diff --git a/kube/4-core/1-ingress/3-nginx.yaml b/kube/4-core/1-ingress/3-nginx.yaml
index 105eef2e..5ebce852 100644
--- a/kube/4-core/1-ingress/3-nginx.yaml
+++ b/kube/4-core/1-ingress/3-nginx.yaml
@@ -25,6 +25,9 @@ spec:
     uninstall:
         keepHistory: false
     values:
+        tcp:
+            "42080": ingress/ingress-nginx-controller:80::PROXY
+            "42443": ingress/ingress-nginx-controller:443::PROXY
         controller:
             replicaCount: 3
             # kind: DaemonSet
@@ -51,9 +54,6 @@ spec:
                 https: 443
                 internalhttp: 42080
                 internalhttps: 42443
-            tcp:
-                "42080": ingress/ingress-nginx-controller:80::PROXY
-                "42443": ingress/ingress-nginx-controller:443::PROXY
             # hostNetwork: true
             # dnsPolicy: ClusterFirstWithHostNet
             publishService:
@@ -113,8 +113,8 @@ sops:
             WmZ6WCtSWU42UDBJdDZYbWdMOGsyYUEKCKQn/WSsrUipmkVB2zc+iQic7y42agyU
             xmS4orBGFZz5HgMQrNp4p66Lo6nX4spBWV6mbFYyVAQk2HqOdCOuLg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-02-19T17:13:11Z"
-    mac: ENC[AES256_GCM,data:WzBRLvHhr5JxkvCYsCnKssaDm3rAIAdg4E6j9UGdq+ect0sl5Q25A277D1gPEftGtALXCkX8EDR5VZ8wIwkgltFzOR6CcOpLhj91FBWHcYpUmHRuIbu8HLu0yfN/KMuxX0D6UQ5Y2lBs740MIByqo6wKyKFd9JuoqYINfPjknrk=,iv:eGzrK/d7cBxsHeOQeMNZytX8giQ6fm6D+JUvL3LPu9s=,tag:z4qA3o97pUNQZEspJYWxxA==,type:str]
+    lastmodified: "2023-02-19T17:55:37Z"
+    mac: ENC[AES256_GCM,data:TC+9smecoMpmBpXTxGvz06sqeyYtUjVnCvfLySsThx8a/dqhpp3ous549FI+FLu88aDLw425crTdn6bY1Q7Z/67RzsRCP5cUbvFQkKp6oCbYgHn8vx74lE8hR0CpXd839MfJBUDuRweWtJ20s8T49BvIWLRVXTR6ivBtGYHzucw=,iv:aNwMr10IQgQN+eITJawTefhNBOjHLLwOC26EXUKYiJk=,tag:J/9LWLeqakC3EtcjSUuwPQ==,type:str]
     pgp:
         - created_at: "2023-02-15T23:32:36Z"
           enc: |
diff --git a/kube/4-core/1-ingress/4-nginx-external-svc.yaml b/kube/4-core/1-ingress/4-nginx-external-svc.yaml
deleted file mode 100644
index 76549f8e..00000000
--- a/kube/4-core/1-ingress/4-nginx-external-svc.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-# Please edit the object below. Lines beginning with a '#' will be ignored,
-# and an empty file will abort the edit. If an error occurs while saving this file will be
-# reopened with the relevant failures.
-#
-apiVersion: v1
-kind: Service
-metadata:
-    name: ingress-nginx-external-controller
-    namespace: ingress
-spec:
-    externalIPs:
-        - ENC[AES256_GCM,data:9a2V8hq6BKbvAmb+,iv:jUFPT5JGbYVkPN3D8JKh4Ct2V7xRsiOxncNXVnhhMak=,tag:r8T8xKZ5UG/kOmTO29BsRw==,type:str]
-    externalTrafficPolicy: Local
-    type: NodePort
-    ports:
-        - appProtocol: http
-          name: http
-          port: 30080
-          protocol: TCP
-          targetPort: 30080
-          nodePort: 30080
-        - appProtocol: https
-          name: https
-          port: 30443
-          protocol: TCP
-          targetPort: 30443
-          nodePort: 30443
-    selector:
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/name: ingress-nginx
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1xl3fcwdw56k73lraxsjhde4ygwn7jw0js5l5qw7vsp54vc5czuwstcejxu
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZk8yU0FqVFdsSEJBdE9o
-            bVF1b2x5Ny93cXEvWWRYbTljYUhIQ1BzQWxzCmFUZkVFRkduQnlJM3ZxT0h2QjJp
-            QnQwdXI2dldQK085MHA1ZjVkRlBQNDQKLS0tIENMa0d6MzlraG9SSHpKWENlTzZ4
-            alRiMGVTQXlOcHp1Zy9rQ2dLOC8rSU0KY2Qww/zZF1zyzJuwcPwGNHnDQ4IuWtHa
-            NQWECjoM7nYXN9pALQ9x6k8pbH2fvrntEKi2OWpgAYxC2xE60/U4Jg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-02-19T10:30:57Z"
-    mac: ENC[AES256_GCM,data:tSlPNOq3ogdWb+2G0k6+kciGv191Vaf0RUAUjl9x3KOp/cytt0RkoeYUmCy0gEYfqVb/kn/dsiti9zyrzTJKDgM3+p59K5bqVROoXFa8KkyjksbE7UsU/MLIOse+t/AIlhvinBxn02zljAm17oUBQGNLoq3XjHuoOsH7J1TsX7Y=,iv:u2SwaQt2hvbvwazf1Zi4+iwtQcMzdrNHpvOJKsPR10U=,tag:+eULUR+dbYicvIH3Dh2w9g==,type:str]
-    pgp:
-        - created_at: "2023-02-17T06:39:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DAAAAAAAAAAASAQdAQS3Cfbsodg6VWgm4bFJoKE51eZS0e4BNfIlQ0cxMHQsw
-            jiUAcIiPZCME7VGsq3Ji/IrNajC9SZcRLg3dqHqqga3MHD8IQLdpyheD1QuiwM1l
-            0lwBOWCa9hbW96X9hilSJy/jUa9KVNJHorjDz5f3qGGF2c9StfXL+JH2m3qvv4rl
-            i0KMzugL9T5bHae/hRKaFc3kN2WOlYI8EqxXYSMOka+0LEXsRNLRQzR5ow/SKA==
-            =HbqD
-            -----END PGP MESSAGE-----
-          fp: 31E70E5BC80C58AFF5DD649921AC5A1AC6E5B7F2
-    encrypted_regex: ^(data|stringData|commonName|dnsNames|externalIPs|loadBalancerIP|whitelist-source-range)$
-    version: 3.7.3
diff --git a/kube/4-core/1-ingress/4-nginx-external.yaml b/kube/4-core/1-ingress/4-nginx-external.yaml
index cbfcde00..3c45911b 100644
--- a/kube/4-core/1-ingress/4-nginx-external.yaml
+++ b/kube/4-core/1-ingress/4-nginx-external.yaml
@@ -25,6 +25,9 @@ spec:
     uninstall:
         keepHistory: false
     values:
+        tcp:
+            "42080": ingress/ingress-nginx-controller:80::PROXY
+            "42443": ingress/ingress-nginx-controller:443::PROXY
         controller:
             replicaCount: 1
             # kind: DaemonSet
@@ -48,9 +51,6 @@ spec:
             containerPort:
                 internalhttp: 42080
                 internalhttps: 42443
-            tcp:
-                "42080": ingress/ingress-nginx-controller:80::PROXY
-                "42443": ingress/ingress-nginx-controller:443::PROXY
             publishService:
                 enabled: true
             ingressClassByName: false
@@ -79,8 +79,8 @@ sops:
             aisrc3h1QmhIQmEwQkdzVE80VjV6LzAKr3e/xgLoKefqHbc/RCav+HZXTAIA3nwB
             oPIkDQoXTSH5XYz57PSZQQ1K5atiJ+U/58A5TNIDyQqv1xVfE3V6RA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-02-19T17:21:43Z"
-    mac: ENC[AES256_GCM,data:KcYnheMBHmYBku7OmgtRH53M09Tfb+YLrfDTBOWjD+DU9fct/1566bfBE4j6RFu6oVzV+YkJ00TCks0VFJfKYWLPc/lfs8ppZEy/U/xWOrcJQVjflLKX7wdUWLHG9PRlqk/EDC98spuOChMwt5jGWDFeBcJ8NfQrQvWPZYyHOxA=,iv:NtuWAZ85t3F0xlgc24H92CyDjPU/ltXoZnTqFIMxCyI=,tag:pfD5QiNeHy6mGFMNo4oPUA==,type:str]
+    lastmodified: "2023-02-19T17:56:08Z"
+    mac: ENC[AES256_GCM,data:jDd5kYZCit8OD9lXt7QpCcAW4ypsENSz0CeWwDugsXN5xFZuS7icRoIgQ1Wc3vbpNutK2U0nRAYQqhc8N7RwsdZafd2CrbkupFJtnFkoiH+kESWmUOzOOGUHrwt1QHEbKh4/iweLzUYTZNWB3rWZN7EdeOo1roWc3hydrYMXY8E=,iv:9chQeauXfOFqpocQwI+rjucwjEKXZg7y0OIxH33N/As=,tag:vP1sIalGstbVa7N7hPxSXg==,type:str]
     pgp:
         - created_at: "2023-02-15T23:32:45Z"
           enc: |