diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi-role.jsonschema b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi-role.md b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.md
new file mode 100644
index 0000000..e6f01a3
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.md
@@ -0,0 +1 @@
+Installs rbacs to let cert-manager create gandi resource
diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi-role.yaml b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.yaml
new file mode 100644
index 0000000..f0f9b93
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi-role.yaml
@@ -0,0 +1,23 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-gandi-role
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-cert-manager
+  dependsOn:
+    - name: cert-manager
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/cert-manager-webhook-gandi-role
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  timeout: 20m0s
+  values:
+    certManager:
+      namespace: {{ .Global.PCloudEnvName }}-cert-manager
+      name: {{ .Global.PCloudEnvName }}-cert-manager
diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi.jsonschema b/core/installer/values-tmpl/cert-manager-webhook-gandi.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi.md b/core/installer/values-tmpl/cert-manager-webhook-gandi.md
new file mode 100644
index 0000000..6590062
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi.md
@@ -0,0 +1 @@
+Installs cert-manager DNS01 resolver for Gandi.net domain registrar
diff --git a/core/installer/values-tmpl/cert-manager-webhook-gandi.yaml b/core/installer/values-tmpl/cert-manager-webhook-gandi.yaml
new file mode 100644
index 0000000..fdcc030
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager-webhook-gandi.yaml
@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-gandi
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-cert-manager
+  dependsOn:
+    - name: cert-manager
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/cert-manager-webhook-gandi
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  timeout: 20m0s
+  values:
+    fullnameOverride: {{ .Global.PCloudEnvName }}-cert-manager-webhook-gandi
+    certManager:
+      namespace: {{ .Global.PCloudEnvName }}-cert-manager
+      name: {{ .Global.PCloudEnvName }}-cert-manager
+    image:
+      repository: giolekva/cert-manager-webhook-gandi
+      tag: v0.2.0
+      pullPolicy: IfNotPresent
+    logLevel: 2
diff --git a/core/installer/values-tmpl/cert-manager.jsonschema b/core/installer/values-tmpl/cert-manager.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/cert-manager.md b/core/installer/values-tmpl/cert-manager.md
new file mode 100644
index 0000000..aba785a
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager.md
@@ -0,0 +1 @@
+Installs cert-manager
diff --git a/core/installer/values-tmpl/cert-manager.yaml b/core/installer/values-tmpl/cert-manager.yaml
new file mode 100644
index 0000000..db00d34
--- /dev/null
+++ b/core/installer/values-tmpl/cert-manager.yaml
@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-cert-manager
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: {{ .Global.PCloudEnvName }}
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
+    pcloudInstanceId: ""
+    namespacePrefix: {{ .Global.PCloudEnvName }}-
+    namespaces:
+    - cert-manager
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-cert-manager
+  dependsOn:
+    - name: namespaces-cert-manager
+      namespace: {{ .Global.PCloudEnvName }}
+    - name: ingress-public
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/cert-manager
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  timeout: 20m0s
+  values:
+    fullnameOverride: {{ .Global.PCloudEnvName }}-cert-manager
+    installCRDs: true
+    image:
+      tag: v1.11.1
+      pullPolicy: IfNotPresent
diff --git a/core/installer/values-tmpl/certificate-issuer-private.jsonschema b/core/installer/values-tmpl/certificate-issuer-private.jsonschema
new file mode 100644
index 0000000..46ae9c3
--- /dev/null
+++ b/core/installer/values-tmpl/certificate-issuer-private.jsonschema
@@ -0,0 +1,7 @@
+{
+  "type": "object",
+  "properties": {
+    "GandiAPIToken": { "type": "string" },
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/certificate-issuer-private.md b/core/installer/values-tmpl/certificate-issuer-private.md
new file mode 100644
index 0000000..9ee84cc
--- /dev/null
+++ b/core/installer/values-tmpl/certificate-issuer-private.md
@@ -0,0 +1 @@
