diff --git a/apps/okd4/hedgedoc/credentials.yaml b/apps/okd4/hedgedoc/credentials.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..906c30a3d591ddfc62451329d8b2e5b87ec07a1b
--- /dev/null
+++ b/apps/okd4/hedgedoc/credentials.yaml
@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-token
+    namespace: hedgedoc-demo
+    labels:
+        app: hedgedoc-demo
+type: Opaque
+data:
+    token: ENC[AES256_GCM,data:rWTUboIN98v8aUXSbcf5fgcbk1PMHF46Yl+60bYfj6RHgk82LCP3z6QvXC0rUXiozzMsMRr5P+muHS4eUeP2S3gyd845U8Gd,iv:Sw2LnY+fSCJdh9SoJyayi4sTX5DkqUNXKNHFSyGoXDI=,tag:6cwypkeXYhCAGITSTx4a8A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2021-08-19T18:55:55Z"
+    mac: ENC[AES256_GCM,data:pErau8aeTMduVNgrlME2vQG+OXehC6WsHFLhNZr/Lh90j4Uw3YltzumUwfL+FoWtW2lSW6GCONcZ+kHBqJO3PxU8Q6OlUIoWup1XGOi/jA2QHx3EzVSP3ePXhlp3hEHwE13ZIBLEeQmV5uw/W+OhqMtNIW9FcDxpM7hVlB5tYOo=,iv:W0S3Sz+2Ud//DbtDQGMqNaaUJ4igq8mPX0+7yyEWMoc=,tag:nVNHOTU9NbHtHL4ilkNeLQ==,type:str]
+    pgp:
+        - created_at: "2021-08-13T23:42:09Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1u//sli4/n1ARAAr3Y+LDoHcRSvotgmcWFF34p0OtC4ytAKmyOsK5D9voaf
+            6o96qWD01VA6jQ6Cp4UXhEAdTezfKllGUjMwLHbS30bCtwo8gRznRAPStY3u2rcZ
+            ZgV2QKJBEM0bm3vtO1UT94IbMas4GwvdO8qxltFn0yBy0TQI5E9+js+b2/Cyyy3L
+            wnXT93p4HLBkhMGD43eYxZWW4i+vHrEx6efOahpyIuJqpNo+IiNhCT5TQzqkmfBZ
+            BQImX+EOeMMzvZO3WPUgvxeph+qb7pLOlXP8b0AK1qrZ2/jq1/aF4RwU+Kx/8By4
+            Wmq47P/++IL/I4rLAGKry5xr7eFHH6ltfjfJd48aqiNb0jeKi/TlmAew4RcTMlrF
+            Tfo/lCjQPet7OKHY6Fh7n2vniKej6IeEkaakIbexAhugI14i5/63HjBt8Us/951+
+            1j+QT5jN3BcrvJORCkDetJ2YVaSqPdCnf+9jkOqocLDR31pSvBBvqVAO7DNWYwjk
+            fX9G/HUa3k2SYHd6OP0dWji7qQzjmNWQN2lGvTrCkV6IIyC9h5wEfXZ/1VnP9QSb
+            QDlh6ln5RlKVe+HrhtO4luG8vMXBY78sZ1PC8KPBcS7kz7v0CB7FOMuh06nzby+D
+            nv9nvBwGXIQ3zI3gGYHX3XHmRmPpuXjuEoc5ru70mo8uAz7JgBSnRO5/0xpH9jPS
+            XgGsoCtK7Sh60yN4BVBiTiABHReMSXEjBjuwTtZt89lHST5EswZ4VdhJHcIXPqqj
+            QSipFXeX99C6EoYvFxYq7QOrp4rwt5j7YXP/+9nVDpXMFohN3Zrc2FNAExkc2N0=
+            =OHq8
+            -----END PGP MESSAGE-----
+          fp: 9D02A9AD73EF7F3D5F657AC2B392F6EB325E8C50
+        - created_at: "2021-08-13T23:42:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA7kpg2bgzVHcARAAsydPjUm/G6Vd6b61e3b+NOu4YWp4IMRirA6Shxp2PBM7
+            Ch+K6WXvE6KRwHcJMG66rDj0W9p0kA6tQhC1HkzU/3U+cUnITT/SFOtlywOH+29c
+            7xVEmOcwcvlFYO99fJIb0KslyzRHj3FLYp75VBLGDbVMIgaUqjZwRwO6g9N0MyS3
+            UE2+BXXHzvHSep2ylMd+y6afe+jcEDISF6G8s7xgjdyvdhWfQv5Bbib9laKAnCqr
+            4qKTspa/ePVT+frwwcict85F6EcB5SY37uUwEZ1P+jJDU2S58PfLvdVCKejEzKyh
+            B7N/86jUucYdqOVZsewN99Unrrvq+f7q8EulQ08XcmZ8J7DDOXHqNgUcw/Sfgp4v
+            aVGSeQNUGuHFc7q32K8+7zkbo9FrpIV4RhztKrmKUZy5QrkFxm8NVol1DVzPtlBj
