diff --git a/app/matrix/appservice-telegram.libsonnet b/app/matrix/appservice-telegram.libsonnet
new file mode 100644
index 0000000..b174225
--- /dev/null
+++ b/app/matrix/appservice-telegram.libsonnet
@@ -0,0 +1,157 @@
+local kube = import "../../kube/kube.libsonnet";
+
+{
+    AppServiceTelegram(name):: {
+        local bridge = self,
+        local cfg = bridge.cfg,
+        cfg:: {
+            metadata: {},
+            image: error "image must be set",
+            storageClassName: error "storageClassName must be set",
+
+            // Data that will be serialized into the appservice's config.yaml.
+            // This is taken straight from a YAML that was generated by
+            // dock.mau.dev/tulir/mautrix-telegram:v0.8.2. We override here
+            // fields that we know are strictly necessary to be configured when
+            // instantiating this template.
+            config: (std.native("parseYaml")(importstr "appservice-telegram.yaml")[0]) + {
+                homeserver+: {
+                    address: error "homeserver.address must be set",
+                    domain: error "homeserver.domain must be set",
+                },
+                appservice+: {
+                    address: bridge.svc.http_url,
+                    // We disable this. I have no idea what it does, but it
+                    // wants a secret. ~q3k
+                    provisioning+: {
+                        enabled: false,
+                        shared_secret: if self.enabled then error "appservice.provisioning.shared_secret must be set" else "hackme",
+                    },
+                    id: error "appservice.id must be set",
+                    as_token: "This value is generated when generating the registration",
+                    hs_token: "This value is generated when generating the registration",
+                },
+                telegram+: {
+                    api_id: error "telegram.api_id must be set",
+                    api_hash: error "telegram.api_hash must be set",
+                    bot_token: error "telegram.bot_token must be set",
+                },
+                bridge+: {
+                    permissions: {
+                        '*': "relaybot",
+                    },
+                },
+            },
+        },
+
+        config: kube.Secret("appservice-telegram-%s" % [name]) {
+            metadata+: cfg.metadata,
+            data: {
+                "config.yaml": std.base64(std.manifestYamlDoc(cfg.config)),
+            },
+        },
+
+        dataVolume: kube.PersistentVolumeClaim("appservice-telegram-%s" % [name]) {
+            metadata+: cfg.metadata,
+            spec+: {
+                storageClassName: cfg.storageClassName,
+                accessModes: [ "ReadWriteOnce" ],
+                resources: {
+                    requests: {
+                        storage: "10Gi",
+                    },
+                },
+            },
+        },
+
+        bootstrapJob: kube.Job("appservice-telegram-%s-bootstrap" % [name]) {
+            metadata+: cfg.metadata {
+                labels: {
+                    "job-name": "appservice-telegram-%s-bootstrap" % [name],
+                },
+            },
+            spec+: {
+                template+: {
+                    spec+: {
+                        volumes_: {
+                            config: kube.SecretVolume(bridge.config),
+                        },
+                        containers_: {
+                            bootstrap: kube.Container("appservice-telegram-%s-bootstrap" % [name]) {
+                                image: cfg.image,
+                                command: [
+                                    "sh", "-c",
+                                    "python3 -m mautrix_telegram -g -c /config/config.yaml -r /tmp/registration.yaml && echo SNIPSNIP && cat /tmp/registration.yaml",
+                                ],
+                                volumeMounts_: {
+                                    config: { mountPath: "/config" },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+
+        deployment: kube.Deployment("appservice-telegram-%s" % [name]) {
+            metadata+: cfg.metadata,
+            spec+: {
+                replicas: 1,
+                template+: {
+                    spec+: {
+                        volumes_: {
+                            config: kube.SecretVolume(bridge.config),
+                            data: kube.PersistentVolumeClaimVolume(bridge.dataVolume),
+                            registration: { secret: { secretName: "appservice-telegram-%s-registration" % [name] } },
+                        },
+                        initContainers: [
+                            // This container takes the stateless config from the Secret, and
+                            // updates it with the registration secrets from the registration token.
+                            kube.Container("generate-config") {
+                                volumeMounts_: {
+                                    config: { mountPath: "/config", },
+                                    registration: { mountPath: "/registration", },
+                                    data: { mountPath: "/data" },
+                                },
+                                // Ow, the edge! We need yq.
+                                // See: https://github.com/mikefarah/yq/issues/190#issuecomment-667519015
+                                image: "alpine@sha256:156f59dc1cbe233827642e09ed06e259ef6fa1ca9b2e29d52ae14d5e7b79d7f0",
+                                command: [
+                                    "sh", "-c", |||
+                                        set -e -x
+                                        apk add --no-cache yq
+                                        cp /config/config.yaml /data/config.yaml
+                                        yq w -i /data/config.yaml appservice.as_token $(yq r /registration/registration.yaml as_token)
+                                        yq w -i /data/config.yaml appservice.hs_token $(yq r /registration/registration.yaml hs_token)
+                                    |||
+                                ],
+                            },
+                        ],
+                        containers_: {
+                            appserviceIrc: kube.Container("appservice-telegram-%s" % [name]) {
+                                image: cfg.image,
+                                command: [
+                                    "sh", "-c", |||
+                                        alembic -x config=/data/config.yaml upgrade head
+                                        python3 -m mautrix_telegram -n -c /data/config.yaml
+                                    |||
+                                ],
+                                ports_: {
+                                    http: { containerPort: 29317 },
+                                },
+                                volumeMounts_: {
+                                    data: { mountPath: "/data" },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+
+        svc: kube.Service("appservice-telegram-%s" % [name]) {
+            metadata+: cfg.metadata,
+            target_pod:: bridge.deployment.spec.template,
+        },
+    },
+}
diff --git a/app/matrix/appservice-telegram.yaml b/app/matrix/appservice-telegram.yaml
new file mode 100644
index 0000000..28880af
--- /dev/null
+++ b/app/matrix/appservice-telegram.yaml
@@ -0,0 +1,443 @@
+# Homeserver details
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: https://example.com
+    # The domain of the homeserver (for MXIDs, etc).
