diff --git a/charts/apps/apprise/templates/deployment.yaml b/charts/apps/apprise/templates/deployment.yaml
deleted file mode 100644
index 9544d6e..0000000
--- a/charts/apps/apprise/templates/deployment.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: "{{ .Release.Name }}"
-spec:
-  strategy:
-    type: Recreate
-  replicas: 1
-  selector:
-    matchLabels:
-      app: "{{ .Release.Name }}"
-  template:
-    metadata:
-      labels:
-        app: "{{ .Release.Name }}"
-    spec:
-      containers:
-        - name: "{{ .Release.Name }}"
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          livenessProbe:
-            tcpSocket:
-              port: http
-          readinessProbe:
-            tcpSocket:
-              port: http
-          env:
-            - name: TZ
-              value: "{{ .Values.globals.timezone }}"
-            - name: BASE_URL
-              value: https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}
-          volumeMounts:
-            - mountPath: /config
-              name: data
-
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: "{{ .Release.Name }}-data"
diff --git a/charts/apps/apprise/templates/pvc.yaml b/charts/apps/apprise/templates/pvc.yaml
deleted file mode 100644
index bc1d0a6..0000000
--- a/charts/apps/apprise/templates/pvc.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: '{{ .Release.Name }}-data'
-spec:
-  accessModes:
-    - 'ReadWriteOnce'
-  resources:
-    requests:
-      storage: '1Gi'
-  storageClassName: '{{ .Values.globals.environment }}'
diff --git a/charts/apps/apprise/templates/service.yaml b/charts/apps/apprise/templates/service.yaml
deleted file mode 100644
index f7001fc..0000000
--- a/charts/apps/apprise/templates/service.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: "{{ .Release.Name }}"
-  labels:
-    app: "{{ .Release.Name }}"
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: 8000
-      protocol: TCP
-      name: http
-  selector:
-    app: "{{ .Release.Name }}"
diff --git a/charts/apps/apprise/values.yaml b/charts/apps/apprise/values.yaml
deleted file mode 100644
index e3c9f2e..0000000
--- a/charts/apps/apprise/values.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-globals:
-  environment: prod
-  timezone: Europe/Amsterdam
-  domain: olsen.cloud
-image:
-  repository: docker.io/caronc/apprise
-  tag: latest@sha256:127b3834f0679502529397ead8ffeaadf5189019c4c863fa6652e9b942fdccf8
-  pullPolicy: IfNotPresent
-subdomain: apprise
diff --git a/charts/apps/apprise/Chart.yaml b/charts/apps/penpot/Chart.yaml
similarity index 68%
rename from charts/apps/apprise/Chart.yaml
rename to charts/apps/penpot/Chart.yaml
index d54ee22..a315e21 100644
--- a/charts/apps/apprise/Chart.yaml
+++ b/charts/apps/penpot/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
 version: 1.0.0
-name: apprise
+name: penpot
diff --git a/charts/apps/penpot/templates/client.yaml b/charts/apps/penpot/templates/client.yaml
new file mode 100644
index 0000000..1ece047
--- /dev/null
+++ b/charts/apps/penpot/templates/client.yaml
@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /api/auth/oauth/oidc/callback
+      subdomain: "{{ .Values.frontend.subdomain }}"
+      matchingMode: strict
diff --git a/charts/apps/apprise/templates/client.yaml b/charts/apps/penpot/templates/database.yaml
similarity index 50%
rename from charts/apps/apprise/templates/client.yaml
rename to charts/apps/penpot/templates/database.yaml
index 8299b34..6a30b53 100644
--- a/charts/apps/apprise/templates/client.yaml
+++ b/charts/apps/penpot/templates/database.yaml
@@ -1,10 +1,6 @@
 apiVersion: homelab.mortenolsen.pro/v1
-kind: OidcClient
+kind: PostgresDatabase
 metadata:
   name: '{{ .Release.Name }}'
 spec:
   environment: '{{ .Values.globals.environment }}'
-  redirectUris:
-    - path: /oauth/oidc/callback
-      subdomain: '{{ .Values.subdomain }}'
-      matchingMode: strict
diff --git a/charts/apps/penpot/templates/deployment.yaml b/charts/apps/penpot/templates/deployment.yaml
new file mode 100644
index 0000000..d53898b
--- /dev/null
+++ b/charts/apps/penpot/templates/deployment.yaml
@@ -0,0 +1,176 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-frontend"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-frontend"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-frontend"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}-frontend"
+          image: "{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag }}"
+          imagePullPolicy: "{{ .Values.frontend.image.pullPolicy }}"
+          env:
+            - name: PENPOT_PUBLIC_URI
+              value: "https://{{ .Values.frontend.subdomain }}.{{ .Values.globals.domain }}"
+            - name: PENPOT_FLAGS
+              value: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies disable-registration enable-login-with-oidc disable-login-with-password
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /opt/data/assets
+              name: assets
+      volumes:
+        - name: assets
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-assets"
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-valkey"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-valkey"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-valkey"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}-valkey"
+          image: "{{ .Values.valkey.image.repository }}:{{ .Values.valkey.image.tag }}"
+          imagePullPolicy: "{{ .Values.valkey.image.pullPolicy }}"
+          ports:
+            - name: tcp
+              containerPort: 6379
+              protocol: TCP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-backend"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-backend"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-backend"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}-backend"
+          image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
