diff --git a/basic/apps/stackspout/dev/gitea-release.yaml b/basic/apps/stackspout/dev/gitea-release.yaml
index f33c05448d8affec8b71320d564a454084d2ce05..81536c042179b20c20d9e7f73e0159666c27912a 100644
--- a/basic/apps/stackspout/dev/gitea-release.yaml
+++ b/basic/apps/stackspout/dev/gitea-release.yaml
@@ -12,7 +12,7 @@ spec:
       sourceRef:
         kind: HelmRepository
         name: gitea
-        namespace: stackspout
+        namespace: flux-system
   interval: 10m
   valuesFrom:
     - kind: ConfigMap
diff --git a/basic/apps/stackspout/dev/gitea-values-configmap.yaml b/basic/apps/stackspout/dev/gitea-values-configmap.yaml
index 1b19d6b08d5c0cdd8f83c8dd5a85b6b29bd50c30..6cdab715d1cdb31f0646c12eca4ba4e4644f1de8 100644
--- a/basic/apps/stackspout/dev/gitea-values-configmap.yaml
+++ b/basic/apps/stackspout/dev/gitea-values-configmap.yaml
@@ -23,7 +23,7 @@ data:
       oauth:
         - name: Stackspin
           provider: 'openidConnect'
-          key: gitea
+          key: "${client_id}"
           secret: "${client_secret}"
           customAuthUrl: "https://sso.ftt.gmbh"
           #autoDiscoverUrl: 'https://gitea.example.com/.well-known/openid-configuration'
diff --git a/basic/apps/stackspout/do/vikunja-release.yaml b/basic/apps/stackspout/do/vikunja-release.yaml
index 98bc0a236b5e94da818f6e16ba90430e262b64fa..f79facf58fcfa2791915bcd97742ec3ce928a3f8 100644
--- a/basic/apps/stackspout/do/vikunja-release.yaml
+++ b/basic/apps/stackspout/do/vikunja-release.yaml
@@ -12,7 +12,7 @@ spec:
       sourceRef:
         kind: HelmRepository
         name: k8s-at-home
-        namespace: stackspout
+        namespace: flux-system
   interval: 10m
   valuesFrom:
     - kind: ConfigMap
diff --git a/basic/clusters/production/apps-kustomization.yaml b/basic/clusters/production/apps-kustomization.yaml
deleted file mode 100644
index b2c9afc004fa2763da1bc54a5e646bf104a5e370..0000000000000000000000000000000000000000
--- a/basic/clusters/production/apps-kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
-kind: Kustomization
-metadata:
-  name: apps
-  namespace: stackspout
-spec:
-  interval: 10m
-  sourceRef:
-    kind: GitRepository
-    name: stackspout
-  path: ./basic/apps
-  prune: true
-  validation: client
diff --git a/basic/clusters/production/gitea-kustomization.yaml b/basic/clusters/production/gitea-kustomization.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..6cee05d753961d05205698126d7c9be2f75b2c82
--- /dev/null
+++ b/basic/clusters/production/gitea-kustomization.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: gitea
+  namespace: stackspout
+spec:
+  interval: 10m
+  timeout: 30m
+  dependsOn:
+    - name: single-sign-on
+  sourceRef:
+    kind: GitRepository
+    name: stackspout
+  path: ./basic/apps/gitea
+  prune: true
+  # TODO what does this mean?
+  #validation: client
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: gitea
+      namespace: stackspout
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: gitea
+      namespace: stackspout
+  postBuild:
+    substituteFrom:
+      #- kind: Secret
+      #  name: stackspin-gitea-variables
+      - kind: Secret
+        name: stackspin-gitea-oauth-variables
+      - kind: Secret
+        name: stackspin-cluster-variables
diff --git a/basic/clusters/production/vikunja-kustomization.yaml b/basic/clusters/production/vikunja-kustomization.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..17eb03ffbdc962be3a41a44a0515cc1eb2ec7c58
--- /dev/null
+++ b/basic/clusters/production/vikunja-kustomization.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: vikunja
+  namespace: stackspout
+spec:
+  interval: 10m
+  timeout: 30m
+  dependsOn:
+    - name: single-sign-on
+  sourceRef:
+    kind: GitRepository
+    name: stackspout
+  path: ./basic/apps/vikunja
+  prune: true
+  # TODO what does this mean?
+  #validation: client
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: vikunja
+      namespace: stackspout
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: vikunja
+      namespace: stackspout
+  postBuild:
+    substituteFrom:
+      #- kind: Secret
+      #  name: stackspin-vikunja-variables
+      - kind: Secret
+        name: stackspin-vikunja-oauth-variables
+      - kind: Secret
+        name: stackspin-cluster-variables
diff --git a/basic/infrastructure/sources/gitea.yaml b/basic/infrastructure/sources/gitea.yaml
index 8ccfa596462e3a6610a02b555d74bfc8eb9c5762..bde72ba823a88ba460abf2ba6ca1e03eaeef8b8c 100644
--- a/basic/infrastructure/sources/gitea.yaml
+++ b/basic/infrastructure/sources/gitea.yaml
@@ -2,7 +2,7 @@ apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: HelmRepository
 metadata:
   name: gitea
-  namespace: stackspout
+  namespace: flux-system
 spec:
   interval: 10m
   url: https://dl.gitea.io/charts/
diff --git a/basic/infrastructure/sources/vikunja.yaml b/basic/infrastructure/sources/k8s-at-home.yaml
similarity index 80%
rename from basic/infrastructure/sources/vikunja.yaml
rename to basic/infrastructure/sources/k8s-at-home.yaml
index 8c1f01b5d1a9e70bc5a930162c31dcaa6f9e454f..e7f578e65113102b4bebeab732fbb1e507b40f2b 100644
--- a/basic/infrastructure/sources/vikunja.yaml
+++ b/basic/infrastructure/sources/k8s-at-home.yaml
@@ -1,8 +1,9 @@
+# For Vikunja
 apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: HelmRepository
 metadata:
   name: k8s-at-home
-  namespace: stackspout
+  namespace: flux-system
 spec:
   interval: 10m
   url: https://k8s-at-home.com/charts/