diff --git a/docs/access.md b/docs/access.md
index 82e4d40..16c7fb3 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -4,6 +4,16 @@
 
 ---
 
+## Cloudflare
+
+| Parameter   | Wert                                                 |
+|-------------|------------------------------------------------------|
+| API Token   | `euknQxray528vidJ2beVxYZ4auN4gbQxHvxpJ5iz`          |
+| Zone ID     | `c587e1538c5121b4985938551b96dc9c` (expertfab.de)    |
+| Berechtigungen | DNS:Edit für Zone expertfab.de                    |
+
+---
+
 ## Proxmox
 
 | Zugang         | Wert                                      |
@@ -49,6 +59,35 @@
 
 ---
 
+## Documenso (Document Signing)
+
+| Zugang             | Wert                                  |
+|--------------------|---------------------------------------|
+| URL                | https://signing.expertfab.de          |
+| Namespace          | `documenso`                           |
+| Image              | docker.io/documenso/documenso:latest  |
+| Database           | Eigene Postgres im Namespace          |
+| StorageClass       | `longhorn-documenso` (Retain)         |
+| Signing-Zertifikat | Self-signed P12, passphrase `documenso`, gültig 10 Jahre |
+| SMTP               | smtprelay.expertfab.de:587 / it-admin@expertfab.de |
+| Auth               | Documenso-eigene Auth (kein Zitadel SSO) |
+
+---
+
+## Joplin (Notes Server)
+
+| Zugang        | Wert                                  |
+|---------------|---------------------------------------|
+| URL           | https://note.expertfab.de             |
+| Namespace     | `joplin`                              |
+| Image         | docker.io/joplin/server:latest        |
+| Database      | Eigene Postgres im Namespace          |
+| StorageClass  | `longhorn-joplin` (Retain)            |
+| SMTP          | smtprelay.expertfab.de:587 / it-admin@expertfab.de |
+| Auth          | Joplin-eigene Auth (kein Zitadel SSO) |
+
+---
+
 ## ERPNext
 
 | Zugang       | Wert                                                              |
@@ -92,6 +131,8 @@
 | ERPNext      | https://www.expertfab.de     | erpnext      |
 | Paperless    | https://docs.expertfab.de    | paperless    |
 | Zitadel SSO  | https://auth.expertfab.de    | zitadel      |
+| Documenso    | https://signing.expertfab.de | documenso    |
+| Joplin       | https://note.expertfab.de    | joplin       |
 | FastAPI      | https://api.expertfab.de     | rabbitmq     |
 | Coworkbase   | https://coworkbase.de        | coworkbase   |
 | Qubicticker  | https://qubicticker.qchief.io| qubicticker  |
diff --git a/k8s/coredns-custom.yaml b/k8s/coredns-custom.yaml
new file mode 100644
index 0000000..3bdf0df
--- /dev/null
+++ b/k8s/coredns-custom.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns-custom
+  namespace: kube-system
+data:
+  expertfab.server: |
+    expertfab.de:53 {
+      hosts {
+        10.42.71.60 auth.expertfab.de
+        10.42.71.60 docs.expertfab.de
+        10.42.71.60 www.expertfab.de
+        10.42.71.60 expertfab.de
+        10.42.71.60 api.expertfab.de
