diff --git a/.gitignore b/.gitignore
index 6f86690..fcea597 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,4 @@ cronjobs
 *.crt
 *.key
 
-chacal/
-
-secrets/
\ No newline at end of file
+chacal/
\ No newline at end of file
diff --git a/infra/eso/bitwarden-cli.yaml b/infra/eso/bitwarden-cli.yaml
index 26a90fb..6a44192 100644
--- a/infra/eso/bitwarden-cli.yaml
+++ b/infra/eso/bitwarden-cli.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: bitwarden-cli
-  namespace: bitwarden
+  namespace: infra
   labels:
     app.kubernetes.io/name: bitwarden-cli
 spec:
@@ -102,3 +102,20 @@ spec:
             requests:
               cpu: 50m
               memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: bitwarden-cli
+  ports:
+    - name: http
+      port: 8087
+      targetPort: http
+      protocol: TCP
diff --git a/infra/eso/bw-cli-netpol.yaml b/infra/eso/bw-cli-netpol.yaml
new file mode 100644
index 0000000..c97d539
--- /dev/null
+++ b/infra/eso/bw-cli-netpol.yaml
@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bw-cli
+  namespace: infra
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
+        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: external-secrets
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: external-secrets
diff --git a/infra/eso/secretstores.yaml b/infra/eso/secretstores.yaml
new file mode 100644
index 0000000..40c0d60
--- /dev/null
+++ b/infra/eso/secretstores.yaml
@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-login }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-fields }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        {
+          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
+        }
diff --git a/secrets/adguard.yaml b/secrets/adguard.yaml
new file mode 100644
index 0000000..90556ac
--- /dev/null
+++ b/secrets/adguard.yaml
@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: adguardhome-password, namespace: dns }
+spec:
+  refreshInterval: 1h
+  target:
+    name: adguardhome-password
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
diff --git a/secrets/cloudreve.yaml b/secrets/cloudreve.yaml
new file mode 100644
index 0000000..6fc6991
--- /dev/null
+++ b/secrets/cloudreve.yaml
@@ -0,0 +1,36 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: cloudreve, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: cloudreve-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DB_USER: "{{ .DB_USER }}"
+        DB_PASSWORD: "{{ .DB_PASSWORD }}"
+        DB_NAME: "{{ .DB_NAME }}"
+        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
+  data:
+    - secretKey: DB_USER
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_NAME
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/openwebui.yaml b/secrets/openwebui.yaml
new file mode 100644
index 0000000..47a1221
--- /dev/null
+++ b/secrets/openwebui.yaml
@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: openwebui, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: openwebui-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: dbname
+      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/paperless.yaml b/secrets/paperless.yaml
new file mode 100644
index 0000000..641c8df
--- /dev/null
+++ b/secrets/paperless.yaml
@@ -0,0 +1,39 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: paperless, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: paperless-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
+        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
+        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
+  data:
+    - secretKey: PAPERLESS_DBNAME
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBNAME,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBUSER
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBUSER,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBPASSWORD
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBPASSWORD,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/radarr.yaml b/secrets/radarr.yaml
new file mode 100644
index 0000000..d9f6079
--- /dev/null
+++ b/secrets/radarr.yaml
@@ -0,0 +1,48 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: radarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: radarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
+        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
+        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
+        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Radarr__Postgres__User
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: username,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Password
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: password,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Host
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/recommender.yaml b/secrets/recommender.yaml
new file mode 100644
index 0000000..3812d84
--- /dev/null
+++ b/secrets/recommender.yaml
@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: recommender, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: recommender-secrets
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
+        DATABASE_URL: "{{ .DATABASE_URL }}"
+  data:
+    - secretKey: OPENAI_API_KEY
+      remoteRef:
+        {
+          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
+          property: OPENAI_API_KEY,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: DATABASE_URL
+      remoteRef:
+        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/slink.yaml b/secrets/slink.yaml
new file mode 100644
index 0000000..28e869c
--- /dev/null
+++ b/secrets/slink.yaml
@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: slink, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: slink-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}"
+        ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}"
+        ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}"
+  data:
+    - secretKey: ADMIN_USERNAME
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_PASSWORD
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_EMAIL
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/sonarr.yaml b/secrets/sonarr.yaml
new file mode 100644
index 0000000..3d87606
--- /dev/null
+++ b/secrets/sonarr.yaml
@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: sonarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: sonarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
+        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
+        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
+        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Sonarr__Postgres__User
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Password
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Host
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }