diff --git a/k8s/riju-proxy.yaml b/k8s/riju-proxy.yaml
index 08bc319..7e1543d 100644
--- a/k8s/riju-proxy.yaml
+++ b/k8s/riju-proxy.yaml
@@ -91,3 +91,34 @@ spec:
             - name: auth
               mountPath: /etc/squid/passwd
               subPath: htpasswd
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  namespace: riju
+  name: riju-proxy
+spec:
+  selector:
+    app: riju-proxy
+  ports:
+    - name: http
+      port: 3128
+      targetPort: 3128
+
+---
+kind: IngressRoute
+apiVersion: traefik.containo.us/v1alpha1
+metadata:
+  namespace: riju
+  name: riju-proxy
+spec:
+  entryPoints:
+    - proxy
+  routes:
+    - kind: Rule
+      match: "PathPrefix(`/`)"
+      services:
+        - namespace: riju
+          name: riju-proxy
+          port: 3128
diff --git a/k8s/traefik-config.in.yaml b/k8s/traefik-config.in.yaml
index 041bc8c..a4942fe 100644
--- a/k8s/traefik-config.in.yaml
+++ b/k8s/traefik-config.in.yaml
@@ -7,6 +7,13 @@ metadata:
 data:
   traefik.yaml: |
     entryPoints:
+      proxy:
+        address: ":3128"
+        http:
+          tls:
+            certResolver: riju
+            domains:
+              - main: k8s.riju.codes
       http:
         address: ":8000"
       https:
diff --git a/k8s/traefik.yaml b/k8s/traefik.yaml
index 03bf0bd..78a3f26 100644
--- a/k8s/traefik.yaml
+++ b/k8s/traefik.yaml
@@ -124,6 +124,8 @@ spec:
   selector:
     app: traefik
   ports:
+    - port: 3128
+      name: squid
     - port: 80
       name: http
       targetPort: 8000