diff --git a/core/installer/values-tmpl/dodo-app-instance.cue b/core/installer/values-tmpl/dodo-app-instance.cue
new file mode 100644
index 0000000..e783ffe
--- /dev/null
+++ b/core/installer/values-tmpl/dodo-app-instance.cue
@@ -0,0 +1,68 @@
+import (
+	"encoding/base64"
+)
+
+input: {
+	appName: string
+	repoAddr: string
+	gitRepoPublicKey: string
+	// TODO(gio): auto generate
+	fluxKeys: #SSHKey
+}
+
+name: "Dodo App Instance"
+namespace: "dodo-app-instance"
+readme: "Deploy app by pushing to Git repository"
+description: "Deploy app by pushing to Git repository"
+icon: ""
+_domain: "\(input.subdomain).\(input.network.domain)"
+
+resources: {
+	"config-kustomization": {
+		apiVersion: "kustomize.toolkit.fluxcd.io/v1"
+		kind: "Kustomization"
+		metadata: {
+			name: input.appName
+			namespace: release.namespace
+		}
+		spec: {
+			interval: "1m"
+			path: "./"
+			sourceRef: {
+				kind: "GitRepository"
+				name: "app"
+				namespace: release.namespace
+			}
+			prune: true
+		}
+	}
+	"config-secret": {
+		apiVersion: "v1"
+		kind: "Secret"
+		type: "Opaque"
+		metadata: {
+			name: input.appName
+			namespace: release.namespace
+		}
+		data: {
+			identity: base64.Encode(null, input.fluxKeys.private)
+			"identity.pub": base64.Encode(null, input.fluxKeys.public)
+			known_hosts: base64.Encode(null, "soft-serve.\(release.namespace).svc.cluster.local \(input.gitRepoPublicKey)")
+		}
+	}
+	"config-source": {
+		apiVersion: "source.toolkit.fluxcd.io/v1"
+		kind: "GitRepository"
+		metadata: {
+			name: input.appName
+			namespace: release.namespace
+		}
+		spec: {
+			interval: "1m0s"
+			ref: branch: "dodo"
+			secretRef: name: input.appName
+			timeout: "60s"
+			url: input.repoAddr
+		}
+	}
+}
diff --git a/core/installer/values-tmpl/dodo-app.cue b/core/installer/values-tmpl/dodo-app.cue
index 80d0e4c..abc09b2 100644
--- a/core/installer/values-tmpl/dodo-app.cue
+++ b/core/installer/values-tmpl/dodo-app.cue
@@ -70,7 +70,7 @@
 			serviceType: "ClusterIP"
 			addressPool: ""
 			reservedIP: ""
-			adminKey: strings.Join([input.adminKey, input.fluxKeys.public, input.dAppKeys.public], "\n")
+			adminKey: strings.Join([input.fluxKeys.public, input.dAppKeys.public], "\n")
 			privateKey: input.ssKeys.private
 			publicKey: input.ssKeys.public
 			ingress: {
@@ -97,6 +97,8 @@
 			self: "dodo-app.\(release.namespace).svc.cluster.local"
 			namespace: release.namespace
 			envConfig: base64.Encode(null, json.Marshal(global))
+			appAdminKey: input.adminKey
+			gitRepoPublicKey: input.ssKeys.public
 		}
 	}
 }
@@ -106,15 +108,15 @@
 		apiVersion: "kustomize.toolkit.fluxcd.io/v1"
 		kind: "Kustomization"
 		metadata: {
-			name: "app"
+			name: "config"
 			namespace: release.namespace
 		}
 		spec: {
 			interval: "1m"
-			path: "./.dodo"
+			path: "./"
 			sourceRef: {
 				kind: "GitRepository"
-				name: "app"
+				name: "config"
 				namespace: release.namespace
 			}
 			prune: true
@@ -125,7 +127,7 @@
 		kind: "Secret"
 		type: "Opaque"
 		metadata: {
-			name: "app"
+			name: "config"
 			namespace: release.namespace
 		}
 		data: {
@@ -138,15 +140,15 @@
 		apiVersion: "source.toolkit.fluxcd.io/v1"
 		kind: "GitRepository"
 		metadata: {
-			name: "app"
+			name: "config"
 			namespace: release.namespace
 		}
 		spec: {
 			interval: "1m0s"
-			ref: branch: "dodo"
-			secretRef: name: "app"
+			ref: branch: "master"
+			secretRef: name: "config"
 			timeout: "60s"
-			url: "ssh://soft-serve.\(release.namespace).svc.cluster.local:22/app"
+			url: "ssh://soft-serve.\(release.namespace).svc.cluster.local:22/config"
 		}
 	}
 }