diff --git a/.gitignore b/.gitignore
index 364ca6e..ea35378 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,6 +94,10 @@ temp/*
 
 # Environment 
 .env
+
+# kubernetes
+*/k8s/*secret*
+!*/k8s/*secret*.example
 .env.anna
 .env.forust
 .env.*
diff --git a/adguardhome/k8s/adguard.yaml b/adguardhome/k8s/adguard.yaml
new file mode 100644
index 0000000..dbbdb60
--- /dev/null
+++ b/adguardhome/k8s/adguard.yaml
@@ -0,0 +1,85 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-service
+  namespace: adguard
+spec:
+  selector:
+    app: adguard
+  ports:
+  - port: 3000
+    name: webui
+    targetPort: 3000
+  - port: 53
+    name: dns
+    targetPort: 53
+    protocol: UDP
+  - port: 53
+    name: dns-tcp
+    targetPort: 53
+    protocol: TCP
+  - port: 853
+    name: dot
+    targetPort: 853
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-deployment
+  namespace: adguard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adguard
+  template:
+    metadata:
+      labels:
+        app: adguard
+    spec:
+      containers:
+      - name: adguard
+        image: adguard/adguardhome:latest
+        resources:
+          limits:
+            memory: "1Gi"
+            cpu: "500m"
+          requests:
+            memory: "128Mi"
+            cpu: "50m"
+        ports:
+        - containerPort: 3000
+          name: webui
+        - containerPort: 53
+          name: dns
+        - containerPort: 853
+          name: dot
+        volumeMounts:
+        - name: adguard-data
+          mountPath: /opt/adguardhome/work
+          subPath: work
+        - name: adguard-data
+          mountPath: /opt/adguardhome/conf
+          subPath: conf
+        - name: adguard-certs
+          mountPath: /certs
+          readOnly: true
+      volumes:
+      - name: adguard-data
+        persistentVolumeClaim:
+          claimName: adguard-pvc
+      - name: adguard-certs
+        secret:
+          secretName: adguard-certs
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguard-pvc
+  namespace: adguard
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml
new file mode 100644
index 0000000..6a84859
--- /dev/null
+++ b/adguardhome/k8s/ingress.yaml
@@ -0,0 +1,67 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-dev
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-local
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-prod
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-doh
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    {}
diff --git a/adguardhome/k8s/namespace.yaml b/adguardhome/k8s/namespace.yaml
new file mode 100644
index 0000000..9aa98c6
--- /dev/null
+++ b/adguardhome/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: adguard
\ No newline at end of file
diff --git a/adguardhome/k8s/secrets.yaml.example b/adguardhome/k8s/secrets.yaml.example
new file mode 100644
index 0000000..af5cfad
--- /dev/null
+++ b/adguardhome/k8s/secrets.yaml.example
@@ -0,0 +1,10 @@
+kubectl apply -f k8s/namespace.yaml && \
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem \
+  --key=certs/privkey.pem --dry-run=client -o json > \
+  k8s/secrets.yaml
+
+#  OR WITH NO FILE CREATION:
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem --key=certs/privkey.pem \
+  --save-config
\ No newline at end of file
diff --git a/checkmk/k8s/checkmk.yaml b/checkmk/k8s/checkmk.yaml
new file mode 100644
index 0000000..056f2db
--- /dev/null
+++ b/checkmk/k8s/checkmk.yaml
@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: checkmk-service
+  namespace: checkmk
+spec:
+  selector:
+    app: checkmk
+  ports:
+  - port: 5000
+    targetPort: 5000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checkmk-deployment
+  namespace: checkmk
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: checkmk
+  template:
+    metadata:
+      labels:
+        app: checkmk
+    spec:
+      containers:
+      - name: checkmk
+        image: checkmk/check-mk-raw:2.4.0-latest
+        envFrom:
+        - secretRef:
+            name: checkmk-secrets
+        env:
+        - name: CMK_SITE_ID
+          value: "cmk"
+        - name: TZ
+          value: "Etc/UTC"
+        ports:
+        - containerPort: 5000
+        volumeMounts:
+        - name: sites
+          mountPath: /omd/sites
+        - name: tmp
+          mountPath: /opt/omd/sites/cmk/tmp
+        resources:
+          requests:
+            memory: "1Gi"
+            cpu: "1"
+          limits:
+            memory: "5Gi"
+            cpu: "4"
+      volumes:
+      - name: sites
+        persistentVolumeClaim:
+          claimName: checkmk-sites-pvc
+      - name: tmp
+        emptyDir:
+          medium: Memory
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: checkmk-sites-pvc
+  namespace: checkmk
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml
new file mode 100644
index 0000000..50a5852
--- /dev/null
+++ b/checkmk/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-prod
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`cmk.forust.xyz`)
+    kind: Rule
+    services:
+    - name: checkmk-service
+      port: 5000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-local
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`cmk.workstation.internal`)
+    kind: Rule
+    services:
+    - name: checkmk-service
+      port: 5000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-dev
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`cmk.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: checkmk-service
+      port: 5000
+  tls:
+    secretName: local-tls
diff --git a/checkmk/k8s/namespace.yaml b/checkmk/k8s/namespace.yaml
new file mode 100644
index 0000000..1e2fe52
--- /dev/null
+++ b/checkmk/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: checkmk
diff --git a/dockmon/k8s/dockmon.yaml b/dockmon/k8s/dockmon.yaml
new file mode 100644
index 0000000..1b59b58
--- /dev/null
+++ b/dockmon/k8s/dockmon.yaml
@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dockmon-service
+  namespace: dockmon
+spec:
+  selector:
+    app: dockmon
+  ports:
+  - port: 443
+    targetPort: 443
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dockmon-deployment
+  namespace: dockmon
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dockmon
+  template:
+    metadata:
+      labels:
+        app: dockmon
+    spec:
+      containers:
+      - name: dockmon
+        image: darthnorse/dockmon:latest
+        ports:
+        - containerPort: 443
+        volumeMounts:
+        - name: data
+          mountPath: /app/data
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 443
+            scheme: HTTPS
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 10
+          failureThreshold: 3
+        resources:
+          requests:
+            memory: "512Gi"
+            cpu: "200m"
+          limits:
+            memory: "2Gi"
+            cpu: "1500m "
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: dockmon-data-pvc
