diff --git a/servarr-system/servarr.yaml b/servarr-system/servarr.yaml
index a8a28eb..5f24bd8 100644
--- a/servarr-system/servarr.yaml
+++ b/servarr-system/servarr.yaml
@@ -3,313 +3,17 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: servarr-system
-  labels:
-    app.kubernetes.io/managed-by: argocd
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prowlarr-config
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: prowlarr
-data:
-  prowlarr-config.json: |
-    {"apiKey":"c04914c6bfad445a3edc23e5edbca4d1","applications":[{"apiKey":"2bac5d00dca43258313c734821a15c4c","baseUrl":"http://sonarr.servarr-system.svc:8989","name":"Sonarr","prowlarrUrl":"http://prowlarr.servarr-system.svc:9696","syncLevel":"fullSync"},{"apiKey":"4fac7d10eca54269424d835a2edc15d2","baseUrl":"http://radarr.servarr-system.svc:7878","name":"Radarr","prowlarrUrl":"http://prowlarr.servarr-system.svc:9696","syncLevel":"fullSync"}],"indexers":[{"enable":true,"name":"nCore","priority":25}]}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: qbittorrent-config
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/instance: preparr
-    app.kubernetes.io/name: preparr
-    app: qbittorrent
-data:
-  qbittorrent-config.json: |
-    {}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr-config
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: radarr
-data:
-  radarr-config.json: |
-    {"apiKey":"4fac7d10eca54269424d835a2edc15d2","downloadClients":[{"configContract":"QBittorrentSettings","enable":true,"fields":[{"name":"host","value":"__QBIT_HOST__"},{"name":"port","value":8080},{"name":"username","value":"__QBIT_USER__"},{"name":"password","value":"__QBIT_PASS__"},{"name":"category","value":"movies"}],"implementation":"QBittorrent","implementationName":"qBittorrent","name":"qBittorrent","priority":1}],"prowlarrSync":true,"qualityProfiles":[{"cutoff":1080,"items":[{"allowed":true,"quality":{"id":1,"name":"Bluray-1080p"}},{"allowed":true,"quality":{"id":2,"name":"WEBDL-1080p"}}],"name":"HD - 1080p","upgradeAllowed":true}],"rootFolders":[{"accessible":true,"path":"/movies"}]}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: sonarr-config
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: sonarr
-data:
-  sonarr-config.json: |
-    {"apiKey":"2bac5d00dca43258313c734821a15c4c","downloadClients":[{"configContract":"QBittorrentSettings","enable":true,"fields":[{"name":"host","value":"__QBIT_HOST__"},{"name":"port","value":8080},{"name":"username","value":"__QBIT_USER__"},{"name":"password","value":"__QBIT_PASS__"},{"name":"category","value":"tv"}],"implementation":"QBittorrent","implementationName":"qBittorrent","name":"qBittorrent","priority":1}],"prowlarrSync":true,"qualityProfiles":[{"cutoff":1080,"items":[{"allowed":true,"quality":{"id":1,"name":"HDTV-1080p"}},{"allowed":true,"quality":{"id":2,"name":"WEBDL-1080p"}}],"name":"HD - 1080p","upgradeAllowed":true}],"rootFolders":[{"accessible":true,"path":"/tv"}]}
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config-pvc
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: radarr
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config-pvc
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: sonarr
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config-pvc
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: qbittorrent
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config-pvc
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: prowlarr
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgres-pvc
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: postgres
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 8Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: postgres
-spec:
-  type: ClusterIP
-  selector:
-    app: postgres
-  ports:
-    - port: 5432
-      targetPort: 5432
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: prowlarr
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: prowlarr.home
-spec:
-  type: LoadBalancer
-  loadBalancerIP: 192.168.0.201
-  selector:
-    app: prowlarr
-  ports:
-    - name: webui
-      port: 9696
-      targetPort: 9696
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: qbittorrent
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: qbittorrent.home
-spec:
-  type: LoadBalancer
-  loadBalancerIP: 192.168.0.202
-  selector:
-    app: qbittorrent
-  ports:
-    - name: webui
-      port: 8080
-      targetPort: 8080
-    - name: bittorrent
-      port: 6881
-      targetPort: 6881
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: radarr
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: radarr.home
-spec:
-  type: ClusterIP
-  selector:
-    app: radarr
-  ports:
-    - name: webui
-      port: 7878
-      targetPort: 7878
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: sonarr
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: sonarr.home
-spec:
-  type: ClusterIP
-  selector:
-    app: sonarr
-  ports:
-    - name: webui
-      port: 8989
-      targetPort: 8989
-      protocol: TCP
 ---
+# Prowlarr - Indexer Manager
