diff --git a/fogcutter/k8s/airsonic.yml b/fogcutter/k8s/airsonic.yml
index 3e86f03..ae30e85 100644
--- a/fogcutter/k8s/airsonic.yml
+++ b/fogcutter/k8s/airsonic.yml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: airsonic
-          image: linuxserver/airsonic
+          image: linuxserver/airsonic:v10.6.2-ls83
           env:
             - name: PUID
               value: "1000"
diff --git a/fogcutter/k8s/dnsutils.yml b/fogcutter/k8s/dnsutils.yml
new file mode 100644
index 0000000..6eb5625
--- /dev/null
+++ b/fogcutter/k8s/dnsutils.yml
@@ -0,0 +1,17 @@
+# Used to test DNS, example:
+# k exec -i -t dnsutils -- nslookup dns-host.default
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: dnsutils
+  namespace: default
+spec:
+  containers:
+  - name: dnsutils
+    image: gcr.io/kubernetes-e2e-test-images/dnsutils:1.3
+    command:
+      - sleep
+      - "3600"
+    imagePullPolicy: IfNotPresent
+  restartPolicy: Always
diff --git a/fogcutter/k8s/gitea.yml b/fogcutter/k8s/gitea.yml
index 77edeca..d7bd044 100644
--- a/fogcutter/k8s/gitea.yml
+++ b/fogcutter/k8s/gitea.yml
@@ -19,6 +19,7 @@ spec:
       containers:
         - name: gitea
           image: gitea/gitea:1.12.5
+          # after initial install options must be changed at /data/gitea/conf/app.ini
           env:
             - name: RUN_MODE
               value: "prod"
@@ -34,8 +35,8 @@ spec:
               value: "true"
             - name: DISABLE_REGISTRATION
               value: "true"
-            - name: REQUIRED_SIGNIN_VIEW
-              value: "true"
+            - name: REQUIRE_SIGNIN_VIEW
+              value: "false"
             - name: USER_UID
               value: "1000"
             - name: USER_GUID
diff --git a/fogcutter/k8s/haproxy.yml b/fogcutter/k8s/haproxy.yml
index 0fcc5f6..13fc521 100644
--- a/fogcutter/k8s/haproxy.yml
+++ b/fogcutter/k8s/haproxy.yml
@@ -110,11 +110,10 @@ spec:
       serviceAccountName: haproxy-ingress-service-account
       containers:
         - name: haproxy-ingress
-          image: haproxytech/kubernetes-ingress
+          image: haproxytech/kubernetes-ingress:1.4.9
           args:
             - --configmap=pew/haproxy
             - --configmap-tcp-services=pew/tcpservices
-            - --default-backend-service=pew/ingress-default-backend
           ports:
             - name: http
               containerPort: 80
@@ -208,6 +207,16 @@ spec:
                 name: gitea
                 port:
                   number: 3000
+    - host: nc.seaturtle.pw
+      http:
+        paths:
+          - path: /
+            pathType: "Exact"
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 80
     - host: plex.seaturtle.pw
       http:
         paths:
@@ -225,6 +234,7 @@ spec:
         - airsonic.seaturtle.pw
         - git.seaturtle.pw
         - plex.seaturtle.pw
+
 ---
 apiVersion: cert-manager.io/v1alpha2
 kind: ClusterIssuer
diff --git a/fogcutter/k8s/minecraft.yml b/fogcutter/k8s/minecraft.yml
index fe4a82b..6cc4bbe 100644
--- a/fogcutter/k8s/minecraft.yml
+++ b/fogcutter/k8s/minecraft.yml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: minecraft
-          image: itzg/minecraft-server
+          image: itzg/minecraft-server:latest
           env:
             - name: EULA
               value: "TRUE"
diff --git a/fogcutter/k8s/nextcloud.yml b/fogcutter/k8s/nextcloud.yml
new file mode 100644
index 0000000..3caeeef
--- /dev/null
+++ b/fogcutter/k8s/nextcloud.yml
@@ -0,0 +1,168 @@
+# to scan new files: su -l www-data -s /bin/bash -c "/var/www/html/occ files:scan --path='/USER/files'"
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: nextcloud
+  name: nextcloud
+  namespace: pew
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: nextcloud
+  template:
+    metadata:
+      labels:
+        run: nextcloud
+    spec:
+      containers:
+        - name: nextcloud
+          image: nextcloud:20.0.1-apache
+          env:
+            - name: OVERWRITEHOST
+              value: "nc.seaturtle.pw"
+            - name: OVERWRITEPROTOCOL
+              value: "https"
+            - name: MYSQL_DATABASE
+              value: "nextcloud"
+            - name: MYSQL_USER
+              value: "nextcloud"
+            - name: MYSQL_PASSWORD
+              value: "nextcloud"
+            - name: MYSQL_HOST
+              value: "nextcloud-mariadb.pew"
+            - name: REDIS_HOST
+              value: "nextcloud-redis.pew"
+            - name: REDIS_HOST_PASSWORD
+              value: "nextcloud"
+          volumeMounts:
+            - mountPath: /var/www/html
+              name: nextcloud-data
+              readOnly: false
+          ports:
+            - name: http
+              containerPort: 80
+      volumes:
+        - name: nextcloud-data
+          hostPath:
+            path: /opt/NEXTCLOUD-K8S/data
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: nextcloud
+  name: nextcloud
+  namespace: pew
+spec:
+  selector:
+    run: nextcloud
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: nextcloud-mariadb
+  name: nextcloud-mariadb
+  namespace: pew
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: nextcloud-mariadb
+  template:
+    metadata:
+      labels:
+        run: nextcloud-mariadb
+    spec:
+      containers:
+        - name: mariadb
+          image: mariadb:10.5.6
+          env:
+            - name: MYSQL_RANDOM_ROOT_PASSWORD
+              value: "notnullvalue"
+            - name: MYSQL_PASSWORD
+              value: "nextcloud"
+            - name: MYSQL_DATABASE
+              value: "nextcloud"
+            - name: MYSQL_USER
+              value: "nextcloud"
+          volumeMounts:
+            - mountPath: /var/lib/mysql
+              name: nextcloud-mariadb
+              readOnly: false
+          ports:
+            - name: mysql
+              containerPort: 3306
+      volumes:
+        - name: nextcloud-mariadb
+          hostPath:
+            path: /opt/NEXTCLOUD-K8S/mariadb
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: nextcloud-mariadb
+  name: nextcloud-mariadb
+  namespace: pew
+spec:
+  selector:
+    run: nextcloud-mariadb
+  ports:
+    - name: mysql
+      port: 3306
+      protocol: TCP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: nextcloud-redis
+  name: nextcloud-redis
+  namespace: pew
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: nextcloud-redis
+  template:
+    metadata:
+      labels:
+        run: nextcloud-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:6.0.9
+          args:
+            - --requirepass nextcloud
+          ports:
+            - name: redis
+              containerPort: 6379
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: nextcloud-redis
+  name: nextcloud-redis
+  namespace: pew
+spec:
+  selector:
+    run: nextcloud-redis
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
diff --git a/fogcutter/k8s/nginx.yml b/fogcutter/k8s/nginx.yml
index 440e30b..d61e8f5 100644
--- a/fogcutter/k8s/nginx.yml
+++ b/fogcutter/k8s/nginx.yml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginx
+          image: nginx:1.19.3
           volumeMounts:
             - mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
diff --git a/fogcutter/k8s/plex.yml b/fogcutter/k8s/plex.yml
index ccc4a55..707a85c 100644
--- a/fogcutter/k8s/plex.yml
+++ b/fogcutter/k8s/plex.yml
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: plex
-          image: linuxserver/plex
+          image: linuxserver/plex:1.20.4.3517-ab5e1197c-ls123
           env:
             - name: PUID
               value: "1000"