diff --git a/gateway/retry-policy.yaml b/gateway/retry-policy.yaml
index 0552e32..4d2bb90 100644
--- a/gateway/retry-policy.yaml
+++ b/gateway/retry-policy.yaml
@@ -1,8 +1,8 @@
 # Retry a request when the backend drops a kept-alive connection just as
 # Envoy sends a request over it. Envoy answers that with a 503 (flag UC) and
-# does not retry by default; ingress-nginx did. It happens most behind the
-# Apache of sol-auth (immich), which recycles its processes after 30
-# connections, and broke immich's page loads.
+# does not retry by default; ingress-nginx did. It broke immich's page loads
+# behind the Apache of sol-auth (since removed), which recycled its
+# processes after 30 connections, and shows up less often elsewhere.
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: BackendTrafficPolicy
 metadata:
diff --git a/immich/httpd.conf-cm.yml b/immich/httpd.conf-cm.yml
deleted file mode 100644
index 5952210..0000000
--- a/immich/httpd.conf-cm.yml
+++ /dev/null
@@ -1,132 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: httpd-conf
-data:
-  httpd.conf: |
-    ServerRoot "/usr/local/apache2"
-    Listen 8002
-    LoadModule mpm_event_module modules/mod_mpm_event.so
-    LoadModule authn_core_module modules/mod_authn_core.so
-    LoadModule authz_core_module modules/mod_authz_core.so
-    LoadModule xml2enc_module modules/mod_xml2enc.so
-    LoadModule proxy_html_module modules/mod_proxy_html.so
-    LoadModule log_config_module modules/mod_log_config.so
-    LoadModule headers_module modules/mod_headers.so
-    LoadModule proxy_module modules/mod_proxy.so
-    LoadModule proxy_http_module modules/mod_proxy_http.so
-    LoadModule http2_module modules/mod_http2.so
-    LoadModule proxy_http2_module modules/mod_proxy_http2.so
-    LoadModule unixd_module modules/mod_unixd.so
-    LoadModule authopenid_module /usr/lib/apache2/modules/mod_auth_openid.so
-    LoadModule dir_module modules/mod_dir.so
-    LoadModule alias_module modules/mod_alias.so
-    LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
-    LoadModule rewrite_module modules/mod_rewrite.so
-
-    MaxConnectionsPerChild 30
-
-    <IfModule unixd_module>
-    User www-data
-    Group www-data
-    </IfModule>
-
-    ServerAdmin webmaster@scoutingmbg.nl
-    ServerName foto.scoutingmbg.nl
-
-    <Directory />
-        AllowOverride none
-        Require all denied
-    </Directory>
-
-    DocumentRoot "/usr/local/apache2/htdocs"
-
-    <Directory "/usr/local/apache2/htdocs">
-        Options Indexes FollowSymLinks
-        AllowOverride None
-    </Directory>
-
-    <Location />
-      AuthType			  OpenID
-      require valid-user
-      
-      AuthOpenIDDBLocation              /tmp/mod_auth_openid.db
-      AuthOpenIDTrusted                 ^https://login.scouting.nl/.*$ ^https://login.scouting.nl/user/$
-      AuthOpenIDUseCookie               On
-      AuthOpenIDCookieName              open_id_session_id
-      AuthOpenIDCookieLifespan          31536000
-      AuthOpenIDServerName              https://foto.scoutingmbg.nl
-      AuthOpenIDSingleIdP               https://login.scouting.nl/user/
-      AuthOpenIDSecureCookie            On    
-    </Location>
-
-    <Location "/_app">
-      AuthType None
-      Require all granted
-    </Location>
-
-    AllowEncodedSlashes NoDecode
-    ProxyPreserveHost Off
-
-    RewriteEngine on
-    RewriteRule ^/?photos/?$ /sharing [R=301,L]
-
-    ProxyPass / http://helm-immich-server:2283/
-    ProxyPassReverse / http://helm-immich-server:2283/
-    RewriteEngine on
-    RewriteCond %{HTTP:Upgrade} websocket [NC]
-    RewriteCond %{HTTP:Connection} upgrade [NC]
-    RewriteRule ^/?(.*) "ws://helm-immich-server:2283/$1" [P,L]
-    
-
