{
  kubernetes.resources = {
    services.esrom.spec = {
      type = "ExternalName";
      externalName = "esrom.dmz";

      ports.web = {
        port = 80;
        targetPort = 80;
      };
    };

    ingresses.esrom = {
      metadata.annotations."cert-manager.io/cluster-issuer" = "letsencrypt";

      spec = {
        ingressClassName = "traefik";

        rules = [{
          host = "esrom.kun.is";

          http.paths = [{
            path = "/";
            pathType = "Prefix";

            backend.service = {
              name = "esrom";
              port.name = "web";
            };
          }];
        }];

        tls = [{
          secretName = "esrom-tls";
          hosts = [ "esrom.kun.is" ];
        }];
      };
    };
  };
}