diff --git a/pottwal.yml b/pottwal.yml
index e5367f9..4275be9 100644
--- a/pottwal.yml
+++ b/pottwal.yml
@@ -21,6 +21,17 @@
       vars:
         docker_data_root: "/srv/docker"
     - role: apache
+    - role: apache-letsencrypt  # Uses configuration from dehydrated setup
+    - role: ansible-role-dehydrated
+      vars:
+        dehydrated_contact_email: "{{ server_admin }}"
+        dehydrated_domains:
+        - name: gitea.n39.eu
+        - name: uritools.n39.eu
+        - name: entities-validation.svc.n39.eu
+        - name: sl.n39.eu
+        - name: pad.n39.eu
+    - role: penguineer.dehydrated_cron
     - role: dd24-dyndns-cron
       # variables are set in the inventory
 
@@ -46,8 +57,7 @@
         restart_policy: unless-stopped
         detach: yes
         ports:
-#          - 127.0.0.1:{{ gitea_host_port }}:3000
-          - "{{ gitea_host_port }}:3000"
+          - 127.0.0.1:{{ gitea_host_port }}:3000
           - 2222:2222
         env:
           APP_NAME="Netz39 Gitea"
@@ -89,7 +99,7 @@
         state: started
         detach: yes
         ports:
-          - "{{ uritools_host_port }}:8080"
+          - "127.0.0.1:{{ uritools_host_port }}:8080"
         restart_policy: unless-stopped
 
     - name: Setup proxy site uritools.n39.eu
@@ -107,7 +117,7 @@
         state: started
         detach: yes
         ports:
-          - "{{ entities_validation_svc_host_port }}:8080"
+          - "127.0.0.1:{{ entities_validation_svc_host_port }}:8080"
         restart_policy: unless-stopped
 
     - name: Setup proxy site entities-validation.svc.n39.eu
@@ -125,7 +135,7 @@
         state: started
         detach: yes
         ports:
-          - "{{ shlink_host_port }}:8080"
+          - "127.0.0.1:{{ shlink_host_port }}:8080"
         restart_policy: unless-stopped
         env:
           SHORT_DOMAIN_HOST: "{{ shlink_domain_name }}"
@@ -187,7 +197,7 @@
         state: started
         detach: yes
         ports:
-          - "{{ hedgedoc_host_port }}:3000"
+          - "127.0.0.1:{{ hedgedoc_host_port }}:3000"
         restart_policy: unless-stopped
         env:
           NODE_ENV: "production"