diff --git a/apply.sh b/apply.sh
index 4f0daa6..c91c3c5 100755
--- a/apply.sh
+++ b/apply.sh
@@ -92,3 +92,9 @@ k apply -f lets.yaml
 ###  badges
 
 kubectl -n apps create secret generic sentry-credentials --from-literal=dsn=xxx
+
+### Nextcloud
+
+# kubectl -n apps create secret generic postgresql-credentials --from-literal=username=postgres --from-literal=password=xxx
+
+k apply -f nextcloud-pv.yaml -n media
diff --git a/media.yaml b/media.yaml
index a915a73..85087a8 100644
--- a/media.yaml
+++ b/media.yaml
@@ -404,99 +404,150 @@ spec:
 
 ---
 
-# apiVersion: apps/v1
-# kind: Deployment
-# metadata:
-#   name: jackett
-# spec:
-#   selector:
-#     matchLabels:
-#       app: jackett
-#   replicas: 1
-#   template:
-#     metadata:
-#       labels:
-#         app: jackett
-#     spec:
-#       volumes:
-#         - name: jackett-config
-#           hostPath:
-#             path: /mnt/configs/jackett
-#             type: Directory
-#         - name: jackett-downloads
-#           hostPath:
-#             path: /mnt/jackett_downloads
-#             type: Directory
-#       containers:
-#         - name: jackett
-#           image: linuxserver/jackett
-#           securityContext:
-#             runAsUser: 0
-#           imagePullPolicy: Always
-#           ports:
-#             - containerPort: 9117
-#               name: jackett-port
-#               protocol: TCP
-#           env:
-#             - name: TZ
-#               value: Australia/Melbourne
-#             - name: PUID
-#               value: "1000"
-#             - name: PGID
-#               value: "1000"
-#           volumeMounts:
-#             - name: jackett-config
-#               mountPath: /config
-#             - name: jackett-downloads
-#               mountPath: /downloads
-#           resources:
-#             requests:
-#               cpu: 50m
-#               memory: 128Mi
-#             limits:
-#               cpu: 100m
-#               memory: 128Mi
-# ---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+spec:
+  selector:
+    matchLabels:
+      app: nextcloud
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+    spec:
+      volumes:
+        - name: nextcloud-config
+          hostPath:
+            path: /mnt/configs/nextcloud/config
+            type: Directory
+        - name: nextcloud-apps
+          hostPath:
+            path: /mnt/configs/nextcloud/apps
+            type: Directory
+        - name: data
+          persistentVolumeClaim:
+            claimName: nextcloud-nfs
+      initContainers:
+        - name: take-data-dir-ownership
+          image: alpine:3
+          securityContext:
+            runAsUser: 0
+          command:
+            - chown
+            - -R
+            - 1000:1000
+            - /data
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: nextcloud
+          image: wonderfall/nextcloud:20
+          securityContext:
+            # nextcloud uses www-data which id is 33
+            runAsUser: 0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8888
+              name: web-port
+              protocol: TCP
+          env:
+            - name: UID
+              value: "1000"
+            - name: GID
+              value: "1000"
+            - name: NEXTCLOUD_UPDATE
+              value: "1"
+            - name: ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-credentials
+                  key: username
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-credentials
+                  key: password
+            - name: DB_TYPE
+              value: pgsql
+            - name: DB_NAME
+              value: nextcloud
+            - name: DB_HOST
+              value: postgres-postgresql.db.svc.cluster.local
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgresql-credentials
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgresql-credentials
+                  key: password
+            - name: TZ
+              value: Australia/Melbourne
+          volumeMounts:
+            - name: nextcloud-config
+              mountPath: /config
+            - name: nextcloud-apps
+              mountPath: /apps2
+            - name: nextcloud-apps
+              mountPath: /var/www/html/apps
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 500m
+              memory: 1Gi
+---
 
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: jackett
-#   labels:
-#     app: jackett
-# spec:
-#   type: ClusterIP
-#   ports:
-#     - port: 80
-#       targetPort: jackett-port
-#       protocol: TCP
-#       name: web
-#   selector:
-#     app: jackett
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  labels:
+    app: nextcloud
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: web-port
+      protocol: TCP
+      name: web
+  selector:
+    app: nextcloud
 
-# ---
+---
 
-# apiVersion: networking.k8s.io/v1beta1
-# kind: Ingress
-# metadata:
-#   name: jackett-ingress
-#   annotations:
-#     kubernetes.io/ingress.class: "nginx"
-#     kubernetes.io/tls-acme: "true"
-#     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-# spec:
-#   tls:
-#   - hosts:
-#     - jackett.home.toozhao.com
-#     secretName: jackett-tls
-#   rules:
-#   - host: jackett.home.toozhao.com
-#     http:
-#       paths:
-#       - backend:
-#           serviceName: jackett
-#           servicePort: 80
-# ---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: nextcloud-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acxme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: 10240m
+spec:
+  tls:
+  - hosts:
+    - cloud.home.toozhao.com
+    secretName: nextcloud-tls
+  rules:
+  - host: cloud.home.toozhao.com
+    http:
+      paths:
+      - backend:
+          serviceName: nextcloud
+          servicePort: 80
+
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/nextcloud-pv.yaml b/nextcloud-pv.yaml
new file mode 100644
index 0000000..401673c
--- /dev/null
+++ b/nextcloud-pv.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nextcloud-nfs
+spec:
+  capacity:
+    storage: 800Gi
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    server: 192.168.1.4
+    path: "/nextcloud-data"
+---
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: "media"
+  name: "nextcloud-nfs"
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 800Gi