diff --git a/.github/dev.env b/.github/dev.env
new file mode 100644
index 00000000..b8748f8a
--- /dev/null
+++ b/.github/dev.env
@@ -0,0 +1,2 @@
+SOCIALGOUV_BASE_DOMAIN=dev.fabrique.social.gouv.fr
+RANCHER_PROJECT_ID=c-gjtkk:p-94v9x
diff --git a/.github/preprod.env b/.github/preprod.env
new file mode 100644
index 00000000..b8748f8a
--- /dev/null
+++ b/.github/preprod.env
@@ -0,0 +1,2 @@
+SOCIALGOUV_BASE_DOMAIN=dev.fabrique.social.gouv.fr
+RANCHER_PROJECT_ID=c-gjtkk:p-94v9x
diff --git a/.github/prod.env b/.github/prod.env
new file mode 100644
index 00000000..2d98539b
--- /dev/null
+++ b/.github/prod.env
@@ -0,0 +1,2 @@
+SOCIALGOUV_BASE_DOMAIN=fabrique.social.gouv.fr
+RANCHER_PROJECT_ID=c-5rj5b:p-tgccq
diff --git a/.github/renovate.json b/.github/renovate.json
index 0e5c28fe..ea001817 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,4 +1,4 @@
 {
   "$schema": "http://json.schemastore.org/renovate",
-  "extends": ["github>SocialGouv/renovate-config:light", ":automergeAll"]
+  "extends": ["github>SocialGouv/renovate-config:light"]
 }
diff --git a/.github/stale.yml b/.github/stale.yml
deleted file mode 100644
index 70a8a1b1..00000000
--- a/.github/stale.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 60
-
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - help wanted
-
-# Label to use when marking an issue as stale
-staleLabel: wontfix
-
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs.
-  Mark it with `help wanted` label if don't want it to be considered stale.
-  Thank you for your contributions.
-
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: >
-  This issue has been automatically closed because no further activity occurs...
-  Feel free to re-open it :robot:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d2f56a98..0378f8c7 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,7 +18,7 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ master ]
   schedule:
-    - cron: '18 6 * * 2'
+    - cron: '22 3 * * 4'
 
