diff --git a/core/installer/app.go b/core/installer/app.go
index 6312e8b..384e54f 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -4,7 +4,6 @@
 	"archive/tar"
 	"compress/gzip"
 	"embed"
-	"encoding/json"
 	"fmt"
 	htemplate "html/template"
 	"io"
@@ -37,16 +36,12 @@
 	Name       string
 	Namespaces []string
 	Templates  []*template.Template
-	Schema     string
+	schema     Schema
 	Readme     *template.Template
 }
 
-func (a App) ConfigSchema() map[string]any {
-	ret := make(map[string]any)
-	if err := json.NewDecoder(strings.NewReader(a.Schema)).Decode(&ret); err != nil {
-		panic(err) // TODO(giolekva): prevalidate
-	}
-	return ret
+func (a App) Schema() Schema {
+	return a.schema
 }
 
 type StoreApp struct {
@@ -140,9 +135,21 @@
 	}
 }
 
+func readJSONSchemaFromFile(fs embed.FS, f string) (Schema, error) {
+	schema, err := fs.ReadFile(f)
+	if err != nil {
+		return nil, err
+	}
+	ret, err := NewJSONSchema(string(schema))
+	if err != nil {
+		return nil, err
+	}
+	return ret, nil
+}
+
 // TODO(gio): service account needs permission to create/update secret
 func CreateAppIngressPrivate(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/private-network.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/private-network.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -153,13 +160,13 @@
 			tmpls.Lookup("ingress-private.yaml"),
 			tmpls.Lookup("tailscale-proxy.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("private-network.md"),
 	}
 }
 
 func CreateCertificateIssuerPrivate(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/certificate-issuer-private.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/certificate-issuer-private.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -169,13 +176,13 @@
 		[]*template.Template{
 			tmpls.Lookup("certificate-issuer-private.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("certificate-issuer-private.md"),
 	}
 }
 
 func CreateCertificateIssuerPublic(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/certificate-issuer-public.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/certificate-issuer-public.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -185,13 +192,13 @@
 		[]*template.Template{
 			tmpls.Lookup("certificate-issuer-public.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("certificate-issuer-public.md"),
 	}
 }
 
 func CreateAppCoreAuth(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/core-auth.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/core-auth.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -202,13 +209,13 @@
 			tmpls.Lookup("core-auth-storage.yaml"),
 			tmpls.Lookup("core-auth.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("core-auth.md"),
 	}
 }
 
 func CreateAppVaultwarden(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/vaultwarden.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/vaultwarden.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -219,7 +226,7 @@
 			[]*template.Template{
 				tmpls.Lookup("vaultwarden.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("vaultwarden.md"),
 		},
 		Icon:             `<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 48 48"><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" d="M35.38 25.63V9.37H24v28.87a34.93 34.93 0 0 0 5.41-3.48q6-4.66 6-9.14Zm4.87-19.5v19.5A11.58 11.58 0 0 1 39.4 30a16.22 16.22 0 0 1-2.11 3.81a23.52 23.52 0 0 1-3 3.24a34.87 34.87 0 0 1-3.22 2.62c-1 .69-2 1.35-3.07 2s-1.82 1-2.27 1.26l-1.08.51a1.53 1.53 0 0 1-1.32 0l-1.08-.51c-.45-.22-1.21-.64-2.27-1.26s-2.09-1.27-3.07-2A34.87 34.87 0 0 1 13.7 37a23.52 23.52 0 0 1-3-3.24A16.22 16.22 0 0 1 8.6 30a11.58 11.58 0 0 1-.85-4.32V6.13A1.64 1.64 0 0 1 9.38 4.5h29.24a1.64 1.64 0 0 1 1.63 1.63Z"/></svg>`,
@@ -228,7 +235,7 @@
 }
 
 func CreateAppMatrix(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/matrix.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/matrix.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -240,7 +247,7 @@
 				tmpls.Lookup("matrix-storage.yaml"),
 				tmpls.Lookup("matrix.yaml"),
 			},
-			string(schema),
+			schema,
 			nil,
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 24 24"><path fill="currentColor" d="M.632.55v22.9H2.28V24H0V0h2.28v.55zm7.043 7.26v1.157h.033a3.312 3.312 0 0 1 1.117-1.024c.433-.245.936-.365 1.5-.365c.54 0 1.033.107 1.481.314c.448.208.785.582 1.02 1.108c.254-.374.6-.706 1.034-.992c.434-.287.95-.43 1.546-.43c.453 0 .872.056 1.26.167c.388.11.716.286.993.53c.276.245.489.559.646.951c.152.392.23.863.23 1.417v5.728h-2.349V11.52c0-.286-.01-.559-.032-.812a1.755 1.755 0 0 0-.18-.66a1.106 1.106 0 0 0-.438-.448c-.194-.11-.457-.166-.785-.166c-.332 0-.6.064-.803.189a1.38 1.38 0 0 0-.48.499a1.946 1.946 0 0 0-.231.696a5.56 5.56 0 0 0-.06.785v4.768h-2.35v-4.8c0-.254-.004-.503-.018-.752a2.074 2.074 0 0 0-.143-.688a1.052 1.052 0 0 0-.415-.503c-.194-.125-.476-.19-.854-.19c-.111 0-.259.024-.439.074c-.18.051-.36.143-.53.282a1.637 1.637 0 0 0-.439.595c-.12.259-.18.6-.18 1.02v4.966H5.46V7.81zm15.693 15.64V.55H21.72V0H24v24h-2.28v-.55z"/></svg>`,
@@ -249,7 +256,7 @@
 }
 
 func CreateAppPihole(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/pihole.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/pihole.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -260,7 +267,7 @@
 			[]*template.Template{
 				tmpls.Lookup("pihole.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("pihole.md"),
 		},
 		// "simple-icons:pihole",
@@ -270,7 +277,7 @@
 }
 
 func CreateAppPenpot(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/penpot.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/penpot.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -281,7 +288,7 @@
 			[]*template.Template{
 				tmpls.Lookup("penpot.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("penpot.md"),
 		},
 		// "simple-icons:pihole",
@@ -291,7 +298,7 @@
 }
 
