"you see, at some point in time the password was bypassed for users on local network 192.168.1.0/24, however the traefik ingress lives on 192.168.1.1"

which of course is his real problem (reverse proxy, microservices). And of course he has to double down and pile on even more complexity as the solution, instead of throwing out all the crap he's stacked together and coming up with something simple, performant and sane.