diff --git a/core/installer/values-tmpl/certificate-issuer.yaml b/core/installer/values-tmpl/certificate-issuer.yaml
index 7cabe94..db2ed7b 100644
--- a/core/installer/values-tmpl/certificate-issuer.yaml
+++ b/core/installer/values-tmpl/certificate-issuer.yaml
@@ -2,7 +2,7 @@
 kind: HelmRelease
 metadata:
   name: certificate-issuer
-  namespace: {{ .Values.NamespacePrefix }}ingress-private
+  namespace: {{ .Global.NamespacePrefix }}ingress-private
 spec:
   chart:
     spec:
@@ -10,28 +10,28 @@
       sourceRef:
         kind: GitRepository
         name: pcloud
-        namespace: {{ .Values.Id }}
+        namespace: {{ .Global.Id }}
   dependsOn:
   - name: ingress-private
-    namespace: {{ .Values.NamespacePrefix }}ingress-private
+    namespace: {{ .Global.NamespacePrefix }}ingress-private
   interval: 1m0s
   values:
-    pcloudInstanceId: {{ .Values.Id }}
+    pcloudInstanceId: {{ .Global.Id }}
     certManager:
-      namespace: {{ .Values.PCloudEnvName }}-cert-manager
-      gandiWebhookSecretReader: {{ .Values.PCloudEnvName }}-cert-manager-webhook-gandi
+      namespace: {{ .Global.PCloudEnvName }}-cert-manager
+      gandiWebhookSecretReader: {{ .Global.PCloudEnvName }}-cert-manager-webhook-gandi
     public:
-      name: {{ .Values.Id }}-public
-      # server: https://acme-v02.api.letsencrypt.org/directory
-      server: https://acme-staging-v02.api.letsencrypt.org/directory
-      domain: {{ .Values.Domain }}
-      contactEmail: {{ .Values.ContactEmail }}
-      ingressClass: {{ .Values.PCloudEnvName }}-ingress-public
+      name: {{ .Global.Id }}-public
+      server: https://acme-v02.api.letsencrypt.org/directory
+      # server: https://acme-staging-v02.api.letsencrypt.org/directory
+      domain: {{ .Global.Domain }}
+      contactEmail: {{ .Global.ContactEmail }}
+      ingressClass: {{ .Global.PCloudEnvName }}-ingress-public
     private:
-      name: {{ .Values.Id }}-private
-      # server: https://acme-v02.api.letsencrypt.org/directory
-      server: https://acme-staging-v02.api.letsencrypt.org/directory
-      domain: p.{{ .Values.Domain }}
-      contactEmail: {{ .Values.ContactEmail }}
-      ingressClassName: {{ .Values.Id }}-ingress-private
+      name: {{ .Global.Id }}-private
+      server: https://acme-v02.api.letsencrypt.org/directory
+      # server: https://acme-staging-v02.api.letsencrypt.org/directory
+      domain: {{ .Global.PrivateDomain }}
+      contactEmail: {{ .Global.ContactEmail }}
+      ingressClassName: {{ .Global.Id }}-ingress-private
       gandiAPIToken: {{ .Values.GandiAPIToken }}
diff --git a/core/installer/values-tmpl/core-auth.yaml b/core/installer/values-tmpl/core-auth.yaml
index a454c3b..1dcdef7 100644
--- a/core/installer/values-tmpl/core-auth.yaml
+++ b/core/installer/values-tmpl/core-auth.yaml
@@ -230,17 +230,15 @@
       secret:
         enabled: true
       maester:
-        enabled: false
-        hydraFullnameOverride: hydra
+        enabled: true
       hydra-maester:
-        fullnameOverride: {{ .Global.Id }}-hydra-maester
+        adminService:
+          name: hydra-admin
+          port: 80
         image:
           repository: giolekva/ory-hydra-maester
           tag: latest
           pullPolicy: IfNotPresent
-        adminService:
-          name: hydra
-          port: 80
       hydra:
         automigration:
           enabled: true
diff --git a/core/installer/values-tmpl/headscale.yaml b/core/installer/values-tmpl/headscale.yaml
index 317eb68..b908419 100644
--- a/core/installer/values-tmpl/headscale.yaml
