diff --git a/.gitignore b/.gitignore
index dca601d..344744a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,4 +19,10 @@ apps.config
 
 # generated files
 all-apps/lb/Caddyfile
+all-apps/nextcloud/nextcloud_admin_user
+all-apps/nextcloud/nextcloud_admin_password
+all-apps/nextcloud/postgres_db
+all-apps/nextcloud/postgres_user
+all-apps/nextcloud/postgres_password
+all-apps/nextcloud/redis_password
 generated.tfvars
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 82fe702..0154700 100644
--- a/Makefile
+++ b/Makefile
@@ -1,15 +1,39 @@
 TERRAFORM_ENV=production
 
+include apps.config
+
 # .dirstamp plus && $@ is like make magic to get this rule
 # to only run if the contents of all-apps changes
 app/.dirstamp: all-apps/app.service all-apps/docker-compose.yaml $(wildcard all-apps/lb/*) $(wildcard all-apps/nextcloud/*) $(wildcard all-apps/wg-easy/*)
 	rm -Rf app/
 	cp -a all-apps app && touch $@
 
+# Caddy / lb
 all-apps/lb/Caddyfile: apps.config make-caddyfile.sh
 	./make-caddyfile.sh > all-apps/lb/Caddyfile
 
-ignition.json: cl.yaml app/.dirstamp all-apps/lb/Caddyfile
+# Nextcloud
+all-apps/nextcloud/nextcloud_admin_user: apps.config
+	echo "$(NEXTCLOUD_ADMIN_USER)" > $@
+all-apps/nextcloud/nextcloud_admin_password: apps.config
+	echo "$(NEXTCLOUD_ADMIN_PASSWORD)" > $@
+all-apps/nextcloud/postgres_db: apps.config
+	echo "$(NEXTCLOUD_POSTGRES_DB)" > $@
+all-apps/nextcloud/postgres_user: apps.config
+	echo "$(NEXTCLOUD_POSTGRES_USER)" > $@
+all-apps/nextcloud/postgres_password: apps.config
+	echo "$(NEXTCLOUD_POSTGRES_PASSWORD)" > $@
+all-apps/nextcloud/redis_password: apps.config
+	echo "$(NEXTCLOUD_REDIS_PASSWORD)" > $@
+
+ignition.json: cl.yaml app/.dirstamp \
+all-apps/lb/Caddyfile \
+all-apps/nextcloud/nextcloud_admin_user \
+all-apps/nextcloud/nextcloud_admin_password \
+all-apps/nextcloud/postgres_db \
+all-apps/nextcloud/postgres_user \
+all-apps/nextcloud/postgres_password \
+all-apps/nextcloud/redis_password
 	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
 
 generated.tfvars: apps.config make-generated.sh
diff --git a/apps.config.tmpl b/apps.config.tmpl
index 3e44604..96672fa 100644
--- a/apps.config.tmpl
+++ b/apps.config.tmpl
@@ -1,2 +1,8 @@
 ROOT_DOMAIN=example.com
-APP_CONFIGS="nextcloud,nextcloud wg-easy,wg-easy"
\ No newline at end of file
+APP_CONFIGS="nextcloud,nextcloud wg-easy,wg-easy"
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_ADMIN_PASSWORD=
+NEXTCLOUD_POSTGRES_DB=nextcloud
+NEXTCLOUD_POSTGRES_USER=nextcloud
+NEXTCLOUD_POSTGRES_PASSWORD=
+NEXTCLOUD_REDIS_PASSWORD=
\ No newline at end of file