diff --git a/core/installer/Makefile b/core/installer/Makefile
index fe61694..1655ac0 100644
--- a/core/installer/Makefile
+++ b/core/installer/Makefile
@@ -14,6 +14,9 @@
 	$(podman) build --file=Dockerfile.flux --tag=$(repo_name)/flux:latest . --platform=linux/arm64
 	docker push $(repo_name)/flux:latest
 
+format:
+	go run cuelang.org/go/cmd/cue fmt app_configs/*.cue
+
 build: export CGO_ENABLED=0
 build: clean
 	/usr/local/go/bin/go build -o pcloud cmd/*.go
diff --git a/core/installer/app_configs/app_base.cue b/core/installer/app_configs/app_base.cue
index d43cf0f..d4ee363 100644
--- a/core/installer/app_configs/app_base.cue
+++ b/core/installer/app_configs/app_base.cue
@@ -292,6 +292,7 @@
 	codeServer: #CodeServer | *{enabled: false}
 	cpuCores: int
 	memory:   string
+	sshKey?:  #SSHKey
 	sshKnownHosts: [...string] | *[]
 	sshAuthorizedKeys: [...string] | *[]
 	cloudInit: #CloudInit
@@ -438,6 +439,7 @@
 				hostname:     _name
 				ssh_pwauth:   true
 				disable_root: false
+				// TODO(gio): get keys from memberships service
 				ssh_authorized_keys: list.Concat([[
 					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOa7FUrmXzdY3no8qNGUk7OPaRcIUi8G7MVbLlff9eB/ lekva@gl-mbp-m1-max.local",
 				], sshAuthorizedKeys])
@@ -457,16 +459,39 @@
 					"""
 					owner:       "\(username):\(username)"
 					permissions: "0644"
-				}], cloudInit.writeFiles])
+				}],
+					if sshKey != _|_ {
+						[{
+							encoding:    "b64"
+							path:        "/home/\(username)/.ssh/key"
+							content:     base64.Encode(null, sshKey.private)
+							owner:       "\(username):\(username)"
+							permissions: "0600"
+							defer:       true
+						}, {
+							encoding:    "b64"
+							path:        "/home/\(username)/.ssh/key.pub"
+							content:     base64.Encode(null, sshKey.public)
+							owner:       "\(username):\(username)"
+							permissions: "0644"
+							defer:       true
+						},
+						]
+					},
+					cloudInit.writeFiles])
 				runcmd: list.Concat([
 					[
 						["sh", "-c", "chown -R \(username):\(username) /home/\(username)"],
-						["sh", "-c", "ssh-keygen -t ed25519 -f /home/\(username)/.ssh/id_ed25519 -q -N ''"],
-						["sh", "-c", "chown \(username):\(username) /home/\(username)/.ssh/id_ed25519*"],
-						["sh", "-c", "chmod 0600 /home/\(username)/.ssh/id_ed25519*"],
+						if sshKey == _|_ {
+							["sh", "-c", "ssh-keygen -t ed25519 -f /home/\(username)/.ssh/key -q -N ''"]
+						},
+						["sh", "-c", "chown \(username):\(username) /home/\(username)/.ssh/*"],
+						["sh", "-c", "chmod 0600 /home/\(username)/.ssh/*"],
 						// TODO(gio): implement post app delete webhook to remove ssh key from memberships
 						// TODO(gio): make memberships-api addr configurable
-						["sh", "-c", "PUBKEY=$(cat /home/\(username)/.ssh/id_ed25519.pub) && curl --request POST --data \"{\\\"user\\\":\\\"\(username)\\\",\\\"publicKey\\\":\\\"${PUBKEY}\\\"}\" http://memberships-api.\(global.namespacePrefix)core-auth-memberships.svc.cluster.local/api/users/\(username)/keys"],
+						if sshKey == _|_ {
+							["sh", "-c", "PUBKEY=$(cat /home/\(username)/.ssh/key.pub) && curl --request POST --data \"{\\\"user\\\":\\\"\(username)\\\",\\\"publicKey\\\":\\\"${PUBKEY}\\\"}\" http://memberships-api.\(global.namespacePrefix)core-auth-memberships.svc.cluster.local/api/users/\(username)/keys"]
+						},
 					],
 					_vpnCmd,
 					_codeServerCmd,
diff --git a/core/installer/app_configs/dodo_app.cue b/core/installer/app_configs/dodo_app.cue
index a02ac1e..3fb4a1b 100644
--- a/core/installer/app_configs/dodo_app.cue
+++ b/core/installer/app_configs/dodo_app.cue
@@ -694,6 +694,7 @@
 			cpuCores: 2
 			memory:   "3Gi"
 			ports:    svc.ports
+			sshKey:   input.key
 			configFiles: {
 				"env.sh": _envProfile
 			}
@@ -706,7 +707,7 @@
 				}]
 				runCmd: list.Concat([[
 					["sh", "-c", "chown \(username):\(username) /home/\(username)/.cache"],
-					["sh", "-c", "GIT_SSH_COMMAND='ssh -i /home/\(username)/.ssh/id_ed25519 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new' git clone --branch \(svc.source.branch) \(svc.source.repository) /home/\(username)/code"],
+					["sh", "-c", "GIT_SSH_COMMAND='ssh -i /home/\(username)/.ssh/key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new' git clone --branch \(svc.source.branch) \(svc.source.repository) /home/\(username)/code"],
 					["sh", "-c", "chown -R \(username):\(username) /home/\(username)/code"],
 					["sh", "-c", "chown -R \(username):\(username) /home/\(username)"],
 				], svc.vm.cloudInit.runCmd])
diff --git a/core/installer/dodo_app_test.go b/core/installer/dodo_app_test.go
index 579d3b2..cc92d6b 100644
--- a/core/installer/dodo_app_test.go
+++ b/core/installer/dodo_app_test.go
@@ -525,3 +525,94 @@
 	}
 	t.Log(string(r.Raw))
 }
+
+const foo = `
+{
+  "service": [
+    {
+      "type": "deno:2.2.0",
+      "name": "qwe",
+      "source": {
+        "repository": "git@github.com:giolekva/dodo-blog.git"
+      },
+      "ports": [
+        {
+          "name": "web",
+          "value": 8080,
+          "protocol": "TCP"
+        }
+      ],
+      "env": [
+        {
+          "name": "DODO_POSTGRESQL_DB_URL"
+        },
+        {
+          "name": "DODO_PORT_WEB"
+        }
+      ],
+      "ingress": [
+        {
+          "network": "Private",
+          "subdomain": "blog",
+          "port": {
+            "name": "web"
+          },
+          "auth": {
+            "enabled": false
+          }
+        }
+      ],
+      "preBuildCommands": [],
+      "dev": {
+        "enabled": true,
+        "username": "gio",
+        "codeServer": {
+          "network": "Private",
+          "subdomain": "code"
+        },
+        "ssh": {
+          "network": "Public",
+          "subdomain": "code"
+        }
+      }
+    }
+  ],
+  "volume": [],
+  "postgresql": [
+    {
+      "name": "db",
+      "size": "1Gi",
+      "expose": []
+    }
+  ],
+  "mongodb": []
+}
+`
+
+func TestFoo(t *testing.T) {
+	app, err := NewDodoApp([]byte(foo))
+	if err != nil {
+		for _, e := range errors.Errors(err) {
+			t.Log(e)
+		}
+		t.Fatal(err)
+	}
+	release := Release{
+		Namespace:     "foo",
+		AppInstanceId: "foo-bar",
+		RepoAddr:      "ssh://192.168.100.210:22/config",
+		AppDir:        "/foo/bar",
+	}
+	keyGen := testKeyGen{}
+	r, err := app.Render(release, env, networks, nil, map[string]any{
+		"managerAddr":          "",
+		"appId":                "",
+		"sshPrivateKey":        "",
+		"port_service_qwe_ssh": 12,
+		"port_service_qwe_0":   13,
+	}, nil, keyGen)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(string(r.Raw))
+}