 func CreateAppMaddy(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/maddy.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/maddy.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -302,7 +309,7 @@
 			[]*template.Template{
 				tmpls.Lookup("maddy.yaml"),
 			},
-			string(schema),
+			schema,
 			nil,
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 48 48"><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" d="M9.5 13c13.687 13.574 14.825 13.09 29 0"/><rect width="37" height="31" x="5.5" y="8.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" rx="2"/></svg>`,
@@ -311,7 +318,7 @@
 }
 
 func CreateAppQBittorrent(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/qbittorrent.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/qbittorrent.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -322,7 +329,7 @@
 			[]*template.Template{
 				tmpls.Lookup("qbittorrent.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("qbittorrent.md"),
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 48 48"><circle cx="24" cy="24" r="21.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" d="M26.651 22.364a5.034 5.034 0 0 1 5.035-5.035h0a5.034 5.034 0 0 1 5.034 5.035v3.272a5.034 5.034 0 0 1-5.034 5.035h0a5.034 5.034 0 0 1-5.035-5.035m0 5.035V10.533m-5.302 15.103a5.034 5.034 0 0 1-5.035 5.035h0a5.034 5.034 0 0 1-5.034-5.035v-3.272a5.034 5.034 0 0 1 5.034-5.035h0a5.034 5.034 0 0 1 5.035 5.035m0-5.035v20.138"/></svg>`,
@@ -331,7 +338,7 @@
 }
 
 func CreateAppJellyfin(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/jellyfin.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/jellyfin.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -342,7 +349,7 @@
 			[]*template.Template{
 				tmpls.Lookup("jellyfin.yaml"),
 			},
-			string(schema),
+			schema,
 			nil,
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 48 48"><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" d="M24 20c-1.62 0-6.85 9.48-6.06 11.08s11.33 1.59 12.12 0S25.63 20 24 20Z"/><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" d="M24 5.5c-4.89 0-20.66 28.58-18.25 33.4s34.13 4.77 36.51 0S28.9 5.5 24 5.5Zm12 29.21c-1.56 3.13-22.35 3.17-23.93 0S20.8 12.83 24 12.83s13.52 18.76 12 21.88Z"/></svg>`,
@@ -351,7 +358,7 @@
 }
 
 func CreateAppRpuppy(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/rpuppy.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/rpuppy.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -362,7 +369,7 @@
 			[]*template.Template{
 				tmpls.Lookup("rpuppy.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("rpuppy.md"),
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 256 256"><path fill="currentColor" d="M100 140a8 8 0 1 1-8-8a8 8 0 0 1 8 8Zm64 8a8 8 0 1 0-8-8a8 8 0 0 0 8 8Zm64.94-9.11a12.12 12.12 0 0 1-5 1.11a11.83 11.83 0 0 1-9.35-4.62l-2.59-3.29V184a36 36 0 0 1-36 36H80a36 36 0 0 1-36-36v-51.91l-2.53 3.27A11.88 11.88 0 0 1 32.1 140a12.08 12.08 0 0 1-5-1.11a11.82 11.82 0 0 1-6.84-13.14l16.42-88a12 12 0 0 1 14.7-9.43h.16L104.58 44h46.84l53.08-15.6h.16a12 12 0 0 1 14.7 9.43l16.42 88a11.81 11.81 0 0 1-6.84 13.06ZM97.25 50.18L49.34 36.1a4.18 4.18 0 0 0-.92-.1a4 4 0 0 0-3.92 3.26l-16.42 88a4 4 0 0 0 7.08 3.22ZM204 121.75L150 52h-44l-54 69.75V184a28 28 0 0 0 28 28h44v-18.34l-14.83-14.83a4 4 0 0 1 5.66-5.66L128 186.34l13.17-13.17a4 4 0 0 1 5.66 5.66L132 193.66V212h44a28 28 0 0 0 28-28Zm23.92 5.48l-16.42-88a4 4 0 0 0-4.84-3.16l-47.91 14.11l62.11 80.28a4 4 0 0 0 7.06-3.23Z"/></svg>`,
@@ -371,7 +378,7 @@
 }
 
 func CreateAppSoftServe(fs embed.FS, tmpls *template.Template) StoreApp {
-	schema, err := fs.ReadFile("values-tmpl/soft-serve.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/soft-serve.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -382,7 +389,7 @@
 			[]*template.Template{
 				tmpls.Lookup("soft-serve.yaml"),
 			},
-			string(schema),
+			schema,
 			tmpls.Lookup("soft-serve.md"),
 		},
 		`<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 48 48"><g fill="none" stroke="currentColor" stroke-linecap="round" stroke-width="4"><path stroke-linejoin="round" d="M15.34 22.5L21 37l3 6l3-6l5.66-14.5"/><path d="M19 32h10"/><path stroke-linejoin="round" d="M24 3c-6 0-8 6-8 6s-6 2-6 7s5 7 5 7s3.5-2 9-2s9 2 9 2s5-2 5-7s-6-7-6-7s-2-6-8-6Z"/></g></svg>`,
@@ -391,7 +398,7 @@
 }
 
 func CreateAppHeadscale(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/headscale.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/headscale.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -401,13 +408,13 @@
 		[]*template.Template{
 			tmpls.Lookup("headscale.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("headscale.md"),
 	}
 }
 
 func CreateAppHeadscaleUser(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/headscale-user.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/headscale-user.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -417,13 +424,13 @@
 		[]*template.Template{
 			tmpls.Lookup("headscale-user.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("headscale-user.md"),
 	}
 }
 
 func CreateMetallbIPAddressPool(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/metallb-ipaddresspool.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/metallb-ipaddresspool.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -433,13 +440,13 @@
 		[]*template.Template{
 			tmpls.Lookup("metallb-ipaddresspool.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("metallb-ipaddresspool.md"),
 	}
 }
 
 func CreateEnvManager(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/env-manager.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/env-manager.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -449,13 +456,13 @@
 		[]*template.Template{
 			tmpls.Lookup("env-manager.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("env-manager.md"),
 	}
 }
 
 func CreateWelcome(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/welcome.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/welcome.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -465,13 +472,13 @@
 		[]*template.Template{
 			tmpls.Lookup("welcome.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("welcome.md"),
 	}
 }
 
 func CreateAppManager(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/appmanager.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/appmanager.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -481,13 +488,13 @@
 		[]*template.Template{
 			tmpls.Lookup("appmanager.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("appmanager.md"),
 	}
 }
 
