diff --git a/services/tiddlypwa.hcl b/services/tiddlypwa.hcl
index 9b0815c..467e5c9 100644
--- a/services/tiddlypwa.hcl
+++ b/services/tiddlypwa.hcl
@@ -77,9 +77,21 @@ job "tiddlypwa" {
         port = "http"
         tags = [
           "traefik.enable=true",
-          "traefik.http.routers.whoami.rule=Host(`wiki.alo.land`)",
-          "traefik.http.routers.whoami.entryPoints=websecure",
-          #"traefik.http.routers.whoami.middlewares=authentik@file",
+          "traefik.http.routers.tiddlypwa-main.rule=Host(`wiki.alo.land`)",
+          "traefik.http.routers.tiddlypwa-main.entryPoints=websecure",
+          "traefik.http.routers.tiddlypwa-main.middlewares=authentik@file",
+          # by default, / is the admin UI and the wikis are behind a token
+          # move the admin from / to /admin
+          "traefik.http.routers.tiddlypwa-admin.rule=Host(`wiki.alo.land`) && Path(`/admin`)",
+          "traefik.http.routers.tiddlypwa-admin.entryPoints=websecure",
+          "traefik.http.routers.tiddlypwa-admin.middlewares=authentik@file,tiddlypwa-admin",
+          "traefik.http.middlewares.tiddlypwa-admin.replacepath.path=/",
+          # redirect / to the alo wiki
+          "traefik.http.routers.tiddlypwa-root.rule=Host(`wiki.alo.land`) && Path(`/`)",
+          "traefik.http.routers.tiddlypwa-root.entryPoints=websecure",
+          "traefik.http.routers.tiddlypwa-root.middlewares=authentik@file,tiddlypwa-root",
+          "traefik.http.middlewares.tiddlypwa-root.redirectregex.regex=^https://wiki.alo.land/$",
+          "traefik.http.middlewares.tiddlypwa-root.redirectregex.replacement=https://wiki.alo.land/3B5wygCxN7Xq47G9Gr6wD/app.html",
         ]
       }
     }