diff --git a/apps/navidrome.yaml b/apps_temp/navidrome.yaml
similarity index 100%
rename from apps/navidrome.yaml
rename to apps_temp/navidrome.yaml
diff --git a/forgejo/namespace.yaml b/forgejo/namespace.yaml
index 0aaf004..6521f89 100644
--- a/forgejo/namespace.yaml
+++ b/forgejo/namespace.yaml
@@ -2,5 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: forgejo
-  labels:
-    istio-injection: enabled
diff --git a/forgejo/route.yaml b/forgejo/route.yaml
index 1ed4771..75f3ae8 100644
--- a/forgejo/route.yaml
+++ b/forgejo/route.yaml
@@ -18,7 +18,7 @@ spec:
             value: /
       backendRefs:
         - name: forgejo
-          port: 80 # 👈 Flattened directly to an integer, matching the Gateway API spec
+          port: 80
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
diff --git a/navidrome/certificate.yaml b/navidrome/certificate.yaml
deleted file mode 100644
index f320278..0000000
--- a/navidrome/certificate.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: navidrome-cert
-  namespace: istio-system
-spec:
-  secretName: navidrome-cert
-  issuerRef:
-    name: letsencrypt-dns
-    kind: ClusterIssuer
-  # commonName: music.local.gwg313.xyz
-  dnsNames:
-    - music.local.gwg313.xyz
-    - music.gwg313.xyz
-    - music.zerotier.gwg313.xyz
diff --git a/navidrome/gateway.yaml b/navidrome/gateway.yaml
deleted file mode 100644
index 03f70c9..0000000
--- a/navidrome/gateway.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: networking.istio.io/v1beta1
-kind: Gateway
-metadata:
-  name: music-gateway
-spec:
-  selector:
-    istio: gateway
-  servers:
-    - port:
-        number: 443
-        name: https
-        protocol: HTTPS
-      tls:
-        mode: SIMPLE
-        credentialName: navidrome-cert
-      hosts:
-        - music.local.gwg313.xyz
-        - music.gwg313.xyz
-        - music.zerotier.gwg313.xyz
diff --git a/navidrome/iscsi-secret.yaml b/navidrome/iscsi-secret.yaml
deleted file mode 100644
index 5bdc774..0000000
--- a/navidrome/iscsi-secret.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: navidrome-iscsi-auth
-  namespace: navidrome
-spec:
-  encryptedData:
