diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000000000000000000000000000000000000..23796b52625068807a771bcd515d96cc3905ef3e
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,46 @@
+---
+image: adarnimrod/ci-images:docker
+
+stages:
+  - test
+  - build
+  - run
+
+pre-commit:
+  stage: test
+  image: adarnimrod/ci-images:pre-commit
+  variables:
+    XDG_CACHE_HOME: "$CI_PROJECT_DIR/.cache"
+    # Disabled until https://github.com/pre-commit/pre-commit/issues/1387 is
+    # resolved.
+    SKIP: "hadolint,docker-compose"
+  script:
+    - pre-commit run --all-files
+  cache:
+    paths:
+      - .cache/
+
+build:
+  stage: build
+  tags: ["host01.shore.co.il"]
+  variables:
+    COMPOSE_DOCKER_CLI_BUILD: "1"
+    DOCKER_BUILDKIT: "1"
+  script:
+    - docker-compose build --no-cache --pull
+    - docker-compose pull --quiet
+
+run:
+  stage: run
+  tags: ["host01.shore.co.il"]
+  when: manual
+  script:
+    - docker-compose up --detach --remove-orphans
+    # yamllint disable rule:line-length
+    - |
+        for i in $(seq 12)
+        do
+            docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$' || break
+            sleep 10
+        done
+        ! docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$'
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8bb2e74d9d2f1d111d910b9842524134431c5dd8..3371e0e9d2f08ea23738a8fc62203d1790d267d6 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,14 +2,15 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v2.4.0
+    rev: v2.3.0
     hooks:
       - id: check-added-large-files
       - id: check-merge-conflict
+      - id: detect-private-key
       - id: trailing-whitespace
         exclude: \.diff$
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.19.0
+    rev: v1.17.0
     hooks:
       - id: yamllint
   - repo: https://github.com/amperser/proselint/
@@ -17,9 +18,14 @@ repos:
     hooks:
       - id: proselint
         types: [plain-text]
-        exclude: LICENSE|requirements
-  - repo: https://www.shore.co.il/git/docker-pre-commit
+        exclude: LICENSE
+  - repo: https://git.shore.co.il/nimrod/docker-pre-commit.git/
     rev: v0.3.0
     hooks:
       - id: hadolint
       - id: docker-compose
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v0.13.0
+    hooks:
+      - id: detect-secrets
+        exclude: \.diff$
diff --git a/Dockerfile b/Dockerfile
index 326d728d3bc22f9e9cabf15acd774f706425d286..ab69b347a3c6895d7d6f82715911bef2afb77193 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,6 +10,7 @@ RUN apt-get update && \
         python3-docutils \
         python3-markdown \
         python3-pygments \
+        wget \
     && \
     setcap CAP_NET_BIND_SERVICE=+ep /usr/sbin/apache2 && \
     a2enmod cgid && \
@@ -31,9 +32,9 @@ ENV APACHE_RUN_DIR=/run/apache2 \
     APACHE_PID_FILE=/run/apache2/apache2.pid
 RUN patch --strip 0 --verbose --directory /etc/apache2 --input /root/patch.diff && \
     apache2 -t
-EXPOSE 8080
+EXPOSE 80
 CMD [ "apache2", "-DFOREGROUND" ]
 VOLUME ["/srv/git"]
 USER "www-data"
 WORKDIR /var/www
-HEALTHCHECK CMD wget --spider --quiet http://localhost:8080/cgit/ --user-agent 'Healthcheck' || exit 1
+HEALTHCHECK CMD wget --spider --quiet http://localhost:80/cgit/ --user-agent 'Healthcheck' || exit 1
diff --git a/docker-compose.yml b/docker-compose.yml
index 65fb222de50f797a6d4ee0fd30f4a268d3c11c39..93d1bef75619b1dd42545050daeb99ca70c018f2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,19 +4,14 @@ version: '3.5'
 services:
   cgit:
     build:
+      # cache_from:
+      #   - adarnimrod/cgit
       context: .
-      cache_from:
-        - adarnimrod/cgit
-    image: adarnimrod/cgit
-    ports:
-      - 80:80
+    # image: adarnimrod/cgit
+    restart: always
     volumes:
-      - git:/srv/git:ro
-
-volumes:
-  git:
-    labels:
-      snapshot: 'true'
+      - /var/lib/git:/srv/git:ro
+      - /etc/passwd:/etc/passwd:ro
 
 networks:
   default: