diff --git a/k8s/README.md b/k8s/README.md
index 56a15f6..88ca147 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -106,6 +106,48 @@ for i in $( echo $namespaces ) ; do
 done
 ```
 
+## networking with calico
+
+Install calicoctl in cluster
+
+```sh
+kubectl apply -n kube-system -f https://docs.projectcalico.org/manifests/calicoctl.yaml
+```
+
+Then you may send commands like:
+
+```sh
+kubectl exec -ti -n kube-system calicoctl -- /calicoctl get workloadendpoints -n mailu
+```
+
+Or on the server directly:
+
+```sh
+sudo -E /usr/local/bin/calicoctl node checksystem
+```
+
+### metrics
+
+See this [documentation](https://docs.projectcalico.org/maintenance/monitor-component-metrics).
+
+```sh
+kubectl exec -ti -n kube-system calicoctl -- /calicoctl patch felixConfiguration default  --patch '{"spec":{"prometheusMetricsEnabled": true}}'
+kubectl apply -n kube-system -f - <<EOF
+apiVersion: v1
+kind: Service
+metadata:
+  name: felix-metrics-svc
+  namespace: kube-system
+spec:
+  selector:
+    k8s-app: calico-node
+  ports:
+  - port: 9091
+    targetPort: 9091
+EOF
+
+```
+
 ## rstudio
 
 Currently only for one user:
@@ -203,6 +245,8 @@ Using the [mailu helm chart](https://github.com/Mailu/helm-charts/tree/master/ma
 helm repo add mailu https://mailu.github.io/helm-charts/
 helm repo update
 helm upgrade --install mailu mailu/mailu -n mailu -f mailu/mailu.secret.yml
+helm upgrade --install mailu ../../mailu-helm-charts/mailu/ -n mailu -f mailu/mailu.secret.yml
+helm template mailu ../../mailu-helm-charts/mailu/ -n mailu -f mailu/mailu.secret.yml
 ```
 
 ### troubleshooting
@@ -213,6 +257,40 @@ Test imap from console:
 openssl s_client -crlf -connect moritzgraf.de:993
 ```
 
+### migrate
+
+```sh
+# backup on moritzgraf.de
+ssh moritzgraf.de "sudo su - docker -c 'cd /home/docker/mailu && docker-compose stop' && sudo su - root -c 'cd /home/docker && tar czvf mailu.tar.gz ./mailu && mv mailu.tar.gz /home/moritz/ && chown moritz. /home/moritz/mailu.tar.gz' && scp mailu.tar.gz haumdaucher.de:/home/moritz/"
+# terraform change
+cd ../terraform && terraform apply
+# helm apply
+cd ../k8s
+helm upgrade --install mailu mailu/mailu -n mailu -f mailu/mailu.secret.yml
+# apply mailu and scale all to 0
+kc mailu
+k scale --replicas=0 --all=true deploy
+# apply restore pod
+k apply -f mailu/restore.yaml
+# copy tar gz
+ssh one
+k cp mailu.tar.gz restore:/data/
+# exec to pod and arrange persistence
+k exec -it restore -- bash
+cd /data
+tar xzvf mailu.tar.gz
+mv mailu/data/* ./admin/
+mv mailu/dkim/* ./dkim/
+mv mailu/mail/* ./dovecotmail/
+chown -R mail:man ./dovecotmail
+# scale up
+k scale --replicas=1 --all=true deploy
+```
+
+Checks:
+* browser mail.moritzgraf.de & login
+* browser mail.moritzgraf.de/admin
+
 ## minio
 
 ```sh
diff --git a/terraform/ovh.tf b/terraform/ovh.tf
index 0d3b91d..5e5e16a 100644
--- a/terraform/ovh.tf
+++ b/terraform/ovh.tf
@@ -120,15 +120,15 @@ resource "ovh_domain_zone_record" "mail_moritzgraf" {
     subdomain = "mail"
     fieldtype = "A"
     ttl = local.ttl
-    #target = "91.121.64.43" # old
-    target = "91.121.84.190" # new
+    target = "91.121.64.43" # old
+    #target = "91.121.84.190" # new
 }
 resource "ovh_domain_zone_record" "moritzgraf" {
     zone = "moritzgraf.de"
     fieldtype = "A"
     ttl = local.ttl
-    #target = "91.121.64.43" # old
-    target = "91.121.84.190" # new
+    target = "91.121.64.43" # old
+    #target = "91.121.84.190" # new
 }
 
 
diff --git a/terraform/terraform.tfstate b/terraform/terraform.tfstate
index 7e6bce6..1547d98 100644
--- a/terraform/terraform.tfstate
+++ b/terraform/terraform.tfstate
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "0.12.24",
-  "serial": 134,
+  "serial": 150,
   "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
   "outputs": {},
   "resources": [
@@ -517,7 +517,7 @@
           "schema_version": 0,
           "attributes": {
             "fieldtype": "CNAME",
-            "id": "5113532219",
+            "id": "5122534663",
             "subdomain": "www",
             "target": "krassescheisse.de.",
             "ttl": 60,
@@ -539,7 +539,7 @@
             "fieldtype": "A",
             "id": "5106870709",
             "subdomain": "mail",
-            "target": "91.121.84.190",
+            "target": "91.121.64.43",
             "ttl": 60,
             "zone": "moritzgraf.de"
           },
@@ -559,7 +559,7 @@
             "fieldtype": "A",
             "id": "5118726203",
             "subdomain": "",
-            "target": "91.121.84.190",
+            "target": "91.121.64.43",
             "ttl": 60,
             "zone": "moritzgraf.de"
           },
diff --git a/terraform/terraform.tfstate.backup b/terraform/terraform.tfstate.backup
index f2c9e1b..9de3743 100644
--- a/terraform/terraform.tfstate.backup
+++ b/terraform/terraform.tfstate.backup
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "0.12.24",
-  "serial": 131,
+  "serial": 147,
   "lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
   "outputs": {},
   "resources": [
@@ -517,7 +517,7 @@
           "schema_version": 0,
           "attributes": {
             "fieldtype": "CNAME",
-            "id": "5113532219",
+            "id": "5122534663",
             "subdomain": "www",
             "target": "krassescheisse.de.",
             "ttl": 60,
@@ -539,7 +539,7 @@
             "fieldtype": "A",
             "id": "5106870709",
             "subdomain": "mail",
-            "target": "91.121.64.43",
+            "target": "91.121.84.190",
             "ttl": 60,
             "zone": "moritzgraf.de"
           },
@@ -559,7 +559,7 @@
             "fieldtype": "A",
             "id": "5118726203",
             "subdomain": "",
-            "target": "91.121.64.43",
+            "target": "91.121.84.190",
             "ttl": 60,
             "zone": "moritzgraf.de"
           },