diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9e5fedcc9b226fa39e98a60e2a5f3eb5379de2c6..161c3eaaf38bfd38ae6c654bf976adcc268986f2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,9 +3,10 @@ variables:
 
 stages:
   - build
+  - deploy
   - setup
 
-be-build-job:
+.be-build-job:
   variables:
     IMAGE_NAME: $CI_REGISTRY_IMAGE/backend
   stage: build
@@ -26,7 +27,33 @@ be-build-job:
   only:
     - main
 
-be-setup-job:
+be-deploy-job:
+  variables:
+    KUBECTL_VERSION: v1.8.10
+    IMAGE_NAME: $CI_REGISTRY_IMAGE/backend
+
+  stage: deploy
+  tags:
+    - commul
+  image: docker:latest
+  services:
+    - docker:dind
+  before_script:
+    - wget https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl
+    # NOTE: version is too ald and don't have sha256 available
+    #- wget https://dl.k8s.io/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl.sha256
+    # - echo "$(<kubectl.sha256)  kubectl" | sha256sum --check
+    - mv kubectl /usr/bin/ && chmod +x /usr/bin/kubectl
+    - docker login -u $CI_REGISTRY_USER -p $CI_JOB_TOKEN https://$CI_REGISTRY
+  script:
+    - kubectl version --client
+    - echo YAY!
+    - docker pull ${IMAGE_NAME}:main
+    #- kubectl --namespace kommul-dev set image deployment/merlin browser=${CONTAINER_IMAGE}:${CI_COMMIT_SHA}
+  only:
+    - main
+
+.be-setup-job:
   image: node:16-alpine
   stage: setup
   cache:
@@ -42,7 +69,7 @@ be-setup-job:
     - npm install
     - echo Success!
 
-fe-setup-job:
+.fe-setup-job:
   image: node:16-alpine
   stage: setup
   cache:
diff --git a/backend/kustomize/base/deployment.yaml b/backend/kustomize/base/deployment.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..f7b747187f1e2a1f45d0b3ed6daed8d736c1a138
--- /dev/null
+++ b/backend/kustomize/base/deployment.yaml
@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oetzi-webserver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oetzi-webserver
+  template:
+    metadata:
+      labels:
+        app: oetzi-webserver
+    spec:
+      containers:
+        - name: oetzi-webserver
+          # NOTE: use `minikube image load oetzi:latest` to push into container runtime
+          image: oetzi:latest
+          # NOTE: Never is useful only for locla testing in order to load image from cache
+          imagePullPolicy: Never
+          resources: {}
+          ports:
+            - name: http
+              containerPort: 80
+          command: ["npm", "run", "serve"]
+          env:
+            - name: PORT
+              value: "80"
+            - name: DATABASE_URL
+              value: postgres://db_user:db_pass@database/db_name
+
diff --git a/backend/kustomize/base/ingress.yaml b/backend/kustomize/base/ingress.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..f48ddf146048bd3a24d0196b86fe12c60e43be95
--- /dev/null
+++ b/backend/kustomize/base/ingress.yaml
@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oetzi
+spec:
+  rules:
+    - host: oetzi.eurac
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oetzi-webserver
+                port:
+                  name: http
diff --git a/backend/kustomize/base/service.yaml b/backend/kustomize/base/service.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..69ed8a675b5e94295788dd748ada9bb1d0277af0
--- /dev/null
+++ b/backend/kustomize/base/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oetzi-webserver
+spec:
+  selector:
+    app: oetzi-webserver
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 80