diff --git a/personal/q3k/annoyatron/prod.jsonnet b/personal/q3k/annoyatron/prod.jsonnet
new file mode 100644
index 0000000..977b8e0
--- /dev/null
+++ b/personal/q3k/annoyatron/prod.jsonnet
@@ -0,0 +1,73 @@
+local kube = import '../../../kube/kube.libsonnet';
+{
+    local annoyatron = self,
+    local cfg = self.cfg,
+    cfg:: {
+        image: "registry.k0.hswaw.net/q3k/annoyatron:latest",
+        domain: "annoyatron-prod.q3k.org",
+    },
+
+    deploy: kube.Deployment("annoyatron") {
+        metadata+: {
+            namespace: "q3k",
+        },
+        spec+: {
+            template+: {
+                spec+: {
+                    containers_: {
+                        annoyatron: kube.Container("annoyatron") {
+                            image: cfg.image,
+                            env_: {
+                                TOKEN: {
+                                    secretKeyRef: { name: "annoyatron-token", key: "token" },
+                                },
+                            },
+                            command: [
+                                "/app/annoyatron",
+                                "-token=$(TOKEN)",
+                            ],
+                            ports_: {
+                                client: { containerPort: 8080 },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    },
+    svc: kube.Service("annoyatron") {
+        metadata+: {
+            namespace: "q3k",
+        },
+        target_pod:: annoyatron.deploy.spec.template,
+        spec+: {
+            ports: [
+                { name: "client", port: 8080, targetPort: 8080, protocol: "TCP" },
+            ],
+        },
+    },
+    ingress: kube.Ingress("annoyatron") {
+        metadata+: {
+            namespace: "q3k",
+            annotations+: {
+                "kubernetes.io/tls-acme": "true",
+                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+            },
+        },
+        spec+: {
+            tls: [
+                { hosts: [cfg.domain], secretName: "annoyatron-tls" },
+            ],
+            rules: [
+                {
+                    host: cfg.domain,
+                    http: {
+                        paths: [
+                            { path: "/", backend: annoyatron.svc.name_port },
+                        ],
+                    },
+                }
+            ],
+        },
+    },
+}