diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 764ca3b..7a97028 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -93,6 +93,23 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    # voidstash.xyz — private media stack
+    ingress_rule {
+      hostname = "stash.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "whisparr.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"
diff --git a/servers/legion/voidstash.tf b/servers/legion/voidstash.tf
new file mode 100644
index 0000000..008f5fe
--- /dev/null
+++ b/servers/legion/voidstash.tf
@@ -0,0 +1,24 @@
+# voidstash.xyz — private media stack (Stash + Whisparr)
+# Zone created via API: ba74d72edbea8023ff4ed6cb27487154
+# Nameservers delegated to Cloudflare from Porkbun
+
+data "cloudflare_zone" "voidstash" {
+  name = "voidstash.xyz"
+}
+
+# CNAME records → Cloudflare tunnel (proxied)
+resource "cloudflare_record" "stash" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "stash"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}
+
+resource "cloudflare_record" "whisparr" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "whisparr"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}