diff --git a/apps/nextcloud/app.yaml b/apps/nextcloud/app.yaml
new file mode 100644
index 0000000..a666719
--- /dev/null
+++ b/apps/nextcloud/app.yaml
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nextcloud
+metadata:
+  name: nextcloud
+commonLabels:
+  app: nextcloud
+resources:
+  - app/namespace.yaml
+  - app/nextcloud-db-sealedsecret.yaml
+  - app/nextcloud-sealedsecret.yaml
+  - app/postgres.yaml
+  - app/release.yaml
+  - app/route.yaml
diff --git a/apps/nextcloud/app/namespace.yaml b/apps/nextcloud/app/namespace.yaml
new file mode 100644
index 0000000..479a5a7
--- /dev/null
+++ b/apps/nextcloud/app/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud
+  labels:
+    name: nextcloud
diff --git a/apps/nextcloud/app/nextcloud-db-sealedsecret.yaml b/apps/nextcloud/app/nextcloud-db-sealedsecret.yaml
new file mode 100644
index 0000000..b1ab732
--- /dev/null
+++ b/apps/nextcloud/app/nextcloud-db-sealedsecret.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: nextcloud-db-secret
+  namespace: nextcloud
+spec:
+  encryptedData:
+    database: AgBnYQx6n7VtfsuvoFjsqjJiIWZxPIEGl/Nqd68vWotEOwlovFjn5OeodsKD0i+jEa73XBKNnmcVpihOxo/HIzQ/YmN7DM919NS793u6zOm5yhnnGK/CemvrkxuWJ97ec1JAshkQjNKhEh1VXygN5DSaThInN0ZhX/2ELcG6lxGddO2bcg7mIcq1JOb/+Ro/X/NgREqPSBlOcT8DBXeP5fHIAEqZk26xxDb4/qerVT6C8HH8/wpp57vYFrj55ZfeQOINy+A/JosM1+xyE3XMutlth+CFqTUiozFg6SL6T0jxeQTvy5LawkApu4i089lO60KWLX8M5i3gCa1Y8cgPrVYrVcNw+j7fA/CYAQ87XfXFATQd0wpPNKXfkVvbxDPtauPvV3SUCxqdnHStv0CN5/h8rOuT1SqopmTjQ59LaJH8Q0WHinWDt5SuL5Z9AT3ilSpEKV+e4YKtUg8mWav4Q2biOKfdBikHooWQjlIKnpyyZ7sDJ3avjxutecOv/ikBSp10HxltjSHMcB3LbprYMreD37LLFqt+ggys9B0QZOHGzSJlBRNJ4KHnXV5Ub/kcgSPym9zM+ztNxgc0QyMyDiY5fOMwrVsrVP9EEDOam1Bhcjc1kzpxLLjqdC+LtNjeLWuTq81c2cZX2toFLscC81s0R/HocU1Gp1DvkidcoCglPEYmptrRze2Ua2F6KPnZrO+u6LGvAAn20w==
+    host: AgBob6mWOxd3FAyVtXls0vEa4XyQgK32doFUpC9qqCbGh8Bpzj1Vcqt+CpM2NZDSQSzSIgMXGwKxw5UBbaZl7H4rtPvrLop+LyzcmU9sFS3QvZGk2PYpvf8Xz6rJgyq53PNmYu+tUxRqQUsST0FUYRVGp0TkPYi7AuVOJAN6TQYBva/qp1FS4qTbaodkA/uAfXOGT0HlkPRmqTs+nI2EpxmSiGMcLi2whWSkSJHcTt9uWmslzp5Gij5WE/aZRfHz6wP2BaFJKwR99dLCTuO3SfUIMG6Bs3LytQUMM8Wp+174uVVCL6W6Z69esWW89Y/hIkD3o25fbWcfRT721XTBAqN/yPvU5bgv/F42ddTHop0zNHK+0NLrNNG3a1T7z70kXMcz1ZZZSeCXXEp7K+zCIFulJhtHKQXOI7N4Ce6eV9ZJhOWVpaPP3F4pAQM1pyiv+/wUpFLzI17e4wPx0x2iE9BNgLW0XC4Jss7DoQNX76zVu8w0qiLLNhSs61tPfPHFIWR5rU09V6SqOIHx4zvgzs2nH1QarlC4VZLbnweZUijTBmgCg4T7InBhExRPSjiHZKh4vAtIBpwoXSmFiNK0Wyl1sWnfyVPd58Pa/CSyPW6cQdnjJWUZJCsDCJL5yQC710cxq9jj+RrkUu5Db+uqkqEO9scpA8V4q0aceCQoWdVvblvcbQdse02G3PXs+6jTNEp5PLteLAN6pDL+F+Y=
+    password: AgB8UklTXLaX3l0dqr/y+bPJ+8Ciby3fyYwDSwKXM5CYE1jCc6Fg6ZwsOJWl6G7I5g8wBiMSwmrv81bK52u2r1jbLvg+03JFgEquB3CKgb9/YaKbyt5zZUBhWnmR4Dhp9nSYjRLQiioYJtsm8j7Wp7fv/WX6qq5eeFQDnUQvFraYvB4g12w384WeIL1y+o/qVoxQCW50rDAmulWEA5ldLQmD6g8jKdFqL72FSyfbYfKFZGx139nIqGeS5o823niVFE0fBpZMOlBNYYMXag/lgl/MUsfrCOxBPv7z0emHXlxn8xhPgxZTztj2bVPtK+2kbQTAWGUVr1Zs87QIwg8MJqNz7Bff3s540aUcXVPCElh2t1Mc2oigsqMwrrfBbfc/M4yhPiYVhPpdQXf4FilSsa8IYgJQoh4AaEDvn/XI92fTbXFu7+Ap9hH4ggX8QQ6ZsNxHB9wOUN541d9qr4TDMWVO+Y4tgm0hubH8+3FvtEP3rjZPEipwrNeZxbo6fahBT01R9vuGMf/uxQuBu3ZAyRhwPs/Xlyq+FHi8/S2ffkwgjJ0VP8/4Nd9ayxDJ4EKMt5Z3gx7pOyNDKIKM3Jy15p16RrCf58NhMiENfUwHOkIij5eYVIx3WCeOB500DQkSNvQVR+ZN1mWZeM+6o0p4VXi9mzCVjaozNVE60dSqyWOhX07zJEgeht/yNvp2jFhP6kWix5sjPMUykGuPZXsAxKZf
+    replication-password: AgARIcqzwfLyDje6uMFSDFW3vuQMjTkmq0oMERD82IATX+MGUHq2famRzhk8x69IPDmetQTM7dlR/D95UIYYnToFHmrYGJTy35ZNb0UVXBNxsKfQc2iuiVD0Jcql5LnuJBS2P2mOan8DUigJkA1yB7u+NUCrXE+Fepc9iJGDOOmRW/wrARDSM9nmA9qB3PSA5zcffMPsP7lvSDW/8ybTJGJtYcyLnMIDZ80dvXV0FwM7idSP0a/JWxKHm/r5HdcwWQbYLLrs/V5BitpHwmn+Yn9B8j8AFK2FnofHHw+hpW95dtx+NLiqQg0PYWxVwD0gPA7qLaRJspuRz+OqgmHGrwzJuSkxBkL/QWyFppKAutpHyUowlQo+ct47OeoRC9KVP2TUhYeoL+4JURmc59bcv9GGYFbhvdOpt74kiP0SO8UCJSMGrcfjpnt97+jqtw8bSZV/ctBx7mub5+xM7GfuAUD7dXdvg0H1J7cawGl2QpdnX2Xi65R5FBkg0AqbPAjAbWRoL5X8rII1KNno1UzXwDxKxvcU7mRdLLa73GNFxWykMQmTiv8So0yTlrpea5bxZc1cu2psV1ik+h+AprTx4qtYPIbRz735gyljLDnqmXWuIXTI/cJ9LDsVcDW1IxqfM7KG6gC+UXX+OIiQ/ymFSfGOoZyhcowssnyn6vUZHmJFVDB7kAf+qZlVAkqKyqZpSZe58QzzYQGCPRZKVVv78B4T
+    username: AgBuoYkarhFJmsv3HLd/UY4Lbh8sfQ8Xa+dikF979qZlHb+LhgNDO7NRChmbYrY/oBQurenq5mzdrHXwnY/jHsrdiCmlxFtvpzopuV6iWo6avjhwXSFYJ6lDjF7dB/a3t9sMy8IzlgC2PSiWst3z9nv2CeuD/H0EqsW0gZkCbEzjBHNNTinVhKEjxWBUwa1gZkHb7iB+dBW1LvnY3+cZAbyyGh9PMmhPaKc6bmE9HT0m8eYxCD5BIDP2wJIfBaKLdxZw+3kChahqZP4d7jEaSB3B49IZq3Cb+mOgXCPEkosmvkP8TVSYBSHqf7cxFz6U6mvJ0zxiXse6mQQI9Sm5MoXIhHPmb4Jl9R+ZLRy/fU1NXaeYhuma3V5fZTSmzLLo0DVYKlFfFBtLF2DxXXek6nTdhOZKIaRHPRQquQXp9fcVXtdIwwQDz4cE+8Gx1hrds6taJqAdyH5GYIitfft3mqYC+Z9JogAQ5he3+iiNnHyikvvwWs4f2L+BClush24AM88IHMEaM0mQV9uC6LnRITwmgEfgqQoghPNj9Ibh4Z5qqHu/mO2gmjmNihWqklq/D85kBoluCjXRhTcV5g6pMLG5ehN/av0hUAgj/4eAs0LXmcuUrjgVjKHC+9NdNsjCubefGIUE6FXRDe1zEnOUwVMeR5tVSRaSs+I/7KB9vvQp2sLCamKuNH3SCoIAfqnkuECk3ebz+jGwnw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: nextcloud-db-secret
+      namespace: nextcloud
+    type: Opaque
diff --git a/apps/nextcloud/app/nextcloud-sealedsecret.yaml b/apps/nextcloud/app/nextcloud-sealedsecret.yaml
new file mode 100644
index 0000000..71724c2
--- /dev/null
+++ b/apps/nextcloud/app/nextcloud-sealedsecret.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: nextcloud-secret
+  namespace: nextcloud
+spec:
+  encryptedData:
+    password: AgByHDyfpvWqEZn4Ym0fftPzlzYr8/rUiaspJd7k0BSen919Hkr+UROaJrtfrvSWhjqGT64tFqNrbPBjOIbAZhvos94XCnSjz1K0bVSp5QtBQIHgRrer9SRXW8vOo4hsjRUDrNCHhKQEACPXzD4B/DVlqyvuWxNiEJS0AMfKuhPIosmMgJDSOK+MjiRO5ED7yzRh9kT0Irb7MOqLRGTr9Ub6jBbg1enK+/hSnBYK0gPDutKNA3WGZKCNOm0OgmsZQj5Dc5+xWuplAkSmt7VkdBwMxgycUEZEo6m6gEKJ+3k40Zhqd4A++WVG8Ujhg54FQmUXGPhG7FrxHm0D0gUFEFq4CS0W5F5uO1fUwFQO2LA+sqbQyxRPBhkk5LcDsAJgvIf3CaMGknCQ1BOz0iR9FXQOH6Mh9KORKpm6V3119PaH03HsTz+HPiYBHEK6EytfJBEKGp6ZSwhSP97QribjOB6Xk+OlhqSFpoP6ldWVyLlXdyej0xrC5K2izQodcYifC/1bx+2bmjpMCye+IbP1vKq4JuQj2TFKaMxQp/6cVrS4gr0VZt+Ez1NN4MJuKhKAWP6CDm4u2Yk2OgmeCGoUF5k3WNHfW7injxTn7jHBYYehfDhTeSuXwd1oXy2LCVh9iFZhu43zP92vjb+SmfF5YS5gazcCJ+f8YDlmS2MctfoSradDmKe+tX59001HKCtpoRg/8d8LpaYz7c11E1okaqHH
+    username: AgB06LxfZNj0P+m942YHiyvVU8bk4tTRwqTH/7V93vu9LCL5kHb3ItsYIP8KZ5V0CC+g/s41b5becaBlZ8MCOtGch3cZVHto6u3KJ1oKZ9h3NPh3YJb6aJUPcFe2YQyOdvkagcPk8HfUQJ5A9lei58uHN0A/JVdv4LZ0fGfrw5OCN6mKcdDHSSKw0qtCp+ESqzKzqtP4bHH83huC4YIG21Z1y4j1mw0D9o8bCLlox/Rs3Sb4Dqgfe8MHzm4dUePS1ItqGePSC3VhY9TtFcVLqvppBUXLWcva06DX2GS4oHGJkwwUsDAm6pNFRKDJS208SOTEtT/jYtukgRlUtzy4+DP2V07bbkMoxpGsKC0H1KNZ7nvY6kxhhG3+/wis0xvWhnOzMl//ultsD5B0FRcMpmqEE05EBA8gi14MOAfLz2mmQqfdvHjjLVUvsttVlzOBmb2DMD1xeA3OBMu/W3Ixtq1T6icPew6a6hwnxukEbjz5zfShXfRGuotShb3jq9MupYKAFRzNTMK7qO3+PhCDMDJ8iM1Q3HnEvYr10gobQ1R1yWByGwlqzZF/S27EWKEnj9QESIUyKdQ1/RAlbE2iFT5slHwhrGlsTd+rq/W9e+mLC1WVKXYuCEzeTjUSLR7aRDpOq+VJUTkCU0HDiIHRyATPXoIt+M5Tdxc9qGRjDvG1CLiua/C3ajdskGJOD6WzbU5EuWRpsSosP8U=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: nextcloud-secret
+      namespace: nextcloud
+    type: Opaque
diff --git a/apps/nextcloud/app/postgres.yaml b/apps/nextcloud/app/postgres.yaml
new file mode 100644
index 0000000..296308e
--- /dev/null
+++ b/apps/nextcloud/app/postgres.yaml
@@ -0,0 +1,22 @@
+apiVersion: kubegres.reactive-tech.io/v1
+kind: Kubegres
+metadata:
+  name: nextcloud-db
+  namespace: nextcloud
+spec:
+   replicas: 1
+   image: postgres:16-alpine
+   database:
+      size: 2Gi
+   env:
+      - name: POSTGRES_PASSWORD
+        valueFrom:
+           secretKeyRef:
+              name: nextcloud-db-secret
+              key: password
+
+      - name: POSTGRES_REPLICATION_PASSWORD
+        valueFrom:
+           secretKeyRef:
+              name: nextcloud-db-secret
+              key: replication-password
diff --git a/apps/nextcloud/app/release.yaml b/apps/nextcloud/app/release.yaml
new file mode 100644
index 0000000..9b5c9db
--- /dev/null
+++ b/apps/nextcloud/app/release.yaml
@@ -0,0 +1,57 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  releaseName: nextcloud
+  chart:
+    spec:
+      chart: nextcloud
+      sourceRef:
+        kind: HelmRepository
+        name: nextcloud
+        namespace: repos
+  interval: 60m
+  install:
+    remediation:
+      retries: 3
+  values:
+    image:
+      flavor: fpm
+
+    nextcloud:
+      host: cloud.trivernis.net
+      existingSecret:
+        enabled: true
+        secretName: nextcloud-secret
+        usernameKey: username
+        passwordKey: password
+      configs:
+        overrides.config.php: |-
+          <?php
+          $CONFIG = array (
+          );
+
+    redis:
+      enabled: true
+    cronjob:
+      enabled: true
+
+    internalDatabase:
+      enabled: false
+    externalDatabase:
+      enabled: true
+      type: postgres
+      existingSecret:
+        enabled: true
+        secretName: nextcloud-db-secret
+        usernameKey: username
+        passwordKey: password
+        hostKey: host
+        databaseKey: database
+
+    persistence:
+      enabled: true
+      storageClass: ebs-hdd
+      size: 200Gi
diff --git a/apps/nextcloud/app/route.yaml b/apps/nextcloud/app/route.yaml
new file mode 100644
index 0000000..5551179
--- /dev/null
+++ b/apps/nextcloud/app/route.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-route
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`cloud.trivernis.net`)
+    kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
+    services:
+    - name: nextcloud
+      port: http
diff --git a/cluster/apps.yaml b/cluster/apps.yaml
index 462a6c1..371058f 100644
--- a/cluster/apps.yaml
+++ b/cluster/apps.yaml
@@ -218,3 +218,20 @@ spec:
   prune: true
   wait: true
   timeout: 5m0s
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: apps-nextcloud
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: repos
+  interval: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./apps/nextcloud
+  prune: true
+  wait: true
+  timeout: 5m0s
diff --git a/repos/nextcloud.yaml b/repos/nextcloud.yaml
new file mode 100644
index 0000000..66d6d63
--- /dev/null
+++ b/repos/nextcloud.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: nextcloud
+  namespace: repos
+spec:
+  interval: 60m
+  url: https://nextcloud.github.io/helm/