 func CreateIngressPublic(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/ingress-public.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/ingress-public.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -497,13 +504,13 @@
 		[]*template.Template{
 			tmpls.Lookup("ingress-public.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("ingress-public.md"),
 	}
 }
 
 func CreateCertManager(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/cert-manager.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/cert-manager.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -513,13 +520,13 @@
 		[]*template.Template{
 			tmpls.Lookup("cert-manager.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("cert-manager.md"),
 	}
 }
 
 func CreateCertManagerWebhookGandi(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/cert-manager-webhook-pcloud.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/cert-manager-webhook-pcloud.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -529,13 +536,13 @@
 		[]*template.Template{
 			tmpls.Lookup("cert-manager-webhook-pcloud.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("cert-manager-webhook-pcloud.md"),
 	}
 }
 
 func CreateCSIDriverSMB(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/csi-driver-smb.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/csi-driver-smb.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -545,13 +552,13 @@
 		[]*template.Template{
 			tmpls.Lookup("csi-driver-smb.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("csi-driver-smb.md"),
 	}
 }
 
 func CreateResourceRendererController(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/resource-renderer-controller.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/resource-renderer-controller.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -561,13 +568,13 @@
 		[]*template.Template{
 			tmpls.Lookup("resource-renderer-controller.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("resource-renderer-controller.md"),
 	}
 }
 
 func CreateHeadscaleController(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/headscale-controller.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/headscale-controller.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -577,13 +584,13 @@
 		[]*template.Template{
 			tmpls.Lookup("headscale-controller.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("headscale-controller.md"),
 	}
 }
 
 func CreateDNSZoneManager(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/dns-zone-controller.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/dns-zone-controller.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -595,13 +602,13 @@
 			tmpls.Lookup("coredns.yaml"),
 			tmpls.Lookup("dns-zone-controller.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("dns-zone-controller.md"),
 	}
 }
 