+    domain: example.com
+    # Whether or not to verify the SSL certificate of the homeserver.
+    # Only applies if address starts with https://
+    verify_ssl: true
+
+# Application service host/registration related details
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: http://localhost:29317
+    # When using https:// the TLS certificate and key files for the address.
+    tls_cert: false
+    tls_key: false
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29317
+    # The maximum body size of appservice API requests (from the homeserver) in mebibytes
+    # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
+    max_body_size: 1
+
+    # The full URI to the database. SQLite and Postgres are fully supported.
+    # Other DBMSes supported by SQLAlchemy may or may not work.
+    # Format examples:
+    #   SQLite:   sqlite:///filename.db
+    #   Postgres: postgres://username:password@hostname/dbname
+    database: sqlite:////data/mautrix-telegram.db
+
+    # Public part of web server for out-of-Matrix interaction with the bridge.
+    # Used for things like login if the user wants to make sure the 2FA password isn't stored in
+    # the HS database.
+    public:
+        # Whether or not the public-facing endpoints should be enabled.
+        enabled: false
+        # The prefix to use in the public-facing endpoints.
+        prefix: /public
+        # The base URL where the public-facing endpoints are available. The prefix is not added
+        # implicitly.
+        external: https://example.com/public
+
+    # Provisioning API part of the web server for automated portal creation and fetching information.
+    # Used by things like Dimension (https://dimension.t2bot.io/).
+    provisioning:
+        # Whether or not the provisioning API should be enabled.
+        enabled: true
+        # The prefix to use in the provisioning API endpoints.
+        prefix: /_matrix/provision/v1
+        # The shared secret to authorize users of the API.
+        # Set to "generate" to generate and save a new token.
+        shared_secret: hackmehackmehackme
+
+    # The unique ID of this appservice.
+    id: telegram
+    # Username of the appservice bot.
+    bot_username: telegrambot
+    # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+    # to leave display name/avatar as-is.
+    bot_displayname: Telegram bridge bot
+    bot_avatar: mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX
+
+    # Community ID for bridged users (changes registration file) and rooms.
+    # Must be created manually.
+    #
+    # Example: "+telegram:example.com". Set to false to disable.
+    community_id: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: This value is generated when generating the registration
+    hs_token: This value is generated when generating the registration
+
+# Prometheus telemetry config. Requires prometheus-client to be installed.
+metrics:
+    enabled: false
+    listen_port: 8000
+
+# Manhole config.
+manhole:
+    # Whether or not opening the manhole is allowed.
+    enabled: false
+    # The path for the unix socket.
+    path: /var/tmp/mautrix-telegram.manhole
+    # The list of UIDs who can be added to the whitelist.
+    # If empty, any UIDs can be specified in the open-manhole command.
+    whitelist:
+    - 0
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for Telegram users.
+    # {userid} is replaced with the user ID of the Telegram user.
+    username_template: telegram_{userid}
+    # Localpart template of room aliases for Telegram portal rooms.
+    # {groupname} is replaced with the name part of the public channel/group invite link ( https://t.me/{} )
+    alias_template: telegram_{groupname}
+    # Displayname template for Telegram users.
+    # {displayname} is replaced with the display name of the Telegram user.
+    displayname_template: '{displayname} (Telegram)'
+
+    # Set the preferred order of user identifiers which to use in the Matrix puppet display name.
+    # In the (hopefully unlikely) scenario that none of the given keys are found, the numeric user
+    # ID is used.
+    #
+    # If the bridge is working properly, a phone number or an username should always be known, but
+    # the other one can very well be empty.
+    #
+    # Valid keys:
+    #   "full name"          (First and/or last name)
+    #   "full name reversed" (Last and/or first name)
+    #   "first name"
+    #   "last name"
+    #   "username"
+    #   "phone number"
+    displayname_preference:
+    - full name
+    - username
+    - phone number
+    # Maximum length of displayname
+    displayname_max_length: 100
+    # Remove avatars from Telegram ghost users when removed on Telegram. This is disabled by default
+    # as there's no way to determine whether an avatar is removed or just hidden from some users. If
+    # you're on a single-user instance, this should be safe to enable.
+    allow_avatar_remove: false
+
+    # Maximum number of members to sync per portal when starting up. Other members will be
+    # synced when they send messages. The maximum is 10000, after which the Telegram server
+    # will not send any more members.
+    # Defaults to no local limit (-> limited to 10000 by server)
+    max_initial_member_sync: 100
+    # Whether or not to sync the member list in channels.
+    # If no channel admins have logged into the bridge, the bridge won't be able to sync the member
+    # list regardless of this setting.
+    sync_channel_members: true
+    # Whether or not to skip deleted members when syncing members.
+    skip_deleted_members: true
+    # Whether or not to automatically synchronize contacts and chats of Matrix users logged into
+    # their Telegram account at startup.
+    startup_sync: true
+    # Number of most recently active dialogs to check when syncing chats.
+    # Set to 0 to remove limit.
+    sync_dialog_limit: 30
+    # Whether or not to sync and create portals for direct chats at startup.
+    sync_direct_chats: false
+    # The maximum number of simultaneous Telegram deletions to handle.
+    # A large number of simultaneous redactions could put strain on your homeserver.
+    max_telegram_delete: 10
+    # Whether or not to automatically sync the Matrix room state (mostly unpuppeted displaynames)
+    # at startup and when creating a bridge.
+    sync_matrix_state: true
+    # Allow logging in within Matrix. If false, the only way to log in is using the out-of-Matrix
+    # login website (see appservice.public config section)
+    allow_matrix_login: true
+    # Whether or not to bridge plaintext highlights.
+    # Only enable this if your displayname_template has some static part that the bridge can use to
+    # reliably identify what is a plaintext highlight.
+    plaintext_highlights: false
+    # Whether or not to make portals of publicly joinable channels/supergroups publicly joinable on Matrix.
+    public_portals: true
+    # Whether or not to use /sync to get presence, read receipts and typing notifications when using
+    # your own Matrix account as the Matrix puppet for your Telegram account.
+    sync_with_custom_puppets: true
+    # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, custom puppets will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    login_shared_secret:
+    # Set to false to disable link previews in messages sent to Telegram.
+    telegram_link_preview: true
+    # Use inline images instead of a separate message for the caption.
+    # N.B. Inline images are not supported on all clients (e.g. Riot iOS).
+    inline_images: false
+    # Maximum size of image in megabytes before sending to Telegram as a document.
+    image_as_file_size: 10
+    # Maximum size of Telegram documents in megabytes to bridge.
+    max_document_size: 100
+    # Enable experimental parallel file transfer, which makes uploads/downloads much faster by
+    # streaming from/to Matrix and using many connections for Telegram.
+    # Note that generating HQ thumbnails for videos is not possible with streamed transfers.
+    parallel_file_transfer: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: true
+    # Settings for converting animated stickers.
+    animated_sticker:
+        # Format to which animated stickers should be converted.
+        # disable - No conversion, send as-is (gzipped lottie)
+        # png - converts to non-animated png (fastest),
+        # gif - converts to animated gif, but loses transparency
+        # webm - converts to webm video, requires ffmpeg executable with vp9 codec and webm container support
+        target: gif
+        # Arguments for converter. All converters take width and height.
+        # GIF converter takes background as a hex color.
+        args:
+            width: 256
+            height: 256
+            background: '020202'  # only for gif
+            fps: 30               # only for webm
+    # End-to-bridge encryption support options. These require matrix-nio to be installed with pip
+    # and login_shared_secret to be configured in order to get a device for the bridge bot.
+    #
+    # Additionally, https://github.com/matrix-org/synapse/pull/5758 is required if using a normal
+    # application service.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: false
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: false
+    # Whether or not to explicitly set the avatar and room name for private
+    # chat portal rooms. This will be implicitly enabled if encryption.default is true.
+    private_chat_portal_meta: false
+    # Whether or not the bridge should send a read receipt from the bridge bot when a message has
+    # been sent to Telegram.
+    delivery_receipts: false
+    # Whether or not delivery errors should be reported as messages in the Matrix room.
+    delivery_error_reports: false
+
+    # Overrides for base power levels.
+    initial_power_level_overrides:
+        user: {}
+        group: {}
+
+    # Whether to bridge Telegram bot messages as m.notices or m.texts.
+    bot_messages_as_notices: true
+    bridge_notices:
+        # Whether or not Matrix bot messages (type m.notice) should be bridged.
+        default: false
+        # List of user IDs for whom the previous flag is flipped.
+        # e.g. if bridge_notices.default is false, notices from other users will not be bridged, but
+        #      notices from users listed here will be bridged.
+        exceptions:
+        - '@importantbot:example.com'
+
+    # Some config options related to Telegram message deduplication.
+    # The default values are usually fine, but some debug messages/warnings might recommend you
+    # change these.
+    deduplication:
+        # Whether or not to check the database if the message about to be sent is a duplicate.
+        pre_db_check: false
+        # The number of latest events to keep when checking for duplicates.
+        # You might need to increase this on high-traffic bridge instances.
+        cache_queue_length: 20
+
+    # The formats to use when sending messages to Telegram via the relay bot.
+    # Text msgtypes (m.text, m.notice and m.emote) support HTML, media msgtypes don't.
+    #
+    # Available variables:
+    #   $sender_displayname - The display name of the sender (e.g. Example User)
+    #   $sender_username    - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
+    #   $sender_mxid        - The Matrix ID of the sender (e.g. @exampleuser:example.com)
+    #   $message            - The message content
+    message_formats:
+        m.text: '<b>$sender_displayname</b>: $message'
+        m.notice: '<b>$sender_displayname</b>: $message'
+        m.emote: '* <b>$sender_displayname</b> $message'
+        m.file: '<b>$sender_displayname</b> sent a file: $message'
+        m.image: '<b>$sender_displayname</b> sent an image: $message'
+        m.audio: '<b>$sender_displayname</b> sent an audio file: $message'
+        m.video: '<b>$sender_displayname</b> sent a video: $message'
+        m.location: '<b>$sender_displayname</b> sent a location: $message'
+    # Telegram doesn't have built-in emotes, this field specifies how m.emote's from authenticated
+    # users are sent to telegram. All fields in message_formats are supported. Additionally, the
+    # Telegram user info is available in the following variables:
+    #    $displayname - Telegram displayname
+    #    $username    - Telegram username (may not exist)
+    #    $mention     - Telegram @username or displayname mention (depending on which exists)
+    emote_format: '* $mention $formatted_body'
+
+    # The formats to use when sending state events to Telegram via the relay bot.
+    #
+    # Variables from `message_formats` that have the `sender_` prefix are available without the prefix.
+    # In name_change events, `$prev_displayname` is the previous displayname.
+    #
+    # Set format to an empty string to disable the messages for that event.
+    state_event_formats:
+        join: <b>$displayname</b> joined the room.
+        leave: <b>$displayname</b> left the room.
+        name_change: <b>$prev_displayname</b> changed their name to <b>$displayname</b>
+
+    # Filter rooms that can/can't be bridged. Can also be managed using the `filter` and
+    # `filter-mode` management commands.
+    #
+    # Filters do not affect direct chats.
+    # An empty blacklist will essentially disable the filter.
+    filter:
+        # Filter mode to use. Either "blacklist" or "whitelist".
+        # If the mode is "blacklist", the listed chats will never be bridged.
+        # If the mode is "whitelist", only the listed chats can be bridged.
+        mode: blacklist
+        # The list of group/channel IDs to filter.
+        list: []
+
+    # The prefix for commands. Only required in non-management rooms.
+    command_prefix: '!tg'
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #   relaybot - Only use the bridge via the relaybot, no access to commands.
+    #       user - Relaybot level + access to commands to create bridges.
+    #  puppeting - User level + logging in with a Telegram account.
+    #       full - Full access to use the bridge, i.e. previous levels + Matrix login.
+    #      admin - Full access to use the bridge and some extra administration commands.
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions:
+        '*': relaybot
+        public.example.com: user
+        example.com: full
+        '@admin:example.com': admin
+    relaybot:
+        private_chat:
+            # List of users to invite to the portal when someone starts a private chat with the bot.
+            # If empty, private chats with the bot won't create a portal.
+            invite: []
+            # Whether or not to bridge state change messages in relaybot private chats.
+            state_changes: true
+            # When private_chat_invite is empty, this message is sent to users /starting the
+            # relaybot. Telegram's "markdown" is supported.
+            message: This is a Matrix bridge relaybot and does not support direct chats
+        # List of users to invite to all group chat portals created by the bridge.
+        group_chat_invite: []
+        # Whether or not the relaybot should not bridge events in unbridged group chats.
+        # If false, portals will be created when the relaybot receives messages, just like normal
+        # users. This behavior is usually not desirable, as it interferes with manually bridging
+        # the chat to another room.
+        ignore_unbridged_group_chat: true
+        # Whether or not to allow creating portals from Telegram.
+        authless_portals: true
+        # Whether or not to allow Telegram group admins to use the bot commands.
+        whitelist_group_admins: true
+        # Whether or not to ignore incoming events sent by the relay bot.
+        ignore_own_incoming_events: true
+        # List of usernames/user IDs who are also allowed to use the bot commands.
+        whitelist:
+        - myusername
+        - 12345678
+
+# Telegram config
+telegram:
+    # Get your own API keys at https://my.telegram.org/apps
+    api_id: 12345
+    api_hash: tjyd5yge35lbodk1xwzw2jstp90k55qz
+    # (Optional) Create your own bot at https://t.me/BotFather
+    bot_token: disabled
+
+    # Telethon connection options.
+    connection:
+        # The timeout in seconds to be used when connecting.
+        timeout: 120
+        # How many times the reconnection should retry, either on the initial connection or when
+        # Telegram disconnects us. May be set to a negative or null value for infinite retries, but
+        # this is not recommended, since the program can get stuck in an infinite loop.
+        retries: 5
+        # The delay in seconds to sleep between automatic reconnections.
+        retry_delay: 1
+        # The threshold below which the library should automatically sleep on flood wait errors
+        # (inclusive). For instance, if a FloodWaitError for 17s occurs and flood_sleep_threshold
+        # is 20s, the library will sleep automatically. If the error was for 21s, it would raise
+        # the error instead. Values larger than a day (86400) will be changed to a day.
+        flood_sleep_threshold: 60
+        # How many times a request should be retried. Request are retried when Telegram is having
+        # internal issues, when there is a FloodWaitError less than flood_sleep_threshold, or when
+        # there's a migrate error. May take a negative or null value for infinite retries, but this
+        # is not recommended, since some requests can always trigger a call fail (such as searching
+        # for messages).
+        request_retries: 5
+
+    # Device info sent to Telegram.
+    device_info:
+        # "auto" = OS name+version.
+        device_model: auto
+        # "auto" = Telethon version.
+        system_version: auto
+        # "auto" = mautrix-telegram version.
+        app_version: auto
+        lang_code: en
+        system_lang_code: en
+
+    # Custom server to connect to.
+    server:
+        # Set to true to use these server settings. If false, will automatically
+        # use production server assigned by Telegram. Set to false in production.
+        enabled: false
+        # The DC ID to connect to.
+        dc: 2
+        # The IP to connect to.
+        ip: 149.154.167.40
+        # The port to connect to. 443 may not work, 80 is better and both are equally secure.
+        port: 80
+
+    # Telethon proxy configuration.
+    # You must install PySocks from pip for proxies to work.
+    proxy:
+        # Allowed types: disabled, socks4, socks5, http, mtproxy
+        type: disabled
+        # Proxy IP address and port.
+        address: 127.0.0.1
+        port: 1080
+        # Whether or not to perform DNS resolving remotely. Only for socks/http proxies.
+        rdns: true
+        # Proxy authentication (optional). Put MTProxy secret in password field.
+        username: ''
+        password: ''
+
+# Python logging configuration.
+#
+# See section 16.7.2 of the Python documentation for more info:
+# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
+logging:
+    version: 1
+    formatters:
+        colored:
+            (): mautrix_telegram.util.ColorFormatter
+            format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
+        normal:
+            format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
+    handlers:
+        file:
+            class: logging.handlers.RotatingFileHandler
+            formatter: normal
+            filename: ./mautrix-telegram.log
+            maxBytes: 10485760
+            backupCount: 10
+        console:
+            class: logging.StreamHandler
+            formatter: colored
+    loggers:
+        mau:
+            level: DEBUG
+        telethon:
+            level: INFO
+        aiohttp:
+            level: INFO
+    root:
+        level: DEBUG
+        handlers: [file, console]
diff --git a/app/matrix/prod.jsonnet b/app/matrix/prod.jsonnet
index cf68738..66be5ea 100644
--- a/app/matrix/prod.jsonnet
+++ b/app/matrix/prod.jsonnet
@@ -2,12 +2,25 @@
 # This needs a secret provisioned, create with:
 #    kubectl -n matrix create secret generic synapse --from-literal=postgres_password=$(pwgen 24 1) --from-literal=macaroon_secret_key=$(pwgen 32 1) --from-literal=registration_shared_secret=$(pwgen 32 1)
 #    kubectl -n matrix create secret generic oauth2-cas-proxy --from-literal=oauth2_secret=...
+#
+# Sequencing appservices is fun. The appservice needs to run first (for
+# instance, via a bootstrap job), and on startup it will spit out a
+# registration file.  This registration file then needs to be fed to synapse -
+# this is done via specialy named secrets (appservice-X-registration, for X key
+# in the appservices object).
