diff --git a/apps/nextcloud/application.tf b/apps/nextcloud/application.tf
index a84e67a..2976308 100644
--- a/apps/nextcloud/application.tf
+++ b/apps/nextcloud/application.tf
@@ -12,6 +12,7 @@ data "authentik_group" "readed_groups" {
 resource "authentik_application" "prj_app" {
   name              = "${var.component}"
   slug              = "${var.component}-${var.instance}"
+  protocol_provider = authentik_provider_oauth2.oauth2.id
   meta_launch_url   = format("https://%s.%s", var.sub-domain, var.domain-name)
   meta_icon         = format("https://%s.%s/%s", var.sub-domain, var.domain-name, "apps/theming/favicon")
 }
diff --git a/apps/nextcloud/collabora.tf b/apps/nextcloud/collabora.tf
index 061d135..ef70ce4 100644
--- a/apps/nextcloud/collabora.tf
+++ b/apps/nextcloud/collabora.tf
@@ -121,7 +121,7 @@ resource "kubectl_manifest" "collabora_certificate" {
       labels: ${jsonencode(local.collabora-labels)}
     spec:
         secretName: "${var.instance}-collabora-cert"
-        dnsNames: ${jsonencode(local.dns-collabora)}
+        dnsNames: [${jsonencode(local.dns-collabora)}]
         issuerRef:
           name: "${var.issuer}"
           kind: "ClusterIssuer"
@@ -144,7 +144,7 @@ resource "kubectl_manifest" "collabora_ing" {
       ingressClassName: "${var.ingress-class}"
       rules: ${jsonencode(local.collabora-rules)}
       tls:
-      - hosts: ${jsonencode(local.dns-collabora)}
+      - hosts: ${local.dns-collabora}
         secretName: "${var.instance}-collabora-cert"
   EOF
 }
diff --git a/apps/nextcloud/index.yaml b/apps/nextcloud/index.yaml
index b478686..2ddd273 100644
--- a/apps/nextcloud/index.yaml
+++ b/apps/nextcloud/index.yaml
@@ -6,25 +6,98 @@ metadata:
   name: nextcloud
   description: null
 options:
-  hpa:
+  redis:
     default:
-      avg-cpu: 50
-      max-replicas: 5
-      min-replicas: 1
+      exporter:
+        enabled: true
+        image: quay.io/opstree/redis-exporter:v1.44.0
+      image: quay.io/opstree/redis:v7.0.5
+      storage: 2Gi
     examples:
-    - avg-cpu: 50
-      max-replicas: 5
-      min-replicas: 1
+    - exporter:
+        enabled: true
+        image: quay.io/opstree/redis-exporter:v1.44.0
+      image: quay.io/opstree/redis:v7.0.5
+      storage: 2Gi
     properties:
-      avg-cpu:
-        default: 50
-        type: integer
-      max-replicas:
-        default: 5
-        type: integer
-      min-replicas:
-        default: 1
-        type: integer
+      exporter:
+        default:
+          enabled: true
+          image: quay.io/opstree/redis-exporter:v1.44.0
+        properties:
+          enabled:
+            default: true
+            type: boolean
+          image:
+            default: quay.io/opstree/redis-exporter:v1.44.0
+            type: string
+        type: object
+      image:
+        default: quay.io/opstree/redis:v7.0.5
+        type: string
+      storage:
+        default: 2Gi
+        type: string
+    type: object
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
+  openid-name:
+    default: vynil
+    examples:
+    - vynil
+    type: string
+  apps:
+    default:
+      calendar: false
+      collabora: false
+      contacts: false
+      deck: false
+      groupfolders: true
+      notes: false
+      onlyoffice: false
+      spreed: false
+      tasks: false
+    examples:
+    - calendar: false
+      collabora: false
+      contacts: false
+      deck: false
+      groupfolders: true
+      notes: false
+      onlyoffice: false
+      spreed: false
+      tasks: false
+    properties:
+      calendar:
+        default: false
+        type: boolean
+      collabora:
+        default: false
+        type: boolean
+      contacts:
+        default: false
+        type: boolean
+      deck:
+        default: false
+        type: boolean
+      groupfolders:
+        default: true
+        type: boolean
+      notes:
+        default: false
+        type: boolean
+      onlyoffice:
+        default: false
+        type: boolean
+      spreed:
+        default: false
+        type: boolean
+      tasks:
+        default: false
+        type: boolean
     type: object
   images:
     default:
@@ -189,45 +262,6 @@ options:
             type: string
         type: object
     type: object
-  sub-domain:
-    default: files
-    examples:
-    - files
-    type: string
-  storage:
-    default:
-      accessMode: ReadWriteOnce
-      size: 10Gi
-    examples:
-    - accessMode: ReadWriteOnce
-      size: 10Gi
-    properties:
-      accessMode:
-        default: ReadWriteOnce
-        enum:
-        - ReadWriteOnce
-        - ReadOnlyMany
