diff --git a/modules/kubernetes/actualbudget/main.tf b/modules/kubernetes/actualbudget/main.tf
index f8aaf52d..e9f374c5 100644
--- a/modules/kubernetes/actualbudget/main.tf
+++ b/modules/kubernetes/actualbudget/main.tf
@@ -14,6 +14,7 @@ resource "kubernetes_namespace" "actualbudget" {
     name = "actualbudget"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/affine/main.tf b/modules/kubernetes/affine/main.tf
index 2e1a482b..b1a8d4fc 100644
--- a/modules/kubernetes/affine/main.tf
+++ b/modules/kubernetes/affine/main.tf
@@ -6,6 +6,9 @@ variable "smtp_password" { type = string }
 resource "kubernetes_namespace" "affine" {
   metadata {
     name = "affine"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/audiobookshelf/main.tf b/modules/kubernetes/audiobookshelf/main.tf
index 2a42eb2a..a23fb489 100644
--- a/modules/kubernetes/audiobookshelf/main.tf
+++ b/modules/kubernetes/audiobookshelf/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "audiobookshelf" {
     name = "audiobookshelf"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/blog/main.tf b/modules/kubernetes/blog/main.tf
index e8d88914..eb02b035 100644
--- a/modules/kubernetes/blog/main.tf
+++ b/modules/kubernetes/blog/main.tf
@@ -7,6 +7,7 @@ resource "kubernetes_namespace" "website" {
     name = "website"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/calibre/main.tf b/modules/kubernetes/calibre/main.tf
index daa5fceb..a2ac3ff1 100644
--- a/modules/kubernetes/calibre/main.tf
+++ b/modules/kubernetes/calibre/main.tf
@@ -10,6 +10,9 @@ variable "homepage_password" {
 resource "kubernetes_namespace" "calibre" {
   metadata {
     name = "calibre"
+    labels = {
+      tier = var.tier
+    }
     # labels = {
     #   "istio-injection" : "enabled"
     # }
diff --git a/modules/kubernetes/changedetection/main.tf b/modules/kubernetes/changedetection/main.tf
index 06f16212..e7dca791 100644
--- a/modules/kubernetes/changedetection/main.tf
+++ b/modules/kubernetes/changedetection/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "changedetection" {
     name = "changedetection"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/city-guesser/main.tf b/modules/kubernetes/city-guesser/main.tf
index e6f8bac1..415c4598 100644
--- a/modules/kubernetes/city-guesser/main.tf
+++ b/modules/kubernetes/city-guesser/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "city-guesser" {
     name = "city-guesser"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/cloudflared/main.tf b/modules/kubernetes/cloudflared/main.tf
index e5c63b45..bd5340e6 100644
--- a/modules/kubernetes/cloudflared/main.tf
+++ b/modules/kubernetes/cloudflared/main.tf
@@ -5,6 +5,9 @@ variable "cloudflare_tunnel_token" {}
 resource "kubernetes_namespace" "cloudflared" {
   metadata {
     name = "cloudflared"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 variable "tier" { type = string }
diff --git a/modules/kubernetes/coturn/main.tf b/modules/kubernetes/coturn/main.tf
index 5d18cc4e..c580a7a5 100644
--- a/modules/kubernetes/coturn/main.tf
+++ b/modules/kubernetes/coturn/main.tf
@@ -1,6 +1,7 @@
 variable "tls_secret_name" {}
 variable "tier" { type = string }
 variable "turn_secret" { type = string }
+variable "public_ip" { type = string }
 
 locals {
   turn_realm = "viktorbarzin.me"
@@ -44,6 +45,7 @@ resource "kubernetes_config_map" "coturn_config" {
 
       # Network — use 0.0.0.0, coturn auto-detects pod IP
       listening-ip=0.0.0.0
+      external-ip=${var.public_ip}
 
       # Media relay port range (narrow — 100 ports)
       min-port=${local.min_port}
@@ -153,7 +155,7 @@ resource "kubernetes_service" "coturn" {
     name      = "coturn"
     namespace = kubernetes_namespace.coturn.metadata[0].name
     annotations = {
-      "metallb.universe.tf/loadBalancerIPs"  = "10.0.20.200"
+      "metallb.universe.tf/loadBalancerIPs" = "10.0.20.200"
       "metallb.universe.tf/allow-shared-ip" = "shared"
     }
   }
diff --git a/modules/kubernetes/cyberchef/main.tf b/modules/kubernetes/cyberchef/main.tf
index b8f4041c..5f707e29 100644
--- a/modules/kubernetes/cyberchef/main.tf
+++ b/modules/kubernetes/cyberchef/main.tf
@@ -3,6 +3,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "cyberchef" {
   metadata {
     name = "cyberchef"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/dashy/main.tf b/modules/kubernetes/dashy/main.tf
index 67d839b7..5ba0791d 100644
--- a/modules/kubernetes/dashy/main.tf
+++ b/modules/kubernetes/dashy/main.tf
@@ -13,6 +13,7 @@ resource "kubernetes_namespace" "dashy" {
     name = "dashy"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/dawarich/main.tf b/modules/kubernetes/dawarich/main.tf
index 8b1851b7..527bcd55 100644
--- a/modules/kubernetes/dawarich/main.tf
+++ b/modules/kubernetes/dawarich/main.tf
@@ -12,6 +12,7 @@ resource "kubernetes_namespace" "dawarich" {
     name = "dawarich"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/dbaas/main.tf b/modules/kubernetes/dbaas/main.tf
index 107adb09..99ce8e63 100644
--- a/modules/kubernetes/dbaas/main.tf
+++ b/modules/kubernetes/dbaas/main.tf
@@ -15,6 +15,9 @@ variable "prod" {
 resource "kubernetes_namespace" "dbaas" {
   metadata {
     name = "dbaas"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/diun/main.tf b/modules/kubernetes/diun/main.tf
index 46aec4ca..5109495b 100644
--- a/modules/kubernetes/diun/main.tf
+++ b/modules/kubernetes/diun/main.tf
@@ -8,6 +8,7 @@ resource "kubernetes_namespace" "diun" {
     name = "diun"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/drone/main.tf b/modules/kubernetes/drone/main.tf
index bc1ac2ae..ea8f6096 100644
--- a/modules/kubernetes/drone/main.tf
+++ b/modules/kubernetes/drone/main.tf
@@ -19,6 +19,7 @@ resource "kubernetes_namespace" "drone" {
     name = "drone"
     labels = {
       "resource-governance/custom-quota" = "true"
+      tier                               = var.tier
     }
   }
 }
@@ -30,10 +31,10 @@ resource "kubernetes_resource_quota" "drone" {
   }
   spec {
     hard = {
-      "requests.cpu"    = "8"
-      "requests.memory" = "8Gi"
-      "limits.cpu"      = "16"
-      "limits.memory"   = "32Gi"
+      "requests.cpu"    = "16"
+      "requests.memory" = "16Gi"
+      "limits.cpu"      = "48"
+      "limits.memory"   = "96Gi"
       pods              = "30"
     }
   }
diff --git a/modules/kubernetes/ebook2audiobook/main.tf b/modules/kubernetes/ebook2audiobook/main.tf
index 00820a7a..991dd93b 100644
--- a/modules/kubernetes/ebook2audiobook/main.tf
+++ b/modules/kubernetes/ebook2audiobook/main.tf
@@ -13,6 +13,7 @@ resource "kubernetes_namespace" "ebook2audiobook" {
     name = "ebook2audiobook"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/echo/main.tf b/modules/kubernetes/echo/main.tf
index 724e07d4..1eacfb41 100644
--- a/modules/kubernetes/echo/main.tf
+++ b/modules/kubernetes/echo/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "echo" {
     name = "echo"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/excalidraw/main.tf b/modules/kubernetes/excalidraw/main.tf
index 99d6b14a..c120e7fc 100644
--- a/modules/kubernetes/excalidraw/main.tf
+++ b/modules/kubernetes/excalidraw/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "excalidraw" {
     name = "excalidraw"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/f1-stream/main.tf b/modules/kubernetes/f1-stream/main.tf
index 455fe778..885c3bc7 100644
--- a/modules/kubernetes/f1-stream/main.tf
+++ b/modules/kubernetes/f1-stream/main.tf
@@ -37,7 +37,7 @@ resource "kubernetes_deployment" "f1-stream" {
       }
       spec {
         container {
-          image = "viktorbarzin/f1-stream:v1.2.7"
+          image = "viktorbarzin/f1-stream:v1.2.8"
           name  = "f1-stream"
           resources {
             limits = {
diff --git a/modules/kubernetes/forgejo/main.tf b/modules/kubernetes/forgejo/main.tf
index dd460203..74621708 100644
--- a/modules/kubernetes/forgejo/main.tf
+++ b/modules/kubernetes/forgejo/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "forgejo" {
     name = "forgejo"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/freedify/main.tf b/modules/kubernetes/freedify/main.tf
index ec5bed0f..74c28901 100755
--- a/modules/kubernetes/freedify/main.tf
+++ b/modules/kubernetes/freedify/main.tf
@@ -14,6 +14,7 @@ resource "kubernetes_namespace" "freedify" {
