diff --git a/apps/hydra/linkding/kuztomization.yaml b/apps/hydra/linkding/kuztomization.yaml
index 7a62af4..96e2f9e 100644
--- a/apps/hydra/linkding/kuztomization.yaml
+++ b/apps/hydra/linkding/kuztomization.yaml
@@ -4,7 +4,7 @@ metadata:
   name: linking
   namespace: linkding
 resources:
-- deployment.yaml
-- namespace.yaml
 - srv.yaml
 - pvc.yaml
+- deployment.yaml
+- namespace.yaml
diff --git a/go.mod b/go.mod
index d96848a..37bf9f9 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module danicos.dev/daniel/homelab
 go 1.26.2
 
 require (
-	danicos.dev/daniel/go-kube v1.13.0
+	danicos.dev/daniel/go-kube v1.13.3
 	github.com/cloudnative-pg/api v1.29.0
 	github.com/fatih/color v1.19.0
 	github.com/fluxcd/helm-controller/api v1.5.4
diff --git a/go.sum b/go.sum
index 2f628e5..79811a3 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-danicos.dev/daniel/go-kube v1.13.0 h1:4c6LAkwbiWJ2qXPEPlKF5eD5KAOIN/oSCqgr+rdMykw=
-danicos.dev/daniel/go-kube v1.13.0/go.mod h1:zOhFK+bE4t14yOokp+yqh8Pht1/U102JV/29QoKBjjc=
+danicos.dev/daniel/go-kube v1.13.3 h1:b42L3WEJstDKLKCaAFcgh1Egb915tRlKEYD/hKMiYXE=
+danicos.dev/daniel/go-kube v1.13.3/go.mod h1:zOhFK+bE4t14yOokp+yqh8Pht1/U102JV/29QoKBjjc=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/cloudnative-pg/api v1.29.0 h1:mNx6yJ5qi+Xrjs0NYrUy6V4MlXBkVJxGKwvTJZIuTX4=
diff --git a/infrastructure/hydra/cloud-native-pg/immich-db.yaml b/infrastructure/hydra/cloud-native-pg/immich-db.yaml
new file mode 100644
index 0000000..7b5a048
--- /dev/null
+++ b/infrastructure/hydra/cloud-native-pg/immich-db.yaml
@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: immich-db
+  namespace: cnpg-cluster
+spec:
+  cluster:
+    name: cnpg-cluster
+  name: immich
+  owner: immich
+status: {}
diff --git a/infrastructure/hydra/truenas-csi/kuztomization.yaml b/infrastructure/hydra/truenas-csi/kuztomization.yaml
index c93dc38..5f7bf87 100644
--- a/infrastructure/hydra/truenas-csi/kuztomization.yaml
+++ b/infrastructure/hydra/truenas-csi/kuztomization.yaml
@@ -5,15 +5,15 @@ metadata:
   namespace: truenas-csi
 resources:
 - node-binding.yaml
-- nfs-storage-class.yaml
+- node-deamonset.yaml
 - iscsi-storage-class.yaml
 - controller-deployment.yaml
-- controller-binding.yaml
-- node-deamonset.yaml
-- CSIDriver.yaml
-- config.yaml
-- namespace.yaml
 - controller-service-account.yaml
 - controller-cluster-role.yaml
-- node-service-account.yaml
+- controller-binding.yaml
 - node-cluster-role.yaml
+- CSIDriver.yaml
+- config.yaml
+- nfs-storage-class.yaml
+- namespace.yaml
+- node-service-account.yaml
diff --git a/pkg/cnpg/cluster.go b/pkg/cnpg/cluster.go
index 331d07f..a9117f4 100644
--- a/pkg/cnpg/cluster.go
+++ b/pkg/cnpg/cluster.go
@@ -2,7 +2,6 @@ package cnpg
 
 import (
 	"danicos.dev/daniel/go-kube/pkg/kube"
-	"danicos.dev/daniel/homelab/pkg/immich"
 	"danicos.dev/daniel/homelab/pkg/root"
 
 	kube_cnpg "danicos.dev/daniel/go-kube/pkg/cnpg"
@@ -10,8 +9,9 @@ import (
 	core "k8s.io/api/core/v1"
 )
 
+var cluster_meta = kube.NewMetadata(root.CloudNativePG+"-cluster", root.PGClusterNamespace)
+
 func Cluster() pg.Cluster {
-	meta := kube.NewMetadata(root.CloudNativePG+"-cluster", PGClusterNamespace)
 	spec := pg.ClusterSpec{
 		Instances: 3,
 		StorageConfiguration: pg.StorageConfiguration{
@@ -28,17 +28,11 @@ func Cluster() pg.Cluster {
 					Name:  root.Immich.Name,
 					Login: true,
 					PasswordSecret: &pg.LocalObjectReference{
-						Name: immich.Secret.Name,
+						Name: ImmichPGSecret.Name,
 					},
 				},
 			},
 		},
 	}
-	return kube_cnpg.NewCluster(meta, spec)
+	return kube_cnpg.NewCluster(cluster_meta, spec)
 }
-
-/*
- PG expects username, password
-
- PG Secret
-*/
diff --git a/pkg/cnpg/cnpg.go b/pkg/cnpg/cnpg.go
index 91b1710..4530f76 100644
--- a/pkg/cnpg/cnpg.go
+++ b/pkg/cnpg/cnpg.go
@@ -6,21 +6,21 @@ import (
 	"danicos.dev/daniel/homelab/pkg/root"
 )
 
-var meta kube.Metadata
-var Namespace = kube.Namespace(root.CloudNativePG + "-system")
-var PGClusterNamespace = kube.Namespace(root.CloudNativePG + "-cluster")
+var meta_system kube.Metadata
+var SystemNamespace = kube.Namespace(root.CloudNativePG + "-system")
 
 func init() {
-	meta = kube.NewMetadata(root.CloudNativePG, Namespace)
+	meta_system = kube.NewMetadata(root.CloudNativePG, SystemNamespace)
 }
 
 func Stack() stack.Stack {
 	s := stack.NewStack("cloud-native-pg", map[string]any{
-		"namespace":              Namespace,
-		"cluster-namespace":      PGClusterNamespace,
+		"namespace":              SystemNamespace,
+		"cluster-namespace":      root.PGClusterNamespace,
 		"helm-repository-source": HelmSource(),
 		"helm-release":           HelmRelease(),
 		"pg-cluster":             Cluster(),
+		"immich-db":              ImmichDatabase(),
 	})
 	return s
 }
diff --git a/pkg/cnpg/database.go b/pkg/cnpg/database.go
new file mode 100644
index 0000000..1dd2ac6
--- /dev/null
+++ b/pkg/cnpg/database.go
@@ -0,0 +1,23 @@
+package cnpg
+
+import (
+	kube_cnpg "danicos.dev/daniel/go-kube/pkg/cnpg"
+	"danicos.dev/daniel/go-kube/pkg/kube"
+	"danicos.dev/daniel/homelab/pkg/root"
+	pg "github.com/cloudnative-pg/api/pkg/api/v1"
+	core "k8s.io/api/core/v1"
+)
+
+var ImmichPGSecret = kube_cnpg.NewPGSecret(root.Immich.Name, root.PGClusterNamespace)
+
+func ImmichDatabase() pg.Database {
+	meta := kube.NewMetadata(root.Immich.Name+"-db", root.PGClusterNamespace)
+	spec := pg.DatabaseSpec{
+		Name:  root.Immich.Name,
+		Owner: root.Immich.Name,
+		ClusterRef: core.LocalObjectReference{
+			Name: cluster_meta.Meta().Name,
+		},
+	}
+	return kube_cnpg.NewDatabase(meta, spec)
+}
diff --git a/pkg/cnpg/helm.go b/pkg/cnpg/helm.go
index dac8d8f..4bd0b84 100644
--- a/pkg/cnpg/helm.go
+++ b/pkg/cnpg/helm.go
@@ -16,7 +16,7 @@ func HelmSource() source.HelmRepository {
 		Interval: durHour(root.FLUX_HELM_MONITORING_INTERVAL),
 		URL:      root.HELM_CLOUD_NATIVE_PG_URL,
 	}
-	return flux.NewFluxHelmRepositorySource(meta, spec)
+	return flux.NewFluxHelmRepositorySource(meta_system, spec)
 }
 
 func HelmRelease() helm.HelmRelease {
@@ -30,15 +30,15 @@ func HelmRelease() helm.HelmRelease {
 				Interval: &interval,
 				SourceRef: helm.CrossNamespaceObjectReference{
 					Kind:      flux.MetaHelmRepository.Kind,
-					Name:      meta.Meta().Name,
-					Namespace: Namespace.Name,
+					Name:      meta_system.Meta().Name,
+					Namespace: SystemNamespace.Name,
 				},
 			},
 		},
 		Install: &helm.Install{CRDs: helm.Create},
 		Upgrade: &helm.Upgrade{CRDs: helm.CreateReplace},
 	}
-	return flux.NewFluxHelmRelease(meta, spec)
+	return flux.NewFluxHelmRelease(meta_system, spec)
 }
 
 func durHour(d int64) metav1.Duration {
diff --git a/pkg/enc/immich.go.age b/pkg/enc/immich.go.age
index cd5dcb9..cb020f4 100644
Binary files a/pkg/enc/immich.go.age and b/pkg/enc/immich.go.age differ
diff --git a/pkg/enc/linkding.go.age b/pkg/enc/linkding.go.age
index 4045166..e1ada4a 100644
Binary files a/pkg/enc/linkding.go.age and b/pkg/enc/linkding.go.age differ
diff --git a/pkg/enc/secrets.go.age b/pkg/enc/secrets.go.age
index cff217e..fe722d1 100644
Binary files a/pkg/enc/secrets.go.age and b/pkg/enc/secrets.go.age differ
diff --git a/pkg/enc/truenas.go.age b/pkg/enc/truenas.go.age
index 18edf21..35df204 100644
Binary files a/pkg/enc/truenas.go.age and b/pkg/enc/truenas.go.age differ
diff --git a/pkg/immich/immich.go b/pkg/immich/immich.go
index da798ba..60067df 100644
--- a/pkg/immich/immich.go
+++ b/pkg/immich/immich.go
@@ -7,16 +7,6 @@ import (
 	core "k8s.io/api/core/v1"
 )
 
-var Secret = struct {
-	Name           string
-	DB_UserKey     string
-	DB_PasswordKey string
-}{
-	Name:           root.Immich.Name,
-	DB_UserKey:     "db_username",
-	DB_PasswordKey: "db_password",
-}
-
 var meta kube.Metadata
 var Namespace = kube.Namespace(root.Immich.Name)
 var srv core.Service
diff --git a/pkg/root/services.go b/pkg/root/services.go
index b9ea269..efe2425 100644
--- a/pkg/root/services.go
+++ b/pkg/root/services.go
@@ -1,5 +1,9 @@
 package root
 
+import (
+	"danicos.dev/daniel/go-kube/pkg/kube"
+)
+
 type Service struct {
 	Name              string
 	Image             string
@@ -34,9 +38,10 @@ var Immich = Service{
 }
 
 var (
-	Longhorn      = "longhorn"
-	Monitoring    = "monitoring"
-	CloudNativePG = "cnpg"
+	Longhorn           = "longhorn"
+	Monitoring         = "monitoring"
+	CloudNativePG      = "cnpg"
+	PGClusterNamespace = kube.Namespace(CloudNativePG + "-cluster")
 )
 
 var (