+            GH1Pqcoa7UWeyvBd1/c729Xfu48iP1z70RCu54a6qr01xloJBQBIU6OlsfxpvVif
+            /Dx660riAtr4RKhPQ7sHNO49ibjXqMsche6hB7LR7lt8oPxB8yru270qf/URnvsK
+            b+AmATezCJo6QVLfNH9o6ZY5K+HTy3cJyl0PMtctvNyhaK9ch84/MpHUfckHLbrl
+            Is22TNqkSZoZSeyDzfALU8Z0k4neGRgroyLpc1voNVYBwlnu7RuPuU0SCXx5CKfS
+            5gFntAmaLLls7msGCX1vzSgeQYkVG/j9Vn4L087Os/mW9TbRvvu6p/JuyRTzPgbb
+            J0wF2YgidKqRIAOtMUbupiLkoA0L3xfXhmIOYVcURJ6aneL1vPJOAA==
+            =10Xq
+            -----END PGP MESSAGE-----
+          fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.1
diff --git a/apps/okd4/hedgedoc/issuer.yaml b/apps/okd4/hedgedoc/issuer.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..e1d23857b89060809ff8b24eac0092800621b825
--- /dev/null
+++ b/apps/okd4/hedgedoc/issuer.yaml
@@ -0,0 +1,74 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+    name: letsencrypt-hedgedoc
+    namespace: hedgedoc-demo
+spec:
+    acme:
+        email: ENC[AES256_GCM,data:eBPw+BiEJO67uRLlQf5i9J+phH+TbKiA8BNLfnA2zJ6thR3OeYYLc0p+SB5T9AQ=,iv:TyUprJrFiZJq9gOSN5H631JJIPeJLR4qvcgBXndLblk=,tag:AnXtN2+PggJy5CSSsjgD5A==,type:str]
+        preferredChain: ""
+        privateKeySecretRef:
+            name: letsencrypt
+        server: https://acme-v02.api.letsencrypt.org/directory
+        solvers:
+            - dns01:
+                cloudflare:
+                    apiTokenSecretRef:
+                        key: token
+                        name: cloudflare-token
+                    email: ENC[AES256_GCM,data:QReTFOsJN+Jl/xyzQ6VJM19RXEYhS1bRuzCQTdq5dj1VksTiL/qhWM4=,iv:GceeVKhraaRk3ouDqvZqGA1CYInjDvuOtjuE6QvLbTI=,tag:QuCITSfHEaSAPAiA22zXPA==,type:str]
+              selector:
+                dnsZones:
+                    - ENC[AES256_GCM,data:zSS0UQFlhpejaYd/,iv:GVbpzMXZ6yH76SxKEYM++mrKAbe81i8jyNDF0+vmdNg=,tag:SE1r1/styIH+yf0ydsak0A==,type:str]
+                    - ENC[AES256_GCM,data:1TXIoV+NtXLyqQ==,iv:OoKZP2ncLY6DhZixxDAdluI2Ccb/adylRHgpkVyiyQM=,tag:zOsxhN1CdUPHTpYu6uxmeg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2021-08-19T20:21:53Z"
+    mac: ENC[AES256_GCM,data:3GDd7DIGLBiZS16wLEpTigPm+FpgWnmTFK2u9L267c1j1z25BWJKeg+ZxX3WLxqzs2Fe/1dgl2i1z4r+iIjaXDJr3xnx83uO/nX9Pbkc18Sdaj4DmFSaZ5jH71c9ejzKG1KH8cw/TIKZ80xPhYwMJoOOLEw82nrKydE+aAPdHw8=,iv:N7AYRoMwd/5Om82T4KlU7DtSRtXJUW3ramGHpYR51io=,tag:04KMsRqReiBcMsTB/Wijig==,type:str]
+    pgp:
+        - created_at: "2021-08-13T23:58:48Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1u//sli4/n1AQ/+I794GEYejSDFz4sVZAnBbN1bTpzT1dg4jbEbEtfDg65f
+            9Yqm8F9FENsIucN1XAkQWA0+UDLAHYV4pFOVi/4+LTX0HyOvVgUTSWspuF6JSMum
+            UkfDNLZA4eC0eGqBeF6AaO2qEOxsyrzJz6YtOydevZgegEFnqpk/MdfmvZ29++D9
+            LLgpPIxaRCTVH2wgFc8LOVqTwic7xtlRkT1DDbTI7yoN+KFUALNtFNjZBrIezuaK
