diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..35cd0c4
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.git/
+.idea/
+*.md
+.kube/
+build/
+.kube/
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..78f43e9
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+.idea/
+pkg/
+bin/
\ No newline at end of file
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a21e880..c4667e4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,7 +1,25 @@
+variables:
+  CI_REGISTRY: registry.connectone.pro
+  CONTAINER_IMAGE: ${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_BUILD_REF_NAME}_${CI_BUILD_REF}
+
 stages:
+  - release
+  - deploy
   - release-deb
   - release-hosted
 
+release:
+  stage: release
+  image: docker:latest
+  before_script:
+    - docker login -u gitlab-ci-token -p ${CI_BUILD_TOKEN} ${CI_REGISTRY}
+  script:
+    - docker build -t ${CONTAINER_IMAGE} .
+    - docker push ${CONTAINER_IMAGE}
+  only:
+    - develop
+    - main
+
 release-deb:
   stage: release-deb
   image: docker:latest
@@ -26,5 +44,40 @@ release-hosted:
     - tar -czvf hosted.tar.gz hosted
     - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hosted.tar.gz "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hosted/${VERSION}/hosted.tar.gz"'
   when: manual
+  only:
+    - main
+
+deploy-staging:
+  stage: deploy
+  image: jar3b/deploh:${STAGING_DEPLOYER_VERSION}
+  variables:
+    KUBECONFIG_BASE64: ${STAGING_KUBECONFIG}
+    KUBECONFIG_CONTEXT_NAME: ${STAGING_KUBECONFIG_CONTEXT}
+    NAMESPACE: ${STAGING_NAMESPACE}
+    MAIN_DOMAIN: ${STAGING_MAIN_DOMAIN}
+
+    STORAGE_BASE: ${STAGING_STORAGE_BASE}
+  script:
+    - he.sh . ${NAMESPACE} "freeradius" --set db.password=${PG_PROD_PASS}
+  environment:
+    name: staging
+  only:
+    - develop
+
+deploy-production:
+  stage: deploy
+  image: jar3b/deploh:${PRODUCTION_DEPLOYER_VERSION}
+  variables:
+    KUBECONFIG_BASE64: ${PRODUCTION_KUBECONFIG}
+    KUBECONFIG_CONTEXT_NAME: ${PRODUCTION_KUBECONFIG_CONTEXT}
+    NAMESPACE: ${PRODUCTION_NAMESPACE}
+    MAIN_DOMAIN: ${PRODUCTION_MAIN_DOMAIN}
+
+    STORAGE_BASE: ${PRODUCTION_STORAGE_BASE}
+  script:
+    - he.sh . ${NAMESPACE} "freeradius" --set db.password=${PG_PROD_PASS}
+  environment:
+    name: production
+  when: manual
   only:
     - main
\ No newline at end of file
diff --git a/.kube/Chart.yaml b/.kube/Chart.yaml
new file mode 100644
index 0000000..480b503
--- /dev/null
+++ b/.kube/Chart.yaml
@@ -0,0 +1,4 @@
+apiVersion: v2
+name: freeradius
+version: 1.0.1
+appVersion: 3.2.0
\ No newline at end of file
diff --git a/.kube/templates/00-pullsecret.yaml b/.kube/templates/00-pullsecret.yaml
new file mode 100644
index 0000000..92024b7
--- /dev/null
+++ b/.kube/templates/00-pullsecret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{.Release.Name}}-registry-key
+  namespace: {{.Release.Namespace}}
+data:
+  .dockerconfigjson: "{{.Values.registryAuthBase64}}"
+type: kubernetes.io/dockerconfigjson
diff --git a/.kube/templates/cm-configs.yaml b/.kube/templates/cm-configs.yaml
new file mode 100644
index 0000000..1bc2833
--- /dev/null
+++ b/.kube/templates/cm-configs.yaml
@@ -0,0 +1,168 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-configs
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: clickhouse-operator
+data:
+  default: |
+    server default {
+      listen {
+          type = auth
+          ipaddr = *
+          port = {{.Values.ports.main}}
+          limit {
+                max_connections = 16
+                lifetime = 0
+                idle_timeout = 30
+          }
+      }
+
+      listen {
+          ipaddr = *
+          port = {{.Values.ports.second}}
+          type = acct
+
+          limit {
+          }
+      }
+
+      authorize {
+          filter_username
+          preprocess
+          chap
+          mschap
+          digest
+          expiration
+          logintime
+          pap
+          Autz-Type New-TLS-Connection {
+                ok
+          }
+      }
+      authenticate {
+          Auth-Type PAP {
+              pap
+          }
+          Auth-Type CHAP {
+              chap
+          }
+          digest
+      }
+
+      preacct {
+          preprocess
