diff --git a/apply.sh b/apply.sh
index f5168e6..6015963 100755
--- a/apply.sh
+++ b/apply.sh
@@ -179,6 +179,7 @@ kubectl -n media create secret generic minio --from-literal=AWS_ENDPOINTS=https:
 s3://bucket-name@ap-southeast-2/
 
 # helm
+kubectl -n db create secret generic minio-credentials --from-literal=root-password="xxx" --from-literal=root-user=junv
 
 helm upgrade --install minio -n db -f minio-values.yaml bitnami/minio --set accessKey.password="TODO" \
   --set secretKey.password="TODO"
diff --git a/argocd-values.yaml b/argocd-values.yaml
index 8a096e0..18032f4 100644
--- a/argocd-values.yaml
+++ b/argocd-values.yaml
@@ -23,8 +23,8 @@ server:
       kubernetes.io/tls-acme: "true"
       cert-manager.io/cluster-issuer: "letsencrypt-prod"
       nginx.ingress.kubernetes.io/proxy-body-size: 102400m
-      # nginx.ingress.kubernetes.io/auth-url: "https://id.junv.me/oauth2/auth"
-      # nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.me/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
+      nginx.ingress.kubernetes.io/auth-url: "https://id.junv.me/oauth2/auth"
+      nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.me/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
     hosts: ["argocd.junv.me"]
     tls:
     - hosts:
diff --git a/media/pihole.yaml b/media/pihole.yaml
index 33c68b2..f55c9ff 100644
--- a/media/pihole.yaml
+++ b/media/pihole.yaml
@@ -5,6 +5,7 @@ metadata:
   labels:
     app: pihole
 spec:
+  revisionHistoryLimit: 2
   replicas: 1
   selector:
     matchLabels:
diff --git a/minio-pv.yaml b/minio/minio-pv.yaml
similarity index 100%
rename from minio-pv.yaml
rename to minio/minio-pv.yaml
diff --git a/minio-values.yaml b/minio/minio-values.yaml
similarity index 94%
rename from minio-values.yaml
rename to minio/minio-values.yaml
index d75ae5c..e7eb1a7 100644
--- a/minio-values.yaml
+++ b/minio/minio-values.yaml
@@ -6,6 +6,9 @@ volumePermissions:
 # securityContext:
 #   fsGroup: 1000
 #   runAsUser: 1000
+
+auth:
+  existingSecret: minio-credentials
 metrics:
   serviceMonitor:
     enabled: true