 func CreateFluxcdReconciler(fs embed.FS, tmpls *template.Template) App {
-	schema, err := fs.ReadFile("values-tmpl/fluxcd-reconciler.jsonschema")
+	schema, err := readJSONSchemaFromFile(fs, "values-tmpl/fluxcd-reconciler.jsonschema")
 	if err != nil {
 		panic(err)
 	}
@@ -611,7 +618,7 @@
 		[]*template.Template{
 			tmpls.Lookup("fluxcd-reconciler.yaml"),
 		},
-		string(schema),
+		schema,
 		tmpls.Lookup("fluxcd-reconciler.md"),
 	}
 }
@@ -764,7 +771,11 @@
 		return StoreApp{}, err
 	}
 	defer sb.Close()
-	schema, err := io.ReadAll(sb)
+	scm, err := io.ReadAll(sb)
+	if err != nil {
+		return StoreApp{}, err
+	}
+	schema, err := NewJSONSchema(string(scm))
 	if err != nil {
 		return StoreApp{}, err
 	}
@@ -795,7 +806,7 @@
 		App: App{
 			Name:       appCfg.Name,
 			Readme:     readmeTmpl,
-			Schema:     string(schema),
+			schema:     schema,
 			Namespaces: appCfg.Namespaces,
 			Templates:  tmpls,
 		},
diff --git a/core/installer/app_manager.go b/core/installer/app_manager.go
index 84b87a1..bf9dbe2 100644
--- a/core/installer/app_manager.go
+++ b/core/installer/app_manager.go
@@ -76,7 +76,7 @@
 	if err != nil {
 		return err
 	}
-	derivedValues, err := deriveValues(config, app.ConfigSchema(), CreateNetworks(globalConfig))
+	derivedValues, err := deriveValues(config, app.Schema(), CreateNetworks(globalConfig))
 	if err != nil {
 		fmt.Println(err)
 		return err
@@ -113,7 +113,7 @@
 	if err != nil {
 		return err
 	}
-	derivedValues, err := deriveValues(config, app.ConfigSchema(), CreateNetworks(globalConfig))
+	derivedValues, err := deriveValues(config, app.Schema(), CreateNetworks(globalConfig))
 	if err != nil {
 		return err
 	}
diff --git a/core/installer/app_test.go b/core/installer/app_test.go
new file mode 100644
index 0000000..d43809c
--- /dev/null
+++ b/core/installer/app_test.go
@@ -0,0 +1,296 @@
+package installer
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/cuecontext"
+	fluxcd "github.com/fluxcd/source-controller/api/v1beta2"
+	"helm.sh/helm/v3/pkg/registry"
+	// "github.com/go-git/go-billy/v5/memfs"
+	"github.com/go-git/go-billy/v5/osfs"
+	"helm.sh/helm/v3/pkg/action"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+//go:embed values-tmpl/rpuppy.cue
+var rpuppyConfig []byte
+
+type ContainerImage struct {
+	Repository string
+	Tag        string
+	PullPolicy string
+}
+
+type Chart struct {
+	Source ChartSource
+	Chart  string
+}
+
+type ChartSource struct {
+	Kind    string
+	Address string
+}
+
+type ApplicationConfig struct {
+	Images map[string]ContainerImage
+	Charts map[string]Chart
+}
+
+type client struct {
+	clientset dynamic.Interface
+}
+
+func (c *client) CreateHelmChart(chart fluxcd.HelmChart) error {
+	var buf bytes.Buffer
+	if err := json.NewEncoder(&buf).Encode(chart); err != nil {
+		return nil
+	}
+	var u unstructured.Unstructured
+	if err := json.NewDecoder(&buf).Decode(&u.Object); err != nil {
+		return err
+	}
+	_, err := c.clientset.Resource(schema.GroupVersionResource{Group: fluxcd.GroupVersion.Group, Version: fluxcd.GroupVersion.Version, Resource: "helmcharts"}).Namespace(chart.Namespace).Create(context.TODO(), &u, metav1.CreateOptions{})
+	return err
+}
+
+func NewClient(kubeconfig string) (*client, error) {
+	if kubeconfig == "" {
+		config, err := rest.InClusterConfig()
+		if err != nil {
+			return nil, err
+		}
+		c, err := dynamic.NewForConfig(config)
+		if err != nil {
+			return nil, err
+		}
+		return &client{c}, nil
+
+	} else {
+		config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
+		if err != nil {
+			return nil, err
+		}
+		c, err := dynamic.NewForConfig(config)
+		if err != nil {
+			return nil, err
+		}
+		return &client{c}, nil
+	}
+}
+
+const networkSchema = `
+#Network: {
+	IngressClass: string
+	CertificateIssuer: string
+	Domain: string
+}
+
+value: %s
+
+valid: #Network & value
+`
+
+type StringFormatter struct {
+	s strings.Builder
+}
+
+func (f *StringFormatter) Write(b []byte) (n int, err error) {
+	return f.s.Write(b)
+}
+
+func (f *StringFormatter) Width() (wid int, ok bool) {
+	return 4, true
+}
+
+func (f *StringFormatter) Precision() (prec int, ok bool) {
+	return 4, true
+}
+
+func (f *StringFormatter) Flag(c int) bool {
+	return false
+}
+
+func IsNetwork(v cue.Value) bool {
+	if v.Value().Kind() != cue.StructKind {
+		return false
+	}
+	value := fmt.Sprintf("%#v", v)
+	s := fmt.Sprintf(networkSchema, value)
+	c := cuecontext.New()
+	u := c.CompileString(s)
+	return u.Err() == nil && u.Validate() == nil
+}
+
+func PrintSchema(v cue.Value) {
+	f, _ := v.Fields()
+	for f.Next() {
+		fmt.Printf("%s\n", f.Selector())
+		if IsNetwork(f.Value()) {
+			fmt.Println("network")
+		}
+		PrintSchema(f.Value())
+	}
+}
+
+func TestInput(t *testing.T) {
+	c := cuecontext.New()
+	cfg := c.CompileBytes(rpuppyConfig)
+	input := c.CompileString(`
+global: {
+  id: "foo"
+}
+input: {
+  network: {
+    name: "public"
+    ingressClass: "dodo-ingress-public"
+    certificateIssuer: "rpuppu-public"
+    domain: "lekva.me"
+  }
+  subdomain: "rpuppy"
+}
+`)
+	if cfg.Err() != nil {
+		panic(cfg.Err())
+	}
+	if err := cfg.Validate(); err != nil {
+		panic(err)
+	}
+	PrintSchema(cfg.Eval().LookupPath(cue.ParsePath("input")))
+	out := cfg.Unify(input)
+	if out.Err() != nil {
+		panic(out.Err())
+	}
+	if err := out.Validate(); err != nil {
+		panic(err)
+	}
+	fmt.Printf("%#v\n", out)
+	e := out.Eval()
+	if e.Err() != nil {
+		panic(out.Err())
+	}
+	if err := e.Validate(); err != nil {
+		panic(err)
+	}
+	fmt.Printf("%#v\n", e)
+	fmt.Println(e.IsConcrete())
+}
+
+func TestParseApplicationConfig(t *testing.T) {
+	return
+	var r cue.Runtime
+	i, err := r.Compile("rpuppy", rpuppyConfig)
+	if err != nil {
+		panic(err)
+	}
+	var cfg ApplicationConfig
+	if err := i.Value().Decode(&cfg); err != nil {
+		panic(err)
+	}
+	fmt.Printf("%+v\n", cfg)
+	_, err = NewClient("/Users/lekva/dev/src/pcloud/priv/kubeconfig-hetzner")
+	if err != nil {
+		panic(err)
+	}
+
+	for name, c := range cfg.Charts {
+		chart := fluxcd.HelmChart{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: fluxcd.GroupVersion.String(),
+				Kind:       "HelmChart",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: "dodo",
+			},
+			Spec: fluxcd.HelmChartSpec{
+				Chart: c.Chart,
+				SourceRef: fluxcd.LocalHelmChartSourceReference{
+					Kind: c.Source.Kind,
+					Name: c.Source.Address,
+				},
+				Interval: metav1.Duration{time.Hour},
+			},
+		}
+		fmt.Printf("%+v\n", chart)
+		// if err := client.CreateHelmChart(chart); err != nil {
+		// 	panic(err)
+		// }
+	}
+}
+
+type downloader struct {
+	client *http.Client
+}
+
+func NewDownloader() *downloader {
+	return &downloader{
+		client: http.DefaultClient,
+	}
+}
+
+func (d *downloader) Download(addr string, out io.Writer) error {
+	resp, err := d.client.Get(addr)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(out, resp.Body); err != nil {
+		return err
+	}
+	return nil
+}
+
+func TestDownload(t *testing.T) {
+	return
+	// fs := memfs.New()
+	fs := osfs.New("/tmp")
+	func() {
+		f, err := fs.Create("/chart")
+		if err != nil {
+			panic(err)
+		}
+		defer f.Close()
+		d := NewDownloader()
+		if err := d.Download("http://localhost:9090/helmchart/dodo/rpuppy/rpuppy-0.0.1.tgz", f); err != nil {
+			panic(err)
+		}
+	}()
+	client, err := registry.NewClient()
+	if err != nil {
+		panic(err)
+	}
+	if err := client.Login("https://harbor.t46.lekva.me", registry.LoginOptBasicAuth("admin", "Harbor12345")); err != nil {
+		panic(err)
+	}
+	defer client.Logout("https://harbor.t46.lekva.me")
+	push := action.NewPushWithOpts(action.WithPushConfig(&action.Configuration{
+		RegistryClient: client,
+	}))
+	fmt.Printf("%+v\n", push)
+	res, err := push.Run("/tmp/chart", "oci://harbor.t46.lekva.me/library/charts")
+	fmt.Println(res)
+	if err != nil {
+		panic(err)
+	}
+	// cfg, err := ActionConfigFactory{"/Users/lekva/dev/src/pcloud/priv/kubeconfig-hetzner"}.New("")
+	// installer := action.NewInstall(config)
+	// installer.Namespace = env.Name
+	// installer.ReleaseName = "metallb-ns"
+	// installer.Wait = true
+	// installer.WaitForJobs = true
+
+}
diff --git a/core/installer/cmd/bootstrap.go b/core/installer/cmd/bootstrap.go
index d177ff5..0aa5230 100644
--- a/core/installer/cmd/bootstrap.go
+++ b/core/installer/cmd/bootstrap.go
@@ -7,8 +7,6 @@
 	"os"
 
 	"github.com/spf13/cobra"
-	"helm.sh/helm/v3/pkg/action"
-	"helm.sh/helm/v3/pkg/kube"
 
