diff --git a/core/installer/app_configs/app_base.cue b/core/installer/app_configs/app_base.cue
index 8a674ee..1d81e62 100644
--- a/core/installer/app_configs/app_base.cue
+++ b/core/installer/app_configs/app_base.cue
@@ -131,6 +131,13 @@
 	ingressClassName: string
 }
 
+clusters: [...#Cluster] | *[]
+clusterMap: {
+	for c in clusters {
+		"\(strings.ToLower(c.name))": c
+	}
+}
+
 global: #Global
 release: #Release
 
@@ -353,15 +360,82 @@
 	_volumeClaimName: "\(name)-mongodb"
 	_initdbScripts: initdbScripts
 
-	openPort: [for i, e in expose {
-		network: networks[strings.ToLower(e.network)]
-		port: input["port_mongodb_\(_name)_\(i)"]
-		protocol: "TCP"
-		service: {
-			name: "mongodb-\(_name)"
-			port: 27017
+	openPort: list.FlattenN([for i, e in expose {
+		if cluster == _|_ {
+			network: networks[strings.ToLower(e.network)]
+			port: input["port_mongodb_\(_name)_\(i)"]
+			protocol: "TCP"
+			service: {
+				name: "mongodb-\(_name)"
+				port: 27017
+			}
 		}
-	}]
+		if cluster != _|_ {
+			if strings.ToLower(e.network) == "private" {
+				[{
+					network: #Network & {
+						name: "cluster_\(cluster.name)"
+						ingressClass: "default"
+						domain: ""
+						allocatePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/allocate"
+						reservePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/reserve"
+						deallocatePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/remmove"
+					}
+					port: input["port_mongodb_\(_name)_\(i)_cluster"]
+					protocol: "TCP"
+					service: {
+						name: "mongodb-\(_name)"
+						port: 27017
+					}
+				}, {
+					cluster: _cluster.name
+					network: networks[strings.ToLower(e.network)]
+					port: input["port_mongodb_\(_name)_\(i)"]
+					protocol: "TCP"
+					service: {
+						name: "cluster-\(cluster).devices.\(global.privateDomain)"
+						port: input["port_mongodb_\(_name)_\(i)_cluster"]
+					}
+				}]
+			}
+			if strings.ToLower(e.network) != "private" {
+				[{
+					network: #Network & {
+						name: "cluster_\(cluster.name)"
+						ingressClass: "default"
+						domain: ""
+						allocatePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/allocate"
+						reservePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/reserve"
+						deallocatePortAddr: "http://port-allocator.\(global.id)-cluster-\(cluster.name)-network.svc.cluster.local/api/remmove"
+					}
+					port: input["port_mongodb_\(_name)_\(i)_cluster"]
+					protocol: "TCP"
+					service: {
+						name: "mongodb-\(_name)"
+						port: 27017
+					}
+				}, {
+					network: networks.private // TODO(gio): take corresponding private network
+					cluster: _cluster.name
+					port: input["port_mongodb_\(_name)_\(i)_private"]
+					protocol: "TCP"
+					service: {
+						name: "cluster-\(cluster).devices.\(global.privateDomain)"
+						port: input["port_mongodb_\(_name)_\(i)_cluster"]
+					}
+				}, {
+					network: networks[strings.ToLower(e.network)]
+					port: input["port_mongodb_\(_name)_\(i)"]
+					protocol: "TCP"
+					service: {
+						name: "\(global.id)-nginx-private-controller"
+						namespace: "\(global.namespacePrefix)ingress-private"
+						port: input["port_mongodb_\(_name)_\(i)_private"]
+					}
+				}]
+			}
+		}
+	}], -1)
 
 	images: {
 		mongodb: {
@@ -541,7 +615,7 @@
 					port: input["port_postgresql_\(_name)_\(i)"]
 					protocol: "TCP"
 					service: {
-						name: "cluster-\(cluster).private-network-proxy.devices.\(global.privateDomain)"
+						name: "cluster-\(cluster).devices.\(global.privateDomain)"
 						port: input["port_postgresql_\(_name)_\(i)_cluster"]
 					}
 				}]
@@ -568,7 +642,7 @@
 					port: input["port_postgresql_\(_name)_\(i)_private"]
 					protocol: "TCP"
 					service: {
-						name: "cluster-\(cluster).private-network-proxy.devices.\(global.privateDomain)"
+						name: "cluster-\(cluster).devices.\(global.privateDomain)"
 						port: input["port_postgresql_\(_name)_\(i)_cluster"]
 					}
 				}, {
diff --git a/core/installer/app_configs/app_global_env.cue b/core/installer/app_configs/app_global_env.cue
index 6a02df2..7c90d95 100644
--- a/core/installer/app_configs/app_global_env.cue
+++ b/core/installer/app_configs/app_global_env.cue
@@ -31,13 +31,6 @@
 
 networks: #Networks
 
-clusters: [...#Cluster] | *[]
-clusterMap: {
-	for c in clusters {
-		"\(strings.ToLower(c.name))": c
-	}
-}
-
 #Ingress: #WithOut & {
 	name: string
 	auth: #Auth
diff --git a/core/installer/app_configs/dodo_app.cue b/core/installer/app_configs/dodo_app.cue
index 963421e..608d629 100644
--- a/core/installer/app_configs/dodo_app.cue
+++ b/core/installer/app_configs/dodo_app.cue
@@ -35,6 +35,12 @@
 	for v in _mongodb {
 		for i, e in v.expose {
 			"port_mongodb_\(v.name)_\(i)": int @role(port)
+			if input.cluster != _|_ {
+				"port_mongodb_\(v.name)_\(i)_cluster": int @role(port)
+				if strings.ToLower(e.network) == "public" {
+					"port_mongodb_\(v.name)_\(i)_private": int @role(port)
+				}
+			}
 		}
 	}
 	for svc in service {
diff --git a/core/installer/canvas-app.cue b/core/installer/canvas-app.cue
index 89546c0..0f54b06 100644
--- a/core/installer/canvas-app.cue
+++ b/core/installer/canvas-app.cue
@@ -25,11 +25,19 @@
 		}
 	}],
 	  "postgresql": [{
-		  "name": "pgg",
+		  "name": "pg",
 		  "size": "2Gi",
 		  "expose": [{
 		    "network": "public",
-			"subdomain": "piopio"
+			"subdomain": "pg"
+		  }]
+	  }],
+	  "mongodb": [{
+		  "name": "moo",
+		  "size": "2Gi",
+		  "expose": [{
+		    "network": "public",
+			"subdomain": "mo"
 		  }]
 	  }],
 	  "cluster": "asdc"