diff --git a/core/installer/values-tmpl/certificate-issuer-private.yaml b/core/installer/values-tmpl/certificate-issuer-private.yaml
index 23004a0..be7ac14 100644
--- a/core/installer/values-tmpl/certificate-issuer-private.yaml
+++ b/core/installer/values-tmpl/certificate-issuer-private.yaml
@@ -22,9 +22,8 @@
       gandiWebhookSecretReader: {{ .Global.PCloudEnvName }}-cert-manager-webhook-gandi
     issuer:
       name: {{ .Global.Id }}-private
-      # server: https://acme-v02.api.letsencrypt.org/directory
-      server: https://acme-staging-v02.api.letsencrypt.org/directory
+      server: https://acme-v02.api.letsencrypt.org/directory
+      # server: https://acme-staging-v02.api.letsencrypt.org/directory
       domain: {{ .Global.PrivateDomain }}
       contactEmail: {{ .Global.ContactEmail }}
-      ingressClassName: {{ .Global.Id }}-ingress-private
       gandiAPIToken: {{ .Values.GandiAPIToken }}
diff --git a/core/installer/values-tmpl/certificate-issuer-public.jsonschema b/core/installer/values-tmpl/certificate-issuer-public.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/certificate-issuer-public.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/certificate-issuer-public.md b/core/installer/values-tmpl/certificate-issuer-public.md
new file mode 100644
index 0000000..961c3c3
--- /dev/null
+++ b/core/installer/values-tmpl/certificate-issuer-public.md
@@ -0,0 +1 @@
+Install HTTP01 based certificate issuer for public domain
diff --git a/core/installer/values-tmpl/certificate-issuer.yaml b/core/installer/values-tmpl/certificate-issuer-public.yaml
similarity index 68%
rename from core/installer/values-tmpl/certificate-issuer.yaml
rename to core/installer/values-tmpl/certificate-issuer-public.yaml
index 06729ff..f5fcaf2 100644
--- a/core/installer/values-tmpl/certificate-issuer.yaml
+++ b/core/installer/values-tmpl/certificate-issuer-public.yaml
@@ -4,13 +4,14 @@
   name: certificate-issuer
   namespace: {{ .Global.Id }}
 spec:
+  # TODO(giolekva): is there better namespace for this?
   targetNamespace: {{ .Global.NamespacePrefix }}ingress-private
   dependsOn:
   - name: ingress-private
     namespace: {{ .Global.Id }}
   chart:
     spec:
-      chart: charts/certificate-issuer
+      chart: charts/certificate-issuer-public
       sourceRef:
         kind: GitRepository
         name: pcloud
@@ -21,18 +22,10 @@
     certManager:
       namespace: {{ .Global.PCloudEnvName }}-cert-manager
       gandiWebhookSecretReader: {{ .Global.PCloudEnvName }}-cert-manager-webhook-gandi
-    public:
+    issuer:
       name: {{ .Global.Id }}-public
       server: https://acme-v02.api.letsencrypt.org/directory
       # server: https://acme-staging-v02.api.letsencrypt.org/directory
       domain: {{ .Global.Domain }}
       contactEmail: {{ .Global.ContactEmail }}
       ingressClass: {{ .Global.PCloudEnvName }}-ingress-public
-    private:
-      name: {{ .Global.Id }}-private
-      server: https://acme-v02.api.letsencrypt.org/directory
-      # server: https://acme-staging-v02.api.letsencrypt.org/directory
-      domain: {{ .Global.PrivateDomain }}
-      contactEmail: {{ .Global.ContactEmail }}
-      ingressClassName: {{ .Global.Id }}-ingress-private
-      gandiAPIToken: {{ .Values.GandiAPIToken }}
diff --git a/core/installer/values-tmpl/ingress-private.jsonschema b/core/installer/values-tmpl/ingress-private.jsonschema
index 46ae9c3..f42d895 100644
--- a/core/installer/values-tmpl/ingress-private.jsonschema
+++ b/core/installer/values-tmpl/ingress-private.jsonschema
@@ -1,7 +1,6 @@
 {
   "type": "object",
   "properties": {
-    "GandiAPIToken": { "type": "string" },
   },
   "additionalProperties": false
 }
diff --git a/core/installer/values-tmpl/welcome.jsonschema b/core/installer/values-tmpl/welcome.jsonschema
new file mode 100644
index 0000000..8a011ca
--- /dev/null
+++ b/core/installer/values-tmpl/welcome.jsonschema
@@ -0,0 +1,8 @@
+{
+  "type": "object",
+  "properties": {
+    "RepoAddr": { "type": "string", "default": "ssh://192.168.0.11/example" },
+	"SSHPrivateKey": { "type": "string", "default": "foo bar" }
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/welcome.md b/core/installer/values-tmpl/welcome.md
new file mode 100644
index 0000000..43d5021
--- /dev/null
+++ b/core/installer/values-tmpl/welcome.md
@@ -0,0 +1 @@
+Installs welcome service
diff --git a/core/installer/values-tmpl/welcome.yaml b/core/installer/values-tmpl/welcome.yaml
new file mode 100644
index 0000000..94c68a3
--- /dev/null
+++ b/core/installer/values-tmpl/welcome.yaml
@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-welcome
+  namespace: {{ .Global.Id }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    pcloudInstanceId: {{ .Global.Id }}
+    namespacePrefix: {{ .Global.NamespacePrefix }}
+    namespaces:
+    - app-welcome
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: env-manager
+  namespace: {{ .Global.Id }}
+spec:
+  targetNamespace: {{ .Global.NamespacePrefix }}app-welcome
+  dependsOn:
+    - name: namespaces-welcome
+      namespace: {{ .Global.Id }}
+  chart:
+    spec:
+      chart: charts/welcome
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    repoAddr: {{ .Values.RepoAddr }}
+    sshPrivateKey: {{ .Values.SSHPrivateKey | b64enc }}
+    ingress:
+      className: {{ .Global.PCloudEnvName }}-ingress-public
+      domain: {{ .Global.Domain }}
+      certificateIssuer: {{ .Global.Id }}-public