diff --git a/umami/.gitattributes b/umami/.gitattributes
new file mode 100644
index 0000000..b00dc4d
--- /dev/null
+++ b/umami/.gitattributes
@@ -0,0 +1 @@
+*.env filter=age diff=age merge=age -text
diff --git a/umami/config/umami.env b/umami/config/umami.env
new file mode 100644
index 0000000..772c162
Binary files /dev/null and b/umami/config/umami.env differ
diff --git a/umami/kustomization.yaml b/umami/kustomization.yaml
new file mode 100644
index 0000000..a3dc5a2
--- /dev/null
+++ b/umami/kustomization.yaml
@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: umami
+
+images:
+  - name: umami
+    newName: ghcr.io/umami-software/umami
+    newTag: postgresql-v2.11.2
+
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/instance: icb4dc0de
+    app.kubernetes.io/managed-by: kustomize
+
+resources:
+  - "resources/namespace.yaml"
+  - "resources/deployment.yaml"
+  - "resources/service.yaml"
+  - "resources/http_route.yaml"
+
+configMapGenerator:
+  - name: umami-config
+    envs:
+      - config/umami.env
\ No newline at end of file
diff --git a/umami/resources/deployment.yaml b/umami/resources/deployment.yaml
new file mode 100644
index 0000000..bca7cac
--- /dev/null
+++ b/umami/resources/deployment.yaml
@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: umami
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: umami
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: umami
+    spec:
+      containers:
+      - name: umami
+        image: umami
+        env:
+          - name: DATABASE_URL
+            valueFrom:
+              secretKeyRef:
+                name: default-cluster-pguser-umami
+                key: uri
+        envFrom:
+          - configMapRef:
+              name: umami-config
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "128Mi"
+            cpu: "100m"
+        ports:
+        - containerPort: 3000
+          protocol: TCP
+          name: web
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - arm64
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
\ No newline at end of file
diff --git a/umami/resources/http_route.yaml b/umami/resources/http_route.yaml
new file mode 100644
index 0000000..9d3f39b
--- /dev/null
+++ b/umami/resources/http_route.yaml
@@ -0,0 +1,34 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: umami-http
+spec:
+  parentRefs:
+  - name: contour
+    sectionName: http
+    namespace: projectcontour
+  hostnames:
+  - analytics.icb4dc0.de
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: umami-https
+spec:
+  parentRefs:
+  - name: contour
+    sectionName: https
+    namespace: projectcontour
+  hostnames:
+  - analytics.icb4dc0.de
+  rules:
+  - backendRefs:
+    - name: umami
+      port: 3000
\ No newline at end of file
diff --git a/umami/resources/namespace.yaml b/umami/resources/namespace.yaml
new file mode 100644
index 0000000..dc0519b
--- /dev/null
+++ b/umami/resources/namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: umami
+  labels:
+    prometheus: default
\ No newline at end of file
diff --git a/umami/resources/service.yaml b/umami/resources/service.yaml
new file mode 100644
index 0000000..4c32749
--- /dev/null
+++ b/umami/resources/service.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: umami
+spec:
+  selector:
+    app.kubernetes.io/name: umami
+  ports:
+    - protocol: TCP
+      port: 3000
+      targetPort: 3000
\ No newline at end of file