-    discovery.sendtargets.auth.password: AgCfQP4VjeYYMuHZn5ZOVrs3C9vm+kF0qiWfT1wTixwvvNA5I9mDFA7F2cR/SIT6NvDLpLVMaFku7tf88aJCjlQvhEoEJbeSEurLCfJcXDaQwFKaTeELrz6l1NbyusXlijblpLQYkupxl7ZNraY3mWJSAoBD0OdpQfP56+8NcoOHHEDDdBwYza/VkBdlYOYCFWtPCosbw+wjtLgSIRkiNbrWXEN0MkBAo9OWczvB0GKGyk5divHM8iDFTON34Rk1HMv41o3tvgHa7RvXFC8LJ3GB0NyFeawyrcQF7C3i+8P50zGmzUs3ie1il//8ICzkp+0zJk4hOG+9KBIu9sDInjjVhhwHcCZspvmuKOOqg9F2mjK8a6VGURoKdvxFX2HahqAB/FjFTp5diKKZQY+zfkd7mJ3OnPqhB9fIKmZnxWwtUq8AYI2jcDdERI4FeTrmkbcxAhMCgI7cCYStwDD11dQt4XRqWOeA3trOHubyslPjvjEkIDvoVj2BNHtFIwSNX16gAMs5HsRZnoo1SUc57+IRPH0v/ZaSfJXeE6Lrv2H7ZTSlHEusKkTAvAnVKAQyJmRTYCOMdYPePr169NUEhsAqWVmizjxN34VPiK7Y6kkwgGiQJpXZHHj1QxUQ63P4O4iuvYPEx40gCtR8cXBMesPE6XkH5udxmQ/zAHjjJSyodJgM6v2IO++0gYZb06AZjDPtqgp3sqrHnzlcNRh78oBz
-    discovery.sendtargets.auth.username: AgAY/IEE3LVt8co+pMWEppPD9RC2JnmL/qbFrZ5PKZc3XA33wrtzHGBoELDwWG4Lfc5Itg1Zr0t/Sh8aLNLGlgfa8Zd4KBmu6mi+sHnh4LKKEIEE3pMuyNUC6k4jWDz22XihEy9Qfs3fr4qOrDvn9OxzVSTogLQvvn2bG1jBauRawekN3bwln7B5eY2PVwYTxjdgDBIVe2DdJYoKquK2siFszXJzM9m+IpE7S1M5s1pzs6GdYH3qBiBoWnJ5vVZzx1h7O2Z+5yVrxC1T11gDsal6mOsqSP7XNerIy0G3/NcE/RkWPz0+/wqlWTv8kulnKYnKuG+m1lttnBLr7oc6xqRNQmcFlui+0R/FS0slDvoM52KU7ZBg9YSXoMjZsQziYVF8to2wxCNAvkNpATdsgqTfbj/ydUHNrXmtBgyVWyOmmJZYHw4rUIWqlgwOkEK1arsiHPWLbOEqY+MZAyqWO9s+/iTVhGckTwDACTavhWthEhZAaaW/mr42uDTQAapjnQ8/AYixuwK8pnL20j/89xNXdCIKiSPSx0i5F4vIv7jLRCuLSmyuhMk8yOrSFOMUnk2FHxdFrLMsP9q5L3+ZSU5pVe/pJJtYSM56TIg5sGKE4l8gEm+3aEVKQMhA1urzfEe8Gz1xxpd1qnViEWegaoAEqbfmDBGmnofxkpk6xK/27Y+DKWNtNpQTZ1Ss768sb6hsI1aidC/BcIo=
-    node.session.auth.password: AgCaw7xjK13WWHje8KBCyk9KJVvGsbwnZHcQZjl1OQlqpyPx2MuYt41z2jnReAieFwFJ0EUR0AcHWWVS1llrUl0v4URGLmFSX372s+Z1rZ0J/agFGgAIHwu+ksXRhG2rLtUk4YJ0RBJUaWOcIpFrHk3oGnUU55Nw1v5GtiYbgRTBehMkON6TXQt3PA0WLmVHxEoDoKy9kzQL643VnQ+jTiuFFcmmjVVAF+a+xEAwV0os6FgrO1okej2ucBTrNAmbFUl9dhzGidA50asSZimplrlRY8y1b2R9LUQOYZ/U4PgTsG9dAfM3wSjfhcWFlQ3D4pf4Y/pchUe0OkkFTLXnXCcY0MhdpMtDDWRU6JoBNkDsa4g36gzEL2s+dCcWa+ltA8XPdI1vpbOaFpZn1TZTgk00JQnnePOsL1bTObNY1Eh0Yl7g1zb2SgUzg7zp4C2rOz/0q9I4ftuNgMtAPtD+fbf53vxCOc6hHvEdCZN03uvbsGp2drF7R7xHOXbWNvJtXi1kCO/ddVP6hxKOLbg/5Ag07gf9p1scm+nDhsBvVaTJTI6Oc66MggAsHRkQVvdM6XJlmINVCIKPoqygXCkZwXrIJUXin6MTV3OTqIC/FdKUE4Or0hhQM4Gw6Dg3FE+zAENdPPQeEs6A7+KQbMw0NDA0WoyXDbOobEHpOU5IUcigycjklO/58sYOrQX7z8JlxyibtRunPHhiL7fBWi7p2PSG