+Installs certificate issuer for private domain
diff --git a/core/installer/values-tmpl/certificate-issuer-private.yaml b/core/installer/values-tmpl/certificate-issuer-private.yaml
new file mode 100644
index 0000000..23004a0
--- /dev/null
+++ b/core/installer/values-tmpl/certificate-issuer-private.yaml
@@ -0,0 +1,30 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: certificate-issuer
+  namespace: {{ .Global.Id }}
+spec:
+  targetNamespace: {{ .Global.NamespacePrefix }}ingress-private
+  dependsOn:
+  - name: ingress-private
+    namespace: {{ .Global.Id }}
+  chart:
+    spec:
+      chart: charts/certificate-issuer-private
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    certManager:
+      namespace: {{ .Global.PCloudEnvName }}-cert-manager
+      gandiWebhookSecretReader: {{ .Global.PCloudEnvName }}-cert-manager-webhook-gandi
+    issuer:
+      name: {{ .Global.Id }}-private
+      # server: https://acme-v02.api.letsencrypt.org/directory
+      server: https://acme-staging-v02.api.letsencrypt.org/directory
+      domain: {{ .Global.PrivateDomain }}
+      contactEmail: {{ .Global.ContactEmail }}
+      ingressClassName: {{ .Global.Id }}-ingress-private
+      gandiAPIToken: {{ .Values.GandiAPIToken }}
diff --git a/core/installer/values-tmpl/core-auth.yaml b/core/installer/values-tmpl/core-auth.yaml
index 13e9c9c..856fb4c 100644
--- a/core/installer/values-tmpl/core-auth.yaml
+++ b/core/installer/values-tmpl/core-auth.yaml
@@ -8,6 +8,8 @@
   dependsOn:
   - name: core-auth-storage
     namespace: {{ .Global.Id }}
+  - name: ingress-private
+    namespace: {{ .Global.Id }}
   chart:
     spec:
       chart: charts/auth
diff --git a/core/installer/values-tmpl/csi-driver-smb.jsonschema b/core/installer/values-tmpl/csi-driver-smb.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/csi-driver-smb.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/csi-driver-smb.md b/core/installer/values-tmpl/csi-driver-smb.md
new file mode 100644
index 0000000..171a000
--- /dev/null
+++ b/core/installer/values-tmpl/csi-driver-smb.md
@@ -0,0 +1 @@
+Installs iCSI SMB driver
diff --git a/core/installer/values-tmpl/csi-driver-smb.yaml b/core/installer/values-tmpl/csi-driver-smb.yaml
new file mode 100644
index 0000000..9a2cf36
--- /dev/null
+++ b/core/installer/values-tmpl/csi-driver-smb.yaml
@@ -0,0 +1,40 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-csi-driver-smb
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: {{ .Global.PCloudEnvName }}
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
+    pcloudInstanceId: ""
+    namespacePrefix: {{ .Global.PCloudEnvName }}-
+    namespaces:
+    - csi-driver-smb
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: csi-driver-smb
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-csi-driver-smb
+  dependsOn:
+    - name: namespaces-csi-driver-smb
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/csi-driver-smb
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  timeout: 20m0s
+  values:
diff --git a/core/installer/values-tmpl/env-manager.jsonschema b/core/installer/values-tmpl/env-manager.jsonschema
new file mode 100644
index 0000000..aa2f01d
--- /dev/null
+++ b/core/installer/values-tmpl/env-manager.jsonschema
@@ -0,0 +1,8 @@
+{
+  "type": "object",
+  "properties": {
+    "RepoIP": { "type": "string", "default": "192.168.0.11" },
+	"SSHPrivateKey": { "type": "string", "default": "foo bar" }
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/env-manager.md b/core/installer/values-tmpl/env-manager.md
new file mode 100644
index 0000000..ec69eba
--- /dev/null
+++ b/core/installer/values-tmpl/env-manager.md
@@ -0,0 +1 @@
+PCloud environment manager
diff --git a/core/installer/values-tmpl/env-manager.yaml b/core/installer/values-tmpl/env-manager.yaml
new file mode 100644
index 0000000..691693b
--- /dev/null
+++ b/core/installer/values-tmpl/env-manager.yaml
@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: env-manager
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  chart:
+    spec:
+      chart: charts/env-manager
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
+    repoIP: {{ .Values.RepoIP }}
+    sshPrivateKey: {{ .Values.SSHPrivateKey | b64enc }}
diff --git a/core/installer/values-tmpl/headscale-controller.jsonschema b/core/installer/values-tmpl/headscale-controller.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-controller.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/headscale-controller.md b/core/installer/values-tmpl/headscale-controller.md
