diff --git a/app/mailman-web/kube/mailman.libsonnet b/app/mailman-web/kube/mailman.libsonnet
new file mode 100644
index 0000000..c71de4e
--- /dev/null
+++ b/app/mailman-web/kube/mailman.libsonnet
@@ -0,0 +1,215 @@
+local kube = import "../../../kube/kube.libsonnet";
+
+{
+    local app = self,
+    local cfg = app.cfg,
+
+    cfg:: {
+        namespace: error "cfg.namespace must be set",
+        webDomain: error "cfg.webDomain must be set",
+        images: {
+            web: "registry.k0.hswaw.net/implr/mailman-web:0.6",
+            # https://github.com/octeep/wireproxy
+            wireproxy: "registry.k0.hswaw.net/implr/wireproxy:1.0.5"
+        },
+        passwords: {
+            postgres: error "cfg.secrets.postgres must be set",
+            mailmanRest: error "cfg.secrets.mailmanRest must be set",
+            mailmanArchiver: error "cfg.secrets.mailmanArchiver must be set",
+        },
+        smtp: {
+            user: "postorius",
+            # from mail server
+            password: error "cfg.smtp.password must be set",
+        },
+        secrets: {
+            djangoSecretKey: error "cfg.secrets.djangoSecretKey must be set",
+        },
+        wg: {
+            peerPubkey: error "cfg.wg.peerPubkey must be set",
+            privkey: error "cfg.wg.privkey must be set",
+            endpoint: error "cfg.wg.endpoint must be set",
+        },
+    },
+
+    env:: {
+        WEB_DOMAIN: cfg.webDomain,
+        BIND_ADDR: "0.0.0.0:8080",
+
+        //DB_HOST: app.postgres.svc.host,
+        DB_HOST: "boston-packets.hackerspace.pl",
+        DB_USER: "mailman",
+        DB_NAME: "mailman-web",
+        DB_PASS: kube.SecretKeyRef(app.config, "postgres-pass"),
+        DB_PORT: "5432",
+
+
+        SMTP_HOST: "mail.hackerspace.pl",
+        SMTP_PORT: "587",
+        SMTP_USER: "postorius",
+        SMTP_PASSWORD: kube.SecretKeyRef(app.config, "smtp-password"),
+
+        SECRET_KEY: kube.SecretKeyRef(app.config, "django-secret-key"),
+        MAILMAN_REST_API_PASS: kube.SecretKeyRef(app.config, 'mailman-api-password'),
+        MAILMAN_ARCHIVER_KEY: kube.SecretKeyRef(app.config, 'mailman-archiver-key'),
+
+    },
+
+    namespace: kube.Namespace(cfg.namespace),
+    local ns = self.namespace,
+
+
+    web: ns.Contain(kube.Deployment("web")) {
+        spec+: {
+            minReadySeconds: 10,
+            replicas: 1,
+            template+: {
+                spec+: {
+                    initContainers_: {
+                        migrate: kube.Container("migrate") {
+                            image: cfg.images.web,
+                            env_: app.env,
+                            args: [
+                                "manage", "migrate",
+                            ],
+                        },
+                    },
+                    volumes_: {
+                        config: kube.SecretVolume(app.wireproxyConfig),
+                    },
+                    containers_: {
+                        default: kube.Container("default") {
+                            image: cfg.images.web,
+                            env_: app.env,
+                            args: ["serve"],
+                            ports_: {
+                                web: { containerPort: 8080 },
+                            },
+                            # readinessProbe: {
+                            #     httpGet: {
+                            #         path: "/",
+                            #         port: "web",
+                            #     },
+                            #     failureThreshold: 10,
+                            #     periodSeconds: 5,
+                            # },
+                            resources: {
+                                requests: {
+                                    cpu: "250m",
+                                    memory: "1024M",
+                                },
+                                limits: {
+                                    cpu: "1",
+                                    memory: "1024M",
+                                },
+                            },
+                        },
+                        wireproxy: kube.Container("wireproxy") {
+                            image: cfg.images.wireproxy,
+                            resources: {
+                                requests: {
+                                    cpu: "100m",
+                                    memory: "64M",
+                                },
+                                limits: {
+                                    cpu: "200m",
+                                    memory: "128M",
+                                },
+                            },
+                            volumeMounts_: {
+                                config: { mountPath: "/etc/wireproxy/config", subPath: "config" }
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    },
+
+    local manifestIniMultisection(sname, values) = std.join('\n',
+        [std.manifestIni({
+                sections: {
+                    [sname]: i,
+            }}) for i in values]),
+    wireproxyConfig: ns.Contain(kube.Secret("wireproxy-config")) {
+        data: {
+            config: std.base64(std.manifestIni({
+                sections: {
+                    Interface: {
+                        Address: cfg.wg.address,
+                        PrivateKey: cfg.wg.privkey,
+                    },
+                    Peer: {
+                        PublicKey: cfg.wg.peerPubkey,
+                        Endpoint: cfg.wg.endpoint,
+                    },
+
+                },
+            }) + manifestIniMultisection("TCPClientTunnel", [
+                # {
+                #     # postgres
+                #     ListenPort: 5432,
+                #     Target: "localhost:5432",
+                # },
+                {
+                    # mailman core api
+                    BindAddress: "127.0.0.1:8001",
+                    Target: "172.17.1.1:8001",
+                },
+            ])),
+        },
+    },
+
+
+    svcWeb: ns.Contain(kube.Service("web")) {
+        target_pod: app.web.spec.template,
+        spec+: {
+            # hax
+            type: "LoadBalancer",
+            externalTrafficPolicy: "Local",
+        },
+    },
+
+
+    #ingress: ns.Contain(kube.Ingress("mailman")) {
+    #    metadata+: {
+    #        annotations+: {
+    #            "kubernetes.io/tls-acme": "true",
+    #            "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+    #            "nginx.ingress.kubernetes.io/proxy-body-size": "0",
+    #        },
+    #    },
+    #    spec+: {
+    #        tls: [
+    #            {
+    #                hosts: [cfg.webDomain],
+    #                secretName: "mailman-ingress-tls",
+    #            },
+    #        ],
+    #        rules: [
+    #            {
+    #                host: cfg.webDomain,
+    #                http: {
+    #                    paths: [
+    #                        { path: "/", backend: app.svcWeb.name_port },
+    #                        //{ path: "/static/", backend: app.svcStatic.name_port },
+    #                    ],
+    #                },
+    #            },
+    #        ],
+    #    },
+    #},
+
+    config: ns.Contain(kube.Secret("config")) {
+        data_: {
+            "postgres-pass": cfg.passwords.postgres,
+            "django-secret-key": cfg.secrets.djangoSecretKey,
+
+            "smtp-password": cfg.smtp.password,
+
+            "mailman-api-password": cfg.mailmanCore.mailmanApiPass,
+            "mailman-archiver-key": cfg.mailmanCore.mailmanArchiverKey,
+
+        },
+    },
+}