diff --git a/clusters/titan.lan.huizinga.dev/infra/lldap-controller.yaml b/clusters/titan.lan.huizinga.dev/infra/lldap-controller.yaml
index 1f163f1..8d6e526 100644
--- a/clusters/titan.lan.huizinga.dev/infra/lldap-controller.yaml
+++ b/clusters/titan.lan.huizinga.dev/infra/lldap-controller.yaml
@@ -18,9 +18,14 @@ spec:
   interval: 15m
   dependsOn:
     - name: lldap
+    - name: letsencrypt
   prune: true
   timeout: 2m
   sourceRef:
     kind: OCIRepository
     name: lldap-controller
   wait: true
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: domain-vars
diff --git a/clusters/titan.lan.huizinga.dev/infra/tunnel.yaml b/clusters/titan.lan.huizinga.dev/infra/tunnel.yaml
new file mode 100644
index 0000000..13fb124
--- /dev/null
+++ b/clusters/titan.lan.huizinga.dev/infra/tunnel.yaml
@@ -0,0 +1,26 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: tunnel
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: oci://git.huizinga.dev/dreaded_x/tunnel_rs/manifests
+  ref:
+    tag: edge
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: tunnel
+  namespace: flux-system
+spec:
+  interval: 15m
+  dependsOn:
+    - name: lldap
+  prune: true
+  timeout: 2m
+  sourceRef:
+    kind: OCIRepository
+    name: tunnel
+  wait: true