+          acct_unique
+          suffix
+          files
+      }
+      accounting {
+          detail
+          unix
+          -sql
+          exec
+          attr_filter.accounting_response
+      }
+      session {
+      }
+      post-auth {
+          if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
+              update reply {
+                  &User-Name !* ANY
+              }
+          }
+          update {
+              &reply: += &session-state:
+          }
+          -sql
+          exec
+          remove_reply_message_if_eap
+          Post-Auth-Type REJECT {
+              -sql
+              attr_filter.access_reject
+              remove_reply_message_if_eap
+          }
+          Post-Auth-Type Client-Lost {
+          }
+          if (EAP-Key-Name && &reply:EAP-Session-Id) {
+              update reply {
+                  &EAP-Key-Name := &reply:EAP-Session-Id
+              }
+          }
+      }
+      pre-proxy {
+      }
+      post-proxy {
+      }
+    }
+
+
+  sql: |
+    sql {
+        dialect = "postgresql"
+        driver = "rlm_sql_${dialect}"
+        postgresql {
+            send_application_name = yes
+        }
+
+        server = "{{.Values.db.host}}"
+        port = {{.Values.db.port}}
+        login = "{{.Values.db.user}}"
+        password = "{{.Values.db.password}}"
+        radius_db = "{{.Values.db.name}}"
+
+        acct_table1 = "radacct"
+        acct_table2 = "radacct"
+        postauth_table = "radpostauth"
+        authcheck_table = "radcheck"
+        groupcheck_table = "radgroupcheck"
+        authreply_table = "radreply"
+        groupreply_table = "radgroupreply"
+        usergroup_table = "radusergroup"
+
+        delete_stale_sessions = yes
+
+        pool {
+            start = ${thread[pool].start_servers}
+            min = ${thread[pool].min_spare_servers}
+            max = ${thread[pool].max_servers}
+            spare = ${thread[pool].max_spare_servers}
+            uses = 0
+            retry_delay = 30
+            lifetime = 0
+            idle_timeout = 60
+        }
+
+        client_table = "nas"
+        group_attribute = "SQL-Group"
+        $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+    }
+
+  rest: |
+    rest {
+        tls {
+        }
+        connect_uri = "http://{{.Values.api.host}}:{{.Values.api.port}}/"
+        authorize {
+            uri = "${..connect_uri}radius/auth"
+            method = 'post'
+            body = 'json'
+            data = '{"ip": "%{Packet-Src-IP-Address}", "hotspot-group": "%{raw:Called-Station-Id}", "hotspot-id": "%{raw:NAS-Identifier}"}'
+            force_to = 'json'
+            auth = 'none'
+            require_auth = no
+            timeout = 4.000000
+        }
+        pool {
+            start = ${thread[pool].start_servers}
+            min = ${thread[pool].min_spare_servers}
+            max = ${thread[pool].max_servers}
+            spare = ${thread[pool].max_spare_servers}
+            uses = 0
+            retry_delay = 30
+            lifetime = 0
+            idle_timeout = 60
+        }
+    }
+
diff --git a/.kube/templates/deployment.yaml b/.kube/templates/deployment.yaml
new file mode 100644
index 0000000..fec4f24
--- /dev/null
+++ b/.kube/templates/deployment.yaml
@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.Release.Name}}
+  namespace: {{.Release.Namespace}}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{.Release.Name}}
+  template:
+    metadata:
+      labels:
+        app: {{.Release.Name}}
+    spec:
+      nodeSelector:
+        freeradius: enabled
+      tolerations:
+        - key: freeradius
+          operator: Equal
+          value: enabled
+          effect: NoSchedule
+      imagePullSecrets:
+        - name: {{.Release.Name}}-registry-key
+{{/*      securityContext:*/}}
+{{/*        runAsUser: 108*/}}
+{{/*        runAsGroup: 112*/}}
+{{/*        fsGroup: 108*/}}
+      containers:
+        - name: {{.Release.Name}}
+          image: {{.Values.image.name}}
+          imagePullPolicy: {{.Values.image.pullPolicy}}
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+
+            - name: TZ
+              value: UTC
+            - name: HOSTNAME
+              value: freeradius
+          ports:
+            - containerPort: {{.Values.ports.main}}
+            - containerPort: {{.Values.ports.second}}
+          volumeMounts:
+            - mountPath: /etc/freeradius/certs
+              name: freeradius-cert-data
+              readOnly: false
+            - name: configs-volume
+              mountPath: "/configs/default"
+              subPath: default
+              readOnly: true
+            - name: configs-volume
+              mountPath: "/configs/sql"
+              subPath: sql
+              readOnly: true
+            - name: configs-volume
+              mountPath: "/configs/rest"
+              subPath: rest
+              readOnly: true
+      volumes:
+        - name: configs-volume
+          configMap:
+            name: {{ .Release.Name }}-configs
+            defaultMode: 488
+        - name: freeradius-cert-data
+          persistentVolumeClaim:
+            claimName: freeradius-data-claim
diff --git a/.kube/templates/service.yaml b/.kube/templates/service.yaml
new file mode 100644
index 0000000..6d832c0
--- /dev/null
+++ b/.kube/templates/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{.Release.Name}}-external
+  namespace: {{.Release.Namespace}}
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  ports:
+  - port: {{.Values.ports.main}}
+    nodePort: {{.Values.ports.main}}
+    protocol: UDP
+    name: freerad-first
+  - port: {{.Values.ports.second}}
+    nodePort: {{.Values.ports.second}}
+    protocol: UDP
+    name: freerad-second
+  selector:
+    app: {{ .Chart.Name }}
diff --git a/.kube/templates/volumes.yaml b/.kube/templates/volumes.yaml
new file mode 100644
index 0000000..46dd907
--- /dev/null
+++ b/.kube/templates/volumes.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: freeradius-data-disk
+  namespace: {{.Release.Namespace}}
+spec:
+  capacity:
+    storage: 10Mi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: {{.Values.storageBase}}/{{.Chart.Name}}
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: freeradius-data-claim
+  namespace: {{.Release.Namespace}}
+spec:
+  volumeName: freeradius-data-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Mi
\ No newline at end of file
diff --git a/.kube/values.yaml b/.kube/values.yaml
new file mode 100644
index 0000000..bee6c9a
--- /dev/null
+++ b/.kube/values.yaml
@@ -0,0 +1,20 @@
+image:
+  name: ${CONTAINER_IMAGE}
+  pullPolicy: "IfNotPresent"
+registryAuthBase64: ${REGISTRY_AUTH}
+storageBase: ${STORAGE_BASE}
+
+ports:
+  main: 31812
+  second: 31813
+
+db:
+  host: "postgresql-pgbouncer"
+  port: 6432
+  user: "admin"
+  password: "radius_db"
+  name: "radius_db"
+
+api:
+  host: "hotspotter"
+  port: 8080
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..8eef07d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,30 @@
+FROM ubuntu:18.04
+WORKDIR /tmp
+ARG out_dir=/etc/freeradius
+COPY local-bionic.list /etc/apt/sources.list
+RUN apt-get update && apt-get install -y apt-transport-https ca-certificates curl software-properties-common gpg
+RUN curl -fsSL http://connectone.pro/gpg | gpg --dearmor -o /usr/share/keyrings/connectone.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/connectone.gpg] \
+    https://nexus.connectone.pro/repository/radius bionic main" | tee /etc/apt/sources.list.d/connectone.list \
+    > /dev/null
+RUN apt-get update && apt-get install -y libfreeradius3=3.2.2+git freeradius-common=3.2.2+git \
+    freeradius-postgresql=3.2.2+git freeradius-rest=3.2.2+git freeradius-utils=3.2.2+git freeradius=3.2.2+git && \
+    apt autoremove --purge -y && apt-get clean
+COPY hosted /tmp/hosted
+RUN cp hosted/config/radiusd.conf $out_dir/radiusd.conf && \
+    cp hosted/config/dictionary $out_dir/dictionary && \
+    cp hosted/config/clients.conf $out_dir/clients.conf && \
+    cp hosted/config/mods-enabled/raw $out_dir/mods-enabled/raw && \
+    cp hosted/config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients && \
+    rm -f /etc/freeradius/sites-enabled/inner-tunnel && \
+    rm -f /etc/freeradius/mods-enabled/eap \
+RUN rm -f /etc/freeradius/mods-enabled/delay && \
+    ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay
+ADD entrypoint.sh /bin/entrypoint.sh
+RUN chmod a+x /bin/entrypoint.sh && chmod -R 750 $out_dir && chown -R freerad:root $out_dir && \
+    mv /etc/freeradius/certs /tmp && \
+    rm -rf /tmp/hosted
+
+WORKDIR /etc/freeradius
+ENTRYPOINT ["entrypoint.sh"]
+CMD ["freeradius", "-f"]
diff --git a/README.md b/README.md
index a62f6b9..c886b21 100644
--- a/README.md
+++ b/README.md
@@ -5,4 +5,9 @@ build:
 cd build
 docker build . -t freerad_builder:3.2.x -f Dockerfile_build
 docker run -e DEB_USER=${DEB_USER} DEB_PASS="${DEB_PASS}" freerad_builder:3.2.x ./upload.sh
+```
+
+label nodes:
+```bash
+kubectl label node connect-prod-0 freeradius=enabled
 ```
\ No newline at end of file
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..6007531
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+echo "copy configs"
+cp -r /configs/default /etc/freeradius/sites-enabled/default
+cp -r /configs/sql /etc/freeradius/mods-enabled/sql
+cp -r /configs/rest /etc/freeradius/mods-enabled/rest
+
+if [ ! "$(ls -A /etc/freeradius/certs)" ]; then
+  echo "Copying certificates"
+  mkdir -p /etc/freeradius/certs/
+  cp -r /tmp/certs/ /etc/freeradius/certs/
+fi
+
+echo "chowning..."
+chown -R freerad:root /etc/freeradius && chmod -R 750 /etc/freeradius
+
+echo "running"
+exec "$@"
+
+
diff --git a/local-bionic.list b/local-bionic.list
new file mode 100644
index 0000000..a2f8da0
--- /dev/null
+++ b/local-bionic.list
@@ -0,0 +1,49 @@
+# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
+# newer versions of the distribution.
+deb http://mirror.yandex.ru/ubuntu/ bionic main restricted
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic main restricted
+
+## Major bug fix updates produced after the final release of the
+## distribution.
+deb http://mirror.yandex.ru/ubuntu/ bionic-updates main restricted
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic-updates main restricted
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team. Also, please note that software in universe WILL NOT receive any
+## review or updates from the Ubuntu security team.
+deb http://mirror.yandex.ru/ubuntu/ bionic universe
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic universe
+deb http://mirror.yandex.ru/ubuntu/ bionic-updates universe
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic-updates universe
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team, and may not be under a free licence. Please satisfy yourself as to
+## your rights to use the software. Also, please note that software in
+## multiverse WILL NOT receive any review or updates from the Ubuntu
+## security team.
+deb http://mirror.yandex.ru/ubuntu/ bionic multiverse
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic multiverse
+deb http://mirror.yandex.ru/ubuntu/ bionic-updates multiverse
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic-updates multiverse
+
+## N.B. software from this repository may not have been tested as
+## extensively as that contained in the main release, although it includes
+## newer versions of some applications which may provide useful features.
+## Also, please note that software in backports WILL NOT receive any review
+## or updates from the Ubuntu security team.
+deb http://mirror.yandex.ru/ubuntu/ bionic-backports main restricted universe multiverse
+# deb-src http://mirror.yandex.ru/ubuntu/ bionic-backports main restricted universe multiverse
+
+## Uncomment the following two lines to add software from Canonical's
+## 'partner' repository.
+## This software is not part of Ubuntu, but is offered by Canonical and the
+## respective vendors as a service to Ubuntu users.
+# deb http://archive.canonical.com/ubuntu bionic partner
+# deb-src http://archive.canonical.com/ubuntu bionic partner
+
+deb http://security.ubuntu.com/ubuntu/ bionic-security main restricted
+# deb-src http://security.ubuntu.com/ubuntu/ bionic-security main restricted
+deb http://security.ubuntu.com/ubuntu/ bionic-security universe
+# deb-src http://security.ubuntu.com/ubuntu/ bionic-security universe
+deb http://security.ubuntu.com/ubuntu/ bionic-security multiverse
+# deb-src http://security.ubuntu.com/ubuntu/ bionic-security multiverse