+#
+# For appservice-irc instances, you can use this oneliner magic to get the
+# registration YAML from logs.
 #    kubectl -n matrix create secret generic appservice-irc-freenode-registration --from-file=registration.yaml=<(kubectl logs -n matrix $(kubectl get pods -n matrix --selector=job-name=appservice-irc-freenode-bootstrap --output=jsonpath='{.items[*].metadata.name}') | tail -n +4 | sed -r 's/(.*aliases:.*)/      group_id: "+freenode:hackerspace.pl"\n\1/')
+#
+# For appservice-telegram instances, you can use this oneliner magic:
+#    kubectl -n matrix create secret generic appservice-telegram-prod-registration --from-file=registration.yaml=<(kubectl -n matrix logs job/appservice-telegram-prod-bootstrap | grep -A 100 SNIPSNIP | grep -v SNIPSNIP)
 
 local kube = import "../../kube/kube.libsonnet";
 local postgres = import "../../kube/postgres.libsonnet";
 
 local irc = import "appservice-irc.libsonnet";
+local telegram = import "appservice-telegram.libsonnet";
 
 {
     local app = self,
@@ -16,13 +29,14 @@
         namespace: "matrix",
         domain: "matrix.hackerspace.pl",
         serverName: "hackerspace.pl",
-        storageClassName: "waw-hdd-paranoid-2",
-        storageClassName3: "waw-hdd-redundant-3",
+        storageClassName: "waw-hdd-redundant-3",
 
         synapseImage: "matrixdotorg/synapse:v1.17.0",
         riotImage: "vectorim/riot-web:v1.7.1",
         casProxyImage: "registry.k0.hswaw.net/q3k/oauth2-cas-proxy:0.1.4",
         appserviceIRCImage: "matrixdotorg/matrix-appservice-irc:release-0.17.1",
+        # That's v0.8.2 - we just don't trust that host to not re-tag images.
+        appserviceTelegramImage: "dock.mau.dev/tulir/mautrix-telegram@sha256:9e68eaa80c9e4a75d9a09ec92dc4898b12d48390e01efa4de40ce882a6f7e330"
     },
 
     metadata(component):: {
@@ -44,7 +58,7 @@
             username: "synapse",
             prefix: "waw3-",
             password: { secretKeyRef: { name: "synapse", key: "postgres_password" } },
-            storageClassName: cfg.storageClassName3,
+            storageClassName: cfg.storageClassName,
             storageSize: "100Gi",
         },
     },
@@ -52,7 +66,7 @@
     dataVolume: kube.PersistentVolumeClaim("synapse-data-waw3") {
         metadata+: app.metadata("synapse-data"),
         spec+: {
-            storageClassName: cfg.storageClassName3,
+            storageClassName: cfg.storageClassName,
             accessModes: [ "ReadWriteOnce" ],
             resources: {
                 requests: {
@@ -223,11 +237,18 @@
         target_pod:: app.riotDeployment.spec.template,
     },
 
+    // Any appservice you add here will require an appservice-X-registration
+    // secret containing a registration.yaml file. Adding something to this
+    // dictionary will cause Synapse to not start until that secret is
+    // available - so change things carefully!
+    // If bootstrapping a new appservice, just keep it out of this dictionary
+    // until it spits you a registration YAML and you feed that to a secret.
     appservices: {
         "irc-freenode": irc.AppServiceIrc("freenode") {
             cfg+: {
                 image: cfg.appserviceIRCImage,
-                storageClassName: cfg.storageClassName,
