diff --git a/apps/jellyfin/jellyfin.yaml b/apps/jellyfin/jellyfin.yaml
new file mode 100644
index 0000000..9109dc3
--- /dev/null
+++ b/apps/jellyfin/jellyfin.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      containers:
+        - name: jellyfin
+          image: jellyfin/jellyfin:latest
+          ports:
+            - containerPort: 8096  # HTTP
+            - containerPort: 8920  # HTTPS (if enabled)
+          volumeMounts:
+            - name: jellyfin-config
+              mountPath: /config
+            - name: jellyfin-cache
+              mountPath: /cache
+            - name: jellyfin-media
+              mountPath: /media   # adjust to your real media structure
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "200m"
+            limits:
+              memory: "2Gi"
+              cpu: "1000m"
+      volumes:
+        - name: jellyfin-config
+          persistentVolumeClaim:
+            claimName: jellyfin-config-pvc
+        - name: jellyfin-cache
+          persistentVolumeClaim:
+            claimName: jellyfin-cache-pvc
+        - name: jellyfin-media
+          hostPath:
+            path: /var/lib/rancher/k3s/storage/jellyfin-data-mnt   # where data is on host FS
+            type: Directory
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+spec:
+  type: NodePort
+  selector:
+    app: jellyfin
+  ports:
+    - name: http
+      port: 8096
+      targetPort: 8096
+      nodePort: 30096
diff --git a/apps/jellyfin/pvc.yaml b/apps/jellyfin/pvc.yaml
new file mode 100644
index 0000000..5c88c99
--- /dev/null
+++ b/apps/jellyfin/pvc.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-cache-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
\ No newline at end of file
diff --git a/apps/prometheus/configmap.yaml b/apps/prometheus/configmap.yaml
index e3179c0..332f02e 100644
--- a/apps/prometheus/configmap.yaml
+++ b/apps/prometheus/configmap.yaml
@@ -12,3 +12,10 @@ data:
         static_configs:
           - targets:
               - localhost:9090
+      - job_name: "node-exporter"
+        kubernetes_sd_configs:
+          - role: endpoints
+        relabel_configs:
+          - source_labels: [__meta_kubernetes_endpoints_name]
+            regex: node-exporter
+            action: keep
diff --git a/apps/prometheus/prometheus.yaml b/apps/prometheus/prometheus.yaml
index c66e2da..093adda 100644
--- a/apps/prometheus/prometheus.yaml
+++ b/apps/prometheus/prometheus.yaml
@@ -12,6 +12,7 @@ spec:
       labels:
         app: prometheus
     spec:
+      serviceAccountName: prometheus
       nodeSelector:
         kubernetes.io/hostname: raspberrypi
       containers:
@@ -57,3 +58,9 @@ spec:
       port: 9090
       targetPort: 9090
       nodePort: 30390
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prometheus
+  namespace: default
\ No newline at end of file
diff --git a/apps/prometheus/rbac.yaml b/apps/prometheus/rbac.yaml
new file mode 100644
index 0000000..80fce93
--- /dev/null
+++ b/apps/prometheus/rbac.yaml
@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes
+      - nodes/metrics
+      - pods
+      - services
+      - endpoints
+    verbs: ["get", "list", "watch"]
+  - nonResourceURLs: ["/metrics"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+  - kind: ServiceAccount
+    name: prometheus
+    namespace: default
diff --git a/daemonsets/node-exporter/node-exporter-service.yaml b/daemonsets/node-exporter/node-exporter-service.yaml
new file mode 100644
index 0000000..34dadcb
--- /dev/null
+++ b/daemonsets/node-exporter/node-exporter-service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: node-exporter
+  labels:
+    app: node-exporter
+spec:
+  selector:
+    app: node-exporter
+  ports:
+    - name: metrics
+      port: 9100
+      targetPort: 9100
+      protocol: TCP
+  clusterIP: None   # optional, but good for headless discovery
diff --git a/daemonsets/node-exporter/node-exporter.yaml b/daemonsets/node-exporter/node-exporter.yaml
new file mode 100644
index 0000000..a476d7b
--- /dev/null
+++ b/daemonsets/node-exporter/node-exporter.yaml
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: node-exporter
+  namespace: default
+  labels:
+    app: node-exporter
+spec:
+  selector:
+    matchLabels:
+      app: node-exporter
+  template:
+    metadata:
+      annotations:
+        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+      labels:
+        app: node-exporter
+    spec:
+      hostNetwork: true
+      hostPID: true
+      containers:
+        - name: node-exporter
+          image: prom/node-exporter:v1.8.1
+          args:
+            - --web.listen-address=0.0.0.0:9100
+            - --path.procfs=/host/proc
+            - --path.sysfs=/host/sys
+          ports:
+            - name: metrics
+              containerPort: 9100
+              hostPort: 9100
+          volumeMounts:
+            - name: proc
+              mountPath: /host/proc
+              readOnly: true
+            - name: sys
+              mountPath: /host/sys
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      volumes:
+        - name: proc
+          hostPath:
+            path: /proc
+        - name: sys
+          hostPath:
+            path: /sys