diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index acd4464664bb33d5c2e463f62483db54697fb71b..50e9608367d60945979830b4f754f91c28396a61 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -75,20 +75,31 @@ review:
   variables:
     HELM_UPGRADE_VALUES_FILE: .gitlab/review-apps-values.yaml
     ROLLOUT_RESOURCE_TYPE: deployment
-  except:
-    refs:
-      - master
-      - development
-    variables:
-      - $REVIEW_DISABLED
+  rules:
+    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "development"'
+      when: never
+    - if: '$REVIEW_DISABLED'
+      when: never
+    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
 
 stop_review:
-  except:
-    refs:
-      - master
-      - development
-    variables:
-      - $REVIEW_DISABLED
+  rules:
+    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "development"'
+      when: never
+    - if: '$REVIEW_DISABLED'
+      when: never
+    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
+      when: manual
+
+
 
 .development: &development_template
   extends: .auto-deploy
diff --git a/.gitlab/development-values.yaml b/.gitlab/development-values.yaml
index 1a756bdf674a82cb4ea5b816851e6bd00bb1dfd8..87e1498ecdcccc89753317722b69faf48373b2eb 100644
--- a/.gitlab/development-values.yaml
+++ b/.gitlab/development-values.yaml
@@ -2,20 +2,37 @@ service:
   externalPort: 80
   internalPort: 80
 hpa:
+  enabled: true
   minReplicas: 1
   maxReplicas: 5
+resources:
+  limits:
+    cpu: 500m
+    memory: 1Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
 podDisruptionBudget:
   enabled: true
-  minAvailable: 1
-  maxUnavailable:
+  minAvailable:
+  maxUnavailable: 0
 podAnnotations:
   prometheus.io/scrape: "true"
   prometheus.io/path: /metrics
   prometheus.io/port: "80"
+deploymentApiVersion: apps/v1
 ingress:
   annotations:
-    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     nginx.ingress.kubernetes.io/configuration-snippet: |
+      more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src; object-src; prefetch-src; child-src; frame-src 'self'; worker-src; frame-ancestors 'self' https://scripts.zdv.uni-mainz.de; form-action 'self'; base-uri; manifest-src; plugin-types; report-uri; report-to";
+      more_set_headers "X-Frame-Options: sameorigin";
+      more_set_headers "X-Content-Type-Options: nosniff";
+      more_set_headers "ReferrerPolicy: origin";
+      more_set_headers "X-XSS-Protection: 1; mode=block";
+      if ($arg_out = "results-with-style") {
+        more_set_headers "X-Frame-Options: allow-from https://scripts.zdv.uni-mainz.de/";
+      }
       if ($host = "www.metager3.de") {
           return 301 https://metager3.de$request_uri;
       }
diff --git a/.gitlab/production-values.yaml b/.gitlab/production-values.yaml
index e4f3fb44ae2aa6b16a8dc958c4b85a35c7fe702c..aba1efca1f27d03a0580741da64a7ccd7dc31fb6 100644
--- a/.gitlab/production-values.yaml
+++ b/.gitlab/production-values.yaml
@@ -2,7 +2,8 @@ service:
   externalPort: 80
   internalPort: 80
 hpa:
-  minReplicas: 5
+  enabled: true
+  minReplicas: 1
   maxReplicas: 100
 resources:
   limits:
@@ -13,16 +14,25 @@ resources:
     memory: 1Gi
 podDisruptionBudget:
   enabled: true
-  minAvailable: 4
-  maxUnavailable:
+  minAvailable:
+  maxUnavailable: 0
 podAnnotations:
   prometheus.io/scrape: "true"
   prometheus.io/path: /metrics
   prometheus.io/port: "80"
+deploymentApiVersion: apps/v1
 ingress:
   annotations:
-    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     nginx.ingress.kubernetes.io/configuration-snippet: |
+      more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src; object-src; prefetch-src; child-src; frame-src 'self'; worker-src; frame-ancestors 'self' https://scripts.zdv.uni-mainz.de; form-action 'self'; base-uri; manifest-src; plugin-types; report-uri; report-to";
+      more_set_headers "X-Frame-Options: sameorigin";
+      more_set_headers "X-Content-Type-Options: nosniff";
+      more_set_headers "ReferrerPolicy: origin";