 	"github.com/giolekva/pcloud/core/installer"
 )
@@ -105,31 +103,11 @@
 	b := installer.NewBootstrapper(
 		installer.NewFSChartLoader(bootstrapFlags.chartsDir),
 		nsCreator,
-		actionConfigFactory{rootFlags.kubeConfig},
+		installer.NewActionConfigFactory(rootFlags.kubeConfig),
 	)
 	return b.Run(envConfig)
 }
 
-type actionConfigFactory struct {
-	kubeConfigPath string
-}
-
-func (f actionConfigFactory) New(namespace string) (*action.Configuration, error) {
-	config := new(action.Configuration)
-	if err := config.Init(
-		kube.GetConfig(f.kubeConfigPath, "", namespace),
-		namespace,
-		"",
-		func(fmtString string, args ...any) {
-			fmt.Printf(fmtString, args...)
-			fmt.Println()
-		},
-	); err != nil {
-		return nil, err
-	}
-	return config, nil
-}
-
 func newServiceIPs(from, to string) (installer.EnvServiceIPs, error) {
 	f, err := netip.ParseAddr(from)
 	if err != nil {
diff --git a/core/installer/go.mod b/core/installer/go.mod
index 574c837..a71cc2d 100644
--- a/core/installer/go.mod
+++ b/core/installer/go.mod
@@ -5,9 +5,11 @@
 toolchain go1.21.5
 