+            NoykPInUeBt9VaY6icvb3O+fwdphWh2ws+T/jmVszfaFJFWZDRsG9OTXVAhKPjeU
+            nUmhAUaOr7nWsbYabn38Nxbx+LhrlStyvpTFbwFxcj/gQip4X4q9QOUu/n67E/R5
+            m5XQSWB53vjbZKvpYyxTocUJskneTtS20xuj97/tTS+LjdaBD8E1X2Pr7ztrny5R
+            vQ/PTpA/JProfI8No/HcFnYnXz8ZiRSbnD9ShMevK3CbedmMVRTNIY5y74i/EfV6
+            cAQ1sd4sJ31DXl6YHSuhLl9c3IyN6h+cbaHDjdo0NOcWCXgfcVEu+6l/4TKv5Iqt
+            k61CfQ0OhzRHOWJXcE5IXA4S6hyeLXlzVGWEQm/N1oFuX1/NrSrRI/W/ayFVJTOn
+            cVdqcTVS44I8jPutzWbozy1arFAbQppE2Vyr56yhs/jQpsRBMSkO1zKd/0dzxUnS
+            XAHF7kB8GlQanEFJeXBkzi9ro7UhxkB3ZbtR13sO2/bF/ufiLyASD8FMlZq/0cOh
+            72MIpxYrz84ISBpRPFxAIvAl9FoNbs4XafMKXfAIQH952tOLPZ42xcBZnelq
+            =GaBa
+            -----END PGP MESSAGE-----
+          fp: 9D02A9AD73EF7F3D5F657AC2B392F6EB325E8C50
+        - created_at: "2021-08-13T23:58:48Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA7kpg2bgzVHcARAAZ9I+G7NhI9TYTfIb4MC/r5chkylncqxQgItsooJaGGLw
+            DQOKDs9O8v9IHjGpLK8xv2Oae3VgL/IimkJJ8RmMvlFw8zG5h+9cOt5jwSUw9SE+
+            Vu2kS+sjYy91kOAQR8kufi3gvZnotR0M0fZMaQyW2cUI3p/BVcXUDhPCUjlvE6Y8
+            4tBdCBTP/v5e6AncOijsskMzm0BkIUMYDOcYACOmTuRB7f7Vte3duNPKV3MI3fjZ
+            UUFB3NYNiyP6GsodSjpZ0sXQ+LC2ePsrhpFryRRm1V2PRHhCwJeIvgbGqQTafOml
+            cL61MdvZcZhi4ys2ap4sEWD9lNOorh/3NCJoIv6rCoVtWGqyceliCJUK/7JkqaMB
+            ICh6z5l/6J9eVkoLFVaF+/E7DBWA2Tt3BBGU5+kA07OO3ew5bzk9AMw8hY2fK/DC
+            nxmqf3WsWBulUv0/quOsP7zjjWlr9mnV1Vf98KpLLhtV+9V9Rw10t+EN5JbrhPwT
+            dQYymhgy+E8RA/vxNX+fBeWuqpo9sFPBuBw3ogNVJUw0dXWXusQ1kKMPUCTdVIHS
+            F0X0rRLIzFN/IvmIIlASdekW1DdrAhCbxtStVtn/xvDOF9TRE2/8BZvs9E5Dnu1b
+            oFyBJH0O5DVjI7gRnbI1ntQtDwhvhUcJ0JUZtdiotU7lyMIs+GZaVAhD5qvTNoTS
+            5gEMzmTQCeHUOoKwPndd87s5I8zjqLw6YyQq9D546hglnq4EGg2Fo9grgJN7sdpf
+            efSfct+ElolKYJ4Lfgg4isnkaw8s5HfT0zLXn7mJ5LpyleKNfAdLAA==
+            =CWrw
+            -----END PGP MESSAGE-----
+          fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601
+    encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?)$
+    version: 3.7.1
diff --git a/apps/okd4/hedgedoc/kustomization.yaml b/apps/okd4/hedgedoc/kustomization.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..2a94d5dbe69d1edc9a2f221c61e5630f78f71230
--- /dev/null
+++ b/apps/okd4/hedgedoc/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- credentials.yaml
+- issuer.yaml
+
diff --git a/apps/okd4/kustomization.yaml b/apps/okd4/kustomization.yaml
index 8b8be1fc66903d25847802193e2bec5f4ffbe7e6..c38400d9ea8e4627519e843f1124eb1925090db1 100644
--- a/apps/okd4/kustomization.yaml
+++ b/apps/okd4/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - shivering-isles/shields
   - shivering-isles/blog
   - gitlab/runner
+  - hedgedoc