diff --git a/apps/external-autotune.yaml b/apps/external-autotune.yaml
new file mode 100644
index 0000000..11313d1
--- /dev/null
+++ b/apps/external-autotune.yaml
@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-autotune
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-autotune
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false
\ No newline at end of file
diff --git a/services/external/external-autotune/cert.yaml b/services/external/external-autotune/cert.yaml
new file mode 100644
index 0000000..efa23e7
--- /dev/null
+++ b/services/external/external-autotune/cert.yaml
@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-autotune-labzand
+  namespace: external
+spec:
+  secretName: external-autotune-labzand-tls
+  dnsNames: ["autotune.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer
\ No newline at end of file
diff --git a/services/external/external-autotune/ingressroute-redirect.yaml b/services/external/external-autotune/ingressroute-redirect.yaml
new file mode 100644
index 0000000..454f0aa
--- /dev/null
+++ b/services/external/external-autotune/ingressroute-redirect.yaml
@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-autotune-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`autotune.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService
diff --git a/services/external/external-autotune/ingressroute.yaml b/services/external/external-autotune/ingressroute.yaml
new file mode 100644
index 0000000..cd4818e
--- /dev/null
+++ b/services/external/external-autotune/ingressroute.yaml
@@ -0,0 +1,29 @@
+# autotune (:8043) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: autotune-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-autotune
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-autotune-labzand-tls
+  routes:
+    - match: Host(`autotune.labzand.com`)
+      kind: Rule
+      services:
+        - name: autotune-external
+          port: 8502
+          scheme: https
+          serversTransport: autotune-insecure
diff --git a/services/external/external-autotune/service.yaml b/services/external/external-autotune/service.yaml
new file mode 100644
index 0000000..a0751d1
--- /dev/null
+++ b/services/external/external-autotune/service.yaml
@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: autotune-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8502
+      targetPort: 8502
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: autotune-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.51
+    ports:
+      - name: http
+        port: 8502
+        protocol: TCP