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: postgres
-  namespace: servarr-system
   labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: postgres
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: postgres
-  template:
-    metadata:
-      labels:
-        app: postgres
-    spec:
-      containers:
-      - name: postgres
-        image: "postgres:16-alpine"
-        envFrom:
-        - secretRef:
-            name: postgres-credentials
-        ports:
-        - containerPort: 5432
-        resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        volumeMounts:
-        - name: postgres-data
-          mountPath: /var/lib/postgresql/data
-          subPath: data
-        readinessProbe:
-          exec:
-            command:
-              - pg_isready
-              - -U
-              - postgres
-          initialDelaySeconds: 5
-          periodSeconds: 5
-      volumes:
-      - name: postgres-data
-        persistentVolumeClaim:
-          claimName: postgres-pvc
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
+    app: prowlarr
+    app.kubernetes.io/instance: servarr
+    app.kubernetes.io/name: prowlarr
   name: prowlarr
   namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: prowlarr
 spec:
   replicas: 1
   selector:
@@ -322,71 +26,26 @@ spec:
       labels:
         app: prowlarr
     spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-      - name: preparr-init
-        image: ghcr.io/robbeverhelst/preparr:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: POSTGRES_HOST
-          value: "postgres"
-        - name: POSTGRES_PORT
-          value: "5432"
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_USER
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_PASSWORD
-        - name: POSTGRES_DB
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_DB
-        - name: SERVARR_URL
-          value: "http://prowlarr.servarr-system.svc:9696"
-        - name: SERVARR_TYPE
-          value: "prowlarr"
-        - name: SERVARR_ADMIN_USER
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: username
-        - name: SERVARR_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: password
-        - name: SERVARR_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: servarr-api-keys
-              key: prowlarr
-        - name: CONFIG_PATH
-          value: "/tmp/config/prowlarr-config.json"
-        command: ["/bin/sh", "-c", "if [ ! -f /config/prowlarr-config.json ]; then cp /tmp/config/prowlarr-config.json /config/prowlarr-config.json; fi; bun run dist/index.js --init"]
-        volumeMounts:
-        - name: prowlarr-config-volume
-          mountPath: /config
-        - name: prowlarr-config-file
-          mountPath: /tmp/config
       containers:
       - name: prowlarr
-        image: "linuxserver/prowlarr:latest"
+        image: linuxserver/prowlarr:latest
+        imagePullPolicy: Always
         env:
         - name: PUID
           value: "1000"
         - name: PGID
           value: "1000"
         - name: TZ
-          value: "Europe/Budapest"
+          value: Europe/Budapest
         ports:
         - containerPort: 9696
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 9696
+          initialDelaySeconds: 60
+          periodSeconds: 10
         resources:
           limits:
             cpu: 500m
@@ -395,172 +54,25 @@ spec:
             cpu: 100m
             memory: 256Mi
         volumeMounts:
-        - name: prowlarr-config-volume
+        - name: config
           mountPath: /config
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: 9696
-          initialDelaySeconds: 60
-          periodSeconds: 10
+      securityContext:
+        fsGroup: 1000
       volumes:
-      - name: prowlarr-config-volume
+      - name: config
         persistentVolumeClaim:
           claimName: prowlarr-config-pvc
-      - name: prowlarr-config-file
-        configMap:
-          name: prowlarr-config
-          items:
-          - key: prowlarr-config.json
-            path: prowlarr-config.json
 ---
+# Radarr - Movie Manager
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: qbittorrent
-  namespace: servarr-system
   labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: qbittorrent
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: qbittorrent
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      initContainers:
-      - name: preparr-init
-        image: ghcr.io/robbeverhelst/preparr:latest
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          runAsUser: 0
-          runAsGroup: 0
-        env:
-        - name: POSTGRES_HOST
-          value: "postgres"
-        - name: POSTGRES_PORT
-          value: "5432"
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_USER
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_PASSWORD
-        - name: POSTGRES_DB
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_DB
-        - name: SERVARR_TYPE
-          value: "qbittorrent"
-        - name: QBITTORRENT_USER
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-username
