diff --git a/core/storage.tf b/core/storage.tf
deleted file mode 100644
index e69de29..0000000
diff --git a/core/testing_new_storage.yaml b/core/testing_new_storage.yaml
deleted file mode 100644
index 41ffa5c..0000000
--- a/core/testing_new_storage.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx-deployment
-  labels:
-    app: nginx
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-        - name: nginx
-          image: nginx:1.14.2
-          ports:
-            - containerPort: 80
-          
-          
-          volumeMounts:
-            - name: data
-              mountPath: /hello
-
-      volumes:
-        - name: data
-          hostPath:
-            path: /data/kubernetes/degoog/degoog-data-pvc
-            type: DirectoryOrCreate
-
diff --git a/infrastructure/.tool-versions b/infrastructure/.tool-versions
new file mode 100644
index 0000000..555eb74
--- /dev/null
+++ b/infrastructure/.tool-versions
@@ -0,0 +1 @@
+terraform 1.16.5
diff --git a/infrastructure/deployment.tf b/infrastructure/deployment.tf
index 584c571..638a8e9 100644
--- a/infrastructure/deployment.tf
+++ b/infrastructure/deployment.tf
@@ -40,6 +40,83 @@ resource "kubernetes_service_v1" "automatic_service" {
 
 }
 
+resource "kubernetes_ingress_v1" "automatic_ingress" {
+  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
+  metadata {
+    name      = "${each.key}-ingress"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    annotations = {
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+    }
+  }
+
+  spec {
+    ingress_class_name = "traefik"
+    # Dynamic TLS configuration for cert-manager
+    tls {
+      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
+      secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
+    }
+
+    rule {
+      host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
+      http {
+        path {
+          path = "/"
+          backend {
+            service {
+              name = "${each.key}-svc"
+              port {
+                number = each.value.service_port[0] #selecting the first of the list
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
+  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
+  metadata {
+    name      = "${each.key}-ingress-legacy"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    annotations = {
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+    }
+  }
+
+  spec {
+    ingress_class_name = "traefik"
+    # Dynamic TLS configuration for cert-manager
+    tls {
+      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
+      secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
+    }
+
+    rule {
+      host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
+      http {
+        path {
+          path = "/"
+          backend {
+            service {
+              name = "${each.key}-svc"
+              port {
+                number = each.value.service_port[0] #selecting the first of the list
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
 
 resource "kubernetes_deployment_v1" "automatic" {
   for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
diff --git a/infrastructure/module.tf b/infrastructure/module.tf
index 4fc2685..5c174fa 100644
--- a/infrastructure/module.tf
+++ b/infrastructure/module.tf
@@ -24,6 +24,7 @@ provider "bitwarden-secrets" {
 variable "kubernetes" {
   type = map(object({
     name  = optional(string)
+    docker = optional(bool)
     image = string
     pvc = optional(map(object({
       name                 = optional(string)
@@ -56,6 +57,8 @@ variable "kubernetes" {
     service_type           = optional(string, "ClusterIP")
     service_name           = optional(string)
     domain_name            = optional(string)
+    legacy_domain          = optional(bool, false)
+    exposed                = optional(bool, true)
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)
diff --git a/reverse-proxy/module.tf b/reverse-proxy/module.tf
deleted file mode 100644
index ed3b3f1..0000000
--- a/reverse-proxy/module.tf
+++ /dev/null
@@ -1,83 +0,0 @@
-terraform {
-  required_version = "> 0.8.0"
-}
-
-provider "kubernetes" {
-  config_path = "~/.kube/config"
-}
-
-variable "shunt_kubernetes" {
-  type    = bool
-  default = true
-}
-
-variable "nginx_sites" {
-  type = map(object({
-    service                 = string
-    docker_service          = optional(string)
-    enabled                 = optional(bool, true)
-    proxy_cache             = optional(bool, false)
-    extra-value             = optional(string, "")
-    extra-value-location    = optional(string, "")
