diff --git a/config.tfvars b/config.tfvars
index ca9a8141..b0e4b08c 100644
Binary files a/config.tfvars and b/config.tfvars differ
diff --git a/stacks/terminal/main.tf b/stacks/terminal/main.tf
new file mode 100644
index 00000000..c6daf858
--- /dev/null
+++ b/stacks/terminal/main.tf
@@ -0,0 +1,72 @@
+variable "tls_secret_name" {
+  type      = string
+  sensitive = true
+}
+
+resource "kubernetes_namespace" "terminal" {
+  metadata {
+    name = "terminal"
+    labels = {
+      "istio-injection" : "disabled"
+      tier = local.tiers.aux
+    }
+  }
+}
+
+module "tls_secret" {
+  source          = "../../modules/kubernetes/setup_tls_secret"
+  namespace       = kubernetes_namespace.terminal.metadata[0].name
+  tls_secret_name = var.tls_secret_name
+}
+
+# Service + Endpoints to reverse-proxy to ttyd at 10.0.10.10:7681
+resource "kubernetes_service" "terminal" {
+  metadata {
+    name      = "terminal"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+    labels = {
+      app = "terminal"
+    }
+  }
+
+  spec {
+    port {
+      name        = "http"
+      port        = 80
+      target_port = 7681
+    }
+  }
+}
+
+resource "kubernetes_endpoints" "terminal" {
+  metadata {
+    name      = "terminal"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+  }
+
+  subset {
+    address {
+      ip = "10.0.10.10"
+    }
+    port {
+      name = "http"
+      port = 7681
+    }
+  }
+}
+
+module "ingress" {
+  source          = "../../modules/kubernetes/ingress_factory"
+  namespace       = kubernetes_namespace.terminal.metadata[0].name
+  name            = "terminal"
+  tls_secret_name = var.tls_secret_name
+  protected       = true
+  extra_annotations = {
+    "gethomepage.dev/enabled"      = "true"
+    "gethomepage.dev/name"         = "Terminal"
+    "gethomepage.dev/description"  = "Web terminal (ttyd)"
+    "gethomepage.dev/icon"         = "mdi-console"
+    "gethomepage.dev/group"        = "Infrastructure"
+    "gethomepage.dev/pod-selector" = ""
+  }
+}
diff --git a/stacks/terminal/terragrunt.hcl b/stacks/terminal/terragrunt.hcl
new file mode 100644
index 00000000..e147285f
--- /dev/null
+++ b/stacks/terminal/terragrunt.hcl
@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders()
+}