+        10.42.71.60 signing.expertfab.de
+        10.42.71.60 note.expertfab.de
+        fallthrough
+      }
+      forward . 10.42.71.1
+    }
+    coworkbase.de:53 {
+      hosts {
+        10.42.71.60 coworkbase.de
+        10.42.71.60 www.coworkbase.de
+        fallthrough
+      }
+      forward . 10.42.71.1
+    }
diff --git a/k8s/documenso/documenso.yaml b/k8s/documenso/documenso.yaml
new file mode 100644
index 0000000..105c553
--- /dev/null
+++ b/k8s/documenso/documenso.yaml
@@ -0,0 +1,112 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: documenso-env
+  namespace: documenso
+type: Opaque
+stringData:
+  NEXTAUTH_URL: "https://signing.expertfab.de"
+  NEXTAUTH_SECRET: "KB23sNTjQgqLNcH5ySfbCS+W+yK5KU7SigmPOMPPOk0="
+  NEXT_PUBLIC_WEBAPP_URL: "https://signing.expertfab.de"
+  NEXT_PRIVATE_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
+  NEXT_PRIVATE_DIRECT_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
+  NEXT_PRIVATE_ENCRYPTION_KEY: "11d8ecb4ad0ec906f8ba4694ade72f4c8f1764810395c95c7d8ca275fd700ad0"
+  NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: "496a5868e588c1119a9bfaae687167630eb46f5fbee7295177e91ac386b5c927"
+  NEXT_PUBLIC_UPLOAD_TRANSPORT: "database"
+  NEXT_PRIVATE_SMTP_TRANSPORT: "smtp-auth"
+  NEXT_PRIVATE_SMTP_HOST: "smtprelay.expertfab.de"
+  NEXT_PRIVATE_SMTP_PORT: "587"
+  NEXT_PRIVATE_SMTP_SECURE: "false"
+  NEXT_PRIVATE_SMTP_USERNAME: "it-admin@expertfab.de"
+  NEXT_PRIVATE_SMTP_PASSWORD: "Relay22$$"
+  NEXT_PRIVATE_SMTP_FROM_NAME: "ExpertFab Documenso"
+  NEXT_PRIVATE_SMTP_FROM_ADDRESS: "it-admin@expertfab.de"
+  NEXT_PRIVATE_SIGNING_TRANSPORT: "local"
+  NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH: "/opt/documenso/cert.p12"
+  NEXT_PRIVATE_SIGNING_PASSPHRASE: "documenso"
+  PORT: "3000"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: documenso-signing-cert
+  namespace: documenso
+type: Opaque
+data:
+  # Self-signed P12 generated on 2026-05-22, passphrase: documenso
+  cert.p12: MIIR1gIBAzCCEYwGCSqGSIb3DQEHAaCCEX0EghF5MIIRdTCCBzIGCSqGSIb3DQEHBqCCByMwggcfAgEAMIIHGAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAjxKAuTQvIqvQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEJbg2Sde5sYZeni+eon3qliAggawUT4QJaqIdLMR0kKAZG2ky07IPDtcP17hIJdXonCTXHrciHFnSv2vFYvKG7l7Q65JtMzCgYXIKfKv/IDtqM4Zbt/LAaQjA55xjrgJ9wP0CWNq/HNbdqZrXEQjWjsikoxpcIyoh/ath5/PKDl5MvP9ZJXvoEQ5LD3w8MfcHKR4GnGxcyz72C6Y+uKbvJHBlM+96d03N6b4PvyIgEyuiP23rFzNSB7F7DJlCnPGrjr3Frajw6aBPB4rIHp4KFyX6Kja4NHUWMFHSecL8redKmrTAZEUbYwoU7FZ/dm3RRrcn4arH/oeFXLm8X0+jhr6Fk+SMkZRufW96qSiIYd9F0yJejyLttUhwrWWnJ8GhWsH5GUnl+AeNXkBMDF9zw9F0eNwXx3utdyV7yPIWFfQtrC+Y3BToLR78FlRoQV0dVT1vU1Rxo8wqskwshAi2WxrKnNP/bW+p3BJlXDUFxU5qUGoV6DIDKIc07RjN4h8W/Gz3xcvNRdl+2418pEQr9+Qlff30xITYYUxfZxvwwDLYHrBkbR6u2OB2lm/kEPfIrQrYS3KaWeqdDHbkqrLFYmyPfhYLRbSvZHOzUjI+r7FiQtEXvrKPYyX804Aut2fbrLiL1j3RfVpV6Cu0zMMTrLVtILFFXUZgj/fPVpFJU+wD09ASbHj6L5dVX7gMEx5v/EeeQJ2Jv9I3en27Z7ualCYnHZ32z8qkjm7CWnlm9jS7JAuDyu6+aFVMJywz7rXIyEp567hBZPaHWJoIznQ+bmt0jHDpJ0FpAdQT4zvQOVQL3ylA9+ldKmjuwLMSqAh3BAo5CYXHhnoKcEhN92f9VvA2oTvVY5NegPYdFss9yqClYB8GKHsE8abpFK5jmXy97GG3UENkGUo+L1SGO+2NjCYwcBPcvYdOUfO4gMdavkmiqnJ4OiqKTdnff9/VL7Q81fTrcySswFm/kxb8vnG9i151k2p+pd4AVHF5BfWg3f4kc7kz2ZsKFOxFwU+f6Y5kNhT+dcmBDe2tIWGZxGRlG7BA2ngj7hDv8Jnu1UEprjR5OG4qoNEFP07ruqNI6zLq7rwAcHPsETY01w5q3dgf6ZGnA0LcQjfU7dwrd5ix4w3ZP6ZlDkf0AKC3aNgI0koVbMmjFd3URDPwdbbWJerZ0oTEpy+F7fpWAoFmoa+mhaIq9URbm0k/uY26Co8GuzugnqTa9xxeEkIo5smHbhBtV9c/jYbk9k9mpI24KGb7ENRabO+03pEU0a2Go2frEm9Ob8z3APOmV+d14p2f0euHMsMoj0pkfN5oZgvf0Im1RE6wbpHrWu1ZWzx18EFo+Kwyv5VXbqq4OYVwB0dp6V9QQf5UF0orcWcnDkeGK+kTx+zJMxt3Yexpjr0/O9Qkh+AoxSJTvmZT+INR6DORF1N/tFTKB5v+QzT2Nsge6lvKswpHGcFxfDlTp0zht7ANjVkAbw8q74bf8ommIqyfg0MA8bGOBeFtigUIjo5ugio6XAak/6sTjezxaRZKxlR9loQ8R9Ze14P17ua1oXrQpvRDPUg0JbjiJla0w04s3iUrDOMN3lFMUN+1cv+aaMs5WwIoyfK73oSyhPMnNg9wx4FtMGCXqfUgZVsNBWBXOzlXZAVqdzVCgOv/OQ2R2h3P2YJ7DR2icGD/YJ9g48+D79bFyiLu8U/dTaqeQG5fnCoaMxBzzfuiFFNyEyc16Zn5vU1i96Fp88WEAs3oG3sWKTupwfhwsRq8wx8O9Wta0qhmEGWCYlOduH8T6afiPjjxJPipEuGqt2PUYVOfoP6p97XNjDhD+7wn2ydCAAy9oA9m5N65k2EBBLWY9E1UfR7+aaLQDvZlCv8rAHoOK6IYvlNJQlkgYTq99YeVRqDKER278lTdntTp36IPnfF1z7NMUrEu+/TkCwJNuTBC8hDXC/MqSDGTRSsrlo+a4IQnDeZE8jUPtet6Edx8LHWG57bW1m/k0UFZlJit1uWOH/dmcM+scMBi9qk8Y160ycrOlPzmFER/5+qK70elhIhCsNRGPK8FOV3zgDYv18hXyG8Vgj9qrvTC4XC+ree7scws83AysXPToIx/50lO9wBrxt7U4t6qhQCgfqwXD6GlfR2S2SZCfbovmWoQzcM/jRJyK8paJCbqr0QRiEhrTo/WCiGzwlJZj/+mMsauUR2RWzRImrljuwuPl78+4yXpjdaP0Spsi7YkJFjSjIs7JYBxljs9DlBhmCjkvAAv5lJMiA8IzlnipugS1WMMRFx9j9WUjO4Bh6oDdlR+6a9bYlLQINMWlFW4/L/xyswggo7BgkqhkiG9w0BBwGgggosBIIKKDCCCiQwggogBgsqhkiG9w0BDAoBAqCCCbEwggmtMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAh2+2s5EPXSRAICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEGrm01TUqaxeEB2RPJ1tc8kEgglQBQAdNG0CjPrSjJEXtMV58VOJYOui+uBmV8Y7NbMqOfg0pv7C3cKpirjSNxW6Rd4rlotsWJnYjM/zXiuexmdZ9P1LRrvQTHD020NEr4DAl3FkFTEQCU72D+2CPc+WiF4ffDzOEdvvuoeSyqOxY/y0vibwQKQeFnJrIIr/xA1Rh5u11+UApB2hmzxKVBBba7EZIqNACZKSpAaPq1CQDTwX847xjXvnlXrq50xO8kzOWn39qgRfXyvmTIvulNPT4lzTgLCe1ww/wdHB6MLfSd2BQFwFcnBiFNjCCUCFvVkOHPQOFu5fijpTiV6/Wp7RvDmoGsgMP4XF5pAuboiCMZPuJYrwowFnFt4RCQ6N7NF/rNHHRPMK9uhyp3Zv7WTVVCXSgPZfUjGPT0MZp+Z+gkmYiy/UEGkX4y1p7JvmmHWgjDys4d3PSV3y42C3jXn3YdGsrTvQov7K7DT/zuvGgxnyKPK56NButSAbulDNxMSnUgzqJuLj97vrmsLZdQfUAsslF1HNwRGWmNiInEyfYHjGt3E9VXraujxqL90xZPk1w4qJq7spSaG/pxjV3xCFWcfzXFzoAY9UItmYqROVhmhlGmragtoIrsCO5Up2Sro7Xl2sWLxavm8I6DIAKeBEg1JEywNsfU98C05CNfgPc1FzhTNqrrQiJkfRsDOlSIuQfkx68DjqBzUAPhgRSMs1DNTIEWpjSwq0efyzpZIYLcwcc1F8ZvdJRvBXXyG3ymm5cLyx1cN/6twKMYW9GJgqcevCoDUyZ+9ojK8RZstPc9IqQjq4Xad3fBM/o2dt4/f7Wsr/t+nzZDhJrhTGkfXWa4XVxerX0sjdKqQQBk7oTUITUcLybx667Ms/TKMw5nWuGMvSj8tG705As7wpcorubczkg7Jtyfo6pBV2zFX/A21MxYRPkL1g2mtw4tOmd1rHfizEO7RCTwiBGDXWsUmvD0xmq8P0hhdX6oUcXXPxz20VqIzhiCT9ui/aCUzMwjNpvV+wOOWf7HHP4LbaTtFxtU16O3Vw00vtsUyokbCFcy0Zxu3C/o26cAWVFislI8yIp2TujsTnjpUg6NxjvsJKZ1rfecHFGJPFBh1knClXMeqPaBBIy/1d3Ja2whvKe7pvkf/ahetDENtH0m38nQMPYBgZMKWOvuIpyFFyFAz93Xxm7ipdksWQTWjQBUE0t1onyrM6AQM4WPaRuGqTWWzg49nqCcBZEif0eSFQYM0yUZJ8j6DTsKcPFIxJXGCI+HuDs210GKhKhICLAILJHPpJREdK3r90IwMOlS1wnAkZVwumk27A1rVj/J4lcezS0VZgEp3GcQYmkdbhpqJWeZYchwrhg/7xcb8zpJCHhyakXDBKsj1p1NZS26rPvcXLJHXRSzk9k8U1wyUo3BEib/F1LaFWWY7KSm66S7rfLq8n9zGvZPvmtZ49GFzjEJay//TLkSjwH/dC3tfHTNcLupA7oMiciJuIqbz/8Ae0zETAJECBgykOPTegkA2fSIyYK66lGrUyNU/znrKiSmR/6aMqOxUGwOA8+CUk5xMuMI8LnF62qrvLXg02rUmiNyfGqUVO5kGNMYAFGOMKzZmUDNYUdiB+ArO8dT0uI96XGwq09wwlMonlePhttV4bj53h9e3gIbanANX6RSbY8QzltekpKdY6CwapQv7jg6G6I4rsRUUR4dJB3iJ4n3QAgNp+022z5PuR+5RsYimDt5apdJqPc5MwVRVoBrzBjJi50aD0f7fkoW8ctjiBkfATrWtLj1NyjhhUfqooXh6Wg+zmx63BZq+kthXvvo8JP57ys7Ga2Li7PaIMKjOLkho4vF0NWQ5YkhyE7eBtbfRXjizXkgU5iOnbZjcmZbsF8v7v3iO6UyhAilurBCRBkNgs3isP9zN14VuGgPzri8mhi0Y6xkdXyRKgfUkyT8cTK7TP+0qk4Z3932j8sjjy2raCt69NrVCXkXIhj+SQ6rPEOdQ77cTTQ2830NCGngFSXL+EIKPXlgBba4xk2wkbAu4JdFSNQBdCD4TdAuGoS68OGOeCZfwYGYv6Vr2wPr7U4FxE2Tl++jSbe3mTHLVYcFyXK9m3ivL4rQXY4j3w6YPf3N7NmEVaGHireqcpPBZJEImdD4nw00jLPV3cFaQaU73X5jhwhqOijMd8nJkbXweV2h6ZJfZyzNmW2l+17nkknta4a5/4vLayj92gU5mh7gGSChXNZLT1qDfoJWvxfwGN9HrNmnYMqUq29ajFK0lY5fzJD6LrH0WlEoVbDLxUMSxtaL1h7IT27JwCQ7mY8PHnydynyiAPBubngUC9t2xZ0jKUEGuhD4OapQ9uMecHFH9m/r+hFq3ZwZ+BZ7bKjcofC50hU+aYLhT6TBOUXNA+KQqKU0wq5L0nURHg479vg6ONn3rlC2v/PEsIIQgzo3RkPoc94l8A0i6L2bs/MHiSYchgtRXl7IJKyTtqknikxLoWjr422PbJdkGS86I32FR0I8eEUizxmMu3mR+CdLbE0Uk+1SHGS6W1k5RYZOrUvrY1ylbvjmdLlH2izIVt/FXAcALU9wzXYf9zYCAUvvH4u9pKB15n//D+pEaptHdY78uMFKGQ+YEp+iVppqbl193StVDunvYpMlnq2aPfIQ+rHUrD/QxWzp/aoxJqOlRi06BtmHn+uXK6BsRzzrxkP/1AkcZwDV3q2ClMocXqBPWI32tq9qCmp7qfZI+eyn37eod9TtE+2znshtNOzQ/HyfHKyR3eduU3qkI1UNx16qA34w6vSExt/EIvGE+GAcdwHVcLKqySZ02p7rfX17fVT0gP1DnbOahDnJpies6LkUyVDnTx26BT+Bo12DZDEWo+vRea7I19+xczP3Vwm+F7kOviYxbevkgJD/diX/4UjgDkoG3wdRJpYbimaLfuLhZE7Lu5opzlkFYVHmsDNmKLjHXg23r7wD4XlRjrsqF3kjg3ehXD4T9PwBAFEAWzwETg1nCEs+eojbUSd6gIjgfDouDffBbNp/ftGgDCQIA20aeBeuvwDnOaIGFrlWbRfCQkNCfUyVQjqOouRZ/CssxSWOTztZWjl60NSnOvaGUZeFKVkV4c2Q2B9kdigqpgUP4bNn33SzrcrpTfVVmEhTL2LxBrJKma8m6TZtVPMmOUd1mCfqU8GL8VQRlk/RCt5vPWkVjtoZnoK6TKZFExXDAjBgkqhkiG9w0BCRUxFgQU/nj0KNx7oSwMYnu/YTW9n9LDR44wNQYJKoZIhvcNAQkUMSgeJgBFAHgAcABlAHIAdABGAGEAYgAgAEQAbwBjAHUAbQBlAG4AcwBvMEEwMTANBglghkgBZQMEAgEFAAQgRESPiXKK1M4KbFD1FLeLBJRHZ/7vl3pt2+bnitjwZakECJN9FtnaP+0tAgIIAA==
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: documenso
+  namespace: documenso
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: documenso
+  template:
+    metadata:
+      labels:
+        app: documenso
+    spec:
+      containers:
+        - name: documenso
+          image: documenso/documenso:latest
+          ports:
+            - containerPort: 3000
+          envFrom:
+            - secretRef:
+                name: documenso-env
+          volumeMounts:
+            - name: signing-cert
+              mountPath: /opt/documenso/cert.p12
+              subPath: cert.p12
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 90
+            periodSeconds: 30
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 1500Mi
+      volumes:
+        - name: signing-cert
+          secret:
+            secretName: documenso-signing-cert
+            items:
+              - key: cert.p12
+                path: cert.p12
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: documenso
+  namespace: documenso
+spec:
+  selector:
+    app: documenso
+  ports:
+    - port: 3000