 jobs:
   analyze:
diff --git a/.github/workflows/deactivate.yaml b/.github/workflows/deactivate.yaml
new file mode 100644
index 00000000..74587d42
--- /dev/null
+++ b/.github/workflows/deactivate.yaml
@@ -0,0 +1,14 @@
+name: 🇫🇷
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  bury_review_env:
+    name: 🪦 Review
+    runs-on: ubuntu-latest
+    steps:
+      - uses: SocialGouv/actions/k8s-funeral@master
+        with:
+          kube-config: ${{ secrets.KUBECONFIG }}
diff --git a/.github/workflows/gitlab.yaml b/.github/workflows/gitlab.yaml
deleted file mode 100644
index 5ffceccd..00000000
--- a/.github/workflows/gitlab.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: 🇫🇷
-
-on: 
-  - push
-  - delete
-
-jobs:
-  mirror_gitlab:
-    name: 🪞 Gitlab
-    runs-on: ubuntu-latest
-    steps:
-    - uses: SocialGouv/actions/mirror-gitlab@master
-      with:
-        project: SocialGouv/sample-next-app/sample-next-app
-        token: ${{ secrets.SOCIALGROOVYBOT_GITLAB_TOKEN }}
diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
new file mode 100644
index 00000000..bdaf6aa8
--- /dev/null
+++ b/.github/workflows/production.yml
@@ -0,0 +1,98 @@
+name: Production
+
+on:
+  push:
+    tags:
+      - v*
+
+concurrency:
+  group: preproduction
+  cancel-in-progress: true
+
+jobs:
+  ##############################################################################
+  ## BUILD AND REGISTER DOCKER IMAGE
+  ##############################################################################
+  register:
+    name: Build & Register docker images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get project name
+        run: |
+          echo "project=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
+
+      - name: Application
+        uses: SocialGouv/actions/autodevops-build-register@master
+        with:
+          project: ${{ env.project }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          imageName: ${{ env.project }}/app
+
+      - name: Hasura
+        uses: SocialGouv/actions/autodevops-build-register@master
+        with:
+          project: ${{ env.project }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          imageName: ${{ env.project }}/hasura
+          dockercontext: ./hasura
+          dockerfile: ./hasura/Dockerfile
+
+  ##############################################################################
+  ## GENERATE PREPRODUCTION MANIFESTS
+  ##############################################################################
+  manifests:
+    name: Preproduction manifests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Use k8s manifests generation
+        uses: SocialGouv/actions/k8s-manifests@master
+        with:
+          environment: "preprod"
+
+  ##############################################################################
+  ## DEPLOY PREPRODUCTION APPLICATION
+  ##############################################################################
+  deploy-preprod:
+    name: Deploy preproduction
+    runs-on: ubuntu-latest
+    needs: [register, manifests]
+    environment:
+      name: preproduction
+      url: https://sample-next-app-preprod.${{ env.SOCIALGOUV_BASE_DOMAIN }}
+    steps:
+      - name: Use autodevops deployment
+        uses: SocialGouv/actions/autodevops-deploy@master
+        with:
+          environment: "preprod"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+
+  ##############################################################################
+  ## GENERATE PRODUCTION MANIFESTS
+  ##############################################################################
+  manifests-prod:
+    name: Production manifests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Use k8s manifests generation
+        uses: SocialGouv/actions/k8s-manifests@master
+        with:
+          environment: "prod"
+
+  ##############################################################################
+  ## DEPLOY PRODUCTION APPLICATION
+  ##############################################################################
+  deploy-prod:
+    name: Deploy production
+    runs-on: ubuntu-latest
+    needs: [deploy-preprod, manifests-prod]
+    environment:
+      name: production
+      url: https://sample-next-app.${{ env.SOCIALGOUV_BASE_DOMAIN }}
+    steps:
+      - name: Use autodevops deployment
+        uses: SocialGouv/actions/autodevops-deploy@master
+        with:
+          environment: "prod"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          kubeconfig: ${{ secrets.KUBECONFIG }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..83ce9530
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,27 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [master, alpha, beta, next]
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Semantic Release
+        uses: cycjimmy/semantic-release-action@v2
+        with:
+          semantic_version: 17
+          extra_plugins: |
+            @semantic-release/changelog@5.0.1
+            @semantic-release/git@9.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
new file mode 100644
index 00000000..89d3dfd6
--- /dev/null
+++ b/.github/workflows/review.yml
@@ -0,0 +1,67 @@
+name: Review
+
+on:
+  push:
+    branches:
+      - "**"
+    tags-ignore:
+      - v*
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.ref }}
+
+jobs:
+  ##############################################################################
+  ## BUILD AND REGISTER DOCKER IMAGES
+  ##############################################################################
+  register:
+    name: Build & Register
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get project name
+        run: |
+          echo "project=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
+
+      - name: Application
+        uses: SocialGouv/actions/autodevops-build-register@master
+        with:
+          project: ${{ env.project }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          imageName: ${{ env.project }}/app
+
+      - name: Hasura
+        uses: SocialGouv/actions/autodevops-build-register@master
+        with:
+          project: ${{ env.project }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          imageName: ${{ env.project }}/hasura
+          dockercontext: ./hasura
+          dockerfile: ./hasura/Dockerfile
+
+  ##############################################################################
+  ## GENERATE KUBERNETES MANIFESTS
+  ##############################################################################
+  manifests:
+    name: Generate k8s manifests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Use k8s manifests generation
+        uses: SocialGouv/actions/k8s-manifests@master
+        with:
+          environment: "dev"
+
+  ##############################################################################
+  ## DEPLOY APPLICATION OVER KUBERNETES
+  ##############################################################################
+  deploy:
+    name: Deploy application
+    runs-on: ubuntu-latest
+    needs: [register, manifests]
+    steps:
+      - name: Use autodevops deployment
+        uses: SocialGouv/actions/autodevops-deploy@master
+        with:
+          environment: "dev"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          kubeconfig: ${{ secrets.KUBECONFIG }}
diff --git a/.github/workflows/sync-autodevops-branch.yml b/.github/workflows/sync-autodevops-branch.yml
deleted file mode 100644
index a929a9d0..00000000
--- a/.github/workflows/sync-autodevops-branch.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Sync the `autodevops-test` branch
-
-on:
-  - push
-
-jobs:
-  sync_master:
-    if: |
-      github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Sync `autodevops-master` branch with master
-        run: |
-          git config user.name "Social Groovy Bot"
-          git config user.email "45039513+SocialGroovyBot@users.noreply.github.com"
-
-          git checkout -b autodevops-master
-          sed -i -e 's/ref: .*/ref: master/' .gitlab-ci.yml
-          git commit -a -m "ci(gitlab): test autodevops master ref"
-      - name: Push `autodevops-master` branch
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: 'ci-test-autodevops-master'
-          force: true
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 00000000..850ffc1d
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,37 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - '**'
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.head_ref }}
+
+jobs:
+
+  ##############################################################################
+  ## TEST APPLICATION
+  ##############################################################################
+  test:
+    name: Test application
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Node setup
+      uses: actions/setup-node@v2
+      with:
+        node-version: '14'
+
+    - name: Yarn cache setup
+      uses: c-hive/gha-yarn-cache@v1
+
+    - name: Install dependencies
