diff --git a/k8s/argo-apps/lldap.yaml b/k8s/argo-apps/lldap.yaml
new file mode 100644
index 0000000..eddcb58
--- /dev/null
+++ b/k8s/argo-apps/lldap.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: lldap
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: apps-fuku
+    server: https://kubernetes.default.svc
+  sources:
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/lldap
+      targetRevision: main
+  project: fuku
+  syncPolicy:
+    automated: {}
diff --git a/k8s/services/argo/project-fuku.yaml b/k8s/services/argo/project-fuku.yaml
index adfc1a7..d2e6506 100644
--- a/k8s/services/argo/project-fuku.yaml
+++ b/k8s/services/argo/project-fuku.yaml
@@ -38,3 +38,4 @@ spec:
         - https://harish2k01.github.io/helm-charts/
         - git.roboces.dev/catalin/fukuops
         - git.roboces.dev/catalin
+        - https://evantage-ws.github.io/lldap-kubernetes/
diff --git a/k8s/services/lldap/deployment.yaml b/k8s/services/lldap/deployment.yaml
new file mode 100644
index 0000000..f9e2610
--- /dev/null
+++ b/k8s/services/lldap/deployment.yaml
@@ -0,0 +1,74 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: apps-fuku
+  labels:
+    app: lldap
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lldap
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: lldap
+    spec:
+      containers:
+        - name: lldap
+          image: nitnelave/lldap:v0.6.1-alpine
+          env:
+            - name: GID
+              value: "1001"
+            - name: UID
+              value: "1001"
+            - name: TZ
+              value: Europe/Bucharest
+            - name: LLDAP_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: lldap-jwt-secret
+            - name: LLDAP_LDAP_BASE_DN
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: base-dn
+            - name: LLDAP_LDAP_USER_DN
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: lldap-ldap-user-name
+            - name: LLDAP_LDAP_USER_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: lldap-ldap-user-pass
+            - name: LLDAP_KEY_SEED
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: lldap-key-seed
+          ports:
+            - containerPort: 3890
+              name: ldap
+            - containerPort: 17170
+              name: web
+          volumeMounts:
+            - mountPath: /data
+              name: lldap-data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: lldap-data
+          persistentVolumeClaim:
+            claimName: lldap-data
diff --git a/k8s/services/lldap/ingress.yaml b/k8s/services/lldap/ingress.yaml
new file mode 100644
index 0000000..a9b7f29
--- /dev/null
+++ b/k8s/services/lldap/ingress.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: lldap
+  namespace: apps-fuku
+  labels:
+    app: lldap
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: ldap.fuku
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: lldap
+                port:
+                  number: 17170
+  tls:
+    - hosts:
+        - ldap.fuku
+      secretName: lldap-tls
diff --git a/k8s/services/lldap/pvc.yaml b/k8s/services/lldap/pvc.yaml
new file mode 100644
index 0000000..3868b5b
--- /dev/null
+++ b/k8s/services/lldap/pvc.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: lldap-data
+  namespace: apps-fuku
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: truenas-nfs-csi
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/k8s/services/lldap/service.yaml b/k8s/services/lldap/service.yaml
new file mode 100644
index 0000000..ae13cdf
--- /dev/null
+++ b/k8s/services/lldap/service.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lldap
+  namespace: apps-fuku
+  labels:
+    app: lldap
+spec:
+  type: ClusterIP
+  ports:
+    - name: ldap
+      port: 3890
+      targetPort: 3890
+    - name: web
+      port: 17170
+      targetPort: 17170
+  selector:
+    app: lldap
diff --git a/tofu/adguard/main.tf b/tofu/adguard/main.tf
index 803522b..f206fae 100644
--- a/tofu/adguard/main.tf
+++ b/tofu/adguard/main.tf
@@ -122,3 +122,8 @@ resource "adguard_rewrite" "dns" {
   domain = "dns.fuku"
   answer = "192.168.1.12"
 }
+
+resource "adguard_rewrite" "lldap" {
+  domain = "ldap.fuku"
+  answer = "192.168.1.12"
+}