diff --git a/admin/ingress/nginx-template.yaml b/admin/ingress/nginx-template.yaml
index 94a0a9a..ed87d2b 100644
--- a/admin/ingress/nginx-template.yaml
+++ b/admin/ingress/nginx-template.yaml
@@ -13,42 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 48m
-    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-
-  name: ${USERNAME}-my-streamer-ingress
-  namespace: openserverless
-
-spec:
-  ingressClassName: nginx
-
-$T  tls:
-$T  - hosts:
-$T      - ${USERNAME}.${BASE_HOST:-localhost}
-$T    secretName: streamer-api-tls
-
-  rules:
-  - host: ${USERNAME}.${BASE_HOST:-localhost}
-    http:
-      paths:
-      - backend:
-          service:
-            name: openserverless-streamer-api
-            port:
-              number: 8080
-        path: /
-        pathType: Prefix
-
----
 # /stream/web/... -> /web/${USERNAME}/...
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -61,9 +25,6 @@
     nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/rewrite-target: /web/${USERNAME}/$$2
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-
   name: ${USERNAME}-my-streamer-web-ingress
   namespace: openserverless
 
@@ -73,7 +34,7 @@
 $T  tls:
 $T  - hosts:
 $T      - ${USERNAME}.${BASE_HOST:-localhost}
-$T    secretName: streamer-api-tls
+$T    secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
@@ -100,9 +61,6 @@
     nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/rewrite-target: /action/${USERNAME}/$$2
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-
   name: ${USERNAME}-my-streamer-action-ingress
   namespace: openserverless
 
@@ -112,7 +70,7 @@
 $T  tls:
 $T  - hosts:
 $T      - ${USERNAME}.${BASE_HOST:-localhost}
-$T    secretName: streamer-api-tls
+$T    secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
@@ -142,9 +100,6 @@
     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-
   name: ${USERNAME}-my-s3-ingress
   namespace: openserverless
 
@@ -154,7 +109,7 @@
 $T  tls:
 $T  - hosts:
 $T      - ${USERNAME}.${BASE_HOST:-localhost}
-$T    secretName: streamer-api-tls
+$T    secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
diff --git a/admin/ingress/traefik-template.yaml b/admin/ingress/traefik-template.yaml
index 1806f9a..260a285 100644
--- a/admin/ingress/traefik-template.yaml
+++ b/admin/ingress/traefik-template.yaml
@@ -13,43 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 1024m
-    traefik.ingress.kubernetes.io/transport.respondingTimeouts.idleTimeout: "600"
-    traefik.ingress.kubernetes.io/transport.respondingTimeouts.readTimeout: "600"
-    traefik.ingress.kubernetes.io/transport.respondingTimeouts.writeTimeout: "600"
-
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    traefik.ingress.kubernetes.io/router.tls: "true"
-$T    traefik.ingress.kubernetes.io/router.entrypoints: websecure,web
-
-  name: ${USERNAME}-my-streamer-ingress
-  namespace: openserverless
-
-spec:
-  ingressClassName: traefik
-
-$T  tls:
-$T    - hosts:
-$T        - ${USERNAME}.${BASE_HOST:-localhost}
-$T      secretName: streamer-api-tls
-
-  rules:
-  - host: ${USERNAME}.${BASE_HOST:-localhost}
-    http:
-      paths:
-      - backend:
-          service:
-            name: openserverless-streamer-api
-            port:
-              number: 8080
-        path: /
-        pathType: Prefix
-
----
 # /stream/web/... -> /web/${USERNAME}/...
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
@@ -84,10 +47,6 @@
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.readTimeout: "600"
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.writeTimeout: "600"
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    traefik.ingress.kubernetes.io/router.tls: "true"
-$T    traefik.ingress.kubernetes.io/router.entrypoints: websecure,web
-
   name: ${USERNAME}-my-streamer-web-ingress
   namespace: openserverless
 
@@ -97,7 +56,7 @@
 $T  tls:
 $T    - hosts:
 $T        - ${USERNAME}.${BASE_HOST:-localhost}
-$T      secretName: streamer-api-tls
+$T      secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
@@ -122,10 +81,6 @@
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.readTimeout: "600"
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.writeTimeout: "600"
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    traefik.ingress.kubernetes.io/router.tls: "true"
-$T    traefik.ingress.kubernetes.io/router.entrypoints: websecure,web
-
   name: ${USERNAME}-my-streamer-action-ingress
   namespace: openserverless
 
@@ -135,7 +90,7 @@
 $T  tls:
 $T    - hosts:
 $T        - ${USERNAME}.${BASE_HOST:-localhost}
-$T      secretName: streamer-api-tls
+$T      secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
@@ -165,10 +120,6 @@
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.readTimeout: "600"
     traefik.ingress.kubernetes.io/transport.respondingTimeouts.writeTimeout: "600"
 
-$T    cert-manager.io/cluster-issuer: letsencrypt-prod
-$T    traefik.ingress.kubernetes.io/router.tls: "true"
-$T    traefik.ingress.kubernetes.io/router.entrypoints: websecure,web
-
   name: ${USERNAME}-my-s3-ingress
   namespace: openserverless
 
@@ -178,7 +129,7 @@
 $T  tls:
 $T    - hosts:
 $T        - ${USERNAME}.${BASE_HOST:-localhost}
-$T      secretName: streamer-api-tls
+$T      secretName: ${USERNAME}-crt
 
   rules:
   - host: ${USERNAME}.${BASE_HOST:-localhost}
diff --git a/cloud/k3s/opsfile.yml b/cloud/k3s/opsfile.yml
index 205bd4e..1c91124 100644
--- a/cloud/k3s/opsfile.yml
+++ b/cloud/k3s/opsfile.yml
@@ -76,15 +76,15 @@
       - cp "$OPS_TMP/kubeconfig" "$OPS_TMP/k3s-{{._server_}}.kubeconfig"
 
   delete:
+    vars:
+      INSTALL_USER: '{{._user_ | default "root"}}'
     silent: true
     desc: uninstall with ssh in <server> using <username> with sudo
     cmds:
       - test -n "{{._server_}}" || die "please use <server>"
-      - "{{.SSH}} '{{._user_}}@{{._server_}}' sudo /usr/local/bin/k3s-killall.sh"
-      - "{{.SSH}} '{{._user_}}@{{._server_}}' sudo /usr/local/bin/k3s-uninstall.sh"
+      - "{{.SSH}} '{{.INSTALL_USER}}@{{._server_}}' sudo /usr/local/bin/k3s-killall.sh"
+      - "{{.SSH}} '{{.INSTALL_USER}}@{{._server_}}' sudo /usr/local/bin/k3s-uninstall.sh"
       - rm "$OPS_TMP/kubeconfig" "$OPS_TMP/k3s-{{._server_}}.kubeconfig"
-    vars:
-      USERNAME: '{{.USERNAME | default "root"}}'
 
   status:
     desc: status of the server