+      run: yarn --frozen-lockfile --prefer-offline
+
+    - name: Run tests
+      run: yarn test --coverage
diff --git a/.github/workflows/workflows-src.yml b/.github/workflows/workflows-src.yml
deleted file mode 100644
index 30a6d926..00000000
--- a/.github/workflows/workflows-src.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-jobs:
-  workflows-src-to-workflows:
-    name: Convert
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-        with:
-          branch: "${{ steps.comment.outputs.branch }}"
-          token: "${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}"
-      - uses: "dhall-lang/setup-dhall@35fa9f606036a9b7138bcbc4d519021fdda7bd5e"
-        with:
-          version: "1.38.1"
-      - name: Github Actions Dhall To Yaml
-        run: |
-          find .github/workflows-src -name '*.dhall' -type f -print0 |
-            sort -buz |
-            xargs -0 -i sh -xc '
-              dhall lint --inplace {} --check &&
-              dhall-to-yaml --file {} --output .github/workflows/$(basename {} .dhall).yaml
-            '
-      - env:
-          GITHUB_TOKEN: "${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}"
-        name: Commit changes
-        uses: "EndBug/add-and-commit@a3adef035a1381dcf888c90b847240e2ddb9e008"
-        with:
-          add: ".github/workflows/"
-          author_email: "${{ secrets.SOCIALGROOVYBOT_EMAIL }}"
-          author_name: "${{ secrets.SOCIALGROOVYBOT_NAME }}"
-          branch: "${{ steps.comment.outputs.branch }}"
-          message: "chore(:robot:): workflows-src to workflows"
-name: Github Actions Dhall
-on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - ".github/workflows/workflows-src.yml"
diff --git "a/.github/workflows/\360\237\207\253\360\237\207\267.yaml" "b/.github/workflows/\360\237\207\253\360\237\207\267.yaml"
deleted file mode 100644
index fdc8286f..00000000
--- "a/.github/workflows/\360\237\207\253\360\237\207\267.yaml"
+++ /dev/null
@@ -1,14 +0,0 @@
-name: 🇫🇷
-
-on:
-  pull_request:
-    types: [ closed ]
-    
-jobs:
-  bury_review_env:
-    name: 🪦 Review
-    runs-on: ubuntu-latest
-    steps:
-    - uses: SocialGouv/actions/k8s-funeral@master
-      with:
-        kube-config: ${{ secrets.KUBE_CONFIG }}
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
deleted file mode 100644
index 01627814..00000000
--- a/.gitlab-ci.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-include:
-  - project: SocialGouv/gitlab-ci-yml
-    file: /autodevops.yml
-    ref: v23.2.1
-
-variables:
-  AUTO_DEVOPS_RELEASE_AUTO: "🔖"
-  AUTO_DEVOPS_PRODUCTION_AUTO: "🚀"
-  AUTO_DEVOPS_ENABLE_KAPP: "🚀"
-  AUTO_DEVOPS_KANIKO: "🕹️"
-  PROJECT_PATH: "socialgouv/sample-next-app" # for notify
-
-Register Kaniko image:
-  extends: .autodevops_register_kaniko_image
-  variables:
-    IMAGE_NAME: app
-
-Register hasura image:
-  extends: .autodevops_register_kaniko_image
-  dependencies: []
-  needs: []
-  variables:
-    DOCKER_BUILD_ARGS: >-
-      --dockerfile=hasura/Dockerfile
-    CONTEXT: hasura
-    IMAGE_NAME: hasura
-
-E2E test on deployed branch:
-  stage: Deploy
-  image: ghcr.io/socialgouv/docker/puppeteer:6.38.6
-  allow_failure: true
-  except:
-    refs:
-      # Don't run on release
-      - tags
-      - master
-    variables:
-      # Don't run when deploying in production
-      - $PRODUCTION
-      # Don't run when releasing
-      - $RELEASE
-  environment:
-    name: ${CI_COMMIT_REF_NAME}${AUTO_DEVOPS_DEV_ENVIRONMENT_NAME}
-    url: https://${CI_ENVIRONMENT_SLUG}-${CI_PROJECT_NAME}.${KUBE_INGRESS_BASE_DOMAIN}
-  cache:
-    key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
-    paths:
-      - optional/e2e/runners/puppeteer/node_modules
-      - $CI_PROJECT_DIR/.yarn
-  before_script:
-    - export CODECEPT_BASEURL=${CI_ENVIRONMENT_URL}
-    - cd ./optional/e2e/runners/puppeteer
-    - |-
-      retry=180;
-      while
-        ! wget -q -O - "$@" "${CODECEPT_BASEURL}"  | grep -i "Welcome" &&
-        [[ $(( retry-- )) -gt 0 ]];
-      do echo "Waiting for ${CODECEPT_BASEURL} to be ready" ; sleep 3 ; done ;
-      [ "$retry" -eq "-1" ] && exit 1
-  script:
-    - yarn config set cache-folder $CI_PROJECT_DIR/.yarn
-    - yarn --frozen-lockfile
-    - "echo CODECEPT_BASEURL: $CODECEPT_BASEURL"
-    - yarn test
diff --git a/.k8s/__tests__/__snapshots__/kosko generate --env dev.ts.snap b/.k8s/__tests__/__snapshots__/kosko generate --env dev.ts.snap
index cb9ee117..dc75c54f 100644
--- a/.k8s/__tests__/__snapshots__/kosko generate --env dev.ts.snap	
+++ b/.k8s/__tests__/__snapshots__/kosko generate --env dev.ts.snap	
@@ -19,6 +19,7 @@ metadata:
   labels:
     azure-pg-admin-user: sample-next-app
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -36,10 +37,10 @@ metadata:
   labels:
     app: pgweb
     application: master-dev42-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
-    component: pgweb
   name: pgweb
   namespace: sample-next-app-85-master-dev2
 spec:
@@ -58,10 +59,10 @@ spec:
       labels:
         app: pgweb
         application: master-dev42-sample-next-app
+        component: pgweb
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
-        component: pgweb
     spec:
       containers:
         - image: sosedoff/pgweb:0.11.8
@@ -101,15 +102,15 @@ spec:
             periodSeconds: 5
           envFrom:
             - secretRef:
-                name: azure-pg-user-master-dev42
+                name: azure-pg-user-master
       initContainers:
         - env:
             - name: WAIT_FOR_RETRIES
               value: '24'
           envFrom:
             - secretRef:
-                name: azure-pg-user-master-dev42
-          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.39.1
+                name: azure-pg-user-master
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
           imagePullPolicy: Always
           name: wait-for-postgres
           resources:
@@ -126,6 +127,7 @@ metadata:
   labels:
     app: pgweb
     application: master-dev42-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -159,6 +161,7 @@ metadata:
   labels:
     app: pgweb
     application: master-dev42-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -193,6 +196,7 @@ metadata:
   labels:
     app: app
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -214,13 +218,13 @@ spec:
       labels:
         app: app
         application: master-dev42-sample-next-app
+        component: master-dev42-sample-next-app
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
     spec:
       containers:
-        - image: >-
-            harbor.fabrique.social.gouv.fr/fabrique/app:0123456789abcdefghijklmnopqrstuvwxyz0123
+        - image: 'ghcr.io/socialgouv/sample-next-app/app:'
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -256,10 +260,29 @@ spec:
               port: http
             periodSeconds: 5
           envFrom:
+            - secretRef:
+                name: azure-pg-user-master
             - secretRef:
                 name: app-sealed-secret
             - configMapRef:
                 name: app-configmap
+      initContainers:
+        - env:
+            - name: WAIT_FOR_RETRIES
+              value: '24'
+          envFrom:
+            - secretRef:
+                name: azure-pg-user-master
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
+          imagePullPolicy: Always
+          name: wait-for-postgres
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 5m
+              memory: 16Mi
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -275,6 +298,7 @@ metadata:
   name: app-sealed-secret
   labels:
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -306,6 +330,7 @@ spec:
       name: app-sealed-secret
       labels:
         application: master-dev42-sample-next-app
+        component: master-dev42-sample-next-app
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
@@ -322,6 +347,7 @@ metadata:
     app.gitlab.com/env.name: master-dev42
   labels:
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -339,6 +365,7 @@ metadata:
   labels:
     app: app
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -372,6 +399,7 @@ metadata:
   labels:
     app: app
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -406,6 +434,7 @@ metadata:
   labels:
     app: hasura
     application: master-dev42-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -427,13 +456,13 @@ spec:
       labels:
         app: hasura
         application: master-dev42-sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
     spec:
       containers:
-        - image: >-
-            harbor.fabrique.social.gouv.fr/fabrique/hasura:0123456789abcdefghijklmnopqrstuvwxyz0123
+        - image: 'ghcr.io/socialgouv/sample-next-app/hasura:'
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -470,7 +499,7 @@ spec:
             periodSeconds: 5
           envFrom:
             - secretRef:
-                name: azure-pg-user-master-dev42
+                name: azure-pg-user-master
             - secretRef:
                 name: hasura-sealed-secret
             - configMapRef:
@@ -481,8 +510,8 @@ spec:
               value: '24'
           envFrom:
             - secretRef:
-                name: azure-pg-user-master-dev42
-          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.39.1
+                name: azure-pg-user-master
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
           imagePullPolicy: Always
           name: wait-for-postgres
           resources:
@@ -507,6 +536,7 @@ metadata:
   name: hasura-sealed-secret
   labels:
     application: master-dev42-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -532,6 +562,7 @@ spec:
       name: hasura-sealed-secret
       labels:
         application: master-dev42-sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
@@ -549,6 +580,7 @@ metadata:
     app.gitlab.com/env.name: master-dev42
   labels:
     application: master-dev42-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -568,6 +600,7 @@ metadata:
   labels:
     app: hasura
     application: master-dev42-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -588,41 +621,6 @@ spec:
     app: hasura
   type: ClusterIP
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    kapp.k14s.io/disable-default-ownership-label-rules: ''
-    kapp.k14s.io/disable-default-label-scoping-rules: ''
-    app.gitlab.com/app: socialgouv-sample-next-app
-    app.gitlab.com/env: master-dev42
-    app.gitlab.com/env.name: master-dev42
-  labels:
-    app: hasura
-    application: master-dev42-sample-next-app
-    owner: sample-next-app
-    team: sample-next-app
-    cert: wildcard
-  name: hasura
-  namespace: sample-next-app-85-master-dev2
-spec:
-  rules:
-    - host: hasura-master-dev42-sample-next-app.dev42.fabrique.social.gouv.fr
-      http:
-        paths:
-          - backend:
-              service:
-                name: hasura
-                port:
-                  name: http
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - hasura-master-dev42-sample-next-app.dev42.fabrique.social.gouv.fr
-      secretName: wildcard-crt
----
 apiVersion: batch/v1
 kind: Job
 spec:
@@ -634,17 +632,17 @@ spec:
             - create-db-user
           env:
             - name: NEW_DB_NAME
-              value: autodevops_master-dev42
+              value: autodevops_master
             - name: NEW_USER
-              value: user_master-dev42
+              value: user_master
             - name: NEW_PASSWORD
-              value: password_master-dev42
+              value: password_master
             - name: NEW_DB_EXTENSIONS
               value: hstore pgcrypto citext uuid-ossp
           envFrom:
             - secretRef:
                 name: azure-pg-admin-user
-          image: ghcr.io/socialgouv/docker/azure-db:6.39.1
+          image: ghcr.io/socialgouv/docker/azure-db:6.45.0
           imagePullPolicy: IfNotPresent
           name: create-db-user
           resources:
@@ -655,57 +653,51 @@ spec:
               cpu: 100m
               memory: 64Mi
       restartPolicy: Never
-    metadata:
-      annotations:
-        app.gitlab.com/app: socialgouv-sample-next-app
-        app.gitlab.com/env: master-dev42
-        app.gitlab.com/env.name: master-dev42
-      labels:
-        application: master-dev42-sample-next-app
-        owner: sample-next-app
-        team: sample-next-app
-        cert: wildcard
   ttlSecondsAfterFinished: 86400
 metadata:
   annotations:
+    kapp.k14s.io/update-strategy: skip
     app.gitlab.com/app: socialgouv-sample-next-app
     app.gitlab.com/env: master-dev42
     app.gitlab.com/env.name: master-dev42
   labels:
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
-  name: create-db-job-0123456
+  name: create-db-job-master
   namespace: sample-next-app-85-master-dev2
 ---
 apiVersion: v1
 kind: Secret
 stringData:
   DATABASE_URL: >-
-    postgresql://user_master-dev42%40samplenextappdevserver.postgres.database.azure.com:password_master-dev42@samplenextappdevserver.postgres.database.azure.com/autodevops_master-dev42?sslmode=require
+    postgresql://user_master%40samplenextappdevserver.postgres.database.azure.com:password_master@samplenextappdevserver.postgres.database.azure.com/autodevops_master?sslmode=require
   DB_URI: >-
-    postgresql://user_master-dev42%40samplenextappdevserver.postgres.database.azure.com:password_master-dev42@samplenextappdevserver.postgres.database.azure.com/autodevops_master-dev42?sslmode=require
+    postgresql://user_master%40samplenextappdevserver.postgres.database.azure.com:password_master@samplenextappdevserver.postgres.database.azure.com/autodevops_master?sslmode=require
   HASURA_GRAPHQL_DATABASE_URL: >-
-    postgresql://user_master-dev42%40samplenextappdevserver.postgres.database.azure.com:password_master-dev42@samplenextappdevserver.postgres.database.azure.com/autodevops_master-dev42?sslmode=require
-  PGDATABASE: autodevops_master-dev42
+    postgresql://user_master%40samplenextappdevserver.postgres.database.azure.com:password_master@samplenextappdevserver.postgres.database.azure.com/autodevops_master?sslmode=require
+  PGDATABASE: autodevops_master
   PGHOST: samplenextappdevserver.postgres.database.azure.com
-  PGPASSWORD: password_master-dev42
+  PGPASSWORD: password_master
   PGRST_DB_URI: >-
-    postgresql://user_master-dev42%40samplenextappdevserver.postgres.database.azure.com:password_master-dev42@samplenextappdevserver.postgres.database.azure.com/autodevops_master-dev42?sslmode=require
+    postgresql://user_master%40samplenextappdevserver.postgres.database.azure.com:password_master@samplenextappdevserver.postgres.database.azure.com/autodevops_master?sslmode=require
   PGSSLMODE: require
-  PGUSER: user_master-dev42@samplenextappdevserver.postgres.database.azure.com
+  PGUSER: user_master@samplenextappdevserver.postgres.database.azure.com
 metadata:
   annotations:
+    kapp.k14s.io/update-strategy: skip
     app.gitlab.com/app: socialgouv-sample-next-app
     app.gitlab.com/env: master-dev42
     app.gitlab.com/env.name: master-dev42
   labels:
     application: master-dev42-sample-next-app
+    component: master-dev42-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
-  name: azure-pg-user-master-dev42
+  name: azure-pg-user-master
   namespace: sample-next-app-85-master-dev2
 ---
 apiVersion: bitnami.com/v1alpha1
diff --git a/.k8s/__tests__/__snapshots__/kosko generate --env preprod.ts.snap b/.k8s/__tests__/__snapshots__/kosko generate --env preprod.ts.snap
index f7b075ad..84c4556e 100644
--- a/.k8s/__tests__/__snapshots__/kosko generate --env preprod.ts.snap	
+++ b/.k8s/__tests__/__snapshots__/kosko generate --env preprod.ts.snap	
@@ -18,6 +18,7 @@ metadata:
   labels:
     azure-pg-admin-user: sample-next-app
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -35,10 +36,10 @@ metadata:
   labels:
     app: pgweb
     application: v1-2-3-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
-    component: pgweb
   name: pgweb
   namespace: sample-next-app-85-preprod-dev2
 spec:
@@ -57,10 +58,10 @@ spec:
       labels:
         app: pgweb
         application: v1-2-3-sample-next-app
+        component: pgweb
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
-        component: pgweb
     spec:
       containers:
         - image: sosedoff/pgweb:0.11.8
@@ -108,7 +109,7 @@ spec:
           envFrom:
             - secretRef:
                 name: azure-pg-user
-          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.39.1
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
           imagePullPolicy: Always
           name: wait-for-postgres
           resources:
@@ -125,6 +126,7 @@ metadata:
   labels:
     app: pgweb
     application: v1-2-3-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -158,6 +160,7 @@ metadata:
   labels:
     app: pgweb
     application: v1-2-3-sample-next-app
+    component: pgweb
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -192,6 +195,7 @@ metadata:
   labels:
     app: app
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -213,12 +217,13 @@ spec:
       labels:
         app: app
         application: v1-2-3-sample-next-app
+        component: v1-2-3-sample-next-app
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
     spec:
       containers:
-        - image: harbor.fabrique.social.gouv.fr/fabrique/app:1.2.3
+        - image: ghcr.io/socialgouv/sample-next-app/app:v1.2.3
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -254,10 +259,29 @@ spec:
               port: http
             periodSeconds: 5
           envFrom:
+            - secretRef:
+                name: azure-pg-user
             - secretRef:
                 name: app-sealed-secret
             - configMapRef:
                 name: app-configmap
+      initContainers:
+        - env:
+            - name: WAIT_FOR_RETRIES
+              value: '24'
+          envFrom:
+            - secretRef:
+                name: azure-pg-user
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
+          imagePullPolicy: Always
+          name: wait-for-postgres
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 5m
+              memory: 16Mi
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -273,6 +297,7 @@ metadata:
   name: app-sealed-secret
   labels:
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -304,6 +329,7 @@ spec:
       name: app-sealed-secret
       labels:
         application: v1-2-3-sample-next-app
+        component: v1-2-3-sample-next-app
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
@@ -320,6 +346,7 @@ metadata:
     app.gitlab.com/env.name: preprod-dev42
   labels:
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -337,6 +364,7 @@ metadata:
   labels:
     app: app
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -370,6 +398,7 @@ metadata:
   labels:
     app: app
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -404,6 +433,7 @@ metadata:
   labels:
     app: hasura
     application: v1-2-3-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -425,12 +455,13 @@ spec:
       labels:
         app: hasura
         application: v1-2-3-sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
     spec:
       containers:
-        - image: harbor.fabrique.social.gouv.fr/fabrique/hasura:1.2.3
+        - image: ghcr.io/socialgouv/sample-next-app/hasura:v1.2.3
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -479,7 +510,7 @@ spec:
           envFrom:
             - secretRef:
                 name: azure-pg-user
-          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.39.1
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
           imagePullPolicy: Always
           name: wait-for-postgres
           resources:
@@ -504,6 +535,7 @@ metadata:
   name: hasura-sealed-secret
   labels:
     application: v1-2-3-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -529,6 +561,7 @@ spec:
       name: hasura-sealed-secret
       labels:
         application: v1-2-3-sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
@@ -546,6 +579,7 @@ metadata:
     app.gitlab.com/env.name: preprod-dev42
   labels:
     application: v1-2-3-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -565,6 +599,7 @@ metadata:
   labels:
     app: hasura
     application: v1-2-3-sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -585,41 +620,6 @@ spec:
     app: hasura
   type: ClusterIP
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    kapp.k14s.io/disable-default-ownership-label-rules: ''
-    kapp.k14s.io/disable-default-label-scoping-rules: ''
-    app.gitlab.com/app: socialgouv-sample-next-app
-    app.gitlab.com/env: preprod-dev42
-    app.gitlab.com/env.name: preprod-dev42
-  labels:
-    app: hasura
-    application: v1-2-3-sample-next-app
-    owner: sample-next-app
-    team: sample-next-app
-    cert: wildcard
-  name: hasura
-  namespace: sample-next-app-85-preprod-dev2
-spec:
-  rules:
-    - host: hasura-preprod-sample-next-app.dev42.fabrique.social.gouv.fr
-      http:
-        paths:
-          - backend:
-              service:
-                name: hasura
-                port:
-                  name: http
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - hasura-preprod-sample-next-app.dev42.fabrique.social.gouv.fr
-      secretName: wildcard-crt
----
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
@@ -632,6 +632,7 @@ metadata:
   name: azure-pg-user
   labels:
     application: v1-2-3-sample-next-app
+    component: v1-2-3-sample-next-app
     owner: sample-next-app
     team: sample-next-app
     cert: wildcard
@@ -663,6 +664,7 @@ spec:
       name: azure-pg-user
       labels:
         application: v1-2-3-sample-next-app
+        component: v1-2-3-sample-next-app
         owner: sample-next-app
         team: sample-next-app
         cert: wildcard
diff --git a/.k8s/__tests__/__snapshots__/kosko generate --env prod.ts.snap b/.k8s/__tests__/__snapshots__/kosko generate --env prod.ts.snap
index b14a0008..e1b36f3e 100644
--- a/.k8s/__tests__/__snapshots__/kosko generate --env prod.ts.snap	
+++ b/.k8s/__tests__/__snapshots__/kosko generate --env prod.ts.snap	
@@ -14,6 +14,7 @@ metadata:
   labels:
     app: app
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
   name: app
@@ -34,11 +35,12 @@ spec:
       labels:
         app: app
         application: sample-next-app
+        component: sample-next-app
         owner: sample-next-app
         team: sample-next-app
     spec:
       containers:
-        - image: harbor.fabrique.social.gouv.fr/fabrique/app:1.2.3
+        - image: ghcr.io/socialgouv/sample-next-app/app:v1.2.3
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -74,10 +76,29 @@ spec:
               port: http
             periodSeconds: 5
           envFrom:
+            - secretRef:
+                name: azure-pg-user
             - secretRef:
                 name: app-sealed-secret
             - configMapRef:
                 name: app-configmap
+      initContainers:
+        - env:
+            - name: WAIT_FOR_RETRIES
+              value: '24'
+          envFrom:
+            - secretRef:
+                name: azure-pg-user
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
+          imagePullPolicy: Always
+          name: wait-for-postgres
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 5m
+              memory: 16Mi
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -93,6 +114,7 @@ metadata:
     app.gitlab.com/env.name: prod
   labels:
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
 spec:
@@ -115,6 +137,7 @@ spec:
         app.gitlab.com/env.name: prod
       labels:
         application: sample-next-app
+        component: sample-next-app
         owner: sample-next-app
         team: sample-next-app
     type: Opaque
@@ -131,6 +154,7 @@ metadata:
     app.gitlab.com/env.name: prod
   labels:
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
   namespace: sample-next-app
@@ -147,6 +171,7 @@ metadata:
   labels:
     app: app
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
   name: app
@@ -171,7 +196,7 @@ kind: Ingress
 metadata:
   annotations:
     kubernetes.io/ingress.class: nginx
-    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/tls-acme: 'true'
     kapp.k14s.io/disable-default-ownership-label-rules: ''
     kapp.k14s.io/disable-default-label-scoping-rules: ''
@@ -181,6 +206,7 @@ metadata:
   labels:
     app: app
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
   name: app
@@ -214,6 +240,7 @@ metadata:
   labels:
     app: hasura
     application: sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
   name: hasura
@@ -234,11 +261,12 @@ spec:
       labels:
         app: hasura
         application: sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
     spec:
       containers:
-        - image: harbor.fabrique.social.gouv.fr/fabrique/hasura:1.2.3
+        - image: ghcr.io/socialgouv/sample-next-app/hasura:v1.2.3
           livenessProbe:
             failureThreshold: 6
             httpGet:
@@ -287,7 +315,7 @@ spec:
           envFrom:
             - secretRef:
                 name: azure-pg-user
-          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.39.1
+          image: ghcr.io/socialgouv/docker/wait-for-postgres:6.45.0
           imagePullPolicy: Always
           name: wait-for-postgres
           resources:
@@ -311,6 +339,7 @@ metadata:
     app.gitlab.com/env.name: prod
   labels:
     application: sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
   namespace: sample-next-app
@@ -334,6 +363,7 @@ spec:
         app.gitlab.com/env.name: prod
       labels:
         application: sample-next-app
+        component: hasura
         owner: sample-next-app
         team: sample-next-app
     type: Opaque
@@ -350,6 +380,7 @@ metadata:
     app.gitlab.com/env.name: prod
   labels:
     application: sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
   namespace: sample-next-app
@@ -367,6 +398,7 @@ metadata:
   labels:
     app: hasura
     application: sample-next-app
+    component: hasura
     owner: sample-next-app
     team: sample-next-app
   name: hasura
@@ -397,6 +429,7 @@ metadata:
     app.gitlab.com/env.name: prod
   labels:
     application: sample-next-app
+    component: sample-next-app
     owner: sample-next-app
     team: sample-next-app
   namespace: sample-next-app
@@ -426,6 +459,7 @@ spec:
         app.gitlab.com/env.name: prod
       labels:
         application: sample-next-app
+        component: sample-next-app
         owner: sample-next-app
         team: sample-next-app
     type: Opaque
diff --git a/.k8s/components/_namespace.ts b/.k8s/components/_namespace.ts
index 44241084..c0a398f1 100644
--- a/.k8s/components/_namespace.ts
+++ b/.k8s/components/_namespace.ts
@@ -1,5 +1,3 @@
 import { createNamespace } from "@socialgouv/kosko-charts/components/namespace";
 
