diff --git a/key/keeweb.yaml b/key/keeweb.yaml
new file mode 100644
index 0000000..80aa67a
--- /dev/null
+++ b/key/keeweb.yaml
@@ -0,0 +1,91 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keeweb
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keeweb-nginx
+  namespace: keeweb
+data:
+  keeweb.conf: |
+    server {
+        listen 80;
+        root /keeweb;
+        index index.html;
+        server_name _;
+        server_tokens off;
+        location / {
+            try_files $uri $uri/ =404;
+        }
+        location ~ /\. {
+            deny all;
+        }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keeweb
+  namespace: keeweb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keeweb
+  template:
+    metadata:
+      labels:
+        app: keeweb
+    spec:
+      containers:
+        - name: keeweb
+          image: antelle/keeweb:latest
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/keeweb.conf
+              subPath: keeweb.conf
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: keeweb-nginx
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keeweb
+  namespace: keeweb
+spec:
+  selector:
+    app: keeweb
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keeweb
+  namespace: keeweb
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - keys.roysland.net
+      secretName: keeweb-tls
+  rules:
+    - host: keys.roysland.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keeweb
+                port:
+                  number: 80
diff --git a/netdata.yaml b/netdata.yaml
index dabbe74..e637467 100644
--- a/netdata.yaml
+++ b/netdata.yaml
@@ -38,6 +38,9 @@ spec:
             - name: os-release
               mountPath: /host/etc/os-release
               readOnly: true
+            - name: nextcloud-data
+              mountPath: /host/mnt/nextcloud-data
+              readOnly: true
           env:
             - name: NETDATA_CLAIM_TOKEN
               value: ""
@@ -51,6 +54,9 @@ spec:
         - name: os-release
           hostPath:
             path: /etc/os-release
+        - name: nextcloud-data
+          hostPath:
+            path: /mnt/nextcloud-data
 ---
 apiVersion: v1
 kind: Service
@@ -82,8 +88,3 @@ spec:
                 name: netdata
                 port:
                   number: 19999
-```
-
-Keeping it on `netdata.local` like Headlamp so it's not exposed to the internet. Add to your hosts file too:
-```
-192.168.50.49 netdata.local
diff --git a/nextcloud/nextcloud.yaml b/nextcloud/nextcloud.yaml
index 4ec1f84..32f90a0 100644
--- a/nextcloud/nextcloud.yaml
+++ b/nextcloud/nextcloud.yaml
@@ -110,10 +110,16 @@ spec:
           volumeMounts:
             - name: nextcloud-data
               mountPath: /var/www/html
+            - name: user-data
+              mountPath: /var/www/html/data
       volumes:
         - name: nextcloud-data
           persistentVolumeClaim:
             claimName: nextcloud-data-pvc
+        - name: user-data
+          hostPath:
+            path: /mnt/nextcloud-data
+            type: Directory
 ---
 apiVersion: v1
 kind: Service