diff --git a/home-apps/ext-syncthing.yaml b/home-apps/ext-syncthing.yaml
new file mode 100644
index 0000000..4c35376
--- /dev/null
+++ b/home-apps/ext-syncthing.yaml
@@ -0,0 +1,82 @@
+# Template for Exposing External Services (Outside K8s)
+#
+# Use this template when you have services running on your local network
+# (e.g., http://192.168.1.4:3031) and want to expose them with:
+# - A custom domain (e.g., myapp.junv.cc)
+# - Automatic HTTPS certificate from Let's Encrypt
+# - Through your existing NGINX Ingress Controller
+#
+# HOW TO USE:
+# 1. Copy this template
+# 2. Replace ALL_CAPS placeholders with your values
+# 3. Save as home-apps/up.yaml
+# 4. Apply: kubectl apply -f home-apps/up.yaml
+#
+# EXAMPLE:
+# Service: http://192.168.1.4:3031 → https://myapp.junv.cc
+#
+---
+# Service without selector (no pods, points to external endpoint)
+apiVersion: v1
+kind: Service
+metadata:
+  name: syncthing  # e.g., home-assistant, grafana-external
+  namespace: home-apps
+spec:
+  ports:
+  - name: http
+    port: 80  # Port exposed within cluster
+    targetPort: 8384  # e.g., 3031, 8080, 9090
+    protocol: TCP
+---
+# Manual EndpointSlice pointing to external IP
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: syncthing  # MUST match Service name exactly
+  namespace: home-apps
+  labels:
+    kubernetes.io/service-name: syncthing  # Required: links EndpointSlice to Service
+addressType: IPv4
+endpoints:
+  - addresses:
+      - 192.168.1.4  # e.g., 192.168.1.4
+ports:
+  - name: http  # Should match Service port name
+    port: 8384  # e.g., 3031
+    protocol: TCP
+
+---
+# Ingress for all other paths (requires authentication)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: syncthing-ingress
+  namespace: home-apps
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    # nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    # nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
+    # Optional: Proxy settings for specific backends
+    # nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    # nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    # nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    # Optional: Websocket support (for apps like Home Assistant)
+    # nginx.ingress.kubernetes.io/websocket-services: "up"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - syncthing.junv.cc
+    secretName: syncthing-tls
+  rules:
+  - host: syncthing.junv.cc
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: syncthing
+            port:
+              number: 80