diff --git a/charts/repertory-api/Chart.yaml b/charts/repertory-api/Chart.yaml
new file mode 100644
index 0000000..04d7f88
--- /dev/null
+++ b/charts/repertory-api/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: repertory-api
+description: Repertory API (Flask backend for repertory)
+type: application
+version: 0.1.0
diff --git a/charts/repertory-api/templates/external-secret.yaml b/charts/repertory-api/templates/external-secret.yaml
new file mode 100644
index 0000000..1c946b8
--- /dev/null
+++ b/charts/repertory-api/templates/external-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: repertory-api-secrets
+  namespace: repertory-api
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: repertory-api-secrets
+    template:
+      data:
+        API_KEY: "{{ `{{ .api_key }}` }}"
+        DATABASE_URL: "postgresql://postgres:{{ `{{ .postgres_password }}` }}@postgres.postgres.svc.cluster.local:5432/repertory"
+        CORS_ORIGINS: "{{ .Values.corsOrigins }}"
+  data:
+    - secretKey: api_key
+      remoteRef:
+        key: dumpnet
+        property: repertory_api.api_key
+    - secretKey: postgres_password
+      remoteRef:
+        key: dumpnet
+        property: postgres.password
diff --git a/charts/repertory-api/templates/namespace.yaml b/charts/repertory-api/templates/namespace.yaml
new file mode 100644
index 0000000..8e49d9d
--- /dev/null
+++ b/charts/repertory-api/templates/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: repertory-api
diff --git a/charts/repertory-api/templates/registry-secret.yaml b/charts/repertory-api/templates/registry-secret.yaml
new file mode 100644
index 0000000..dbe8852
--- /dev/null
+++ b/charts/repertory-api/templates/registry-secret.yaml
@@ -0,0 +1,27 @@
+{{- $host := .Values.registry.host }}
+{{- $user := .Values.registry.user }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-registry
+  namespace: repertory-api
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-registry
+    template:
+      engineVersion: v2
+      mergePolicy: Replace
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: '{"auths":{"{{ $host }}":{"username":"{{ $user }}","password":"{{ "{{" }} .registry_token {{ "}}" }}","auth":"{{ "{{" }} printf "{{ $user }}:%s" .registry_token | b64enc {{ "}}" }}"}}}'
+  data:
+    - secretKey: registry_token
+      remoteRef:
+        key: dumpnet
+        property: forgejo.registry_token
diff --git a/charts/repertory-api/templates/repertory-api.yaml b/charts/repertory-api/templates/repertory-api.yaml
new file mode 100644
index 0000000..fec3b4e
--- /dev/null
+++ b/charts/repertory-api/templates/repertory-api.yaml
@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: repertory-api
+  namespace: repertory-api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: repertory-api
+  template:
+    metadata:
+      labels:
+        app: repertory-api
+    spec:
+      imagePullSecrets:
+        - name: forgejo-registry
+      containers:
+        - name: repertory-api
+          image: "{{ .Values.registry.host }}/{{ .Values.registry.user }}/repertory-api:latest"
+          ports:
+            - containerPort: 5000
+          envFrom:
+            - secretRef:
+                name: repertory-api-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 10
+            periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: repertory-api
+  namespace: repertory-api
+spec:
+  selector:
+    app: repertory-api
+  ports:
+    - port: 80
+      targetPort: 5000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: repertory-api
+  namespace: repertory-api
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - repertory-api.{{ .Values.domain }}
+      secretName: repertory-api-tls
+  rules:
+    - host: repertory-api.{{ .Values.domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: repertory-api
+                port:
+                  number: 80
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: repertory-api-migrate
+  namespace: repertory-api
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  ttlSecondsAfterFinished: 120
+  template:
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: forgejo-registry
+      containers:
+        - name: migrate
+          image: "{{ .Values.registry.host }}/{{ .Values.registry.user }}/repertory-api:latest"
+          command: ["uv", "run", "alembic", "upgrade", "head"]
+          envFrom:
+            - secretRef:
+                name: repertory-api-secrets
diff --git a/charts/repertory-api/values.yaml b/charts/repertory-api/values.yaml
new file mode 100644
index 0000000..0a95ca1
--- /dev/null
+++ b/charts/repertory-api/values.yaml
@@ -0,0 +1,5 @@
+domain: dumpnet.chat
+registry:
+  host: forge.keane.sh
+  user: ian
+corsOrigins: "*"
diff --git a/manifests/services/repertory-api.yaml b/manifests/services/repertory-api.yaml
new file mode 100644
index 0000000..3b84a86
--- /dev/null
+++ b/manifests/services/repertory-api.yaml
@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: repertory-api
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      path: charts/repertory-api
+      helm:
+        valueFiles:
+          - $values/values.yaml
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: repertory-api
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+    - group: external-secrets.io
+      kind: ExternalSecret
+      jsonPointers:
+        - /spec/target/template/mergePolicy
+        - /spec/target/template/engineVersion
+        - /spec/target/type
diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars
index a700577..439106f 100644
--- a/terraform/terraform.tfvars
+++ b/terraform/terraform.tfvars
@@ -1,2 +1,2 @@
 hosted_zone_id = "Z068835512G0ZQJ9SJGOI"
-dns_records    = ["argocd", "todo", "git-mcp", "git-mcp-oauth"]
+dns_records    = ["argocd", "todo", "git-mcp", "git-mcp-oauth", "repertory-api"]