     name = "freedify"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/freshrss/main.tf b/modules/kubernetes/freshrss/main.tf
index 5972e2a2..aaaa4c0c 100644
--- a/modules/kubernetes/freshrss/main.tf
+++ b/modules/kubernetes/freshrss/main.tf
@@ -10,6 +10,9 @@ module "tls_secret" {
 resource "kubernetes_namespace" "immich" {
   metadata {
     name = "freshrss"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/frigate/main.tf b/modules/kubernetes/frigate/main.tf
index 1d8b962a..f9164df0 100644
--- a/modules/kubernetes/frigate/main.tf
+++ b/modules/kubernetes/frigate/main.tf
@@ -4,6 +4,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "frigate" {
   metadata {
     name = "frigate"
+    labels = {
+      tier = var.tier
+    }
     # labels = {
     #   "istio-injection" : "enabled"
     # }
diff --git a/modules/kubernetes/grampsweb/main.tf b/modules/kubernetes/grampsweb/main.tf
index 4693a21c..b5dbbe4b 100644
--- a/modules/kubernetes/grampsweb/main.tf
+++ b/modules/kubernetes/grampsweb/main.tf
@@ -5,6 +5,9 @@ variable "smtp_password" { type = string }
 resource "kubernetes_namespace" "grampsweb" {
   metadata {
     name = "grampsweb"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/hackmd/main.tf b/modules/kubernetes/hackmd/main.tf
index 1e21b003..0878cc49 100644
--- a/modules/kubernetes/hackmd/main.tf
+++ b/modules/kubernetes/hackmd/main.tf
@@ -7,6 +7,7 @@ resource "kubernetes_namespace" "hackmd" {
     name = "hackmd"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/headscale/main.tf b/modules/kubernetes/headscale/main.tf
index 65d34a0a..8ae2ab3a 100644
--- a/modules/kubernetes/headscale/main.tf
+++ b/modules/kubernetes/headscale/main.tf
@@ -7,6 +7,9 @@ variable "headscale_acl" {}
 resource "kubernetes_namespace" "headscale" {
   metadata {
     name = "headscale"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/health/main.tf b/modules/kubernetes/health/main.tf
index bac41a30..1fd321a1 100644
--- a/modules/kubernetes/health/main.tf
+++ b/modules/kubernetes/health/main.tf
@@ -6,6 +6,9 @@ variable "secret_key" { type = string }
 resource "kubernetes_namespace" "health" {
   metadata {
     name = "health"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/immich/main.tf b/modules/kubernetes/immich/main.tf
index 9826b25a..32b37b16 100644
--- a/modules/kubernetes/immich/main.tf
+++ b/modules/kubernetes/immich/main.tf
@@ -18,6 +18,9 @@ module "tls_secret" {
 resource "kubernetes_namespace" "immich" {
   metadata {
     name = "immich"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/isponsorblocktv/main.tf b/modules/kubernetes/isponsorblocktv/main.tf
index e7b452be..7a5bf4fc 100644
--- a/modules/kubernetes/isponsorblocktv/main.tf
+++ b/modules/kubernetes/isponsorblocktv/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "isponsorblocktv" {
     name = "isponsorblocktv"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/jsoncrack/main.tf b/modules/kubernetes/jsoncrack/main.tf
index bfa02284..e14ea970 100644
--- a/modules/kubernetes/jsoncrack/main.tf
+++ b/modules/kubernetes/jsoncrack/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "jsoncrack" {
     name = "jsoncrack"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/kms/main.tf b/modules/kubernetes/kms/main.tf
index 955a9b38..d21f1df5 100644
--- a/modules/kubernetes/kms/main.tf
+++ b/modules/kubernetes/kms/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "kms" {
     name = "kms"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/linkwarden/main.tf b/modules/kubernetes/linkwarden/main.tf
index a1d1ea66..d4e27103 100644
--- a/modules/kubernetes/linkwarden/main.tf
+++ b/modules/kubernetes/linkwarden/main.tf
@@ -7,6 +7,9 @@ variable "authentik_client_secret" {}
 resource "kubernetes_namespace" "linkwarden" {
   metadata {
     name = "linkwarden"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/mailserver/main.tf b/modules/kubernetes/mailserver/main.tf
index bd30225b..38b174f0 100644
--- a/modules/kubernetes/mailserver/main.tf
+++ b/modules/kubernetes/mailserver/main.tf
@@ -8,6 +8,9 @@ variable "sasl_passwd" {} # For sendgrid i.e relayhost
 resource "kubernetes_namespace" "mailserver" {
   metadata {
     name = "mailserver"