+++ b/core/installer/values-tmpl/headscale.yaml
@@ -3,6 +3,8 @@
 metadata:
   name: headscale
   namespace: {{ .Global.NamespacePrefix }}app-headscale
+  annotations:
+    version: 2-with-oidc-hydra-admin
 spec:
   chart:
     spec:
@@ -22,3 +24,10 @@
     ingressClassName: pcloud-ingress-public
     certificateIssuer: {{ .Global.Id }}-public
     domain: {{ .Values.Subdomain }}.{{ .Global.Domain }}
+    internalBaseDomain: {{ .Global.PrivateDomain }}
+    oauth2:
+      hydraAdmin: http://hydra-admin.{{ .Global.NamespacePrefix }}core-auth.svc.cluster.local
+      hydraPublic: https://hydra.{{ .Global.Domain }}
+      clientId: headscale
+      secretName: oauth2-client-headscale
+
diff --git a/core/installer/values-tmpl/ingress-private.jsonschema b/core/installer/values-tmpl/ingress-private.jsonschema
index ec6a2c5..c89f310 100644
--- a/core/installer/values-tmpl/ingress-private.jsonschema
+++ b/core/installer/values-tmpl/ingress-private.jsonschema
@@ -1,15 +1,8 @@
 {
   "type": "object",
   "properties": {
-    "Values": {
-      "type": "object",
-      "properties": {
-        "NamespacePrefix": { "type": "string" },
-        "Id": { "type": "string" },
-        "Domain": { "type": "string" }
-      },
-      "additionalProperties": false
-    }
+    "GandiAPIToken": { "type": "string" },
+    "TailscaleAuthKey": { "type": "string" }
   },
   "additionalProperties": false
 }
diff --git a/core/installer/values-tmpl/ingress-private.md b/core/installer/values-tmpl/ingress-private.md
new file mode 100644
index 0000000..35a878f
--- /dev/null
+++ b/core/installer/values-tmpl/ingress-private.md
@@ -0,0 +1 @@
+{{ .Global.PrivateDomain }}
diff --git a/core/installer/values-tmpl/ingress-private.yaml b/core/installer/values-tmpl/ingress-private.yaml
index 760ff96..a0e4246 100644
--- a/core/installer/values-tmpl/ingress-private.yaml
+++ b/core/installer/values-tmpl/ingress-private.yaml
@@ -2,7 +2,7 @@
 kind: HelmRelease
 metadata:
   name: ingress-private
-  namespace: {{ .Values.NamespacePrefix }}ingress-private
+  namespace: {{ .Global.NamespacePrefix }}ingress-private
 spec:
   chart:
     spec:
@@ -10,58 +10,31 @@
       sourceRef:
         kind: GitRepository
         name: pcloud
-        namespace: {{ .Values.Id }}
+        namespace: {{ .Global.Id }}
   interval: 1m0s
   values:
-    fullnameOverride: {{ .Values.Id }}-nginx-private
+    fullnameOverride: {{ .Global.Id }}-nginx-private
     controller:
       service:
         enabled: true
         type: ClusterIP
       ingressClassByName: true
       ingressClassResource:
-        name: {{ .Values.Id }}-ingress-private
+        name: {{ .Global.Id }}-ingress-private
         enabled: true
         default: false
-        controllerValue: k8s.io/{{ .Values.Id }}-ingress-private
+        controllerValue: k8s.io/{{ .Global.Id }}-ingress-private
       extraArgs:
-        default-ssl-certificate: "{{ .Values.Id }}-ingress-private/cert-wildcard.p.{{ .Values.Domain }}"
-      # extraVolumes:
-      # - name: lighthouse-cert
-      #   secret:
-      #     secretName: node-lighthouse-cert
-      # - name: config
-      #   configMap:
-      #     name: lighthouse-config
-      # extraContainers:
-      # - name: lighthouse
-      #   image: giolekva/nebula:latest
-      #   imagePullPolicy: IfNotPresent
-      #   securityContext:
-      #     privileged: true
-      #     capabilities:
-      #       add:
-      #       - NET_ADMIN
-      #   ports:
-      #   - name: nebula
-      #     containerPort: {{ .Values.LighthouseMainPort }}
-      #     protocol: UDP
-      #   command:
-      #   - nebula
-      #   - --config=/etc/nebula/config/lighthouse.yaml
-      #   volumeMounts:
-      #   - name: lighthouse-cert
-      #     mountPath: /etc/nebula/lighthouse
-      #   - name: config
-      #     mountPath: /etc/nebula/config
-      # config:
-      #   bind-address: {{ .Values.LighthouseMainIP }}
-      #   proxy-body-size: 0
-    # udp:
-    #   "53": "{{ .Values.NamespacePrefix }}app-pihole/pihole-dns-udp:53"
-    # tcp:
-    #   "53": "{{ .Values.NamespacePrefix }}app-pihole/pihole-dns-tcp:53"
-    #   "143": "{{ .Values.NamespacePrefix }}app-maddy/maddy:143"
-    #   "465": "{{ .Values.NamespacePrefix }}app-maddy/maddy:465"
-    #   "587": "{{ .Values.NamespacePrefix }}app-maddy/maddy:587"
-    #   "993": "{{ .Values.NamespacePrefix }}app-maddy/maddy:993"
+        default-ssl-certificate: "{{ .Global.Id }}-ingress-private/cert-wildcard.p.{{ .Global.Domain }}"
+      extraContainers:
+      - name: tailscale
+        image: tailscale/tailscale:v1.42.0
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          privileged: true
+          capabilities:
+            add:
+            - NET_ADMIN
+        env:
+        - name: TS_EXTRA_ARGS
+          value: --hostname={{ .Global.PCloudEnvName }}-ingress --login-server=headscale.{{ .Global.Domain }} # TODO(gio): take headscale subdomain from configuration
diff --git a/core/installer/values-tmpl/vaultwarden.jsonschema b/core/installer/values-tmpl/vaultwarden.jsonschema
index ec6a2c5..88c96cb 100644
--- a/core/installer/values-tmpl/vaultwarden.jsonschema
+++ b/core/installer/values-tmpl/vaultwarden.jsonschema
@@ -1,15 +1,7 @@
 {
   "type": "object",
   "properties": {
-    "Values": {
-      "type": "object",
-      "properties": {
-        "NamespacePrefix": { "type": "string" },
-        "Id": { "type": "string" },
-        "Domain": { "type": "string" }
-      },
-      "additionalProperties": false
-    }
+    "Subdomain": { "type": "string", "default": "vaultwarden" }
   },
   "additionalProperties": false
 }
diff --git a/core/installer/values-tmpl/vaultwarden.md b/core/installer/values-tmpl/vaultwarden.md
new file mode 100644
index 0000000..ab9d05d
--- /dev/null
+++ b/core/installer/values-tmpl/vaultwarden.md
@@ -0,0 +1 @@
+Installs vaultwarden on private network accessible at https://{{ .Values.Subdomain }}.{{ .Global.PrivateDomain }}
diff --git a/core/installer/values-tmpl/vaultwarden.yaml b/core/installer/values-tmpl/vaultwarden.yaml
index 32d66e7..c35a45b 100644
--- a/core/installer/values-tmpl/vaultwarden.yaml
+++ b/core/installer/values-tmpl/vaultwarden.yaml
@@ -2,7 +2,7 @@
 kind: HelmRelease
 metadata:
   name: vaultwarden
-  namespace: {{ .Values.NamespacePrefix }}app-vaultwarden
+  namespace: {{ .Global.NamespacePrefix }}app-vaultwarden
 spec:
   chart:
     spec:
@@ -10,10 +10,10 @@
       sourceRef:
         kind: GitRepository
         name: pcloud
-        namespace: {{ .Values.Id }}
+        namespace: {{ .Global.Id }}
   dependsOn:
     - name: namespaces
-      namespace: {{ .Values.Id }}
+      namespace: {{ .Global.Id }}
   interval: 1m0s
   values:
     image:
@@ -22,6 +22,6 @@
       pullPolicy: IfNotPresent
     storage:
       size: 1Gi
-    domain: bitwarden.p.{{ .Values.Domain }}
-    certificateIssuer: {{ .Values.Id }}-private
-    ingressClassName: {{ .Values.Id }}-ingress-private
+    domain: {{ .Values.Subdomain }}.{{ .Global.PrivateDomain }}
+    certificateIssuer: {{ .Global.Id }}-private
+    ingressClassName: {{ .Global.Id }}-ingress-private