diff --git a/charts/auth-proxy/templates/install.yaml b/charts/auth-proxy/templates/install.yaml
index 09a1059..33ed875 100644
--- a/charts/auth-proxy/templates/install.yaml
+++ b/charts/auth-proxy/templates/install.yaml
@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: auth-proxy
+  name: {{ .Values.name }}
   namespace: {{ .Release.Namespace }}
 spec:
   type: ClusterIP
   selector:
-    app: auth-proxy
+    app: {{ .Values.name }}
   ports:
   - name: {{ .Values.portName }}
     port: 80
@@ -16,17 +16,17 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: auth-proxy
+  name: {{ .Values.name }}
   namespace: {{ .Release.Namespace }}
 spec:
   selector:
     matchLabels:
-      app: auth-proxy
+      app: {{ .Values.name }}
   replicas: 1
   template:
     metadata:
       labels:
-        app: auth-proxy
+        app: {{ .Values.name }}
     spec:
       containers:
       - name: auth-proxy
diff --git a/charts/auth-proxy/values.yaml b/charts/auth-proxy/values.yaml
index 742f4c9..779772d 100644
--- a/charts/auth-proxy/values.yaml
+++ b/charts/auth-proxy/values.yaml
@@ -2,6 +2,7 @@
   repository: giolekva/auth-proxy
   tag: latest
   pullPolicy: Always
+name: "auth-proxy"
 upstream: bar.svc.cluster.local
 whoAmIAddr: https://accounts.example.com/sessions/whoami
 loginAddr: https://accounts-ui.example.com/login
diff --git a/charts/dodo-app/templates/install.yaml b/charts/dodo-app/templates/install.yaml
index 58c920c..bc5f0b4 100644
--- a/charts/dodo-app/templates/install.yaml
+++ b/charts/dodo-app/templates/install.yaml
@@ -130,6 +130,7 @@
         - --networks={{ .Values.allowedNetworks }}
         - --external={{ .Values.external }}
         - --fetch-users-addr={{ .Values.fetchUsersAddr }}
+        - --headscale-api-addr={{ .Values.headscaleAPIAddr }}
         volumeMounts:
         - name: ssh-key
           readOnly: true
diff --git a/charts/dodo-app/values.yaml b/charts/dodo-app/values.yaml
index b1d57c4..ba822a2 100644
--- a/charts/dodo-app/values.yaml
+++ b/charts/dodo-app/values.yaml
@@ -17,3 +17,4 @@
 allowedNetworks: ""
 external: false
 fetchUsersAddr: ""
+headscaleAPIAddr: ""
diff --git a/charts/soft-serve/templates/ingress.yaml b/charts/soft-serve/templates/ingress.yaml
deleted file mode 100644
index 490a5b3..0000000
--- a/charts/soft-serve/templates/ingress.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{ if .Values.ingress.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ingress
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.ingress.certificateIssuer }}
-  annotations:
-    acme.cert-manager.io/http01-edit-in-place: "true"
-    cert-manager.io/cluster-issuer: {{ .Values.ingress.certificateIssuer }}
-  {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress.ingressClassName }}
-  {{- if .Values.ingress.certificateIssuer }}
-  tls:
-  - hosts:
-    - {{ .Values.ingress.domain }}
-    secretName: cert-soft-serve
-  {{- end }}
-  rules:
-  - host: {{ .Values.ingress.domain }}
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: soft-serve
-            port:
-              name: http
-{{ end }}
diff --git a/charts/soft-serve/templates/service-transport.yaml b/charts/soft-serve/templates/service-transport.yaml
deleted file mode 100644
index 969fbbe..0000000
--- a/charts/soft-serve/templates/service-transport.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{ if .Values.ingress.enabled }}
-apiVersion: transport.dodo.cloud/v1
-kind: ServiceTransport
-metadata:
-  name: ingress-transport
-  namespace: {{ .Release.Namespace }}
-spec:
-  port: {{ .Values.port }}
-  sourcePort: {{ .Values.ingress.sourcePort }}
-  protocol: TCP
-  service: soft-serve
-  ingressClassName: {{ .Values.ingress.ingressClassName }}
-{{ end }}
diff --git a/charts/soft-serve/templates/stateful-set.yaml b/charts/soft-serve/templates/stateful-set.yaml
index e5b32eb..5cf32c6 100644
--- a/charts/soft-serve/templates/stateful-set.yaml
+++ b/charts/soft-serve/templates/stateful-set.yaml
@@ -17,7 +17,7 @@
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: soft-serve
