diff --git a/apps/external-homeassistant.yaml b/apps/external-homeassistant.yaml
new file mode 100644
index 0000000..6d85600
--- /dev/null
+++ b/apps/external-homeassistant.yaml
@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-homeassistant
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-homeassistant
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false
diff --git a/services/cloudfare-ddns/configmap.yaml b/services/cloudfare-ddns/configmap.yaml
index d645937..ca126d9 100644
--- a/services/cloudfare-ddns/configmap.yaml
+++ b/services/cloudfare-ddns/configmap.yaml
@@ -9,5 +9,5 @@ data:
   # Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
   # Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
   # die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
-  DOMAINS: "ns.labzand.com"
+  DOMAINS: "ns.labzand.com, ha.labzand.com"
   ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"
diff --git a/services/external-homeassistant/cert.yaml b/services/external-homeassistant/cert.yaml
new file mode 100644
index 0000000..e0dd004
--- /dev/null
+++ b/services/external-homeassistant/cert.yaml
@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ha-labzand
+  namespace: external
+spec:
+  secretName: ha-labzand-tls
+  dnsNames: ["ha.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer
diff --git a/services/external-homeassistant/ingress.yaml b/services/external-homeassistant/ingress.yaml
new file mode 100644
index 0000000..354f13c
--- /dev/null
+++ b/services/external-homeassistant/ingress.yaml
@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homeassistant
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ha.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ha-external
+            port:
+              number: 8123
+  tls:
+  - hosts:
+    - ha.labzand.com
+    secretName: ha-labzand-tls
diff --git a/services/external-homeassistant/ingressroute-redirect.yaml b/services/external-homeassistant/ingressroute-redirect.yaml
new file mode 100644
index 0000000..7f03e04
--- /dev/null
+++ b/services/external-homeassistant/ingressroute-redirect.yaml
@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ha-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ha.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService
diff --git a/services/external-homeassistant/service.yaml b/services/external-homeassistant/service.yaml
new file mode 100644
index 0000000..0121d2f
--- /dev/null
+++ b/services/external-homeassistant/service.yaml
@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ha-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8123
+      targetPort: 8123
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ha-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.146
+    ports:
+      - name: http
+        port: 8123
+        protocol: TCP