The solution was (as partly mentioned by @bluepuma77) to split the config the following way (I also changed from toml to yaml, but that shouldnt matter):

traefik.yaml:

entryPoints:
  web:
    address: ":80"

log:
  level: DEBUG

accessLog: {}

api:
  dashboard: true
  insecure: true

providers:
  file:
    filename: /etc/traefik/traefik-dynamic.yaml
    watch: true

And traefik-dynamic.yaml:

http:
  routers:
    api:
      rule: Host(`api.localhost`)
      service: api
  services:
    api:
      loadBalancer:
        servers:
          - url: http://web:8000