+      - name: docker-sock
+        hostPath:
+          path: /var/run/docker.sock
+          type: Socket
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dockmon-data-pvc
+  namespace: dockmon
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml
new file mode 100644
index 0000000..412b3af
--- /dev/null
+++ b/dockmon/k8s/ingress.yaml
@@ -0,0 +1,63 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: dockmon-transport
+  namespace: dockmon
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-prod
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: security-headers@file
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-local
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.workstation.internal`)
+    kind: Rule
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-dev
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    secretName: local-tls
diff --git a/dockmon/k8s/namespace.yaml b/dockmon/k8s/namespace.yaml
new file mode 100644
index 0000000..521ecc4
--- /dev/null
+++ b/dockmon/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dockmon
diff --git a/downtify/k8s/downtify.yaml b/downtify/k8s/downtify.yaml
new file mode 100644
index 0000000..fb9b607
--- /dev/null
+++ b/downtify/k8s/downtify.yaml
@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: downtify-service
+  namespace: downtify
+spec:
+  selector:
+    app: downtify
+  ports:
+  - port: 8000
+    targetPort: 8000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: downtify-deployment
+  namespace: downtify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: downtify
+  template:
+    metadata:
+      labels:
+        app: downtify
+    spec:
+      containers:
+      - name: downtify
+        image: ghcr.io/henriquesebastiao/downtify:latest
+        ports:
+        - containerPort: 8000
+        volumeMounts:
+        - name: downloads
+          mountPath: /downloads
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "200m"
+          limits:
+            memory: "1Gi"
+            cpu: "1"
+      volumes:
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: downtify-downloads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: downtify-downloads-pvc
+  namespace: downtify
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml
new file mode 100644
index 0000000..d57b50c
--- /dev/null
+++ b/downtify/k8s/ingress.yaml
@@ -0,0 +1,52 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-prod
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`downtify.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: security-chain@file
+    services:
+    - name: downtify-service
+      port: 8000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-local
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`downtify.workstation.internal`)
+    kind: Rule
+    services:
+    - name: downtify-service
+      port: 8000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-dev
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`downtify.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: downtify-service
+      port: 8000
+  tls:
+    secretName: local-tls
diff --git a/downtify/k8s/namespace.yaml b/downtify/k8s/namespace.yaml
new file mode 100644
index 0000000..1f5361e
--- /dev/null
+++ b/downtify/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downtify
diff --git a/errorpages/k8s/error-pages.yaml b/errorpages/k8s/error-pages.yaml
new file mode 100644
index 0000000..cbbe9cc
--- /dev/null
+++ b/errorpages/k8s/error-pages.yaml
@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: error-pages-service
+  namespace: error-pages
+spec:
+  selector:
+    app: error-pages
+  ports:
+  - port: 80
+    targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: error-pages-deployment
+  namespace: error-pages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: error-pages
+  template:
+    metadata:
+      labels:
+        app: error-pages
+    spec:
+      containers:
+      - name: error-pages
+        image: gcr.forust.xyz/forust/error-pages:latest
+        ports:
+        - containerPort: 80
+---
+
diff --git a/errorpages/k8s/namespace.yaml b/errorpages/k8s/namespace.yaml
new file mode 100644
index 0000000..af279b5
--- /dev/null
+++ b/errorpages/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: error-pages
diff --git a/gitea/k8s/config.yaml b/gitea/k8s/config.yaml
new file mode 100644
index 0000000..8bde82d
--- /dev/null
+++ b/gitea/k8s/config.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-config
+  namespace: gitea
+data:
+  GITEA__server__DOMAIN: "gitea.gigaforust.internal"
+  GITEA__server__ROOT_URL: "https://gitea.gigaforust.internal"
+  GITEA__server__SSH_DOMAIN: "gitssh.gigaforust.internal"
+  GITEA__server__SSH_PORT: "2221"
+
+  GITEA__database__DB_TYPE: "postgres"
+  GITEA__database__HOST: "gitea-postgres-service:5432"
+  GITEA__database__NAME: "gitea"
+  GITEA__security__REVERSE_PROXY_LIMIT: "1"
+  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
+  
+  GITEA__mailer__ENABLED: "false"
+  USER_UID: "1000"
+  USER_GID: "1000"
\ No newline at end of file
diff --git a/gitea/k8s/gitea.yaml b/gitea/k8s/gitea.yaml
new file mode 100644
index 0000000..d870d46
--- /dev/null
+++ b/gitea/k8s/gitea.yaml
@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-service
+  namespace: gitea
+spec:
+  selector:
+    app: gitea
+  ports:
+  - port: 3000
+    name: http
+    targetPort: 3000
+  - port: 2221
+    name: ssh
+    targetPort: 2221
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-deployment
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+      - name: gitea
+        image: docker.gitea.com/gitea:1.26
+        envFrom:
+        - configMapRef:
+            name: gitea-config
+        - secretRef:
+            name: gitea-secrets
+        ports:
+        - containerPort: 3000
+          name: http
+        - containerPort: 2221
+          name: ssh
+        volumeMounts:
+        - name: gitea-data
+          mountPath: /data
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "1.5Gi"
+            cpu: "1500m"
+      volumes:
+      - name: gitea-data
+        persistentVolumeClaim:
+          claimName: gitea-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
diff --git a/gitea/k8s/ingressroute.yaml b/gitea/k8s/ingressroute.yaml
new file mode 100644
index 0000000..cedc053
--- /dev/null
+++ b/gitea/k8s/ingressroute.yaml
@@ -0,0 +1,81 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-dev
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-local
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.workstation.internal`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-prod
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.forust.xyz`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-registry
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+  - match: HostSNI(`*`)
+    services:
+    - name: gitea-service
+      port: 2221