-const manifests = createNamespace();
-
-export default manifests;
+export default createNamespace();
diff --git a/.k8s/components/_pgweb.ts b/.k8s/components/_pgweb.ts
index f887b39b..b1a920a2 100644
--- a/.k8s/components/_pgweb.ts
+++ b/.k8s/components/_pgweb.ts
@@ -1,8 +1,6 @@
 import env from "@kosko/env";
 import { create } from "@socialgouv/kosko-charts/components/pgweb";
 
-const manifests = create("pgweb", {
+export default create("pgweb", {
   env,
 });
-
-export default manifests;
diff --git a/.k8s/components/app.ts b/.k8s/components/app.ts
index c568fbd8..4f060333 100644
--- a/.k8s/components/app.ts
+++ b/.k8s/components/app.ts
@@ -1,15 +1,19 @@
 import env from "@kosko/env";
 
 import { create } from "@socialgouv/kosko-charts/components/app";
-import { getHarborImagePath } from "@socialgouv/kosko-charts/utils/getHarborImagePath";
+import { getGithubRegistryImagePath } from "@socialgouv/kosko-charts/utils/getGithubRegistryImagePath";
 
-const manifests = create("app", {
+export default create("app", {
   env,
   config: {
-    containerPort: 3030,
+    containerPort: 3000,
+    withPostgres: true,
   },
   deployment: {
-    image: getHarborImagePath({ name: "app" }),
+    image: getGithubRegistryImagePath({
+      project: "sample-next-app",
+      name: "app",
+    }),
     container: {
       resources: {
         requests: {
@@ -24,5 +28,3 @@ const manifests = create("app", {
     },
   },
 });
-
-export default manifests;
diff --git a/.k8s/components/hasura.ts b/.k8s/components/hasura.ts
index d2033982..c609750c 100644
--- a/.k8s/components/hasura.ts
+++ b/.k8s/components/hasura.ts
@@ -1,16 +1,14 @@
 import env from "@kosko/env";
 
 import { create } from "@socialgouv/kosko-charts/components/hasura";
-import { getHarborImagePath } from "@socialgouv/kosko-charts/utils/getHarborImagePath";
+import { getGithubRegistryImagePath } from "@socialgouv/kosko-charts/utils/getGithubRegistryImagePath";
 