-        - ReadWriteMany
-        type: string
-      size:
-        default: 10Gi
-        type: string
-    type: object
-  domain:
-    default: your-company
-    examples:
-    - your-company
-    type: string
-  openid-name:
-    default: vynil
-    examples:
-    - vynil
-    type: string
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
   postgres:
     default:
       replicas: 1
@@ -248,66 +282,60 @@ options:
         default: '14'
         type: string
     type: object
-  issuer:
-    default: letsencrypt-prod
+  storage:
+    default:
+      accessMode: ReadWriteOnce
+      size: 10Gi
     examples:
-    - letsencrypt-prod
+    - accessMode: ReadWriteOnce
+      size: 10Gi
+    properties:
+      accessMode:
+        default: ReadWriteOnce
+        enum:
+        - ReadWriteOnce
+        - ReadOnlyMany
+        - ReadWriteMany
+        type: string
+      size:
+        default: 10Gi
+        type: string
+    type: object
+  hpa:
+    default:
+      avg-cpu: 50
+      max-replicas: 5
+      min-replicas: 1
+    examples:
+    - avg-cpu: 50
+      max-replicas: 5
+      min-replicas: 1
+    properties:
+      avg-cpu:
+        default: 50
+        type: integer
+      max-replicas:
+        default: 5
+        type: integer
+      min-replicas:
+        default: 1
+        type: integer
+    type: object
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
     type: string
   ingress-class:
     default: traefik
     examples:
     - traefik
     type: string
-  apps:
-    default:
-      calendar: false
-      collabora: false
-      contacts: false
-      deck: false
-      groupfolders: true
-      notes: false
-      onlyoffice: false
-      spreed: false
-      tasks: false
-    examples:
-    - calendar: false
-      collabora: false
-      contacts: false
-      deck: false
-      groupfolders: true
-      notes: false
-      onlyoffice: false
-      spreed: false
-      tasks: false
-    properties:
-      calendar:
-        default: false
-        type: boolean
-      collabora:
-        default: false
-        type: boolean
-      contacts:
-        default: false
-        type: boolean
-      deck:
-        default: false
-        type: boolean
-      groupfolders:
-        default: true
-        type: boolean
-      notes:
-        default: false
-        type: boolean
-      onlyoffice:
-        default: false
-        type: boolean
-      spreed:
-        default: false
-        type: boolean
-      tasks:
-        default: false
-        type: boolean
-    type: object
   admin:
     default:
       name: nextcloud_admin
@@ -318,39 +346,11 @@ options:
         default: nextcloud_admin
         type: string
     type: object
-  redis:
-    default:
-      exporter:
-        enabled: true
-        image: quay.io/opstree/redis-exporter:v1.44.0
-      image: quay.io/opstree/redis:v7.0.5
-      storage: 2Gi
+  sub-domain:
+    default: files
     examples:
-    - exporter:
-        enabled: true
-        image: quay.io/opstree/redis-exporter:v1.44.0
-      image: quay.io/opstree/redis:v7.0.5
-      storage: 2Gi
-    properties:
-      exporter:
-        default:
-          enabled: true
-          image: quay.io/opstree/redis-exporter:v1.44.0
-        properties:
-          enabled:
-            default: true
-            type: boolean
-          image:
-            default: quay.io/opstree/redis-exporter:v1.44.0
-            type: string
-        type: object
-      image:
-        default: quay.io/opstree/redis:v7.0.5
-        type: string
-      storage:
-        default: 2Gi
-        type: string
-    type: object
+    - files
+    type: string
 dependencies: []
 providers:
   kubernetes: true
diff --git a/apps/nextcloud/onlyoffice.tf b/apps/nextcloud/onlyoffice.tf
index 0e05de4..9615bc0 100644
--- a/apps/nextcloud/onlyoffice.tf
+++ b/apps/nextcloud/onlyoffice.tf
@@ -113,7 +113,7 @@ resource "kubectl_manifest" "onlyoffice_certificate" {
       labels: ${jsonencode(local.onlyoffice-labels)}
     spec:
         secretName: "${var.instance}-onlyoffice-cert"
-        dnsNames: ${jsonencode(local.dns-onlyoffice)}
+        dnsNames: [${jsonencode(local.dns-onlyoffice)}]
         issuerRef:
           name: "${var.issuer}"
           kind: "ClusterIssuer"
@@ -136,7 +136,7 @@ resource "kubectl_manifest" "onlyoffice_ing" {
       ingressClassName: "${var.ingress-class}"
       rules: ${jsonencode(local.onlyoffice-rules)}
       tls:
-      - hosts: ${jsonencode(local.dns-onlyoffice)}
+      - hosts: ${local.dns-onlyoffice}
         secretName: "${var.instance}-onlyoffice-cert"
   EOF
 }