-    node.session.auth.username: AgBGQxzefQTAt3/7O+1bqbt6XlqehG0Obc3+GH5V4dgDyZMcPGgq74Beh07j8ahe9i4T+tXY4DylnTaBoVBSrOW62ipwVYmiyxWRbQ7TJ0m4dcAJOddDFED2pmQ91S0xneIrHx7N8SZgXf2Gh9xabOrkqcTHx0n0KXjuQvrDO6DcckSdnvptS3PNniK9DogY1cOInHZdAX341wXY93U4DyQb1JsoKi3QvxjVGBlmPft9GiAfWTBj9Hj9q+AA6pymH69j7xhkUiv7b6XCgYdjOqE0D1/4hIMvJR7qybGYrwUbVv/xvfLcIKJFsAMkigi2VQaTvn4E+4MkmukM+FBDfuoJ64asvYlu8quJ5KwD/OHL8toYthjs/g3aq/EQBCn1hc3JNPq6ZZ52rfRKiPcjHKOdoFkPy8yXg6nb3HSqDlUv3i01CbQ841hQhJgFfnbqDYvI3xYH0ubXKiJsGlTbZVV8iDOiJJIPRiRKL9tt4PzR2J3GCnR4ZZVYYHWkE1wIYheLwklxBkKmg2lktc0MzBfCtbcCewmcfZ9bnQFy0TT9Bvzr5EA8UbYDVEiw7eqNiK8u//iwNPZvHyMXo0lKDQ0O8YuznUrZZ0g+RHALKwDPpYqhXvu5ARh3SnSkvonZ2STVDMJgeM4/p0Q2fKomfrzwJrzHth3ipR/9gScdInMvtrudcBpVhgULxsc9UxbwnW708N6kN5lo7fo=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: navidrome-iscsi-auth
-      namespace: navidrome
-    type: kubernetes.io/iscsi-chap
diff --git a/navidrome/iscsi-secrets-sealed.yaml b/navidrome/iscsi-secrets-sealed.yaml
new file mode 100644
index 0000000..c0b1fc8
--- /dev/null
+++ b/navidrome/iscsi-secrets-sealed.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: navidrome-iscsi-auth
+  namespace: navidrome
+spec:
+  encryptedData:
+    discovery.sendtargets.auth.password: AgBYZfb/V7zmafu5+HmTwRAyKh3CySd/G4y7JEqkKcY2D4clIQCwvygtBPyyYSNfVkd9akUeF3ZM8N7LY9kYIq+aPQ4b23Hg0HOPJikMkjeQbE186cE0MxPi9jvZGxMWUue2L6IgWAZy7OHqNBYQArOaRv0RpAMeNyfOwWYUToPwDO16S82igE09V1lXukxsNx3EwH12ypSHNabqjBJ6SSZdKgnKaPykxpDLrgear4KRiVJYlNFDjmIWP7taOP5m/Dut+f39IARh5xkimAaVW8FyCRjQO4Pk9aXOV/2XPdtjdlEw2lxAq/+EZMcbnY47RNDvKT6307t5RITIBG8Zk0OLRNitczk9nS9sMtakkv2hOOO7cTMuhHH52t7ZI2QQDvTeLuv9o26rY5JGFC3tQqwcdCw6u+1Hy6El1SqTN3JOmnDXEVJiQrZvpNZCoycQONho97qpygm1/s9Xik9FcmM4UK9GGi64AH+vAAinpZXcnKEvRxGkHW+1snoXcbLBU1W4ew1Fyih/rp74Tz6Ic+JnVvESG3YZas+q4hmQwwPnRhg9K7rswqtqhHrzhe77SEULvZBCBM64pFA+/ZwWeUMvuGuESSybL3YtEBMwotW6XmD5OgaDRQac0ngjPVr0vYuKUC0kT351oQlaTc90H2C6KXFfkPcaZgwyGXwnhoJxE6766BwBEhtzxPOeHBFrhwHTkijQ/VuaMx47cCcLAY9r
