diff --git a/apps-gx10/fc-php/certificate-php-web-tls.json b/apps-gx10/fc-php/certificate-php-web-tls.json
new file mode 100644
index 0000000..178d990
--- /dev/null
+++ b/apps-gx10/fc-php/certificate-php-web-tls.json
@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "php-web-tls",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "dnsNames": [
+      "php.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "php-web-tls"
+  }
+}
diff --git a/apps-gx10/fc-php/ingressroute-php-web.json b/apps-gx10/fc-php/ingressroute-php-web.json
new file mode 100644
index 0000000..178abc2
--- /dev/null
+++ b/apps-gx10/fc-php/ingressroute-php-web.json
@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "php-web",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`php.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "php-web",
+            "port": 5400
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "php-web-tls"
+    }
+  }
+}