diff --git a/apps/redoost/kustomization.yaml b/apps/redoost/kustomization.yaml
new file mode 100644
index 0000000..f0dcaa2
--- /dev/null
+++ b/apps/redoost/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
diff --git a/apps/redoost/sealed-secret.yaml b/apps/redoost/sealed-secret.yaml
new file mode 100644
index 0000000..cdf43f5
--- /dev/null
+++ b/apps/redoost/sealed-secret.yaml
@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-s3
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
+    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
+  template:
+    metadata:
+      name: redoost-s3
+      namespace: redoost
+    type: Opaque
diff --git a/argocd-apps/services/kustomization.yaml b/argocd-apps/services/kustomization.yaml
index 7ad6f7d..6991d05 100644
--- a/argocd-apps/services/kustomization.yaml
+++ b/argocd-apps/services/kustomization.yaml
@@ -9,5 +9,6 @@ resources:
   - jellyfin.yaml
   - legislative-summarization.yaml
   - qbit.yaml
+  - redoost.yaml
   - rustbin.yaml
   - scriptscribe.yaml
diff --git a/argocd-apps/services/redoost.yaml b/argocd-apps/services/redoost.yaml
new file mode 100644
index 0000000..cb3010a
--- /dev/null
+++ b/argocd-apps/services/redoost.yaml
@@ -0,0 +1,56 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: redoost
+  namespace: argocd
+spec:
+  destination:
+    namespace: redoost
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - repoURL: https://github.com/whyredfire/redoost.git
+      targetRevision: main
+      path: chart
+      helm:
+        values: |
+          appOrigin: https://redoost.whyredfire.dev
+          sitesOrigin: https://whyredfire.dpdns.org
+          httpRoute:
+            annotations:
+              argocd.argoproj.io/sync-wave: "2"
+            app:
+              parentRefs:
+                - kind: Gateway
+                  name: traefik-gateway
+                  namespace: traefik
+                  sectionName: websecure
+            sites:
+              parentRefs:
+                - kind: Gateway
+                  name: traefik-gateway
+                  namespace: traefik
+                  sectionName: websecure-dpdns
+          s3:
+            endpoint: http://garage.garage.svc.cluster.local:3900
+            publicEndpoint: https://s3.whyredfire.dev
+            websiteUpstream: garage.garage.svc.cluster.local:3902
+            bucket: redoost-sites
+            existingSecret: redoost-s3
+          api:
+            image:
+              tag: sha-0e2e897
+          frontend:
+            image:
+              tag: sha-0e2e897
+    - path: apps/redoost
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true