diff --git a/README.md b/README.md
index 345c0d3..1ed1f5c 100644
--- a/README.md
+++ b/README.md
@@ -161,6 +161,7 @@ flux reconcile kustomization -n cloud-limbosolutions-com full-stack-sync --width
 sops -e ./deploy/whiteboard/whiteboard-secrets.dec.yaml > ./deploy/whiteboard/whiteboard-secrets.yaml
 sops -e ./deploy/onlyoffice/onlyoffice-secrets.dec.yaml > ./deploy/onlyoffice/onlyoffice-secrets.yaml
 sops -e ./deploy/backups/backup-secrets.dec.yaml > ./deploy/backups/backup-secrets.yaml
+sops -e ./deploy/nextcloud/mariadb-secrets.dec.yaml > ./deploy/nextcloud/mariadb-secrets.yaml
 ```
 
 ## internal logs
diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml
index 40f4be4..7ba263b 100644
--- a/deploy/kustomization.yaml
+++ b/deploy/kustomization.yaml
@@ -3,7 +3,7 @@ kind: Kustomization
 namespace: cloud-limbosolutions-com
 resources:
   - global
-  #- nextcloud
+  - nextcloud
   - backups
   - onlyoffice
   - whiteboard
diff --git a/deploy/nextcloud/.env.d/.gitignore b/deploy/nextcloud/.env.d/.gitignore
deleted file mode 100644
index 9621539..0000000
--- a/deploy/nextcloud/.env.d/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-**
-!.gitignore
-!**.example
\ No newline at end of file
diff --git a/deploy/nextcloud/.env.d/nextcloud-mariadb.env.example b/deploy/nextcloud/.env.d/nextcloud-mariadb.env.example
deleted file mode 100644
index 45e5202..0000000
--- a/deploy/nextcloud/.env.d/nextcloud-mariadb.env.example
+++ /dev/null
@@ -1,5 +0,0 @@
-# values bust be equal to nextcloud deployment
-MARIADB_USER=????
-MARIADB_PASSWORD=????
-MARIADB_ROOT_PASSWORD=???
-MARIADB_DATABASE=???
\ No newline at end of file
diff --git a/deploy/nextcloud/kustomization.yaml b/deploy/nextcloud/kustomization.yaml
index f7de7df..d80105c 100644
--- a/deploy/nextcloud/kustomization.yaml
+++ b/deploy/nextcloud/kustomization.yaml
@@ -1,18 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-generatorOptions:
-  disableNameSuffixHash: true
-
-
-secretGenerator:
-- name: nextcloud-mariadb
-  envs:
-    - ./.env.d/nextcloud-mariadb.env
-
 resources:
-  - storage-limbosolutions-com
+  - ./storage-limbosolutions-com
   - ./mariadb-deploy.yaml
+  - ./mariadb-secrets.yaml
   - ./ingress-web-public.yaml
   - ./ingress-web.yaml
   - ./network-policies.yaml
diff --git a/deploy/nextcloud/mariadb-secrets.yaml b/deploy/nextcloud/mariadb-secrets.yaml
new file mode 100644
index 0000000..8917383
--- /dev/null
+++ b/deploy/nextcloud/mariadb-secrets.yaml
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: nextcloud-mariadb
+type: Opaque
+stringData:
+    MARIADB_USER: ENC[AES256_GCM,data:ZTgH+LhkOW2n,iv:sQacYHkhY7ygS0VdwqqoAKySBkoBlesGYe5v2IU0N9U=,tag:JAIULwDjGqA1WZabClcC5A==,type:str]
+    MARIADB_PASSWORD: ENC[AES256_GCM,data:Mm3OgHOsEwpdnAfi,iv:MddfkmKrdjBUjxYTrV8rXLYgZMEG+XgaKd2Ho+eOZnU=,tag:D/El77MC28UpdAa3go0ddQ==,type:str]
+    MARIADB_ROOT_PASSWORD: ENC[AES256_GCM,data:KFPiI/rxScbu0CXa8UCKpA==,iv:YsYVnNY9wfyOVijoImXhtSb5yfnPHRNVynifadmhyf4=,tag:VfxZe/W425NePeG8vEZhqA==,type:str]
+    MARIADB_DATABASE: ENC[AES256_GCM,data:AMw7mI5m+vkl,iv:IjXKN+504X+G/TGrImDzLlt11Tbt+Gv7VJBJVPzi3b0=,tag:LtB7O9aXolzx2CzdvCRGsw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVbVpXamNiQTg5a0M2aUZ1
+            YVd2eXV3a1ZpeTFHbzh2QzVZbWQ1RXlFOFQwCi8rWERKN3E1ZTdxTnFuQklIYS8y
+            ZndzNGxZU3c0dVd3WThCYVY3eVdGYUUKLS0tIGthcU1DTklhc2R2VExiSzhiVktD
+            V1pSWERvQkk1cnFraVFid0JubTJnOGcKKPVuVxho7REIHWgFBFH+sa+Tnw+YtZRp
+            FfTdDwMDKWZnYTTY6ub91QPe00x4/hn2LuqyqRVnQFJwlf0PC8u50A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-07-16T20:39:58Z"
+    mac: ENC[AES256_GCM,data:LiyPHkjaHBvIkblArsoCl3JIsBBC3XsCcREfq+mVkepDUemmUoJQl09FahOaVqkq4PdB77GROo1MNpXPBpuNVZvLt10q+nynhVaU4fh5xIHlxG9pHp4aR4VwMxbjWB5u5lz4TN07awacHYJ23W2AnSPsdMbzTpld9+0wOwjWsOM=,iv:ZbT2hdZyLrtQQ5pvqrpdBb1/OIMYkH6CEH+9HhL7kg4=,tag:Tmudb7V31Z419Dq2N8hp8A==,type:str]
+    version: 3.13.1