new file mode 100644
index 0000000..99d2190
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-controller.md
@@ -0,0 +1 @@
+Installs headscale controller
diff --git a/core/installer/values-tmpl/headscale-controller.yaml b/core/installer/values-tmpl/headscale-controller.yaml
new file mode 100644
index 0000000..3285f58
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-controller.yaml
@@ -0,0 +1,38 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-headscale-controller
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
+    namespacePrefix: {{ .Global.PCloudEnvName }}-
+    namespaces:
+    - headscale-controller
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: headscale-controller
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-headscale-controller
+  dependsOn:
+    - name: namespaces-headscale-controller
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/headscale-controller
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
diff --git a/core/installer/values-tmpl/headscale.yaml b/core/installer/values-tmpl/headscale.yaml
index 79e457e..8c16b86 100644
--- a/core/installer/values-tmpl/headscale.yaml
+++ b/core/installer/values-tmpl/headscale.yaml
@@ -28,6 +28,8 @@
   dependsOn:
     - name: namespaces-headscale
       namespace: {{ .Global.Id }}
+    - name: core-auth
+      namespace: {{ .Global.Id }}
   chart:
     spec:
       chart: charts/headscale
@@ -46,7 +48,7 @@
     ingressClassName: pcloud-ingress-public
     certificateIssuer: {{ .Global.Id }}-public
     domain: {{ .Values.Subdomain }}.{{ .Global.Domain }}
-    internalBaseDomain: {{ .Global.PrivateDomain }}
+    publicBaseDomain: {{ .Global.Domain }}
     oauth2:
       hydraAdmin: http://hydra-admin.{{ .Global.NamespacePrefix }}core-auth.svc.cluster.local
       hydraPublic: https://hydra.{{ .Global.Domain }}
diff --git a/core/installer/values-tmpl/ingress-private.yaml b/core/installer/values-tmpl/ingress-private.yaml
index f33e179..0874b72 100644
--- a/core/installer/values-tmpl/ingress-private.yaml
+++ b/core/installer/values-tmpl/ingress-private.yaml
@@ -21,34 +21,12 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: volumes-ingress-private
-  namespace: {{ .Global.Id }}
-spec:
-  targetNamespace: {{ .Global.NamespacePrefix }}ingress-private
-  dependsOn:
-    - name: namespaces-ingress-private
-      namespace: {{ .Global.Id }}
-  chart:
-    spec:
-      chart: charts/volumes
-      sourceRef:
-        kind: GitRepository
-        name: pcloud
-        namespace: {{ .Global.Id }}
-  interval: 1m0s
-  values:
-    name: tailscale
-    size: 1Gi
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
   name: ingress-private
   namespace: {{ .Global.Id }}
 spec:
   targetNamespace: {{ .Global.NamespacePrefix }}ingress-private
   dependsOn:
-    - name: volumes-ingress-private
+    - name: namespaces-ingress-private
       namespace: {{ .Global.Id }}
   chart:
     spec:
diff --git a/core/installer/values-tmpl/ingress-public.jsonschema b/core/installer/values-tmpl/ingress-public.jsonschema
index ec6a2c5..f42d895 100644
--- a/core/installer/values-tmpl/ingress-public.jsonschema
+++ b/core/installer/values-tmpl/ingress-public.jsonschema
@@ -1,15 +1,6 @@
 {
   "type": "object",
   "properties": {
-    "Values": {
-      "type": "object",
-      "properties": {
-        "NamespacePrefix": { "type": "string" },
-        "Id": { "type": "string" },
-        "Domain": { "type": "string" }
-      },
-      "additionalProperties": false
-    }
   },
   "additionalProperties": false
 }
diff --git a/core/installer/values-tmpl/ingress-public.md b/core/installer/values-tmpl/ingress-public.md
new file mode 100644
index 0000000..227c2d4
--- /dev/null
+++ b/core/installer/values-tmpl/ingress-public.md
@@ -0,0 +1 @@
+Sets up ingress for publicly accessible services
diff --git a/core/installer/values-tmpl/ingress-public.yaml b/core/installer/values-tmpl/ingress-public.yaml
index 43ae8bc..80a5efd 100644
--- a/core/installer/values-tmpl/ingress-public.yaml
+++ b/core/installer/values-tmpl/ingress-public.yaml
@@ -2,51 +2,52 @@
 kind: HelmRelease
 metadata:
   name: namespaces-ingress-public
-  namespace: {{ .Global.Id }}
+  namespace: {{ .Global.PCloudEnvName }}
 spec:
   chart:
     spec:
       chart: charts/namespaces
       sourceRef:
         kind: GitRepository
-        name: pcloud
-        namespace: {{ .Global.Id }}
+        name: {{ .Global.PCloudEnvName }}
+        namespace: {{ .Global.PCloudEnvName }}
   interval: 1m0s
   values:
