diff --git a/bootstrap/secrets.yaml.tpl b/bootstrap/secrets.yaml.tpl
index 627dcad4b5..7c6fdcad94 100644
--- a/bootstrap/secrets.yaml.tpl
+++ b/bootstrap/secrets.yaml.tpl
@@ -21,11 +21,3 @@ metadata:
 stringData:
   1password-credentials.json: op://Kubernetes/1password/OP_CREDENTIALS_JSON
   token: op://Kubernetes/1password/OP_CONNECT_TOKEN
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-tunnel-id-secret
-  namespace: networking
-stringData:
-  CLOUDFLARE_TUNNEL_ID: op://Kubernetes/cloudflare/CLOUDFLARE_TUNNEL_ID
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/externalsecret.yaml b/kubernetes/apps/networking/cloudflare-tunnel/app/externalsecret.yaml
deleted file mode 100644
index 84659b2386..0000000000
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/externalsecret.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: cloudflare-tunnel
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword
-  target:
-    name: cloudflare-tunnel-secret
-    template:
-      data:
-        TUNNEL_TOKEN: |
-          {{ toJson (dict "a" .CLOUDFLARE_ACCOUNT_TAG "t" .CLOUDFLARE_TUNNEL_ID "s" .CLOUDFLARE_TUNNEL_SECRET) | b64enc }}
-  dataFrom:
-    - extract:
-        key: cloudflare
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/grafanadashboard.yaml b/kubernetes/apps/networking/cloudflare-tunnel/app/grafanadashboard.yaml
deleted file mode 100644
index 4e98de8913..0000000000
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/grafanadashboard.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/grafana.integreatly.org/grafanadashboard_v1beta1.json
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: cloudflared
-spec:
-  allowCrossNamespaceImport: true
-  instanceSelector:
-    matchLabels:
-      grafana.internal/instance: grafana
-  datasources:
-    - datasourceName: prometheus
-      inputName: DS_PROMETHEUS
-  grafanaCom:
-    id: 17457
-    revision: 6
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/helmrelease.yaml b/kubernetes/apps/networking/cloudflare-tunnel/app/helmrelease.yaml
deleted file mode 100644
index 5d2f260912..0000000000
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/helmrelease.yaml
+++ /dev/null
@@ -1,92 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cloudflare-tunnel
-spec:
-  interval: 1h
-  chartRef:
-    kind: OCIRepository
-    name: cloudflare-tunnel
-  values:
-    controllers:
-      cloudflare-tunnel:
-        replicas: 1
-        strategy: RollingUpdate
-        annotations:
-          reloader.stakater.com/auto: "true"
-        containers:
-          app:
-            image:
-              repository: docker.io/cloudflare/cloudflared
-              tag: 2026.6.1@sha256:6d91c121b803126f7a5344005d17a9324788fc09d305b6e2560ec6040a7ae283
-            env:
-              NO_AUTOUPDATE: true
-              TUNNEL_METRICS: 0.0.0.0:8080
-              TUNNEL_ORIGIN_ENABLE_HTTP2: true
-              TUNNEL_POST_QUANTUM: true # disable when using http2
-              TUNNEL_TRANSPORT_PROTOCOL: quic # http2
-            envFrom:
-              - secretRef:
-                  name: "{{ .Release.Name }}-secret"
-            args:
-              - tunnel
-              - run
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /ready
-                    port: &port 8080
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: {drop: ["ALL"]}
-            resources:
-              requests:
-                cpu: 10m
-              limits:
-                memory: 256Mi
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-    service:
-      app:
-        ports:
-          http:
-            port: *port
-    serviceMonitor:
-      app:
-        endpoints:
-          - port: http
-    configMaps:
-      config:
-        data:
-          config.yaml: |-
-            ingress:
-              - hostname: ok8.sh
-                originRequest:
-                  originServerName: ok8.sh
-                service: https://envoy-external.{{ .Release.Namespace }}.svc.cluster.local:443
-              - hostname: "*.ok8.sh"
-                originRequest:
-                  originServerName: external.ok8.sh
-                service: https://envoy-external.{{ .Release.Namespace }}.svc.cluster.local:443
-              - service: http_status:404
-    persistence:
-      config-file:
-        type: configMap
-        identifier: config
-        globalMounts:
-          - path: /etc/cloudflared/config.yaml
-            subPath: config.yaml
\ No newline at end of file
diff --git a/kubernetes/apps/networking/envoy-gateway/app/policy/clienttrafficpolicy.yaml b/kubernetes/apps/networking/envoy-gateway/app/policy/clienttrafficpolicy.yaml
index a215179587..6b03fac690 100644
--- a/kubernetes/apps/networking/envoy-gateway/app/policy/clienttrafficpolicy.yaml
+++ b/kubernetes/apps/networking/envoy-gateway/app/policy/clienttrafficpolicy.yaml
@@ -12,6 +12,8 @@ spec:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: external
+  proxyProtocol:
+    optional: true
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
diff --git a/kubernetes/apps/networking/kustomization.yaml b/kubernetes/apps/networking/kustomization.yaml
index 440462de23..23557a436b 100644
--- a/kubernetes/apps/networking/kustomization.yaml
+++ b/kubernetes/apps/networking/kustomization.yaml
@@ -9,8 +9,8 @@ replacements:
   - path: ../../components/replacements/ks.yaml
 resources:
   - ./cloudflare-dns/ks.yaml