+      more_set_headers "X-XSS-Protection: 1; mode=block";
+      if ($arg_out = "results-with-style") {
+        more_set_headers "X-Frame-Options: allow-from https://scripts.zdv.uni-mainz.de/";
+      }
       if ($host = "www.metager.de") {
           return 301 https://metager.de$request_uri;
       }
diff --git a/.gitlab/review-apps-values.yaml b/.gitlab/review-apps-values.yaml
index f13b3784d6a276f15cb0e0a72001ea976580c908..8c4d37f43474dd7b4c48be7dea6b9df228c51d26 100644
--- a/.gitlab/review-apps-values.yaml
+++ b/.gitlab/review-apps-values.yaml
@@ -5,9 +5,19 @@ ingress:
   annotations: 
     kubernetes.io/tls-acme: "false"
     nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src; object-src; prefetch-src; child-src; frame-src 'self'; worker-src; frame-ancestors 'self' https://scripts.zdv.uni-mainz.de; form-action 'self'; base-uri; manifest-src; plugin-types; report-uri; report-to";
+      more_set_headers "X-Frame-Options: sameorigin";
+      more_set_headers "X-Content-Type-Options: nosniff";
+      more_set_headers "ReferrerPolicy: origin";
+      more_set_headers "X-XSS-Protection: 1; mode=block";
+      if ($arg_out = "results-with-style") {
+        more_set_headers "X-Frame-Options: allow-from https://scripts.zdv.uni-mainz.de/";
+      }
   tls: 
     enabled: false
 service: 
   commonName: ""
   externalPort: 80
   internalPort: 80
+deploymentApiVersion: apps/v1
diff --git a/Dockerfile b/Dockerfile
index a74f916b948735b21b1bc4ae838d4f2a515dae5d..bfdd92cae87b08678e11b1a889fdbe02edccc19c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,7 @@ RUN apk add --update \
     dcron \
     zip \
     redis \
+    libpng \
     php7 \
     php7-fpm \
     php7-common \
@@ -38,10 +39,10 @@ RUN sed -i 's/;error_log = log\/php7\/error.log/error_log = \/dev\/stderr/g' /et
     sed -i 's/;catch_workers_output = yes/catch_workers_output = yes/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/user = nobody/user = nginx/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/group = nobody/group = nginx/g' /etc/php7/php-fpm.d/www.conf && \
-    sed -i 's/pm.max_children = 5/pm.max_children = 100/g' /etc/php7/php-fpm.d/www.conf && \
-    sed -i 's/pm.start_servers = 2/pm.start_servers = 5/g' /etc/php7/php-fpm.d/www.conf && \
+    sed -i 's/pm.max_children = 5/pm.max_children = 1024/g' /etc/php7/php-fpm.d/www.conf && \
+    sed -i 's/pm.start_servers = 2/pm.start_servers = 50/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/pm.min_spare_servers = 1/pm.min_spare_servers = 5/g' /etc/php7/php-fpm.d/www.conf && \
-    sed -i 's/pm.max_spare_servers = 3/pm.max_spare_servers = 25/g' /etc/php7/php-fpm.d/www.conf && \
+    sed -i 's/pm.max_spare_servers = 3/pm.max_spare_servers = 50/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/user = www-data/user = nginx/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/group = www-data/group = nginx/g' /etc/php7/php-fpm.d/www.conf && \
     sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php7/php.ini && \
diff --git a/app/Http/Controllers/HumanVerification.php b/app/Http/Controllers/HumanVerification.php
index 741e55fef5a42d6e28090e6660d2f9e1488b560d..d304fc1b36e8619c1ef61a6632716e9f201c527a 100644
--- a/app/Http/Controllers/HumanVerification.php
+++ b/app/Http/Controllers/HumanVerification.php
@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use Captcha;
 use Carbon;
+use Cookie;
 use Illuminate\Hashing\BcryptHasher as Hasher;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
@@ -21,7 +22,17 @@ class HumanVerification extends Controller
         if ($url != null) {
             $url = base64_decode(str_replace("<<SLASH>>", "/", $url));
         } else {
-            $url = $request->input('url');
+            $url = $request->input('url', url("/"));
+        }
+
+        $protocol = "http://";
+
+        if ($request->secure()) {
+            $protocol = "https://";
+        }
+
+        if (stripos($url, $protocol . $request->getHttpHost()) !== 0) {
+            $url = url("/");
         }
 