+    discovery.sendtargets.auth.username: AgAnqVjPTeBOB6jZMP523a3yjD358MLaVfWtncFtkd1NgeoZkg7slaICcFYLCyFbanTv4D9epcXEA4QDYYRgXB+LsgH5znIYbQAHWlBomVspq9ccARvRqgCgEj4/vpnw97QRGkRZ44o/FVa5qYOTzPv4ILthdpQjAeApeGwZsXb5Xaj9dAG7oc79sledE2RIA/ddyd5t/VthV8QE9u7JXwmXmb5QqhsbNT17LXSvIvJVkmZYvkzfikjFIoXN7CSmtx74ei+WSQNKObDJldRP5RQTkROnEBd3rb/ZylQzoLxQ2F3W7PsneXKco0jquzJC2fIC/SfoDQA2+NHa8sb0VObX6OJN0DTqW1tfkZi6FF7t+bK++55j8V5QaAdBHewgU8b/8d+PJ2Gv9n+oFXxcvntnFyOEX9nhwAOhjwssacuqIOmoxl8M9vtM+1RQLmZ6cYdDYVCij87svFZsHKCdaZHx5raz+DlkmvdSecd7Xe74VOzNgekaUC8ZzawfC41pFf3bFjNDZ+V4ZLwRM4l4AMqTsIVscRtIoj0iP+TcPn+XxirlN0wC9X4B77URd3dDzhqdZUaCDu9e664E1rAQZxP3eLF6pyy3n33tMVD5ySMBDLI2JG6Ns7P/n8rwc+ORr82vfF3ZeBFddC7johTwGj7/wiVmJQph/1t+N9J5q4CKtV24lGGGaq1WfBjzqwJqLWJD6/IX7mUR46o=
+    node.session.auth.password: AgCWDzgAOVvCvNmQgPBN9wWrfr1h2xgE75VQ4fFGOrFBTKd34sA1EzpvObNwIPO8woyB09J7PD/9UP9FInPI3CcmvVswJWuL4jfQGAUTNu5L0lpTdnSzSj6mLAGi78DKcxK20Fe/FHgjXNeSxSF4DUFvOOCxsfn8yWc060qBQC5MclRcHqHrU0W4MQiWBRK6KBWEuUIm31F+i0OyhybKUI+mB6ocWqvGKDUHBzZ7qc7OPFk/OWwV7wdzBF6pVeCazDVaakdi5qdyzxaQBe2CVeAOCu2ZwVjY7/9eqdsEsK4curxtRLqE34/XSuA2VBUC6dp/FV/L1C9WZZ7Xm067Ng23nPFJNH7XRs4xZgDGa6QCl8pEpDGX16LddzARscfHI4svZAVdgrFocfGejCCw/Q3DIVUr3eLl+pi38MUCG5qbVtDlDpBR4D6wXkQfwCAgvUCE+9GOReh56vUFX6guXU0Fq7ottYV+/lZ2TIiZrHMN82l16OGNZ6pvjo7j5POPHdPwEpqzGNeU8zte7al2984gu5p57Lx5BHf4A9FZVQNEeyNt60Ro7T65JEqBogVapuc1PuxKJBmAznvDpZNskNzkSNOcuv3QA+j6aLXhwfHqWC3aW7sK0uFjC3QMTz2FOloRR0x9vZ8d5pXNzps6NMPYM5J22tf03fL4YXeASSjwddinHOH7ZicUHXjktcO/lfkIW7E/e1IsXiDbMeTOdujQ
+    node.session.auth.username: AgCJX7DYpD6b9VZT6SyZGbarzuoskz4gFebcipAxnSL8+BRvRmJZzYKLDGWLCpGmO7/ZmpjShERvoRNNHrZ0RoNEmciiMy7IO3FWmYdHA7r2fY5TVc5fIgzPo0xUP7yUWe+RRA3/nYfQg3lIq7Vmd5XTzxjbQb7l1B+URwDvYjicQZgOxOncMvlomnl22Ash5a90yeIWHTCuJqzYF+EQWUMUZHhXWgPjzWOHicoOVwQ0Wiu6kVmOH+gUfx9PC9h9QpwuOKHIxQFO9OBpyJxufDZ7Z0SsGw6bsA78YJsI0Gq7de2V+wk6ZHIvs/H0+E3tyWzWldfaJo4JI2gPYZZQ4yJthqt3XMbm+w+hAALI++nVjROo3GNmzw725hnSRH82FcK2ZGGhgBJTqwFjN8vol0JPRQvaZhPdJXCDE4Hmx61ldUlJq1tu54KcDnfKb7H+GtCw+GwdwDEVtsSy15OhvIb47DGXprhl3I4R3NqTRMVXPyehrhaq8K8QAIJX1Y+QfePbgnXX2Gk92V8vpArrRA9yL9kuzKWoUaAc9B4BWMj7dNOT/p38sdK7CHNZ/41c+uljss+XcSFay2XIDmlt6mly684IPNH0yyPZ2wl/LT88ObtvRvNXXMoqc4wa4tsxnV3GMj/Uzx/8itnXlQ3/+lituXVev1SaxEmoksK5tCZ4v/qyHQRqnzhDkE/6C7lXjK5Q26UkwW+71wY=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: navidrome-iscsi-auth
