diff --git a/adhoc-config/badges-tunnel.yaml b/adhoc-config/badges-tunnel.yaml
new file mode 100644
index 0000000..534a6db
--- /dev/null
+++ b/adhoc-config/badges-tunnel.yaml
@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: badges-cloudflared
+  name: badges-cloudflared-deployment
+  namespace: apps
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      pod: badges-cloudflared
+  template:
+    metadata:
+      labels:
+        pod: badges-cloudflared
+    spec:
+      containers:
+      - command:
+        - cloudflared
+        - tunnel
+        # In a k8s environment, the metrics server needs to listen outside the pod it runs on.
+        # The address 0.0.0.0:2000 allows any pod in the namespace.
+        - --metrics
+        - 0.0.0.0:2000
+        - run
+        args:
+        - --token
+        - eyJhIjoiZDM5YjVhY2E0MzkxNjQ2MDJjMDFmN2FmMmE1OGQ0YmYiLCJ0IjoiOTAxOWE2NWItMWVkMS00M2IzLWI1ZjEtMmI2YzhkNjk4M2UxIiwicyI6Ik5HSXhNRFZoTkRRdFpEUmhNeTAwWXpZNUxUa3lOVEl0TURFNFlUTTNNekk1T1dRMyJ9
+        image: cloudflare/cloudflared:latest
+        name: badges-cloudflared
+        livenessProbe:
+          httpGet:
+          # Badges-cloudflared has a /ready endpoint which returns 200 if and only if
+          # it has an active connection to the edge.
+            path: /ready
+            port: 2000
+          failureThreshold: 1
+          initialDelaySeconds: 10
+          periodSeconds: 10
diff --git a/home-apps/home-proxy.yaml b/home-apps/home-proxy.yaml
index b980a36..2b1e94c 100644
--- a/home-apps/home-proxy.yaml
+++ b/home-apps/home-proxy.yaml
@@ -266,3 +266,112 @@ spec:
             name: home-proxy
             port:
               number: 8082
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plex-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  tls:
+  - hosts:
+    - plex.home.junv.cc
+    secretName: plex-home-tls
+  rules:
+  - host: plex.home.junv.cc
+    http:
+      paths:
+      - pathType: Prefix
+        path: /
+        backend:
+          service:
+            name: home-proxy
+            port:
+              number: 8082
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nas-home-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: 1024000m
+spec:
+  tls:
+  - hosts:
+    - nas.home.junv.cc
+    secretName: nas-home-tls
+  rules:
+  - host: nas.home.junv.cc
+    http:
+      paths:
+      - backend:
+          service:
+            name: home-proxy
+            port:
+              number: 8081
+        path: /
+        pathType: Prefix
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-home-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  tls:
+  - hosts:
+    - jellyfin.home.junv.cc
+    secretName: jellyfin-home-tls
+  rules:
+  - host: jellyfin.home.junv.cc
+    http:
+      paths:
+      - backend:
+          service:
+            name: home-proxy
+            port:
+              number: 8080
+        path: /
+        pathType: Prefix
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vm-home-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+spec:
+  tls:
+  - hosts:
+    - vm.home.junv.cc
+    secretName: vm-home-tls
+  rules:
+  - host: vm.home.junv.cc
+    http:
+      paths:
+      - backend:
+          service:
+            name: home-proxy
+            port:
+              number: 8083
+        path: /
+        pathType: Prefix