diff --git a/apps-kustomized/writefreely/configmap.yaml b/apps-kustomized/writefreely/configmap.yaml
new file mode 100644
index 0000000..8cfc4f8
--- /dev/null
+++ b/apps-kustomized/writefreely/configmap.yaml
@@ -0,0 +1,43 @@
+apiVersion: v1
+data:
+  config.ini: |-
+    [server]
+    hidden_host          = 
+    port                 = 8080
+    bind                 = 0.0.0.0
+    tls_cert_path        = 
+    tls_key_path         = 
+    templates_parent_dir = 
+    static_parent_dir    = 
+    pages_parent_dir     = 
+    keys_parent_dir      = 
+    [database]
+    type     = mysql
+    filename = 
+    username = writefreely
+    password = ${MYSQL_PASSWORD}
+    database = writefreely
+    host     = mysql4blog-mariadb
+    port     = 3306
+    [app]
+    site_name         = Martyn's random blog
+    site_description  = Where I put stuff that I maybe care about
+    host              = https://musings.martyn.berlin
+    theme             = write
+    disable_js        = false
+    webfonts          = true
+    single_user       = true
+    open_registration = false
+    min_username_len  = 3
+    max_blogs         = 1
+    federation        = true
+    public_stats      = true
+    private           = false
+    local_timeline    = false
+    user_invites      = 
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: writefreely
+  name: blog-config
+
diff --git a/apps-kustomized/writefreely/deploy.yaml b/apps-kustomized/writefreely/deploy.yaml
new file mode 100644
index 0000000..d7a7bb6
--- /dev/null
+++ b/apps-kustomized/writefreely/deploy.yaml
@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: writefreely
+  name: blog-writefreely
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: writefreely
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: writefreely
+    spec:
+      containers:
+      - args:
+        - -c
+        - /conf/config.ini
+        env:
+        - name: MYSQL_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: mariadb-password
+              name: db-creds
+        image: writeas/writefreely
+        imagePullPolicy: IfNotPresent
+        name: writefreely
+        volumeMounts:
+        - mountPath: /conf
+          name: full-config
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - args:
+        - config.ini
+        env:
+        - name: MYSQL_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: mariadb-password
+              name: db-creds
+        image: dibi/envsubst
+        imagePullPolicy: Always
+        name: processconfig
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /workdir
+          name: blog-config
+        - mountPath: /processed
+          name: full-config
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: blog-config
+        name: blog-config
+      - name: full-config
+        persistentVolumeClaim:
+          claimName: writefreely-config-data
diff --git a/apps-kustomized/writefreely/ingress.yaml b/apps-kustomized/writefreely/ingress.yaml
new file mode 100644
index 0000000..3e280d6
--- /dev/null
+++ b/apps-kustomized/writefreely/ingress.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    external-dns.alpha.kubernetes.io/target: home.martyn.berlin
+    kubernetes.io/ingress.class: nginx
+  labels:
+    app.kubernetes.io/name: writefreely
+  name: blog-writefreely
+spec:
+  rules:
+  - host: musings.martyn.berlin
+    http:
+      paths:
+      - backend:
+          service:
+            name: blog-writefreely
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - musings.martyn.berlin
+    secretName: musings-tls
diff --git a/apps-kustomized/writefreely/pvc.yaml b/apps-kustomized/writefreely/pvc.yaml
new file mode 100644
index 0000000..ff5270a
--- /dev/null
+++ b/apps-kustomized/writefreely/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: writefreely-config-data
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: rook-ceph-block-ssd
diff --git a/apps-kustomized/writefreely/service.yaml b/apps-kustomized/writefreely/service.yaml
new file mode 100644
index 0000000..3e00916
--- /dev/null
+++ b/apps-kustomized/writefreely/service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: writefreely
+  name: blog-writefreely
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/name: writefreely
+  type: LoadBalancer
diff --git a/everything-app/writefreely.yaml b/everything-app/writefreely.yaml
new file mode 100644
index 0000000..1d4508c
--- /dev/null
+++ b/everything-app/writefreely.yaml
@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: writefreely
+  namespace: argocd
+spec:
+  destination:
+    namespace: writefreely
+    server: https://kubernetes.default.svc
+  project: apps
+  source:
+    path: apps-kustomized/writefreely
+    repoURL: https://git.martyn.berlin/martyn/infra4talos
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      selfHeal: true