-    pcloudInstanceId: {{ .Global.Id }}
-    namespacePrefix: {{ .Global.NamespacePrefix }}
+    pcloudInstanceId: ""
+    namespacePrefix: {{ .Global.PCloudEnvName }}-
     namespaces:
-    - app-ingress-public
+    - ingress-public
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: ingress-public
-  namespace: {{ .Global.Id }}
+  namespace: {{ .Global.PCloudEnvName }}
 spec:
-  targetNamespace: {{ .Values.NamespacePrefix }}ingress-public
+  targetNamespace: {{ .Global.PCloudEnvName }}-ingress-public
   dependsOn:
     - name: namespaces-ingress-public
-      namespace: {{ .Global.Id }}
+      namespace: {{ .Global.PCloudEnvName }}
   chart:
     spec:
-      chart: ingress-nginx
-      version: 4.0.3
+      chart: charts/ingress-nginx
       sourceRef:
-        kind: HelmRepository
-        name: ingress-nginx
-        namespace: {{ .Values.Id }}
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
   interval: 1m0s
   values:
-    fullnameOverride: {{ .Values.Id }}-ingress-public
+    fullnameOverride: {{ .Global.PCloudEnvName }}-ingress-public
     controller:
       service:
         type: LoadBalancer
+        annotations:
+          metallb.universe.tf/loadBalancerIPs: 192.168.0.213 # TODO(giolekva): configurable
       ingressClassByName: true
       ingressClassResource:
-        name: {{ .Values.Id }}-ingress-public
+        name: {{ .Global.PCloudEnvName }}-ingress-public
         enabled: true
         default: false
-        controllerValue: k8s.io/{{ .Values.Id }}-ingress-public
+        controllerValue: k8s.io/{{ .Global.PCloudEnvName }}-ingress-public
       config:
-        proxy-body-size: 100M
+        proxy-body-size: 100M # TODO(giolekva): configurable
diff --git a/core/installer/values-tmpl/metallb-config-env.yaml b/core/installer/values-tmpl/metallb-config-env.yaml
index 6ea2ac9..39907e4 100644
--- a/core/installer/values-tmpl/metallb-config-env.yaml
+++ b/core/installer/values-tmpl/metallb-config-env.yaml
@@ -1,7 +1,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: meteallb-config-env
+  name: meteallb-config-env # TODO(giolekva): typo metea
   namespace: {{ .Global.Id }}
 spec:
   chart:
diff --git a/core/installer/values-tmpl/resource-renderer-controller.jsonschema b/core/installer/values-tmpl/resource-renderer-controller.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/resource-renderer-controller.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/resource-renderer-controller.md b/core/installer/values-tmpl/resource-renderer-controller.md
new file mode 100644
index 0000000..81231e0
--- /dev/null
+++ b/core/installer/values-tmpl/resource-renderer-controller.md
@@ -0,0 +1 @@
+Installs resource-renderer controller
diff --git a/core/installer/values-tmpl/resource-renderer-controller.yaml b/core/installer/values-tmpl/resource-renderer-controller.yaml
new file mode 100644
index 0000000..72cf68b
--- /dev/null
+++ b/core/installer/values-tmpl/resource-renderer-controller.yaml
@@ -0,0 +1,38 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-rr-controller
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
+    namespacePrefix: {{ .Global.PCloudEnvName }}-
+    namespaces:
+    - rr-controller
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: rr-controller
+  namespace: {{ .Global.PCloudEnvName }}
+spec:
+  targetNamespace: {{ .Global.PCloudEnvName }}-rr-controller
+  dependsOn:
+    - name: namespaces-rr-controller
+      namespace: {{ .Global.PCloudEnvName }}
+  chart:
+    spec:
+      chart: charts/resource-renderer-controller
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.PCloudEnvName }}
+  interval: 1m0s
+  values:
diff --git a/core/installer/values-tmpl/tailscale-proxy.yaml b/core/installer/values-tmpl/tailscale-proxy.yaml
index 56dec5e..9664e51 100644
--- a/core/installer/values-tmpl/tailscale-proxy.yaml
+++ b/core/installer/values-tmpl/tailscale-proxy.yaml
@@ -28,6 +28,8 @@
   dependsOn:
     - name: namespaces-tailscale-proxy
       namespace: {{ .Global.Id }}
+    - name: headscale
+      namespace: {{ .Global.Id }}
   chart:
     spec:
       chart: charts/tailscale
@@ -38,6 +40,7 @@
   interval: 1m0s
   values:
     hostname: {{ .Global.PCloudEnvName }}-{{ .Global.Id }}-internal-proxy
+    apiServer: http://headscale-api.{{ .Global.Id }}-app-headscale.svc.cluster.local
     loginServer: https://headscale.{{ .Global.Domain }} # TODO(gio): take headscale subdomain from configuration
     ipSubnet: {{ .Values.IPSubnet }}
     username: {{ .Values.Username }}