+          imagePullPolicy: "{{ .Values.backend.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 6060
+              protocol: TCP
+          env:
+            - name: PENPOT_PUBLIC_URI
+              value: "https://{{ .Values.frontend.subdomain }}.{{ .Values.globals.domain }}"
+            - name: PENPOT_FLAGS
+              value: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies disable-registration enable-login-with-oidc disable-login-with-password
+            - name: PENPOT_DATABASE_URI
+              value: "postgresql://prod-postgres-cluster.homelab.svc.cluster.local/prod_penpot"
+            - name: PENPOT_DATABASE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-pg-connection"
+                  key: user
+            - name: PENPOT_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-pg-connection"
+                  key: password
+            - name: PENPOT_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: PENPOT_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: PENPOT_OIDC_BASE_URI
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configurationIssuer
+            # - name: PENPOT_OIDC_ROLES
+            #   value: admins
+            # - name: PENPOT_OIDC_ROLES_ATTR
+            #   value: groups
+
+            - name: PENPOT_REDIS_URI
+              value: "redis://{{ .Release.Name }}-valkey/0"
+            - name: PENPOT_ASSETS_STORAGE_BACKEND
+              value: assets-fs
+            - name: PENPOT_STORAGE_ASSETS_FS_DIRECTORY
+              value: /opt/data/assets
+            - name: PENPOT_TELEMETRY_ENABLED
+              value: "false"
+          volumeMounts:
+            - mountPath: /opt/data/assets
+              name: assets
+      volumes:
+        - name: assets
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-assets"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}-exporter"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}-exporter"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}-exporter"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}-exporter"
+          image: "{{ .Values.exporter.image.repository }}:{{ .Values.exporter.image.tag }}"
+          imagePullPolicy: "{{ .Values.exporter.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 6061
+              protocol: TCP
+          env:
+            - name: PENPOT_PUBLIC_URI
+              value: "https://{{ .Values.frontend.subdomain }}.{{ .Values.globals.domain }}"
+            - name: PENPOT_REDIS_URI
+              value: "redis://{{ .Release.Name }}-valkey.{{ .Release.Namespace }}.svc.cluster.local/0"
diff --git a/charts/apps/apprise/templates/http-service.yaml b/charts/apps/penpot/templates/external-http-service.yaml
similarity index 52%
rename from charts/apps/apprise/templates/http-service.yaml
rename to charts/apps/penpot/templates/external-http-service.yaml
index 15b1989..ffb7a52 100644
--- a/charts/apps/apprise/templates/http-service.yaml
+++ b/charts/apps/penpot/templates/external-http-service.yaml
@@ -1,11 +1,11 @@
 apiVersion: homelab.mortenolsen.pro/v1
-kind: HttpService
+kind: ExternalHttpService
 metadata:
   name: "{{ .Release.Name }}"
 spec:
   environment: "{{ .Values.globals.environment }}"
-  subdomain: "{{ .Values.subdomain }}"
+  subdomain: "{{ .Values.frontend.subdomain }}"
   destination:
-    host: "{{ .Release.Name }}"
+    host: "{{ .Release.Name }}-frontend.{{ .Release.Namespace }}.svc.cluster.local"
     port:
       number: 80
diff --git a/charts/apps/penpot/templates/pvc.yaml b/charts/apps/penpot/templates/pvc.yaml
new file mode 100644
index 0000000..b14a2a8
--- /dev/null
+++ b/charts/apps/penpot/templates/pvc.yaml
@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-assets"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"
diff --git a/charts/apps/penpot/templates/service.yaml b/charts/apps/penpot/templates/service.yaml
new file mode 100644
index 0000000..0b38d09
--- /dev/null
+++ b/charts/apps/penpot/templates/service.yaml
@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-valkey"
+  labels:
+    app: "{{ .Release.Name }}-valkey"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: 6379
+      protocol: TCP
+      name: tcp
+  selector:
+    app: "{{ .Release.Name }}-valkey"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-frontend"
+  labels:
+    app: "{{ .Release.Name }}-frontend"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-frontend"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-backend"
+  labels:
+    app: "{{ .Release.Name }}-backend"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6060
+      targetPort: 6060
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-backend"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}-exporter"
+  labels:
+    app: "{{ .Release.Name }}-exporter"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6061
+      targetPort: 6061
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}-exporter"
diff --git a/charts/apps/penpot/values.yaml b/charts/apps/penpot/values.yaml
new file mode 100644
index 0000000..5175a5d
--- /dev/null
+++ b/charts/apps/penpot/values.yaml
@@ -0,0 +1,21 @@
+frontend:
+  image:
+    repository: penpotapp/frontend
+    tag: latest
+    pullPolicy: IfNotPresent
+  subdomain: penpot
+backend:
+  image:
+    repository: penpotapp/backend
+    tag: latest
+    pullPolicy: IfNotPresent
+exporter:
+  image:
+    repository: penpotapp/exporter
+    tag: latest
+    pullPolicy: IfNotPresent
+valkey:
+  image:
+    repository: valkey/valkey
+    tag: 8.1
+    pullPolicy: IfNotPresent
diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl
index 7dde41a..4b30aa1 100644
--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -133,3 +133,8 @@ releases:
     namespace: prod
     values:
       - values.yaml
+  - name: penpot
+    chart: charts/apps/penpot
+    namespace: prod
+    values:
+      - values.yaml