diff --git a/files/traefik/rules/cvmfs-stratum0-router.yml b/files/traefik/rules/cvmfs-stratum0-router.yml
new file mode 100644
index 000000000..5c8c44ecb
--- /dev/null
+++ b/files/traefik/rules/cvmfs-stratum0-router.yml
@@ -0,0 +1,7 @@
+tcp:
+  routers:
+    cvmfs-stratum0-rsync:
+      rule: "HostSNI(`*`)"
+      service: cvmfs-stratum0-rsync
+      entryPoints:
+        - cvmfs-rsync
diff --git a/files/traefik/rules/cvmfs-stratum0-service.yml b/files/traefik/rules/cvmfs-stratum0-service.yml
new file mode 100644
index 000000000..9cab952be
--- /dev/null
+++ b/files/traefik/rules/cvmfs-stratum0-service.yml
@@ -0,0 +1,6 @@
+tcp:
+  services:
+    cvmfs-stratum0-rsync:
+      loadBalancer:
+        servers:
+          - address: "cvmfs-stratum0.bi.privat:22"
diff --git a/group_vars/traefik.yml b/group_vars/traefik.yml
index 0c5dd824d..5cf397df7 100644
--- a/group_vars/traefik.yml
+++ b/group_vars/traefik.yml
@@ -75,6 +75,7 @@ traefik_containers:
       - --entryPoints.websecure.address=:443
       - --entryPoints.amqps.address=:5671
       - --entryPoints.influxdb.address=:8086
+      - --entryPoints.cvmfs-rsync.address=:5432
       - --entryPoints.web.http.redirections.entryPoint.to=websecure
       - --entryPoints.web.http.redirections.entryPoint.scheme=https
       - --entryPoints.metrics.address=:8082
@@ -161,6 +162,10 @@ traefik_containers:
         published_port: 8086
         protocol: tcp
         mode: host
+      - target_port: 5432
+        published_port: 5432
+        protocol: tcp
+        mode: host
 
     secrets:
       - secret_name: aws_shared_credentials