-    http2_bool              = optional(bool, false)
-    proxy_pass_https        = optional(bool, false)
-    authentication_required = optional(bool, false)
-    redirect_to_https_bool  = optional(bool, true)
-    listen_port_80_bool     = optional(bool, false)
-    geoip_blocking          = optional(bool, false)
-    geoip_allow             = optional(list(string), ["FR", "GB"])
-    redirect_to_root_domain = optional(bool, true)
-  }))
-
-}
-
-resource "kubernetes_config_map" "automatic-configmap" {
-  #avoiding this to create if the shunt_kubernetes is on 
-  count = var.shunt_kubernetes ? 0 : 1
-  metadata {
-    name      = "sites-terraform"
-    namespace = "reverse-proxy"
-    annotations = {
-      "reloader.stakater.com/match" : "true",
-    }
-  }
-
-  data = {
-    for key, value in var.nginx_sites :
-    "${key}.conf" => templatefile("nginx_config.tftpl", {
-      name_site               = key
-      name_service            = value.service
-      proxy_cache             = value.proxy_cache
-      extra-value             = value.extra-value
-      extra-value-location    = value.extra-value-location
-      http2_bool              = value.http2_bool
-      proxy_pass_https        = value.proxy_pass_https
-      authentication_required = value.authentication_required
-      redirect_to_https_bool  = value.redirect_to_https_bool
-      listen_port_80_bool     = value.listen_port_80_bool
-      geoip_blocking          = value.geoip_blocking
-      geoip_allow             = value.geoip_allow
-      redirect_to_root_domain = value.redirect_to_root_domain
-    }) if value.enabled == true
-  }
-
-}
-
-resource "local_file" "nginx_configs" {
-  for_each = { for key, value in var.nginx_sites : key => value if value.enabled == true && value.docker_service != null }
-
-  filename = "/data/kubernetes/reverse-proxy/reverse-proxy-sites/${each.key}.conf"
-  content = templatefile("nginx_config.tftpl", {
-    name_site               = each.key
-    name_service            = each.value.docker_service
-    proxy_cache             = each.value.proxy_cache
-    extra-value             = each.value.extra-value
-    extra-value-location    = each.value.extra-value-location
-    http2_bool              = each.value.http2_bool
-    proxy_pass_https        = each.value.proxy_pass_https
-    authentication_required = each.value.authentication_required
-    redirect_to_https_bool  = each.value.redirect_to_https_bool
-    listen_port_80_bool     = each.value.listen_port_80_bool
-    redirect_to_root_domain = each.value.redirect_to_root_domain
-  })
-}
diff --git a/reverse-proxy/nginx_config.tftpl b/reverse-proxy/nginx_config.tftpl
deleted file mode 100644
index 2a152e8..0000000
--- a/reverse-proxy/nginx_config.tftpl
+++ /dev/null
@@ -1,144 +0,0 @@
-############################################
-#       config file for ${name_site}
-############################################
-
-upstream ${name_site}_backend {
-        server ${name_service};
-        server 1.1.1.1 backup;
-    }
-
-
-server {
-        server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-
-
-%{~ if redirect_to_root_domain~}
-        if ($host = www.${name_site}.tryton.geeraert.eu) {
-                return 301 https://${name_site}.geeraert.eu$request_uri;
-        }
-
-
-        if ($host = ${name_site}.tryton.geeraert.eu) {
-                return 301 https://${name_site}.geeraert.eu$request_uri;
-        }
-
-        %{~ endif ~}
-	%{ if redirect_to_root_domain != true }
-
-        location / {
-                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
-                proxy_set_header    Upgrade     $http_upgrade;
-		proxy_set_header Host $host;
-                ${extra-value-location}
-
-
-        }
-        location /.well-known/acme-challenge/ {
-                root /var/www/certbot;
-        }
-	%{ endif }
-
-	access_log /var/log/nginx/access.log my_custom_format;
-        access_log /var/log/nginx/ip_audit.log ip_audit;
-        access_log /var/log/nginx/backend_debug.log backend_debug;
-	${extra-value}
-        %{~ if http2_bool~}
-        http2 on;
-        ssl_protocols TLSv1.2;
-        %{~ endif ~}
-
-        listen 443 ssl;
-        %{~ if listen_port_80_bool~}
-        listen 80;
-        %{~ endif ~}
-
-        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
-
-
-
-}
-%{~ if redirect_to_https_bool~}
-
-server {
-        if ($host = www.${name_site}.tryton.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-
-
-        if ($host = ${name_site}.tryton.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-        server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu ;
