diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..55dd511
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,36 @@
+stages:
+  - build
+  - release
+
+build-docker:
+  image: docker:24.0.5
+  services:
+    - name: docker:24.0.5
+      alias: docker
+  only:
+    - main
+  stage: build
+  script:
+    - apk add --update git
+    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
+    - docker build -t registry.gitlab.com/dhawos/bluesky-custom-feeds:main .
+    - docker tag registry.gitlab.com/dhawos/bluesky-custom-feeds:main registry.gitlab.com/dhawos/bluesky-custom-feeds:$CI_COMMIT_SHA
+    - docker push registry.gitlab.com/dhawos/bluesky-custom-feeds:main
+    - docker push registry.gitlab.com/dhawos/bluesky-custom-feeds:$CI_COMMIT_SHA
+
+release:
+  image: docker:24.0.5
+  services:
+    - name: docker:24.0.5
+      alias: docker
+  only:
+    - tags
+  except:
+    - branches
+  stage: release
+  script:
+    - apk add --update git
+    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
+    - docker build -t registry.gitlab.com/dhawos/bluesky-custom-feeds:$CI_COMMIT_TAG .
+    - docker push registry.gitlab.com/dhawos/bluesky-custom-feeds:$CI_COMMIT_TAG
+
diff --git a/Dockerfile b/Dockerfile
index 9f7a311..8b6f4a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,12 +7,16 @@ COPY go.mod go.sum .
 RUN go mod download
 COPY . .
 RUN go build -o /go/dist/bsfeedserver /go/cmd/feed/main.go
+RUN go build -o /go/dist/bsfeedindexer /go/cmd/indexer/main.go
 
 FROM ubuntu:24.04 AS runner
 RUN useradd app && mkdir /app
+RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
 COPY --from=builder /go/dist/bsfeedserver /app/bsfeedserver
+COPY --from=builder /go/dist/bsfeedindexer /app/bsfeedindexer
 
 RUN chmod +x /app/bsfeedserver
+RUN chmod +x /app/bsfeedindexer
 
 WORKDIR /app
 USER app
diff --git a/cmd/feed/main.go b/cmd/feed/main.go
index 51bd899..0b85b8c 100644
--- a/cmd/feed/main.go
+++ b/cmd/feed/main.go
@@ -33,10 +33,13 @@ func main() {
 	if !serviceDIDSet {
 		serviceDID = fmt.Sprintf("did:web:%s", hostname)
 	}
-
+	dbPassword, dbPasswordSet := os.LookupEnv("FEED_DB_PASSWORD")
+	if !dbPasswordSet {
+		slog.Error("FEED_DB_PASSWORD env var not set")
+		os.Exit(1)
+	}
+	connectionString := fmt.Sprintf("user=blueskyfeeds dbname=bluesky sslmode=disable host=%s password=%s", dbHostname, dbPassword)
 	ctx := context.Background()
-
-	connectionString := fmt.Sprintf("user=username dbname=bluesky sslmode=disable host=%s password=password", dbHostname)
 	pool, err := pgxpool.New(ctx, connectionString)
 	if err != nil {
 		panic(err)
diff --git a/cmd/indexer/main.go b/cmd/indexer/main.go
index c6e25e6..5a80b9b 100644
--- a/cmd/indexer/main.go
+++ b/cmd/indexer/main.go
@@ -20,7 +20,12 @@ func main() {
 		slog.Error("FEED_DB_HOST env var not set")
 		os.Exit(1)
 	}
-	connectionString := fmt.Sprintf("user=username dbname=bluesky sslmode=disable host=%s password=password", dbHostname)
+	dbPassword, dbPasswordSet := os.LookupEnv("FEED_DB_PASSWORD")
+	if !dbPasswordSet {
+		slog.Error("FEED_DB_PASSWORD env var not set")
+		os.Exit(1)
+	}
+	connectionString := fmt.Sprintf("user=blueskyfeeds dbname=bluesky sslmode=disable host=%s password=%s", dbHostname, dbPassword)
 	pool, err := pgxpool.New(ctx, connectionString)
 	if err != nil {
 		panic(err)
diff --git a/internal/firehose/stream.go b/internal/firehose/stream.go
index 0c3ab14..df04662 100644
--- a/internal/firehose/stream.go
+++ b/internal/firehose/stream.go
@@ -96,6 +96,9 @@ func (fh *FirehoseListener) onPostCreate(ctx context.Context, post *bsky.FeedPos
 func (fh *FirehoseListener) SubscribeFirehose() {
 	uri := "wss://bsky.network/xrpc/com.atproto.sync.subscribeRepos"
 	con, _, err := websocket.DefaultDialer.Dial(uri, http.Header{})
+	if err != nil {
+		panic(err)
+	}
 	ctx := context.TODO()
 	rsc := &events.RepoStreamCallbacks{
 		RepoCommit: func(evt *atproto.SyncSubscribeRepos_Commit) error {