-        - name: QBITTORRENT_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-password
-        - name: SERVARR_ADMIN_USER
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: username
-        - name: SERVARR_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: password
-        - name: QBITTORRENT_URL
-          value: "http://qbittorrent.servarr-system.svc:8080"
-        - name: CONFIG_PATH
-          value: "/config/qbittorrent-config.json"
-        - name: QBITTORRENT_DOWNLOADS_PATH
-          value: "/downloads"
-        command: ["/bin/sh", "-c", "if [ ! -f /config/qbittorrent-config.json ]; then cp /tmp/config/qbittorrent-config.json /config/qbittorrent-config.json; fi; bun run dist/index.js --init"]
-        volumeMounts:
-        - name: qbittorrent-config-volume
-          mountPath: /config
-        - name: qbittorrent-config-file
-          mountPath: /tmp/config
-      containers:
-      - name: qbittorrent
-        image: "linuxserver/qbittorrent:latest"
-        env:
-        - name: PUID
-          value: "1000"
-        - name: PGID
-          value: "1000"
-        - name: TZ
-          value: "Europe/Budapest"
-        - name: WEBUI_PORT
-          value: "8080"
-        - name: CONFIG_PATH
-          value: "/config/qbittorrent-config.json"
-        ports:
-        - containerPort: 8080
-        - containerPort: 6881
-        resources:
-          limits:
-            cpu: 1000m
-            memory: 1Gi
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        volumeMounts:
-        - name: qbittorrent-config-volume
-          mountPath: /config
-        - mountPath: /mnt/2_hdd
-          name: 2hdd
-        - mountPath: /mnt/1_hdd
-          name: 1hdd
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 8080
-          initialDelaySeconds: 30
-          periodSeconds: 10
-      volumes:
-      - name: qbittorrent-config-volume
-        persistentVolumeClaim:
-          claimName: qbittorrent-config-pvc
-      - name: qbittorrent-config-file
-        configMap:
-          name: qbittorrent-config
-          items:
-          - key: qbittorrent-config.json
-            path: qbittorrent-config.json
-      - hostPath:
-          path: /mnt/2_hdd
-          type: Directory
-        name: 2hdd
-      - hostPath:
-          path: /mnt/1_hdd
-          type: Directory
-        name: 1hdd
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
+    app: radarr
+    app.kubernetes.io/instance: servarr
+    app.kubernetes.io/name: radarr
   name: radarr
   namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: radarr
 spec:
   replicas: 1
   selector:
@@ -573,104 +85,26 @@ spec:
       labels:
         app: radarr
     spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-      - name: preparr-init
-        image: ghcr.io/robbeverhelst/preparr:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: POSTGRES_HOST
-          value: "postgres"
-        - name: POSTGRES_PORT
-          value: "5432"
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_USER
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_PASSWORD
-        - name: POSTGRES_DB
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_DB
-        - name: SERVARR_URL
-          value: "http://radarr.servarr-system.svc:7878"
-        - name: SERVARR_TYPE
-          value: "radarr"
-        - name: SERVARR_ADMIN_USER
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: username
-        - name: SERVARR_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: password
-        - name: SERVARR_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: servarr-api-keys
-              key: radarr
-        - name: CONFIG_PATH
-          value: "/config/radarr-config.json"
-        - name: QBIT_HOST
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-host
-        - name: QBIT_USER
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-username
-        - name: QBIT_PASS
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-password
-        command:
-        - /bin/sh
-        - -c
-        - |
-          if [ ! -f /config/radarr-config.json ]; then
-            # Copy template and inject secrets
-            sed -e "s|__QBIT_HOST__|$QBIT_HOST|g" \
-                -e "s|__QBIT_USER__|$QBIT_USER|g" \
-                -e "s|__QBIT_PASS__|$QBIT_PASS|g" \
-                /tmp/config/radarr-config.json > /config/radarr-config.json
-          fi
-          bun run dist/index.js --init
-          if [ -f /config/config.xml ]; then
-            sed -i 's|<AuthenticationMethod>Forms</AuthenticationMethod>|<AuthenticationMethod>External</AuthenticationMethod>|g' /config/config.xml
-            sed -i 's|<AuthenticationRequired>Enabled</AuthenticationRequired>|<AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>|g' /config/config.xml
-            echo "Patched config.xml for external authentication"
-          fi
-        volumeMounts:
-        - name: radarr-config-volume
-          mountPath: /config
-        - name: radarr-config-file
-          mountPath: /tmp/config
-        - mountPath: /mnt/2_hdd
-          name: 2hdd
