{
  kubernetes.resources = {
    secrets.kitchenowl.stringData.jwtSecretKey = "ref+sops://secrets/sops.yaml#/kitchenowl/jwtSecretKey";

    deployments = {

      kitchenowl = {
        metadata.labels.app = "kitchenowl";

        spec = {
          selector.matchLabels.app = "kitchenowl";

          template = {
            metadata.labels.app = "kitchenowl";

            spec = {
              volumes.data.persistentVolumeClaim.claimName = "kitchenowl";

              containers.kitchenowl = {
                image = "tombursch/kitchenowl:v0.5.1";
                ports.web.containerPort = 8080;

                env.JWT_SECRET_KEY.valueFrom.secretKeyRef = {
                  name = "kitchenowl";
                  key = "jwtSecretKey";
                };

                volumeMounts = [{
                  name = "data";
                  mountPath = "/data";
                }];
              };
            };
          };
        };
      };
    };

    services.kitchenowl.spec = {
      selector.app = "kitchenowl";

      ports.web = {
        port = 80;
        targetPort = "web";
      };
    };
  };

  lab = {
    nfsVolumes.kitchenowl.path = "kitchenowl/data";

    ingresses.kitchenowl = {
      host = "boodschappen.kun.is";

      service = {
        name = "kitchenowl";
        portName = "web";
      };
    };
  };
}