diff --git a/clusters/stand/00-vault/kustomization.yaml b/clusters/stand/00-vault/kustomization.yaml
new file mode 100644
index 0000000..1f13d53
--- /dev/null
+++ b/clusters/stand/00-vault/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/vault/contour-template
diff --git a/clusters/stand/kustomization.yaml b/clusters/stand/kustomization.yaml
index 2102b68..9cc807f 100644
--- a/clusters/stand/kustomization.yaml
+++ b/clusters/stand/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ./flux-system
   - ./helm-repositories.yaml
+  - ./layers.yaml
diff --git a/clusters/stand/layers.yaml b/clusters/stand/layers.yaml
new file mode 100644
index 0000000..5715606
--- /dev/null
+++ b/clusters/stand/layers.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 00-vault
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/00-vault
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
diff --git a/infrastructure/vault/contour-template/kustomization.yaml b/infrastructure/vault/contour-template/kustomization.yaml
new file mode 100644
index 0000000..dd86ecb
--- /dev/null
+++ b/infrastructure/vault/contour-template/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml
diff --git a/infrastructure/vault/contour-template/vault.yaml b/infrastructure/vault/contour-template/vault.yaml
new file mode 100644
index 0000000..09711e9
--- /dev/null
+++ b/infrastructure/vault/contour-template/vault.yaml
@@ -0,0 +1,110 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  install:
+    disableWait: true
+  upgrade:
+    disableWait: true
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: vault
+              name: vault-vault-contour
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: replace
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      namespace: vault
+      imagePullSecrets:
+        - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    server:
+      includeConfigAnnotation: true
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+      dataStorage:
+        size: 10Gi
+        storageClass: ${STORAGE_CLASS}
+      volumes:
+        - name: unseal-keys
+          secret:
+            secretName: vault-unseal-keys
+            optional: true
+            defaultMode: 0440
+      extraContainers:
+        - name: unsealer
+          image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: VAULT_ADDR
+              value: http://127.0.0.1:8200
+          command:
+            - /bin/sh
+            - -c
+            - |
+              while true; do
+                if vault status >/dev/null 2>&1; then
+                  :
+                else
+                  rc=$?
+                  if [ "$rc" -eq 2 ]; then
+                    if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
+                      for k in key1 key2 key3; do
+                        vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
+                      done
+                      if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
+                    else
+                      echo "sealed, keys not mounted"
+                    fi
+                  fi
+                fi
+                sleep 10
+              done
+          volumeMounts:
+            - name: unseal-keys
+              mountPath: /vault/unseal-keys
+              readOnly: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+      ha:
+        replicas: 1
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+            }
+
+            service_registration "kubernetes" {}