       containers:
       - name: radarr
-        image: "linuxserver/radarr:latest"
+        image: linuxserver/radarr:latest
+        imagePullPolicy: Always
         env:
         - name: PUID
           value: "1000"
         - name: PGID
           value: "1000"
         - name: TZ
-          value: "Europe/Budapest"
+          value: Europe/Budapest
         ports:
         - containerPort: 7878
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 7878
+          initialDelaySeconds: 60
+          periodSeconds: 10
         resources:
           limits:
             cpu: 500m
@@ -679,41 +113,31 @@ spec:
             cpu: 100m
             memory: 256Mi
         volumeMounts:
-        - name: radarr-config-volume
+        - name: config
           mountPath: /config
-        - mountPath: /mnt/2_hdd
-          name: 2hdd
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: 7878
-          initialDelaySeconds: 60
-          periodSeconds: 10
+        - name: movies
+          mountPath: /mnt/2_hdd
+      securityContext:
+        fsGroup: 1000
       volumes:
-      - name: radarr-config-volume
+      - name: config
         persistentVolumeClaim:
           claimName: radarr-config-pvc
-      - name: radarr-config-file
-        configMap:
-          name: radarr-config
-          items:
-          - key: radarr-config.json
-            path: radarr-config.json
-      - hostPath:
+      - name: movies
+        hostPath:
           path: /mnt/2_hdd
           type: Directory
-        name: 2hdd
 ---
-# Source: preparr/templates/sonarr.yaml
+# Sonarr - TV Show Manager
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  labels:
+    app: sonarr
+    app.kubernetes.io/instance: servarr
+    app.kubernetes.io/name: sonarr
   name: sonarr
   namespace: servarr-system
-  labels:
-    app.kubernetes.io/name: preparr
-    app.kubernetes.io/instance: preparr
-    app: sonarr
 spec:
   replicas: 1
   selector:
@@ -726,95 +150,9 @@ spec:
       labels:
         app: sonarr
     spec:
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-      - name: preparr-init
-        image: ghcr.io/robbeverhelst/preparr:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: POSTGRES_HOST
-          value: "postgres"
-        - name: POSTGRES_PORT
-          value: "5432"
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_USER
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_PASSWORD
-        - name: POSTGRES_DB
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: POSTGRES_DB
-        - name: SERVARR_URL
-          value: "http://sonarr.servarr-system.svc:8989"
-        - name: SERVARR_TYPE
-          value: "sonarr"
-        - name: SERVARR_ADMIN_USER
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: username
-        - name: SERVARR_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: servarr-credentials
-              key: password
-        - name: SERVARR_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: servarr-api-keys
-              key: sonarr
-        - name: CONFIG_PATH
-          value: "/config/sonarr-config.json"
-        - name: QBIT_HOST
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-host
-        - name: QBIT_USER
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-username
-        - name: QBIT_PASS
-          valueFrom:
-            secretKeyRef:
-              name: download-client-credentials
-              key: qbittorrent-password
-        command:
-        - /bin/sh
-        - -c
-        - |
-          if [ ! -f /config/sonarr-config.json ]; then
-            # Copy template and inject secrets
-            sed -e "s|__QBIT_HOST__|$QBIT_HOST|g" \
-                -e "s|__QBIT_USER__|$QBIT_USER|g" \
-                -e "s|__QBIT_PASS__|$QBIT_PASS|g" \
-                /tmp/config/sonarr-config.json > /config/sonarr-config.json
-          fi
-          bun run dist/index.js --init
-          if [ -f /config/config.xml ]; then
-            sed -i 's|<AuthenticationMethod>Forms</AuthenticationMethod>|<AuthenticationMethod>External</AuthenticationMethod>|g' /config/config.xml
-            sed -i 's|<AuthenticationRequired>Enabled</AuthenticationRequired>|<AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>|g' /config/config.xml
-            echo "Patched config.xml for external authentication"
-          fi
-        volumeMounts:
-        - name: sonarr-config-volume
-          mountPath: /config
-        - name: sonarr-config-file
-          mountPath: /tmp/config
-        - mountPath: /mnt/1_hdd
-          name: 1hdd
       containers:
       - name: sonarr
-        image: "linuxserver/sonarr:latest"
+        image: linuxserver/sonarr:latest
         imagePullPolicy: IfNotPresent
         env:
         - name: PUID
@@ -822,11 +160,17 @@ spec:
         - name: PGID
           value: "1000"
         - name: TZ
-          value: "Europe/Budapest"
+          value: Europe/Budapest
         ports:
-        - name: webui
-          containerPort: 8989
+        - containerPort: 8989
+          name: webui
           protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 8989
