hide traefik 8080 port for dashboard behind /traefik/ or /dashboard/ still not pwd protected, but it is only on local net anyway

docker-compose.yml

@@ -5,11 +5,9 @@ services:
     image: "traefik"
     restart: unless-stopped
     network_mode: host
-    labels:
-      - "com.centurylinklabs.watchtower.enable=true"
     command:
 #      - "--log.level=DEBUG"
-      - "--api.insecure=true"
+      - "--api.dashboard=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.useBindPortIP=true"
@@ -20,10 +18,16 @@ services:
       - "--entrypoints.secureweb.address=:443"
       - "--metrics"
       - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=PathPrefix(`/traefik`) || PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
+      - "traefik.http.routers.dashboard.entrypoints=web"
+      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
+      - "traefik.http.routers.dashboard.service=api@internal"
     ports:
       - "80:80"
       - "443:443"
-      - "8080:8080"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "/srv/docker/container/traefik/:/configuration"