diff --git a/main.tf b/main.tf
index 013d96e..3c56db6 100644
--- a/main.tf
+++ b/main.tf
@@ -44,6 +44,18 @@ variable "traefik_lb_ip" {
   type = string
 }
 
+# Hostname des Longhorn-Dashboards (internes DNS, z.B. Unbound-Override in OPNsense)
+variable "longhorn_host" {
+  type    = string
+  default = "longhorn.boday.lan"
+}
+
+# BasicAuth für Longhorn als htpasswd-Zeile, z.B.: htpasswd -nbB admin 'geheim'
+variable "longhorn_basic_auth" {
+  type      = string
+  sensitive = true
+}
+
 # Kein hostPort mehr -> der Talos-Standard (PSA "baseline") reicht
 resource "kubernetes_namespace" "traefik" {
   metadata {
@@ -96,6 +108,47 @@ resource "helm_release" "traefik" {
       kubernetesIngress = { enabled = true }
       kubernetesCRD     = { enabled = true }
     }
+
+    # Gemeinsame Routen der Plattform: Longhorn-Dashboard mit Login hinter Traefik
+    extraObjects = [
+      {
+        apiVersion = "v1"
+        kind       = "Secret"
+        metadata   = { name = "longhorn-basic-auth", namespace = "longhorn-system" }
+        type       = "Opaque"
+        stringData = { users = var.longhorn_basic_auth }
+      },
+      {
+        apiVersion = "traefik.io/v1alpha1"
+        kind       = "Middleware"
+        metadata   = { name = "longhorn-auth", namespace = "longhorn-system" }
+        spec       = { basicAuth = { secret = "longhorn-basic-auth" } }
+      },
+      {
+        apiVersion = "networking.k8s.io/v1"
+        kind       = "Ingress"
+        metadata = {
+          name      = "longhorn"
+          namespace = "longhorn-system"
+          annotations = {
+            "traefik.ingress.kubernetes.io/router.middlewares" = "longhorn-system-longhorn-auth@kubernetescrd"
+          }
+        }
+        spec = {
+          ingressClassName = "traefik"
+          rules = [{
+            host = var.longhorn_host
+            http = {
+              paths = [{
+                path     = "/"
+                pathType = "Prefix"
+                backend  = { service = { name = "longhorn-frontend", port = { number = 80 } } }
+              }]
+            }
+          }]
+        }
+      },
+    ]
   })]
 }