diff --git a/gitea/k8s/namespace.yaml b/gitea/k8s/namespace.yaml
new file mode 100644
index 0000000..d884423
--- /dev/null
+++ b/gitea/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
\ No newline at end of file
diff --git a/gitea/k8s/postgres.yaml b/gitea/k8s/postgres.yaml
new file mode 100644
index 0000000..55afde4
--- /dev/null
+++ b/gitea/k8s/postgres.yaml
@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgres-service
+  namespace: gitea
+spec:
+  clusterIP: None
+  selector:
+    app: gitea-postgres
+  ports:
+  - port: 5432
+    targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-postgres-statefulset
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-postgres
+  serviceName: gitea-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: gitea-postgres
+    spec:
+      containers:
+      - name: gitea-postgres
+        image: postgres:14
+        env:
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__USER
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__PASSWD
+        - name: POSTGRES_DB
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__USER
+        ports:
+        - containerPort: 5432
+          name: postgres
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+  - metadata:
+      name: postgres-data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      resources:
+        requests:
+          storage: 1Gi
diff --git a/headscale/k8s/headplane-config.yaml b/headscale/k8s/headplane-config.yaml
new file mode 100644
index 0000000..d32b766
--- /dev/null
+++ b/headscale/k8s/headplane-config.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: headplane-config
+  namespace: headscale
+data:
+  config.yaml: |
+    server:
+      host: "0.0.0.0"
+      port: 3000
+      base_url: https://hs.forust.xyz
+      cookie_secure: true
+      cookie_max_age: 86400
+      data_path: "/var/lib/headplane"
+    headscale:
+      url: "http://headscale-service:8080"
+      config_path: "/etc/headscale/config.yaml"
+      config_strict: true
+    integration:
+      docker:
+        enabled: true
+        container_label: "me.tale.headplane.target=headscale"
+        container_name: "headscale"
+        socket: "unix:///var/run/docker.sock"
+      kubernetes:
+        enabled: false
+      proc:
+        enabled: false
diff --git a/headscale/k8s/headplane.yaml b/headscale/k8s/headplane.yaml
new file mode 100644
index 0000000..ad40efd
--- /dev/null
+++ b/headscale/k8s/headplane.yaml
@@ -0,0 +1,82 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headplane-service
+  namespace: headscale
+spec:
+  selector:
+    app: headplane
+  ports:
+  - port: 3000
+    targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: headplane-deployment
+  namespace: headscale
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: headplane
+  template:
+    metadata:
+      labels:
+        app: headplane
+    spec:
+      containers:
+      - name: headplane
+        image: ghcr.io/tale/headplane:latest
+        ports:
+        - containerPort: 3000
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+        env:
+        - name: COOKIE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: headscale-secrets
+              key: HEADPLANE_COOKIE_SECRET
+        - name: CONFIG_PATH
+          value: "/etc/headplane/config.yaml"
+        volumeMounts:
+        - name: config
+          mountPath: /etc/headplane
+        - name: headscale-config
+          mountPath: /etc/headscale
+        - name: data
+          mountPath: /var/lib/headplane
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
+      volumes:
+      - name: config
+        configMap:
+          name: headplane-config
+      - name: headscale-config
+        configMap:
+          name: headscale-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: headplane-data-pvc
+      - name: docker-sock
+        hostPath:
+          path: /var/run/docker.sock
+          type: Socket
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: headplane-data-pvc
+  namespace: headscale
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/headscale/k8s/headscale-admin.yaml b/headscale/k8s/headscale-admin.yaml
new file mode 100644
index 0000000..2194cf4
--- /dev/null
+++ b/headscale/k8s/headscale-admin.yaml
@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-admin-service
+  namespace: headscale
+spec:
+  selector:
+    app: headscale-admin
+  ports:
+  - port: 80
+    targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: headscale-admin-deployment
+  namespace: headscale
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: headscale-admin
+  template:
+    metadata:
+      labels:
+        app: headscale-admin
+    spec:
+      containers:
+      - name: headscale-admin
+        image: goodieshq/headscale-admin:latest
+        ports:
+        - containerPort: 80
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "256Mi"
+            cpu: "200m"
diff --git a/headscale/k8s/headscale-config.yaml b/headscale/k8s/headscale-config.yaml
new file mode 100644
index 0000000..0142105
--- /dev/null
+++ b/headscale/k8s/headscale-config.yaml
@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: headscale-config
+  namespace: headscale
+data:
+  config.yaml: |
+    server_url: https://hs.forust.xyz
+    listen_addr: 0.0.0.0:8080
+    metrics_listen_addr: 0.0.0.0:9090
+    grpc_listen_addr: 127.0.0.1:50443
+    grpc_allow_insecure: false
+    noise:
+      private_key_path: /var/lib/headscale/noise_private.key
+    prefixes:
+      v4: 100.64.0.0/10
+      v6: fd7a:115c:a1e0::/48
+      allocation: sequential
+    derp:
+      server:
+        enabled: true
+        region_id: 999
+        region_code: "headscale"
+        region_name: "Headscale Embedded DERP"
+        stun_listen_addr: "0.0.0.0:3478"
+        private_key_path: /var/lib/headscale/derp_server_private.key
+        automatically_add_embedded_derp_region: true
+        ipv4: 1.2.3.4
+        ipv6: 2001:db8::1
+      urls:
+        - https://controlplane.tailscale.com/derpmap/default
+      paths: []
+      auto_update_enabled: true
+      update_frequency: 24h
+    disable_check_updates: false
+    ephemeral_node_inactivity_timeout: 30m
+    database:
+      type: sqlite
+      debug: false
+      gorm:
+        prepare_stmt: true
+        parameterized_queries: true
+        skip_err_record_not_found: true
+        slow_threshold: 1000
+      sqlite:
+        path: /var/lib/headscale/db.sqlite
+        write_ahead_log: true
+        wal_autocheckpoint: 1000
+    acme_url: https://acme-v02.api.letsencrypt.org/directory
+    acme_email: ""
+    tls_letsencrypt_hostname: ""
+    tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+    tls_letsencrypt_challenge_type: HTTP-01
+    tls_letsencrypt_listen: ":http"
+    tls_cert_path: ""
+    tls_key_path: ""
+    log:
+      format: text
+      level: info
+    policy:
+      mode: database
+      path: ""
+    dns:
+      magic_dns: true
