Pangolin's default docker-compose ships its own Traefik container, and that's almost always what's actually fighting your existing one, not a config typo on your end. Two ways out of it that I've seen work:

• Comment out the traefik service in Pangolin's compose file entirely and let your existing traefik instance handle routing via labels. Pangolin's docs have a section for using an existing reverse proxy that walks through pointing your own traefik at Gerbil's exposed port instead of the bundled one.
• Or the reverse: let Pangolin's traefik own ports 80/443 and demote your main one to a different port/internal-only role if it's not doing much else.

First option is cleaner if your main traefik is already handling other services and you don't want two separate ACME/cert setups running side by side.