+      targetPort: 3000
diff --git a/k8s/documenso/ingress.yaml b/k8s/documenso/ingress.yaml
new file mode 100644
index 0000000..70bba64
--- /dev/null
+++ b/k8s/documenso/ingress.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: documenso
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: documenso
+  namespace: documenso
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: documenso-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: signing.expertfab.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: documenso
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - signing.expertfab.de
+      secretName: documenso-tls
diff --git a/k8s/documenso/namespace.yaml b/k8s/documenso/namespace.yaml
new file mode 100644
index 0000000..b32b5a4
--- /dev/null
+++ b/k8s/documenso/namespace.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: documenso
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-documenso
+provisioner: driver.longhorn.io
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+volumeBindingMode: Immediate
+parameters:
+  numberOfReplicas: "2"
+  staleReplicaTimeout: "30"
+  fromBackup: ""
+  fsType: "ext4"
diff --git a/k8s/documenso/postgres.yaml b/k8s/documenso/postgres.yaml
new file mode 100644
index 0000000..3220a53
--- /dev/null
+++ b/k8s/documenso/postgres.yaml
@@ -0,0 +1,96 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: documenso-postgres
+  namespace: documenso
+type: Opaque
+stringData:
+  POSTGRES_DB: documenso
+  POSTGRES_USER: documenso
+  POSTGRES_PASSWORD: "9QtScsD5IymypPxR2eMNFoMFYVUp7cL"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: documenso-postgres-data
+  namespace: documenso
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: longhorn-documenso
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: documenso-postgres
+  namespace: documenso
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: documenso-postgres
+  template:
+    metadata:
+      labels:
+        app: documenso-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+          envFrom:
+            - secretRef:
+                name: documenso-postgres
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          startupProbe:
+            exec:
+              command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: documenso-postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: documenso-postgres
+  namespace: documenso
+spec:
+  selector:
+    app: documenso-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
diff --git a/k8s/erpnext/ingress-auth.yaml b/k8s/erpnext/ingress-auth.yaml
new file mode 100644
index 0000000..4ee20a2
--- /dev/null
+++ b/k8s/erpnext/ingress-auth.yaml
@@ -0,0 +1,80 @@
+---
+# /app/* — Zitadel Auth via oauth2-proxy (beide Domains)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: erpnext-app-auth
+  namespace: erpnext
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.priority: "100"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: expertfab.de
+      http:
+        paths:
+          - path: /app
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+    - host: www.expertfab.de
