diff --git a/app/toot/prod.jsonnet b/app/toot/prod.jsonnet
new file mode 100644
index 0000000..e30247b
--- /dev/null
+++ b/app/toot/prod.jsonnet
@@ -0,0 +1,35 @@
+# toot.hackerspace.pl, a Mastodon instance.
+# This needs a secret provisioned, create with:
+#    kubectl -n toot create secret generic mastodon --from-literal=postgres_password=$(pwgen 24 1)
+
+local kube = import "../../kube/kube.libsonnet";
+local postgres = import "../../kube/postgres.libsonnet";
+
+{
+    local app = self,
+    local cfg = app.cfg,
+    cfg:: {
+        namespace: "toot",
+    },
+
+    metadata(component):: {
+        namespace: app.cfg.namespace,
+        labels: {
+            "app.kubernetes.io/name": "toot",
+            "app.kubernetes.io/managed-by": "kubecfg",
+            "app.kubernetes.io/component": component,
+        },
+    },
+
+    namespace: kube.Namespace(app.cfg.namespace),
+
+    postgres: postgres {
+        cfg+: {
+            namespace: cfg.namespace,
+            appName: "toot",
+            database: "mastodon",
+            username: "mastodon",
+            password: { secretKeyRef: { name: "mastodon", key: "postgres_password" } },
+        },
+    },
+}