+      namespace: navidrome
+    type: kubernetes.io/iscsi-chap
diff --git a/navidrome/namespace.yaml b/navidrome/namespace.yaml
new file mode 100644
index 0000000..6d061bb
--- /dev/null
+++ b/navidrome/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: navidrome
diff --git a/navidrome/navidrome-secrets-sealed.yaml b/navidrome/navidrome-secrets-sealed.yaml
new file mode 100644
index 0000000..d5a9703
--- /dev/null
+++ b/navidrome/navidrome-secrets-sealed.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: navidrome-secrets
+  namespace: navidrome
+spec:
+  encryptedData:
+    ND_LASTFM_APIKEY: AgCjnGsru3lcSOXWXAFnC2sxT6FY1MDOJD5hsTPEXsC4bQ9BNvmFwOhLzovTzTTd0SR9TOHlWibnWB8/tyzVsPcktBbKI1HaWH95EnFlG13gOtzMnl7jXf2qPD2LsRKukAivt4FxWIijyOHqss4Ct3Vea6XELJVC7nemmbl9tj9YVaceDWLX1oWYRLbNTqG4we4yV/06KerTQIyafbGQP/nkLhAYkJBf1mgYpKOe1vAah3m+sP9Q1LO25BNstxUASIlloFEYx3T1e8HnWUemZPLHTJNEhjoE8C9d8ULiCOQL9nQR2mYgv6YQuYRIb6CKXoc43GHemqRwJlGJeslZL3u7k27kFcsArU6XlMTNSZHZKmW0Yd0rQTNVd3DJMs+9YZ0s8DGRiGtZyK2R/LCNNnckp+TDHcWV4ivfhN2aFbgmHc1Coea5Og5f2lOf97VnIIgKgejAFbDzr4PRM1XqDFRPV7B7+iiyDDZuAeys4C/QQD2ZaBJuV3B5TR8ZkHgh+bDpkQ/5MhNY6t26dVTAIZfsBo6vRilH7ppryLXfTuAOdh8ojpqpCUUoSxqGc2IIXNoD/zKJpOJhsR5B4JOF2NbFLCDf7kSBkC8JvoG3CPti7tht3ziM5WrDMbi5+BXgTC+U9EES0yBSfvrS4dO+TntKbk+igchYdhEsDZ2Hi810o9RLnW6IjLjUWy1yYawsKgHmcuQ7+6dR5gNkvM5kZ3l+mA7BmQZttwmmKX9M52C7Yg==
+    ND_LASTFM_SECRET: AgBdSpMRmm/YeUslT4eBa12ZzGwAaBgZuPsGxeCGsAq2MaU1nnvllOa4YKULdSSI6bwavBM/JGE4EE+eUzCRa9kED0+pSocOZLFCdKEvVrLvcp5UbaoFdhpG0AQeuyB2DXEJsmgqXjPoA4WdeAB+k9HRdOZR61Cx9UJXvltF9X3n07E4Zehyxuz0d1FEnfDI1FYst9EYIm8DhE7CZGib9ygH5WN4GItFgB//za2EtKnnlo5DZWl5BPn5dHYa7dIxZx4k7sNQx3sUW85HhCPKCoYufILCsSxCTXV0QSBkhRrkO+uJPIcSlYgK6es/Tq7L64Jh0ow/4cRJ9TankfzdsA/zy8bKx/OZMuEqiffHxgHZOW5gB1pVLENdUkY7xOIitEPQEbuE4pgxdmMkpFvT/o2mdw/MDJxbl3WrbLxZyvoaqxOotVp4RvGI5EpwwHAKnQfdnoLM7iB75l0I52wLYKLqyLXIz3+F9h3Zvou9xiHO+s2OlMKcgSt1c4bHta12o5ZTrFpBfsYTpVQ8V3AdSzNe81q5Id+sNMO81XtluMvDlAtRTqlqGWBden4FlBWMBGUjssJba1JJThzyqCXd44vVqtajv2a0BExI5MKLnRY1ZigHEm38qNSYo2GllfDUaPWzJUcZSKiKCDVO/D8c5dBwf6nerkM4kbXGvLIbDWfVx80BzI6kKl6vTNWym7CokeZwDSJ3Mu1dFNnu/fFg5qQ/XzOGxH8L1A9nsv6IqXxFkA==