+      base_domain: example.com
+      nameservers:
+        global:
+          - 1.1.1.1
+          - 1.0.0.1
+          - 2606:4700:4700::1111
+          - 2606:4700:4700::1001
+        split: {}
+      search_domains: []
+      extra_records: []
+    unix_socket: /var/run/headscale/headscale.sock
+    unix_socket_permission: "0770"
+    logtail:
+      enabled: false
+    randomize_client_port: false
diff --git a/headscale/k8s/headscale.yaml b/headscale/k8s/headscale.yaml
new file mode 100644
index 0000000..f128f37
--- /dev/null
+++ b/headscale/k8s/headscale.yaml
@@ -0,0 +1,84 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-service
+  namespace: headscale
+spec:
+  selector:
+    app: headscale
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+  - name: metrics
+    port: 9090
+    targetPort: 9090
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: headscale-deployment
+  namespace: headscale
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: headscale
+  template:
+    metadata:
+      labels:
+        app: headscale
+    spec:
+      containers:
+      - name: headscale
+        image: headscale/headscale:latest
+        command: ["serve"]
+        ports:
+        - containerPort: 8080
+          name: http
+        - containerPort: 9090
+          name: metrics
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "1Gi"
+            cpu: "1"
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 30
+          periodSeconds: 15
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        volumeMounts:
+        - name: config
+          mountPath: /etc/headscale
+        - name: data
+          mountPath: /var/lib/headscale
+      volumes:
+      - name: config
+        configMap:
+          name: headscale-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: headscale-data-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: headscale-data-pvc
+  namespace: headscale
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml
new file mode 100644
index 0000000..b55f33e
--- /dev/null
+++ b/headscale/k8s/ingress.yaml
@@ -0,0 +1,157 @@
+# Headscale main
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.forust.xyz`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 8080
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.workstation.internal`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 8080
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-dev
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 8080
+  tls:
+    secretName: local-tls
+---
+# Headscale metrics
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-metrics-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 9090
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-metrics-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 9090
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-metrics-dev
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)
+    kind: Rule
+    services:
+    - name: headscale-service
+      port: 9090
+  tls:
+    secretName: local-tls
+---
+# Headscale admin UI
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-admin-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+    kind: Rule
+    middlewares:
+    - name: security-chain@file
+    services:
+    - name: headscale-admin-service
+      port: 80
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-admin-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.workstation.internal`) && PathPrefix(`/admin`)
+    kind: Rule
+    services:
+    - name: headscale-admin-service
+      port: 80
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-admin-dev
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)
+    kind: Rule
+    services:
+    - name: headscale-admin-service
+      port: 80
+  tls:
+    secretName: local-tls
diff --git a/headscale/k8s/namespace.yaml b/headscale/k8s/namespace.yaml
new file mode 100644
index 0000000..74f64ea
--- /dev/null
+++ b/headscale/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: headscale
diff --git a/homepages/k8s/homepages.yaml b/homepages/k8s/homepages.yaml
new file mode 100644
index 0000000..ff3eab7
--- /dev/null
+++ b/homepages/k8s/homepages.yaml
@@ -0,0 +1,65 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: forust-homepage-service
+  namespace: homepages
+spec:
+  selector:
+    app: forust-homepage
+  ports:
+  - port: 80
+    targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forust-homepage-deployment
+  namespace: homepages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forust-homepage
+  template:
+    metadata:
+      labels:
+        app: forust-homepage
+    spec:
+      containers:
+      - name: forust-homepage
+        image: gcr.forust.xyz/forust/forust-homepage:latest
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: xdfnx-homepage-service
+  namespace: homepages
+spec:
+  selector:
+    app: xdfnx-homepage
+  ports:
+  - port: 80
+    targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: xdfnx-homepage-deployment
+  namespace: homepages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: xdfnx-homepage
+  template:
+    metadata:
+      labels:
+        app: xdfnx-homepage
+    spec:
+      containers:
+      - name: xdfnx-homepage
+        image: gcr.forust.xyz/forust/xdfnx-homepage:latest
+        ports:
+        - containerPort: 80
diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml
new file mode 100644
index 0000000..92b143a
--- /dev/null
+++ b/homepages/k8s/ingress.yaml
@@ -0,0 +1,101 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forust-homepage-prod
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`forust.xyz`)
+    kind: Rule
+    services:
+    - name: forust-homepage-service
+      port: 80
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forust-homepage-local
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`landing.workstation.internal`)
+    kind: Rule
+    services:
+    - name: forust-homepage-service
+      port: 80
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forust-homepage-dev
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`landing.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: forust-homepage-service
+      port: 80
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xdfnx-homepage-prod
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`xdfnx.cfd`)
+    kind: Rule
+    services:
+    - name: xdfnx-homepage-service
+      port: 80
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xdfnx-homepage-local
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`xdfnx.workstation.internal`)
+    kind: Rule
+    services:
+    - name: xdfnx-homepage-service
+      port: 80
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xdfnx-homepage-dev
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`xdfnx.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: xdfnx-homepage-service
+      port: 80
+  tls:
+    secretName: local-tls