-    # must be bigger than pingInterval (25s by default) + pingTimeout (20s by default)
-    ProxyTimeout 60
-    ProxyRequests off
-
-    Header always set Access-Control-Allow-Origin "*"
-    Header always set Access-Control-Max-Age "1000"
-    Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
-
-    <IfModule dir_module>
-        DirectoryIndex index.html
-    </IfModule>
-
-    <Files ".ht*">
-        Require all denied
-    </Files>
-
-    ErrorLog /proc/self/fd/2
-    LogLevel warn
-
-    <IfModule log_config_module>
-        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-        LogFormat "%h %l %u %t \"%r\" %>s %b" common
-        <IfModule logio_module>
-          LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
-        </IfModule>
-        CustomLog /proc/self/fd/1 common
-    </IfModule>
-
-    <IfModule alias_module>
-        ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
-    </IfModule>
-    <Directory "/usr/local/apache2/cgi-bin">
-        AllowOverride None
-        Options None
-        Require all granted
-    </Directory>
-    <IfModule headers_module>
-        RequestHeader unset Proxy early
-    </IfModule>
-    <IfModule mime_module>
-        TypesConfig conf/mime.types
-        AddType application/x-compress .Z
-        AddType application/x-gzip .gz .tgz
-    </IfModule>
-    <IfModule proxy_html_module>
-        Include conf/extra/proxy-html.conf
-    </IfModule>
-    <IfModule ssl_module>
-        SSLRandomSeed startup builtin
-        SSLRandomSeed connect builtin
-    </IfModule>
diff --git a/immich/sol-auth-deployment.yml b/immich/sol-auth-deployment.yml
deleted file mode 100644
index be9d264..0000000
--- a/immich/sol-auth-deployment.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sol-auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: sol-auth
-  template:
-    metadata:
-      labels:
-        app: sol-auth
-    spec:
-      # securityContext:
-      #     runAsUser: 1000
-      #     runAsGroup: 1000
-      #     fsGroup: 1000
-      containers:
-        - image: hebury/sol-auth:2.3
-          name: sol-auth
-          resources: 
-            requests:
-              memory: "50Mi"
-            limits:
-              memory: "500Mi"
-          ports:
-            - name: http
-              containerPort: 8002
-              hostPort: 8002
-              protocol: TCP
-          volumeMounts:
-          - name: config-volume
-            mountPath: /config/
-      volumes:
-        - name: config-volume
-          configMap:
-            name: httpd-conf
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 5
\ No newline at end of file
diff --git a/immich/sol-auth-service.yaml b/immich/sol-auth-service.yaml
deleted file mode 100644
index 938d4d1..0000000
--- a/immich/sol-auth-service.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: sol-auth-svc
-spec:
-  ports:
-    - name: http-svc
-      port: 8002
-      targetPort: 8002
-  selector:
-    app: sol-auth
-status:
-  loadBalancer: {}
diff --git a/immich/sol-auth/Dockerfile b/immich/sol-auth/Dockerfile
deleted file mode 100644
index 2e94e9d..0000000
--- a/immich/sol-auth/Dockerfile
+++ /dev/null
@@ -1,13 +0,0 @@
-FROM httpd:2.4-bullseye
-RUN apt-get update && \
-    apt-get install --no-install-recommends -y \
-    ca-certificates libapache2-mod-auth-openid
-RUN touch /tmp/mod_auth_openid.db && chown www-data /tmp/mod_auth_openid.db
-RUN mkdir /config
-RUN touch /config/httpd.conf
-RUN rm /usr/local/apache2/conf/httpd.conf
-RUN ln -s /config/httpd.conf /usr/local/apache2/conf/httpd.conf
-
-# how to build: docker build . -t hebury/sol-auth:2.3 
-# how to push: docker push hebury/sol-auth:2.3
-# do not remember how to build for arm atm.
\ No newline at end of file