I can't seem to get mTLS to work on Traefik

I'm trying to enable mTLS on Traefik for my Nginx container in Docker. First I created the tls option that will be pointed to the rootCA(localhost.pem). Then in the traefik.yml I tell Traefik to watch the traefik-dynamic.yml file. Not sure where to go from there though. I looked into the documentation for Traefik but their examples usually have that "foobar" stuff that just doesn't make sense to me. Other than that I've followed examples from blogs I found on Google (which is how I got to where I am currently) but couldn't get it to work. These are some of the tutorials I've followed:

https://dev.to/badgerbadgerbadgerbadger/yet-another-mtls-tutorial-10pp

https://smallstep.com/hello-mtls/doc/server/traefik

https://github.com/vahempio/PKI-Traefik-mTLS

Here are the three files I have so far:

docker-compose.yml

version: '3.8'

  
services:

  nginx:
    image: nginx:latest
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.nginx.rule=Host(`nginx.localhost`)"
        - "traefik.http.routers.nginx.service=nginx"
        - "traefik.http.routers.nginx.entrypoints=web,websecure"
        - "traefik.http.routers.nginx.tls=true"
        - "traefik.http.services.nginx.loadbalancer.server.port=80"


  traefik:
    image: traefik:2.8
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik/letsencrypt:/data/letsencrypt/
      - ./config/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./config/traefik/traefik-dynamic.yml:/etc/traefik-dynamic/traefik-dynamic.yml:ro
      - ./data/traefik-ssl:/etc/ssl/certs:ro
    deploy:
      placement:
        constraints:
          - node.role == manager

traefik-dynamic.yml

tls:
  options:
    mtls-required:
      clientAuth:
        caFiles:
          - /etc/ssl/certs/localhost.pem
        clientAuthType: RequireAndVerifyClientCert
  certificates:
    - certFile: /etc/ssl/certs/localhost.pem
      keyFile: /etc/ssl/certs/localhost-key.pem

traefik.yaml (static configs)

api:

  dashboard: true
  insecure: true

providers:
  docker:
    exposedByDefault: false
    swarmMode: true
  file:
    directory: /etc/traefik-dynamic
    watch: true

log:
  level: DEBUG

entryPoints:
  web:
    address: ":80"
 
  websecure:
    address: ":443"


certificatesResolvers:

  staging:
    acme:
      email: EMAIL
      storage: /data/letsencrypt/acme.json
      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
      httpChallenge:
        entryPoint: web


  production: 
    acme:
      email: EMAIL
      storage: /data/letsencrypt/acme.json
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
      httpChallenge:
        entryPoint: websecure

serversTransport:
  insecureSkipVerify: true