+    labels = {
+      tier = var.tier
+    }
     # connecting via localhost does not seem to work?
     # labels = {
     #   "istio-injection" : "enabled"
diff --git a/modules/kubernetes/matrix/main.tf b/modules/kubernetes/matrix/main.tf
index 12a069af..1b1d6684 100644
--- a/modules/kubernetes/matrix/main.tf
+++ b/modules/kubernetes/matrix/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "matrix" {
     name = "matrix"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/mcaptcha/main.tf b/modules/kubernetes/mcaptcha/main.tf
index 4d0e7149..0d65ee38 100644
--- a/modules/kubernetes/mcaptcha/main.tf
+++ b/modules/kubernetes/mcaptcha/main.tf
@@ -14,6 +14,7 @@ resource "kubernetes_namespace" "mcaptcha" {
     name = "mcaptcha"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/meshcentral/main.tf b/modules/kubernetes/meshcentral/main.tf
index 8fab8266..79d6e98c 100644
--- a/modules/kubernetes/meshcentral/main.tf
+++ b/modules/kubernetes/meshcentral/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "meshcentral" {
     name = "meshcentral"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/n8n/main.tf b/modules/kubernetes/n8n/main.tf
index 6a7b59a8..93083ed7 100644
--- a/modules/kubernetes/n8n/main.tf
+++ b/modules/kubernetes/n8n/main.tf
@@ -11,6 +11,9 @@ module "tls_secret" {
 resource "kubernetes_namespace" "n8n" {
   metadata {
     name = "n8n"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/navidrome/main.tf b/modules/kubernetes/navidrome/main.tf
index 12d21684..11cd7932 100644
--- a/modules/kubernetes/navidrome/main.tf
+++ b/modules/kubernetes/navidrome/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "navidrome" {
     name = "navidrome"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/netbox/main.tf b/modules/kubernetes/netbox/main.tf
index 21ee2c51..5f73f6fe 100644
--- a/modules/kubernetes/netbox/main.tf
+++ b/modules/kubernetes/netbox/main.tf
@@ -4,6 +4,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "netbox" {
   metadata {
     name = "netbox"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/networking-toolbox/main.tf b/modules/kubernetes/networking-toolbox/main.tf
index df8ab459..be23b852 100644
--- a/modules/kubernetes/networking-toolbox/main.tf
+++ b/modules/kubernetes/networking-toolbox/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "networking-toolbox" {
     name = "networking-toolbox"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/ntfy/main.tf b/modules/kubernetes/ntfy/main.tf
index dafdbd5b..04943516 100644
--- a/modules/kubernetes/ntfy/main.tf
+++ b/modules/kubernetes/ntfy/main.tf
@@ -3,6 +3,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "ntfy" {
   metadata {
     name = "ntfy"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/ollama/main.tf b/modules/kubernetes/ollama/main.tf
index 95543857..6192951c 100644
--- a/modules/kubernetes/ollama/main.tf
+++ b/modules/kubernetes/ollama/main.tf
@@ -8,6 +8,9 @@ variable "ollama_api_credentials" {
 resource "kubernetes_namespace" "ollama" {
   metadata {
     name = "ollama"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/openclaw/main.tf b/modules/kubernetes/openclaw/main.tf
index 1c180fc0..3a599243 100644
--- a/modules/kubernetes/openclaw/main.tf
+++ b/modules/kubernetes/openclaw/main.tf
@@ -10,6 +10,9 @@ variable "skill_secrets" { type = map(string) }
 resource "kubernetes_namespace" "openclaw" {
   metadata {
     name = "openclaw"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
@@ -86,10 +89,10 @@ resource "kubernetes_config_map" "openclaw_config" {
             fallbacks = ["gemini/gemini-2.5-flash", "llama-as-openai/Llama-3.3-70B-Instruct"]
           }
           models = {
-            "modal/zai-org/GLM-5-FP8"                                   = { streaming = false }
-            "gemini/gemini-2.5-flash"                                    = {}
-            "llama-as-openai/Llama-3.3-70B-Instruct"                     = {}
-            "llama-as-openai/Llama-4-Scout-17B-16E-Instruct-FP8"         = {}
+            "modal/zai-org/GLM-5-FP8"                            = { streaming = false }
+            "gemini/gemini-2.5-flash"                            = {}
+            "llama-as-openai/Llama-3.3-70B-Instruct"             = {}
+            "llama-as-openai/Llama-4-Scout-17B-16E-Instruct-FP8" = {}
           }
         }
       }
diff --git a/modules/kubernetes/osm-routing/main.tf b/modules/kubernetes/osm-routing/main.tf
index be943c04..fa421db8 100644
--- a/modules/kubernetes/osm-routing/main.tf
+++ b/modules/kubernetes/osm-routing/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "osm-routing" {
     name = "osm-routing"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/owntracks/main.tf b/modules/kubernetes/owntracks/main.tf
index ea79dabe..d0568e44 100644
--- a/modules/kubernetes/owntracks/main.tf
+++ b/modules/kubernetes/owntracks/main.tf
@@ -12,6 +12,7 @@ resource "kubernetes_namespace" "owntracks" {
     name = "owntracks"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/paperless-ngx/main.tf b/modules/kubernetes/paperless-ngx/main.tf
index 24aa6e9b..b80a788e 100644
--- a/modules/kubernetes/paperless-ngx/main.tf
+++ b/modules/kubernetes/paperless-ngx/main.tf
@@ -9,6 +9,9 @@ variable "homepage_password" {}
 resource "kubernetes_namespace" "paperless-ngx" {
   metadata {
     name = "paperless-ngx"
+    labels = {
+      tier = var.tier
+    }
     # labels = {
     #   "istio-injection" : "enabled"
     # }
diff --git a/modules/kubernetes/plotting-book/main.tf b/modules/kubernetes/plotting-book/main.tf
index 8b1e91e8..f2fb0d76 100644
--- a/modules/kubernetes/plotting-book/main.tf
+++ b/modules/kubernetes/plotting-book/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "plotting-book" {
     name = "plotting-book"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/privatebin/main.tf b/modules/kubernetes/privatebin/main.tf
index 0c5a2f4a..788f439d 100644
--- a/modules/kubernetes/privatebin/main.tf
+++ b/modules/kubernetes/privatebin/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "privatebin" {
     name = "privatebin"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/real-estate-crawler/main.tf b/modules/kubernetes/real-estate-crawler/main.tf
index 0db7b77c..b55d853f 100644
--- a/modules/kubernetes/real-estate-crawler/main.tf
+++ b/modules/kubernetes/real-estate-crawler/main.tf
@@ -12,6 +12,7 @@ resource "kubernetes_namespace" "realestate-crawler" {
     name = "realestate-crawler"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
@@ -57,7 +58,7 @@ resource "kubernetes_deployment" "realestate-crawler-ui" {
           image = "viktorbarzin/immoweb:latest"
           port {
             name           = "http"
-            container_port = 80
+            container_port = 8080
             protocol       = "TCP"
           }
           env {
@@ -89,7 +90,8 @@ resource "kubernetes_service" "realestate-crawler-ui" {
       app = "realestate-crawler-ui"
     }
     port {
-      port = 80
+      port        = 80
+      target_port = 8080
     }
   }
 }
diff --git a/modules/kubernetes/redis/main.tf b/modules/kubernetes/redis/main.tf
index 4271c99e..11b107b9 100644
--- a/modules/kubernetes/redis/main.tf
+++ b/modules/kubernetes/redis/main.tf
@@ -4,6 +4,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "redis" {
   metadata {
     name = "redis"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/resume/main.tf b/modules/kubernetes/resume/main.tf
index 4320ccb4..4aa7c8d7 100644
--- a/modules/kubernetes/resume/main.tf
