diff --git a/app/matrix/lib/matrix.libsonnet b/app/matrix/lib/matrix.libsonnet
index fef0bd8..c17a934 100644
--- a/app/matrix/lib/matrix.libsonnet
+++ b/app/matrix/lib/matrix.libsonnet
@@ -32,8 +32,8 @@
 local postgres = import "../../../kube/postgres.libsonnet";
 
 {
-    local app = self,
-    local cfg = app.cfg,
+    local top = self,
+    local cfg = top.cfg,
     cfg:: {
         namespace: error "cfg.namespace must be set",
         # webDomain is the domain name at which element will run
@@ -96,7 +96,7 @@
     },
 
     dataVolume: kube.PersistentVolumeClaim("synapse-data-waw3") {
-        metadata+: app.metadata("synapse-data"),
+        metadata+: top.metadata("synapse-data"),
         storage:: "50Gi",
         storageClass:: cfg.storageClassName,
     },
@@ -112,7 +112,7 @@
         signing_key_path: "/data/%s.signing.key" % [cfg.serverName],
         app_service_config_files: [
             "/appservices/%s/registration.yaml" % [k]
-            for k in std.objectFields(app.appservices)
+            for k in std.objectFields(top.appservices)
         ],
     } + (if cfg.cas.enable then {
         cas_config: {
@@ -123,15 +123,15 @@
     } else {}),
 
     synapseConfigMap: kube.ConfigMap("synapse") {
-        metadata+: app.metadata("synapse"),
+        metadata+: top.metadata("synapse"),
         data: {
-            "homeserver.yaml": std.manifestYamlDoc(app.synapseConfig),
+            "homeserver.yaml": std.manifestYamlDoc(top.synapseConfig),
             "log.config": importstr "synapse/log.config",
         },
     },
 
     casDeployment: if cfg.cas.enable then kube.Deployment("oauth2-cas-proxy") {
-        metadata+: app.metadata("oauth2-cas-proxy"),
+        metadata+: top.metadata("oauth2-cas-proxy"),
         spec+: {
             replicas: 1,
             template+: {
@@ -160,22 +160,22 @@
     },
 
     casSvc: if cfg.cas.enable then kube.Service("oauth2-cas-proxy") {
-        metadata+: app.metadata("oauth2-cas-proxy"),
-        target:: app.casDeployment,
+        metadata+: top.metadata("oauth2-cas-proxy"),
+        target:: top.casDeployment,
     },
 
     synapseDeployment: kube.Deployment("synapse") {
-        metadata+: app.metadata("synapse"),
+        metadata+: top.metadata("synapse"),
         spec+: {
             replicas: 1,
             template+: {
                 spec+: {
                     volumes_: {
-                        data: kube.PersistentVolumeClaimVolume(app.dataVolume),
-                        config: kube.ConfigMapVolume(app.synapseConfigMap),
+                        data: kube.PersistentVolumeClaimVolume(top.dataVolume),
+                        config: kube.ConfigMapVolume(top.synapseConfigMap),
                     } + {
                         [k]: { secret: { secretName: "appservice-%s-registration" % [k] } }
-                        for k in std.objectFields(app.appservices)
+                        for k in std.objectFields(top.appservices)
                     },
                     containers_: {
                         web: kube.Container("synapse") {
@@ -203,7 +203,7 @@
                                 config: { mountPath: "/conf", },
                             } + {
                                 [k]: { mountPath: "/appservices/%s" % [k] }
-                                for k in std.objectFields(app.appservices)
+                                for k in std.objectFields(top.appservices)
                             },
                         },
                     },
@@ -218,8 +218,8 @@
     },
 
     synapseSvc: kube.Service("synapse") {
-        metadata+: app.metadata("synapse"),
-        target:: app.synapseDeployment,
+        metadata+: top.metadata("synapse"),
+        target:: top.synapseDeployment,
     },
 
     riotConfig:: {
@@ -253,9 +253,9 @@
     },
 
     riotConfigMap: kube.ConfigMap("riot-web-config") {
-        metadata+: app.metadata("riot-web-config"),
+        metadata+: top.metadata("riot-web-config"),
         data: {
-            "config.json": std.manifestJsonEx(app.riotConfig, ""),
+            "config.json": std.manifestJsonEx(top.riotConfig, ""),
             // Standard nginx.conf, made to work when running as unprivileged user.
             "nginx.conf": |||
                 worker_processes  auto;
@@ -304,13 +304,13 @@
     },
 
     riotDeployment: kube.Deployment("riot-web") {
-        metadata+: app.metadata("riot-web"),
+        metadata+: top.metadata("riot-web"),
         spec+: {
             replicas: 1,
             template+: {
                 spec+: {
                     volumes_: {
-                        config: kube.ConfigMapVolume(app.riotConfigMap),
+                        config: kube.ConfigMapVolume(top.riotConfigMap),
                     },
                     containers_: {
                         web: kube.Container("riot-web") {
@@ -343,13 +343,13 @@
     },
 
     riotSvc: kube.Service("riot-web") {
-        metadata+: app.metadata("riot-web"),
-        target:: app.riotDeployment,
+        metadata+: top.metadata("riot-web"),
+        target:: top.riotDeployment,
     },
 
     wellKnown: if cfg.wellKnown then {
         deployment: kube.Deployment("wellknown") {
-            metadata+: app.metadata("wellknown"),
+            metadata+: top.metadata("wellknown"),
             spec+: {
                 replicas: 1,
                 template+: {
@@ -373,8 +373,8 @@
             },
         },
         svc: kube.Service("wellknown") {
-            metadata+: app.metadata("wellknown"),
-            target:: app.wellKnown.deployment,
+            metadata+: top.metadata("wellknown"),
+            target:: top.wellKnown.deployment,
         },
     } else {},
 
@@ -388,14 +388,14 @@
 
     ingress: kube.SimpleIngress("matrix") {
         hosts:: [cfg.webDomain],
-        target_service:: app.riotSvc,
-        metadata+: app.metadata("matrix"),
+        target_service:: top.riotSvc,
+        metadata+: top.metadata("matrix"),
         extra_paths:: [
-            { path: "/_matrix", backend: app.synapseSvc.name_port },
+            { path: "/_matrix", backend: top.synapseSvc.name_port },
         ] + (if cfg.cas.enable then [
-            { path: "/_cas", backend: app.casSvc.name_port },
+            { path: "/_cas", backend: top.casSvc.name_port },
         ] else []) + (if cfg.wellKnown then [
-            { path: "/.well-known/matrix", backend: app.wellKnown.svc.name_port },
+            { path: "/.well-known/matrix", backend: top.wellKnown.svc.name_port },
         ] else [])
     },
 }