diff --git a/homepages/k8s/namespace.yaml b/homepages/k8s/namespace.yaml
new file mode 100644
index 0000000..66473ee
--- /dev/null
+++ b/homepages/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homepages
diff --git a/kener/k8s/config.yaml b/kener/k8s/config.yaml
new file mode 100644
index 0000000..58fb123
--- /dev/null
+++ b/kener/k8s/config.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kener-config
+  namespace: kener
+data:
+  ORIGIN: "https://status.forust.xyz"
+  REDIS_URL: "redis://kener-redis-service:6379"
+  TZ: "Etc/UTC"
diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml
new file mode 100644
index 0000000..9971110
--- /dev/null
+++ b/kener/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kener-prod
+  namespace: kener
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`status.forust.xyz`)
+    kind: Rule
+    services:
+    - name: kener-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kener-local
+  namespace: kener
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`status.workstation.internal`)
+    kind: Rule
+    services:
+    - name: kener-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kener-dev
+  namespace: kener
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`status.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: kener-service
+      port: 3000
+  tls:
+    secretName: local-tls
diff --git a/kener/k8s/kener.yaml b/kener/k8s/kener.yaml
new file mode 100644
index 0000000..e559de2
--- /dev/null
+++ b/kener/k8s/kener.yaml
@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kener-service
+  namespace: kener
+spec:
+  selector:
+    app: kener
+  ports:
+  - port: 3000
+    targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kener-deployment
+  namespace: kener
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kener
+  template:
+    metadata:
+      labels:
+        app: kener
+    spec:
+      containers:
+      - name: kener
+        image: rajnandan1/kener:4.0.23
+        envFrom:
+        - configMapRef:
+            name: kener-config
+        - secretRef:
+            name: kener-secrets
+        ports:
+        - containerPort: 3000
+        volumeMounts:
+        - name: kener-db
+          mountPath: /app/database
+        - name: kener-uploads
+          mountPath: /app/uploads
+      volumes:
+      - name: kener-db
+        persistentVolumeClaim:
+          claimName: kener-db-pvc
+      - name: kener-uploads
+        persistentVolumeClaim:
+          claimName: kener-uploads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: kener-db-pvc
+  namespace: kener
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: kener-uploads-pvc
+  namespace: kener
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/kener/k8s/namespace.yaml b/kener/k8s/namespace.yaml
new file mode 100644
index 0000000..659b4f5
--- /dev/null
+++ b/kener/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kener
diff --git a/kener/k8s/redis.yaml b/kener/k8s/redis.yaml
new file mode 100644
index 0000000..92da7c7
--- /dev/null
+++ b/kener/k8s/redis.yaml
@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kener-redis-service
+  namespace: kener
+spec:
+  selector:
+    app: kener-redis
+  ports:
+  - port: 6379
+    targetPort: 6379
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kener-redis-deployment
+  namespace: kener
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kener-redis
+  template:
+    metadata:
+      labels:
+        app: kener-redis
+    spec:
+      containers:
+      - name: redis
+        image: redis:7-alpine
+        ports:
+        - containerPort: 6379
+        volumeMounts:
+        - name: redis-data
+          mountPath: /data
+      volumes:
+      - name: redis-data
+        persistentVolumeClaim:
+          claimName: kener-redis-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: kener-redis-pvc
+  namespace: kener
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/kener/k8s/secrets.yaml.example b/kener/k8s/secrets.yaml.example
new file mode 100644
index 0000000..f1ef80a
--- /dev/null
+++ b/kener/k8s/secrets.yaml.example
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kener-secrets
+  namespace: kener
+type: Opaque
+stringData:
+  KENER_SECRET_KEY: ""
diff --git a/metube/k8s/config.yaml b/metube/k8s/config.yaml
new file mode 100644
index 0000000..3569b25
--- /dev/null
+++ b/metube/k8s/config.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: metube-config
+  namespace: metube
+data:
+  DOWNLOAD_MODE: "limited"
+  MAX_CONCURRENT_DOWNLOADS: "3"
+  DELETE_FILE_ON_TRASHCAN: "true"
+  DEFAULT_OPTION_PLAYLIST_STRICT_MODE: "true"
diff --git a/metube/k8s/ingress.yaml b/metube/k8s/ingress.yaml
new file mode 100644
index 0000000..b28a2dc
--- /dev/null
+++ b/metube/k8s/ingress.yaml
@@ -0,0 +1,52 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: metube-prod
+  namespace: metube
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`metube.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: security-chain@file
+    services:
+    - name: metube-service
+      port: 8081
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: metube-local
+  namespace: metube
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`metube.workstation.internal`)
+    kind: Rule
+    services:
+    - name: metube-service
+      port: 8081
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: metube-dev
+  namespace: metube
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`metube.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: metube-service
+      port: 8081
+  tls:
+    secretName: local-tls
diff --git a/metube/k8s/metube.yaml b/metube/k8s/metube.yaml
new file mode 100644
index 0000000..7ee2b3c
--- /dev/null
+++ b/metube/k8s/metube.yaml
@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: metube-service
+  namespace: metube
+spec:
+  selector:
+    app: metube
+  ports:
+  - port: 8081
+    targetPort: 8081
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metube-deployment
+  namespace: metube
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: metube
+  template:
+    metadata:
+      labels:
+        app: metube
+    spec:
+      containers:
+      - name: metube
+        image: ghcr.io/alexta69/metube
+        envFrom:
+        - configMapRef:
+            name: metube-config
+        ports:
+        - containerPort: 8081
+        volumeMounts:
+        - name: downloads
+          mountPath: /downloads
+      volumes:
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: metube-downloads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: metube-downloads-pvc
+  namespace: metube
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
diff --git a/metube/k8s/namespace.yaml b/metube/k8s/namespace.yaml
new file mode 100644
index 0000000..6bafd26
--- /dev/null
+++ b/metube/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metube
diff --git a/netronome/k8s/config.yaml b/netronome/k8s/config.yaml
