diff --git a/apps-kustomized/zigbee2mqtt/.version b/apps-kustomized/zigbee2mqtt/.version
new file mode 100644
index 0000000..80c8c0b
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/.version
@@ -0,0 +1 @@
+1.33.2
diff --git a/apps-kustomized/zigbee2mqtt/backup.sh b/apps-kustomized/zigbee2mqtt/backup.sh
new file mode 100644
index 0000000..07d081b
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/backup.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+filename=$(date '+%Y%m%d%H%M%S').tgz
+for i in $(talosctl -n 192.168.1.26 list /var/mnt/storage/zigbee2mqtt | grep 192.168 | tail -n 4 | awk '{print $2}'); do talosctl -n 192.168.1.26 read /var/mnt/storage/zigbee2mqtt/$i >$i; done
+tar czf ${filename} $(talosctl -n 192.168.1.26 list /var/mnt/storage/zigbee2mqtt | grep 192.168 | tail -n 4 | awk '{print $2}' | xargs echo)
+rm $(talosctl -n 192.168.1.26 list /var/mnt/storage/zigbee2mqtt | grep 192.168 | tail -n 4 | awk '{print $2}' | xargs echo)
+echo copy to https://minio.service.consul/browser/backups/emlnYmVlMm1xdHQv
diff --git a/apps-kustomized/zigbee2mqtt/configmap.yaml b/apps-kustomized/zigbee2mqtt/configmap.yaml
new file mode 100644
index 0000000..20f025a
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/configmap.yaml
@@ -0,0 +1,174 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/instance: zigbee2mqtt
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zigbee2mqtt
+    app.kubernetes.io/version: 1.19.1
+    helm.sh/chart: zigbee2mqtt-9.4.2
+  name: zigbee2mqtt-settings
+  namespace: zigbee2mqtt
+data:
+  configuration.yaml: |
+    advanced:
+      homeassistant_discovery_topic: homeassistant
+      homeassistant_status_topic: homeassistant/status
+      last_seen: ISO_8601
+      log_level: debug
+      log_output:
+        - console
+      network_key: '!secrets network_key'
+      channel: 25
+    experimental:
+      new_api: true
+    frontend:
+      port: 8080
+    homeassistant: true
+    serial:
+      adapter: deconz
+      port: 'tcp://ser2net.ser2net.svc.cluster.local:3001'
+    mqtt:
+      base_topic: zigbee2mqtt
+      include_device_information: true
+      server: 'mqtt://mosquitto.service.kube'
+    permit_join: false
+    devices:
+      '0x001788010694ee2d':
+        friendly_name: pantry
+      '0xb0ce1814032e8038':
+        friendly_name: kitchen_1
+      '0xb0ce1814032d2128':
+        friendly_name: kitchen_2
+      '0xb0ce1814032ea0c1':
+        friendly_name: kitchen_3
+      '0xb0ce1814032df653':
+        friendly_name: kitchen_5
+      '0xb0ce1814032f02e8':
+        friendly_name: kitchen_4
+      '0xb0ce1814032d77bd':
+        friendly_name: kitchen_sink
+      '0x001788010694ea33':
+        friendly_name: dining_5
+      '0x00178801042b6376':
+        friendly_name: dining_1
+      '0x0017880104889944':
+        friendly_name: dining_2
+      '0x00178801065ce007':
+        friendly_name: dining_3
+      '0x00178801065d8925':
+        friendly_name: dining_4
+      '0x00178801031a913d':
+        friendly_name: laundry_1
+      '0x00178801031f5205':
+        friendly_name: laundry_2
+      '0x0017880106da874e':
+        friendly_name: living_room_2
+      '0x00178801063b3145':
+        friendly_name: living_room_1
+      '0x00178801087745db':
+        friendly_name: downstairs_hall_1
+      '0x001788010877486e':
+        friendly_name: front_door_1
+      '0x0017880106c41569':
+        friendly_name: front_door_2
+      '0x00178801065f8c7c':
+        friendly_name: library_1
+      '0x00178801065d6823':
+        friendly_name: half_bath_2
+      '0x0017880106a97503':
+        friendly_name: half_bath_1
+      '0xb0ce1814032e09c8':
+        friendly_name: downstairs_hall_2
+    groups:
+      '1':
+        friendly_name: kitchen
+        devices:
+          - 0xb0ce1814032e8038/1
+          - 0xb0ce1814032d2128/1
+          - 0xb0ce1814032ea0c1/1
+          - 0xb0ce1814032df653/1
+          - 0xb0ce1814032f02e8/1
+      '2':
+        friendly_name: downstairs
+        devices:
+          - 0xb0ce1814032e8038/1
+          - 0x001788010694ee2d/11
+          - 0xb0ce1814032d2128/1
