diff --git a/lib/data.py b/lib/data.py
index 35e78d2..6d545ee 100644
--- a/lib/data.py
+++ b/lib/data.py
@@ -82,19 +82,17 @@ def get_projects(
     for project in projects_raw:
         services = []
         p = Project(**project)
-        if not filter:
+        if not filter or filter.__code__.co_argcount == 1 and cast(Callable[[Project], bool], filter)(p):
             ret.append(p)
             continue
         for s in p.services.copy():
+            if filter.__code__.co_argcount == 2 and cast(Callable[[Project, Service], bool], filter)(p, s):
+                services.append(s)
+                continue
             ingress = []
             for i in s.ingress.copy():
-                if (
-                    (
-                        filter.__code__.co_argcount == 3
-                        and cast(Callable[[Project, Service, Ingress], bool], filter)(p, s, i)
-                    )
-                    or (filter.__code__.co_argcount == 2 and cast(Callable[[Project, Service], bool], filter)(p, s))
-                    or (filter.__code__.co_argcount == 1 and cast(Callable[[Project], bool], filter)(p))
+                if filter.__code__.co_argcount == 3 and cast(Callable[[Project, Service, Ingress], bool], filter)(
+                    p, s, i
                 ):
                     ingress.append(i)
             if len(ingress) > 0:
diff --git a/lib/models.py b/lib/models.py
index 5afeec4..daa3131 100644
--- a/lib/models.py
+++ b/lib/models.py
@@ -56,8 +56,8 @@ class ProxyProtocol(str, Enum):
 class Ingress(BaseModel):
     """Ingress model"""
 
-    domain: str
-    """The domain to use for the service"""
+    domain: str = None
+    """The domain to use for the service. If omitted, the service will not be publicly accessible."""
     hostport: int = None
     """The port to expose on the host"""
     passthrough: bool = False
diff --git a/lib/upstream.py b/lib/upstream.py
index b672ca4..ab80744 100644
--- a/lib/upstream.py
+++ b/lib/upstream.py
@@ -17,11 +17,10 @@ def write_upstream(project: Project) -> None:
     tpl = Template(t)
     tpl.globals["Protocol"] = Protocol
     tpl.globals["isinstance"] = isinstance
+    tpl.globals["len"] = len
+    tpl.globals["list"] = list
     tpl.globals["str"] = str
-    if os.environ.get("PYTHON_ENV") != "production":
-        content = tpl.render(project=project, domain=os.environ.get("TRAEFIK_DOMAIN"), env="development")
-    else:
-        content = tpl.render(project=project, domain=project.domain)
+    content = tpl.render(project=project)
     with open(f"upstream/{project.name}/docker-compose.yml", "w", encoding="utf-8") as f:
         f.write(content)
 
diff --git a/tpl/docker-compose.yml.j2 b/tpl/docker-compose.yml.j2
index 358b1a7..2593ddc 100755
--- a/tpl/docker-compose.yml.j2
+++ b/tpl/docker-compose.yml.j2
@@ -9,6 +9,7 @@ networks:
 
 services:
 {%- for s in project.services %}
+  {%- set has_ingress = list(s.ingress | selectattr('domain')) | length > 0 %}
   {{ project.name }}-{{ s.name }}:
   {%- if s.command %}
     command: {{ s.command }}
@@ -24,29 +25,33 @@ services:
       - '{{ i.port }}/{{ Protocol[i.protocol].value }}'
   {%- endfor %}
     image: {{ s.image }}
-  {%- if s.ingress | length > 1 %}
+  {%- if has_ingress or (s.labels | length > 0) %}
     labels:
+    {%- if has_ingress %}
       - traefik.enable=true
       - traefik.docker.network=proxynet
-    {%- for i in s.ingress %}
-      {%- set name = project.name ~ '-' ~ s.name.replace('.', '-') ~ '-' ~ i.port %}
+      {%- for i in s.ingress %}
+        {%- if i.domain %}
+          {%- set name = project.name ~ '-' ~ s.name.replace('.', '-') ~ '-' ~ i.port %}
       - traefik.http.routers.{{ name }}.entrypoints=web-secure
       - traefik.http.routers.{{ name }}.rule=Host(`{{ i.domain }}`){%- if i.path_prefix %} && PathPrefix(`{{ i.path_prefix }}`){%- endif %}
       - traefik.http.routers.{{ name }}.tls.certresolver=letsencrypt
-      {%- if i.path_prefix and i.path_remove %}
+          {%- if i.path_prefix and i.path_remove %}
       - traefik.http.middlewares.removeServiceSelector.stripPrefix.prefixes={{ i.path_prefix }}
-      {%- endif %}
+          {%- endif %}
       - traefik.http.services.{{ name }}.loadbalancer.server.port={{ i.port }}
-    {%- endfor %}
+        {%- endif %}
+      {%- endfor %}
+    {%- endif %}
     {%- for l in s.labels %}
       - {{ l }}
     {%- endfor %}    
-  {%- endif %}0
+  {%- endif %}
     networks:
   {%- if p.services | length > 1 %}
       - default
-  {%- endif %}  
-  {%- if s.ingress | length > 1 %}
+  {%- endif %}
+  {%- if has_ingress %}
       - proxynet
   {%- endif %}
     restart: {{ s.restart }}