 require (
+	cuelang.org/go v0.7.0
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/cenkalti/backoff/v4 v4.2.1
 	github.com/charmbracelet/keygen v0.5.0
+	github.com/fluxcd/source-controller/api v1.2.3
 	github.com/giolekva/pcloud/core/ns-controller v0.0.0-20231212095918-378ea88919ca
 	github.com/go-git/go-billy/v5 v5.5.0
 	github.com/go-git/go-git/v5 v5.10.1
@@ -43,6 +45,7 @@
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/containerd/containerd v1.7.6 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -58,11 +61,13 @@
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
 	github.com/fatih/color v1.15.0 // indirect
+	github.com/fluxcd/pkg/apis/acl v0.1.0 // indirect
+	github.com/fluxcd/pkg/apis/meta v1.2.0 // indirect
 	github.com/frankban/quicktest v1.14.5 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.20.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
@@ -110,6 +115,7 @@
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
@@ -156,18 +162,18 @@
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.28.2 // indirect
-	k8s.io/apiserver v0.28.2 // indirect
+	k8s.io/apiextensions-apiserver v0.28.3 // indirect
+	k8s.io/apiserver v0.28.3 // indirect
 	k8s.io/cli-runtime v0.28.2 // indirect
-	k8s.io/component-base v0.28.2 // indirect
-	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/component-base v0.28.3 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230928205116-a78145627833 // indirect
 	k8s.io/kubectl v0.28.2 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	k8s.io/utils v0.0.0-20231127182322-b307cd553661 // indirect
 	oras.land/oras-go v1.2.4 // indirect
-	sigs.k8s.io/controller-runtime v0.16.1 // indirect
+	sigs.k8s.io/controller-runtime v0.16.3 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 )
diff --git a/core/installer/go.sum b/core/installer/go.sum
index 20f244b..bdf96ba 100644
--- a/core/installer/go.sum
+++ b/core/installer/go.sum
@@ -1,4 +1,8 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cuelabs.dev/go/oci/ociregistry v0.0.0-20231103182354-93e78c079a13 h1:zkiIe8AxZ/kDjqQN+mDKc5BxoVJOqioSdqApjc+eB1I=
+cuelabs.dev/go/oci/ociregistry v0.0.0-20231103182354-93e78c079a13/go.mod h1:XGKYSMtsJWfqQYPwq51ZygxAPqpEUj/9bdg16iDPTAA=
+cuelang.org/go v0.7.0 h1:gMztinxuKfJwMIxtboFsNc6s8AxwJGgsJV+3CuLffHI=
+cuelang.org/go v0.7.0/go.mod h1:ix+3dM/bSpdG9xg6qpCgnJnpeLtciZu+O/rDbywoMII=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -66,6 +70,8 @@
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
+github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
 github.com/containerd/containerd v1.7.6 h1:oNAVsnhPoy4BTPQivLgTzI9Oleml9l/+eYIDYXRCYo8=
@@ -106,6 +112,8 @@
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/proto v1.10.0 h1:pDGyFRVV5RvV+nkBK9iy3q67FBy9Xa7vwrOTE+g5aGw=
+github.com/emicklei/proto v1.10.0/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -118,6 +126,12 @@
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fluxcd/pkg/apis/acl v0.1.0 h1:EoAl377hDQYL3WqanWCdifauXqXbMyFuK82NnX6pH4Q=
+github.com/fluxcd/pkg/apis/acl v0.1.0/go.mod h1:zfEZzz169Oap034EsDhmCAGgnWlcWmIObZjYMusoXS8=
+github.com/fluxcd/pkg/apis/meta v1.2.0 h1:O766PzGAdMdQKybSflGL8oV0+GgCNIkdsxfalRyzeO8=
+github.com/fluxcd/pkg/apis/meta v1.2.0/go.mod h1:fU/Az9AoVyIxC0oI4ihG0NVMNnvrcCzdEym3wxjIQsc=
+github.com/fluxcd/source-controller/api v1.2.3 h1:71mXv3Qg9HEhcpqOq1ObmoE+P/HuZNaAvxfI7dqZMo8=
+github.com/fluxcd/source-controller/api v1.2.3/go.mod h1:5gaIVVH7hgb8p3HKFp8P6hGmZEC8fKSt4EcrG3g5vZI=
 github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
 github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
 github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
@@ -141,10 +155,9 @@
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
@@ -155,6 +168,8 @@
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
 github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
+github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
@@ -337,6 +352,8 @@
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de h1:D5x39vF5KCwKQaw+OC9ZPiLVHXz3UFw2+psEX+gYcto=
+github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de/go.mod h1:kJun4WP5gFuHZgRjZUWWuH1DTxCtxbHDOIJsudS8jzY=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -382,12 +399,14 @@
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0 h1:sadMIsgmHpEOGbUs6VtHBXRR1OHevnj7hLx9ZcdNGW4=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0/go.mod h1:jgxiZysxFPM+iWKwQwPR+y+Jvo54ARd4EisXxKYpB5c=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.11.1-0.20231026093722-fa6a31e0812c h1:fPpdjePK1atuOg28PXfNSqgwf9I/qD1Hlo39JFwKBXk=
+github.com/rogpeppe/go-internal v1.11.1-0.20231026093722-fa6a31e0812c/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
 github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -627,37 +646,37 @@
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY=
 k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0=
-k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=
-k8s.io/apiextensions-apiserver v0.28.2/go.mod h1:5tnkxLGa9nefefYzWuAlWZ7RZYuN/765Au8cWLA6SRg=
+k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08=
+k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc=
 k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
 k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
-k8s.io/apiserver v0.28.2 h1:rBeYkLvF94Nku9XfXyUIirsVzCzJBs6jMn3NWeHieyI=
-k8s.io/apiserver v0.28.2/go.mod h1:f7D5e8wH8MWcKD7azq6Csw9UN+CjdtXIVQUyUhrtb+E=
+k8s.io/apiserver v0.28.3 h1:8Ov47O1cMyeDzTXz0rwcfIIGAP/dP7L8rWbEljRcg5w=
+k8s.io/apiserver v0.28.3/go.mod h1:YIpM+9wngNAv8Ctt0rHG4vQuX/I5rvkEMtZtsxW2rNM=
 k8s.io/cli-runtime v0.28.2 h1:64meB2fDj10/ThIMEJLO29a1oujSm0GQmKzh1RtA/uk=
 k8s.io/cli-runtime v0.28.2/go.mod h1:bTpGOvpdsPtDKoyfG4EG041WIyFZLV9qq4rPlkyYfDA=
 k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY=
 k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4=
-k8s.io/component-base v0.28.2 h1:Yc1yU+6AQSlpJZyvehm/NkJBII72rzlEsd6MkBQ+G0E=
-k8s.io/component-base v0.28.2/go.mod h1:4IuQPQviQCg3du4si8GpMrhAIegxpsgPngPRR/zWpzc=
-k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
-k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI=
+k8s.io/component-base v0.28.3/go.mod h1:fDJ6vpVNSk6cRo5wmDa6eKIG7UlIQkaFmZN2fYgIUD8=
+k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
+k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
 k8s.io/kube-openapi v0.0.0-20230928205116-a78145627833 h1:iFFEmmB7szQhJP42AvRD2+gzdVP7EuIKY1rJgxf0JZY=
 k8s.io/kube-openapi v0.0.0-20230928205116-a78145627833/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
 k8s.io/kubectl v0.28.2 h1:fOWOtU6S0smdNjG1PB9WFbqEIMlkzU5ahyHkc7ESHgM=
 k8s.io/kubectl v0.28.2/go.mod h1:6EQWTPySF1fn7yKoQZHYf9TPwIl2AygHEcJoxFekr64=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661 h1:FepOBzJ0GXm8t0su67ln2wAZjbQ6RxQGZDnzuLcrUTI=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 oras.land/oras-go v1.2.4 h1:djpBY2/2Cs1PV87GSJlxv4voajVOMZxqqtq9AB8YNvY=
 oras.land/oras-go v1.2.4/go.mod h1:DYcGfb3YF1nKjcezfX2SNlDAeQFKSXmf+qrFmrh4324=
-sigs.k8s.io/controller-runtime v0.16.1 h1:+15lzrmHsE0s2kNl0Dl8cTchI5Cs8qofo5PGcPrV9z0=
-sigs.k8s.io/controller-runtime v0.16.1/go.mod h1:vpMu3LpI5sYWtujJOa2uPK61nB5rbwlN7BAB8aSLvGU=
+sigs.k8s.io/controller-runtime v0.16.3 h1:2TuvuokmfXvDUamSx1SuAOO3eTyye+47mJCigwG62c4=
+sigs.k8s.io/controller-runtime v0.16.3/go.mod h1:j7bialYoSn142nv9sCOJmQgDXQXxnroFU4VnX/brVJ0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 h1:XX3Ajgzov2RKUdc5jW3t5jwY7Bo7dcRm+tFxT+NfgY0=
 sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3/go.mod h1:9n16EZKMhXBNSiUC5kSdFQJkdH3zbxS/JoO619G1VAY=
 sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 h1:W6cLQc5pnqM7vh3b7HvGNfXrJ/xL6BDMS0v1V/HHg5U=
 sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3/go.mod h1:JWP1Fj0VWGHyw3YUPjXSQnRnrwezrZSrApfX5S0nIag=
-sigs.k8s.io/structured-merge-diff/v4 v4.3.0 h1:UZbZAZfX0wV2zr7YZorDz6GXROfDFj6LvqCRm4VUVKk=
-sigs.k8s.io/structured-merge-diff/v4 v4.3.0/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/core/installer/helm.go b/core/installer/helm.go
new file mode 100644
index 0000000..1f805b9
--- /dev/null
+++ b/core/installer/helm.go
@@ -0,0 +1,32 @@
+package installer
+
+import (
+	"fmt"
+
+	"helm.sh/helm/v3/pkg/action"
+	"helm.sh/helm/v3/pkg/kube"
+)
+
+type ActionConfigFactory struct {
+	kubeConfigPath string
+}
+
+func NewActionConfigFactory(kubeConfigPath string) ActionConfigFactory {
+	return ActionConfigFactory{kubeConfigPath}
+}
+
+func (f ActionConfigFactory) New(namespace string) (*action.Configuration, error) {
+	config := new(action.Configuration)
+	if err := config.Init(
+		kube.GetConfig(f.kubeConfigPath, "", namespace),
+		namespace,
+		"",
+		func(fmtString string, args ...any) {
+			fmt.Printf(fmtString, args...)
+			fmt.Println()
+		},
+	); err != nil {
+		return nil, err
+	}
+	return config, nil
+}
diff --git a/core/installer/repoio.go b/core/installer/repoio.go
index ca47731..45a2a53 100644
--- a/core/installer/repoio.go
+++ b/core/installer/repoio.go
@@ -375,35 +375,31 @@
 	}
 }
 
