diff --git a/kube/deploy/apps/piped/app/hr.yaml b/kube/deploy/apps/piped/app/hr.yaml
index 0635d6ec24..cd0a348a7f 100644
--- a/kube/deploy/apps/piped/app/hr.yaml
+++ b/kube/deploy/apps/piped/app/hr.yaml
@@ -18,6 +18,7 @@ spec:
     podLabels:
       ingress.home.arpa/nginx-internal: "allow"
       ingress.home.arpa/nginx-external: "allow"
+      ingress.home.arpa/cloudflare: "allow"
       egress.home.arpa/nginx-internal: "allow"
       egress.home.arpa/nginx-external: "allow"
       db.home.arpa/pg: "pg-default"
diff --git a/kube/deploy/apps/piped/app/ingress.yaml b/kube/deploy/apps/piped/app/ingress.yaml
new file mode 100644
index 0000000000..c8da298536
--- /dev/null
+++ b/kube/deploy/apps/piped/app/ingress.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: excalidraw
+  namespace: excalidraw
+  annotations:
+    external-dns.alpha.kubernetes.io/target: "${DNS_CF}"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10
+spec:
+  ingressClassName: nginx-external
+  rules:
+  - host: &host "${APP_DNS_PIPED_BACKEND:=piped-backend}"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: piped-backend
+            port:
+              number: 8080
+  tls:
+  - hosts:
+    - draw.jjg.gg
+status:
+  loadBalancer:
+    ingress:
+    - ip: 10.12.34.80
diff --git a/kube/deploy/apps/piped/ks.yaml b/kube/deploy/apps/piped/ks.yaml
index 2220eeeeed..540e682c8e 100644
--- a/kube/deploy/apps/piped/ks.yaml
+++ b/kube/deploy/apps/piped/ks.yaml
@@ -7,7 +7,6 @@ metadata:
 spec:
   path: ./kube/deploy/apps/piped/app
   dependsOn:
-    - name: 1-core-ingress-nginx-app
     - name: 1-core-db-pg-clusters-default
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1