diff --git a/deploy/apps/kustomization.yaml b/deploy/apps/kustomization.yaml
deleted file mode 100644
index 4da8ab1..0000000
--- a/deploy/apps/kustomization.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - backups
-  - nextcloud
-  - onlyoffice
-  - whiteboard
-generatorOptions:
-  disableNameSuffixHash: true
-
-  
\ No newline at end of file
diff --git a/deploy/apps/backups/.env.d/.gitignore b/deploy/backups/.env.d/.gitignore
similarity index 100%
rename from deploy/apps/backups/.env.d/.gitignore
rename to deploy/backups/.env.d/.gitignore
diff --git a/deploy/apps/backups/.env.d/pbs.env.example b/deploy/backups/.env.d/pbs.env.example
similarity index 100%
rename from deploy/apps/backups/.env.d/pbs.env.example
rename to deploy/backups/.env.d/pbs.env.example
diff --git a/deploy/apps/backups/backup-pbs-cronjob.yaml b/deploy/backups/backup-pbs-cronjob.yaml
similarity index 100%
rename from deploy/apps/backups/backup-pbs-cronjob.yaml
rename to deploy/backups/backup-pbs-cronjob.yaml
diff --git a/deploy/apps/backups/kustomization.yaml b/deploy/backups/kustomization.yaml
similarity index 100%
rename from deploy/apps/backups/kustomization.yaml
rename to deploy/backups/kustomization.yaml
diff --git a/deploy/apps/onlyoffice/.env.d/.gitignore b/deploy/fluxcd/.env.d/.gitignore
similarity index 100%
rename from deploy/apps/onlyoffice/.env.d/.gitignore
rename to deploy/fluxcd/.env.d/.gitignore
diff --git a/deploy/fluxcd/full-stack-sync.yaml b/deploy/fluxcd/full-stack-sync.yaml
new file mode 100644
index 0000000..cd00e10
--- /dev/null
+++ b/deploy/fluxcd/full-stack-sync.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: full-stack-sync
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: cloud-limbosolutions-com
+    namespace: cloud-limbosolutions-com
+  path: deploy/kustomization.yaml
+  prune: true
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops-age
\ No newline at end of file
diff --git a/deploy/fluxcd/git-repo.yaml b/deploy/fluxcd/git-repo.yaml
new file mode 100644
index 0000000..542914b
--- /dev/null
+++ b/deploy/fluxcd/git-repo.yaml
@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: cloud-limbosolutions-com
+spec:
+  interval: 1m0s
+  url: ssh://git@git.limbosolutions.com:2222/marcio.fernandes/nextcloud.git
+  ref:
+    branch: main
+  secretRef:
+    name: flux-repo-ssh-credentials
\ No newline at end of file
diff --git a/deploy/fluxcd/kustomization.yaml b/deploy/fluxcd/kustomization.yaml
new file mode 100644
index 0000000..dab48d8
--- /dev/null
+++ b/deploy/fluxcd/kustomization.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cloud-limbosolutions-com
+resources:
+ - git-repo.yaml
+ - full-stack-sync.yaml
+secretGenerator:
+  - name: flux-repo-ssh-credentials
+    files:
+      - "identity=./.env.d/flux-repo-ssh-key"
+      - "known_hosts=./.env.d/flux-repo-ssh-known_hosts"
+      - "pubkey=./.env.d/flux-repo-ssh-key.pub"
+  - name: flux-sops-age
+    files:
+      - "age.agekey=./.env.d/age.agekey"
+generatorOptions:
+  disableNameSuffixHash: true
\ No newline at end of file
diff --git a/deploy/infra/global/certificate.yaml b/deploy/global/certificate.yaml
similarity index 81%
rename from deploy/infra/global/certificate.yaml
rename to deploy/global/certificate.yaml
index b8f486e..4dc8092 100644
--- a/deploy/infra/global/certificate.yaml
+++ b/deploy/global/certificate.yaml
@@ -2,7 +2,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: cloud-limbosolutions-com-tls
-  namespace: cloud-limbosolutions-com
 spec:
   secretName: cloud-limbosolutions-com-tls
   issuerRef:
@@ -10,4 +9,3 @@ spec:
     kind: ClusterIssuer
   dnsNames:
     - cloud.limbosolutions.com
-  renewBefore: 360h
\ No newline at end of file
diff --git a/deploy/infra/global/kustomization.yaml b/deploy/global/kustomization.yaml
similarity index 78%
rename from deploy/infra/global/kustomization.yaml
rename to deploy/global/kustomization.yaml
index 2514b69..aa823bb 100644
--- a/deploy/infra/global/kustomization.yaml
+++ b/deploy/global/kustomization.yaml
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cloud-limbosolutions-com
 
 resources:
   - ./certificate.yaml
diff --git a/deploy/global/network-policies.yaml b/deploy/global/network-policies.yaml
new file mode 100644
index 0000000..7bd5595
--- /dev/null
+++ b/deploy/global/network-policies.yaml
@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-same-namespace-ingress
+spec:
+  endpointSelector: {}   # All pods in this namespace
+  ingress:
+    - fromEndpoints:
