Dashy behind traefik - "Connection not secure"

[chupacabra71]

Does anyone have any experience setting Dashy up behind a Traefik reverse proxy with SSL certs? all my home lab stuff is behind traefik and working fine. I can see that Dashy gets my wildcard certificate, but when i go to the site i still get an insecure message:

i've tried everything i can think of in the tags, but nothing seems to make a difference. here is the compose file for Dashy in case it helps:

---
version: "3.8"
services:
  dashy:
    image: lissy93/dashy
    container_name: Dashy
    volumes:
      - data:/app/public/
    networks:
      - traefik-proxy
    environment:
      - NODE_ENV=production
    restart: unless-stopped
    healthcheck:
      test: ['CMD', 'node', '/app/services/healthcheck']
      interval: 1m30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      mode: replicated
      replicas: 1
      labels:
# My standard Traefik config for services
        - "traefik.enable=true"
        - "traefik.http.routers.dashy.entrypoints=http"
        - "traefik.http.routers.dashy.rule=Host(`dashy.local.my.tld`)"
        - "traefik.http.middlewares.dashy-https-redirect.redirectscheme.scheme=https"
        - "traefik.http.routers.dashy.middlewares=dashy-https-redirect"
        - "traefik.http.routers.dashy-secure.entrypoints=https"
        - "traefik.http.routers.dashy-secure.rule=Host(`dashy.local.my.tld`)"
        - "traefik.http.routers.dashy-secure.tls=true"
        - "traefik.http.routers.dashy-secure.service=dashy"
        - "traefik.http.services.dashy.loadbalancer.server.port=80"
        - "traefik.docker.network=traefik-proxy"
# found these in the discussions for dashy
        - "traefik.http.middlewares.sslHeader.headers.customRequestHeaders.X-Forwarded-Proto=https"
        - "traefik.http.middlewares.testHeader.headers.accessControlAllowMethods=GET,OPTIONS,PUT"
        - "traefik.http.middlewares.testHeader.headers.accessControlAllowOriginList=https://dashy.local.my.tld"
        - "traefik.http.middlewares.testHeader.headers.accessControlMaxAge=100"
        - "traefik.http.middlewares.testHeader.headers.addVaryHeader=true"

volumes:
  data:
    driver_opts:
      type: "nfs"
      o: "addr=mynas,rw,nolock,soft,nfsvers=4"
      device: ":/DOCKER/dashy/data"

networks:
  traefik-proxy:
    external: true