diff --git a/deploy/manifests/backend-secret.yaml b/deploy/manifests/backend-secret.yaml
new file mode 100644
index 0000000..cd0d074
--- /dev/null
+++ b/deploy/manifests/backend-secret.yaml
@@ -0,0 +1,60 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: movienight-backend
+  namespace: movienight
+spec:
+  secretStoreRef:
+    name: infisical
+    kind: ClusterSecretStore
+
+  target:
+    name: movienight-backend
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        JELLYFIN_INTEGRATION_ENABLED: "true"
+        JELLYFIN_BASE_URL: "http://jellyfin.jellyfin.svc.cluster.local:8096"
+        JELLYFIN_WEB_URL: "{{ .jellyfinWebUrl }}"
+        JELLYFIN_PLUGIN_TOKEN: "{{ .jellyfinPluginToken }}"
+        JELLYFIN_API_KEY: "{{ .jellyfinApiKey }}"
+        OAUTH2_GOOGLE_CLIENT_ID: "{{ .googleClientId }}"
+        OAUTH2_GOOGLE_CLIENT_SECRET: "{{ .googleClientSecret }}"
+        OAUTH2_YANDEX_CLIENT_ID: "{{ .yandexClientId }}"
+        OAUTH2_YANDEX_CLIENT_SECRET: "{{ .yandexClientSecret }}"
+        OAUTH2_VK_CLIENT_ID: "{{ .vkClientId }}"
+        OAUTH2_VK_CLIENT_SECRET: "{{ .vkClientSecret }}"
+
+  data:
+    - secretKey: jellyfinWebUrl
+      remoteRef:
+        key: /movienight/MOVIENIGHT_JELLYFIN_WEB_URL
+    - secretKey: jellyfinPluginToken
+      remoteRef:
+        key: /movienight/MOVIENIGHT_JELLYFIN_PLUGIN_TOKEN
+    - secretKey: jellyfinApiKey
+      remoteRef:
+        key: /movienight/MOVIENIGHT_JELLYFIN_API_KEY
+    - secretKey: googleClientId
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_GOOGLE_CLIENT_ID
+    - secretKey: googleClientSecret
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_GOOGLE_CLIENT_SECRET
+    - secretKey: yandexClientId
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_YANDEX_CLIENT_ID
+    - secretKey: yandexClientSecret
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_YANDEX_CLIENT_SECRET
+    - secretKey: vkClientId
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_VK_CLIENT_ID
+    - secretKey: vkClientSecret
+      remoteRef:
+        key: /movienight/MOVIENIGHT_OAUTH2_VK_CLIENT_SECRET
+
+  refreshInterval: 1h
diff --git a/deploy/manifests/bootstrap-secret.yaml b/deploy/manifests/bootstrap-secret.yaml
new file mode 100644
index 0000000..34d42b9
--- /dev/null
+++ b/deploy/manifests/bootstrap-secret.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: movienight-cnpg-bootstrap
+  namespace: movienight
+spec:
+  secretStoreRef:
+    name: infisical
+    kind: ClusterSecretStore
+
+  target:
+    name: movienight-cnpg-bootstrap
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      type: kubernetes.io/basic-auth
+      data:
+        username: "{{ .dbUsername }}"
+        password: "{{ .dbPassword }}"
+
+  data:
+    - secretKey: dbUsername
+      remoteRef:
+        key: /movienight/MOVIENIGHT_DB_USERNAME
+    - secretKey: dbPassword
+      remoteRef:
+        key: /movienight/MOVIENIGHT_DB_PASSWORD
+
+  refreshInterval: 1h
diff --git a/deploy/manifests/cluster-secret-store.yaml b/deploy/manifests/cluster-secret-store.yaml
new file mode 100644
index 0000000..177cf89
--- /dev/null
+++ b/deploy/manifests/cluster-secret-store.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: infisical
+spec:
+  provider:
+    infisical:
+      hostAPI: https://vault.itqdev.xyz
+      auth:
+        universalAuthCredentials:
+          clientId:
+            name: infisical-secret
+            key: clientId
+            namespace: external-secrets
+          clientSecret:
+            name: infisical-secret
+            key: clientSecret
+            namespace: external-secrets
+      secretsScope:
+        projectSlug: default-c-nay
+        environmentSlug: prod
+        secretsPath: /
diff --git a/deploy/manifests/ns.yaml b/deploy/manifests/ns.yaml
new file mode 100644
index 0000000..b395506
--- /dev/null
+++ b/deploy/manifests/ns.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: movienight