+                // TODO(q3k): move this appservice to waw-hdd-redundant-3
+                storageClassName: "waw-hdd-paranoid-2",
                 metadata: app.metadata("appservice-irc-freenode"),
                 // TODO(q3k): add labels to blessed nodes
                 nodeSelector: {
@@ -250,6 +271,34 @@
                 },
             },
         },
+        "telegram-prod": telegram.AppServiceTelegram("prod") {
+            cfg+: {
+                image: cfg.appserviceTelegramImage,
+                storageClassName: cfg.storageClassName,
+                metadata: app.metadata("appservice-telegram-prod"),
+
+                config+: {
+                    homeserver+: {
+                        address: "https://%s" % [cfg.domain],
+                        domain: cfg.serverName,
+                    },
+                    appservice+: {
+                        id: "telegram",
+                    },
+                    telegram+: {
+                        api_id: (std.split(importstr "secrets/plain/appservice-telegram-prod-api-id", "\n"))[0],
+                        api_hash: (std.split(importstr "secrets/plain/appservice-telegram-prod-api-hash", "\n"))[0],
+                        bot_token: (std.split(importstr "secrets/plain/appservice-telegram-prod-token", "\n"))[0],
+                    },
+                    bridge+: {
+                        permissions+: {
+                            "hackerspace.pl": "puppeting",
+                            "@q3k:hackerspace.pl": "admin",
+                        },
+                    },
+                },
+            },
+        },
     },
 
     ingress: kube.Ingress("matrix") {
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash b/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash
new file mode 100644
index 0000000..6328ef9
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash
@@ -0,0 +1,40 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQf+Mi//T3zuThdW2iv4kCVLTun+jvfVlxj+kAyoRT9GIpYv
+BMLxfYJqHw+helGHJw7bipYQKuHwYKEh25ZTzSXkb8vf1Dinb38Bcxl1u1Mco/rL
++7TjhqL4AB+E7jRbdKq5z/dCWcEUSy1eqTqUPJqPiUMp83gs0je07s0FYAN8Z6aa
+AELVGVpDhazvP3k3XfEGWr7WPZGtqSOP1JqcI3E6eZmwXySG7vWnBYVnd0e94MlF
+gpTRsh4vRQd9mTvsni9KvhrglwBHv0WeXdQyMZlKArCqscHYDyfTgjNrCSkukoN4
+2ldV1mAXzt9uh9FeyX1HAPFX7O73RhgmRi+EGsnZMIUBDANcG2tp6fXqvgEIAJs0
+5TeRQAq5EwFA3zQmzxEQtalaEAMpX5wJTQGCmpNjAwtJWHsQvhAsbolV3UGHAyaF
+QIxQo2kSsMraWQDrFlvVfsZg5qLsP9ktTUfiyqOdnto/5AWp33DFjvL4SWOEGFJR
+grHah+ooDsg+FByZGgaECn9aab/USbUbWBM4pXGPBti3lVRmzKJmc4Xi7ncVi/GK
+Ew3+d3Kj8qmIitSp6TtmKwBLvEO3FpQZanGZ73nLf9dhnuhP0+2Op8gnCQYf0/Aj
+8hu1raaZ0b4Z7CK63PBWgDiDX2pv8iu4wdWmo+qDVJcwroQCfJ7MMDJO2rblDK6c
+8ap2yvvNrPTFFHuNZG2FAgwDodoT8VqRl4UBD/4pz3vCkCH3MiymsRsYj6uVcqWc
+yNTs/Ac3MLWPwNqSRgtKlO9cKdOHMse5/ZFXCmFUKD5HzD7q2uSIQVN4MgQ12adO
+o6P7jBZc50Fs0gEuW0fu0iSpbodpN+7sZl0UVsDUjk0uuiOJ8X5D7GoxTyzgan0b
+TpkELlxfJS+qrxOTuru4ruT62w6pt0LhMrEjiE9YBBsYUHj5LXlvBAJWuTjg4DCo
+RnjaXkzNgMXg9k7gwr/7T0kvgcmoFde2Z5WtpmbZZtddxIl/A1pFBjlC3ShdaK9M
+aLJewD/PpE3prfAvPR1uqsZ4+70ZGaOfONFg6W39W1AezfWcoHOBBzNzFopZeJgi
+3rL5bqKtU2fB/pwTvmua/8b+MJmsDDlxwKhaWyAZyecnW3+UlOFdv/SVgeiyyECY
+TWeILyw7lpLc853Dp3jHiBtmoG5I7NJ3Ra61SJWSuIuKF/un1+205or8cDE6O53Y
+eqmerHuM/9s29b0eGwgSWuR8e/abSEhNIW5jB8koCaWZTZcTYRZWwQIxoMmB0Sge
+lcRaK8Y+D5eNOBlwvkYvOytwji6SPGkGWEcUXPQq7IehDRFadBKyMZV+X/cR25XX
