diff --git a/.gitignore b/.gitignore
index 3771d07..94e29f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -104,3 +104,4 @@ temp/*
 */k8s/*secret*
 !*/k8s/*secret*.example
 traefik/k8s/local-tls.yaml
+convertx/k8s/config.yaml
diff --git a/convertx/k8s/config.yaml.example b/convertx/k8s/config.yaml.example
new file mode 100644
index 0000000..9e812c3
--- /dev/null
+++ b/convertx/k8s/config.yaml.example
@@ -0,0 +1,16 @@
+# test manifest with docker and k8s config keys mismatch
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: convertx-config
+  namespace: convertx
+data:
+  ACCOUNT_REGISTRATION: "false"
+  HTTP_ALLOWED: "false"
+  ALLOW_UNAUTHENTICAED: "false"
+  AUTO_DELETE_EVERY_N_HOURS: "24"
+  WEBROOT: "/convert"
+  HIDE_HISTORY: "false"
+  LANGUAGE: "en"
+  UNAUTHED_USER_SHARING: "false"
+  MAX_CONVERT_PROCESS: "0"
diff --git a/convertx/k8s/convertx.yaml b/convertx/k8s/convertx.yaml
new file mode 100644
index 0000000..dfdd116
--- /dev/null
+++ b/convertx/k8s/convertx.yaml
@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: convertx-service
+  namespace: convertx
+spec:
+  selector:
+    app: convertx
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: convertx-deployment
+  namespace: convertx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: convertx
+  template:
+    metadata:
+      labels:
+        app: convertx
+    spec:
+      containers:
+        - image: ghcr.io/c4illin/convertx:latest
+          name: convertx
+          envFrom:
+            - configMapRef:
+                name: convertx-config
+            - secretRef:
+                name: convertx-secrets
+          ports:
+            - containerPort: 3000
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "20m"
+            limits:
+              cpu: "700m"
+              memory: "1Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: convertx-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: convertx-pvc
+  namespace: convertx
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/convertx/k8s/ingress.yaml b/convertx/k8s/ingress.yaml
new file mode 100644
index 0000000..e7a0759
--- /dev/null
+++ b/convertx/k8s/ingress.yaml
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-prod
+  namespace: convertx
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`forust.xyz`) && PathPrefix(`/convert`)
+      kind: Rule
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-local
+  namespace: convertx
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`workstation.internal`) && PathPrefix(`/convert`)
+      kind: Rule
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-dev
+  namespace: convertx
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gigaforust.internal`) && PathPrefix(`/convert`)
+      kind: Rule
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    secretName: local-tls
diff --git a/convertx/k8s/namespace.yaml b/convertx/k8s/namespace.yaml
new file mode 100644
index 0000000..7c16137
--- /dev/null
+++ b/convertx/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: convertx
diff --git a/convertx/k8s/secrets.yaml.example b/convertx/k8s/secrets.yaml.example
new file mode 100644
index 0000000..58902a9
--- /dev/null
+++ b/convertx/k8s/secrets.yaml.example
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: convertx-secrets
+type: Opaque
+stringData:
+  jwt-secret: ""