diff --git a/applications/stuff/authentik.yaml b/applications/stuff/authentik.yaml
new file mode 100644
index 0000000..634821e
--- /dev/null
+++ b/applications/stuff/authentik.yaml
@@ -0,0 +1,48 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://charts.goauthentik.io
+    chart: "authentik"
+    targetRevision: 2025.6.4
+    type: helm
+    helm:
+      values: |
+        global:
+          envFrom:
+            - secretRef:
+                name: authentik-env
+        redis:
+          enabled: false
+
+        postgresql:
+          enabled: false
+
+        server:
+          ingress:
+            enabled: true
+            annotations:
+              external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
+            hosts:
+              - host: auth.hxme.net
+                paths:
+                  - path: /
+                    pathType: Prefix
+            tls:
+              - hosts:
+                  - auth.hxme.net
+                secretName: wildcard-hxme-net
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: home-server
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/applications/stuff/nextcloud.yaml b/applications/stuff/nextcloud.yaml
new file mode 100644
index 0000000..4abd2a4
--- /dev/null
+++ b/applications/stuff/nextcloud.yaml
@@ -0,0 +1,112 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nextcloud-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  hostPath:
+    path: /dpool/services/nextcloud/data/
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-pvc
+  namespace: home-server
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path 
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: nextcloud-pv
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: home-server
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nextcloud
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: home-server
+spec:
+  securityContext:
+    runAsUser:  1000
+    runAsGroup: 1000
+    fsGroup:    1000
+  selector:
+    matchLabels:
+      app: nextcloud
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+    spec:
+      containers:
+        - name: nextcloud
+          image: nextcloud:29
+          env:
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-secrets
+                  key: MYSQL_PASSWORD
+            - name: MYSQL_DATABASE
+              value: nextcloud
+            - name: MYSQL_USER
+              value: nextcloud
+            - name: MYSQL_HOST
+              value: mariadb.database
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: nextcloud-data
+              mountPath: /var/www/html
+          securityContext:
+            runAsUser:  1000
+            runAsGroup: 1000
+            fsGroup:    1000
+      volumes:
+        - name: nextcloud-data
+          persistentVolumeClaim:
+            claimName: nextcloud-pvc
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud
+  namespace: home-server
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
+    nginx.ingress.kubernetes.io/server-snippet: |
+      add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+spec:
+  tls:
+    - hosts:
+        - nc.hxme.net
+      secretName: wildcard-hxme-net
+  rules:
+    - host: nc.hxme.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 80
diff --git a/deploy/server.yaml b/deploy/server.yaml
index 5822477..897ea1e 100644
--- a/deploy/server.yaml
+++ b/deploy/server.yaml
@@ -24,6 +24,11 @@ spec:
             namespace: database
             wave: 3
 
+          - name: deploy-stuff
+            path: applications/stuff
+            namespace: home-server
+            wave: 3
+
   template:
     metadata:
       name: "{{.name}}"