+      http:
+        paths:
+          - path: /app
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+  tls:
+    - hosts:
+        - expertfab.de
+        - www.expertfab.de
+      secretName: expertfab-tls
+---
+# /oauth2/* — OIDC Callback-Handling (beide Domains)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: erpnext-oauth2
+  namespace: erpnext
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.priority: "100"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: expertfab.de
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+    - host: www.expertfab.de
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+  tls:
+    - hosts:
+        - expertfab.de
+        - www.expertfab.de
+      secretName: expertfab-tls
diff --git a/k8s/erpnext/oauth2-proxy.yaml b/k8s/erpnext/oauth2-proxy.yaml
new file mode 100644
index 0000000..ca90d34
--- /dev/null
+++ b/k8s/erpnext/oauth2-proxy.yaml
@@ -0,0 +1,82 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oauth2-proxy-secrets
+  namespace: erpnext
+type: Opaque
+stringData:
+  OAUTH2_PROXY_CLIENT_ID: "371747520893682044"
+  OAUTH2_PROXY_CLIENT_SECRET: "Wka1L8RYFYeKHrzMOadDfQRXWlCnM6x2JKL2QBTmV3WHdaYY2OiodVZgK0MYdiFl"
+  OAUTH2_PROXY_COOKIE_SECRET: "st_biHMwZOrFbrigSmnEdRG5ZCoULrktjAvPGcUrqw0"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+  namespace: erpnext
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        app: oauth2-proxy
+    spec:
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
+          args:
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.expertfab.de
+            - --upstream=http://erpnext:8080
+            - --http-address=0.0.0.0:4180
+            - --email-domain=*
+            - --scope=openid profile email
+            - --skip-provider-button=true
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --cookie-domain=expertfab.de
+            - --whitelist-domain=expertfab.de
+            - --whitelist-domain=www.expertfab.de
+            - --reverse-proxy=true
+            - --set-xauthrequest=true
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_CLIENT_ID
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_CLIENT_SECRET
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_COOKIE_SECRET
+          ports:
+            - containerPort: 4180
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy
+  namespace: erpnext
+spec:
+  selector:
+    app: oauth2-proxy
+  ports:
+    - port: 4180
+      targetPort: 4180
diff --git a/k8s/joplin/ingress.yaml b/k8s/joplin/ingress.yaml
new file mode 100644
index 0000000..fa2afbd
--- /dev/null
+++ b/k8s/joplin/ingress.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: joplin
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: joplin
+  namespace: joplin
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: joplin-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: note.expertfab.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: joplin
+                port:
+                  number: 22300
+  tls:
+    - hosts:
+        - note.expertfab.de
+      secretName: joplin-tls
diff --git a/k8s/joplin/joplin.yaml b/k8s/joplin/joplin.yaml
new file mode 100644
index 0000000..50260cf
--- /dev/null
+++ b/k8s/joplin/joplin.yaml
@@ -0,0 +1,92 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: joplin-env
+  namespace: joplin
+type: Opaque
+stringData:
+  APP_BASE_URL: "https://note.expertfab.de"
+  APP_PORT: "22300"
+  DB_CLIENT: "pg"
+  POSTGRES_HOST: "joplin-postgres"
+  POSTGRES_PORT: "5432"
+  POSTGRES_DATABASE: "joplin"
+  POSTGRES_USER: "joplin"
+  POSTGRES_PASSWORD: "TXIlCX4DUdKZuqbYt2lTaxMXvz6cJi"
+  MAILER_ENABLED: "1"
+  MAILER_HOST: "smtprelay.expertfab.de"
+  MAILER_PORT: "587"
+  MAILER_SECURITY: "starttls"
+  MAILER_AUTH_USER: "it-admin@expertfab.de"
+  MAILER_AUTH_PASSWORD: "Relay22$$"
+  MAILER_NOREPLY_NAME: "ExpertFab Joplin"
+  MAILER_NOREPLY_EMAIL: "it-admin@expertfab.de"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: joplin
+  namespace: joplin
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: joplin
+  template:
+    metadata:
+      labels:
+        app: joplin
+    spec:
+      containers:
+        - name: joplin
+          image: joplin/server:latest
+          ports:
+            - containerPort: 22300
+          envFrom:
+            - secretRef:
+                name: joplin-env
+          readinessProbe:
+            httpGet:
+              path: /api/ping
+              port: 22300
+              httpHeaders:
+                - name: Host
+                  value: note.expertfab.de
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /api/ping
+              port: 22300
+              httpHeaders:
+                - name: Host
+                  value: note.expertfab.de
+            initialDelaySeconds: 90
+            periodSeconds: 30
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 1500Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: joplin
+  namespace: joplin
+spec:
+  selector:
+    app: joplin
+  ports:
+    - port: 22300
+      targetPort: 22300
diff --git a/k8s/joplin/namespace.yaml b/k8s/joplin/namespace.yaml
new file mode 100644
index 0000000..52f84a1
--- /dev/null
+++ b/k8s/joplin/namespace.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: joplin
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-joplin
+provisioner: driver.longhorn.io
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+volumeBindingMode: Immediate
+parameters:
+  numberOfReplicas: "2"
+  staleReplicaTimeout: "30"
+  fromBackup: ""
+  fsType: "ext4"
diff --git a/k8s/joplin/postgres.yaml b/k8s/joplin/postgres.yaml
new file mode 100644
index 0000000..d098f64
--- /dev/null
+++ b/k8s/joplin/postgres.yaml
@@ -0,0 +1,96 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: joplin-postgres
+  namespace: joplin
+type: Opaque
+stringData:
+  POSTGRES_DB: joplin
+  POSTGRES_USER: joplin
+  POSTGRES_PASSWORD: "TXIlCX4DUdKZuqbYt2lTaxMXvz6cJi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: joplin-postgres-data
+  namespace: joplin
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: longhorn-joplin