-const manifests = create("hasura", {
+export default create("hasura", {
   env,
-  config: {
-    ingress: true,
-  },
   deployment: {
-    image: getHarborImagePath({ name: "hasura" }),
+    image: getGithubRegistryImagePath({
+      project: "sample-next-app",
+      name: "hasura",
+    }),
   },
 });
-
-export default manifests;
diff --git a/.k8s/environments/prod/hasura.ts b/.k8s/environments/prod/hasura.ts
deleted file mode 100644
index 18b4df7d..00000000
--- a/.k8s/environments/prod/hasura.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { AppConfig } from "@socialgouv/kosko-charts/components/app";
-
-export default {
-  ingress: false,
-} as Partial<AppConfig>;
diff --git a/.k8s/package.json b/.k8s/package.json
index 411f72df..e17c6fe9 100644
--- a/.k8s/package.json
+++ b/.k8s/package.json
@@ -8,11 +8,11 @@
   },
   "dependencies": {
     "@kosko/env": "^2.0.1",
-    "@kubernetes-models/sealed-secrets": "^1.6.3",
-    "@socialgouv/kosko-charts": "^9.5.4",
+    "@kubernetes-models/sealed-secrets": "^2.0.2",
+    "@socialgouv/kosko-charts": "^9.5.10",
     "@types/node": "^16.3.3",
     "kosko": "^1.1.5",
-    "kubernetes-models": "^1.7.1",
+    "kubernetes-models": "^2.0.2",
     "ts-node": "^10.2.1",
     "typescript": "^4.4.2"
   },
diff --git a/.k8s/yarn.lock b/.k8s/yarn.lock
index f6afedd4..8f552bc0 100644
--- a/.k8s/yarn.lock
+++ b/.k8s/yarn.lock
@@ -618,25 +618,6 @@
     is-plain-object "^5.0.0"
     tslib "^2.3.0"
 
-"@kubernetes-models/base@^1.5.5":
-  version "1.5.5"
-  resolved "https://registry.yarnpkg.com/@kubernetes-models/base/-/base-1.5.5.tgz#6bff274f32e081d15f084853be1322380d2a41b2"
-  integrity sha512-0XoupDEOE+qOy3BpAprcqGuI8CmRW1KwVDfXPsfUkU1uxo6fwv5VeNVzTJ0MHESLUNybgQdbdnm+iysbyFBuug==
-  dependencies:
-    "@kubernetes-models/validate" "^1.6.0"
-    is-plain-object "^5.0.0"
-    tslib "^2.2.0"
-
-"@kubernetes-models/sealed-secrets@^1.6.3":
-  version "1.6.3"
-  resolved "https://registry.yarnpkg.com/@kubernetes-models/sealed-secrets/-/sealed-secrets-1.6.3.tgz#21aea46a2a8e91ccc3b3eb6310df7bd086fbdf80"
-  integrity sha512-n/QT4Yxtfooo+xthZaO4ewIRP+UXbdh6h+CI6gGmYVsjR0pGSai9eI9D+KDYrexlVOM0FqoZgIm1+DAVsrv5VA==
-  dependencies:
-    "@kubernetes-models/base" "^1.5.5"
-    "@kubernetes-models/validate" "^1.6.0"
-    kubernetes-models "^1.7.1"
-    tslib "^2.2.0"
-
 "@kubernetes-models/sealed-secrets@^2.0.2":
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/@kubernetes-models/sealed-secrets/-/sealed-secrets-2.0.2.tgz#76fda974c52abc6cf3414b32ab4243819889c005"
@@ -656,15 +637,6 @@
     ajv-formats "^2.1.0"
     tslib "^2.3.0"
 
-"@kubernetes-models/validate@^1.6.0":
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/@kubernetes-models/validate/-/validate-1.6.0.tgz#d8189ff268bd73a13d717d83fde1ff0ef64207f0"
-  integrity sha512-OIZ7X42s9UDr9scSuqzlHMAfHq7g2ZQ5XeivJN9Ozy5L7QkaT13Um4bbLrbGFeUJlhQMWfUbBxXbEBIB4ggQ6A==
-  dependencies:
-    ajv "^8.5.0"
-    ajv-formats "^2.1.0"
-    tslib "^2.2.0"
-
 "@nodelib/fs.scandir@2.1.3":
   version "2.1.3"
   resolved "https://registry.yarnpkg.com/@nodelib/fs.scandir/-/fs.scandir-2.1.3.tgz#3a582bdb53804c6ba6d146579c46e52130cf4a3b"
@@ -686,10 +658,10 @@
     "@nodelib/fs.scandir" "2.1.3"
     fastq "^1.6.0"
 
-"@sindresorhus/is@^4.0.1":
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/@sindresorhus/is/-/is-4.0.1.tgz#d26729db850fa327b7cacc5522252194404226f5"
-  integrity sha512-Qm9hBEBu18wt1PO2flE7LPb30BHMQt1eQgbV76YntdNk73XZGpn3izvGTYxbGgzXKgbCjiia0uxTd3aTNQrY/g==
+"@sindresorhus/is@^4.2.0":
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/@sindresorhus/is/-/is-4.2.0.tgz#667bfc6186ae7c9e0b45a08960c551437176e1ca"
+  integrity sha512-VkE3KLBmJwcCaVARtQpfuKcKv8gcBmUubrfHGF84dXuuW6jgsRYxPtzcIhPyK9WAPpRt2/xY6zkD9MnRaJzSyw==
 
 "@sinonjs/commons@^1.7.0":
   version "1.8.1"
@@ -705,13 +677,13 @@
   dependencies:
     "@sinonjs/commons" "^1.7.0"
 