+++ b/modules/kubernetes/resume/main.tf
@@ -12,6 +12,9 @@ locals {
 resource "kubernetes_namespace" "resume" {
   metadata {
     name = local.namespace
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/rybbit/main.tf b/modules/kubernetes/rybbit/main.tf
index 5df5ba56..80a3bbc6 100644
--- a/modules/kubernetes/rybbit/main.tf
+++ b/modules/kubernetes/rybbit/main.tf
@@ -6,6 +6,9 @@ variable "postgres_password" { type = string }
 resource "kubernetes_namespace" "rybbit" {
   metadata {
     name = "rybbit"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/send/main.tf b/modules/kubernetes/send/main.tf
index 6f4e0eb7..822c9dab 100644
--- a/modules/kubernetes/send/main.tf
+++ b/modules/kubernetes/send/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "send" {
     name = "send"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/servarr/main.tf b/modules/kubernetes/servarr/main.tf
index e55e8da0..ae102719 100644
--- a/modules/kubernetes/servarr/main.tf
+++ b/modules/kubernetes/servarr/main.tf
@@ -5,6 +5,9 @@ variable "aiostreams_database_connection_string" { type = string }
 resource "kubernetes_namespace" "servarr" {
   metadata {
     name = "servarr"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/shadowsocks/main.tf b/modules/kubernetes/shadowsocks/main.tf
index acb5ea9b..dbd5ad15 100644
--- a/modules/kubernetes/shadowsocks/main.tf
+++ b/modules/kubernetes/shadowsocks/main.tf
@@ -7,6 +7,9 @@ variable "method" {
 resource "kubernetes_namespace" "shadowsocks" {
   metadata {
     name = "shadowsocks"
+    labels = {
+      tier = var.tier
+    }
     # TLS termination seems iffy - I get pfsense MiTM-ing
     # labels = {
     #   "istio-injection" : "enabled"
diff --git a/modules/kubernetes/speedtest/main.tf b/modules/kubernetes/speedtest/main.tf
index 104ac17e..6327a3f2 100644
--- a/modules/kubernetes/speedtest/main.tf
+++ b/modules/kubernetes/speedtest/main.tf
@@ -6,6 +6,9 @@ variable "db_password" { type = string }
 resource "kubernetes_namespace" "speedtest" {
   metadata {
     name = "speedtest"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/stirling-pdf/main.tf b/modules/kubernetes/stirling-pdf/main.tf
index 25b29ee4..52481f76 100644
--- a/modules/kubernetes/stirling-pdf/main.tf
+++ b/modules/kubernetes/stirling-pdf/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "stirling-pdf" {
     name = "stirling-pdf"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/tandoor/main.tf b/modules/kubernetes/tandoor/main.tf
index b395890c..043f1b1f 100644
--- a/modules/kubernetes/tandoor/main.tf
+++ b/modules/kubernetes/tandoor/main.tf
@@ -8,6 +8,7 @@ resource "kubernetes_namespace" "tandoor" {
     name = "tandoor"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/technitium/main.tf b/modules/kubernetes/technitium/main.tf
index f9d3357e..5a7aee15 100644
--- a/modules/kubernetes/technitium/main.tf
+++ b/modules/kubernetes/technitium/main.tf
@@ -6,6 +6,9 @@ variable "technitium_db_password" {}
 resource "kubernetes_namespace" "technitium" {
   metadata {
     name = "technitium"
+    labels = {
+      tier = var.tier
+    }
     # stale cache error when trying to resolve
     # labels = {
     #   "istio-injection" : "enabled"
diff --git a/modules/kubernetes/tor-proxy/main.tf b/modules/kubernetes/tor-proxy/main.tf
index 6994393d..b86f8533 100644
--- a/modules/kubernetes/tor-proxy/main.tf
+++ b/modules/kubernetes/tor-proxy/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "tor-proxy" {
     name = "tor-proxy"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/travel_blog/main.tf b/modules/kubernetes/travel_blog/main.tf
index fd47fe1b..cac745e4 100644
--- a/modules/kubernetes/travel_blog/main.tf
+++ b/modules/kubernetes/travel_blog/main.tf