-func deriveValues(values any, schema map[string]any, networks []Network) (map[string]any, error) {
+func deriveValues(values any, schema Schema, networks []Network) (map[string]any, error) {
 	ret := make(map[string]any)
 	for k, v := range values.(map[string]any) { // TODO(giolekva): validate
-		def, err := fieldSchema(schema, k)
-		if err != nil {
-			return nil, err
-		}
-		t, ok := def["type"]
+		def, ok := schema.Fields()[k]
 		if !ok {
-			return nil, fmt.Errorf("Found field with undefined type: %s", k)
+			return nil, fmt.Errorf("Field not found: %s", k)
 		}
-		if t == "string" {
-			role, ok := def["role"]
-			if ok && role == "network" {
-				n, err := findNetwork(networks, v.(string)) // TODO(giolekva): validate
-				if err != nil {
-					return nil, err
-				}
-				ret[k] = n
-			} else {
-				ret[k] = v
-			}
-		} else if t == "boolean" {
+		switch def.Kind() {
+		case KindBoolean:
+		case KindString:
 			ret[k] = v
-		} else {
-			ret[k], err = deriveValues(v, def, networks)
+		case KindNetwork:
+			n, err := findNetwork(networks, v.(string)) // TODO(giolekva): validate
 			if err != nil {
 				return nil, err
 			}
+			ret[k] = n
+		case KindStruct:
+			r, err := deriveValues(v, def, networks)
+			if err != nil {
+				return nil, err
+			}
+			ret[k] = r
+		default:
+			return nil, fmt.Errorf("Should not reach!")
 		}
 	}
 	return ret, nil
@@ -418,26 +414,6 @@
 	return Network{}, fmt.Errorf("Network not found: %s", name)
 }
 
-func fieldSchema(schema map[string]any, key string) (map[string]any, error) {
-	properties, ok := schema["properties"]
-	if !ok {
-		return nil, fmt.Errorf("Properties not found")
-	}
-	propMap, ok := properties.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("Expected properties to be map")
-	}
-	def, ok := propMap[key]
-	if !ok {
-		return nil, fmt.Errorf("Unknown field: %s", key)
-	}
-	ret, ok := def.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("Invalid schema")
-	}
-	return ret, nil
-}
-
 type Network struct {
 	Name              string
 	IngressClass      string
diff --git a/core/installer/schema.go b/core/installer/schema.go
new file mode 100644
index 0000000..abafa15
--- /dev/null
+++ b/core/installer/schema.go
@@ -0,0 +1,130 @@
+package installer
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/cuecontext"
+)
+
+type Kind int
+
+const (
+	KindBoolean Kind = 0
+	KindString       = 1
+	KindStruct       = 2
+	KindNetwork      = 3
+)
+
+type Schema interface {
+	Kind() Kind
+	Fields() map[string]Schema
+}
+
+const networkSchema = `
+#Network: {
+	IngressClass: string
+	CertificateIssuer: string
+	Domain: string
+}
+
+value: %s
+
+valid: #Network & value
+`
+
+func isNetwork(v cue.Value) bool {
+	if v.Value().Kind() != cue.StructKind {
+		return false
+	}
+	value := fmt.Sprintf("%#v", v)
+	s := fmt.Sprintf(networkSchema, value)
+	c := cuecontext.New()
+	u := c.CompileString(s)
+	return u.Err() == nil && u.Validate() == nil
+}
+
+type basicSchema struct {
+	kind Kind
+}
+
+func (s basicSchema) Kind() Kind {
+	return s.kind
+}
+
+func (s basicSchema) Fields() map[string]Schema {
+	return nil
+}
+
+type structSchema struct {
+	fields map[string]Schema
+}
+
+func (s structSchema) Kind() Kind {
+	return KindStruct
+}
+
+func (s structSchema) Fields() map[string]Schema {
+	return s.fields
+}
+
+func NewCueSchema(v cue.Value) (Schema, error) {
+	switch v.Value().Kind() {
+	case cue.StringKind:
+		return basicSchema{KindString}, nil
+	case cue.StructKind:
+		if isNetwork(v) {
+			return basicSchema{KindNetwork}, nil
+		}
+		s := structSchema{make(map[string]Schema)}
+		f, err := v.Fields()
+		if err != nil {
+			return nil, err
+		}
+		for f.Next() {
+			scm, err := NewCueSchema(f.Value())
+			if err != nil {
+				return nil, err
+			}
+			s.fields[f.Selector().String()] = scm
+		}
+		return s, nil
+	default:
+		return nil, fmt.Errorf("SHOULD NOT REACH!")
+	}
+}
+
+func newSchema(schema map[string]any) (Schema, error) {
+	switch schema["type"] {
+	case "string":
+		if r, ok := schema["role"]; ok && r == "network" {
+			return basicSchema{KindNetwork}, nil
+		} else {
+			return basicSchema{KindString}, nil
+		}
+	case "object":
+		s := structSchema{make(map[string]Schema)}
+		props := schema["properties"].(map[string]any)
+		for name, schema := range props {
+			sm, _ := schema.(map[string]any)
+			scm, err := newSchema(sm)
+			if err != nil {
+				return nil, err
+			}
+			s.fields[name] = scm
+		}
+		return s, nil
+	default:
+		return nil, fmt.Errorf("SHOULD NOT REACH!")
+	}
+}
+
+func NewJSONSchema(schema string) (Schema, error) {
+	ret := make(map[string]any)
+	if err := json.NewDecoder(strings.NewReader(schema)).Decode(&ret); err != nil {
+		return nil, err
+	}
+	return newSchema(ret)
+}
diff --git a/core/installer/values-tmpl/rpuppy.cue b/core/installer/values-tmpl/rpuppy.cue
new file mode 100644
index 0000000..ebf71cb
--- /dev/null
+++ b/core/installer/values-tmpl/rpuppy.cue
@@ -0,0 +1,113 @@
+#Input: {
+	network: #Network
+	subdomain: string
+}
+
+input: #Input
+
+_domain: "\(input.subdomain).\(input.network.domain)"
+
+readme: "rpuppy application will be installed on \(input.network.name) network and be accessible to any user on https://\(_domain)"
+
+images: {
+	rpuppy: {
+		repository: "giolekva"
+		name: "rpuppy"
+		tag: "latest"
+		pullPolicy: "Always"
+	}
+}
+
+charts: {
+	rpuppy: {
+		source: {
+			kind: "GitRepository"
+			address: "pcloud"
+		}
+		chart: "./charts/rpuppy"
+	}
+}
+
+helm: {
+	rpuppy: {
+		chart: charts.rpuppy
+		values: {
+			ingressClassName: input.network.ingressClass
+			certificateIssuer: input.network.certificateIssuer
+			domain: _domain
+			image: {
+				repository: images.rpuppy.fullName
+				tag: images.rpuppy.tag
+				pullPolicy: images.rpuppy.pullPolicy
+			}
+		}
+	}
+}
+
+// TODO(gio): import
+
+#Network: {
+	name: string
+	ingressClass: string
+	certificateIssuer: string
+	domain: string
+}
+
+#Image: {
+	registry: string | *"docker.io"
+	repository: string
+	name: string
+	tag: string
+	pullPolicy: string // TODO(gio): remove?
+	fullName: "\(registry)/\(repository)/\(name)"
+	fullNameWithTag: "\(fullName):\(tag)"
+}
+
+#Global: {
+	id: string
+}
+
+global: #Global
+
+images: {
+	for key, value in images {
+		"\(key)": #Image & value
+	}
+}
+
+#HelmRelease: {
+	_name: string
+	_chart: string
+	_values: _
+
+	apiVersion: "helm.toolkit.fluxcd.io/v2beta1"
+	kind: "HelmRelease"
+	metadata: {
+		name: _name
+   		namespace: "{{ .Release.Namespace }}"
+	}
+	spec: {
+		interval: "1m0s"
+		chart: {
+			spec: {
+				chart: _chart
+				sourceRef: {
+					kind: "HelmRepository"
+					name: "pcloud"
+					namespace: global.id
+				}
+			}
+		}
+		values: _values
+	}
+}
+
+output: [
+	for name, r in helm {
+		#HelmRelease & {
+			_name: name
+			_chart: "rpuppy"
+			_values: r.values
+		}
+	}
+]
diff --git a/core/installer/welcome/appmanager-tmpl/app.html b/core/installer/welcome/appmanager-tmpl/app.html
index df7501b..8d844a8 100644
--- a/core/installer/welcome/appmanager-tmpl/app.html
+++ b/core/installer/welcome/appmanager-tmpl/app.html
@@ -2,22 +2,20 @@
   {{ $readonly := .ReadOnly }}
   {{ $networks := .AvailableNetworks }}
   {{ $data := .Data }}
-  {{ range $name, $schema := .Schema.properties }}
-    {{ if eq $schema.type "string" }}
+  {{ range $name, $schema := .Schema.Fields }}
+    {{ if or (eq $schema.Kind 0) (eq $schema.Kind 1) }}
       <label for="{{ $name }}">
         <span>{{ $name }}</span>
       </label>
-      {{ if eq (index $schema "role") "network" }}
-        <select oninput="valueChanged({{ $name }}, this.value)" {{ if $readonly }}disabled{{ end }} >
-          {{ if not $readonly }}<option disabled selected value> -- select an option -- </option>{{ end }}
-          {{ range $networks }}
-            <option {{if eq .Name (index $data $name) }}selected{{ end }}>{{ .Name }}</option>
-          {{ end }}
-        </select>
-      {{ else }}
-        <input type="text" name="{{ $name }}" oninput="valueChanged({{ $name }}, this.value)" {{ if $readonly }}disabled{{ end }} value="{{ index $data $name }}"/>
-      {{ end }}
-    {{ end }}
+	  <input type="text" name="{{ $name }}" oninput="valueChanged({{ $name }}, this.value)" {{ if $readonly }}disabled{{ end }} value="{{ index $data $name }}"/>
+	{{ else if eq $schema.Kind 3 }}
+	  <select oninput="valueChanged({{ $name }}, this.value)" {{ if $readonly }}disabled{{ end }} >
+		{{ if not $readonly }}<option disabled selected value> -- select an option -- </option>{{ end }}
+		{{ range $networks }}
+		  <option {{if eq .Name (index $data $name) }}selected{{ end }}>{{ .Name }}</option>
+		{{ end }}
+	  </select>
+	{{ end }}
   {{ end }}
 {{ end }}
 