+          initialDelaySeconds: 60
+          periodSeconds: 10
         resources:
           limits:
             cpu: 500m
@@ -835,87 +179,267 @@ spec:
             cpu: 100m
             memory: 256Mi
         volumeMounts:
-        - name: sonarr-config-volume
+        - name: config
           mountPath: /config
-        - mountPath: /mnt/1_hdd
-          name: 1hdd
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: 8989
-          initialDelaySeconds: 60
-          periodSeconds: 10
+        - name: tv
+          mountPath: /mnt/1_hdd
+      securityContext:
+        fsGroup: 1000
       volumes:
-      - name: sonarr-config-volume
+      - name: config
         persistentVolumeClaim:
           claimName: sonarr-config-pvc
-      - name: sonarr-config-file
-        configMap:
-          name: sonarr-config
-          items:
-          - key: sonarr-config.json
-            path: sonarr-config.json
-      - hostPath:
+      - name: tv
+        hostPath:
           path: /mnt/1_hdd
           type: Directory
-        name: 1hdd
 ---
+# qBittorrent - Download Client
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: qbittorrent
+    app.kubernetes.io/instance: servarr
+    app.kubernetes.io/name: qbittorrent
+  name: qbittorrent
+  namespace: servarr-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: qbittorrent
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      containers:
+      - name: qbittorrent
+        image: linuxserver/qbittorrent:latest
+        imagePullPolicy: Always
+        env:
+        - name: PUID
+          value: "1000"
+        - name: PGID
+          value: "1000"
+        - name: TZ
+          value: Europe/Budapest
+        - name: WEBUI_PORT
+          value: "8080"
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        - containerPort: 6881
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8080
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        resources:
+          limits:
+            cpu: "1"
+            memory: 1Gi
+          requests:
+            cpu: 100m
+            memory: 256Mi
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: 2hdd
+          mountPath: /mnt/2_hdd
+        - name: 1hdd
+          mountPath: /mnt/1_hdd
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: qbittorrent-config-pvc
+      - name: 2hdd
+        hostPath:
+          path: /mnt/2_hdd
+          type: Directory
+      - name: 1hdd
+        hostPath:
+          path: /mnt/1_hdd
+          type: Directory
+---
+# Services
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: prowlarr
+  name: prowlarr
+  namespace: servarr-system
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 9696
+    protocol: TCP
+    targetPort: 9696
+  selector:
+    app: prowlarr
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: radarr
+  name: radarr
+  namespace: servarr-system
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 7878
+    protocol: TCP
+    targetPort: 7878
+  selector:
+    app: radarr
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: sonarr
+  name: sonarr
+  namespace: servarr-system
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 8989
+    protocol: TCP
+    targetPort: 8989
+  selector:
+    app: sonarr
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: qbittorrent
+  name: qbittorrent
+  namespace: servarr-system
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  - name: torrent
+    port: 6881
+    protocol: TCP
+    targetPort: 6881
+  selector:
+    app: qbittorrent
+---
+# Ingresses with Authentik proxy auth
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    external-dns.alpha.kubernetes.io/hostname: qbittorrent.home,qbittorrent.dooplex.hu
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/auth-url: "http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx"
-    nginx.ingress.kubernetes.io/auth-signin: "https://qbittorrent.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri"
-    nginx.ingress.kubernetes.io/auth-response-headers: "Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email"
+    external-dns.alpha.kubernetes.io/hostname: prowlarr.dooplex.hu,prowlarr.home
+    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
+    nginx.ingress.kubernetes.io/auth-signin: https://prowlarr.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
-  name: qbittorrent
+    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  name: prowlarr
   namespace: servarr-system
 spec:
   ingressClassName: nginx-internal
   rules:
-  - host: qbittorrent.dooplex.hu
+  - host: prowlarr.dooplex.hu
     http:
       paths:
       - backend:
           service:
-            name: qbittorrent
+            name: prowlarr
             port:
-              number: 8080
+              number: 9696
         path: /
         pathType: Prefix
-  - host: qbittorrent.home
+  - host: prowlarr.home
     http:
       paths:
       - backend:
           service:
-            name: qbittorrent
+            name: prowlarr
             port:
-              number: 8080