+        - matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - cloud-limbosolutions-com
+
+
diff --git a/deploy/infra/global/network-policies.yaml b/deploy/infra/global/network-policies.yaml
deleted file mode 100644
index 0f96c21..0000000
--- a/deploy/infra/global/network-policies.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-same-namespace-ingress
-spec:
-  endpointSelector: {}   # All pods in this namespace
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: k8s:io.kubernetes.pod.namespace
-              operator: In
-              values:
-                - cloud-limbosolutions-com
-  
----
-
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-traefik-to-nextcloud-ingress
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: nextcloud
-
-  ingress:
-    # -------------------------------------------------------------
-    # Allow Traefik (internal and public) to reach nextcloud web port
-    # -------------------------------------------------------------
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: traefik
-          matchExpressions:
-            - key: k8s:io.kubernetes.pod.namespace
-              operator: In
-              values:
-                - traefik
-                - traefik-public
-      toPorts:
-        - ports:
-            - port: "80"
-    
-              protocol: TCP
-
----
-
-
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-traefik-to-onlyoffice-ingress
-spec:
-  endpointSelector:
-    matchLabels:
-      app: onlyoffice
-
-  ingress:
-    # -------------------------------------------------------------
-    # Allow Traefik (internal and public) to reach onlyoffice web port
-    # -------------------------------------------------------------
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: traefik
-          matchExpressions:
-            - key: k8s:io.kubernetes.pod.namespace
-              operator: In
-              values:
-                - traefik
-                - traefik-public
-      toPorts:
-        - ports:
-            - port: "80"
-    
-              protocol: TCP
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-traefik-to-whiteboard-ingress
-spec:
-  endpointSelector:
-    matchLabels:
-      app: nextcloud-whiteboard
-
-  ingress:
-    # -------------------------------------------------------------
-    # Allow Traefik (internal and public) to reach whiteboard ws
-    # -------------------------------------------------------------
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: traefik
-          matchExpressions:
-            - key: k8s:io.kubernetes.pod.namespace
-              operator: In
-              values:
-                - traefik
-                - traefik-public
-      toPorts:
-        - ports:
-            - port: "3002"
-    
-              protocol: TCP
\ No newline at end of file
diff --git a/deploy/infra/nextcloud/kustomization.yaml b/deploy/infra/nextcloud/kustomization.yaml
deleted file mode 100644
index c10dcab..0000000
--- a/deploy/infra/nextcloud/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cloud-limbosolutions-com
-
-resources:
-  - ./ingress-web-public.yaml
-  - ./ingress-web.yaml
-
diff --git a/deploy/infra/onlyoffice/kustomization.yaml b/deploy/infra/onlyoffice/kustomization.yaml
deleted file mode 100644
index ded9e50..0000000
--- a/deploy/infra/onlyoffice/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cloud-limbosolutions-com
-
-resources:
-  - ./ingress.yaml
-  - ./middlewares.yaml
-
diff --git a/deploy/infra/whiteboard/kustomization.yaml b/deploy/infra/whiteboard/kustomization.yaml
deleted file mode 100644
index 7cc028a..0000000
--- a/deploy/infra/whiteboard/kustomization.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cloud-limbosolutions-com
-
-resources:
-  - ./middlewares.yaml
-
diff --git a/deploy/infra/kustomization.yaml b/deploy/kustomization.yaml
similarity index 58%
rename from deploy/infra/kustomization.yaml
rename to deploy/kustomization.yaml
index 83a847e..0c0db78 100644
--- a/deploy/infra/kustomization.yaml
+++ b/deploy/kustomization.yaml
@@ -1,10 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: cloud-limbosolutions-com
 resources:
   - global
-  - nextcloud
-  - onlyoffice
-  - whiteboard
+  #- nextcloud
+  #- backups
+  #- onlyoffice
+  #- whiteboard
 generatorOptions:
   disableNameSuffixHash: true
 
diff --git a/deploy/apps/nextcloud/.env.d/.gitignore b/deploy/nextcloud/.env.d/.gitignore
similarity index 100%
rename from deploy/apps/nextcloud/.env.d/.gitignore
rename to deploy/nextcloud/.env.d/.gitignore