@@ -26,7 +24,7 @@
 <h1>{{ .App.Icon }}{{ .App.Name }}</h1>
 <pre id="readme"></pre>
 
-{{ $schema := .App.ConfigSchema }}
+{{ $schema := .App.Schema }}
 {{ $networks := .AvailableNetworks }}
 
 <form id="config-form">
diff --git a/core/installer/welcome/appmanager.go b/core/installer/welcome/appmanager.go
index be077e0..5d7e537 100644
--- a/core/installer/welcome/appmanager.go
+++ b/core/installer/welcome/appmanager.go
@@ -71,7 +71,6 @@
 	Icon             template.HTML         `json:"icon"`
 	ShortDescription string                `json:"shortDescription"`
 	Slug             string                `json:"slug"`
-	Schema           string                `json:"schema"`
 	Instances        []installer.AppConfig `json:"instances,omitempty"`
 }
 
@@ -82,7 +81,7 @@
 	}
 	resp := make([]app, len(all))
 	for i, a := range all {
-		resp[i] = app{a.Name, a.Icon, a.ShortDescription, a.Name, a.Schema, nil}
+		resp[i] = app{a.Name, a.Icon, a.ShortDescription, a.Name, nil}
 	}
 	return c.JSON(http.StatusOK, resp)
 }
@@ -116,7 +115,7 @@
 			}
 		}
 	}
-	return c.JSON(http.StatusOK, app{a.Name, a.Icon, a.ShortDescription, a.Name, a.Schema, instances})
+	return c.JSON(http.StatusOK, app{a.Name, a.Icon, a.ShortDescription, a.Name, instances})
 }
 
 func (s *AppManagerServer) handleInstance(c echo.Context) error {
@@ -146,7 +145,7 @@
 	if err != nil {
 		return err
 	}
-	return c.JSON(http.StatusOK, app{a.Name, a.Icon, a.ShortDescription, a.Name, a.Schema, []installer.AppConfig{instance}})
+	return c.JSON(http.StatusOK, app{a.Name, a.Icon, a.ShortDescription, a.Name, []installer.AppConfig{instance}})
 }
 
 type file struct {
@@ -293,7 +292,7 @@
 	}
 	resp := make([]app, len(all))
 	for i, a := range all {
-		resp[i] = app{a.Name, a.Icon, a.ShortDescription, a.Name, a.Schema, nil}
+		resp[i] = app{a.Name, a.Icon, a.ShortDescription, a.Name, nil}
 	}
 	return tmpl.Execute(c.Response(), resp)
 }