diff --git a/apps/templates/gateway-folder.yaml b/apps/templates/gateway-folder.yaml
new file mode 100644
index 0000000..1209adb
--- /dev/null
+++ b/apps/templates/gateway-folder.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gateway-folder
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: gateway
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: envoy-gateway-system
+  syncPolicy:
+    syncOptions:
+    - ServerSideApply=true
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/gateway/envoyproxy.yaml b/gateway/envoyproxy.yaml
new file mode 100644
index 0000000..b12a18c
--- /dev/null
+++ b/gateway/envoyproxy.yaml
@@ -0,0 +1,32 @@
+# How Envoy Gateway runs the proxy: a DaemonSet that takes the node's ports
+# directly, the way the microk8s ingress-nginx addon does. Gateway listeners
+# below 1024 run on port + 10000 inside the container (80 becomes 10080).
+#
+# While ingress-nginx still owns 80 and 443, the host ports are 10080 and
+# 10443 so both can be tested side by side.
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: hostport
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      # No cloud load balancer here; a LoadBalancer Service would stay pending.
+      envoyService:
+        type: ClusterIP
+      envoyDaemonSet:
+        patch:
+          type: StrategicMerge
+          value:
+            spec:
+              template:
+                spec:
+                  containers:
+                  - name: envoy
+                    ports:
+                    - containerPort: 10080
+                      hostPort: 10080
+                    - containerPort: 10443
+                      hostPort: 10443
diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
new file mode 100644
index 0000000..1158e90
--- /dev/null
+++ b/gateway/gateway.yaml
@@ -0,0 +1,16 @@
+# The single entry point for all HTTP(S) traffic. Each app adds an HTTPS
+# listener for its hostname here and an HTTPRoute in its own namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: homelab
+  namespace: envoy-gateway-system
+spec:
+  gatewayClassName: envoy
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: All
diff --git a/gateway/gatewayclass.yaml b/gateway/gatewayclass.yaml
new file mode 100644
index 0000000..153b6de
--- /dev/null
+++ b/gateway/gatewayclass.yaml
@@ -0,0 +1,11 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: hostport
+    namespace: envoy-gateway-system