+mReikAg4Ujm7+QLwkFx1UW7oAMTj5MSHLxC5GsZ53tyw1Dfs7bkjiwhggzEq+U6j
+PCourQac30W8NSRL1YUCDAPiA8lOXOuz7wEP/29VkdpnBq0oqCFjY2CGtvUSwNLO
+8DzyLg6nieLviDpji0raFcNysIGidbjeA5DfLjjxKMzuNBKTwhfmbsVe7x27tkr4
+wM+uYzJw0kAMWju8i2CmIEZ0vJrs/TStyGizBGV273jrWJ98vMYcCcyyQ4TvKt7B
+IYEeemsZqci2tk0Gx1ySFI42nw2PGAZKocmGOE0QrQRypuwWQnAFNuIlz4mz+lDx
+HekocBy80N+o6RLzkdrX37ihwkSzHhEn2ouCVr9rPStlIWLjrWYApVmuIwfDzTN0
+RZ4jcBBNJNu4e+Skq7WhlZLKzOVdpL9T/ZZJdollkuDvuRcMZMKSBpN+BYO5qZId
+8eYWf08RULnTwOpph15S136HiY6HfR1yix1MXfMp0tgpjEETb0ZHqYWn5LmLssTz
+piebYuZy8RX7/LeMs6DgXwZvlGLRfumxB3R590AALSJcmR9LoFzETPX7k+zx6wia
+Whh1axlxB6T5ixovsAP9FVgdxAMxNjeZpX3fLV5kwFmNWWPLB461I5JvFcrIyAp4
+j/PPF/8W3eKbjIC99xLxfrKwCPbZ5a6nNfGZF1v5mnltlShTH6B9anVz7Gat6aqD
+jVQuj4ZXetXK+sOXB++X/Wv4Cxtr5O5iMCNcb/XZRwKtM48EAnj7Hi79qoOzuLxp
+wqsyMCRlIwRRPgZO0nsB1IEYcjXuak363TmE+21Zfzroid04n0ACt11gBzHCXnw1
+MBlQTVl4AvZe0jQOWW7+DZFDEENXWQxRIV9nBOe4LR6BvOCHx5f/5skxMlEmawF8
+hruFENYt2FyHl7Y8eSoyERnJWbGLaZUBAZ7pWQm+hrFlwvolo0odipo=
+=A4un
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-api-id b/app/matrix/secrets/cipher/appservice-telegram-prod-api-id
new file mode 100644
index 0000000..45273fd
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-api-id
@@ -0,0 +1,40 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQgAiqMa7pqfKcyQw7p3KPcgI1iGhOsgZyNWymK18ejm5BxV
+zA9lURjn0OMhiOnKg+A9X10S3XcJs2ow3v4nvOwVPDI2dSYMUwnkhKGiI5V+I/qe
+bYXd9xk1LPn3d23LH3U616TLQ0bllv37Fs9rU2o/DMy5UGESaU6mzkTKjV9l0loW
+VuClwK3fgOOXLMFzsP99gO0JG0Z1gfKcWE2IEPEB7OSoGx/XA69JxT8YjbzPYA8Z
+QpKk2FBxkiVx4xW7kRUnuly7HzQLprmqSye6OQSPXSduyra8aMs1PVkwPvEg38Ec
+BDuBrE3dXepU52HXkLkt9zcBo9LSJAkMR69+CJ6SdYUBDANcG2tp6fXqvgEH/Aly
++zfvbUs+H6Nzj82GwQUqJtRmypOYFLMzYSNzeWdCGJSPbCop+v+dpx+/8vwfl/yf
+unnLtlSvDnNwLsUqe7WSq6wSeQ2073XNi1f+pjmwZQ2Jjcr8p4l+8B2IlhSM6m1A
+wcly8dl9fVbKzJ06GrC9q+cd4Brl7g0fF+isvF5klNomjDy1DjSpjgWcpgi/9osJ
+FUdR6trTKIR1yMtr5+PiVYEEvZOsIqJySQfGI6U3R66muI/s4PaTAJPyf46Vzmd5
+pnVNi8CnCAoERtLZ+hFbnB7vbD47bSyTpsTkxUOQOik2sghYLDdEGouWbONakL0g
+OOGV160WddGotrXTY6iFAgwDodoT8VqRl4UBD/41aYgD53H7Vu8hC/YNTeD4HrVw
+khuOqEsZ1tBXxJwkujjRl4hx7xEmzhC59daI3IwsJSTFE+gBYTHlyIksqSgq72P6
+VfpNdwzV3GP5RpgAi6Kin7q2HcDVxBUJYQvmZ4igoe+luXXEtkHAYv/BO507+Rr9
+UMlFw/XldRrqMUQhxfYOWgVrAxIg4bbOKo0xt2KjXXeUpM8qclK9QUKtyFUPMDOB
+xbCKa2SiwtsFQUXhS4cyt4lTBeemCXC1ajhghgW7f9G3ym/UR/beNICiF56t4Mvr
+HEdiPGDzVnntC9Wbt6rLiE2WQAskjana53kpwVUCfrv4f4BDvVrkqoQSeEEnj2Qz
+Kc3zFcedrE3FILgHPApJFrZknD+V3RdPXv5d1tgTVYxZJu840YgBXVihKgFcIkN7
+QU5ZwttNwnWGKhCFtS/za6rWGaWe+LUoMJ5b6FqZ5vXV9s3+VjXAaHT55Qv9EKDz
+eDHlfpK0VizPlRBgJJEFjxWPIf7d6qHyHWfivmXwbwzdducZFSvof6qqrSsSJY41
+qvIsf+/YjGFLKz8UT+/bTBFL32Wf/F0cDefJ4zystG9ZhWQSUdpF6XeHrG0+1BuG
+pVBk+HakEFrjzG5YlQGERbrktJi/lCEDRf0LsQfiXsDVlwXvUUgsIShrE11mnX/T
+oh8+YOe4cI3Gy5r0a4UCDAPiA8lOXOuz7wEP/RRJo/3Op15irMGWp+6Ty/8yciZQ
+DisSpfckpZtWo+jn1K2KJ/xJz9SHa2TcwkoXi4N/1je0oYjUB/KwiVhS0nxHKjdT
+BLbG9XZeI+PzgiBaV2pfoDytHYjsecLLPNRkMC/4A+2EOOZ4r0MsXRik0By2AuMP
+lfz4OUZGppdRG61+fUAuxkCz7YEmwe/sYdiZUHZhcA9HyxcjTnWWnmQ9Wivt0wOW
+mPKWDbYsSISKzqWJKwU7X2dG0W8A8WDQgozHyL/SCuVT8hnnyEeyQsRXk+gBvb4K
+/5zO9OgBtOoiYyH+NZNY+gYGUs/1R6wWp3KJCaD6v7/DE8sryQlHSVlDJ41g611d
+YiT5JXoQZreEgCZmUZE1Q4rZjtS5sEPq+O9eYoHFLzSElXE0uyXvlv71ANLExWia
+u/ITgxmRk9mbrLQS4eoI60tM/vg+mT8JPkr/CJv7jrI1jHIFf7cGAqm/CFKhy69R