new file mode 100644
index 0000000..fa4f125
--- /dev/null
+++ b/netronome/k8s/config.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netronome-config
+  namespace: netronome
+data:
+  NETRONOME__DB_TYPE: "postgres"
+  NETRONOME__DB_HOST: "netronome-postgres-service"
+  NETRONOME__DB_PORT: "5432"
+  NETRONOME__DB_NAME: "netronome"
+  NETRONOME__DB_SSLMODE: "disable"
+  NETRONOME__HOST: "0.0.0.0"
+  NETRONOME__PORT: "7575"
+  NETRONOME__BASE_URL: "/"
diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml
new file mode 100644
index 0000000..070a19b
--- /dev/null
+++ b/netronome/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netronome-prod
+  namespace: netronome
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nm.forust.xyz`)
+    kind: Rule
+    services:
+    - name: netronome-service
+      port: 7575
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netronome-local
+  namespace: netronome
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nm.workstation.internal`)
+    kind: Rule
+    services:
+    - name: netronome-service
+      port: 7575
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netronome-dev
+  namespace: netronome
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nm.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: netronome-service
+      port: 7575
+  tls:
+    secretName: local-tls
diff --git a/netronome/k8s/namespace.yaml b/netronome/k8s/namespace.yaml
new file mode 100644
index 0000000..35ac1ec
--- /dev/null
+++ b/netronome/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netronome
diff --git a/netronome/k8s/netronome.yaml b/netronome/k8s/netronome.yaml
new file mode 100644
index 0000000..289f706
--- /dev/null
+++ b/netronome/k8s/netronome.yaml
@@ -0,0 +1,77 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netronome-service
+  namespace: netronome
+spec:
+  selector:
+    app: netronome
+  ports:
+  - port: 7575
+    protocol: TCP
+    targetPort: 7575
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netronome-deployment
+  namespace: netronome
+  labels:
+    app: netronome
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netronome
+  template:
+    metadata:
+      labels:
+        app: netronome
+    spec:
+      containers:
+      - name: netronome
+        image: ghcr.io/autobrr/netronome:latest
+        ports:
+        - name: netronome-port
+          protocol: TCP
+          containerPort: 7575
+        envFrom:
+        - configMapRef:
+            name: netronome-config
+        env:
+        - name: NETRONOME__DB_USER
+          valueFrom:
+            secretKeyRef:
+              name: netronome-secret
+              key: NETRONOME__DB_USER
+        - name: NETRONOME__DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: netronome-secret
+              key: NETRONOME__DB_PASSWORD
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+        volumeMounts:
+        - name: netronome-data
+          mountPath: /data
+      volumes:
+      - name: netronome-data
+        persistentVolumeClaim:
+          claimName: netronome-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netronome-pvc
+  namespace: netronome
+spec:
+  resources:
+    requests:
+      storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
diff --git a/nextcloud/compose.yaml b/nextcloud/compose.yaml
index 3b35d6c..ded64e5 100644
--- a/nextcloud/compose.yaml
+++ b/nextcloud/compose.yaml
@@ -6,15 +6,13 @@ services:
     container_name: nextcloud-aio-mastercontainer # Do not change
     volumes:
       - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/run/docker.sock:/var/run/docker.sock
       - /dev/dri:/dev/dri
+    ports:
+      - 8080:8080
     networks:
       - nextcloud-aio
       - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      # ports:
-      # - 8081:80 # may be removed if under reverse-proxy
-      # - 8443:8443 
-      # - 8888:8080 # AIO
 
     labels:
       - "traefik.enable=true"
diff --git a/nextcloud/k8s/external-service.yaml b/nextcloud/k8s/external-service.yaml
new file mode 100644
index 0000000..e5194e8
--- /dev/null
+++ b/nextcloud/k8s/external-service.yaml
@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+spec:
+  ports:
+  - port: 11000
+    targetPort: 11000
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-apache
+addressType: IPv4
+ports:
+- port: 11000
+  protocol: TCP
+endpoints:
+- addresses:
+  - "192.168.49.1"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+spec:
+  ports:
+  - port: 8080
+    targetPort: 8080
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-aio
+addressType: IPv4
+ports:
+- port: 8080
+  protocol: TCP
+endpoints:
+- addresses:
+  - "192.168.49.1"
diff --git a/nextcloud/k8s/ingress.yaml b/nextcloud/k8s/ingress.yaml
new file mode 100644
index 0000000..e350c55
--- /dev/null
+++ b/nextcloud/k8s/ingress.yaml
@@ -0,0 +1,115 @@
+# Nextcloud
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-dev
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.gigaforust.internal`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.workstation.internal`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-prod
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    {}
+---
+# Nextcloud AIO
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-dev
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.workstation.internal`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-prod
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.forust.xyz`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    {}
diff --git a/nextcloud/k8s/namespace.yaml b/nextcloud/k8s/namespace.yaml
new file mode 100644
index 0000000..e8c2e8f
--- /dev/null
+++ b/nextcloud/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud
diff --git a/nextcloud/k8s/servers-transport.yaml b/nextcloud/k8s/servers-transport.yaml
new file mode 100644
index 0000000..cbc4029
--- /dev/null
+++ b/nextcloud/k8s/servers-transport.yaml
@@ -0,0 +1,7 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: insecure-transport
+  namespace: nextcloud
+spec:
+  insecureSkipVerify: true
diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml
new file mode 100644
index 0000000..a556192
--- /dev/null
+++ b/portainer/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: portainer-prod
+  namespace: portainer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`portainer.forust.xyz`)
+    kind: Rule
+    services:
+    - name: portainer-service
+      port: 9000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: portainer-local
+  namespace: portainer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`portainer.workstation.internal`)
+    kind: Rule
+    services:
+    - name: portainer-service
+      port: 9000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: portainer-dev
+  namespace: portainer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`portainer.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: portainer-service