diff --git a/deploy/apps/nextcloud/.env.d/nextcloud-mariadb.env.example b/deploy/nextcloud/.env.d/nextcloud-mariadb.env.example
similarity index 100%
rename from deploy/apps/nextcloud/.env.d/nextcloud-mariadb.env.example
rename to deploy/nextcloud/.env.d/nextcloud-mariadb.env.example
diff --git a/deploy/infra/nextcloud/ingress-web-public.yaml b/deploy/nextcloud/ingress-web-public.yaml
similarity index 100%
rename from deploy/infra/nextcloud/ingress-web-public.yaml
rename to deploy/nextcloud/ingress-web-public.yaml
diff --git a/deploy/infra/nextcloud/ingress-web.yaml b/deploy/nextcloud/ingress-web.yaml
similarity index 100%
rename from deploy/infra/nextcloud/ingress-web.yaml
rename to deploy/nextcloud/ingress-web.yaml
diff --git a/deploy/apps/nextcloud/kustomization.yaml b/deploy/nextcloud/kustomization.yaml
similarity index 68%
rename from deploy/apps/nextcloud/kustomization.yaml
rename to deploy/nextcloud/kustomization.yaml
index 93db763..f7de7df 100644
--- a/deploy/apps/nextcloud/kustomization.yaml
+++ b/deploy/nextcloud/kustomization.yaml
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cloud-limbosolutions-com
 
 generatorOptions:
   disableNameSuffixHash: true
@@ -12,6 +11,9 @@ secretGenerator:
     - ./.env.d/nextcloud-mariadb.env
 
 resources:
-  - ./storage-limbosolutions-com
+  - storage-limbosolutions-com
   - ./mariadb-deploy.yaml
+  - ./ingress-web-public.yaml
+  - ./ingress-web.yaml
+  - ./network-policies.yaml
 
diff --git a/deploy/apps/nextcloud/mariadb-deploy.yaml b/deploy/nextcloud/mariadb-deploy.yaml
similarity index 100%
rename from deploy/apps/nextcloud/mariadb-deploy.yaml
rename to deploy/nextcloud/mariadb-deploy.yaml
diff --git a/deploy/infra/nextcloud/middlewares.yaml b/deploy/nextcloud/middlewares.yaml
similarity index 100%
rename from deploy/infra/nextcloud/middlewares.yaml
rename to deploy/nextcloud/middlewares.yaml
diff --git a/deploy/nextcloud/network-policies.yaml b/deploy/nextcloud/network-policies.yaml
new file mode 100644
index 0000000..39b7041
--- /dev/null
+++ b/deploy/nextcloud/network-policies.yaml
@@ -0,0 +1,27 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-to-nextcloud-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach nextcloud web port
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "80"
+    
+              protocol: TCP
\ No newline at end of file
diff --git a/deploy/apps/nextcloud/nextcloud-helm-values.yaml b/deploy/nextcloud/nextcloud-helm-values.yaml
similarity index 100%
rename from deploy/apps/nextcloud/nextcloud-helm-values.yaml
rename to deploy/nextcloud/nextcloud-helm-values.yaml
diff --git a/deploy/apps/nextcloud/redis-helm-values.yaml b/deploy/nextcloud/redis-helm-values.yaml
similarity index 100%
rename from deploy/apps/nextcloud/redis-helm-values.yaml
rename to deploy/nextcloud/redis-helm-values.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/kustomization.yaml b/deploy/nextcloud/storage-limbosolutions-com/kustomization.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/kustomization.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/kustomization.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-it-storage.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-it-storage.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-it-storage.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-it-storage.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-gaming.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-gaming.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-gaming.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-gaming.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-music.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-music.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-music.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-music.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-videos.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-videos.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-media-videos.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-media-videos.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf-documents.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf-documents.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf-documents.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf-documents.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf-gallery.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf-gallery.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf-gallery.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf-gallery.yaml
