diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml
index 9c1ecbf0..587e6ed9 100644
--- a/deploy/prod/cm.yaml
+++ b/deploy/prod/cm.yaml
@@ -6,20 +6,28 @@ metadata:
 data:
   Caddyfile: |
     {
-        storage redis {
-        }
+    	storage redis {
+    	}
 
-        on_demand_tls {
-            ask http://localhost:5000/
-        }
+    	on_demand_tls {
+    		ask http://localhost:5000/
+    	}
+    }
+
+    xlog.app, *.xlog.app {
+    	tls jeff@rss3.io {
+    		dns cloudflare {env.CF_API_TOKEN}
+    	}
+
+    	reverse_proxy 127.0.0.1:3000
     }
 
     :80, :443 {
-        tls {
-            on_demand
-        }
+    	tls jeff@rss3.io {
+    		on_demand
+    	}
 
-        reverse_proxy 127.0.0.1:3000
+    	reverse_proxy 127.0.0.1:3000
     }
 ---
 apiVersion: v1
diff --git a/deploy/prod/secrets.yaml b/deploy/prod/secrets.yaml
index 64526ae5..2fa1d12c 100644
--- a/deploy/prod/secrets.yaml
+++ b/deploy/prod/secrets.yaml
@@ -22,6 +22,7 @@ stringData:
   CADDY_CLUSTERING_REDIS_USERNAME: ""
   CADDY_CLUSTERING_REDIS_PASSWORD: ${CADDY_CLUSTERING_REDIS_PASSWORD}
   CADDY_CLUSTERING_REDIS_DB: "0"
+  CF_API_TOKEN: ${CF_API_TOKEN}
 kind: Secret
 metadata:
   name: xlog-caddy