+          claimName: {{ .Values.persistentVolumeClaimName }}
       {{ if and .Values.privateKey .Values.publicKey }}
       - name: keys
         configMap:
@@ -31,7 +31,7 @@
         - name: SOFT_SERVE_SSH_LISTEN_ADDR
           value: ":{{ .Values.port }}"
         - name: SOFT_SERVE_SSH_PUBLIC_URL
-          value: "ssh://{{ .Values.ingress.domain }}:{{ .Values.sshPublicPort }}"
+          value: "ssh://{{ .Values.host }}:{{ .Values.sshPublicPort }}"
         - name: SOFT_SERVE_INITIAL_ADMIN_KEYS
           value: |-
 {{ indent 12 .Values.adminKey }}
@@ -44,11 +44,7 @@
         - name: SOFT_SERVE_HTTP_LISTEN_ADDR
           value: ":80"
         - name: SOFT_SERVE_HTTP_PUBLIC_URL
-          value: "http://{{ .Values.ingress.domain }}"
-        - name: SOFT_SERVE_ALLOW_KEYLESS
-          value: "{{ .Values.allowKeyless }}"
-        - name: SOFT_SERVE_ANON_ACCESS
-          value: "{{ .Values.anonAccess }}"
+          value: "http://{{ .Values.host }}"
         ports:
         - name: ssh
           containerPort: {{ .Values.port }}
diff --git a/charts/soft-serve/templates/volume.yaml b/charts/soft-serve/templates/volume.yaml
deleted file mode 100644
index f5d0bfc..0000000
--- a/charts/soft-serve/templates/volume.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: soft-serve
-  namespace: {{ .Release.Namespace }}
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ .Values.storage.size }}
diff --git a/charts/soft-serve/values.yaml b/charts/soft-serve/values.yaml
index cd042fc..5538d5c 100644
--- a/charts/soft-serve/values.yaml
+++ b/charts/soft-serve/values.yaml
@@ -2,8 +2,8 @@
   repository: charmcli/soft-serve
   tag: latest
   pullPolicy: IfNotPresent
-storage:
-  size: 1Gi
+persistentVolumeClaimName: ""
+host: ""
 port: 22
 sshPublicPort: 22
 privateKey: ""
@@ -12,11 +12,3 @@
 serviceType: LoadBalancer
 reservedIP: ""
 addressPool: ""
-ingress:
-  enabled: false
-  domain: git.p.example.com
-  ingressClassName: example-ingress-private
-  certificateIssuer: ""
-  sourcePort: 0
-allowKeyless: false
-anonAccess: "no-access"
diff --git a/charts/url-shortener/templates/install.yaml b/charts/url-shortener/templates/install.yaml
index a0fc858..d06ccdd 100644
--- a/charts/url-shortener/templates/install.yaml
+++ b/charts/url-shortener/templates/install.yaml
@@ -46,4 +46,4 @@
       volumes:
       - name: url-shortener
         persistentVolumeClaim:
-          claimName: url-shortener
+          claimName: {{ .Values.persistentVolumeClaimName }}
diff --git a/charts/url-shortener/templates/volume.yaml b/charts/url-shortener/templates/volume.yaml
deleted file mode 100644
index 992e601..0000000
--- a/charts/url-shortener/templates/volume.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: url-shortener
-  namespace: {{ .Release.Namespace }}
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ .Values.storage.size }}
diff --git a/charts/url-shortener/values.yaml b/charts/url-shortener/values.yaml
index dd3da7d..c9dd02e 100644
--- a/charts/url-shortener/values.yaml
+++ b/charts/url-shortener/values.yaml
@@ -2,7 +2,6 @@
   repository: giolekva/url-shortener
   tag: latest
   pullPolicy: Always
-storage:
-  size: 1Gi
+persistentVolumeClaimName: "data"
 portName: http
 requireAuth: false
diff --git a/charts/vaultwarden/templates/install.yaml b/charts/vaultwarden/templates/install.yaml
index 3305d6a..010a067 100644
--- a/charts/vaultwarden/templates/install.yaml
+++ b/charts/vaultwarden/templates/install.yaml
@@ -1,15 +1,3 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: data
-  namespace: {{ .Release.Namespace }}
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ .Values.storage.size }}
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -28,7 +16,7 @@
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: data
+          claimName: {{ .Values.persistentVolumeClaimName }}
       containers:
       - name: server
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
@@ -41,7 +29,7 @@
         - name: DOMAIN
           value: https://{{ .Values.domain }}
         ports:
-        - name: http
+        - name: {{ .Values.httpPortName }}
           containerPort: 80
           protocol: TCP
         volumeMounts:
@@ -60,27 +48,5 @@
   ports:
   - name: http
     port: 80
-    targetPort: http
+    targetPort: {{ .Values.httpPortName }}
     protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ingress
-  namespace: {{ .Release.Namespace }}
-spec:
-  ingressClassName: {{ .Values.ingressClassName }}
-  tls:
-  - hosts:
-    - {{ .Values.domain }}
-  rules:
-  - host: {{ .Values.domain }}
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: server
-            port:
-              name: http
diff --git a/charts/vaultwarden/values.yaml b/charts/vaultwarden/values.yaml
index 8bd6296..d432172 100644
--- a/charts/vaultwarden/values.yaml
+++ b/charts/vaultwarden/values.yaml
@@ -2,8 +2,6 @@
   repository: vaultwarden/server
   tag: 1.28.1
   pullPolicy: IfNotPresent
-storage:
-  size: 1Gi
 domain: bitwarden.example.com
-certificateIssuer: private
-ingressClassName: ingress-private
+persistentVolumeClaimName: "data"
+httpPortName: "http"
diff --git a/charts/virtual-machine/templates/secret-network-data.yaml b/charts/virtual-machine/templates/secret-network-data.yaml
new file mode 100644
index 0000000..02c002c
--- /dev/null
+++ b/charts/virtual-machine/templates/secret-network-data.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.name }}-network-data
+type: Opaque
+data:
+  networkdata: {{ .Values.cloudInit.networkData}}
diff --git a/charts/virtual-machine/templates/secret-user-data.yaml b/charts/virtual-machine/templates/secret-user-data.yaml
new file mode 100644
index 0000000..228ab91
--- /dev/null
+++ b/charts/virtual-machine/templates/secret-user-data.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.name }}-user-data
+type: Opaque
+data:
+  userdata: {{ .Values.cloudInit.userData}}
diff --git a/charts/virtual-machine/templates/service-code-server.yaml b/charts/virtual-machine/templates/service-code-server.yaml
deleted file mode 100644
index 3be8855..0000000
--- a/charts/virtual-machine/templates/service-code-server.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-# TODO(gio): enable
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: {{ .Values.name }}-code-server
-# spec:
-#   type: ClusterIP
-#   selector:
-#     app: {{ .Values.name }}
-#   ports:
-#   - name: http
-#     port: 80
-#     targetPort: 8080 # TODO(gio): add to values.yaml
-#     protocol: TCP
diff --git a/charts/virtual-machine/templates/service.yaml b/charts/virtual-machine/templates/service.yaml
new file mode 100644
index 0000000..b79b385
--- /dev/null
+++ b/charts/virtual-machine/templates/service.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.name }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ .Values.name }}
+  ports:
+    {{- toYaml .Values.servicePorts | nindent 4 }}
diff --git a/charts/virtual-machine/templates/vm.yaml b/charts/virtual-machine/templates/vm.yaml
index d66da80..40c4a34 100644
--- a/charts/virtual-machine/templates/vm.yaml
+++ b/charts/virtual-machine/templates/vm.yaml
@@ -22,7 +22,8 @@
         devices:
           interfaces:
             - name: default
-              masquerade: {}
+              # masquerade: {}
+              bridge: {}
               ports:
                 {{- range .Values.ports }}
                 - port: {{ . }}
@@ -44,6 +45,7 @@
             claimName: dv-{{ .Values.name }}
         - name: cloudinitdisk
           cloudInitNoCloud:
-            userData: |
-              #cloud-config
-              {{- toYaml .Values.cloudInit.userData | nindent 14 }}
+            secretRef:
+              name: {{ .Values.name }}-user-data
+            networkDataSecretRef:
+              name: {{ .Values.name }}-network-data
diff --git a/charts/virtual-machine/values.yaml b/charts/virtual-machine/values.yaml
index 6c8b642..79ea0a9 100644
--- a/charts/virtual-machine/values.yaml
+++ b/charts/virtual-machine/values.yaml
@@ -6,4 +6,6 @@
   size: 64Gi
 ports: []
 cloudInit:
-  userData: {}
+  userData: "" # base64 encoded
+  networkData: "" # base64 encoded
+ports: []