2: "5803"
+netbootxyz_port_tftp: "69"
+
+# uid/gid
+netbootxyz_user_id: "1000"
+netbootxyz_group_id: "1000"
+
+# specs
+netbootxyz_memory: 1g
diff --git a/roles/netbootxyz/tasks/main.yml b/roles/netbootxyz/tasks/main.yml
index ca919751..e2d33026 100644
--- a/roles/netbootxyz/tasks/main.yml
+++ b/roles/netbootxyz/tasks/main.yml
@@ -1,4 +1,3 @@
-
 ---
 - name: netbootxyz Directory
   file:
@@ -20,14 +19,16 @@
       - "{{ netbootxyz_port_http }}:3000"
       - "{{ netbootxyz_port_http2 }}:80"
       - "{{ netbootxyz_port_tftp }}:69/udp"
+    memory: "{{ netbootxyz_memory }}"
     env:
       TZ: "{{ ansible_nas_timezone }}"
       PUID: "{{ netbootxyz_user_id }}"
       PGID: "{{ netbootxyz_group_id }}"
     restart_policy: unless-stopped
     labels:
-      traefik.backend: "netbootxyz"
-      traefik.frontend.rule: "Host:netbootxyz.{{ ansible_nas_domain }}"
-      traefik.enable: "{{ netbootxyz_available_externally }}"
-      traefik.port: "80"
-    memory: 1g
+      traefik.enable: "{{ netbootxyz_externally }}"
+      traefik.http.routers.netdata.rule: "Host(`{{ netbootxyz_hostname }}.{{ ansible_nas_domain }}`)"
+      traefik.http.routers.netdata.tls.certresolver: "letsencrypt"
+      traefik.http.routers.netdata.tls.domains[0].main: "{{ ansible_nas_domain }}"
+      traefik.http.routers.netdata.tls.domains[0].sans: "*.{{ ansible_nas_domain }}"
+      traefik.http.services.netdata.loadbalancer.server.port: "80"