+    ND_SPOTIFY_ID: AgBTtb5SoXvc7r74BgK0hL5exzAsI23Yj8h6eaDIEmbOKKcd/S0fs7sFnn04r7RrHzQaRvowrSIwAXPWNdvpUSAObeDjb9NURe28RAHcxlKpRisjUm6NWaqo4eNlv2oZNZfmEajKmbFtSezdqAOuBbr1Yvm1d2Si05KSLlDfQHUiVN0OIvFBwSYJuYHFH7tAhbIZRzJI4HC4WrR37XV1Ow9Mms3HXS1qsM2e7Y8njkVObtJnjS5ejmbu1LajfU8laSUnsIv0d0NvlWTil1upzTca+Xm3EUJ1AG6Q9Jl74wZEd4/NU8ZiV8aqHA5j/EBLisiT9YeTD2xCJVQ3zvmXaA/SS/9w4bJpN/4x758cJDEvUK5q9r6hnF0Fvt6w4hKNoWNLdhl9oV668BjryV66HsTTJlzMjWVj9rpDx5O+XNLUgKlBjna2/uZIc/ys60l8Q+YxN0XTleFytCLfoBOOASF/EfcZYzwLR68zQqSkS4scOtqhBjyPNA0UJARtVvTmLLpP0YTMsQm7PNI2WdbZsDtgazRqTj+00o5HIXBiDSKP7mhHfkUtOQuI9fwIYek1YBxCY3D3K5vc6CNw1WSatJ8tkR+cfaf36wwM8XbW5iftUJP+c2sox2tHTHyUJXoWb4HD5u5qYOeZIWKs9XAlNzqK3fxnK1wms5XJCAEBvdm675wpaxqo9WqvFSGJfHjVAqfvUeWP9T/mv50PMvluIVRN1ZRp7ULP3c+5tFk0cpCrZ98=
+    ND_SPOTIFY_SECRET: AgA+w4eh9o6qh2L7zcOKhqiNwM5knXlIWA7xLTzEO0NXs1uSTuKSQost5vWm2EB5OlwncxJmacW7um+sdA9039GnbrtIvBja0PvkWqS6I1AFZECX/+ZHVpLjh2S+K0ELqT2A9DdHXtDllcW6M84rR8QuAExFVsaHO7QvUjVlyM71f420ktm6rU3kIRMdhRvhYatKnapdq6uI3kz6Y2EwSx6wGJlfG7nDye+60l6PIyNUvezQBDZh/Ldi+Nm+mTLumhscHo0mciSsC9zM17hgd8UGCE79S8cmy6r38EJtqeLmxy02x0cTj7NoDQ/WftFCC8aj/HGSWh8Io54YNbs5LIjFDIJL6VbVe7g/TKqVONJLfTWa24DXw1m5hLgH8iP5wRE6B677hOVkLsqvxZw7ALdrwm331/kL6xRLtkG1mjnosYCh8MBUVskdvw4HbL3cwmAkLy1Jvahd6Z6BbhKVci+r8d88J/CTgRkAd6oJiZxrpsN0m5oiWP5U9WlD1lCDvhuoaAFX60zjmSbE6leroP//h3arMMBlbVxi2SLAYQVXkD4QRc32WOXuOcbKUKitckC4mzcpEYRtguJuKkj6qe2FI6fSrsaw6aidPpPSzGZLgXIrDrTd3AUj9GjTPftvkHsxjgrL6WB3Tba6KbbNrJKCN+APyMUI2jJXHY5gYl2wjoocJ4Lnen86AZtynlMvMBkM8Qma8GAjwwWugqy5ZLw9cv8bqNsa90n4V8IYHHIamQM=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: navidrome-secrets
+      namespace: navidrome
+    type: Opaque
diff --git a/navidrome/navidrome-secrets.yaml b/navidrome/navidrome-secrets.yaml
deleted file mode 100644
index 565ea8a..0000000
--- a/navidrome/navidrome-secrets.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: navidrome-secrets
-  namespace: navidrome
-spec:
-  encryptedData:
-    ND_LASTFM_APIKEY: AgBtbBJ+dQ30vpgr5lU6e94qa4wsxBHrs6zuD/HjC8SB5eqFk5u6FT6/7SPvKbrSxllFkOrpeUJpvmQvstEO1pqCil54gwxTmtq5eMpqee9wASbGSPOlGGOz6BT+38HX60x2A8jXmg7AnZWm5gTdjS2k3UxzIfNW/6jrNx2X+sZer2gH5ck1cISbZli68oDYgyYQ5sJYTiTSoBBJFjICZHzep2pKEaUV+4sp+PHmeBseXEajUJ3XcxEOPORr0AQX+uyqb0jYQQBMk9/EmSIisaCR2Xn4/bH0YioosSGSsPkQzT1E6fdeDuaiwjtf2Vt/0FmtBvkT2KeEqQIVbRL5AEjjgP33hmVD+PvBYm6TS1VlE8MpP/gHfQtNASw8PO5txroPdtlRCI3DgmmEMw1knoJcTQ0LNxPBit0IlBEiN8sVlXe5jWxBD0NrywZdufYrgvl7bxtcV32nGYj6ux+aaK/GS41rIvfHdh2mDyAXNWGXQbl+VPTzH5jBhvGZqlqhmVsbL8EA8nuG3sP4/AfWINUO8M4ru50lOUR1yr7XjFxO/I8LWch3qExQ9MRyjKbfphm/ge/9rdVNTN9aeE190LCrGiDI41OITEPq27pl3UavoYM2e6TEf1j8qLgZRmZb+cdf5qbE5uOyig1nlclRGX8eUwQTJWMrJaLJnSLidLHiRL8yHSRvnH9tWa10HMUe/KmTkusAvdfxiMdfOsgyA8HwyXKPljrg/MDOzu+PSsYa+w==
-    ND_LASTFM_SECRET: AgCa1zBHgJ7H5yRJqK6HE0c/x7mxS0PlENPJ6gryJyciqezSznr0ONAVDAtvVkWvbZrhpvTcI1SPaiqRUIF8x+7kWTYROnnCXlphoX8zMFCaw+LZxv4mC6GI4q9ciUZTRvCMKKlzTVbJIYcUaPh8zH4F0MlyWyWhpTLamkkLiPst+uArxqTw40qtqLpA9rZoshSlIXq84eeZmUuyMEhGXRspjwI7HINAaF3TfsSsuuHsqsKjbY2atwfOmeyddWh2GT1r1OtjchOq43thHHLqXH3KkKhprUK0m0b9unna9wO8Q274CeXpXME0+/qH3A14nmsYtFeyPRTuBM3iHoHR4gMaSIPcm6xZNYxSkEKglxWJztOJ6JvSsepgd37RQpDmzaZe67/9gJKTHL3pe+Id7+TQVeWqCUMQFywYE3VqJdGJWF60jc28pkCQPnbuUNgsfQySY+s65RwEqfJwJrM7orfS66vK8FDlJtH4e3bBVvZfUKjoH5mc6H9mNhJeYMAWG+RMsRvC8WRnOf9n+GTSm0j6MZ7IPpKn0xCrUaAuTAhQrSJ94exqLTGQ99RNN5RHuwMshdwr3uK3fpo33Y3xL6mFTW+GNDhRpyjlh1c6mRrMtWIfkUvWlpfFA15JTc9yR0lupZjIb3dUPrNCWQJh5J3f8k9wfiR8oQLvQesKh90zM2OYcqodwxPysRfMhxrZLmVytjCoFEcjXJy8u1PD9oTw1KaSvk5m4hUqLirNNyZ8ig==
-    ND_SPOTIFY_ID: AgBEOjEOVPO7L1Yg/5b7Lp47Lo/ZDALMypfaKoGlt6dPUVfUd7D3Ex9fdydNdcOZroRgYKi4j8gOYg+5JMJVw/TzGVlXiuhCBWYga9deeboAatgr4EuldvUgApfwKBFdoMLsOtGnSI+UoAX4pXyJXTCsjqnxtN+HfYmBu5oxbOkm65ztoiodwpjFVOBsgsCgCVwt6uI6H37ryKxxZ2nPS+X38VbMJAyo6dvD3jLB+wyUB1hemmdTyg/VbnBFaIMX+Ms6iUmLMggfOq0P3oLvc4sL5LSaZ5ZCIcwDrNvFc19xR7c265XgIUGiD2HyT+lqIoNq6V6duLQkQynRsbh3fS2KLGui+CiIskajM6RqtjncsutVEXPSsuRxUD1WU9IB6UwrNuuiJXnLgUhB8/av9ERDN+Un3cxNW78ytXClIxTCyB8Ndr6A6urwJIBogAo/bL8rNg7TlKqUnzpYa/GYQ6lBIN2SL9UTRyBfi8sE664ERs8nZkPlf/BQQBKQxJpYeSjTVDGpDNhuSE1LdLK6VM+vDueFlJ38d/YAz0gaV2Km1eWmfm4dTpG0zjZoFQbfRjGFIZYhLaju/cBpSW5qb7IoVN8TdQzJ6YFLy2lDEWfTqEcmu/Lbp1cvjU1MYeQ48x4eRK+SsLD+7ds4tiQLwhi52nC+uLi4YcqQayF2m/pSoMOOqarhP5g0ZRG2tcgJnynvCzAzks2zkGWyA+3FPg75eEc49IueaNTE6jT+/4fgww==