+      port: 9000
+  tls:
+    secretName: local-tls
diff --git a/portainer/k8s/namespace.yaml b/portainer/k8s/namespace.yaml
new file mode 100644
index 0000000..aec7989
--- /dev/null
+++ b/portainer/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: portainer
diff --git a/portainer/k8s/portainer.yaml b/portainer/k8s/portainer.yaml
new file mode 100644
index 0000000..bfbf445
--- /dev/null
+++ b/portainer/k8s/portainer.yaml
@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: portainer-service
+  namespace: portainer
+spec:
+  selector:
+    app: portainer
+  ports:
+  - port: 9000
+    targetPort: 9000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: portainer-deployment
+  namespace: portainer
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: portainer
+  template:
+    metadata:
+      labels:
+        app: portainer
+    spec:
+      containers:
+      - name: portainer
+        image: portainer/portainer-ce:2.41.0
+        ports:
+        - containerPort: 9000
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: portainer-data-pvc
+      - name: docker-sock
+        hostPath:
+          path: /var/run/docker.sock
+          type: Socket
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: portainer-data-pvc
+  namespace: portainer
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml
new file mode 100644
index 0000000..bd5f16c
--- /dev/null
+++ b/traefik/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-dev
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-local
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.workstation.internal`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-prod
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.forust.xyz`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    {}
diff --git a/traefik/k8s/local-tls.yaml b/traefik/k8s/local-tls.yaml
new file mode 100644
index 0000000..6464646
--- /dev/null
+++ b/traefik/k8s/local-tls.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: local-tls
+  namespace: traefik
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXVENDQWtHZ0F3SUJBZ0lVR0FpNCtsWDlCOUFteVdmcVpUSWl3UTlYYkcwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0Z6RVZNQk1HQTFVRUF3d01LaTVtYjNKMWMzUXVlSGw2TUI0WERUSTJNRFl3T0RBMk1qazFObG9YRFRNMgpNRFl3TlRBMk1qazFObG93RnpFVk1CTUdBMVVFQXd3TUtpNW1iM0oxYzNRdWVIbDZNSUlCSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF5c2VLRnBmaDRJVGR0NGdHR2JNV01pQ1F2bTc5UkZ4UDgwa3QKNDVWOTF5VkVRWUZaMmptRjFpOS9JRTNiKzhacXR6cXQ2bWU5aHN4L21LTXE5Z05tQ1M1NWUxc0NMNkttRCs3bgpSOXJtM2h2TEJWRUpselIwZW9FOXhWS091dzJYNkNvcEZRelVQU1ZzUFRSajExQlUyVDVqekVUc00xTG5LVFhHCnlzMHpCcjByZHMvRlM2cUV2alY4TkREdUVZWVNCaU1hMUdpclpPSndvd2NiZ0pBVWRiRnUyMHRGRmZMb3B2R0wKSEFQcnA3TXpYWTdVQ3RRYW9xY0xMeTN1NEdKN3dyNUcyRURvVUhmdXlJaFBtTStibENZbWkzY2NlZ0tBQ2hKcApZQTQyMGRXVkRBYWpmT1hFc2c1VTFFT3JLK2hQaTluRVc3MUlYYnNYdWp3ZG9zbEgvd0lEQVFBQm80R2NNSUdaCk1CMEdBMVVkRGdRV0JCVHkxdFlLWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFmQmdOVkhTTUVHREFXZ0JUeTF0WUsKWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFQQmdOVkhSTUJBZjhFQlRBREFRSC9NRVlHQTFVZEVRUS9NRDJDRENvdQpabTl5ZFhOMExuaDVlb0lXS2k1M2IzSnJjM1JoZEdsdmJpNXBiblJsY201aGJJSVZLaTVuYVdkaFptOXlkWE4wCkxtbHVkR1Z5Ym1Gc01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1ZTQ21Sekl2RjhhdXRWVkxZRXpuVHN6OHUKWlNWOGJSYkxYalpDVWVSZUJidW1OR2JQS1c5dExLS2JBWmJqUit1dWZIbGxMMGk1TjdrdFRvNm5NU05vS3NjaApOSjdrRkJoVHRwcmRZUjhMNFpnUkh1VFZGTmViR0pBL1RPRFpUSjhUNTNXaVdoa2tUWnRWOEViQ2hwZ3Zqb2tuCkJCSEpBbEo2dkZFczBzSE9pMVp4Yk5VU2ZLQWdiMlJiSXpJRlhPZkllR095ZjZCL3hFcGtndVNzN3drMGJrK3QKV2YyNVJ5WnZiYmg0amc4WDVOVGQwS2dwdU5NZU96aERlUHNKNlM0b3o5STA0UlEvdENRdWErdlRYNEM3NkFrWgpjcnYxYlR4Wm5pNjBzYVZKeC8wVDI0LzBPN2dGbXFkelcvL1U0QS82eUx3RzlRMG9jZ1JYcGFlVmFLeUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREt4NG9XbCtIZ2hOMjMKaUFZWnN4WXlJSkMrYnYxRVhFL3pTUzNqbFgzWEpVUkJnVm5hT1lYV0wzOGdUZHY3eG1xM09xM3FaNzJHekgrWQpveXIyQTJZSkxubDdXd0l2b3FZUDd1ZEgydWJlRzhzRlVRbVhOSFI2Z1QzRlVvNjdEWmZvS2lrVkROUTlKV3c5Ck5HUFhVRlRaUG1QTVJPd3pVdWNwTmNiS3pUTUd2U3QyejhWTHFvUytOWHcwTU80UmhoSUdJeHJVYUt0azRuQ2oKQnh1QWtCUjFzVzdiUzBVVjh1aW04WXNjQSt1bnN6TmRqdFFLMUJxaXB3c3ZMZTdnWW52Q3ZrYllRT2hRZCs3SQppRStZejV1VUppYUxkeHg2QW9BS0VtbGdEamJSMVpVTUJxTjg1Y1N5RGxUVVE2c3I2RStMMmNSYnZVaGR1eGU2ClBCMml5VWYvQWdNQkFBRUNnZ0VBRWdrZlloVU9OUTc4UFdldXl6aGZnQVBmZStDWlRDdzl2RERGRVJucHdHb0QKSVNSbEhvREJRNlNqMVBhMzJ6UHhwK3hqTFpjZWgwL0hCWWQxdWIzaHBHMXF4cXI0amM0VW9SUXBvLzEzVFVnQgpqYTZBZ045Y2dNemY5cDM2TGU3dWxPcXpEcmsrWTFYaHc2dldPWDllbkpmcy9tMGU2UTIxbTdlNXY2M3luT1dyCjN0cFhWcXNPNVhrVWwyb2lCQWNHNG1STnhOSzVkdTZjamJMSTlIenBZSEQrYVpNNVBnTDdUUDltQ3djN1M2dnEKWks4M1h2UC9DL0U2alJzMmwyTWJLRzFkSzllOVl3cnVaNmpCbTRVVVRtR0xOVU1JamVnZ09XTWNnaDVhVHRBRAo5N2JTUFovWHYxeWgwZzUyMkhNbUFHYW52WlZRNWs3VkIyY3dCc2FabVFLQmdRRG8zTm5EWGhsM1l2ajRFQUtDCk1TK2ZkVEp2NFYzem9oWnlLZlYxN053U2dpQ2ZQaldKbDduRGluSVdhR2p1QzY2OENPM0dURys5Q25IY2dLS2UKcnp5QWhaUGpzc2EvQVZuSGE0MDBTYm9Cb3RacUVQdnA5eTVQTzVnNGkyT1k3ZUFjTDZZakJsUmVmOUsyNUNkbQpIR1d3MjNnRG5UeDRXMDFncjY4Uk5GOVZEUUtCZ1FEZTdYditkVUhCT1BzcHNSVmVlV1FuWjB3WlJFVGxvSE1KCnZ3OVZsdlYrN1hIYTRDb0gyMUg5TU1IbkM5TkhuYmlTaUpvR09lc1FLMUowUnhVNjZMMkZDQUJnQk9USTlqYU4KZmNmaTNKcGZ4a2N3c2VWRXB1WmQrZHFZbVlPNjlRZG1nODJOa3o0emwrTWREU0RBOVQ5Uk1XS1V4WHZVSEVPcgpuTE9pU0VQbU93S0JnQ3V1c2xNSjVmRVZhZXJ1NWVtU1hJS25NNHoxVS9DT0tYUEZGenpGOEFxd3lublU2Nm9pCkFrRUNTYUNXZVlpZVBHc2RxYTBYVGFiQ3ZOVkdkRHNjV0ZjcnQ3QnhLd05OdDQvSFJ6ZlYxTVRWelM4Y2ZJVkoKVHpDaDEwNVVKNXpha3IzMjJrMmJ0RnY5MG9Ob2pWT0VaRGNuRkg1cEVwenBVN3lkZUZQYjVUNUpBb0dCQUlVNAp6Um5TL3htMnNMcElubW1ZQjlkWWJ1ekdsSm5abWdYZ0RRenNLd2ZRWkhNVjlXZytsQy9IL0lqVDAwNkFIZlpMCjlpZjBZdHFGMlQrdDN5MFdPM1FOeFJPY3VSQ3p1d1F4Zjh1K1krOEtjaTdTa1IzRzAvS2pSeFJjNFpGUHJ6MS8KVk03ZmlKT1NtR0liSDFEUS95YkphWTFZdTFpV0Q0YTJIYy9FZWZkVEFvR0FQRmcxZW14U1BoYUdCN3RKVkVFaQptNzhCUEhpZ01OTXd6VDFWRVcrV1BXeks4a3lvak1XU1puRkIyamEwZ25VL0dOSjkzY3F3T0xGck1aOCtSL1JyClRnRnVJZ0JENGRENUJ0MGd4WlQ1SC9QU0dUOGszUU0vYloxamZaTXk0WG1vTlFONytaVXIrS2EycWNaSjhMZHYKbmlvdGhGTGg3VmI4d0grTGhvNnVzaFE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/traefik/k8s/traefik-dynamic-configmap.yaml b/traefik/k8s/traefik-dynamic-configmap.yaml
new file mode 100644
index 0000000..d0a90cb
--- /dev/null
+++ b/traefik/k8s/traefik-dynamic-configmap.yaml
@@ -0,0 +1,124 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-dynamic
+  namespace: traefik
+data:
+  dynamic.yml: |
+    http:
+      serversTransports:
+        insecureTransport:
+          insecureSkipVerify: true
+  middlewares.yml: |
+    http:
+      middlewares:
+        # HTTPS Redirect
+        redirect-https:
+          redirectScheme:
+            scheme: https
+            permanent: true
+        # Cloudflare IP Whitelist
+        cloudflare-ipwhitelist:
+          ipWhiteList:
+            sourceRange:
+              - "173.245.48.0/20"
+              - "103.21.244.0/22"
+              - "103.22.200.0/22"
+              - "103.31.4.0/22"
+              - "141.101.64.0/18"
+              - "108.162.192.0/18"
+              - "190.93.240.0/20"