-        listen 80;
-        return 404;
-
-}
-%{~ endif ~}
-
-
-
-
-
-############################################
-#       config file for ${name_site}
-############################################
-
-upstream ${name_site}_backend_root {
-        server ${name_service};
-        server 1.1.1.1 backup;
-    }
-
-server {
-        server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
-
-        location / {
-                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend_root;
-                proxy_set_header    Upgrade     $http_upgrade;
-		proxy_set_header Host $host;
-                ${extra-value-location}
-
-
-        }
-        location /.well-known/acme-challenge/ {
-                root /var/www/certbot;
-        }
-
-
-	access_log /var/log/nginx/access.log my_custom_format;
-        access_log /var/log/nginx/ip_audit.log ip_audit;
-        access_log /var/log/nginx/backend_debug.log backend_debug;
-	${extra-value}
-        %{~ if http2_bool~}
-        http2 on;
-        ssl_protocols TLSv1.2;
-        %{~ endif ~}
-
-        listen 443 ssl;
-        %{~ if listen_port_80_bool~}
-        listen 80;
-        %{~ endif ~}
-
-        ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
-
-
-
-}
-%{~ if redirect_to_https_bool~}
-
-server {
-        if ($host = www.${name_site}.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-
-
-        if ($host = ${name_site}.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-        server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu ;
-        listen 80;
-        return 404;
-
-}
-%{~ endif ~}
diff --git a/reverse-proxy/variables.auto.tfvars b/reverse-proxy/variables.auto.tfvars
deleted file mode 100644
index 7806b6a..0000000
--- a/reverse-proxy/variables.auto.tfvars
+++ /dev/null
@@ -1,433 +0,0 @@
-nginx_sites = {
-  bitwarden = {
-    service                 = "bitwarden-nginx-svc.bitwarden.svc:8080"
-    http2_bool              = true
-    redirect_to_root_domain = false
-  }
-
-  bookstack = {
-    enabled     = false
-    service     = "bookstack-svc.bookstack.svc"
-    proxy_cache = false
-  }
-
-
-  django = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  admin = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  redirect = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  streaming = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  stash = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  simpsons = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  kubernetes = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  cloudmanager = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  podcast = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  django-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  admin-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  redirect-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  streaming-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  stash-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  simpsons-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  kubernetes-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  cloudmanager-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-  podcast-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-  echo = {
-    enabled        = true
-    service        = "echo-svc.echo.svc"
-    docker_service = "echo-svc.echo.svc"
-    proxy_cache    = true
-    http2_bool     = true
-  }
-
-  sonarr = {
-    enabled = false
-
-    service     = "sonarr-svc.servarr.svc:8989"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-
-  nextcloud = {
-    enabled = false
-
-    redirect_to_root_domain = false
-    service                 = "webserver.nextcloud.svc"
-    #service     = "nextcloud-svc.next.svc"
-    proxy_cache = true
-    http2_bool  = true
-    extra-value = <<EOT
-
-
-        location /.well-known/carddav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location /.well-known/caldav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location = /health {
-                default_type text/html;
-                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
-        }
-                        EOT
-  }
-
-
-
-  router = {
-    enabled = false
-
-    service                 = "192.168.88.1"
-    authentication_required = true
-  }
-
-  octoprint = {
-
-    service              = "192.168.0.32:5000"
-    extra-value-location = <<EOT
-    proxy_set_header Host $http_host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
-    