+bPTGf85130iR+w49NkZ8XBDwW7P7xyoflCBi2qL9jcgb2jyHjSSL+X7ucVXjm50i
+rDMvtYuvFtP08ut9q/I7HVxOzmr+atY4MiNcTVltBFn+3NLRqJIyacx/ZgY1EDAc
+wokg2Tylglv/uSXTzHFbgWT6TH/WdgMobJdf705xoIIXhaa2HRCWvOGdJ5r0mKI0
+bjwvZKJEZB8MKU0s0mIBGGFffvNvb8WrixQCczg37YNVhvnBxprUT9R4tMfE/ybt
+BPFQIXTCjdaxMc6GL1EGLhaj3XADUT/JLSDqX9BUuZyN8CBrt4EgkD4tmtwB80Cp
+b9sc0R49c51gYZ2y00PvXQ==
+=ezNx
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-token b/app/matrix/secrets/cipher/appservice-telegram-prod-token
new file mode 100644
index 0000000..52708e3
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-token
@@ -0,0 +1,41 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQf+KV+pXyxCBLTkTCGWRc7I1loxw8793j1CXOgINS1817Sl
+6cq4o07NxQRY+owyXGOyUGpQC1mlqyUJYbPjjgj6SzPIm6Knr7ue0PWeFsdKq+3d
+XHf5R7+xijJG0GMBMRXrP46Jg4amPNkydUmGFhbcSJ6uGnvfcqdOO7G9m5A6ACo/
+LCJgsoncBpxb5xVgfkPJRna1yFzZCDXmtT3c0UGcnVfhN4ZSsKThEX5n0W/cbQXv
+tzPGgP/4A0JGxvKcB5OHsGMH4bbEtlEHobm6Wo9OKNc7I9iIbCczkUR2viz988y1
+7v8si3aCrZVbIkIqlBRI6fJCoW9yfzo6r9KtlwL0wYUBDANcG2tp6fXqvgEH/ROm
+5xNkYKPpyEPULzEdk5VWQxmrwsnweEl33mejTmSrFD5l+1w2aS5eUwSfy9bwjr+Z
+zQ+Rsu2OISTisQsfKHrCuGxaV+E+hH4Ta5RoKopcVdOI9bga1Ja4wtGk6M5tul9L
+4/ePGWK5A6vwnBp4pPSC14nZXpWXUvZRGpglV9DSEHJ/DfsiSqfkdW6bKfx33MGP
+KhxmocxwR3K2KzgRyj2lVQpCiMnGsQbXKwyFSnVFid5NR/g4lOWnHhKLybNI6DHV
+eAC12Ai+YjIfoTcsYL2fwUYhsXkgvzicWF9lgQkJjFiJGSuo1ZdSg7Bmjro6Bfok
+4tRBE2CDDiNUL1LCE0GFAgwDodoT8VqRl4UBD/4pIsJ4On49B3D8P+vwPBHUCOkw
+MOT3TvnLxAuB0NoYYnNRjYz5J1SrZTyHi0wiRed5T2Rxhy+MAXiKMKmBYBjdBkye
+eMHObobXq0OWu0cTSHy6HwR7gDI3osd1hNVIN8zxt9OgKE1omv8TJ0hnkFgLtyLD
+l8mh9LLHgRoZ9aFmU26LUA8DV7QY2XMetCmbGM5kMswq1hf4Kok/WHDleTEbv3Af
+23jSqn2+eAHipKqZFhbBvx14o+9bCa2gmQbep/QGuMS29GYgBEQbAw9cFW6dTKqY
+GL2eHYwmcjDx8jDSZqPFAYyXJWR+cBsd8oQnVoiKCEX1YGPWOp6AW+V2B41y4fo6
+4yrbQSkNVJhb5uNxFkyTcJ+kAnQ/GkaIq5ju+0hbCEnGL3J8jrY21rXWHNZgQcc3
+XmDYuE+ewDMMi4y4m7sIaFlpEnsi7ikNiDw27X33OIfBJ5VA2eN2yhYlmlVPzx9N
+9O3Xiz2EzwtfVCpQplgIdYlKBop/FtU4dKEuLgVM/UwsZ1nR5xqTMctIXUxF2DAP
+ZyCjg/EpOvII4Qw3CUoyF31ICA1BqxYvP+b7cE/70zTeF4YtBoTICsxRQYK85y04
+qJlSB1GG+wr8nHWYH3xDizxt4KmVEcIFVID9fw/IMSYd8uZxfLxxTPlT/UCYLqTA
+IayaZbzvP+2bGFYXJoUCDAPiA8lOXOuz7wEP/jTu6keVVeCyqmeWXoJQKXgQl43y
+TiDVsJkeeCaR4Ek3crZ/VfN/Tu8j14zsVS2hdE+4l96cWNasEjNP/To7IYCjm5xl
+btSkXwtNEG65zHuKfOqgXLoFN1zfyi2uMdhiCXURFjHdMPSaP60dAkF0oC5HQ4X2
+IJBeRjV0XTzJusvs7DpmYTs8q+BKjg2ERNvXtQZHUftDAL04OjJVqYiXeuL13das
+jhxSliz7VWrrFmaWzg0wB3QyZeN7p2Qx2VDiJlXVp7GLRUOgfkdeCNYJFBfk8DHV
+qiLzCZYRSSypPoLnDQZoCye3m04B5IAQi4NTAAlTAAzVZC6tbV/0nSkrSDhdm0Wn
+JLh0Xonhg/JlEArerQKag9eZ0FOxnrQSSz73A2lH9qrH5MO5DRLR5f0UigVHdhMh
+gQ02jBtQ5u1fSW64pPscrmllXaZn8H838j+C5T+/iTxSD0KQrArTJg3dB525fIQ6
+U1j50kpACF5Q9MHebCpVE6xXrThkQYcSIJIPUYUlQUzbQQQJHTs32U4JrGsxK26G
+FVMl+df12S6CdezB9SD8gu4Qjw01A5LPSYSInVhgJRmLHokHvVgXBr7BF7k0WO8G
+ci56x5N2zLvYAki+gJbVnUd4jVXr3uSmhlKgBSlE+vED4M3ZVK6XSxbfrKeRLfek
+mQZW+n9NgYG/ai8h0ogBJ7POGcjfmI//VsnhZNmFpSuQi63Lr8hC2DHVzp4GdegZ
+oyXPqIZb3HCiuJ/fKbHRcQau2Pyp//P4l6Zv2moikOEP4SWhUZ2ZyFxgEqt8vjkB
+wlJAfgJuJbjis9Cj1QA2cOW03I9or9cinTW782SzEeNMZgmYZnM2+mKrTANlwnLi
+6uaFMmg9
+=xl1i
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/plain/.gitignore b/app/matrix/secrets/plain/.gitignore
new file mode 100644
index 0000000..72e8ffc
--- /dev/null
+++ b/app/matrix/secrets/plain/.gitignore
@@ -0,0 +1 @@
+*