diff --git a/deployments/home-server/dovecot.yaml b/deployments/home-server/dovecot.yaml
new file mode 100644
index 0000000..b8662bf
--- /dev/null
+++ b/deployments/home-server/dovecot.yaml
@@ -0,0 +1,110 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dovecot-config
+  namespace: home-server
+data:
+  dovecot.conf: |
+    log_path = /dev/stdout
+    info_log_path = /dev/stdout
+    debug_log_path = /dev/stdout
+    syslog_facility = local0
+    protocols = imap
+    listen = *
+    disable_plaintext_auth = yes
+    mail_location = maildir:/data/%u
+    base_dir = /var/run/dovecot/
+    ssl = required
+    ssl_cert = </etc/ssl/hxme/fullchain.pem
+    ssl_key  = </etc/ssl/hxme/privkey.pem
+    auth_mechanisms = plain login
+
+    passdb {
+      driver = ldap
+      args = /config/ldap.conf
+    }
+
+    userdb {
+      driver = static
+      args = uid=1000 gid=1000 home=/data/%u
+    }
+
+    service imap-login {
+      inet_listener imap {
+        port = 0
+      }
+      inet_listener imaps {
+        port = 993
+        ssl = yes
+      }
+    }
+  ldap.conf: |
+    hosts = ldap://auth.hxme.net
+    auth_bind = yes
+    base = dc=ldap,dc=goauthentik,dc=io
+    dn = cn=binduser,ou=service-accounts,dc=ldap,dc=goauthentik,dc=io
+    dnpass = FtaJpthRpKyhEEy69H5qxPymtSeSeuCT9SQCdXmWDeAe7cgTCnk6HXpSzTNS
+    user_attrs = =home=/data/%u
+    user_filter = (&(objectClass=person)(uid=%u))
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dovecot
+  namespace: home-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dovecot
+  template:
+    metadata:
+      labels:
+        app: dovecot
+    spec:
+      containers:
+        - name: dovecot
+          image: registry.gitlab.com/dxcker/dovecot:latest
+          ports:
+            - containerPort: 993
+              name: imaps
+          volumeMounts:
+            - name: config
+              mountPath: /config/
+            - name: certs
+              mountPath: /etc/ssl/hxme
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: dovecot-config
+        - name: ldap
+          configMap:
+            name: dovecot-ldap
+        - name: certs
+          secret:
+            secretName: dovecot-cert
+            items:
+              - key: tls.crt
+                path: fullchain.pem
+        - name: tls
+          secret:
+            secretName: wildcard-hxme-net
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dovecot
+  namespace: home-server
+spec:
+  selector:
+    app: dovecot
+  ports:
+    - name: imaps
+      port: 993
+      targetPort: 993
+  type: ClusterIP
+