-    ND_SPOTIFY_SECRET: AgBpGvv+LZdybstbYW39F5dY2YZHqTVL80XJ8oVLyuvCljamzABlpYaoVw58OygdGRuyDJCrOPpyCxpDRx1MoQV4+qwE/a4K6JLjlFXCg6yR1vySHjO7l7zwJtWhf71wmvQ5WSrs/l54BbWh7Vfz18Dr4kuoNgk6F394XdKBZv3jhawQP94b4sykHhmSkXoqoPAESxLkPJ8M3rhxmdnerdRA3y4Y7m1fXy7yXqw1ojr0w2850hubK6YYxpcCqDwGi97//V/tWzz+Z7XZe8cf8cQ4+KvxpZQUpOfeCE8mVVaPAuHCDDXk9y8ObsUbwlcLstds+GFGfo16Llb2mwoTfifSrby1nbPEKAvGqa7eQavGpaeFEP9t5SftASGWeKflzYveCa9lkdrH5/8ZsieWrVJJv2K0YemaD3QqwL3ymyzehWzG7O/6bK98RkxdHGHFCH3HzFl+rHzQTPSLKof5YQU6+cMwbr3TCNTFnQVJ7O9+AFrOQVYn2/3fC3ZXq5SDObRYJYQRw5bGQcJPGZFC8uUzhT9KI+8gAVJYSwtTwNrZzEgCHviUlg6mKyV0I+7KdC8ghfl4GmjBIwscH2Ur2h20NDGQ1z22RsqSkxaYZBtLzaMLE3jZFMZTEYtjs2NjXSspSWVR2eplBmXez/kdkUOV5r9x8Z6vs3FEDyslzEEsuyutC1OGY7xi4Jiuq6P87y1R7fZttkuTIiUgyz7j9ZaLPu5qs/fjGonU1vvYe8OVVA==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: navidrome-secrets
-      namespace: navidrome
-    type: Opaque
diff --git a/navidrome/route.yaml b/navidrome/route.yaml
new file mode 100644
index 0000000..6de174d
--- /dev/null
+++ b/navidrome/route.yaml
@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: navidrome
+  namespace: navidrome
+spec:
+  parentRefs:
+    - name: shared-edge-gateway
+      namespace: cilium-ingress
+
+  hostnames:
+    - "music.local.gwg313.xyz"
+    - "music.gwg313.xyz"
+    - "music.zerotier.gwg313.xyz"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: navidrome
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-gateway-to-navidrome
+  namespace: navidrome
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      namespace: cilium-ingress
+  to:
+    - group: ""
+      kind: Service
+      name: navidrome
diff --git a/navidrome/virtualservice.yaml b/navidrome/virtualservice.yaml
deleted file mode 100644
index 5609a07..0000000
--- a/navidrome/virtualservice.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: networking.istio.io/v1beta1
-kind: VirtualService
-metadata:
-  name: navidrome
-spec:
-  hosts:
-    - music.local.gwg313.xyz
-    - music.gwg313.xyz
-    - music.zerotier.gwg313.xyz
-  gateways:
-    - music-gateway
-  http:
-    - match:
-        - uri:
-            prefix: /
-      route:
-        - destination:
-            host: navidrome
-            port:
-              number: 80