-    # Required for OctoPrint WebSockets to function properly
-    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    
-    client_max_body_size 0;    # Allows large file uploads like gcode
-                EOT
-
-  }
-  onitama = {
-    service = "onitama-svc.onitama.svc:8080"
-    enabled = false
-  }
-
-
-  paperless = {
-    enabled = false
-
-    #service = "webserver.paperless.svc:8000"
-    service = "paperless-svc.paperless.svc:8000"
-  }
-  pihole = {
-    enabled = false
-
-    service = "172.16.0.60:8081"
-    enabled = false
-  }
-
-  prowlarr = {
-    enabled = false
-
-    service     = "prowlarr-svc.servarr.svc:9696"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-  qbittorrent = {
-    enabled     = false
-    service     = "qbittorrent-svc.servarr.svc:8080"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-  radarr = {
-    enabled = false
-
-    service     = "radarr-svc.servarr.svc:7878"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-
-  unifi = {
-    enabled = false
-
-    #    service = "unifi.unifi.svc:8443"
-    service          = "192.168.88.244:8443"
-    proxy_pass_https = true
-  }
-  unifi-inform = {
-    enabled = false
-
-    service = "192.168.88.50:8082"
-  }
-
-
-  immich = {
-    enabled = false
-
-    #service = "immich-server.immich.svc:2283"
-    service              = "immich-svc.immich.svc:2283"
-    geoip_allow          = ["FR", "GB", "NL"]
-    extra-value-location = <<EOT
-       proxy_set_header Connection "upgrade";
-       proxy_set_header X-Real-IP $remote_addr;
-       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-       proxy_set_header X-Forwarded-Proto $scheme;
-       proxy_read_timeout 60000s;
-
-
-    #adding websocket , usefull for reverse proxy
-       proxy_set_header Connection "upgrade";
-       proxy_set_header X-Real-IP $remote_addr;
-       proxy_cache_bypass $http_upgrade;
-    #end of working
-                EOT  
-  }
-
-
-
-  stirling = {
-    enabled              = false
-    service              = "stirling-svc.stirling.svc:8080"
-    extra-value-location = <<EOT
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-#working
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-#end of working
-
-
-
-                EOT
-  }
-
-
-
-  openmediavault = {
-    service = "192.168.88.29"
-  }
-  pihole = {
-    enabled = false
-    service = "web.piholenew.svc"
-  }
-
-  synology = {
-    enabled = true
-    service = "192.168.88.39:5000"
-  }
-
-  gitea = {
-    enabled                 = true
-    service                 = "gitea-svc.gitea.svc:3000"
-    docker_service          = "gitea-svc.gitea.svc:3000"
-    redirect_to_root_domain = false
-  }
-
-  next = {
-    enabled     = false
-    service     = "next-svc.next.svc"
-    proxy_cache = true
-    http2_bool  = true
-    extra-value = <<EOT
-
-
-        location /.well-known/carddav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location /.well-known/caldav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location = /health {
-                default_type text/html;
-                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
-        }
-                        EOT
-  }
-
-
-  stash = {
-    enabled = false
-    service = "stash-svc.stash.svc:9999"
-    #geoip_blocking = false
-    #extra-value= <<EOT
-    #   proxy_protocol on;
-    #EOT
-    extra-value-location = <<EOT
-    #don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
-    #Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
-    #proxy_bind $remote_addr transparent;
-
-##used to be working
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-    #working
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-    #end of working
-    EOT
-
-    geoip_allow = ["FR", "GB", "NL"]
-  }
-  neko = {
-    enabled              = false
-    service              = "neko-svc.neko.svc:8080"
-    http2_bool           = true
-    extra-value-location = <<EOT
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-
-                EOT
-
-  }
-
-
-
-
-  wikijs = {
-    #enabled     = false
-    geoip_blocking = false
-    service        = "wikijs-svc.wikijs.svc:3000"
-    extra-value    = <<EOT
-client_max_body_size 20m;
-        proxy_request_buffering off;
-                EOT
-  }
-
-
-
-
-  tdarr = {
-    enabled              = false
-    service              = "tdarr-svc.servarr.svc:8265"
-    extra-value-location = <<EOT
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-#working
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-#end of working
-
-
-
-                EOT
-
-  }
-
-}
-deny_ip = ["1.2.3.4"]