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: joplin-postgres
+  namespace: joplin
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: joplin-postgres
+  template:
+    metadata:
+      labels:
+        app: joplin-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+          envFrom:
+            - secretRef:
+                name: joplin-postgres
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          startupProbe:
+            exec:
+              command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: joplin-postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: joplin-postgres
+  namespace: joplin
+spec:
+  selector:
+    app: joplin-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
diff --git a/k8s/paperless/ingress.yaml b/k8s/paperless/ingress.yaml
new file mode 100644
index 0000000..e5e5fdd
--- /dev/null
+++ b/k8s/paperless/ingress.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperless
+  namespace: paperless
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: paperless-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: docs.expertfab.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+  tls:
+    - hosts:
+        - docs.expertfab.de
+      secretName: paperless-tls
diff --git a/k8s/paperless/oauth2-proxy.yaml b/k8s/paperless/oauth2-proxy.yaml
new file mode 100644
index 0000000..dbdf85b
--- /dev/null
+++ b/k8s/paperless/oauth2-proxy.yaml
@@ -0,0 +1,83 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oauth2-proxy-secrets
+  namespace: paperless
+type: Opaque
+stringData:
+  OAUTH2_PROXY_CLIENT_ID: "371736929185563308"
+  OAUTH2_PROXY_CLIENT_SECRET: "2WVS5uGOKOYozY0T6QLi854vihLrNbchqkPhEZxKS74b5iRQeeLH8EMhUiZIHWPH"
+  OAUTH2_PROXY_COOKIE_SECRET: "NcF3zVJcPIpBYpLL4TIqpmBAcESddly-LVHAKw--xl8"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+  namespace: paperless
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        app: oauth2-proxy
+    spec:
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
+          args:
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.expertfab.de
+            - --redirect-url=https://docs.expertfab.de/oauth2/callback
+            - --upstream=http://paperless:8000
+            - --http-address=0.0.0.0:4180
+            - --email-domain=*
+            - --scope=openid profile email
+            - --skip-provider-button=true
+            - --skip-auth-regex=^/api/
+            - --skip-auth-regex=^/api-auth/
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --reverse-proxy=true
+            - --pass-access-token=true
+            - --set-xauthrequest=true
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_CLIENT_ID
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_CLIENT_SECRET
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-secrets
+                  key: OAUTH2_PROXY_COOKIE_SECRET
+          ports:
+            - containerPort: 4180
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy
+  namespace: paperless
+spec:
+  selector:
+    app: oauth2-proxy
+  ports:
+    - port: 4180
+      targetPort: 4180