+          - 0xb0ce1814032ea0c1/1
+          - 0xb0ce1814032d77bd/1
+          - 0xb0ce1814032df653/1
+          - 0xb0ce1814032f02e8/1
+          - 0x001788010694ea33/11
+          - 0x00178801042b6376/11
+          - 0x0017880104889944/11
+          - 0x00178801065ce007/11
+          - 0x00178801065d8925/11
+          - 0x0017880106da874e/11
+          - 0x00178801063b3145/11
+          - 0x00178801087745db/11
+          - 0x001788010877486e/11
+          - 0x0017880106c41569/11
+          - 0x00178801065f8c7c/11
+          - 0x00178801065d6823/11
+          - 0x0017880106a97503/11
+          - 0x00178801031a913d/11
+          - 0x00178801031f5205/11
+          - 0xb0ce1814032e09c8/1
+      '3':
+        friendly_name: dining_room
+        devices:
+          - 0x001788010694ea33/11
+          - 0x00178801042b6376/11
+          - 0x0017880104889944/11
+          - 0x00178801065ce007/11
+          - 0x00178801065d8925/11
+      '4':
+        friendly_name: living_room
+        devices:
+          - 0x0017880106da874e/11
+          - 0x00178801063b3145/11
+      '5':
+        friendly_name: laundry_room
+        devices:
+          - 0x00178801031a913d/11
+          - 0x00178801031f5205/11
+      '6':
+        friendly_name: library
+        devices:
+          - 0x001788010877486e/11
+          - 0x0017880106c41569/11
+          - 0x00178801065f8c7c/11
+          - 0x00178801087745db/11
+      '7':
+        friendly_name: half_bath
+        devices:
+          - 0x00178801065d6823/11
+          - 0x0017880106a97503/11
+      '8':
+        friendly_name: all
+        devices:
+          - 0xb0ce1814032e8038/1
+          - 0x001788010694ee2d/11
+          - 0xb0ce1814032d2128/1
+          - 0xb0ce1814032ea0c1/1
+          - 0xb0ce1814032d77bd/1
+          - 0xb0ce1814032df653/1
+          - 0xb0ce1814032f02e8/1
+          - 0x001788010694ea33/11
+          - 0x00178801042b6376/11
+          - 0x0017880104889944/11
+          - 0x00178801065ce007/11
+          - 0x00178801065d8925/11
+          - 0x0017880106da874e/11
+          - 0x00178801063b3145/11
+          - 0x00178801087745db/11
+          - 0x001788010877486e/11
+          - 0x0017880106c41569/11
+          - 0x00178801065f8c7c/11
+          - 0x00178801065d6823/11
+          - 0x0017880106a97503/11
+          - 0x00178801031a913d/11
+          - 0x00178801031f5205/11
+          - 0xb0ce1814032e09c8/1
diff --git a/apps-kustomized/zigbee2mqtt/kustomization.yaml b/apps-kustomized/zigbee2mqtt/kustomization.yaml
new file mode 100644
index 0000000..27db126
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: zigbee2mqtt
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - vault.yaml
+  - zigbee2mqtt.yaml
+  - pv.yaml
+  - pvc.yaml
+  - traefik.yaml
diff --git a/apps-kustomized/zigbee2mqtt/namespace.yaml b/apps-kustomized/zigbee2mqtt/namespace.yaml
new file mode 100644
index 0000000..721743e
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    name: zigbee2mqtt
+  name: zigbee2mqtt
diff --git a/apps-kustomized/zigbee2mqtt/pv.yaml b/apps-kustomized/zigbee2mqtt/pv.yaml
new file mode 100644
index 0000000..0c4dfd8
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/pv.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: zigbee2mqtt
+spec:
+  accessModes:
+  - ReadWriteOnce
+  capacity:
+    storage: 128Mi
+  hostPath:
+    path: /var/mnt/storage/zigbee2mqtt
+    type: DirectoryOrCreate
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: feature.node.kubernetes.io/usb-08_0781_5597.present
+          operator: Exists
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  volumeMode: Filesystem
diff --git a/apps-kustomized/zigbee2mqtt/pvc.yaml b/apps-kustomized/zigbee2mqtt/pvc.yaml
new file mode 100644
index 0000000..f888ae3
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/pvc.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: zigbee2mqtt
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 128Mi
+  volumeMode: Filesystem
+  volumeName: zigbee2mqtt
diff --git a/apps-kustomized/zigbee2mqtt/traefik.yaml b/apps-kustomized/zigbee2mqtt/traefik.yaml
new file mode 100644
index 0000000..45732a3
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/traefik.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: zigbee2mqtt-redirect
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - kind: Rule
+      match: Host(`zig.service.kube`)
+      priority: 10
+      middlewares:
+        - name: httpredirectscheme
+          namespace: traefik
+      services:
+        - name: zigbee2mqtt
+          port: 8080
+---
+# Source: zigbee2mqtt/templates/ingress.yaml
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: zigbee2mqtt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`zig.service.kube`)
+      services:
+        - name: zigbee2mqtt
+          port: 8080
+  tls: {}
diff --git a/apps-kustomized/zigbee2mqtt/vault.yaml b/apps-kustomized/zigbee2mqtt/vault.yaml
new file mode 100644
index 0000000..2b1789b
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/vault.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultConnection
+metadata:
+  name: default
+spec:
+  address: http://192.168.3.2:8200
+  skipTLSVerify: true
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: zigbee2mqtt
+spec:
+  vaultAuthRef: zigbee2mqtt
+  mount: secret/
+  type: kv-v2
+  path: zigbee2mqtt
+  refreshAfter: 60s
+  destination:
+    create: true
+    name: zigbee2mqtt
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: zigbee2mqtt
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: zigbee2mqtt
+    serviceAccount: default
diff --git a/apps-kustomized/zigbee2mqtt/zigbee2mqtt.yaml b/apps-kustomized/zigbee2mqtt/zigbee2mqtt.yaml
new file mode 100644
index 0000000..65bfd13
--- /dev/null
+++ b/apps-kustomized/zigbee2mqtt/zigbee2mqtt.yaml
@@ -0,0 +1,131 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: zigbee2mqtt
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zigbee2mqtt
+    app.kubernetes.io/version: 1.19.1
+    helm.sh/chart: zigbee2mqtt-9.4.2
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: zigbee2mqtt
+    app.kubernetes.io/name: zigbee2mqtt
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: zigbee2mqtt
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zigbee2mqtt
+    app.kubernetes.io/version: 1.19.1
+    helm.sh/chart: zigbee2mqtt-9.4.2
+  annotations:
+    configmap.reloader.stakater.com/reload: "zigbee2mqtt-settings"
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: zigbee2mqtt
+      app.kubernetes.io/name: zigbee2mqtt
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: zigbee2mqtt
+        app.kubernetes.io/name: zigbee2mqtt
+    spec:
+      automountServiceAccountToken: true
+      initContainers:
+      - command:
+        - /bin/sh
+        - -c
+        - cp /configs/configuration.yaml /data/;echo $SECRETS_YAML | base64 -d >/data/secrets.yaml;
+        image: alpine:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: SECRETS_YAML
+          valueFrom:
+            secretKeyRef:
+              key: secrets
+              name: zigbee2mqtt
+        name: copy
+        volumeMounts:
+        - mountPath: /data
+          name: data
+        - mountPath: /configs/
+          name: zigbee2mqtt-settings
+      containers:
+      - env:
+        - name: ZIGBEE2MQTT_DATA
+          value: /data
+        image: koenkk/zigbee2mqtt:1.33.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        name: zigbee2mqtt
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - NET_RAW
+            - SYS_ADMIN
+          privileged: true
+        startupProbe:
+          failureThreshold: 30
+          initialDelaySeconds: 0
+          periodSeconds: 5
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      dnsPolicy: ClusterFirstWithHostNet
+      enableServiceLinks: true
+      hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: feature.node.kubernetes.io/usb-08_0781_5597.present
+                operator: Exists
+      serviceAccountName: default
+      volumes:
+      - configMap:
+          name: zigbee2mqtt-settings
+        name: zigbee2mqtt-settings
+      - name: data
+        persistentVolumeClaim:
+          claimName: zigbee2mqtt