diff --git a/build_sources/lego-config-map.yaml b/build_sources/lego-config-map.yaml
new file mode 100644
index 0000000..3ffb41b
--- /dev/null
+++ b/build_sources/lego-config-map.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+metadata:
+  name: kube-lego
+  namespace: default
+data:
+  # modify this to specify your address
+  lego.email: "sergei.greben@gmail.com"
+  # configure letsencrypt's production api
+  lego.url: "https://acme-v01.api.letsencrypt.org/directory"
+kind: ConfigMap
diff --git a/build_sources/lego-deployment.yaml b/build_sources/lego-deployment.yaml
new file mode 100644
index 0000000..75f0df6
--- /dev/null
+++ b/build_sources/lego-deployment.yaml
@@ -0,0 +1,43 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: kube-lego
+  namespace: default
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: kube-lego
+    spec:
+      containers:
+      - name: kube-lego
+        image: jetstack/kube-lego:0.1.4
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 8080
+        env:
+        - name: LEGO_EMAIL
+          valueFrom:
+            configMapKeyRef:
+              name: kube-lego
+              key: lego.email
+        - name: LEGO_URL
+          valueFrom:
+            configMapKeyRef:
+              name: kube-lego
+              key: lego.url
+        - name: LEGO_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: LEGO_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 1
diff --git a/build_sources/nginx-vhosts.yaml b/build_sources/nginx-vhosts.yaml
index c29e14b..c9e089f 100644
--- a/build_sources/nginx-vhosts.yaml
+++ b/build_sources/nginx-vhosts.yaml
@@ -6,7 +6,15 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: "nginx"
     ingress.kubernetes.io/ssl-redirect: "true"
+    kubernetes.io/tls-acme: "true"
 spec:
+  tls:
+  - secretName: jenkins-tls
+    hosts:
+    - jenkins.com
+  - secretName: bomba-tls
+    hosts:
+    - demo.bomba.by
   rules:
   - host: "jenkins.com"
     http:
@@ -29,7 +37,7 @@ spec:
         backend:
           serviceName: grafana
           servicePort: 8080
-  - host: "demo.com"
+  - host: "demo.bomba.by"
     http:
       paths:
       - path: /