diff --git a/apps-kustomized/s3onhp40l/ing-masto-media.yaml b/apps-kustomized/s3onhp40l/ing-masto-media.yaml
index 96979f8..3d1e3c6 100644
--- a/apps-kustomized/s3onhp40l/ing-masto-media.yaml
+++ b/apps-kustomized/s3onhp40l/ing-masto-media.yaml
@@ -14,6 +14,7 @@ metadata:
       if ($uri !~ "^(.*)\.(.*)$") {
         rewrite ^ $uri/index.html break;
       }
+      rewrite ^/masto-media/(.*) /$1;
     nginx.ingress.kubernetes.io/enable-rewrite-log: "true"
     nginx.ingress.kubernetes.io/rewrite-target: /masto-media/$1
     nginx.ingress.kubernetes.io/use-regex: "true"
diff --git a/apps-kustomized/s3onhp40l/ing.yaml b/apps-kustomized/s3onhp40l/ing.yaml
new file mode 100644
index 0000000..7147e80
--- /dev/null
+++ b/apps-kustomized/s3onhp40l/ing.yaml
@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
+  name: s3
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: s3.martyn.berlin
+    http:
+      paths:
+      - backend:
+          service:
+            name: s3
+            port:
+              number: 8333
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - s3.martyn.berlin