-  - ./cloudflare-tunnel/ks.yaml
   - ./echo/ks.yaml
   - ./envoy-gateway/ks.yaml
   - ./multus/ks.yaml
+  - ./towonel-agent/ks.yaml
   - ./unifi-dns/ks.yaml
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/dnsendpoint.yaml b/kubernetes/apps/networking/towonel-agent/app/dnsendpoint.yaml
similarity index 68%
rename from kubernetes/apps/networking/cloudflare-tunnel/app/dnsendpoint.yaml
rename to kubernetes/apps/networking/towonel-agent/app/dnsendpoint.yaml
index 88c1c94ec3..27d2658b7f 100644
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/dnsendpoint.yaml
+++ b/kubernetes/apps/networking/towonel-agent/app/dnsendpoint.yaml
@@ -3,11 +3,13 @@
 apiVersion: externaldns.k8s.io/v1alpha1
 kind: DNSEndpoint
 metadata:
-  name: cloudflared
+  name: towonel-agent
   labels:
     thisisstupid.ok8.sh: external
+  annotations:
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec:
   endpoints:
     - dnsName: external.ok8.sh
       recordType: CNAME
-      targets: ["${CLOUDFLARE_TUNNEL_MAIN_ID}.cfargotunnel.com"]
+      targets: ["edge-na.towonel.dev"]
diff --git a/kubernetes/apps/networking/towonel-agent/app/externalsecret.yaml b/kubernetes/apps/networking/towonel-agent/app/externalsecret.yaml
new file mode 100644
index 0000000000..5ab3b4394a
--- /dev/null
+++ b/kubernetes/apps/networking/towonel-agent/app/externalsecret.yaml
@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: towonel-agent-secret
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: towonel-agent-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: TOWONEL_INVITE_TOKEN
+      remoteRef:
+        key: towonel-tunnel
+        property: invite_token
diff --git a/kubernetes/apps/networking/towonel-agent/app/helmrelease.yaml b/kubernetes/apps/networking/towonel-agent/app/helmrelease.yaml
new file mode 100644
index 0000000000..c6dba460aa
--- /dev/null
+++ b/kubernetes/apps/networking/towonel-agent/app/helmrelease.yaml
@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: towonel-agent
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: towonel-agent
+  interval: 1h
+  values:
+    replicaCount: 2
+    deploymentAnnotations:
+      reloader.stakater.com/auto: "true"
+    agent:
+      logLevel: info
+      healthPort: 9090
+      services:
+        - hostname: "*.ok8.sh"
+          origin: envoy-external.networking.svc.cluster.local:443
+      inviteTokenSecret:
+        name: towonel-agent-secret
+        key: TOWONEL_INVITE_TOKEN
+    monitoring:
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+      prometheusRule:
+        enabled: true
+      dashboards:
+        enabled: true
+        grafanaOperator:
+          enabled: true
+          allowCrossNamespaceImport: true
+          matchLabels:
+            grafana.internal/instance: grafana
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/kustomization.yaml b/kubernetes/apps/networking/towonel-agent/app/kustomization.yaml
similarity index 81%
rename from kubernetes/apps/networking/cloudflare-tunnel/app/kustomization.yaml
rename to kubernetes/apps/networking/towonel-agent/app/kustomization.yaml
index 75ea03d4b4..043421fbb6 100644
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/kustomization.yaml
+++ b/kubernetes/apps/networking/towonel-agent/app/kustomization.yaml
@@ -3,8 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./externalsecret.yaml
   - ./dnsendpoint.yaml
+  - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./grafanadashboard.yaml
-  - ./ocirepository.yaml
\ No newline at end of file
+  - ./ocirepository.yaml
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/app/ocirepository.yaml b/kubernetes/apps/networking/towonel-agent/app/ocirepository.yaml
similarity index 77%
rename from kubernetes/apps/networking/cloudflare-tunnel/app/ocirepository.yaml
rename to kubernetes/apps/networking/towonel-agent/app/ocirepository.yaml
index 23a8f8376f..7820ba75c4 100644
--- a/kubernetes/apps/networking/cloudflare-tunnel/app/ocirepository.yaml
+++ b/kubernetes/apps/networking/towonel-agent/app/ocirepository.yaml
@@ -3,12 +3,12 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: OCIRepository
 metadata:
-  name: cloudflare-tunnel
+  name: towonel-agent
 spec:
   interval: 15m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 5.0.1
-  url: oci://ghcr.io/bjw-s-labs/helm/app-template
\ No newline at end of file
+    tag: 0.1.27
+  url: oci://codeberg.org/towonel/charts/towonel-agent
diff --git a/kubernetes/apps/networking/cloudflare-tunnel/ks.yaml b/kubernetes/apps/networking/towonel-agent/ks.yaml
similarity index 74%
rename from kubernetes/apps/networking/cloudflare-tunnel/ks.yaml
rename to kubernetes/apps/networking/towonel-agent/ks.yaml
index 4e42723374..f3c4c2e0f6 100644
--- a/kubernetes/apps/networking/cloudflare-tunnel/ks.yaml
+++ b/kubernetes/apps/networking/towonel-agent/ks.yaml
@@ -3,7 +3,7 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app cloudflare-tunnel
+  name: &app towonel-agent
   namespace: &namespace networking
   labels:
     substitution.flux.home.arpa/enabled: "true"
@@ -15,11 +15,7 @@ spec:
   dependsOn:
     - name: onepassword
       namespace: external-secrets
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: cloudflare-tunnel-id-secret
-  path: ./kubernetes/apps/networking/cloudflare-tunnel/app
+  path: ./kubernetes/apps/networking/towonel-agent/app
   prune: false
   wait: true
   interval: 30m