diff --git a/.agola/config.yml b/.agola/config.yml
deleted file mode 100644
index e15a79b..0000000
--- a/.agola/config.yml
+++ /dev/null
@@ -1,62 +0,0 @@
-version: v0
-runs:
-  - name: Build
-    tasks:
-      - name: Checkout code
-        runtime:
-          type: pod
-          containers:
-            - image: docker.io/alpine/git
-        steps:
-          - clone:
-              recurse_submodules: true
-          - save_to_workspace:
-              contents:
-                - source_dir: .
-                  dest_dir: .
-                  paths:
-                    - '**'
-      - name: Build
-        runtime:
-          containers:
-            - image: gcr.io/kaniko-project/executor:debug
-        environment:
-          DOCKERAUTH:
-            from_variable: dockerauth            
-        shell: /busybox/sh
-        steps:
-          - restore_workspace:
-              dest_dir: .
-          - run:
-              name: generate docker config
-              command: |
-                cat << EOF > /kaniko/.docker/config.json
-                {
-                  "auths": {
-                    "https://code.icb4dc0.de": { "auth" : "$DOCKERAUTH" }
-                  }
-                }
-                EOF
-          - run:
-              name: Build container image
-              command: |
-                /kaniko/executor \
-                  --destination code.icb4dc0.de/prskr/blog:$AGOLA_GIT_COMMITSHA \
-                  --destination code.icb4dc0.de/prskr/blog:latest \
-                  --context dir:///root/project/ \
-                  --dockerfile /root/project/Dockerfile
-        depends:
-          - Checkout code
-      - name: Deploy
-        runtime:
-          containers:
-            - image: docker.io/alpine/helm
-        service_account_name: agola
-        steps:
-          - restore_workspace:
-              dest_dir: .
-          - run:
-              name: Deploy Helm chart
-              command: helm upgrade --set image.tag=$AGOLA_GIT_COMMITSHA --install --namespace blog blog deploy/helm
-        depends:
-          - Build
\ No newline at end of file
diff --git a/.concourse/tasks/image.yml b/.concourse/tasks/image.yml
index 7e29e68..a4f8d6f 100644
--- a/.concourse/tasks/image.yml
+++ b/.concourse/tasks/image.yml
@@ -24,5 +24,5 @@ run:
     echo "{\"auths\": {\"https://code.icb4dc0.de\": {\"auth\" : \"$(printf '%s:%s' $GITEA_USER $GITEA_TOKEN | base64)\" }}}" > /kaniko/.docker/config.json
     /kaniko/executor \
       --destination code.icb4dc0.de/prskr/blog:latest \
-      --destination code.icb4dc0.de/prskr/blog:$(cat .git/refs/heads/main) \
+      --destination code.icb4dc0.de/prskr/blog:$(cat .git/ref) \
       --context .
\ No newline at end of file
diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index 5a69223..0000000
--- a/.gitmodules
+++ /dev/null
@@ -1,3 +0,0 @@
-[submodule "themes/anubis"]
-	path = themes/anubis
-	url = https://github.com/mitrichius/hugo-theme-anubis.git
diff --git a/Dockerfile b/Dockerfile
index 4125bd5..c2b2f50 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
-FROM docker.io/alpine:latest as builder
+FROM docker.io/golang:1.19-alpine as builder
 
 WORKDIR /tmp
 
-RUN apk add -U --no-cache hugo
+RUN apk add -U --no-cache hugo git
 
 WORKDIR /src
 
diff --git a/config.toml b/config.toml
index 42df1ef..3e6184a 100644
--- a/config.toml
+++ b/config.toml
@@ -1,7 +1,7 @@
 baseURL = 'https://www.icb4dc0.de/'
 languageCode = 'en-us'
 title = 'icb4dc0.de'
-theme = "anubis"
+theme = ['github.com/Mitrichius/hugo-theme-anubis']
 paginate = 10
 enableEmoji = true
 disqusShortname = ""
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index 103994f..7128317 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -5,9 +5,7 @@ metadata:
   labels:
     {{- include "web.labels" . | nindent 4 }}
 spec:
-  {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
-  {{- end }}
   selector:
     matchLabels:
       {{- include "web.selectorLabels" . | nindent 6 }}
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index 3aa3fd2..a712b1a 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -1,7 +1,3 @@
-# Default values for web.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
 replicaCount: 2
 
 image:
@@ -19,13 +15,14 @@ podAnnotations: {}
 podSecurityContext: {}
   # fsGroup: 2000
 
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  runAsUser: 65532
 
 service:
   type: ClusterIP
@@ -33,7 +30,7 @@ service:
 
 ingress:
   enabled: true
-  className: ""
+  className: "traefik"
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
@@ -43,28 +40,14 @@ ingress:
         - path: /
           pathType: ImplementationSpecific
   tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
 
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
-
-autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 100
-  targetCPUUtilizationPercentage: 80
-  # targetMemoryUtilizationPercentage: 80
+resources:
+  limits:
+    cpu: 100m
+    memory: 60Mi
+  requests:
+    cpu: 50m
+    memory: 20Mi
 
 nodeSelector: {}
 
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..a561844
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,5 @@
+module code.icb4dc0.de/prskr/blog
+
+go 1.19
+
+require github.com/Mitrichius/hugo-theme-anubis v0.0.0-20220725170731-d4ba47cd2196 // indirect
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..0aa4f5a
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,2 @@
+github.com/Mitrichius/hugo-theme-anubis v0.0.0-20220725170731-d4ba47cd2196 h1:TzahMQaJXpezO9D2iQHnifGWPUn+41IWgYNBg/wNtQE=
+github.com/Mitrichius/hugo-theme-anubis v0.0.0-20220725170731-d4ba47cd2196/go.mod h1:FKD3NbdsQzL+cXsC3x99XD/t/Rd5EyhDlNBAxQhULbo=
diff --git a/themes/anubis b/themes/anubis
deleted file mode 160000
index 8e61854..0000000
--- a/themes/anubis
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 8e618548dad3553e196aeae334900d9afe76256e