diff --git a/nix/flake/kubenix/media.nix b/nix/flake/kubenix/media.nix
index eb1d395..ae2328b 100644
--- a/nix/flake/kubenix/media.nix
+++ b/nix/flake/kubenix/media.nix
@@ -686,113 +686,184 @@
         };
       };
 
-      #   transmission.spec = {
-      #     ingressClassName = "traefik";
+      transmission = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
 
-      #     rules = [{
-      #       host = "transmission.kun.is";
+        spec = {
+          ingressClassName = "traefik";
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+          rules = [{
+            host = "transmission.kun.is";
 
-      #         backend.service = {
-      #           name = "transmission-web";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
 
-      #   jellyseerr.spec = {
-      #     ingressClassName = "traefik";
+              backend.service = {
+                name = "transmission-web";
+                port.number = 80;
+              };
+            }];
+          }];
 
-      #     rules = [{
-      #       host = "jellyseerr.kun.is";
+          tls = [{
+            secretName = "transmission-tls";
+            hosts = [ "transmission.kun.is" ];
+          }];
+        };
+      };
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+      jellyseerr = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
 
-      #         backend.service = {
-      #           name = "jellyseerr";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+        spec = {
+          ingressClassName = "traefik";
 
-      #   radarr.spec = {
-      #     ingressClassName = "traefik";
+          rules = [{
+            host = "jellyseerr.kun.is";
 
-      #     rules = [{
-      #       host = "radarr.kun.is";
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+              backend.service = {
+                name = "jellyseerr";
+                port.number = 80;
+              };
+            }];
+          }];
 
-      #         backend.service = {
-      #           name = "radarr";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+          tls = [{
+            secretName = "jellyseerr-tls";
+            hosts = [ "jellyseerr.kun.is" ];
+          }];
+        };
+      };
 
-      #   prowlarr.spec = {
-      #     ingressClassName = "traefik";
+      radarr = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
 
-      #     rules = [{
-      #       host = "prowlarr.kun.is";
+        spec = {
+          ingressClassName = "traefik";
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+          rules = [{
+            host = "radarr.kun.is";
 
-      #         backend.service = {
-      #           name = "prowlarr";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
 
-      #   sonarr.spec = {
-      #     ingressClassName = "traefik";
+              backend.service = {
+                name = "radarr";
+                port.number = 80;
+              };
+            }];
+          }];
 
-      #     rules = [{
-      #       host = "sonarr.kun.is";
+          tls = [{
+            secretName = "radarr-tls";
+            hosts = [ "radarr.kun.is" ];
+          }];
+        };
+      };
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+      prowlarr = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
 
-      #         backend.service = {
-      #           name = "sonarr";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+        spec = {
+          ingressClassName = "traefik";
 
-      #   bazarr.spec = {
-      #     ingressClassName = "traefik";
+          rules = [{
+            host = "prowlarr.kun.is";
 
-      #     rules = [{
-      #       host = "bazarr.kun.is";
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
 
-      #       http.paths = [{
-      #         path = "/";
-      #         pathType = "Prefix";
+              backend.service = {
+                name = "prowlarr";
+                port.number = 80;
+              };
+            }];
+          }];
 
-      #         backend.service = {
-      #           name = "bazarr";
-      #           port.number = 80;
-      #         };
-      #       }];
-      #     }];
-      #   };
+          tls = [{
+            secretName = "prowlarr-tls";
+            hosts = [ "prowlarr.kun.is" ];
+          }];
+        };
+      };
+
+      sonarr = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
+
+        spec = {
+          ingressClassName = "traefik";
+
+          rules = [{
+            host = "sonarr.kun.is";
+
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
+
+              backend.service = {
+                name = "sonarr";
+                port.number = 80;
+              };
+            }];
+          }];
+
+          tls = [{
+            secretName = "sonarr-tls";
+            hosts = [ "sonarr.kun.is" ];
+          }];
+        };
+      };
+
+      bazarr = {
+        metadata.annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt";
+          "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+        };
+        spec = {
+          ingressClassName = "traefik";
+
+          rules = [{
+            host = "bazarr.kun.is";
+
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
+
+              backend.service = {
+                name = "bazarr";
+                port.number = 80;
+              };
+            }];
+          }];
+
+          tls = [{
+            secretName = "bazarr-tls";
+            hosts = [ "bazarr.kun.is" ];
+          }];
+        };
+      };
     };
   };
 }
diff --git a/nix/flake/kubenix/pihole.nix b/nix/flake/kubenix/pihole.nix
index 43b4093..3cba4ce 100644
--- a/nix/flake/kubenix/pihole.nix
+++ b/nix/flake/kubenix/pihole.nix
@@ -131,22 +131,34 @@
       };
     };
 
-    # ingresses.pihole-web.spec = {
-    #   ingressClassName = "traefik";
+    ingresses.pihole-web = {
+      metadata.annotations = {
+        "cert-manager.io/cluster-issuer" = "letsencrypt";
+        "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+      };
 
-    #   rules = [{
-    #     host = "pihole.kun.is";
+      spec = {
+        ingressClassName = "traefik";
 
-    #     http.paths = [{
-    #       path = "/";
-    #       pathType = "Prefix";
+        rules = [{
+          host = "pihole.kun.is";
 
-    #       backend.service = {
-    #         name = "pihole-web";
-    #         port.number = 80;
-    #       };
-    #     }];
-    #   }];
-    # };
+          http.paths = [{
+            path = "/";
+            pathType = "Prefix";
+
+            backend.service = {
+              name = "pihole-web";
+              port.number = 80;
+            };
+          }];
+        }];
+
+        tls = [{
+          secretName = "pihole-tls";
+          hosts = [ "pihole.kun.is" ];
+        }];
+      };
+    };
   };
 }
diff --git a/nix/flake/kubenix/syncthing.nix b/nix/flake/kubenix/syncthing.nix
index 013a76e..ff2b8e5 100644
--- a/nix/flake/kubenix/syncthing.nix
+++ b/nix/flake/kubenix/syncthing.nix
@@ -79,22 +79,34 @@
       }];
     };
 
-    # ingresses.syncthing.spec = {
-    #   ingressClassName = "traefik";
+    ingresses.syncthing = {
+      metadata.annotations = {
+        "cert-manager.io/cluster-issuer" = "letsencrypt";
+        "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
+      };
 
-    #   rules = [{
-    #     host = "sync.kun.is";
+      spec = {
+        ingressClassName = "traefik";
 
-    #     http.paths = [{
-    #       path = "/";
-    #       pathType = "Prefix";
+        rules = [{
+          host = "sync.kun.is";
 
-    #       backend.service = {
-    #         name = "syncthing";
-    #         port.number = 80;
-    #       };
-    #     }];
-    #   }];
-    # };
+          http.paths = [{
+            path = "/";
+            pathType = "Prefix";
+
+            backend.service = {
+              name = "syncthing";
+              port.number = 80;
+            };
+          }];
+        }];
+
+        tls = [{
+          secretName = "syncthing-tls";
+          hosts = [ "sync.kun.is" ];
+        }];
+      };
+    };
   };
 }