diff --git a/servers/legion/apps/headscale-config.yaml b/servers/legion/apps/headscale-config.yaml
deleted file mode 100644
index 976c1e3..0000000
--- a/servers/legion/apps/headscale-config.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: headscale-config
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: http://gitea.git.svc.cluster.local:3000/will/infrastructure.git
-    targetRevision: main
-    path: servers/legion/k8s/headscale
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: headscale
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
diff --git a/servers/legion/apps/headscale.yaml b/servers/legion/apps/headscale.yaml
deleted file mode 100644
index f2d80cb..0000000
--- a/servers/legion/apps/headscale.yaml
+++ /dev/null
@@ -1,145 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: headscale-config
-  namespace: headscale
-data:
-  config.yaml: |
-    server_url: https://vpn.neuralplatform.ai
-    listen_addr: 0.0.0.0:8080
-    grpc_listen_addr: 0.0.0.0:50443
-    grpc_allow_insecure: true
-    private_key_path: /data/private.key
-    noise:
-      private_key_path: /data/noise_private.key
-    prefixes:
-      v4: 100.64.0.0/10
-    database:
-      type: sqlite
-      sqlite:
-        path: /data/headscale.db
-    log:
-      level: info
-    dns:
-      magic_dns: true
-      base_domain: ts.neuralplatform.ai
-      nameservers:
-        global:
-          - 192.168.8.148
-          - 1.1.1.1
-    derp:
-      server:
-        enabled: false
-      urls:
-        - https://controlplane.tailscale.com/derpmap/default
-      auto_update_enabled: true
-      update_frequency: 24h
-    disable_check_updates: true
-    ephemeral_node_inactivity_timeout: 30m
-    node_update_check_interval: 10s
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: headscale
-  namespace: headscale
-  labels:
-    app: headscale
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: headscale
-  template:
-    metadata:
-      labels:
-        app: headscale
-    spec:
-      containers:
-        - name: headscale
-          image: headscale/headscale:0.23
-          command: ["headscale", "serve"]
-          ports:
-            - name: http
-              containerPort: 8080
-            - name: grpc
-              containerPort: 50443
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: config
-              mountPath: /etc/headscale/config.yaml
-              subPath: config.yaml
-          resources:
-            requests:
-              memory: 64Mi
-              cpu: 50m
-            limits:
-              memory: 256Mi
-              cpu: 200m
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: headscale-data
-        - name: config
-          configMap:
-            name: headscale-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: headscale
-  namespace: headscale
-spec:
-  selector:
-    app: headscale
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-    - name: grpc
-      port: 50443
-      targetPort: 50443
-  type: ClusterIP
----
-# Traefik ingress — direct TLS, bypasses Cloudflare proxy so WebSocket
-# upgrades (required by Tailscale TS2021) pass through unmodified.
-# DNS: vpn.neuralplatform.ai A 72.204.75.49 (DNS-only, not proxied)
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: headscale
-  namespace: headscale
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-spec:
-  tls:
-    - hosts:
-        - vpn.neuralplatform.ai
-      secretName: headscale-tls
-  rules:
-    - host: vpn.neuralplatform.ai
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: headscale
-                port:
-                  number: 8080
diff --git a/servers/legion/apps/media.yaml b/servers/legion/apps/media.yaml
deleted file mode 100644
index b42aa2a..0000000
--- a/servers/legion/apps/media.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: media
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: http://gitea.git.svc.cluster.local:3000/will/infrastructure.git
-    targetRevision: main
-    path: servers/legion/k8s/media
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: media
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true