diff --git a/apps/maddy/install.yaml b/apps/maddy/install.yaml
new file mode 100644
index 0000000..22a46a7
--- /dev/null
+++ b/apps/maddy/install.yaml
@@ -0,0 +1,182 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app-maddy
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: maddy
+  namespace: app-maddy
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: maddy
+  ports:
+    - port: 25
+      protocol: TCP
+      name: a
+    - port: 143
+      protocol: TCP
+      name: b
+    - port: 993
+      protocol: TCP
+      name: c
+    - port: 587
+      protocol: TCP
+      name: d
+    - port: 465
+      protocol: TCP
+      name: e
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-lekva.me  # mx1
+  namespace: app-maddy
+spec:
+  dnsNames:
+  - 'mx1.lekva.me'
+  issuerRef:
+    name: letsencrypt-prod-dns
+    kind: ClusterIssuer
+  secretName: cert-mx1.lekva.me
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+  namespace: app-maddy
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: maddy
+  namespace: app-maddy
+spec:
+  selector:
+    matchLabels:
+      app: maddy
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: maddy
+    spec:
+      volumes:
+      - name: config
+        configMap:
+          name: config
+      - name: certs
+        secret:
+          secretName: cert-mx1.lekva.me
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      containers:
+      - name: maddy
+        image: giolekva/maddy:v0.4.4
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 25
+        - containerPort: 143
+        - containerPort: 993
+        - containerPort: 587
+        - containerPort: 465
+        command: ["maddy"]
+        args: ["-config", "/etc/maddy/config/maddy.conf"]
+        volumeMounts:
+        - name: config
+          mountPath: /etc/maddy/config
+        - name: certs
+          mountPath: /etc/maddy/certs
+        - name: data
+          mountPath: /var/lib/maddy
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mta-sts
+  namespace: app-maddy
+data:
+  mta-sts.txt: |
+    version: STSv1
+    mode: enforce
+    max_age: 604800
+    mx: mx1.lekva.me
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mta-sts
+  namespace: app-maddy
+spec:
+  selector:
+    matchLabels:
+      app: mta-sts
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: mta-sts
+    spec:
+      volumes:
+      - name: mta-sts
+        configMap:
+          name: mta-sts
+      containers:
+      - name: maddy
+        image: giolekva/static-file-server:latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 80
+        command: ["static-file-server"]
+        args: ["-port=80", "-dir=/etc/static-file-server/data"]
+        volumeMounts:
+        - name: mta-sts
+          mountPath: /etc/static-file-server/data/.well-known
+          readOnly: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mta-sts
+  namespace: app-maddy
+spec:
+  type: ClusterIP
+  selector:
+    app: mta-sts
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mta-sts
+  namespace: app-maddy
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: mta-sts.lekva.me
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: mta-sts
+            port:
+              name: http
diff --git a/apps/maddy b/apps/maddy/maddy
similarity index 100%
rename from apps/maddy
rename to apps/maddy/maddy
diff --git a/apps/nebula/Dockerfile b/apps/nebula/Dockerfile
new file mode 100644
index 0000000..a9bc502
--- /dev/null
+++ b/apps/nebula/Dockerfile
@@ -0,0 +1,6 @@
+FROM alpine:latest
+
+COPY nebula/build/linux-arm64/nebula /usr/bin
+COPY nebula/build/linux-arm64/nebula-cert /usr/bin
+RUN chmod +x /usr/bin/nebula
+RUN chmod +x /usr/bin/nebula-cert
diff --git a/apps/nebula/Makefile b/apps/nebula/Makefile
new file mode 100644
index 0000000..e19816e
--- /dev/null
+++ b/apps/nebula/Makefile
@@ -0,0 +1,12 @@
+build:
+	make -C nebula build/linux-arm64/nebula
+	make -C nebula build/linux-arm64/nebula-cert
+
+clean:
+	rm -f nebula/build
+
+image: clean build
+	docker build --tag=giolekva/nebula .
+
+push: image
+	docker push giolekva/nebula:latest
diff --git a/apps/nebula/install.yaml b/apps/nebula/install.yaml
new file mode 100644
index 0000000..16a22ca
--- /dev/null
+++ b/apps/nebula/install.yaml
@@ -0,0 +1,93 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app-nebula
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nebula
+  namespace: app-nebula
+spec:
+  type: LoadBalancer
+  selector:
+    app: nebula
+  ports:
+  - name: nebula
+    port: 4242
+    targetPort: nebula
+    protocol: UDP
+# ---
+# apiVersion: networking.k8s.io/v1
+# kind: Ingress
+# metadata:
+#   name: ingress
+#   namespace: app-nebula
+#   annotations:
+#     cert-manager.io/cluster-issuer: "letsencrypt-prod"
+#     acme.cert-manager.io/http01-edit-in-place: "true"
+# spec:
+#   ingressClassName: nginx
+#   tls:
+#   - hosts:
+#     - woof.lekva.me
+#     secretName: cert-woof.lekva.me
+#   rules:
+#   - host: woof.lekva.me
+#     http:
+#       paths:
+#       - path: /
+#         pathType: Prefix
+#         backend:
+#           service:
+#             name: nebula
+#             port:
+#               name: http
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nebula
+  namespace: app-nebula
+spec:
+  selector:
+    matchLabels:
+      app: nebula
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: nebula
+    spec:
+      volumes:
+      - name: lighthouse-cert
+        configMap:
+          name: lighthouse-cert
+      - name: ca-cert
+        configMap:
+          name: ca-cert
+      - name: config
+        configMap:
+          name: lighthouse-config
+      containers:
+      - name: nebula
+        image: giolekva/nebula:latest
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+          privileged: true
+        ports:
+        - name: nebula
+          containerPort: 4242
+          protocol: UDP
+        command: ["nebula", "--config=/etc/nebula/config/lighthouse.yaml"]
+        volumeMounts:
+        - name: lighthouse-cert
+          mountPath: /etc/nebula/lighthouse
+        - name: ca-cert
+          mountPath: /etc/nebula/ca
+        - name: config
+          mountPath: /etc/nebula/config
diff --git a/apps/nebula/nebula b/apps/nebula/nebula
new file mode 160000
index 0000000..9f34c5e
--- /dev/null
+++ b/apps/nebula/nebula
@@ -0,0 +1 @@
+Subproject commit 9f34c5e2baa7b05b34bcbb13b62beb1bafd92530