diff --git a/deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf.yaml b/deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf.yaml
similarity index 100%
rename from deploy/apps/nextcloud/storage-limbosolutions-com/nextcloud-mf.yaml
rename to deploy/nextcloud/storage-limbosolutions-com/nextcloud-mf.yaml
diff --git a/deploy/onlyoffice/.env.d/.gitignore b/deploy/onlyoffice/.env.d/.gitignore
new file mode 100644
index 0000000..d29675e
--- /dev/null
+++ b/deploy/onlyoffice/.env.d/.gitignore
@@ -0,0 +1,2 @@
+**
+!.gitignore
\ No newline at end of file
diff --git a/deploy/apps/onlyoffice/deployment.yaml b/deploy/onlyoffice/deployment.yaml
similarity index 100%
rename from deploy/apps/onlyoffice/deployment.yaml
rename to deploy/onlyoffice/deployment.yaml
diff --git a/deploy/onlyoffice/ingress-web-public.yaml b/deploy/onlyoffice/ingress-web-public.yaml
new file mode 100644
index 0000000..202ff63
--- /dev/null
+++ b/deploy/onlyoffice/ingress-web-public.yaml
@@ -0,0 +1,22 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: onlyoffice-web-public
+  annotations:
+    kubernetes.io/ingress.class: traefik-public
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`office.limbosolutions.com`)
+      kind: Rule
+      services:
+        - name: onlyoffice
+          port: 80
+      middlewares:
+          - name: onlyoffice-headers
+          - name: onlyoffice-security-headers
+          - name: rate-limit
+
+  tls:
+    secretName: office-limbosolutions-com-tls
\ No newline at end of file
diff --git a/deploy/infra/onlyoffice/ingress.yaml b/deploy/onlyoffice/ingress-web.yaml
similarity index 90%
rename from deploy/infra/onlyoffice/ingress.yaml
rename to deploy/onlyoffice/ingress-web.yaml
index 713f4fa..bda1a5a 100644
--- a/deploy/infra/onlyoffice/ingress.yaml
+++ b/deploy/onlyoffice/ingress-web.yaml
@@ -1,14 +1,13 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: office-limbosolutions-com
+  name: onlyoffice-web
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/ingress.class: traefik
 spec:
   entryPoints:
     - websecure
-    - public-https
   routes:
     - match: Host(`office.limbosolutions.com`)
       kind: Rule
diff --git a/deploy/apps/onlyoffice/kustomization.yaml b/deploy/onlyoffice/kustomization.yaml
similarity index 76%
rename from deploy/apps/onlyoffice/kustomization.yaml
rename to deploy/onlyoffice/kustomization.yaml
index 4fbb15a..5843e94 100644
--- a/deploy/apps/onlyoffice/kustomization.yaml
+++ b/deploy/onlyoffice/kustomization.yaml
@@ -8,9 +8,11 @@ secretGenerator:
 
 generatorOptions:
   disableNameSuffixHash: true
-namespace: cloud-limbosolutions-com
 
 resources:
   - ./deployment.yaml
   - ./service.yaml
   - ./pvc.yaml
+  - ./middlewares.yaml
+  - ./network-policies.yaml
+  - ./ingress-web-public.yaml
\ No newline at end of file
diff --git a/deploy/infra/onlyoffice/middlewares.yaml b/deploy/onlyoffice/middlewares.yaml
similarity index 100%
rename from deploy/infra/onlyoffice/middlewares.yaml
rename to deploy/onlyoffice/middlewares.yaml
diff --git a/deploy/onlyoffice/network-policies.yaml b/deploy/onlyoffice/network-policies.yaml
new file mode 100644
index 0000000..99f2ab7
--- /dev/null
+++ b/deploy/onlyoffice/network-policies.yaml
@@ -0,0 +1,28 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-to-onlyoffice-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app: onlyoffice
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach onlyoffice web port
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "80"
+    
+              protocol: TCP
+---
\ No newline at end of file
diff --git a/deploy/apps/onlyoffice/pvc.yaml b/deploy/onlyoffice/pvc.yaml
similarity index 100%
rename from deploy/apps/onlyoffice/pvc.yaml
rename to deploy/onlyoffice/pvc.yaml
diff --git a/deploy/apps/onlyoffice/service.yaml b/deploy/onlyoffice/service.yaml
similarity index 100%
rename from deploy/apps/onlyoffice/service.yaml
rename to deploy/onlyoffice/service.yaml
diff --git a/deploy/apps/whiteboard/.env.d/.gitignore b/deploy/whiteboard/.env.d/.gitignore
similarity index 100%
rename from deploy/apps/whiteboard/.env.d/.gitignore
rename to deploy/whiteboard/.env.d/.gitignore
diff --git a/deploy/apps/whiteboard/.env.d/whiteboard.env.example b/deploy/whiteboard/.env.d/whiteboard.env.example
similarity index 100%
rename from deploy/apps/whiteboard/.env.d/whiteboard.env.example
rename to deploy/whiteboard/.env.d/whiteboard.env.example
