diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
index 9f32ce9..cc55be4 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
@@ -16,23 +16,24 @@
     - name: Configure Traefik dashboard ingress
       ansible.builtin.template:
         src: ingressroute.j2
-        dest: /var/lib/rancher/k3s/server/manifests/{{ item.name }}-manifest.yaml
+        dest: /var/lib/rancher/k3s/server/manifests/{{ _template.name }}-manifest.yaml
         owner: root
         group: root
         mode: 0600
       vars:
-        name: traefik-dashboard
-        namespace: kube-system
-        config: |2
-            entryPoints:
-            - web
-            - websecure
-            routes:
-            - kind: Rule
-              match: Host(`ingress.{{ vapp['metacluster.fqdn'] }}`)
-              services:
-              - kind: TraefikService
-                name: api@internal
+        _template:
+          name: traefik-dashboard
+          namespace: kube-system
+          config: |2
+              entryPoints:
+              - web
+              - websecure
+              routes:
+              - kind: Rule
+                match: Host(`ingress.{{ vapp['metacluster.fqdn'] }}`)
+                services:
+                - kind: TraefikService
+                  name: api@internal
 
     - name: Ensure API availability
       ansible.utils.cli_parse:
@@ -157,21 +158,22 @@
     - name: Configure additional SSH ingress
       ansible.builtin.template:
         src: ingressroutetcp.j2
-        dest: /var/lib/rancher/k3s/server/manifests/{{ item.name }}-manifest.yaml
+        dest: /var/lib/rancher/k3s/server/manifests/{{ _template.name }}-manifest.yaml
         owner: root
         group: root
         mode: 0600
       vars:
-        name: gitea-ssh
-        namespace: gitea
-        config: |2
-            entryPoints:
-              - ssh
-            routes:
-            - match: HostSNI(`*`)
-              services:
-              - name: gitea-ssh
-                port: 22
+        _template:
+          name: gitea-ssh
+          namespace: gitea
+          config: |2
+              entryPoints:
+                - ssh
+              routes:
+              - match: HostSNI(`*`)
+                services:
+                - name: gitea-ssh
+                  port: 22
 
     - name: Ensure gitea API availability
       ansible.utils.cli_parse:
diff --git a/ansible/roles/firstboot/files/ansible_payload/templates/ingressroute.j2 b/ansible/roles/firstboot/files/ansible_payload/templates/ingressroute.j2
index 8b12efa..0716b65 100644
--- a/ansible/roles/firstboot/files/ansible_payload/templates/ingressroute.j2
+++ b/ansible/roles/firstboot/files/ansible_payload/templates/ingressroute.j2
@@ -1,7 +1,7 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: {{ item.name }}
-  namespace: {{ item.namespace }}
+  name: {{ _template.name }}
+  namespace: {{ _template.namespace }}
 spec:
-{{ item.config }}
+{{ _template.config }}
diff --git a/ansible/roles/firstboot/files/ansible_payload/templates/ingressroutetcp.j2 b/ansible/roles/firstboot/files/ansible_payload/templates/ingressroutetcp.j2
index 53fad5e..d041f1f 100644
--- a/ansible/roles/firstboot/files/ansible_payload/templates/ingressroutetcp.j2
+++ b/ansible/roles/firstboot/files/ansible_payload/templates/ingressroutetcp.j2
@@ -1,7 +1,7 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRouteTCP
 metadata:
-  name: {{ item.name }}
-  namespace: {{ item.namespace }}
+  name: {{ _template.name }}
+  namespace: {{ _template.namespace }}
 spec:
-{{ item.config }}
+{{ _template.config }}