diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a9f8829..454550e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -92,4 +92,9 @@ jobs:
             exit 1
           fi
           cd k8s/overlays/$OVERLAY
-          kustomize build . | kubectl apply --prune -l app=public-wiki --prune-allowlist=core/v1/Namespace --prune-allowlist=apps/v1/Deployment --prune-allowlist=core/v1/Service --prune-allowlist=networking.k8s.io/v1/Ingress -f -
+          if [ "$OVERLAY" = "main" ]; then
+            ENV_LABEL="main"
+          else
+            ENV_LABEL="dev"
+          fi
+          kustomize build . | kubectl apply -f -
diff --git a/k8s/base/deployment.yml b/k8s/base/deployment.yml
index fb3d231..46abe10 100644
--- a/k8s/base/deployment.yml
+++ b/k8s/base/deployment.yml
@@ -2,11 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: public-wiki
-  namespace: wiki
-  labels:
-    app: public-wiki
 spec:
-  replicas: 3 # default, will be overridden by overlays
+  replicas: 1 # default, will be overridden by overlays
   selector:
     matchLabels:
       app: public-wiki
@@ -17,6 +14,6 @@ spec:
     spec:
       containers:
       - name: public-wiki
-        image: IMAGE_TAG # will be replaced by kustomize
+        image: ghcr.io/42core-team/wiki:dev # will be replaced by overlays
         ports:
         - containerPort: 3000
diff --git a/k8s/base/ingress.yml b/k8s/base/ingress.yml
index 99fec47..6238aeb 100644
--- a/k8s/base/ingress.yml
+++ b/k8s/base/ingress.yml
@@ -2,14 +2,17 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: public-wiki-ingress
-  namespace: wiki
-  labels:
-    app: public-wiki
   annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
 spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - PLACEHOLDER_HOST # will be patched in overlays
+    secretName: PLACEHOLDER_TLS_SECRET # will be patched in overlays
   rules:
-  - host: PLACEHOLDER_HOST
+  - host: PLACEHOLDER_HOST # will be patched in overlays
     http:
       paths:
       - path: /
diff --git a/k8s/base/kustomization.yml b/k8s/base/kustomization.yml
index 133a1d5..ab16a5d 100644
--- a/k8s/base/kustomization.yml
+++ b/k8s/base/kustomization.yml
@@ -4,8 +4,4 @@ resources:
   - service.yml
   - ingress.yml
 
-images:
-  - name: public-wiki
-    newName: IMAGE_TAG
-
 namespace: wiki
diff --git a/k8s/base/namespace.yml b/k8s/base/namespace.yml
index adf0a9e..5367c37 100644
--- a/k8s/base/namespace.yml
+++ b/k8s/base/namespace.yml
@@ -2,5 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: wiki
-  labels:
-    app: public-wiki
diff --git a/k8s/base/service.yml b/k8s/base/service.yml
index 229de96..e779618 100644
--- a/k8s/base/service.yml
+++ b/k8s/base/service.yml
@@ -2,9 +2,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: public-wiki
-  namespace: wiki
-  labels:
-    app: public-wiki
 spec:
   selector:
     app: public-wiki
diff --git a/k8s/deployment.yml b/k8s/deployment.yml
deleted file mode 100644
index fb3d231..0000000
--- a/k8s/deployment.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: public-wiki
-  namespace: wiki
-  labels:
-    app: public-wiki
-spec:
-  replicas: 3 # default, will be overridden by overlays
-  selector:
-    matchLabels:
-      app: public-wiki
-  template:
-    metadata:
-      labels:
-        app: public-wiki
-    spec:
-      containers:
-      - name: public-wiki
-        image: IMAGE_TAG # will be replaced by kustomize
-        ports:
-        - containerPort: 3000
diff --git a/k8s/ingress.yml b/k8s/ingress.yml
deleted file mode 100644
index 99fec47..0000000
--- a/k8s/ingress.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: public-wiki-ingress
-  namespace: wiki
-  labels:
-    app: public-wiki
-  annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /
-spec:
-  rules:
-  - host: PLACEHOLDER_HOST
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: public-wiki
-            port:
-              number: 80
diff --git a/k8s/kustomization.yml b/k8s/kustomization.yml
deleted file mode 100644
index 2e58f59..0000000
--- a/k8s/kustomization.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-resources:
-  - namespace.yml
-  - deployment.yml
-  - service.yml
-  - ingress.yml
-images:
-  - name: public-wiki
-    newName: IMAGE_TAG
-
-namespace: wiki
diff --git a/k8s/namespace.yml b/k8s/namespace.yml
deleted file mode 100644
index adf0a9e..0000000
--- a/k8s/namespace.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: wiki
-  labels:
-    app: public-wiki
diff --git a/k8s/overlays/dev/kustomization.yml b/k8s/overlays/dev/kustomization.yml
index b593024..86a2a68 100644
--- a/k8s/overlays/dev/kustomization.yml
+++ b/k8s/overlays/dev/kustomization.yml
@@ -1,8 +1,13 @@
+namePrefix: dev-
+namespace: wiki
+labels:
+  - pairs:
+      app: public-wiki
+      env: dev
+
 resources:
   - ../../base
 
-namespace: wiki
-
 patches:
   - target:
       kind: Deployment
@@ -11,6 +16,9 @@ patches:
       - op: replace
         path: /spec/replicas
         value: 1
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: ghcr.io/42core-team/wiki:dev
   - target:
       kind: Ingress
       name: public-wiki-ingress
@@ -18,8 +26,9 @@ patches:
       - op: replace
         path: /spec/rules/0/host
         value: dev.wiki.coregame.de
-
-images:
-  - name: IMAGE_TAG
-    newName: ghcr.io/42core-team/wiki
-    newTag: dev
+      - op: replace
+        path: /spec/tls/0/hosts/0
+        value: dev.wiki.coregame.de
+      - op: replace
+        path: /spec/tls/0/secretName
+        value: dev-wiki-coregame-de-tls
diff --git a/k8s/overlays/main/kustomization.yml b/k8s/overlays/main/kustomization.yml
index 63214dc..e6d595e 100644
--- a/k8s/overlays/main/kustomization.yml
+++ b/k8s/overlays/main/kustomization.yml
@@ -1,8 +1,11 @@
+namePrefix: main-
+namespace: wiki
+labels:
+  - pairs:
+      app: public-wiki
+      env: main
 resources:
   - ../../base
-
-namespace: wiki
-
 patches:
   - target:
       kind: Deployment
@@ -11,6 +14,9 @@ patches:
       - op: replace
         path: /spec/replicas
         value: 3
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: ghcr.io/42core-team/wiki:main
   - target:
       kind: Ingress
       name: public-wiki-ingress
@@ -18,8 +24,9 @@ patches:
       - op: replace
         path: /spec/rules/0/host
         value: wiki.coregame.de
-
-images:
-  - name: IMAGE_TAG
-    newName: ghcr.io/42core-team/wiki
-    newTag: main
+      - op: replace
+        path: /spec/tls/0/hosts/0
+        value: wiki.coregame.de
+      - op: replace
+        path: /spec/tls/0/secretName
+        value: wiki-coregame-de-tls
diff --git a/k8s/service.yml b/k8s/service.yml
deleted file mode 100644
index 229de96..0000000
--- a/k8s/service.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: public-wiki
-  namespace: wiki
-  labels:
-    app: public-wiki
-spec:
-  selector:
-    app: public-wiki
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 3000