+              number: 9696
         path: /
         pathType: Prefix
   tls:
   - hosts:
-    - qbittorrent.dooplex.hu
-    secretName: qbittorrent-tls
+    - prowlarr.dooplex.hu
+    secretName: prowlarr-tls
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    external-dns.alpha.kubernetes.io/hostname: sonarr.home,sonarr.dooplex.hu
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/auth-url: "http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx"
-    nginx.ingress.kubernetes.io/auth-signin: "https://sonarr.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri"
-    nginx.ingress.kubernetes.io/auth-response-headers: "Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,Authorization"
+    external-dns.alpha.kubernetes.io/hostname: radarr.dooplex.hu,radarr.home
+    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
+    nginx.ingress.kubernetes.io/auth-signin: https://radarr.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  name: radarr
+  namespace: servarr-system
+spec:
+  ingressClassName: nginx-internal
+  rules:
+  - host: radarr.dooplex.hu
+    http:
+      paths:
+      - backend:
+          service:
+            name: radarr
+            port:
+              number: 7878
+        path: /
+        pathType: Prefix
+  - host: radarr.home
+    http:
+      paths:
+      - backend:
+          service:
+            name: radarr
+            port:
+              number: 7878
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - radarr.dooplex.hu
+    secretName: radarr-tls
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    external-dns.alpha.kubernetes.io/hostname: sonarr.dooplex.hu,sonarr.home
+    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,Authorization
+    nginx.ingress.kubernetes.io/auth-signin: https://sonarr.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-snippet: |
+      proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
   name: sonarr
   namespace: servarr-system
 spec:
@@ -951,52 +475,117 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    external-dns.alpha.kubernetes.io/hostname: radarr.home,radarr.dooplex.hu
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/auth-url: "http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx"
-    nginx.ingress.kubernetes.io/auth-signin: "https://radarr.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri"
-    nginx.ingress.kubernetes.io/auth-response-headers: "Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email"
+    external-dns.alpha.kubernetes.io/hostname: qbittorrent.dooplex.hu,qbittorrent.home
+    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
+    nginx.ingress.kubernetes.io/auth-signin: https://qbittorrent.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
-  name: radarr
+    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  name: qbittorrent
   namespace: servarr-system
 spec:
   ingressClassName: nginx-internal
   rules:
-  - host: radarr.dooplex.hu
+  - host: qbittorrent.dooplex.hu
     http:
       paths:
       - backend:
           service:
-            name: radarr
+            name: qbittorrent
             port:
-              number: 7878
+              number: 8080
         path: /
         pathType: Prefix
-  - host: radarr.home
+  - host: qbittorrent.home
     http:
       paths:
       - backend:
           service:
-            name: radarr
+            name: qbittorrent
             port:
-              number: 7878
+              number: 8080
         path: /
         pathType: Prefix
   tls:
   - hosts:
-    - radarr.dooplex.hu
-    secretName: radarr-tls
+    - qbittorrent.dooplex.hu
+    secretName: qbittorrent-tls
 ---
+# PVCs for config (keep existing, add Prune=false to prevent deletion)
 apiVersion: v1
-kind: Service
+kind: PersistentVolumeClaim
 metadata:
-  name: ak-outpost-arr-outpost
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+  labels:
+    app: prowlarr
+    recurring-job-group.longhorn.io/needbackup: enabled
+    recurring-job.longhorn.io/source: enabled
+  name: prowlarr-config-pvc
   namespace: servarr-system
 spec:
-  type: ExternalName
-  externalName: ak-outpost-arr-outpost.auth-system.svc.cluster.local
-  ports:
-  - port: 9000
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+  labels:
+    app: radarr
+    recurring-job-group.longhorn.io/needbackup: enabled
+    recurring-job.longhorn.io/source: enabled
+  name: radarr-config-pvc
+  namespace: servarr-system
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 3Gi
+  storageClassName: longhorn
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+  labels:
+    app: sonarr
+    recurring-job-group.longhorn.io/needbackup: enabled
+    recurring-job.longhorn.io/source: enabled
+  name: sonarr-config-pvc
+  namespace: servarr-system
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+  labels:
+    app: qbittorrent
+    recurring-job-group.longhorn.io/needbackup: enabled
+    recurring-job.longhorn.io/source: enabled
+  name: qbittorrent-config-pvc
+  namespace: servarr-system
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn