diff --git a/charts/headscale/templates/headscale.yaml b/charts/headscale/templates/headscale.yaml
index 128a24c..fa58ab5 100644
--- a/charts/headscale/templates/headscale.yaml
+++ b/charts/headscale/templates/headscale.yaml
@@ -6,6 +6,9 @@
   annotations:
     acme.cert-manager.io/http01-edit-in-place: "true"
     cert-manager.io/cluster-issuer: {{ .Values.certificateIssuer}}
+    {{ if .Values.ui.enabled }}
+    nginx.org/rewrites: "serviceName=headscale rewrite=/;serviceName=headscale-ui rewrite=/"
+    {{ end }}
 spec:
   ingressClassName: {{ .Values.ingressClassName }}
   tls:
@@ -23,6 +26,15 @@
             name: headscale
             port:
               name: http
+      {{ if .Values.ui.enabled }}
+      - path: /web
+        pathType: Prefix
+        backend:
+          service:
+            name: headscale-ui
+            port:
+              name: http
+      {{ end }}
 ---
 apiVersion: v1
 kind: Service
@@ -40,6 +52,25 @@
     port: 80
     targetPort: http
     protocol: TCP
+{{ if .Values.ui.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-ui
+  namespace: {{ .Release.Namespace }}
+  # annotations:
+  #   metallb.universe.tf/address-pool: {{ .Values.ipAddressPool }}
+spec:
+  type: ClusterIP
+  selector:
+    app: headscale
+  ports:
+  - name: http
+    port: 80
+    targetPort: http-ui
+    protocol: TCP
+{{ end }}
 ---
 apiVersion: v1
 kind: Service
@@ -160,3 +191,12 @@
           readOnly: false
         - mountPath: /headscale-api
           name: api-socket
+      {{ if .Values.ui.enabled }}
+      - name: headscale-ui # TODO(gio): separate deployment
+        image: {{ .Values.ui.image.repository }}:{{ .Values.ui.image.tag }}
+        imagePullPolicy: {{ .Values.ui.image.pullPolicy }}
+        ports:
+        - name: http-ui
+          containerPort: 80
+          protocol: TCP
+      {{ end }}