+              - "188.114.96.0/20"
+              - "197.234.240.0/22"
+              - "198.41.128.0/17"
+              - "162.158.0.0/15"
+              - "104.16.0.0/13"
+              - "104.24.0.0/14"
+              - "172.64.0.0/13"
+              - "131.0.72.0/22"
+
+        # Authentik + secure headers
+        security-chain:
+          chain:
+            middlewares:
+              - authentik@file
+              - security-headers@file
+        authentik:
+          forwardAuth:
+            address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+            trustForwardHeader: true
+            maxResponseBodySize: 1048576
+            authResponseHeaders:
+              - X-authentik-username
+              - X-authentik-groups
+              - X-authentik-email
+              - X-authentik-name
+              - X-authentik-uid
+              - X-authentik-jwt
+              - X-authentik-meta-jwks
+              - X-authentik-meta-outpost
+              - X-authentik-meta-provider
+              - X-authentik-meta-app
+              - X-authentik-meta-version
+
+        # Security Headers
+        security-headers:
+          headers:
+            browserXssFilter: true
+            contentTypeNosniff: true
+            forceSTSHeader: true
+            stsIncludeSubdomains: true
+            stsPreload: true
+            stsSeconds: 31536000
+            customFrameOptionsValue: "SAMEORIGIN"
+            customResponseHeaders:
+              X-Content-Type-Options: "nosniff"
+              Referrer-Policy: "strict-origin-when-cross-origin"
+
+        # Nextcloud specific headers
+        nextcloud-secure-headers:
+          headers:
+            hostsProxyHeaders:
+              - "X-Forwarded-Host"
+              - "X-Forwarded-Proto"
+            referrerPolicy: "same-origin"
+            customFrameOptionsValue: "SAMEORIGIN"
+
+        # Rate limiting
+        rate-limit:
+          rateLimit:
+            average: 100
+            burst: 50
+            period: 1m
+
+        # Nextcloud chain
+        nextcloud-chain:
+          chain:
+            middlewares:
+              - nextcloud-secure-headers@file
+              - security-headers@file
+
+        # Error pages
+        error-pages:
+          errors:
+            status:
+              - "400"
+              - "402-599"
+            service: error-pages-service.error-pages@kubernetescrd
+            query: /{status}.html
+  tls.yml: |
+    # TLS Configuration
+    tls:
+      options:
+        default:
+          minVersion: VersionTLS12
+          sniStrict: false
+          cipherSuites:
+            - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+            - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+            - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
new file mode 100644
index 0000000..08351eb
--- /dev/null
+++ b/traefik/k8s/traefik-values.yaml
@@ -0,0 +1,81 @@
+# Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
+
+hostNetwork: true
+
+api:
+  dashboard: true
+  insecure: true
+
+deployment:
+  initContainers:
+    - name: volume-permissions
+      image: busybox:latest
+      command:
+        - sh
+        - -c
+        - "mkdir -p /data/letsencrypt && touch /data/letsencrypt/acme.json && chmod 600 /data/letsencrypt/acme.json"
+      volumeMounts:
+        - name: data
+          mountPath: /data
+
+providers:
+  kubernetesIngress:
+    enabled: false
+  kubernetesCRD:
+    enabled: true
+  kubernetesGateway:
+    enabled: false
+  file:
+    enabled: false
+
+# Entrypoints
+ports:
+  web:
+    port: 80
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+  websecure:
+    port: 443
+    http:
+      tls:
+        enabled: true
+  ssh:
+    port: 2221
+
+ingressRoute:
+  dashboard:
+    enabled: false
+
+persistence:
+  enabled: true
+  size: 100Mi
+  path: /data
+
+certificatesResolvers:
+  letsencrypt-staging:
+    acme:
+      email: bobrovod@national.shitposting.agency
+      storage: /data/letsencrypt/acme.json
+      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      httpChallenge:
+        entryPoint: web
+
+volumes:
+  - name: traefik-dynamic
+    mountPath: /etc/traefik/dynamic
+    type: configMap
+
+additionalArguments:
+  - "--providers.file.directory=/etc/traefik/dynamic"
+  - "--providers.file.watch=true"
+
+logs:
+  general:
+    level: INFO
+    format: json
+  access:
+    enabled: true
diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml
new file mode 100644
index 0000000..dd44f59
--- /dev/null
+++ b/uptime-kuma/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: uptime-kuma-dev
+  namespace: uptime-kuma
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`uptime.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: uptime-kuma-service
+      port: 3001
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: uptime-kuma-local
+  namespace: uptime-kuma
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`uptime.workstation.internal`)
+    kind: Rule
+    services:
+    - name: uptime-kuma-service
+      port: 3001
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: uptime-kuma-prod
+  namespace: uptime-kuma
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`uptime.forust.xyz`)
+    kind: Rule
+    services:
+    - name: uptime-kuma-service
+      port: 3001
+  tls:
+    {}
diff --git a/uptime-kuma/k8s/namespace.yaml b/uptime-kuma/k8s/namespace.yaml
new file mode 100644
index 0000000..ec3c9bf
--- /dev/null
+++ b/uptime-kuma/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: uptime-kuma
\ No newline at end of file
diff --git a/uptime-kuma/k8s/uptime-kuma.yaml b/uptime-kuma/k8s/uptime-kuma.yaml
new file mode 100644
index 0000000..45daed2
--- /dev/null
+++ b/uptime-kuma/k8s/uptime-kuma.yaml
@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: uptime-kuma-service
+  namespace: uptime-kuma
+spec:
+  selector:
+    app: uptime-kuma
+  ports:
+  - port: 3001
+    targetPort: 3001
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: uptime-kuma-deployment
+  namespace: uptime-kuma
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: uptime-kuma
+  template:
+    metadata:
+      labels:
+        app: uptime-kuma
+    spec:
+      containers:
+      - name: uptime-kuma
+        image: louislam/uptime-kuma:2
+        resources:
+          limits:
+            memory: "3Gi"
+            cpu: "1"
+          requests:
+            memory: "512Mi"
+            cpu: "100m"
+        ports:
+        - containerPort: 3001
+        volumeMounts:
+        - name: uptime-kuma-data
+          mountPath: /app/data
+      volumes:
+      - name: uptime-kuma-data
+        persistentVolumeClaim:
+          claimName: uptime-kuma-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: uptime-kuma-pvc
+  namespace: uptime-kuma
+spec:
+  resources:
+    requests:
+      storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+
+