diff --git a/.env.sample b/.env.sample
index ab6fd7c..5f97943 100644
--- a/.env.sample
+++ b/.env.sample
@@ -185,3 +185,6 @@ COMPOSE_FILE="compose.yml"
 #ANUBIS_OG_EXPIRY_TIME=1h
 #ANUBIS_OG_CACHE_CONSIDER_HOST=true
 #ANUBIS_SERVE_ROBOTS_TXT=true
+
+## Enable onion service support
+#ONION_ENABLED=1
diff --git a/README.md b/README.md
index 5e7f334..dd7cc0e 100644
--- a/README.md
+++ b/README.md
@@ -68,4 +68,8 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
+## Enabling onion service
+
+Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
+
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
diff --git a/abra.sh b/abra.sh
index 2df62cd..2054e3f 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v28
+export TRAEFIK_YML_VERSION=v29
 export FILE_PROVIDER_YML_VERSION=v11
 export ENTRYPOINT_VERSION=v5
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 8a9c812..e01b621 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -11,14 +11,14 @@ providers:
     endpoint: "tcp://socket-proxy:2375"
     exposedByDefault: false
     network: proxy
-  {{ if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
+  {{- if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
   file:
     directory: /etc/traefik/file-providers
     watch: true
-  {{ else }}
+  {{- else }}
   file:
     filename: /etc/traefik/file-provider.yml
-  {{ end }}
+  {{- end }}
 
 api:
   dashboard: {{ env "DASHBOARD_ENABLED" }}
@@ -42,86 +42,90 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
-  {{ if eq (env "GITEA_SSH_ENABLED") "1" }}
+  {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
-  {{ end }}
-  {{ if eq (env "P2PANDA_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "P2PANDA_ENABLED") "1" }}
   p2panda-udp-v4:
     address: ":2022/udp"
   p2panda-udp-v6:
     address: ":2023/udp"
-  {{ end }}
-  {{ if eq (env "GARAGE_RPC_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "GARAGE_RPC_ENABLED") "1" }}
   garage-rpc:
     address: ":3901"
-  {{ end }}
-  {{ if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
-  {{ end }}
-  {{ if eq (env "SMTP_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "SMTP_ENABLED") "1" }}
   smtp-submission:
     address: ":587"
-  {{ end }}
-  {{ if eq (env "PEERTUBE_RTMP_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "PEERTUBE_RTMP_ENABLED") "1" }}
   peertube-rtmp:
     address: ":1935"
-  {{ end }}
-  {{ if eq (env "WEB_ALT_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "WEB_ALT_ENABLED") "1" }}
   web-alt:
     address: ":8000"
-  {{ end }}
-  {{ if eq (env "SSB_MUXRPC_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "SSB_MUXRPC_ENABLED") "1" }}
   ssb-muxrpc:
     address: ":8008"
-  {{ end }}
-  {{ if eq (env "MSSQL_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "MSSQL_ENABLED") "1" }}
   mssql:
     address: ":1433"
-  {{ end }}
-  {{ if eq (env "MUMBLE_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "MUMBLE_ENABLED") "1" }}
   mumble:
     address: ":64738"
   mumble-udp:
     address: ":64738/udp"
-  {{ end }}
-  {{ if eq (env "COMPY_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "COMPY_ENABLED") "1" }}
   compy:
     address: ":9999"
-  {{ end }}
-  {{ if eq (env "IRC_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "IRC_ENABLED") "1" }}
   irc:
     address: ":6697"
-  {{ end }}
-  {{ if eq (env "METRICS_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
   metrics:
     address: ":8082"
     http:
       middlewares:
         - basicauth@file
-  {{ end }}
-  {{ if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
   matrix-federation:
     address: ":9001"
-  {{ end }}
-  {{ if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }}
+  {{- end }}
+  {{- if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }}
   nextcloud-talk-hpb:
     address: ":3478"
   nextcloud-talk-hpb-udp:
     address: ":3478/udp"
-  {{ end }}
+  {{- end }}
+  {{- if eq (env "ONION_ENABLED") "1" }}
+  onion:
+    address: ":9052"
+  {{- end }}
 
 ping:
   entryPoint: web
 
-{{ if eq (env "METRICS_ENABLED") "1" }}
+{{- if eq (env "METRICS_ENABLED") "1" }}
 metrics:
   prometheus:
     entryPoint: metrics
     addRoutersLabels: true
     addServicesLabels: true
-{{ end }}
+{{- end }}
 
 certificatesResolvers:
   staging:
@@ -131,23 +135,23 @@ certificatesResolvers:
       caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
       httpChallenge:
         entryPoint: web
-      {{ if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
+      {{- if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
       dnsChallenge:
         provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
         resolvers:
           - "1.1.1.1:53"
           - "8.8.8.8:53"
-      {{ end }}
+      {{- end }}
   production:
     acme:
       email: {{ env "LETS_ENCRYPT_EMAIL" }}
       storage: /etc/letsencrypt/production-acme.json
       httpChallenge:
         entryPoint: web
-      {{ if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
+      {{- if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
       dnsChallenge:
         provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
         resolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
-      {{ end }}
+      {{- end }}