diff --git a/headscale/compose.yaml b/headscale/compose.yaml
index c4b91e2..76422f9 100644
--- a/headscale/compose.yaml
+++ b/headscale/compose.yaml
@@ -65,6 +65,40 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     networks:
       - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headplane.loadbalancer.server.port=3000"
+
+      # Middleware: add /admin prefix for root requests
+      - "traefik.http.middlewares.headplane-prefix.addPrefix.prefix=/admin"
+
+      # Prod Root Router
+      - "traefik.http.routers.headplane-root.rule=Host(`hp.forust.xyz`)"
+      - "traefik.http.routers.headplane-root.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root.tls.certresolver=letsencrypt"
+      # Prod Router
+      - "traefik.http.routers.headplane.rule=Host(`hp.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane.entrypoints=websecure"
+      - "traefik.http.routers.headplane.tls.certresolver=letsencrypt"
+      # Local Root Router
+      - "traefik.http.routers.headplane-root-local.rule=Host(`hp.workstation.internal`)"
+      - "traefik.http.routers.headplane-root-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-local.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-local.tls=true"
+      # Local Router
+      - "traefik.http.routers.headplane-local.rule=Host(`hp.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-local.tls=true"
+      # Dev Root Router
+      - "traefik.http.routers.headplane-root-dev.rule=Host(`hp.gigaforust.internal`)"
+      - "traefik.http.routers.headplane-root-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-dev.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-dev.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headplane-dev.rule=Host(`hp.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-dev.tls=true"
   web:
     image: goodieshq/headscale-admin:latest
     restart: unless-stopped
diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml
index 2f4247a..4f4e877 100644
--- a/headscale/k8s/ingress.yaml
+++ b/headscale/k8s/ingress.yaml
@@ -1,7 +1,16 @@
 apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: headplane-prefix
+  namespace: headscale
+spec:
+  addPrefix:
+    prefix: "/admin"
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-prod
+  name: headscale-prod
   namespace: headscale
 spec:
   entryPoints:
@@ -14,13 +23,52 @@ spec:
       services:
         - name: headscale-server-external
           port: 8080
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-server-external
+          port: 9090
   tls:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-local
+  name: headplane-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hp.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
   namespace: headscale
 spec:
   entryPoints:
@@ -31,76 +79,33 @@ spec:
       services:
         - name: headscale-server-external
           port: 8080
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-prod
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
-        - name: security-chain@file
-      services:
-        - name: headscale-ui-external
-          port: 80
-  tls:
-    certResolver: letsencrypt
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-local
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
       kind: Rule
       services:
         - name: headscale-ui-external
           port: 80
-
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-metrics-prod
+  name: headplane-local
   namespace: headscale
 spec:
-  entryPoints:
-    - websecure
   routes:
-    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
       kind: Rule
       middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: headplane-prefix
       services:
-        - name: headscale-server-external
-          port: 9090
-  tls:
-    certResolver: letsencrypt
-    domains:
-      - main: hs.forust.xyz
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-metrics-local
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
+        - name: headplane-external
+          port: 3000
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
       kind: Rule
       services:
-        - name: headscale-server-external
-          port: 9090
+        - name: headplane-external
+          port: 3000