-"@socialgouv/kosko-charts@^9.5.4":
-  version "9.5.4"
-  resolved "https://registry.yarnpkg.com/@socialgouv/kosko-charts/-/kosko-charts-9.5.4.tgz#923ee66df66d976656524563994d1bd97c85e59c"
-  integrity sha512-3xpXEkJPFpdegWK45NMwjvmKb/TEvmVs269U18oZluyLYhHuIq951sadWGtzssk0mYW+52mXvmEmglo1eDkVyg==
+"@socialgouv/kosko-charts@^9.5.10":
+  version "9.5.10"
+  resolved "https://registry.yarnpkg.com/@socialgouv/kosko-charts/-/kosko-charts-9.5.10.tgz#4464025b4560ab0db285e055b8a7599650c2faab"
+  integrity sha512-P0dredOW7yr2LJn0R3C4SqEw3CMU+nqnLD8XCXrjay8WtA3JN8Cd1MKmN4bC7VpI7si97Cxhz0OsSpw5fglYkw==
   dependencies:
     "@kubernetes-models/sealed-secrets" "^2.0.2"
-    "@sindresorhus/is" "^4.0.1"
+    "@sindresorhus/is" "^4.2.0"
     fs-extra "^10.0.0"
     kubernetes-models "^2.0.2"
     slugify "^1.6.0"
@@ -894,7 +866,7 @@ ajv-formats@^2.1.0:
   dependencies:
     ajv "^8.0.0"
 
-ajv@^8.0.0, ajv@^8.5.0, ajv@^8.6.2:
+ajv@^8.0.0, ajv@^8.6.2:
   version "8.6.2"
   resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.6.2.tgz#2fb45e0e5fcbc0813326c1c3da535d1881bb0571"
   integrity sha512-9807RlWAgT564wT+DjeyU5OFMPjmzxVobvDFmNAhY+5zD6A2ly3jDp6sgnfyDtlIQ+7H97oc/DGCzzfu9rjw9w==
@@ -2373,15 +2345,6 @@ kubernetes-models@2.0.2, kubernetes-models@^2.0.2:
     "@kubernetes-models/validate" "2.0.1"
     tslib "^2.3.0"
 
-kubernetes-models@^1.7.1:
-  version "1.7.1"
-  resolved "https://registry.yarnpkg.com/kubernetes-models/-/kubernetes-models-1.7.1.tgz#e699a3b9454e219ff08d30fc2edaa81c9d3fd127"
-  integrity sha512-x9lI7ravBEDDhKp71H2MSznSWoQFlzWNCQ3WAtYhRROUTCXOQjS6qpqtLnXWtV8mGoHsJR/JNlNPJ0eyliv5VQ==
-  dependencies:
-    "@kubernetes-models/base" "^1.5.5"
-    "@kubernetes-models/validate" "^1.6.0"
-    tslib "^2.2.0"
-
 leven@^3.1.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/leven/-/leven-3.1.0.tgz#77891de834064cccba82ae7842bb6b14a13ed7f2"
@@ -3057,7 +3020,7 @@ ts-node@^10.2.1:
     make-error "^1.1.1"
     yn "3.1.1"
 
-tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.0:
+tslib@^2.1.0, tslib@^2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.3.0.tgz#803b8cdab3e12ba581a4ca41c8839bbb0dacb09e"
   integrity sha512-N82ooyxVNm6h1riLCoyS9e3fuJ3AMG2zIZs2Gd1ATcSFjSA23Q0fzjjZeh0jbJvWVDZ0cJT8yaNNaaXHzueNjg==
diff --git a/Dockerfile b/Dockerfile
index 367f1e3e..a09eb226 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,37 @@
-FROM node:15.14.0-alpine3.12
+# from https://nextjs.org/docs/deployment
 
+# Install dependencies only when needed
+FROM node:14-alpine AS deps
+# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
+RUN apk add --no-cache libc6-compat
 WORKDIR /app
-
 COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile
+
+# Rebuild the source code only when needed
+FROM node:14-alpine AS builder
+WORKDIR /app
+COPY . .
+COPY --from=deps /app/node_modules ./node_modules
+RUN yarn build && yarn install --production --ignore-scripts --prefer-offline
 
-RUN yarn install --production --frozen-lockfile
+# Production image, copy all the files and run next
+FROM node:14-alpine AS runner
+WORKDIR /app
+
+ENV NODE_ENV production
+
+WORKDIR /app
 
-COPY next.config.js server.js  ./
-COPY src/sentry.js ./src/sentry.js
-COPY .next/ ./.next
-COPY public/ ./
+# You only need to copy next.config.js if you are NOT using the default configuration
+COPY --from=builder /app/next.config.js ./
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=node:node /app/.next ./.next
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./package.json
 
 USER node
 
-ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
+ENV NEXT_TELEMETRY_DISABLED 1
 
-CMD ["yarn", "start"]
+CMD ["yarn", "start"]
\ No newline at end of file
diff --git a/package.json b/package.json
index 5190d797..6e0c4427 100644
--- a/package.json
+++ b/package.json
@@ -58,13 +58,13 @@
   "private": true,
   "scripts": {
     "build": "next build",
-    "dev": "node -r dotenv/config server.js dotenv_config_path=.env.development",
+    "dev": "next dev",
     "e2e": "yarn --cwd=./optional/e2e/runners/puppeteer",
     "k8s": "yarn --silent --cwd .k8s",
     "lint": "eslint src/*",
     "precommit": "lint-staged",
     "prepare": "is-ci || husky install",
-    "start": "NODE_ENV=production node server.js",
+    "start": "next start",
     "test": "jest"
   },
   "lint-staged": {
diff --git a/src/pages/health.js b/src/pages/health.js
deleted file mode 100644
index 96ec5c3f..00000000
--- a/src/pages/health.js
+++ /dev/null
@@ -1,8 +0,0 @@
-import React from "react";
-
-const Page = () => (
-  <h1 style={{ marginTop: "20vh", textAlign: "center", width: "100%" }}>
-    It Works!
-  </h1>
-);
-export default Page;
diff --git a/server.js b/src/server.js
similarity index 100%
rename from server.js
rename to src/server.js