diff --git a/clusters/base/apps/mosquitto/secret.enc.yaml b/clusters/base/apps/mosquitto/secret.enc.yaml
index c853779..1ceb08a 100644
--- a/clusters/base/apps/mosquitto/secret.enc.yaml
+++ b/clusters/base/apps/mosquitto/secret.enc.yaml
@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:65N11XyiHZ+/OMVh8GSndKnLZf3Zq+Pf+jLHlz6HT+iyYn+PcMB7lBs7kmexCTwGLEtIdREHb4tW2fz0QSoDNIQTYeML+9CHDf4h4ipJEc+FvfUzY5oFGyAiLMzQzNbu0gS3B/2cuYRxeadA8xDw/uSFIdbkJqmySG8EB4AqnBTuIhlZkGl2R7uLvoMt9oRLWwERLk0VYPyCzCfYjAzm/X3mupUffn9HbWha3l8NnJnvPP6aBjINU9ft2ev3Zw==,iv:2jx1k0L15L1OrOCJMVenYYFOgGE8E678TeJnNJkchH8=,tag:/27Mrs1VZOw/JzgoYPb9pg==,type:str]
+    passwd: ENC[AES256_GCM,data:n4mdp9w3mi5p3qcLORSPlsi6FWtBWJpX9OIVQ6UikgoQFRBRsqzmq7Cq8MBNtMxrYgdbNgb8OZ+sDnfYFZojl5dX24+Fjqq7SIyS5z0w7OPnvAjux7ABywnyPQA/rztt3qZDGqmBPOMUs3Au08dgvOgbPLGHMoaseKu8qtwNHDTQ6E1qXo8FjpFIJJODsBKOdxc0KOHdhpnxFPcsYKC8T5Lg7Qg0nE3p6mYJ1qiDkiSFI/nVFyAzVPnbM7ZCyg==,iv:CwMek58B8U3wxmmPNxTB5emMwmpiHmeg59Yr/LYr8bo=,tag:p3+lAVVpyhf1bnWDjOdbAg==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEc0p0bVl2MmlJUEtvMmFD
-            Umh2Tm85S2pKcFczVVc2bURGdGRPUUFKTjI0CmtSSE1sc08vL2tGc3Z2dUdRbFJY
-            aDRXaG40OVBiV0Q3NlJRTXBDdS92bVkKLS0tICtYL25sdGJPT1VML1dickZQaDZh
-            Z3R6bE9UUFZVVXpNM3BmUXFreUVoWWcKpCuxapn2aHvLcUnjj89QzrWLDNFNXTxz
-            zcXMws6PzKn+0jMNVyh/5oN1AbG2Y33jX5ioIR8Q0bAT4+lyglv4vw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UFh0QXBBVEpGR0F6d1Rj
+            RkhaMVpybDBzRTNJZzhwamJORlZFSHdSN3ljCmtBR0gyWHpxVDFBR2t1cStLWnla
+            bENBVW1yNHVMWXRqTXhYcEJXTjd0aWsKLS0tIFJBS2F3aEt0TkNiN0wzc3hGcTdE
+            eWUxb3VOTC9sMDliMnVwVm9XdXlHRm8KstZhKVC/wkhvF1d/mH7wZ44y5vo0vLYh
+            T38QGkjP3rUUpuyW/hppn7J5qdolRMyKyKIBqDJDIyMgmG3Hp0I4dQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:20Z"
-    mac: ENC[AES256_GCM,data:FbjOrhp1XTDFTQzefVhP09KxIGdnknPs0ICiBjO2wEMpo8HVnwEafW9Kd8gW05xJXYqrUu9QGiW6tMNsEpMLRr+EdqtTIq9ZdopLeFWSoIyqb9/b+cCRHgp8EBwSgHy1XVN6oaNLk3vTPJ9KahKRz6FJUeiOpKZmALoAMFBdwBs=,iv:5IjFaTqhwXXNswepdrM55aNvuc2KCHh1uls0jjisIbc=,tag:ShEquysSjcw8mcb6wT6fng==,type:str]
+    lastmodified: "2026-08-26T10:19:25Z"
+    mac: ENC[AES256_GCM,data:rtOagU+o2Hvj8eXjN4vF/1QQTTq6PpcuD7H1ElZO0evwzqN2mqTX6p/MB7A8AQdEuRFkRlfsjruAsdcA8prMx9GrWeR8KMhtm6Lp/VFTN1aSqVdUTqmmY37rwiRVFF5Q/TrSf3sYuKcJCXbvvrb09i2+sA3WfDr10mMLEffrzTc=,iv:wQ9FXmceA0pjbmYN0Yga3+hQnULlkZP/aQ1IohmloOo=,tag:xsg4pFrI/0lAKSonZA2F+g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0
diff --git a/clusters/base/apps/radicale/helmrelease.yaml b/clusters/base/apps/radicale/helmrelease.yaml
index 5318970..5044ce2 100644
--- a/clusters/base/apps/radicale/helmrelease.yaml
+++ b/clusters/base/apps/radicale/helmrelease.yaml
@@ -34,10 +34,11 @@ spec:
         className: traefik
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: pim-radicale-stripprefix@kubernetescrd,pim-radicale-headers@kubernetescrd
         hosts:
           - host: c.aggtaa.com
             paths:
-              - path: /
+              - path: /server
                 pathType: Prefix
                 service:
                   identifier: app
diff --git a/clusters/base/apps/radicale/kustomization.yaml b/clusters/base/apps/radicale/kustomization.yaml
index e99a21d..eae78ac 100644
--- a/clusters/base/apps/radicale/kustomization.yaml
+++ b/clusters/base/apps/radicale/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - secret.enc.yaml
   - configmap.yaml
   - helmrelease.yaml
+  - middleware.yaml
diff --git a/clusters/base/apps/radicale/middleware.yaml b/clusters/base/apps/radicale/middleware.yaml
new file mode 100644
index 0000000..b82cd09
--- /dev/null
+++ b/clusters/base/apps/radicale/middleware.yaml
@@ -0,0 +1,21 @@
+# middleware order matters!
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: radicale-stripprefix
+  namespace: pim
+spec:
+  stripPrefix:
+    prefixes:
+      - /server
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: radicale-headers
+  namespace: pim
+spec:
+  headers:
+    customRequestHeaders:
+      X-Script-Name: /server
diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml
index 240b4ed..7e7357c 100644
--- a/clusters/base/apps/vaultwarden/secret.enc.yaml
+++ b/clusters/base/apps/vaultwarden/secret.enc.yaml
@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:bLpPcgdjgfg4jMJGqcSfRW0Klxw0uuqma5xA6f3fanaIE/abQTB9UFrVLe61wbn/B9RIbDcYNmnI,iv://Z6ibujadSD/j3pxtpYoIJ4hvZiKOYaXcYbh1nlkOs=,tag:QJ81xDF+q/yucyf3pN1FHw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:J4Xvt3D5BwrffKgMDiDi4AQrNl9DKkPSNhm9i03ivr5dvauvFweu757HN+BZXbUu+R1urxgDrwR7tK4zmRqv0DCX4hojiVn+t+JuxbiaXwbPNBD5sytrrjTg5JlN/T98FW+cRXyv2XsOxoy3BuWZEm6a2podnA==,iv:64u1TC7NQ07C0Q/lXdJMo14xhflWrLs6jsjoiK8c/f0=,tag:KOT/iJ9b64ScCePX0qRiYg==,type:str]
+    #ENC[AES256_GCM,data:aOrabCMOFGxGscMonlTLjLuO+oZ5f3H4ZzHz4yarRRD9DSeq4wUISIP0jyZlV6LAM4J/ZBeKKXBm,iv:HgsaT40RJrLk5pA8xEsIS+kwE7G0rRYP5wffysU890E=,tag:DmcpYggAlJHhCsy6IA0oiw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:XhnHFoQPsNe4ZdNHQow/TB7yezmSS/VP6ymdGian2HApQ0WTJZVDtJys9xbxsLOqjGVs8q43NOnnWjdZg/8rPDbEbULmNf+8ZrjvbnE4OHI+RBwox91DiKbtmvVCjR598lTsITMoA9U4RmUX4z+rEHXm1jNU+w==,iv:5zop46xOQVFj3eqK3bIOSRWzFoGxQlyS3X5P50zl9+Q=,tag:k3fzsDsTbiMWoPsIdthdOQ==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHaXA2MW1rQ25QaHNtcmxx
-            TllaVW8yenUzTCswWTBzUGR1OFBjQ2t2RFVvCnNoZ3htd1pyMXcrWEFEZFowaXdx
-            WDZUSTBpeGN6MTdLcG94U083SFpNWVkKLS0tIENVeG42NG8vd21mSlZBTmFTaFh1
-            M2FzWnFUMENoVUlqTVQ0b0t2SzVBMjQKhHWZW7e6AD2lEBKLBYHbLxX8mQdAJ59w
-            3hQrj4WOXAA4wPfNnnkqqgbA+yumrBMM60qQHBXTt9Pg0veK8EOKTg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ekhNdnZXc2hwd2FmM1JE
+            Nndud0w3SExXaEU1cVNkVTlzUDEwMXBpeWp3Cjh2WVV5ejI1N0E4NUE2K3ltNnp2
+            NnRwWHpoNzMrVldtOW9kblEzWVN4aXMKLS0tIHNPNkxHK2d0STRKVGVGR3NQZUZp
+            ZVpNQ1MxSHQwRUt0STR1SlJHTUJYcUUKpqPSMk/ASYOMjC/0WfNmOuIIk9hbGbSw
+            tyrrlFTSgWs0qidKSxbBY61mHwWLyj2G1E7x3mzbMFcIZIJM5lsjlA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:21Z"
-    mac: ENC[AES256_GCM,data:acwKoDxpeRxsIk2AslcSIsdOU9Srm0bLeNiLsWQxDtTTBC+PEeUUbiZ/91TU1jtVCqkZ2/e+8spoUuaua3U2KHIjhaYlXKLt3xySjZJmmDC864a023Mo3Z4BW4CknmU37g8s+DLrVdoWe5+Yh7RlIdEvPN7uDjzyxuGFwOJk+Dc=,iv:5UOzYOounQ/0BCmAkvVIxKiTC/EsXepFRZrRxxBF4QI=,tag:hrNOuYOIz0UzVFkbuHJn2w==,type:str]
+    lastmodified: "2026-08-26T10:19:26Z"
+    mac: ENC[AES256_GCM,data:wHHZzm/Tqvv3BfOAaLESs3spxKJcFeD60BGFNFIxTFz+M2xnmsYJwKgJwnx9/pEt77PhvqfAp9agsy0Zlh0JS4DQFv971/MN3MnJcT0Tfcv8Zf3A6cSezEvvSu1vo5VRbzKFcIDC1hHYIadlkgSrMF7v+AvOjKBd8noB0903QKw=,iv:jP52nrm1x9Gr938Bz/eUjMciGw1oROECkWA4CX6HQpI=,tag:+Gyomr3zWwiZLrJtfQKSSw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0
diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
index cc26658..b117029 100644
--- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
+++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:33Boz/xPq8hdh33vSIWvHceQqI68yBnepYR2l8nNCM5IwkuV9vT1RbAt7oXvTFJC2vpGaT1yB9cp0V8TRja3GDPAGalsjpvbuXGyU7CLnXS/hlxALnUxxoOP1RYg4qEw9hJsHfVg6+vIhgMH+Vrxa5VA5rVTMAtIX7jfgt0=,iv:HGhI3GDkj7dZh2pajTtLB1ufIJ+xx29MyqoUx7A2cf0=,tag:A6XPpLmWGJfa8QfJmRSscw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:cng7u7VcxOi1zQpZaxHaTzgUcDj6y6YeQbIuvz54cxi7hRmetw+OkT41zeiPNRVuSiJDzwdiWDuIlc4CGAJoE/vk0hQLeVKBPxD51MSz8jF0ywHe3sga0emR2Mdjun9vTPFLDFu4tx8ttom4LaTXTFnve2eTZ5a3WHUg1ck=,iv:YqWMZBjjisRUfNVg8I7M2LC65MHHx3NdZkSRcsAWO38=,tag:WJafLvGi9AcxWLSF25GgTA==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbDZ1OFpjTUptUGI0WnN4
-            Mmx2RjBxUHkvQm5VRGNUTURibHQvN0tKa2xZCjJUVFgvVldKSWF1UFEzVXJBR0ly
-            Q3JoL3Vhd0VKWENzRkk3TFR4NTAwYlEKLS0tIEJRekNwTU05L0ZPUWphdW5TbHJQ
-            Zk9WRkY0dUJwSlZVRVE3b3AwMVdKTk0K7DaCmV6E71PJL7ywAYf5URAFyy7TgTEk
-            3wNVynE01QsFT/axWBBr+YCsmKbxvnyddOR3rSWBIEW6aIKHz26Nmg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSnROSjg4Y3JNa1N6c2dC
+            eGd0ZWZyZXlWU0RxOURHQ0FFZ1lxWGpUZFV3CmY5UGtGbEE0THVKOFdHejRDemdU
+            aGk5eW1EZ1JhWERremw1NHR5NGFrMncKLS0tIEhOTXYyaXlZMVAwNXFUNExNNkpB
+            SmIzWDdCOGtGUnppK0RvRUE2T2lDNHMK9hbM7OGSQNNmkL6Y336U/mFt0oES11ZA
+            D/VK/CCvdVPI2vabRlKhRlnpkzlnwCFR8l8K1rMkIR47Dk1khAX1ig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:22Z"
-    mac: ENC[AES256_GCM,data:T5ZXUgy50dlxFbwSPJw8lS4kZlm0rad0KOYJd5Rk5QSVMM+AfuPPF210yEKl++vPePoR7w5vx+bwtqZmhcsf05GV3RVOifGSLM/hxnpnSsBVZrjw5hPf6OxwbbUtszHWouBNEUYdGksKpBsvNo8LZGjFKbyoAYTzAfGLs/K4Miw=,iv:SqLw1LOoM2ws5Gc8kvIoftAXoUnMObA0VOFTQcG1RaQ=,tag:nWReAcfUXDYUJn3xFlU7qg==,type:str]
+    lastmodified: "2026-08-26T10:19:27Z"
+    mac: ENC[AES256_GCM,data:Z/vPgy/SfB8ev5oG+Ox2+xt0l4xarV59pHdFlP/umprNmQylgsxglVaWwcgA6PAqQm6IW1tjrIvWNLevZ3TahoB0FO83uFPJtzc9u78GBRaAbNW7ME3SrgHmhNiEEbbZdsOz0thhvor7xjggtzQrcSC20TWHzITzcUS3d6wlRXA=,iv:dm8XxXkPZBmoYcPBLu5Hj7FcZ+PFkbE3PSMNowQYzPU=,tag:YPLSCDAM5PhzCyQgJftIPg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0