diff --git a/manifests/gitea/gitea-public-ingress.yaml b/manifests/gitea/gitea-public-ingress.yaml
new file mode 100644
index 0000000..b1cfdb5
--- /dev/null
+++ b/manifests/gitea/gitea-public-ingress.yaml
@@ -0,0 +1,32 @@
+# Apply: kubectl apply -f manifests/gitea/gitea-public-ingress.yaml
+# Delete: kubectl delete -f manifests/gitea/gitea-public-ingress.yaml
+# Description: Let's Encrypt TLS certificate and public IngressRoute for Gitea at gitea.nik4nao.com.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-nik4nao-tls
+  namespace: gitea
+spec:
+  secretName: gitea-nik4nao-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - gitea.nik4nao.com
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-public
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.nik4nao.com`)
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    secretName: gitea-nik4nao-tls
\ No newline at end of file
diff --git a/manifests/network/watch-party-ingress.yaml b/manifests/network/watch-party-ingress.yaml
index 51266d2..d3ed572 100644
--- a/manifests/network/watch-party-ingress.yaml
+++ b/manifests/network/watch-party-ingress.yaml
@@ -1,7 +1,6 @@
 # Apply: kubectl apply -f manifests/network/watch-party-ingress.yaml
 # Delete: kubectl delete -f manifests/network/watch-party-ingress.yaml
-# Description: External Endpoints and Service for Watch Party on Mac Mini. No public
-#   route — taken off the internet (was Ingress + Let's Encrypt cert at watch-party.nik4nao.com).
+# Description: External Endpoints, Service, and Ingress for Watch Party on Mac Mini at watch-party.nik4nao.com.
 apiVersion: v1
 kind: Endpoints
 metadata:
@@ -22,3 +21,30 @@ spec:
   ports:
     - port: 3000
       targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: watch-party
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - secretName: watch-party-tls
+      hosts:
+        - watch-party.nik4nao.com
+  rules:
+    - host: watch-party.nik4nao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: watch-party-mac-mini
+                port:
+                  number: 3000
diff --git a/manifests/portfolio/portfolio.yaml b/manifests/portfolio/portfolio.yaml
index 2ed7441..15c7514 100644
--- a/manifests/portfolio/portfolio.yaml
+++ b/manifests/portfolio/portfolio.yaml
@@ -1,7 +1,6 @@
 # Apply: kubectl apply -f manifests/portfolio/portfolio.yaml
 # Delete: kubectl delete -f manifests/portfolio/portfolio.yaml
-# Description: Portfolio website deployment and service. No public route — taken off
-#   the internet (was IngressRoute + Let's Encrypt cert at nik4nao.com).
+# Description: Portfolio website deployment, service, TLS certificate, and public IngressRoute at nik4nao.com.
 ---
 apiVersion: v1
 kind: Namespace
@@ -49,4 +48,50 @@ spec:
     app: portfolio
   ports:
     - port: 80
-      targetPort: 80
\ No newline at end of file
+      targetPort: 80
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: portfolio-tls
+  namespace: portfolio
+spec:
+  secretName: portfolio-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - nik4nao.com
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: portfolio
+  namespace: portfolio
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nik4nao.com`)
+      kind: Rule
+      middlewares:
+        - name: portfolio-ratelimit
+      services:
+        - name: portfolio
+          port: 80
+  tls:
+    secretName: portfolio-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: portfolio-ratelimit
+  namespace: portfolio
+spec:
+  rateLimit:
+    average: 50
+    burst: 100
+    period: 1m
+    sourceCriterion:
+      ipStrategy:
+        depth: 1
\ No newline at end of file