@@ -6,6 +6,7 @@ resource "kubernetes_namespace" "travel-blog" {
     name = "travel-blog"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/tuya-bridge/main.tf b/modules/kubernetes/tuya-bridge/main.tf
index bc154638..31652877 100644
--- a/modules/kubernetes/tuya-bridge/main.tf
+++ b/modules/kubernetes/tuya-bridge/main.tf
@@ -10,6 +10,7 @@ resource "kubernetes_namespace" "tuya-bridge" {
     name = "tuya-bridge"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/uptime-kuma/main.tf b/modules/kubernetes/uptime-kuma/main.tf
index 2a5a3402..e6ad046f 100644
--- a/modules/kubernetes/uptime-kuma/main.tf
+++ b/modules/kubernetes/uptime-kuma/main.tf
@@ -4,6 +4,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "uptime-kuma" {
   metadata {
     name = "uptime-kuma"
+    labels = {
+      tier = var.tier
+    }
     # labels = {
     #   "istio-injection" : "enabled"
     # }
diff --git a/modules/kubernetes/url-shortener/main.tf b/modules/kubernetes/url-shortener/main.tf
index e692e224..da2e5190 100644
--- a/modules/kubernetes/url-shortener/main.tf
+++ b/modules/kubernetes/url-shortener/main.tf
@@ -18,6 +18,7 @@ resource "kubernetes_namespace" "shlink" {
     name = "url"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/vaultwarden/main.tf b/modules/kubernetes/vaultwarden/main.tf
index f478611a..06e7aedb 100644
--- a/modules/kubernetes/vaultwarden/main.tf
+++ b/modules/kubernetes/vaultwarden/main.tf
@@ -7,6 +7,7 @@ resource "kubernetes_namespace" "vaultwarden" {
     name = "vaultwarden"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/wealthfolio/main.tf b/modules/kubernetes/wealthfolio/main.tf
index f9733332..55b4db14 100644
--- a/modules/kubernetes/wealthfolio/main.tf
+++ b/modules/kubernetes/wealthfolio/main.tf
@@ -14,6 +14,7 @@ resource "kubernetes_namespace" "wealthfolio" {
     name = "wealthfolio"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
diff --git a/modules/kubernetes/webhook_handler/main.tf b/modules/kubernetes/webhook_handler/main.tf
index 5e742ab9..16158cd0 100644
--- a/modules/kubernetes/webhook_handler/main.tf
+++ b/modules/kubernetes/webhook_handler/main.tf
@@ -12,6 +12,9 @@ variable "ssh_key" {}
 resource "kubernetes_namespace" "webhook-handler" {
   metadata {
     name = "webhook-handler"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/whisper/main.tf b/modules/kubernetes/whisper/main.tf
index 1c148acd..ea67d40a 100644
--- a/modules/kubernetes/whisper/main.tf
+++ b/modules/kubernetes/whisper/main.tf
@@ -4,6 +4,9 @@ variable "tier" { type = string }
 resource "kubernetes_namespace" "whisper" {
   metadata {
     name = "whisper"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/wireguard/main.tf b/modules/kubernetes/wireguard/main.tf
index a84cc5c1..8f6165d3 100644
--- a/modules/kubernetes/wireguard/main.tf
+++ b/modules/kubernetes/wireguard/main.tf
@@ -13,6 +13,9 @@ module "tls_secret" {
 resource "kubernetes_namespace" "wireguard" {
   metadata {
     name = "wireguard"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 resource "kubernetes_config_map" "wg_0_conf" {
diff --git a/modules/kubernetes/xray/main.tf b/modules/kubernetes/xray/main.tf
index 10c666e1..e7dc3cac 100644
--- a/modules/kubernetes/xray/main.tf
+++ b/modules/kubernetes/xray/main.tf
@@ -19,6 +19,9 @@ module "tls_secret" {
 resource "kubernetes_namespace" "xray" {
   metadata {
     name = "xray"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 
diff --git a/modules/kubernetes/youtube_dl/main.tf b/modules/kubernetes/youtube_dl/main.tf
index 156cc66a..cd4f8518 100644
--- a/modules/kubernetes/youtube_dl/main.tf
+++ b/modules/kubernetes/youtube_dl/main.tf
@@ -9,6 +9,7 @@ resource "kubernetes_namespace" "ytdlp" {
     name = "ytdlp"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }