diff --git a/terraform/k8apps/.vault b/terraform/k8apps/.vault
new file mode 100644
index 0000000..7007d14
--- /dev/null
+++ b/terraform/k8apps/.vault
@@ -0,0 +1 @@
+../../repository.vault
\ No newline at end of file
diff --git a/terraform/k8apps/backend.tf b/terraform/k8apps/backend.tf
new file mode 100644
index 0000000..38df914
--- /dev/null
+++ b/terraform/k8apps/backend.tf
@@ -0,0 +1,24 @@
+# 
+# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai)
+# 
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+# 
+#        http://www.apache.org/licenses/LICENSE-2.0
+# 
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+# 
+# File: backend.tf
+
+terraform {
+  backend "s3" {
+    bucket                      = "a13labs.infra"
+    key                         = "scaleway-apps.tfstate"
+    region                      = "us-east-1"
+  }
+}
diff --git a/terraform/k8apps/buckets.tf b/terraform/k8apps/buckets.tf
new file mode 100644
index 0000000..2c9b910
--- /dev/null
+++ b/terraform/k8apps/buckets.tf
@@ -0,0 +1,49 @@
+resource "random_string" "bucket_suffix" {
+  length  = 8
+  lower   = true
+  upper   = false
+  special = false
+}
+
+resource "scaleway_object_bucket" "backup" {
+  name       = "a13labs-backup-${random_string.bucket_suffix.result}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+
+  lifecycle_rule {
+    id      = "clean"
+    prefix  = "gitea-backup/"
+    enabled = true
+
+    expiration {
+      days = local.cloud_backup_retention_days
+    }
+  }
+
+  lifecycle_rule {
+    id      = "clean"
+    prefix  = "wordpress-backup/"
+    enabled = true
+
+    expiration {
+      days = local.cloud_backup_retention_days
+    }
+  }
+
+  lifecycle_rule {
+    id      = "clean"
+    prefix  = "nextcloud-backup/"
+    enabled = true
+
+    expiration {
+      days = local.cloud_backup_retention_days
+    }
+  }
+
+}
+
+resource "scaleway_object_bucket" "nextcloud" {
+  name       = "a13labs-nextcloud-${random_string.bucket_suffix.result}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+}
diff --git a/terraform/k8apps/collabora.tf b/terraform/k8apps/collabora.tf
new file mode 100644
index 0000000..fadbf6b
--- /dev/null
+++ b/terraform/k8apps/collabora.tf
@@ -0,0 +1,213 @@
+#
+# Namespace
+#
+resource "kubernetes_namespace" "collabora" {
+  metadata {
+    annotations = {
+      name = "collabora"
+    }
+
+    labels = {
+      name = "collabora"
+    }
+
+    name = "collabora"
+  }
+}
+
+resource "kubernetes_secret" "collabora_admin_credentials" {
+  metadata {
+    name      = "collabora-admin-credentials"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+  }
+  data = {
+    username = "admin"
+    password = var.collabora_admin_password
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_config_map" "collabora" {
+
+  metadata {
+    name      = "collabora-config"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+  }
+  data = {
+    "extra_params" = "-o:ssl.enable=true"
+    "aliasgroup1"  = "https://${local.nextcloud_fqdn}"
+  }
+}
+
+resource "kubernetes_service_account" "collabora_service_account" {
+
+  metadata {
+    name      = "collabora-app-sa"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+
+resource "kubernetes_service" "collabora_office" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+  }
+  spec {
+    port {
+      port        = 80
+      target_port = "http"
+    }
+    selector = {
+      app = "collabora"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_ingress_v1" "collabora_ingress" {
+  depends_on = [
+    kubernetes_stateful_set.collabora_office
+  ]
+  metadata {
+    name      = "collabora-ingress"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"                  = "public"
+      "cert-manager.io/cluster-issuer"               = "letsencrypt-prod"
+      "kubernetes.io/tls-acme"                       = "true"
+      "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.collabora_fqdn]
+      secret_name = "collabora-tls"
+    }
+    rule {
+      host = local.collabora_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+
+resource "kubernetes_stateful_set" "collabora_office" {
+
+  metadata {
+    name      = "collabora"
+    namespace = kubernetes_namespace.collabora.metadata[0].name
+  }
+
+  spec {
+    service_name = "collabora"
+    selector {
+      match_labels = {
+        app = "collabora"
+      }
+    }
+    template {
+      metadata {
+        annotations = {
+          "cluster-autoscaler.kubernetes.io/safe-to-evict" = "true"
+        }
+        labels = {
+          app = "collabora"
+        }
+      }
+      spec {
+        termination_grace_period_seconds = 60
+        service_account_name             = kubernetes_service_account.collabora_service_account.metadata[0].name
+        container {
+          name              = "collabora"
+          image             = "collabora/code:${local.collabora_version}"
+          image_pull_policy = "IfNotPresent"
+          port {
+            name           = "http"
+            container_port = 9980
+            protocol       = "TCP"
+          }
+          startup_probe {
+            tcp_socket {
+              # path   = "/"
+              port = 9980
+              # scheme = "HTTP"
+            }
+            failure_threshold = 30
+            period_seconds    = 3
+          }
+          liveness_probe {
+            tcp_socket {
+              # path   = "/"
+              port = 9980
+              # scheme = "HTTP"
+            }
+            initial_delay_seconds = 0
+            period_seconds        = 30
+            timeout_seconds       = 30
+            success_threshold     = 1
+            failure_threshold     = 4
+          }
+          readiness_probe {
+            tcp_socket {
+              # path   = "/"
+              port = 9980
+              # scheme = "HTTP"
+            }
+            initial_delay_seconds = 0
+            period_seconds        = 30
+            timeout_seconds       = 30
+            success_threshold     = 1
+            failure_threshold     = 2
+          }
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.collabora.metadata[0].name
+            }
+          }
+          env {
+            name = "username"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.collabora_admin_credentials.metadata[0].name
+                key  = "username"
+              }
+            }
+          }
+          env {
+            name = "password"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.collabora_admin_credentials.metadata[0].name
+                key  = "password"
+              }
+            }
+          }
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
+        }
+        volume {
+          name = "tmp"
+          empty_dir {
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/terraform/k8apps/config.tf b/terraform/k8apps/config.tf
new file mode 100644
index 0000000..4252430
--- /dev/null
+++ b/terraform/k8apps/config.tf
@@ -0,0 +1,40 @@
+locals {
+
+  # apps
+  wordpress_version                    = "6.5.2"
+  wordpress_fqdn                       = "blog.alexpires.me"
+  wordpress_sql_backup_cron_schedule   = "0 2 * * *"
+  wordpress_files_backup_cron_schedule = "10 2 * * *"
+
+  gitea_version                    = "1.21.3"
+  gitea_fqdn                       = "code.alexpires.me"
+  gitea_sql_backup_cron_schedule   = "20 2 * * *"
+  gitea_files_backup_cron_schedule = "30 2 * * *"
+
+  nextcloud_version                    = "28.0.7-apache"
+  nextcloud_fqdn                       = "cloud.alexpires.me"
+  nextcloud_sql_backup_cron_schedule   = "40 2 * * *"
+  nextcloud_files_backup_cron_schedule = "50 2 * * *"
+
+  # collabora
+  collabora_fqdn    = "office.alexpires.me"
+  collabora_version = "24.04.1.4.1"
+
+  # tvheadend
+  m3uproxy_version  = "latest"
+  wireguard_version = "latest"
+  m3uproxy_fqdn     = "tv.alexpires.me"
+
+  # backup
+  local_backup_retention_days = 2
+  cloud_backup_retention_days = 3
+
+  # notification
+  scaleway_smtp_host = "smtp.tem.scw.cloud"
+  scaleway_smtp_port = 587
+}
+
+data "scaleway_account_project" "default" {
+  project_id      = var.scaleway_project_id
+  organization_id = var.scaleway_organization_id
+}
diff --git a/terraform/k8apps/gitea.tf b/terraform/k8apps/gitea.tf
new file mode 100644
index 0000000..fc23a63
--- /dev/null
+++ b/terraform/k8apps/gitea.tf
@@ -0,0 +1,352 @@
+locals {
+  gitea_env_vars = {
+    APP_NAME                 = "A13Labs git repository"
+    HTTP_PORT                = "3000"
+    RUN_MODE                 = "prod"
+    LFS_START_SERVER         = "true"
+    SSH_DOMAIN               = local.gitea_fqdn
+    DISABLE_REGISTRATION     = true
+    INSTALL_LOCK             = "true"
+    DB_TYPE                  = "mysql"
+    DB_NAME                  = "gitea"
+    DB_HOST                  = module.gitea_database.host
+    SSH_LISTEN_PORT          = 22
+    GITEA__mailer__ENABLED   = true
+    GITEA__mailer__FROM      = "gitea@alexpires.me"
+    GITEA__mailer__SMTP_ADDR = local.scaleway_smtp_host
+    GITEA__mailer__SMTP_PORT = local.scaleway_smtp_port
+    GITEA__mailer__PROTOCOL  = "smtps"
+  }
+
+  gitea_secrets = {
+    DB_USER = {
+      key  = "username"
+      name = module.gitea_database.app_crendentials_name
+    }
+    DB_PASSWD = {
+      key  = "password"
+      name = module.gitea_database.app_crendentials_name
+    }
+    GITEA__mailer__USER = {
+      key  = "username"
+      name = kubernetes_secret.gitea_mail_credentials.metadata[0].name
+    }
+    GITEA__mailer__PASSWD = {
+      key  = "password"
+      name = kubernetes_secret.gitea_mail_credentials.metadata[0].name
+    }
+  }
+
+  gitea_path       = "/var/lib/gitea"
+  gitea_mysql_path = "/var/lib/mysql.gitea"
+}
+
+#
+# Namespace
+#
+resource "kubernetes_namespace" "gitea" {
+  metadata {
+    annotations = {
+      name = "gitea"
+    }
+
+    labels = {
+      name = "gitea"
+    }
+
+    name = "gitea"
+  }
+}
+
+#
+# Mail credentials
+#
+resource "kubernetes_secret" "gitea_mail_credentials" {
+  metadata {
+    name      = "gitea-mail-credentials"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  data = {
+    username = var.scaleway_project_id
+    password = scaleway_iam_api_key.mail_app_api.secret_key
+  }
+  type = "Opaque"
+}
+
+#
+# Setup MariaDB database
+#
+module "gitea_database" {
+  source = "./modules/k8s_mariadb"
+
+  namespace         = kubernetes_namespace.gitea.metadata[0].name
+  app_name          = "gitea"
+  app_backup_folder = "gitea.backups"
+
+  app_password  = var.gitea_mysql_password
+  root_password = var.mysql_root_password
+
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.gitea_sql_backup_cron_schedule
+  host_storage_path = local.gitea_mysql_path
+}
+
+#
+# Setup rsync backup job to scaleway bucket
+#
+module "gitea_backup" {
+  source = "./modules/scw_backup_job"
+
+  namespace         = kubernetes_namespace.gitea.metadata[0].name
+  app_name          = "gitea"
+  app_files_folder  = "gitea"
+  app_backup_folder = "mysql.gitea/gitea.backups"
+
+  scaleway_organization_id = var.scaleway_organization_id
+  scaleway_project_id      = var.scaleway_organization_id
+  access_key               = scaleway_iam_api_key.backup_app_api.access_key
+  secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
+  bucket_name              = scaleway_object_bucket.backup.name
+
+  retention_days = local.local_backup_retention_days
+  cron_schedule  = local.gitea_files_backup_cron_schedule
+}
+
+# 
+# Gitea service, ingress, deployment and file backup job
+#
+resource "kubernetes_service_account" "gitea_service_account" {
+
+  metadata {
+    name      = "gitea-app-sa"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_service" "gitea_http" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  spec {
+    port {
+      port        = 80
+      target_port = "http"
+    }
+    selector = {
+      app = "gitea"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_service" "gitea_ssh" {
+  metadata {
+    name      = "ssh"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  spec {
+    port {
+      port        = 22
+      target_port = "ssh"
+      node_port   = 30036
+    }
+    selector = {
+      app = "gitea"
+    }
+    type = "NodePort"
+  }
+}
+
+resource "kubernetes_ingress_v1" "gitea_ingress" {
+  metadata {
+    name      = "gitea-ingress"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"                         = "public"
+      "cert-manager.io/cluster-issuer"                      = "letsencrypt-prod"
+      "nginx.ingress.kubernetes.io/ssl-redirect"            = "true"
+      "nginx.ingress.kubernetes.io/proxy-body-size"         = "8m"
+      "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
+      "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
+      "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.gitea_fqdn]
+      secret_name = "gitea-tls"
+    }
+    rule {
+      host = local.gitea_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_deployment" "gitea" {
+
+  depends_on = [module.gitea_database]
+
+  metadata {
+    name      = "gitea-app"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  spec {
+    selector {
+      match_labels = {
+        app = "gitea"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "gitea"
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.gitea_service_account.metadata[0].name
+        container {
+          name              = "gitea"
+          image             = "gitea/gitea:${local.gitea_version}"
+          image_pull_policy = "Always"
+
+          resources {
+            requests = {
+              memory = "100Mi"
+            }
+            limits = {
+              memory = "300Mi"
+            }
+          }
+
+          liveness_probe {
+            http_get {
+              path = "/api/healthz"
+              port = "http"
+            }
+            initial_delay_seconds = 200
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 5
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = "http"
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          dynamic "env" {
+            for_each = local.gitea_env_vars
+            content {
+              name  = env.key
+              value = env.value
+            }
+          }
+
+          dynamic "env" {
+            for_each = local.gitea_secrets
+            content {
+              name = env.key
+              value_from {
+                secret_key_ref {
+                  key  = env.value.key
+                  name = env.value.name
+                }
+              }
+            }
+          }
+
+          port {
+            container_port = 3000
+            name           = "http"
+          }
+          port {
+            container_port = 22
+            name           = "ssh"
+          }
+
+          volume_mount {
+            mount_path = "/data"
+            name       = "persistent-storage"
+          }
+        }
+        volume {
+          name = "persistent-storage"
+          host_path {
+            path = local.gitea_path
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_role" "gitea_ssh_access" {
+  metadata {
+    name      = "gitea-ssh-access"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods", "pods/log"]
+    verbs      = ["get", "list"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods/exec"]
+    verbs      = ["create"]
+  }
+}
+
+resource "kubernetes_role_binding" "gitea_ssh_access" {
+  metadata {
+    name      = "gitea-ssh-access"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role.gitea_ssh_access.metadata[0].name
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.gitea_service_account.metadata[0].name
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret" "gitea_access_token" {
+  metadata {
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name
+    }
+    name      = "git-token"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}
diff --git a/terraform/k8apps/iam.tf b/terraform/k8apps/iam.tf
new file mode 100644
index 0000000..7fb624e
--- /dev/null
+++ b/terraform/k8apps/iam.tf
@@ -0,0 +1,72 @@
+resource "scaleway_iam_application" "backup_app" {
+  name            = "k8s_backup_app"
+}
+
+resource "scaleway_iam_application" "mail_app" {
+  name            = "mail_app"
+}
+
+resource "scaleway_iam_application" "nextcloud_app" {
+  name            = "nextcloud_app"
+}
+
+resource "scaleway_iam_policy" "object_read_write_backup" {
+  name            = "K8s backup app policy"
+  description     = "Gives k8s backup job access to object storage in project"
+  application_id  = scaleway_iam_application.backup_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "ObjectStorageObjectsWrite",
+      "ObjectStorageObjectsRead",
+      "ObjectStorageObjectsDelete",
+      "ObjectStorageBucketsRead"
+    ]
+  }
+}
+
+resource "scaleway_iam_policy" "email_full_access" {
+  name            = "Email full access policy"
+  description     = "Gives access to transactional email in project"
+  application_id  = scaleway_iam_application.mail_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "TransactionalEmailFullAccess",
+    ]
+  }
+}
+
+resource "scaleway_iam_policy" "object_read_write_nextcloud" {
+  name            = "Nextcloud app policy"
+  description     = "Gives nextcloud job access to object storage in project"
+  application_id  = scaleway_iam_application.nextcloud_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "ObjectStorageObjectsWrite",
+      "ObjectStorageObjectsRead",
+      "ObjectStorageBucketsRead",
+      "ObjectStorageBucketsWrite",
+      "ObjectStorageObjectsDelete"
+    ]
+  }
+}
+
+resource "scaleway_iam_api_key" "backup_app_api" {
+  application_id = scaleway_iam_application.backup_app.id
+  description    = "k8s backup app API key"
+}
+
+resource "scaleway_iam_api_key" "mail_app_api" {
+  application_id = scaleway_iam_application.mail_app.id
+  description    = "mail access API key"
+}
+
+resource "scaleway_iam_api_key" "nextcloud_app_api" {
+  application_id = scaleway_iam_application.nextcloud_app.id
+  description    = "nextcloud access API key"
+}
diff --git a/terraform/k8apps/m3uproxy.tf b/terraform/k8apps/m3uproxy.tf
new file mode 100644
index 0000000..8a1576b
--- /dev/null
+++ b/terraform/k8apps/m3uproxy.tf
@@ -0,0 +1,446 @@
+locals {
+  m3uproxy_path       = "/var/lib/m3uproxy"
+  m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
+  squid_app_path      = "${local.m3uproxy_path}/squid"
+  wireguard_address   = "192.168.5.3/32"
+  wireguard_dns       = "192.168.5.1"
+  wireguard_allowed_ips = [
+    "192.168.5.1/32",
+    "192.168.5.3/32",
+    "0.0.0.0/0"
+  ]
+  wireguard_endpoint      = "188.82.170.183"
+  wireguard_endpoint_port = 1195
+
+  m3uproxy_config = templatefile("${path.module}/resources/m3uproxy/m3uproxy.json", {
+    m3uproxy_secret = var.m3uproxy_secret
+  })
+
+}
+
+resource "kubernetes_namespace" "m3uproxy" {
+  metadata {
+    annotations = {
+      name = "m3uproxy"
+    }
+
+    labels = {
+      name = "m3uproxy"
+    }
+
+    name = "m3uproxy"
+  }
+
+}
+
+resource "kubernetes_secret" "m3uproxy_admin_credentials" {
+  metadata {
+    name      = "m3uproxy-credentials"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+  data = {
+    username = "tv_admin"
+    password = var.m3uproxy_admin_password
+  }
+  type = "Opaque"
+}
+
+
+resource "kubernetes_service_account" "m3uproxy_service_account" {
+
+  metadata {
+    name      = "m3uproxy-app-sa"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "wireguard_config" {
+  metadata {
+    name      = "wireguard-config"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "wireguard.conf" = templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
+      wireguard_private_key = var.wireguard_private_key
+      wireguard_public_key  = var.wireguard_public_key
+      wireguard_address     = local.wireguard_address
+      wireguard_dns         = local.wireguard_dns
+      wireguard_allowed_ips = join(", ", local.wireguard_allowed_ips)
+      wireguard_endpoint    = "${local.wireguard_endpoint}:${local.wireguard_endpoint_port}"
+    })
+  }
+}
+
+resource "kubernetes_config_map" "squid_config" {
+  metadata {
+    name      = "squid-config"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "squid.conf" = file("${path.module}/resources/squid/squid.conf")
+  }
+
+}
+
+resource "kubernetes_config_map" "m3uproxy_config" {
+  metadata {
+    name      = "m3uproxy-config"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "m3uproxy.json" = local.m3uproxy_config
+    "playlist.json" = file("${path.module}/resources/m3uproxy/playlist.json")
+  }
+}
+
+resource "kubernetes_deployment" "proxy_pt" {
+
+  metadata {
+    name      = "proxy-pt"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+    annotations = {
+      "security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "proxy-pt"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "proxy-pt"
+        }
+      }
+
+      spec {
+        container {
+          name  = "wireguard"
+          image = "linuxserver/wireguard:${local.wireguard_version}"
+
+          resources {
+            requests = {
+              memory = "64Mi"
+            }
+          }
+
+          liveness_probe {
+            exec {
+              command = [
+                "/bin/sh",
+                "-c",
+                "wg show | grep -q transfer"
+              ]
+            }
+            initial_delay_seconds = 90
+            period_seconds        = 90
+          }
+
+          security_context {
+            privileged = true
+            capabilities {
+              add = ["NET_ADMIN"]
+            }
+          }
+
+          env {
+            name  = "PUID"
+            value = "1000"
+          }
+
+          env {
+            name  = "PGID"
+            value = "1000"
+          }
+
+          env {
+            name  = "TZ"
+            value = "Europe/Berlin"
+          }
+
+          volume_mount {
+            name       = "wireguard-config"
+            mount_path = "/config/wg_confs"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "lib-modules"
+            mount_path = "/lib/modules"
+            read_only  = true
+          }
+        }
+
+        container {
+          name  = "squid"
+          image = "ubuntu/squid:edge"
+
+          port {
+            container_port = 3128
+            name           = "proxy"
+            protocol       = "TCP"
+          }
+
+          volume_mount {
+            name       = "squid-config"
+            mount_path = "/etc/squid"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "squid-data"
+            mount_path = "/var/spol/squid"
+          }
+
+        }
+
+        volume {
+          name = "wireguard-config"
+          config_map {
+            name = kubernetes_config_map.wireguard_config.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "lib-modules"
+          host_path {
+            path = "/lib/modules"
+          }
+        }
+
+        volume {
+          name = "squid-config"
+          config_map {
+            name = kubernetes_config_map.squid_config.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "squid-data"
+          host_path {
+            path = local.squid_app_path
+          }
+        }
+      }
+    }
+  }
+
+  lifecycle {
+    replace_triggered_by = [
+      kubernetes_config_map.wireguard_config,
+      kubernetes_config_map.squid_config
+    ]
+  }
+}
+
+
+# Create the Deployment
+resource "kubernetes_deployment" "m3uproxy" {
+  metadata {
+    name      = "m3uproxy"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "m3uproxy"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "m3uproxy"
+        }
+      }
+
+      spec {
+        service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
+
+
+        container {
+          name              = "m3uproxy"
+          image             = "a13labs/m3uproxy:${local.m3uproxy_version}"
+          image_pull_policy = "Always"
+
+          resources {
+            requests = {
+              memory = "256Mi"
+            }
+          }
+
+          port {
+            container_port = 8080
+            name           = "http"
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/health"
+              port = "http"
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            failure_threshold     = 10
+          }
+
+          env {
+            name = "USERNAME"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.m3uproxy_admin_credentials.metadata[0].name
+                key  = "username"
+              }
+            }
+          }
+
+          env {
+            name = "PASSWORD"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.m3uproxy_admin_credentials.metadata[0].name
+                key  = "password"
+              }
+            }
+          }
+
+          security_context {
+            run_as_user  = 1000
+            run_as_group = 1000
+          }
+
+          volume_mount {
+            name       = "m3uproxy-config"
+            mount_path = "/app/conf"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "m3uproxy-app-cache"
+            mount_path = "/app/cache"
+          }
+
+          volume_mount {
+            name       = "geoip-db"
+            mount_path = "/app/GeoIP"
+            read_only  = true
+          }
+        }
+
+        volume {
+          name = "m3uproxy-config"
+          config_map {
+            name = kubernetes_config_map.m3uproxy_config.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "m3uproxy-app-cache"
+          host_path {
+            path = local.m3uproxy_cache_path
+          }
+        }
+
+        volume {
+          name = "geoip-db"
+          host_path {
+            path = "/var/lib/GeoIP"
+          }
+        }
+
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "m3uproxy" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "m3uproxy"
+    }
+    port {
+      port        = 8080
+      target_port = "http"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_service" "proxy_pt" {
+  metadata {
+    name      = "proxy-pt"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "proxy-pt"
+    }
+    port {
+      port = 3128
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_ingress_v1" "m3uproxy_ingress_http" {
+  metadata {
+    name      = "m3uproxy-ingress"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"              = "public"
+      "cert-manager.io/cluster-issuer"           = "letsencrypt-prod"
+      "kubernetes.io/tls-acme"                   = "true"
+      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.m3uproxy_fqdn]
+      secret_name = "m3uproxy-tls"
+    }
+    rule {
+      host = local.m3uproxy_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 8080
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/terraform/k8apps/modules/k8s_mariadb/main.tf b/terraform/k8apps/modules/k8s_mariadb/main.tf
new file mode 100644
index 0000000..df0fa60
--- /dev/null
+++ b/terraform/k8apps/modules/k8s_mariadb/main.tf
@@ -0,0 +1,241 @@
+resource "kubernetes_secret" "root_password" {
+  metadata {
+    name      = "${var.app_name}-root-credentials"
+    namespace = var.namespace
+  }
+  data = {
+    username = "root"
+    password = var.root_password
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_service_account" "service_account" {
+
+  metadata {
+    name      = "${var.app_name}-mariadb-sa"
+    namespace = var.namespace
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_secret" "app_password" {
+  metadata {
+    name      = "${var.app_name}-app-credentials"
+    namespace = var.namespace
+  }
+  data = {
+    username = var.app_name
+    password = var.app_password
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_service" "service" {
+  metadata {
+    name      = "mariadb"
+    namespace = var.namespace
+  }
+  spec {
+    port {
+      port = 3306
+    }
+    selector = {
+      app = "mariadb"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_deployment" "deployment" {
+  metadata {
+    name      = "mariadb"
+    namespace = var.namespace
+  }
+  spec {
+    selector {
+      match_labels = {
+        app = "mariadb"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "mariadb"
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.service_account.metadata[0].name
+        container {
+          name  = "mariadb"
+          image = "mariadb:${var.current_version}"
+
+          resources {
+            requests = {
+              memory = "100Mi"
+            }
+          }
+
+          liveness_probe {
+            exec {
+              command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 10
+            timeout_seconds       = 1
+            failure_threshold     = 15
+          }
+
+          readiness_probe {
+            exec {
+              command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
+            }
+            initial_delay_seconds = 120
+            period_seconds        = 10
+            timeout_seconds       = 1
+            failure_threshold     = 15
+          }
+
+          env {
+            name = "MARIADB_ROOT_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = kubernetes_secret.root_password.metadata[0].name
+              }
+            }
+          }
+          env {
+            name  = "MARIADB_ROOT_HOST"
+            value = "10.%"
+          }
+          env {
+            name = "MARIADB_USER"
+            value_from {
+              secret_key_ref {
+                key  = "username"
+                name = kubernetes_secret.app_password.metadata[0].name
+              }
+            }
+          }
+          env {
+            name = "MARIADB_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = kubernetes_secret.app_password.metadata[0].name
+              }
+            }
+          }
+          env {
+            name  = "MARIADB_DATABASE"
+            value = var.app_name
+          }
+          port {
+            container_port = 3306
+            name           = "mariadb"
+          }
+          volume_mount {
+            mount_path = "/var/lib/mysql"
+            name       = "persistent-storage"
+          }
+          volume_mount {
+            mount_path = "/docker-entrypoint-initdb.d"
+            name       = "initdb-storage"
+          }
+        }
+        volume {
+          name = "persistent-storage"
+          host_path {
+            path = "${var.host_storage_path}/${var.app_name}.data"
+          }
+        }
+        volume {
+          name = "initdb-storage"
+          host_path {
+            path = "${var.host_storage_path}/${var.app_name}.initdb.d"
+          }
+        }
+      }
+    }
+  }
+}
+
+# TODO: This should move out of here
+resource "kubernetes_cron_job_v1" "backup_data_cron" {
+  metadata {
+    name      = "mariadb-backup-job"
+    namespace = var.namespace
+  }
+  spec {
+    concurrency_policy            = "Forbid"
+    schedule                      = var.cron_schedule
+    failed_jobs_history_limit     = 2
+    successful_jobs_history_limit = 2
+    job_template {
+      metadata {
+        labels = {
+          app = "mariadb"
+        }
+      }
+      spec {
+        backoff_limit           = 1
+        parallelism             = 1
+        completions             = 1
+        active_deadline_seconds = 1800
+        template {
+          metadata {}
+          spec {
+            container {
+              name  = "sql-cron-job"
+              image = "mariadb:${var.current_version}"
+              env {
+                name = "MARIADB_USER"
+                value_from {
+                  secret_key_ref {
+                    key  = "username"
+                    name = kubernetes_secret.app_password.metadata[0].name
+                  }
+                }
+              }
+              env {
+                name = "MARIADB_PASSWORD"
+                value_from {
+                  secret_key_ref {
+                    key  = "password"
+                    name = kubernetes_secret.app_password.metadata[0].name
+                  }
+                }
+              }
+              env {
+                name  = "MARIADB_DATABASE"
+                value = var.app_name
+              }
+              command = ["/bin/sh", "-c"]
+              args = [join(";", [
+                "/usr/bin/mariadb-dump --single-transaction -h mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE | gzip > /backups/${var.app_name}-sql-`date +\"%Y%m%d\"`.sql.gz",
+                "find /backups -type f -name '${var.app_name}-sql-*.sql.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm"
+              ])]
+              volume_mount {
+                mount_path = "/backups"
+                name       = "backups-storage"
+              }
+            }
+            volume {
+              name = "backups-storage"
+              host_path {
+                path = "${var.host_storage_path}/${var.app_backup_folder}"
+              }
+            }
+            restart_policy                   = "Never"
+            termination_grace_period_seconds = 30
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/terraform/k8apps/modules/k8s_mariadb/outputs.tf b/terraform/k8apps/modules/k8s_mariadb/outputs.tf
new file mode 100644
index 0000000..4940974
--- /dev/null
+++ b/terraform/k8apps/modules/k8s_mariadb/outputs.tf
@@ -0,0 +1,15 @@
+output "host" {
+  value = "mariadb"
+}
+
+output "port" {
+  value = 3306
+}
+
+output "root_crendentials_name" {
+  value = kubernetes_secret.root_password.metadata[0].name
+}
+
+output "app_crendentials_name" {
+  value = kubernetes_secret.app_password.metadata[0].name
+}
diff --git a/terraform/k8apps/modules/k8s_mariadb/provider.tf b/terraform/k8apps/modules/k8s_mariadb/provider.tf
new file mode 100644
index 0000000..d1b0a1a
--- /dev/null
+++ b/terraform/k8apps/modules/k8s_mariadb/provider.tf
@@ -0,0 +1,11 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~>2.18"
+    }
+  }
+}
+
+
diff --git a/terraform/k8apps/modules/k8s_mariadb/variables.tf b/terraform/k8apps/modules/k8s_mariadb/variables.tf
new file mode 100644
index 0000000..b4541ca
--- /dev/null
+++ b/terraform/k8apps/modules/k8s_mariadb/variables.tf
@@ -0,0 +1,52 @@
+variable "namespace" {
+  description = "namespace"
+  sensitive   = false
+  type        = string
+}
+
+variable "app_name" {
+  description = "database name"
+  sensitive   = false
+  type        = string
+}
+
+variable "root_password" {
+  description = "root password"
+  sensitive   = true
+  type        = string
+}
+
+variable "app_password" {
+  description = "user password"
+  sensitive   = true
+  type        = string
+}
+
+variable "host_storage_path" {
+  description = "host storage path"
+  default     = "/srv"
+  type        = string
+}
+
+variable "cron_schedule" {
+  description = "Cronjob schedule for data backups"
+  default     = "* 2 * * *"
+  type        = string
+}
+
+variable "retention_days" {
+  description = "Backup retention days"
+  default     = 14
+  type        = number
+}
+
+variable "current_version" {
+  description = "version"
+  default     = "10.7.8"
+  type        = string
+}
+
+variable "app_backup_folder" {
+  description = "Backup source location"
+  type        = string
+}
diff --git a/terraform/k8apps/modules/scw_backup_job/config.tf b/terraform/k8apps/modules/scw_backup_job/config.tf
new file mode 100644
index 0000000..48569eb
--- /dev/null
+++ b/terraform/k8apps/modules/scw_backup_job/config.tf
@@ -0,0 +1,3 @@
+locals {
+  rclone_version = "1.61.1"
+}
\ No newline at end of file
diff --git a/terraform/k8apps/modules/scw_backup_job/main.tf b/terraform/k8apps/modules/scw_backup_job/main.tf
new file mode 100644
index 0000000..8ac4a47
--- /dev/null
+++ b/terraform/k8apps/modules/scw_backup_job/main.tf
@@ -0,0 +1,164 @@
+resource "kubernetes_service_account" "service_account" {
+  metadata {
+    name      = "${var.app_name}-backup-sa"
+    namespace = var.namespace
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_secret" "scaleway_api_credentials" {
+  metadata {
+    name      = "${var.app_name}-scaleway-api-credentials"
+    namespace = var.namespace
+  }
+  data = {
+    access_key = var.access_key
+    secret_key = var.secret_key
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_config_map" "rclone_config" {
+  metadata {
+    name      = "rclone-config"
+    namespace = var.namespace
+  }
+  data = {
+    "rclone.conf" = file("${path.module}/resources/rclone.conf")
+  }
+}
+
+resource "kubernetes_cron_job_v1" "backup_job" {
+  metadata {
+    name      = "${var.app_name}-backup"
+    namespace = var.namespace
+  }
+  spec {
+    concurrency_policy            = "Forbid"
+    schedule                      = var.cron_schedule
+    failed_jobs_history_limit     = 2
+    successful_jobs_history_limit = 2
+    job_template {
+      metadata {
+        labels = {
+          app = "${var.app_name}-backup"
+        }
+      }
+      spec {
+        backoff_limit           = 1
+        parallelism             = 1
+        completions             = 1
+        active_deadline_seconds = 1800
+        template {
+          metadata {
+            labels = {
+              app = "${var.app_name}-backup"
+            }
+          }
+          spec {
+            service_account_name = kubernetes_service_account.service_account.metadata[0].name
+            security_context {
+              run_as_user = 0
+            }
+            container {
+
+              name              = "${var.app_name}-backup"
+              image             = "rclone/rclone:${local.rclone_version}"
+              image_pull_policy = "Always"
+
+              resources {
+                requests = {
+                  memory = "100Mi"
+                }
+              }
+
+              env {
+                name = "SCW_ACCESS_KEY"
+                value_from {
+                  secret_key_ref {
+                    key  = "access_key"
+                    name = kubernetes_secret.scaleway_api_credentials.metadata[0].name
+                  }
+                }
+              }
+              env {
+                name = "SCW_SECRET_KEY"
+                value_from {
+                  secret_key_ref {
+                    key  = "secret_key"
+                    name = kubernetes_secret.scaleway_api_credentials.metadata[0].name
+                  }
+                }
+              }
+              env {
+                name  = "SCW_DEFAULT_PROJECT_ID"
+                value = var.scaleway_project_id
+              }
+              env {
+                name  = "SCW_DEFAULT_ORGANIZATION_ID"
+                value = var.scaleway_organization_id
+              }
+              env {
+                name  = "SCW_DEFAULT_REGION"
+                value = var.scaleway_region
+              }
+              env {
+                name  = "SCW_DEFAULT_ZONE"
+                value = var.scaleway_zone
+              }
+              env {
+                name  = "BUCKET_NAME"
+                value = var.bucket_name
+              }
+              command = ["/bin/sh", "-c"]
+              args = [join(";", [
+                "apk update",
+                "apk add gettext",
+                "envsubst</etc/rclone.conf.tmpl>/etc/rclone.conf",
+                "tar -zcvpf /backup/${var.app_name}-files-`date +\"%Y%m%d\"`.tar.gz /files",
+                "find /backup -type f -name '${var.app_name}-files-*.tar.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm",
+                "/usr/local/bin/rclone --config=/etc/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/${var.app_name}-backup"
+              ])]
+              volume_mount {
+                name       = "backup-storage"
+                mount_path = "/backup"
+              }
+              volume_mount {
+                name       = "persistent-storage"
+                mount_path = "/files"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "rclone-conf"
+                mount_path = "/etc/rclone.conf.tmpl"
+                sub_path   = "rclone.conf"
+                read_only  = true
+              }
+            }
+            volume {
+              name = "backup-storage"
+              host_path {
+                path = "${var.host_storage_path}/${var.app_backup_folder}"
+              }
+            }
+            volume {
+              name = "persistent-storage"
+              host_path {
+                path = "${var.host_storage_path}/${var.app_files_folder}"
+              }
+            }
+            volume {
+              name = "rclone-conf"
+              config_map {
+                name = kubernetes_config_map.rclone_config.metadata[0].name
+              }
+            }
+            restart_policy                   = "Never"
+            termination_grace_period_seconds = 30
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/terraform/k8apps/modules/scw_backup_job/provider.tf b/terraform/k8apps/modules/scw_backup_job/provider.tf
new file mode 100644
index 0000000..d1b0a1a
--- /dev/null
+++ b/terraform/k8apps/modules/scw_backup_job/provider.tf
@@ -0,0 +1,11 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~>2.18"
+    }
+  }
+}
+
+
diff --git a/terraform/k8apps/modules/scw_backup_job/resources/rclone.conf b/terraform/k8apps/modules/scw_backup_job/resources/rclone.conf
new file mode 100644
index 0000000..6ae9387
--- /dev/null
+++ b/terraform/k8apps/modules/scw_backup_job/resources/rclone.conf
@@ -0,0 +1,10 @@
+[scaleway]
+type = s3
+provider = Scaleway
+env_auth = false
+access_key_id = $SCW_ACCESS_KEY
+secret_access_key = $SCW_SECRET_KEY
+region = $SCW_DEFAULT_REGION
+endpoint = s3.$SCW_DEFAULT_REGION.scw.cloud
+acl = private
+storage_class = STANDARD
\ No newline at end of file
diff --git a/terraform/k8apps/modules/scw_backup_job/variables.tf b/terraform/k8apps/modules/scw_backup_job/variables.tf
new file mode 100644
index 0000000..05bb10d
--- /dev/null
+++ b/terraform/k8apps/modules/scw_backup_job/variables.tf
@@ -0,0 +1,76 @@
+variable "bucket_name" {
+  description = "Backup bucket name"
+  type        = string
+}
+
+variable "namespace" {
+  description = "Namespace"
+  type        = string
+}
+
+variable "scaleway_project_id" {
+  description = "Scaleway project id"
+  sensitive   = true
+  type        = string
+}
+
+variable "scaleway_organization_id" {
+  description = "Scaleway organization id"
+  sensitive   = true
+  type        = string
+}
+
+variable "scaleway_region" {
+  description = "Scaleway region"
+  default     = "fr-par"
+  type        = string
+}
+
+variable "scaleway_zone" {
+  default = "fr-par-2"
+  type    = string
+}
+
+variable "cron_schedule" {
+  description = "Cronjob schedule for data backups"
+  default     = "* 2 * * *"
+  type        = string
+}
+
+variable "host_storage_path" {
+  description = "Host path"
+  default     = "/var/lib"
+  type        = string
+}
+
+variable "access_key" {
+  description = "Access key"
+  sensitive   = true
+  type        = string
+}
+
+variable "secret_key" {
+  description = "Secret key"
+  sensitive   = true
+  type        = string
+}
+
+variable "app_name" {
+  description = "Name of the app to backup"
+  type        = string
+}
+
+variable "app_files_folder" {
+  description = "Name of host folder"
+  type        = string
+}
+
+variable "app_backup_folder" {
+  description = "Backup source location"
+  type        = string
+}
+
+variable "retention_days" {
+  description = "backup retention days"
+  type        = string
+}
diff --git a/terraform/k8apps/nextcloud.tf b/terraform/k8apps/nextcloud.tf
new file mode 100644
index 0000000..e071b1f
--- /dev/null
+++ b/terraform/k8apps/nextcloud.tf
@@ -0,0 +1,492 @@
+locals {
+  nextcloud_env_vars = {
+    # Database configuration
+    MYSQL_DATABASE = "nextcloud"
+    MYSQL_HOST     = module.nextcloud_database.host
+
+    # Email configuration
+    SMTP_HOST         = local.scaleway_smtp_host
+    SMTP_SECURE       = "ssl"
+    SMTP_PORT         = 465
+    MAIL_FROM_ADDRESS = "cloud"
+    MAIL_DOMAIN       = "alexpires.me"
+    SMTP_AUTHTYPE     = "PLAIN"
+
+    # Redis configuration
+    REDIS_HOST = "redis"
+
+    # Object as primary storage
+    OBJECTSTORE_S3_HOST       = "s3.${scaleway_object_bucket.nextcloud.region}.scw.cloud"
+    OBJECTSTORE_S3_BUCKET     = scaleway_object_bucket.nextcloud.name
+    OBJECTSTORE_S3_PORT       = 443
+    OBJECTSTORE_S3_SSL        = true
+    OBJECTSTORE_S3_REGION     = scaleway_object_bucket.nextcloud.region
+    OBJECTSTORE_S3_AUTOCREATE = false
+
+    # General
+    NEXTCLOUD_TRUSTED_DOMAINS = local.nextcloud_fqdn
+    TRUSTED_PROXIES           = join(" ", ["10.1.0.0/16"])
+    OVERWRITEHOST             = local.nextcloud_fqdn
+    OVERWRITEPROTOCOL         = "https"
+    OVERWRITECLIURL           = "https://${local.nextcloud_fqdn}"
+  }
+
+  nextcloud_secrets = {
+
+    OBJECTSTORE_S3_KEY = {
+      key  = "access_key"
+      name = kubernetes_secret.nextcloud_object_store_credentials.metadata[0].name
+    }
+
+    OBJECTSTORE_S3_SECRET = {
+      key  = "secret_key"
+      name = kubernetes_secret.nextcloud_object_store_credentials.metadata[0].name
+    }
+
+    SMTP_NAME = {
+      key  = "username"
+      name = kubernetes_secret.nextcloud_mail_credentials.metadata[0].name
+    }
+
+    SMTP_PASSWORD = {
+      key  = "password"
+      name = kubernetes_secret.nextcloud_mail_credentials.metadata[0].name
+    }
+
+    MYSQL_USER = {
+      key  = "username"
+      name = module.nextcloud_database.app_crendentials_name
+    }
+
+    MYSQL_PASSWORD = {
+      key  = "password"
+      name = module.nextcloud_database.app_crendentials_name
+    }
+
+    NEXTCLOUD_ADMIN_USER = {
+      key  = "username"
+      name = kubernetes_secret.nextcloud_admin_credentials.metadata[0].name
+    }
+
+    NEXTCLOUD_ADMIN_PASSWORD = {
+      key  = "password"
+      name = kubernetes_secret.nextcloud_admin_credentials.metadata[0].name
+    }
+  }
+
+  nextcloud_path       = "/var/lib/nextcloud"
+  nextcloud_mysql_path = "/var/lib/mysql.nextcloud"
+
+}
+
+#
+# Namespace
+#
+resource "kubernetes_namespace" "nextcloud" {
+  metadata {
+    annotations = {
+      name = "nextcloud"
+    }
+
+    labels = {
+      name = "nextcloud"
+    }
+
+    name = "nextcloud"
+  }
+}
+
+#
+# Nextcloud required credentials
+#
+resource "kubernetes_secret" "nextcloud_mail_credentials" {
+  metadata {
+    name      = "nextcloud-mail-credentials"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  data = {
+    username = var.scaleway_project_id
+    password = scaleway_iam_api_key.mail_app_api.secret_key
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_secret" "nextcloud_object_store_credentials" {
+  metadata {
+    name      = "nextcloud-object-store-credentials"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  data = {
+    access_key = scaleway_iam_api_key.nextcloud_app_api.access_key
+    secret_key = scaleway_iam_api_key.nextcloud_app_api.secret_key
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_secret" "nextcloud_admin_credentials" {
+  metadata {
+    name      = "nextcloud-admin-credentials"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  data = {
+    username = "admin"
+    password = var.nextcloud_admin_password
+  }
+  type = "Opaque"
+}
+
+#
+# Setup MariaDB database
+#
+module "nextcloud_database" {
+  source = "./modules/k8s_mariadb"
+
+  namespace         = kubernetes_namespace.nextcloud.metadata[0].name
+  app_name          = "nextcloud"
+  app_backup_folder = "nextcloud.backups"
+
+  app_password  = var.nextcloud_mysql_password
+  root_password = var.mysql_root_password
+
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.nextcloud_sql_backup_cron_schedule
+  host_storage_path = local.nextcloud_mysql_path
+}
+
+#
+# Setup rsync backup job to scaleway bucket
+#
+module "nextcloud_backup" {
+
+  source = "./modules/scw_backup_job"
+
+  namespace         = kubernetes_namespace.nextcloud.metadata[0].name
+  app_name          = "nextcloud"
+  app_files_folder  = "nextcloud"
+  app_backup_folder = "mysql.nextcloud/nextcloud.backups"
+
+  scaleway_organization_id = var.scaleway_organization_id
+  scaleway_project_id      = var.scaleway_organization_id
+  access_key               = scaleway_iam_api_key.backup_app_api.access_key
+  secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
+  bucket_name              = scaleway_object_bucket.backup.name
+
+  retention_days = local.local_backup_retention_days
+  cron_schedule  = local.nextcloud_files_backup_cron_schedule
+}
+
+# 
+# Nextcloud service, ingress, deployment and file backup job
+#
+#
+resource "kubernetes_service_account" "nextcloud_service_account" {
+
+  metadata {
+    name      = "nextcloud-app-sa"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_service" "nextcloud_redis" {
+  metadata {
+    name      = "redis"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  spec {
+    port {
+      port = 6379
+      name = "redis"
+    }
+    selector = {
+      app = "redis"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_service" "nextcloud_apache" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  spec {
+    port {
+      port        = 80
+      target_port = "http"
+    }
+    selector = {
+      app = "nextcloud"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_ingress_v1" "nextcloud_ingress" {
+  depends_on = [
+    kubernetes_deployment.nextcloud_apache
+  ]
+  metadata {
+    name      = "nextcloud-ingress"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"                         = "public"
+      "cert-manager.io/cluster-issuer"                      = "letsencrypt-prod"
+      "kubernetes.io/tls-acme"                              = "true"
+      "nginx.ingress.kubernetes.io/ssl-redirect"            = "true"
+      "nginx.ingress.kubernetes.io/proxy-body-size"         = "4G"
+      "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
+      "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
+      "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
+      "nginx.ingress.kubernetes.io/server-snippet"          = file("${path.module}/resources/nextcloud-server-snippet.conf")
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.nextcloud_fqdn]
+      secret_name = "nextcloud-tls"
+    }
+    rule {
+      host = local.nextcloud_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_deployment" "nextcloud_redis" {
+  metadata {
+    name      = "redis"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  spec {
+    selector {
+      match_labels = {
+        app = "redis"
+      }
+    }
+    strategy {
+      type = "RollingUpdate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "redis"
+        }
+      }
+      spec {
+        container {
+          name  = "redis"
+          image = "redis:latest"
+
+          resources {
+            requests = {
+              memory = "20Mi"
+            }
+            limits = {
+              memory = "50Mi"
+            }
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = "redis"
+            }
+            initial_delay_seconds = 10
+            period_seconds        = 15
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = "redis"
+            }
+            initial_delay_seconds = 10
+            period_seconds        = 15
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          port {
+            container_port = 6379
+            name           = "redis"
+            protocol       = "TCP"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_deployment" "nextcloud_apache" {
+
+  depends_on = [
+    module.nextcloud_database,
+    kubernetes_deployment.nextcloud_redis
+  ]
+
+  metadata {
+    name      = "nextcloud-app"
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+  }
+  spec {
+    selector {
+      match_labels = {
+        app = "nextcloud"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "nextcloud"
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.nextcloud_service_account.metadata[0].name
+
+        container {
+          name              = "nextcloud"
+          image             = "nextcloud:${local.nextcloud_version}"
+          image_pull_policy = "Always"
+
+          resources {
+            requests = {
+              memory = "200Mi"
+            }
+          }
+
+          readiness_probe {
+            http_get {
+              port = "http"
+              path = "/status.php"
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = "http"
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          dynamic "env" {
+            for_each = local.nextcloud_env_vars
+            content {
+              name  = env.key
+              value = env.value
+            }
+          }
+
+          dynamic "env" {
+            for_each = local.nextcloud_secrets
+            content {
+              name = env.key
+              value_from {
+                secret_key_ref {
+                  key  = env.value.key
+                  name = env.value.name
+                }
+              }
+            }
+          }
+
+          port {
+            container_port = 80
+            name           = "http"
+          }
+
+          volume_mount {
+            mount_path = "/var/www/html"
+            name       = "persistent-storage"
+          }
+        }
+        volume {
+          name = "persistent-storage"
+          host_path {
+            path = local.nextcloud_path
+          }
+        }
+      }
+    }
+  }
+  lifecycle {
+    replace_triggered_by = [
+      kubernetes_deployment.nextcloud_redis
+    ]
+  }
+}
+
+resource "kubernetes_cron_job_v1" "nextcloud_cron_apache" {
+  depends_on = [
+    kubernetes_deployment.nextcloud_apache
+  ]
+  metadata {
+    namespace = kubernetes_namespace.nextcloud.metadata[0].name
+    name      = "cronjob-trigger"
+  }
+  spec {
+    schedule                      = "*/15 * * * *"
+    concurrency_policy            = "Forbid"
+    failed_jobs_history_limit     = 2
+    successful_jobs_history_limit = 2
+    job_template {
+      metadata {
+        labels = {
+          app = "cronjob-trigger"
+        }
+      }
+      spec {
+        backoff_limit           = 1
+        parallelism             = 1
+        completions             = 1
+        active_deadline_seconds = 300
+        template {
+          metadata {
+            labels = {
+              app = "cronjob-trigger"
+            }
+          }
+          spec {
+            container {
+              name  = "nextcloud"
+              image = "nextcloud:${local.nextcloud_version}"
+
+              command = ["curl"]
+              args    = ["--fail", "-L", "http://http/cron.php"]
+            }
+            restart_policy                   = "Never"
+            termination_grace_period_seconds = 30
+          }
+        }
+      }
+    }
+  }
+  lifecycle {
+    replace_triggered_by = [
+      kubernetes_deployment.nextcloud_apache
+    ]
+  }
+}
diff --git a/terraform/k8apps/operator.tf b/terraform/k8apps/operator.tf
new file mode 100644
index 0000000..8362673
--- /dev/null
+++ b/terraform/k8apps/operator.tf
@@ -0,0 +1,38 @@
+resource "kubernetes_service_account" "operator_service_account" {
+  metadata {
+    name      = "operator"
+    namespace = "default"
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "operator_admin_access" {
+
+  metadata {
+    name = "operator-admin-access"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-admin"
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    namespace = "default"
+    name      = kubernetes_service_account.operator_service_account.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret" "operator_access_token" {
+  metadata {
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
+    }
+    name      = "operator-token"
+    namespace = "default"
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}
diff --git a/terraform/k8apps/provider.tf b/terraform/k8apps/provider.tf
new file mode 100644
index 0000000..c2618aa
--- /dev/null
+++ b/terraform/k8apps/provider.tf
@@ -0,0 +1,46 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    random = {
+      source  = "hashicorp/random"
+      version = "~>3.4"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "~>3.2"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "~>2.2"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "~>0.9"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~>2.18"
+    }
+    scaleway = {
+      source  = "scaleway/scaleway"
+      version = "~>2.13"
+    }
+  }
+}
+
+provider "kubernetes" {
+  host                   = var.k8s_host
+  client_certificate     = base64decode(var.k8s_client_certificate)
+  client_key             = base64decode(var.k8s_client_key)
+  cluster_ca_certificate = base64decode(var.k8s_cluster_ca_certificate)
+  insecure               = true
+}
+
+provider "scaleway" {
+  zone            = "fr-par-2"
+  region          = "fr-par"
+  access_key      = var.scaleway_access_key
+  secret_key      = var.scaleway_secret_key
+  organization_id = var.scaleway_organization_id
+}
+
diff --git a/terraform/k8apps/resources/apache2/000-default.conf b/terraform/k8apps/resources/apache2/000-default.conf
new file mode 100644
index 0000000..36e681d
--- /dev/null
+++ b/terraform/k8apps/resources/apache2/000-default.conf
@@ -0,0 +1,29 @@
+<VirtualHost *:8080>
+	# The ServerName directive sets the request scheme, hostname and port that
+	# the server uses to identify itself. This is used when creating
+	# redirection URLs. In the context of virtual hosts, the ServerName
+	# specifies what hostname must appear in the request's Host: header to
+	# match this virtual host. For the default virtual host (this file) this
+	# value is not decisive as it is used as a last resort host regardless.
+	# However, you must set it for any further virtual host explicitly.
+	#ServerName www.example.com
+
+	ServerAdmin webmaster@localhost
+	DocumentRoot /var/www/html
+
+	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
+	# error, crit, alert, emerg.
+	# It is also possible to configure the loglevel for particular
+	# modules, e.g.
+	#LogLevel info ssl:warn
+
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+	CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+	# For most configuration files from conf-available/, which are
+	# enabled or disabled at a global level, it is possible to
+	# include a line for only one particular virtual host. For example the
+	# following line enables the CGI configuration for this host only
+	# after it has been globally disabled with "a2disconf".
+	#Include conf-available/serve-cgi-bin.conf
+</VirtualHost>
diff --git a/terraform/k8apps/resources/collabora/coolwsd.xml b/terraform/k8apps/resources/collabora/coolwsd.xml
new file mode 100644
index 0000000..2eb441a
--- /dev/null
+++ b/terraform/k8apps/resources/collabora/coolwsd.xml
@@ -0,0 +1,477 @@
+<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- -->
+<config>
+
+    <!-- For more detailed documentation on typical configuration options please see:
+         https://sdk.collaboraonline.com/docs/installation/Configuration.html -->
+
+    <!-- Note: 'default' attributes are used to document a setting's default value as well as to use
+    as fallback. -->
+    <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing
+    upon deployment. -->
+
+    <allowed_languages
+        desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance."
+        default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR
+        it nl pt_BR pt_PT ru</allowed_languages>
+
+    <!--
+        These are the settings of external (remote) spellchecker and grammar checker services. Currently
+    LanguageTool and Duden Korrekturserver APIs are supported, you can
+        set either of them. By default they are disabled. To turn the support on, please set "enabled"
+    property to true. It works with self hosted or cloud services, free
+        and premium as well. The "base_url" may be https://api.languagetoolplus.com/v2 if the cloud version
+    of LanguageTool is used. Please note that your data in the
+        document e.g. the text part of it will be sent to the cloud API. Please read the respective privacy
+    policies, e.g. https://languagetool.org/legal/privacy.
+    -->
+    <languagetool desc="Remote API settings for spell and grammar checking">
+        <enabled desc="Enable Remote Spell and Grammar Checker" type="bool" default="false"></enabled>
+        <base_url
+            desc="HTTP endpoint for the API server, without /check or /languages postfix at the end."
+            type="string" default=""></base_url>
+        <user_name desc="LanguageTool or Duden account username for premium usage." type="string"
+            default=""></user_name>
+        <api_key desc="API key provided by LanguageTool or Duden account for premium usage."
+            type="string" default=""></api_key>
+        <ssl_verification
+            desc="Enable or disable SSL verification. You may have to disable it in test environments with self-signed certificates."
+            type="string" default="true"></ssl_verification>
+        <rest_protocol
+            desc="REST API protocol. For LanguageTool leave it blank, for Duden Korrekturserver use the string 'duden'."
+            type="string" default=""></rest_protocol>
+    </languagetool>
+
+    <deepl desc="DeepL API settings for translation service">
+        <enabled
+            desc="If true, shows translate option as a menu entry in the compact view and as an icon in the tabbed view."
+            type="bool" default="false">false</enabled>
+        <api_url desc="URL for the API" type="string" default=""></api_url>
+        <auth_key desc="Auth Key generated by your account" type="string" default=""></auth_key>
+    </deepl>
+
+    <sys_template_path
+        desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes."
+        type="path" relative="true" default="systemplate"></sys_template_path>
+    <child_root_path
+        desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory."
+        type="path" relative="true" default="jails"></child_root_path>
+    <mount_jail_tree
+        desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file."
+        type="bool" default="true"></mount_jail_tree>
+
+    <server_name
+        desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly."
+        type="string" default=""></server_name>
+    <file_server_root_path
+        desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool."
+        type="path" relative="true" default="browser/../"></file_server_root_path>
+    <hexify_embedded_urls
+        desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments"
+        type="bool" default="false"></hexify_embedded_urls>
+    <experimental_features desc="Enable/Disable experimental features" type="bool" default="true">
+        true</experimental_features>
+
+    <memproportion
+        desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents"
+        type="double" default="80.0"></memproportion>
+    <num_prespawn_children
+        desc="Number of child processes to keep started in advance and waiting for new clients."
+        type="uint" default="1">1</num_prespawn_children>
+    <!-- <fetch_update_check desc="Every number of hours will fetch latest version data. Defaults to
+    10 hours." type="uint" default="10">10</fetch_update_check> -->
+    <per_document desc="Document-specific settings, including LO Core settings.">
+        <max_concurrency desc="The maximum number of threads to use while processing a document."
+            type="uint" default="4">4</max_concurrency>
+        <batch_priority
+            desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones"
+            type="uint" default="5">5</batch_priority>
+        <document_signing_url
+            desc="The endpoint URL of signing server, if empty the document signing is disabled"
+            type="string" default=""></document_signing_url>
+        <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">
+            false</redlining_as_comments>
+        <pdf_resolution_dpi
+            desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96."
+            type="uint" default="96">96</pdf_resolution_dpi>
+        <idle_timeout_secs
+            desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour."
+            type="uint" default="3600">3600</idle_timeout_secs>
+        <idlesave_duration_secs
+            desc="The number of idle seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 30 seconds."
+            type="uint" default="30">30</idlesave_duration_secs>
+        <autosave_duration_secs
+            desc="The number of seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 5 minutes."
+            type="uint" default="300">300</autosave_duration_secs>
+        <always_save_on_exit
+            desc="On exiting the last editor, always perform the save, even if the document is not modified."
+            type="bool" default="false">false</always_save_on_exit>
+        <limit_virt_mem_mb
+            desc="The maximum virtual memory allowed to each document process. 0 for unlimited."
+            type="uint">0</limit_virt_mem_mb>
+        <limit_stack_mem_kb
+            desc="The maximum stack size allowed to each document process. 0 for unlimited."
+            type="uint">8000</limit_stack_mem_kb>
+        <limit_file_size_mb
+            desc="The maximum file size allowed to each document process to write. 0 for unlimited."
+            type="uint">0</limit_file_size_mb>
+        <limit_num_open_files
+            desc="The maximum number of files allowed to each document process to open. 0 for unlimited."
+            type="uint">0</limit_num_open_files>
+        <limit_load_secs
+            desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited."
+            type="uint" default="100">100</limit_load_secs>
+        <limit_store_failures
+            desc="Maximum number of consecutive save-and-upload to storage failures when unloading the document. 0 for unlimited (not recommended)."
+            type="uint" default="5">5</limit_store_failures>
+        <limit_convert_secs
+            desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited."
+            type="uint" default="100">100</limit_convert_secs>
+        <min_time_between_saves_ms
+            desc="Minimum number of milliseconds between saving the document on disk." type="uint"
+            default="500">500</min_time_between_saves_ms>
+        <min_time_between_uploads_ms
+            desc="Minimum number of milliseconds between uploading the document to storage."
+            type="uint" default="5000">5000</min_time_between_uploads_ms>
+        <cleanup
+            desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per"
+            enable="true">
+            <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">
+                10000</cleanup_interval_ms>
+            <bad_behavior_period_secs
+                desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset"
+                type="uint" default="60">60</bad_behavior_period_secs>
+            <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state"
+                type="uint" default="300">300</idle_time_secs>
+            <limit_dirty_mem_mb
+                desc="Minimum memory usage for a document to be candidate for bad state" type="uint"
+                default="3072">3072</limit_dirty_mem_mb>
+            <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state"
+                type="uint" default="85">85</limit_cpu_per>
+            <lost_kit_grace_period_secs
+                desc="The minimum grace period for a lost kit process (not referenced by coolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0"
+                default="120">120</lost_kit_grace_period_secs>
+        </cleanup>
+    </per_document>
+
+    <per_view desc="View-specific settings.">
+        <group_download_as
+            desc="If set to true, groups download as icons into a dropdown for the notebookbar view."
+            type="bool" default="true">true</group_download_as>
+        <out_of_focus_timeout_secs
+            desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds."
+            type="uint" default="120">120</out_of_focus_timeout_secs>
+        <idle_timeout_secs
+            desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes."
+            type="uint" default="900">900</idle_timeout_secs>
+    </per_view>
+
+    <ver_suffix desc="Appended to etags to allow easy refresh of changed files during development"
+        type="string" default=""></ver_suffix>
+
+    <logging>
+        <color type="bool">true</color>
+        <!--
+             Note to developers: When you do "make run", the logging.level will be set on the
+             coolwsd command line, so if you want to change it for your testing, do it in
+             Makefile.am, not here.
+        -->
+        <level type="string"
+            desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace"
+            default="warning">warning</level>
+        <level_startup type="string"
+            desc="As for level - but for the initial startup phase which is most problematic, logging reverts to level configured above when startup is complete"
+            default="trace">trace</level_startup>
+        <most_verbose_level_settable_from_client type="string"
+            desc="A loggingleveloverride message from the client can not set a more verbose log level than this"
+            default="notice">notice</most_verbose_level_settable_from_client>
+        <least_verbose_level_settable_from_client type="string"
+            desc="A loggingleveloverride message from a client can not set a less verbose log level than this"
+            default="fatal">fatal</least_verbose_level_settable_from_client>
+        <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">
+            false</protocol>
+        <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging
+        Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav"
+             See also: https://docs.libreoffice.org/sal/html/sal_log.html -->
+        <lokit_sal_log type="string"
+            desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit."
+            default="-INFO-WARN">-INFO-WARN</lokit_sal_log>
+        <file enable="false">
+            <!-- If you use other path than /var/log and you run coolwsd from systemd, make sure
+            that you enable that path in coolwsd.service (ReadWritePaths). -->
+            <property name="path" desc="Log file path.">/var/log/coolwsd.log</property>
+            <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
+            <property name="archive"
+                desc="Append either timestamp or number to the archived log filename.">timestamp</property>
+            <property name="compress" desc="Enable/disable log file compression.">true</property>
+            <property name="purgeAge"
+                desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
+            <property name="purgeCount"
+                desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">
+                10</property>
+            <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
+            <property name="flush"
+                desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">
+                false</property>
+        </file>
+        <anonymize>
+            <anonymize_user_data type="bool"
+                desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled."
+                default="false">false</anonymize_user_data>
+            <anonymization_salt type="uint"
+                desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number."
+                default="82589933">82589933</anonymization_salt>
+        </anonymize>
+        <docstats type="bool" desc="Enable to see document handling information in logs."
+            default="false">false</docstats>
+        <userstats desc="Enable user stats. i.e: logs the details of a file and user" type="bool"
+            default="false">false</userstats>
+    </logging>
+
+    <!--
+         Note to developers: When you do "make run", the trace_event[@enable] will be set on the
+         coolwsd command line, so if you want to change it for your testing, do it in Makefile.am,
+         not here.
+    -->
+    <trace_event desc="The possibility to turn on generation of a Chrome Trace Event file"
+        enable="false">
+        <path
+            desc="Output path for the Trace Event file, to which they will be written if turned on at run-time"
+            type="string" default="/var/log/coolwsd.trace.json">/var/log/coolwsd.trace.json</path>
+    </trace_event>
+
+    <browser_logging desc="Logging in the browser console" default="false">false</browser_logging>
+
+    <trace
+        desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first."
+        enable="false">
+        <path
+            desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/cooltrace-%.gz"
+            compress="true" snapshot="false"></path>
+        <filter>
+            <message desc="Regex pattern of messages to exclude"></message>
+        </filter>
+        <outgoing>
+            <record desc="Whether or not to record outgoing messages" default="false">false</record>
+        </outgoing>
+    </trace>
+
+    <net desc="Network settings">
+        <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all
+        and net.listen is loopback, coolwsd unexpectedly listens on [::1] only.
+           You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
+        <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
+        <listen type="string" default="any"
+            desc="Listen address that coolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
+        <!-- this allows you to shift all of our URLs into a sub-path from
+           https://my.com/browser/a123... to https://my.com/my/sub/path/browser/a123... -->
+        <service_root type="path" default=""
+            desc="Prefix all the pages, websockets, etc. with this path."></service_root>
+        <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
+            <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">
+                192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 addresses">
+                ::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
+            <host desc="The IPv6 loopback (localhost) address.">::1</host>
+            <host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">
+                172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 addresses">
+                ::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">
+                172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 addresses">
+                ::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">
+                172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 addresses">
+                ::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">
+                10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Ditto, but as IPv4-mapped IPv6 addresses">
+                ::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        </post_allow>
+        <frame_ancestors
+            desc="Specify who is allowed to embed the Collabora Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
+        <connection_timeout_secs
+            desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)."
+            type="int" default="30"></connection_timeout_secs>
+
+        <!-- this setting radically changes how online works, it should not be used in a production
+        environment -->
+        <proxy_prefix type="bool" default="false"
+            desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix>
+    </net>
+
+    <ssl desc="SSL settings">
+        <!-- switches from https:// + wss:// to http:// + ws:// -->
+        <enable type="bool"
+            desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable."
+            default="true">true</enable>
+        <!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in
+        production -->
+        <termination
+            desc="Connection via proxy where coolwsd acts as working via https, but actually uses http."
+            type="bool" default="true">false</termination>
+        <cert_file_path desc="Path to the cert file" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
+        <key_file_path desc="Path to the key file" relative="false">/etc/coolwsd/key.pem</key_file_path>
+        <ca_file_path desc="Path to the ca file" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
+        <cipher_list desc="List of OpenSSL ciphers to accept"
+            default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
+        <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
+            <max_age
+                desc="HPKP's max-age directive - time in seconds browser should remember the pins"
+                enable="true">1000</max_age>
+            <report_uri
+                desc="HPKP's report-uri directive - pin validation failure are reported at this URL"
+                enable="false"></report_uri>
+            <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
+                <pin></pin>
+            </pins>
+        </hpkp>
+        <sts desc="Strict-Transport-Security settings, per rfc6797. Subdomains are always included.">
+            <enabled
+                desc="Whether or not Strict-Transport-Security is enabled. Enable only when ready for production. Cannot be disabled without resetting the browsers."
+                type="bool" default="false">false</enabled>
+            <max_age
+                desc="Strict-Transport-Security max-age directive, in seconds. 0 is allowed; please see rfc6797 for details. Defaults to 1 year."
+                type="int" default="31536000">31536000</max_age>
+        </sts>
+    </ssl>
+
+    <security desc="Altering these defaults potentially opens you to significant risk">
+        <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">
+            true</seccomp>
+        <capabilities desc="Should we require capabilities to isolate processes into chroot jails"
+            type="bool" default="true">true</capabilities>
+        <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires"
+            type="int" default="1800">1800</jwt_expiry_secs>
+        <enable_macros_execution
+            desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security."
+            type="bool" default="false">false</enable_macros_execution>
+        <macro_security_level
+            desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation."
+            type="int" default="1">1</macro_security_level>
+        <enable_metrics_unauthenticated
+            desc="When enabled, the /cool/getMetrics endpoint will not require authentication."
+            type="bool" default="false">false</enable_metrics_unauthenticated>
+    </security>
+
+    <certificates>
+        <database_path type="string"
+            desc="Path to the NSS certificates that are used for signing documents" default=""></database_path>
+    </certificates>
+
+    <watermark>
+        <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity>
+        <text desc="Watermark text to be displayed on the document if entered" type="string"></text>
+    </watermark>
+
+
+    <user_interface>
+        <mode type="string"
+            desc="Controls the user interface style. The 'default' means: Take the value from ui_defaults, or decide for one of compact or tabbed (default|compact|tabbed)"
+            default="default">default</mode>
+        <use_integration_theme desc="Use theme from the integrator" type="bool" default="true">true</use_integration_theme>
+    </user_interface>
+
+    <storage desc="Backend storage">
+        <filesystem allow="false" />
+        <wopi desc="Allow/deny wopi storage." allow="true">
+            <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited."
+                type="uint">0</max_file_size>
+            <locking desc="Locking settings">
+                <refresh
+                    desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh"
+                    type="int" default="900">900</refresh>
+            </locking>
+
+            <alias_groups
+                desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases"
+                mode="groups">
+                <group>
+                    <host desc="hostname to allow or deny." allow="true">https://cloud.alexpires.me</host>
+                </group>
+            </alias_groups>
+
+        </wopi>
+        <ssl desc="SSL settings">
+            <as_scheme type="bool" default="true"
+                desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">
+                true</as_scheme>
+            <enable type="bool"
+                desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and coolwsd. When empty this defaults to following the ssl.enable setting"></enable>
+            <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path>
+            <key_file_path desc="Path to the key file" relative="false"></key_file_path>
+            <ca_file_path
+                desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified."
+                relative="false"></ca_file_path>
+            <cipher_list
+                desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overridden only if absolutely needed."></cipher_list>
+        </ssl>
+    </storage>
+
+    <tile_cache_persistent
+        desc="Should the tiles persist between two editing sessions of the given document?"
+        type="bool" default="true">true</tile_cache_persistent>
+
+    <admin_console desc="Web admin console settings.">
+        <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable>
+        <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">
+            false</enable_pam>
+        <username desc="The username of the admin console. Ignored if PAM is enabled.">admin</username>
+        <password
+            desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">
+            M*7#VayBh7</password>
+    </admin_console>
+
+    <monitors desc="Addresses of servers we connect to on start for monitoring">
+    </monitors>
+
+    <quarantine_files
+        desc="Files are stored here to be examined later in cases of crashes or similar situation."
+        default="false" enable="false">
+        <limit_dir_size_mb
+            desc="Maximum directory size. On exceeding the specified limit, older files will be deleted."
+            default="250" type="uint"></limit_dir_size_mb>
+        <max_versions_to_maintain desc="How many versions of the same file to keep." default="2"
+            type="uint"></max_versions_to_maintain>
+        <path desc="Path to directory under which quarantined files will be stored" type="path"
+            relative="true" default="quarantine"></path>
+        <expiry_min desc="Time in mins after quarantined files will be deleted." type="int"
+            default="30"></expiry_min>
+    </quarantine_files>
+
+    <remote_config>
+        <remote_url
+            desc="remote server to which you will send resquest to get remote config in response"
+            type="string" default=""></remote_url>
+    </remote_config>
+
+    <remote_font_config>
+        <url desc="URL of optional JSON file that lists fonts to be included in Online"
+            type="string" default=""></url>
+    </remote_font_config>
+
+    <home_mode>
+        <enable desc="Enable more configuration options for home users" type="bool" default="false">
+            false</enable>
+    </home_mode>
+
+    <fonts_missing>
+        <handling
+            desc="How to handle fonts mising in a document: 'report', 'log', 'both', or 'ignore'"
+            type="string" default="log">log</handling>
+    </fonts_missing>
+
+    <indirection_endpoint>
+        <url desc="URL endpoint to server which servers routeToken in json format" default=""></url>
+    </indirection_endpoint>
+
+
+    <zotero
+        dec="Zotero plugin configuration. For more details about Zotero visit https://www.zotero.org/">
+        <enable dec="Enable Zotero plugin." type="bool" default="true">true</enable>
+    </zotero>
+
+</config>
\ No newline at end of file
diff --git a/terraform/k8apps/resources/m3uproxy/m3uproxy.json b/terraform/k8apps/resources/m3uproxy/m3uproxy.json
new file mode 100644
index 0000000..703b2ef
--- /dev/null
+++ b/terraform/k8apps/resources/m3uproxy/m3uproxy.json
@@ -0,0 +1,30 @@
+{
+    "port": 8080,
+    "playlist": "conf/playlist.json",
+    "epg": "https://m3upt.com/epg",
+    "no_service_image": "assets/no_service_pt.jpg",
+    "default_timeout": 3,
+    "num_workers": 10,
+    "scan_time": 3600,
+    "security": {
+        "geoip": {
+            "database": "GeoIP/GeoLite2-Country.mmdb",
+            "whitelist": [
+                "PT",
+                "ST",
+                "BE"
+            ],
+            "internal_networks": [
+                "10.1.0.0/16",
+                "10.152.183.0/24"
+            ]
+        }
+    },
+    "auth": {
+        "provider": "file",
+        "secret_key": "${m3uproxy_secret}",
+        "settings": {
+            "file_path": "cache/auth.json"
+        }
+    }
+}
\ No newline at end of file
diff --git a/terraform/k8apps/resources/m3uproxy/playlist.json b/terraform/k8apps/resources/m3uproxy/playlist.json
new file mode 100644
index 0000000..eaefe26
--- /dev/null
+++ b/terraform/k8apps/resources/m3uproxy/playlist.json
@@ -0,0 +1,124 @@
+{
+    "providers": {
+        "m3upt": {
+            "provider": "file",
+            "config": {
+                "source": "https://m3upt.com/iptv"
+            }
+        },
+        "iptv_be": {
+            "provider": "file",
+            "config": {
+                "source": "https://raw.githubusercontent.com/iptv-org/iptv/master/streams/be.m3u"
+            }
+        },
+        "iptv_st": {
+            "provider": "file",
+            "config": {
+                "source": "https://raw.githubusercontent.com/iptv-org/iptv/master/streams/st.m3u"
+            }
+        },
+        "iptv_pt_samsung": {
+            "provider": "file",
+            "config": {
+                "source": "https://raw.githubusercontent.com/iptv-org/iptv/master/streams/pt_samsung.m3u"
+            }
+        },
+        "iptv_uk_rakuten": {
+            "provider": "file",
+            "config": {
+                "source": "https://raw.githubusercontent.com/iptv-org/iptv/master/streams/uk_rakuten.m3u"
+            }
+        },
+        "iptv_uk_samsung": {
+            "provider": "file",
+            "config": {
+                "source": "https://raw.githubusercontent.com/iptv-org/iptv/master/streams/uk_samsung.m3u"
+            }
+        }
+    },
+    "providers_priority": [
+        "m3upt",
+        "iptv_be",
+        "iptv_st",
+        "iptv_pt_samsung",
+        "iptv_uk_rakuten",
+        "iptv_uk_samsung"
+    ],
+    "overrides": {
+        "RTP1.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTP2.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "SIC.pt": {
+            "kodi": true,
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "TVI.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTP3.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "SICNoticias.pt": {
+            "headers": {
+                "Origin": "https://sicnoticias.pt",
+                "DNT": "1",
+                "Connection": "keep-alive"
+            },
+            "kodi": true,
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "CNNPortugal.pt": {
+            "kodi": true,
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTPMemoria.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTPAcores.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTPMadeira.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "RTPAfrica.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "SICNovelas.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "SICReplay.pt": {
+            "http_proxy": "http://proxy-pt.m3uproxy.svc.cluster.local:3128"
+        },
+        "Rádio Comercial": {
+            "disable_remap": true
+        },
+        "Rádio Comercial Dance": {
+            "disable_remap": true
+        },
+        "Rádio Comercial By Night": {
+            "disable_remap": true
+        },
+        "Rádio Comercial One Hit Wonders": {
+            "disable_remap": true
+        },
+        "Rádio Comercial Kids": {
+            "disable_remap": true
+        },
+        "Rádio Comercial Portugal": {
+            "disable_remap": true
+        },
+        "Rádio Comercial Brasil": {
+            "disable_remap": true
+        },
+        "Rádio Comercial 90s": {
+            "disable_remap": true
+        },
+        "Rádio Comercial 2000s": {
+            "disable_remap": true
+        }
+    }
+}
\ No newline at end of file
diff --git a/terraform/k8apps/resources/nextcloud-server-snippet.conf b/terraform/k8apps/resources/nextcloud-server-snippet.conf
new file mode 100644
index 0000000..a58c840
--- /dev/null
+++ b/terraform/k8apps/resources/nextcloud-server-snippet.conf
@@ -0,0 +1,27 @@
+server_tokens off;
+proxy_hide_header X-Powered-By;
+
+rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
+rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
+
+location = /.well-known/carddav {
+  return 301 $scheme://$host/remote.php/dav;
+}
+
+location = /.well-known/caldav {
+  return 301 $scheme://$host/remote.php/dav;
+}
+
+location = /robots.txt {
+  allow all;
+  log_not_found off;
+  access_log off;
+}
+
+location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+  deny all;
+}
+
+location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+  deny all;
+}
\ No newline at end of file
diff --git a/terraform/k8apps/resources/squid/squid.conf b/terraform/k8apps/resources/squid/squid.conf
new file mode 100644
index 0000000..2dd6b07
--- /dev/null
+++ b/terraform/k8apps/resources/squid/squid.conf
@@ -0,0 +1,45 @@
+acl localnet src 0.0.0.1-0.255.255.255	# RFC 1122 "this" network (LAN)
+acl localnet src 10.0.0.0/8		# RFC 1918 local private network (LAN)
+acl localnet src 100.64.0.0/10		# RFC 6598 shared address space (CGN)
+acl localnet src 169.254.0.0/16 	# RFC 3927 link-local (directly plugged) machines
+acl localnet src 172.16.0.0/12		# RFC 1918 local private network (LAN)
+acl localnet src 192.168.0.0/16		# RFC 1918 local private network (LAN)
+acl localnet src fc00::/7       	# RFC 4193 local private network range
+acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
+acl SSL_ports port 443
+acl Safe_ports port 80		# http
+acl Safe_ports port 21		# ftp
+acl Safe_ports port 443		# https
+acl Safe_ports port 70		# gopher
+acl Safe_ports port 210		# wais
+acl Safe_ports port 1025-65535	# unregistered ports
+acl Safe_ports port 280		# http-mgmt
+acl Safe_ports port 488		# gss-http
+acl Safe_ports port 591		# filemaker
+acl Safe_ports port 777		# multiling http
+acl CONNECT method CONNECT
+http_access deny !Safe_ports
+http_access deny CONNECT !SSL_ports
+http_access allow localhost manager
+http_access deny manager
+http_access allow localhost
+http_access allow localnet
+http_access deny all
+http_port 3128
+dns_v4_first on
+coredump_dir /var/spool/squid
+refresh_pattern ^ftp:		1440	20%	10080
+refresh_pattern ^gopher:	1440	0%	1440
+refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
+refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
+refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
+refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
+refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
+refresh_pattern .		0	20%	4320
+logfile_rotate 0
+via off
+forwarded_for delete
+follow_x_forwarded_for deny all
+pipeline_prefetch on
+request_header_access From deny all
+request_header_access Server deny all
\ No newline at end of file
diff --git a/terraform/k8apps/resources/wireguard/wireguard.conf.tpl b/terraform/k8apps/resources/wireguard/wireguard.conf.tpl
new file mode 100644
index 0000000..5f5d5a1
--- /dev/null
+++ b/terraform/k8apps/resources/wireguard/wireguard.conf.tpl
@@ -0,0 +1,9 @@
+[Interface]
+PrivateKey = ${wireguard_private_key}
+Address = ${wireguard_address}
+DNS = ${wireguard_dns}
+
+[Peer]
+PublicKey = ${wireguard_public_key}
+AllowedIPs = ${wireguard_allowed_ips}
+Endpoint = ${wireguard_endpoint}
diff --git a/terraform/k8apps/sectool.env b/terraform/k8apps/sectool.env
new file mode 100644
index 0000000..b74df49
--- /dev/null
+++ b/terraform/k8apps/sectool.env
@@ -0,0 +1,16 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY
+TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY
+TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
+TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
+TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
+TF_VAR_mysql_root_password=$MYSQL_ROOT_PASSWORD
+TF_VAR_wordpress_mysql_password=$MYSQL_WORDPRESS_PASSWORD
+TF_VAR_gitea_mysql_password=$MYSQL_GITEA_PASSWORD
+TF_VAR_nextcloud_mysql_password=$MYSQL_NEXTCLOUD_PASSWORD
+TF_VAR_nextcloud_admin_password=$NEXTCLOUD_ADMIN_PASSWORD
+TF_VAR_collabora_admin_password=$NEXTCLOUD_ADMIN_PASSWORD
+TF_VAR_wireguard_private_key=$WIREGUARD_PRIVATE_KEY
+TF_VAR_wireguard_public_key=$WIREGUARD_PUBLIC_KEY
+TF_VAR_m3uproxy_admin_password=$M3UPROXY_ADMIN_PASSWORD
+TF_VAR_m3uproxy_secret=$M3UPROXY_SECRET
\ No newline at end of file
diff --git a/terraform/k8apps/variables.tf b/terraform/k8apps/variables.tf
new file mode 100644
index 0000000..427bd16
--- /dev/null
+++ b/terraform/k8apps/variables.tf
@@ -0,0 +1,89 @@
+variable "wordpress_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+}
+
+variable "mysql_root_password" {
+  description = "MySQL root password"
+  type        = string
+}
+
+variable "gitea_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+}
+
+variable "scaleway_access_key" {
+  description = "Scaleway Access key"
+  type        = string
+}
+
+variable "scaleway_secret_key" {
+  description = "Scaleway Secret key"
+  type        = string
+}
+
+variable "scaleway_project_id" {
+  description = "Scaleway Project Id"
+  type        = string
+}
+
+variable "scaleway_organization_id" {
+  description = "Scaleway Organization Id"
+  type        = string
+}
+
+variable "nextcloud_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+}
+
+variable "nextcloud_admin_password" {
+  description = "Nextcloud access password"
+  type        = string
+}
+
+variable "collabora_admin_password" {
+  description = "Collabora access password"
+  type        = string
+}
+
+variable "wireguard_private_key" {
+  description = "Wireguard public key"
+  type        = string
+}
+
+variable "wireguard_public_key" {
+  description = "Wireguard public key"
+  type        = string
+}
+
+variable "m3uproxy_admin_password" {
+  description = "M3UProxy access password"
+  type        = string
+}
+
+variable "m3uproxy_secret" {
+  description = "M3UProxy HMAC secret"
+  type        = string
+}
+
+variable "k8s_host" {
+  description = "K8S host"
+  type        = string
+}
+
+variable "k8s_client_certificate" {
+  description = "K8S client certificate"
+  type        = string
+}
+
+variable "k8s_client_key" {
+  description = "K8S client key"
+  type        = string
+}
+
+variable "k8s_cluster_ca_certificate" {
+  description = "K8S cluster CA certificate"
+  type        = string
+}
diff --git a/terraform/k8apps/wordpress.tf b/terraform/k8apps/wordpress.tf
new file mode 100644
index 0000000..27b47ed
--- /dev/null
+++ b/terraform/k8apps/wordpress.tf
@@ -0,0 +1,230 @@
+locals {
+  wordpress_path       = "/var/lib/wordpress"
+  wordpress_mysql_path = "/var/lib/mysql.wordpress"
+}
+
+resource "kubernetes_namespace" "wordpress" {
+  metadata {
+    annotations = {
+      name = "wordpress"
+    }
+
+    labels = {
+      name = "wordpress"
+    }
+
+    name = "wordpress"
+  }
+}
+
+
+#
+# Setup MariaDB database
+#
+module "wordpress_database" {
+  source = "./modules/k8s_mariadb"
+
+  namespace         = kubernetes_namespace.wordpress.metadata[0].name
+  app_name          = "wordpress"
+  app_backup_folder = "wordpress.backups"
+
+  app_password  = var.wordpress_mysql_password
+  root_password = var.mysql_root_password
+
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.wordpress_sql_backup_cron_schedule
+  host_storage_path = local.wordpress_mysql_path
+}
+
+
+#
+# Setup rsync backup job to scaleway bucket
+#
+module "wordpress_backup" {
+  source = "./modules/scw_backup_job"
+
+  namespace         = kubernetes_namespace.wordpress.metadata[0].name
+  app_name          = "wordpress"
+  app_files_folder  = "wordpress"
+  app_backup_folder = "mysql.wordpress/wordpress.backups"
+
+  scaleway_organization_id = var.scaleway_organization_id
+  scaleway_project_id      = var.scaleway_organization_id
+  access_key               = scaleway_iam_api_key.backup_app_api.access_key
+  secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
+  bucket_name              = scaleway_object_bucket.backup.name
+
+  retention_days = local.local_backup_retention_days
+  cron_schedule  = local.wordpress_files_backup_cron_schedule
+}
+
+# 
+# Gitea service, ingress, deployment and file backup job
+#
+resource "kubernetes_service_account" "wordpress_service_account" {
+
+  metadata {
+    name      = "wordpress-app-sa"
+    namespace = kubernetes_namespace.wordpress.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+
+resource "kubernetes_service" "wordpress" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.wordpress.metadata[0].name
+  }
+  spec {
+    port {
+      port        = 80
+      target_port = "http"
+    }
+    selector = {
+      app = "wordpress"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_ingress_v1" "wordpress_ingress" {
+  metadata {
+    name      = "wordpress-ingress"
+    namespace = kubernetes_namespace.wordpress.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"    = "public"
+      "cert-manager.io/cluster-issuer" = "letsencrypt-prod"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.wordpress_fqdn]
+      secret_name = "wordpress-le-tls"
+    }
+    rule {
+      host = local.wordpress_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_deployment" "wordpress" {
+
+  depends_on = [module.wordpress_database]
+
+  metadata {
+    name      = "wordpress-app"
+    namespace = kubernetes_namespace.wordpress.metadata[0].name
+  }
+  spec {
+    selector {
+      match_labels = {
+        app = "wordpress"
+      }
+    }
+    strategy {
+      type = "RollingUpdate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "wordpress"
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.wordpress_service_account.metadata[0].name
+
+        container {
+          name              = "wordpress"
+          image             = "wordpress:${local.wordpress_version}"
+          image_pull_policy = "IfNotPresent"
+
+          resources {
+            requests = {
+              memory = "100Mi"
+            }
+            limits = {
+              memory = "500Mi"
+            }
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/?nocache"
+              port = "http"
+            }
+            initial_delay_seconds = 20
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 5
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = "http"
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            success_threshold     = 1
+            failure_threshold     = 3
+          }
+
+          env {
+            name  = "WORDPRESS_DB_NAME"
+            value = "wordpress"
+          }
+          env {
+            name  = "WORDPRESS_DB_HOST"
+            value = "${module.wordpress_database.host}:${module.wordpress_database.port}"
+          }
+          env {
+            name = "WORDPRESS_DB_USER"
+            value_from {
+              secret_key_ref {
+                key  = "username"
+                name = module.wordpress_database.app_crendentials_name
+              }
+            }
+          }
+          env {
+            name = "WORDPRESS_DB_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = module.wordpress_database.app_crendentials_name
+              }
+            }
+          }
+          port {
+            container_port = 80
+            name           = "http"
+          }
+          volume_mount {
+            mount_path = "/var/www/html"
+            name       = "persistent-storage"
+          }
+        }
+        volume {
+          name = "persistent-storage"
+          host_path {
+            path = local.wordpress_path
+          }
+        }
+      }
+    }
+  }
+}