diff --git a/deploy/apps/whiteboard/deployment.yaml b/deploy/whiteboard/deployment.yaml
similarity index 85%
rename from deploy/apps/whiteboard/deployment.yaml
rename to deploy/whiteboard/deployment.yaml
index 8c6dad7..0ef279d 100644
--- a/deploy/apps/whiteboard/deployment.yaml
+++ b/deploy/whiteboard/deployment.yaml
@@ -1,18 +1,18 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: nextcloud-whiteboard
+  name: whiteboard
   labels:
-    app: nextcloud-whiteboard
+    app: whiteboard
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: nextcloud-whiteboard
+      app: whiteboard
   template:
     metadata:
       labels:
-        app: nextcloud-whiteboard
+        app: whiteboard
     spec:
       containers:
         - name: whiteboard-ws
diff --git a/deploy/whiteboard/ingress-web-public.yaml b/deploy/whiteboard/ingress-web-public.yaml
new file mode 100644
index 0000000..d0d1ad7
--- /dev/null
+++ b/deploy/whiteboard/ingress-web-public.yaml
@@ -0,0 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whiteboard-web-public
+  annotations:
+    kubernetes.io/ingress.class: traefik-public
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: cloud-limbosolutions-com-tls
+    domains:
+      - main: cloud.limbosolutions.com
+
+  routes:
+
+    - match: Host(`cloud.limbosolutions.com`) && PathPrefix(`/whiteboard`)
+      kind: Rule
+      services:
+        - name: whiteboard
+          port: 3002
+      middlewares:
+         - name: nextcloud-security-headers
+         - name: rate-limit
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
+         - name: nextcloud-dav
+         - name: strip-whiteboard
\ No newline at end of file
diff --git a/deploy/whiteboard/ingress-web.yaml b/deploy/whiteboard/ingress-web.yaml
new file mode 100644
index 0000000..1b5af5e
--- /dev/null
+++ b/deploy/whiteboard/ingress-web.yaml
@@ -0,0 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whiteboard-web
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: cloud-limbosolutions-com-tls
+    domains:
+      - main: cloud.limbosolutions.com
+
+  routes:
+
+    - match: Host(`cloud.limbosolutions.com`) && PathPrefix(`/whiteboard`)
+      kind: Rule
+      services:
+        - name: whiteboard
+          port: 3002
+      middlewares:
+         - name: nextcloud-security-headers
+         - name: rate-limit
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
+         - name: nextcloud-dav
+         - name: strip-whiteboard
\ No newline at end of file
diff --git a/deploy/apps/whiteboard/kustomization.yaml b/deploy/whiteboard/kustomization.yaml
similarity index 64%
rename from deploy/apps/whiteboard/kustomization.yaml
rename to deploy/whiteboard/kustomization.yaml
index 78ccafc..e3bb333 100644
--- a/deploy/apps/whiteboard/kustomization.yaml
+++ b/deploy/whiteboard/kustomization.yaml
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 secretGenerator:
-  - name: nextcloud-whiteboard
+  - name: whiteboard
     envs:
       - ./.env.d/whiteboard.env
 
@@ -12,3 +12,7 @@ generatorOptions:
 resources:
   - ./deployment.yaml
   - ./service.yaml
+  - ./middlewares.yaml
+  - ./network-policies.yaml
+  - ./ingress-web-public.yaml
+  - ./ingress-web.yaml
\ No newline at end of file
diff --git a/deploy/infra/whiteboard/middlewares.yaml b/deploy/whiteboard/middlewares.yaml
similarity index 100%
rename from deploy/infra/whiteboard/middlewares.yaml
rename to deploy/whiteboard/middlewares.yaml
diff --git a/deploy/whiteboard/network-policies.yaml b/deploy/whiteboard/network-policies.yaml
new file mode 100644
index 0000000..e5ada30
--- /dev/null
+++ b/deploy/whiteboard/network-policies.yaml
@@ -0,0 +1,27 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-to-whiteboard-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app: nextcloud-whiteboard
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach whiteboard ws
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "3002"
+    
+              protocol: TCP
\ No newline at end of file
diff --git a/deploy/apps/whiteboard/service.yaml b/deploy/whiteboard/service.yaml
similarity index 70%
rename from deploy/apps/whiteboard/service.yaml
rename to deploy/whiteboard/service.yaml
index 411fd20..0a554a9 100644
--- a/deploy/apps/whiteboard/service.yaml
+++ b/deploy/whiteboard/service.yaml
@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: nextcloud-whiteboard
+  name: whiteboard
 spec:
   selector:
-    app: nextcloud-whiteboard
+    app: whiteboard
   ports:
     - name: ws
       port: 3002