diff --git a/.gitignore b/.gitignore
index f31b3e2..95fbcbb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
 .DS_Store
 *.swp
+
+# Real SSH key material — never committed. Commit gitrepository-secret.yaml.example instead.
+**/gitrepository-secret.yaml
diff --git a/dataplane-template/certificate.yaml b/dataplane-template/certificate.yaml
new file mode 100644
index 0000000..3eb1fff
--- /dev/null
+++ b/dataplane-template/certificate.yaml
@@ -0,0 +1,16 @@
+# Not a self-signed cert hand-copied into a Secret like
+# ~/dev/kong/kube/gateway/apigw/secret.yaml does — issuer is per-domain/env
+# config (e.g. sttlab-local-ca ClusterIssuer for local, a real ACME issuer
+# for prod), not hardcoded here.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  secretName: ${NAME}-tls
+  dnsNames:
+    - ${HOSTNAME}
+  issuerRef:
+    kind: ${TLS_ISSUER_KIND}
+    name: ${TLS_ISSUER_NAME}
diff --git a/dataplane-template/gateway.yaml b/dataplane-template/gateway.yaml
index afea424..860d61b 100644
--- a/dataplane-template/gateway.yaml
+++ b/dataplane-template/gateway.yaml
@@ -21,4 +21,4 @@ spec:
       tls:
         certificateRefs:
           - kind: Secret
-            name: ${TLS_SECRET_NAME}
+            name: ${NAME}-tls
diff --git a/dataplane-template/konnectapiauthconfiguration.yaml b/dataplane-template/konnectapiauthconfiguration.yaml
index 8271f6f..e3303e6 100644
--- a/dataplane-template/konnectapiauthconfiguration.yaml
+++ b/dataplane-template/konnectapiauthconfiguration.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   type: secretRef
   secretRef:
-    name: ${KONNECT_AUTH_SECRET_NAME}
+    name: ${NAME}-konnect-auth
   serverURL: ${KONNECT_SERVER_URL}
diff --git a/dataplane-template/kustomization.yaml b/dataplane-template/kustomization.yaml
index b848c54..c162b24 100644
--- a/dataplane-template/kustomization.yaml
+++ b/dataplane-template/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - gatewayconfiguration.yaml
   - gateway.yaml
   - secret.yaml
+  - certificate.yaml
diff --git a/dataplane-template/secret.yaml b/dataplane-template/secret.yaml
index e47149f..9931f61 100644
--- a/dataplane-template/secret.yaml
+++ b/dataplane-template/secret.yaml
@@ -5,7 +5,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: ${KONNECT_AUTH_SECRET_NAME}
+  name: ${NAME}-konnect-auth
   namespace: ${NAMESPACE}
   labels:
     konghq.com/credential: konnect
diff --git a/flux/gitrepository-secret.yaml.example b/flux/gitrepository-secret.yaml.example
new file mode 100644
index 0000000..2264849
--- /dev/null
+++ b/flux/gitrepository-secret.yaml.example
@@ -0,0 +1,25 @@
+# Shape of the k8s-platform-git-auth Secret that gitrepository.yaml's
+# secretRef points at — created directly via `kubectl create secret`
+# (never written to a real file, real key material never committed):
+#
+#   kubectl create secret generic k8s-platform-git-auth \
+#     -n flux-system \
+#     --from-file=identity=$HOME/.ssh/id_rsa \
+#     --from-file=identity.pub=$HOME/.ssh/id_rsa.pub \
+#     --from-file=known_hosts=<(ssh-keyscan -p 2222 gitea.sttlab.eu)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: k8s-platform-git-auth
+  namespace: flux-system
+type: Opaque
+stringData:
+  identity: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    PLACEHOLDER
+    -----END OPENSSH PRIVATE KEY-----
+  identity.pub: ssh-rsa PLACEHOLDER
+  known_hosts: |
+    [gitea.sttlab.eu]:2222 ssh-ed25519 PLACEHOLDER
+    [gitea.sttlab.eu]:2222 ssh-rsa PLACEHOLDER
+    [gitea.sttlab.eu]:2222 ecdsa-sha2-nistp256 PLACEHOLDER
diff --git a/flux/gitrepository.yaml b/flux/gitrepository.yaml
index 42dec6b..c3137b7 100644
--- a/flux/gitrepository.yaml
+++ b/flux/gitrepository.yaml
@@ -1,9 +1,5 @@
-# Not applied yet: url is a PLACEHOLDER, this repo has no git remote (see
-# ../../STATUS.md). Once it does, this object is what makes source-controller
-# actually clone it — nothing else does.
-#
 # Bootstrap step, same category as installing the Flux Operator itself
-# (see ../README.md): this file must be applied manually once
+# (see ../README.md): this file was applied manually once
 # (`kubectl apply -f gitrepository.yaml`), because nothing can apply it
 # automatically before it exists — Flux can't fetch the object that tells it
 # where to fetch from. After that one-time apply, since this file lives
@@ -12,9 +8,14 @@
 # would keep it (and everything else here) self-managing going forward —
 # not scaffolded yet, out of scope for this file.
 #
+# secretRef -> k8s-platform-git-auth: SSH identity/known_hosts, created
+# directly via `kubectl create secret` (never written to a file), backed by
+# ~/.ssh/id_rsa (fingerprint SHA256:+BneVyWyJgOlDvISQ597e9YTXmd3GPpN9XHcItgQGKk,
+# already an authorized key on this Gitea account).
+#
 # Any other repo's Kustomization (e.g. dataplane-catalog's
-# flux-kustomization.yaml) can reference this SAME GitRepository by name —
-# one GitRepository per source repo, not per consumer.
+# kustomization.yaml) can reference this SAME GitRepository by name — one
+# GitRepository per source repo, not per consumer.
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
@@ -22,6 +23,8 @@ metadata:
   namespace: flux-system
 spec:
   interval: 5m
-  url: PLACEHOLDER # e.g. https://github.com/<org>/k8s-platform
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-k8s-platform.git
+  secretRef:
+    name: k8s-platform-git-auth
   ref:
     branch: main
diff --git a/kong-platform/dataplane-template-defaults.yaml b/kong-platform/dataplane-template-defaults.yaml
new file mode 100644
index 0000000..5349a84
--- /dev/null
+++ b/kong-platform/dataplane-template-defaults.yaml
@@ -0,0 +1,17 @@
+# Cluster-wide defaults for the dataplane-template ${VAR}s. NOT part of
+# dataplane-template/ itself (that folder is what gets built+applied once
+# per domain into its own namespace — this ConfigMap is applied once,
+# cluster-wide, in flux-system). Each domain's Kustomization lists this
+# FIRST in postBuild.substituteFrom, then its own ConfigMap/Secret after —
+# Flux applies "last wins" precedence across substituteFrom entries, so a
+# domain can still override any of these if it ever needs to.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dataplane-template-defaults
+  namespace: flux-system
+data:
+  KONNECT_SERVER_URL: eu.api.konghq.com
+  GATEWAY_IMAGE: kong/kong-gateway:3.15
+  REPLICAS: "1"
+  TLS_ISSUER_KIND: ClusterIssuer
diff --git a/kong-platform/kustomization.yaml b/kong-platform/kustomization.yaml
index f9792da..54ba02e 100644
--- a/kong-platform/kustomization.yaml
+++ b/kong-platform/kustomization.yaml
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - gatewayclass.yaml
+  - dataplane-template-defaults.yaml