         $userlist = Cache::get(HumanVerification::PREFIX . "." . $id, []);
@@ -40,7 +51,6 @@ class HumanVerification extends Controller
             $key = strtolower($key);
 
             if (!$hasher->check($key, $lockedKey)) {
-                sleep(\random_int(1, 8));
                 $captcha = Captcha::create("default", true);
                 $user["lockedKey"] = $captcha["key"];
                 HumanVerification::saveUser($user);
@@ -67,7 +77,7 @@ class HumanVerification extends Controller
                 }
             }
         }
-        sleep(\random_int(1, 8));
+
         $captcha = Captcha::create("default", true);
         $user["lockedKey"] = $captcha["key"];
         HumanVerification::saveUser($user);
@@ -146,9 +156,9 @@ class HumanVerification extends Controller
         $ip = $request->ip();
         $id = "";
         if (HumanVerification::couldBeSpammer($ip)) {
-            $id = hash("sha512", "999.999.999.999");
+            $id = hash("sha1", "999.999.999.999");
         } else {
-            $id = hash("sha512", $ip);
+            $id = hash("sha1", $ip);
         }
 
         $userlist = Cache::get(HumanVerification::PREFIX . "." . $id, []);
@@ -185,9 +195,9 @@ class HumanVerification extends Controller
         $uid = "";
         $ip = $request->ip();
         if (HumanVerification::couldBeSpammer($ip)) {
-            $uid = hash("sha512", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
+            $uid = hash("sha1", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
         } else {
-            $uid = hash("sha512", $ip . $_SERVER["AGENT"] . "uid");
+            $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
         }
 
         if ($uid === $id) {
@@ -217,11 +227,11 @@ class HumanVerification extends Controller
         $uid = "";
         $ip = $request->ip();
         if (\App\Http\Controllers\HumanVerification::couldBeSpammer($ip)) {
-            $id = hash("sha512", "999.999.999.999");
-            $uid = hash("sha512", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
+            $id = hash("sha1", "999.999.999.999");
+            $uid = hash("sha1", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
         } else {
-            $id = hash("sha512", $ip);
-            $uid = hash("sha512", $ip . $_SERVER["AGENT"] . "uid");
+            $id = hash("sha1", $ip);
+            $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
         }
 
         $userList = Cache::get(HumanVerification::PREFIX . "." . $id);
@@ -240,11 +250,11 @@ class HumanVerification extends Controller
         $uid = "";
         $ip = $request->ip();
         if (\App\Http\Controllers\HumanVerification::couldBeSpammer($ip)) {
-            $id = hash("sha512", "999.999.999.999");
-            $uid = hash("sha512", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
+            $id = hash("sha1", "999.999.999.999");
+            $uid = hash("sha1", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
         } else {
-            $id = hash("sha512", $ip);
-            $uid = hash("sha512", $ip . $_SERVER["AGENT"] . "uid");
+            $id = hash("sha1", $ip);
+            $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
         }
 
         $userList = Cache::get(HumanVerification::PREFIX . "." . $id);
@@ -261,4 +271,84 @@ class HumanVerification extends Controller
         HumanVerification::saveUser($user);
         return redirect('admin/bot');
     }
+
+    public function browserVerification(Request $request)
+    {
+        $key = $request->input("id", "");
+
+        // Verify that key is a md5 checksum
+        if (!preg_match("/^[a-f0-9]{32}$/", $key)) {
+            abort(404);
+        }
+
+        Redis::connection("cache")->pipeline(function ($redis) use ($key) {
+            $redis->rpush($key, true);
+            $redis->expire($key, 30);
+        });
+
+        return response(view('layouts.resultpage.verificationCss'), 200)->header("Content-Type", "text/css");
+    }
+
+    public static function block(Request $request)
+    {
+        $prefix = "humanverification";
+
+        $ip = $request->ip();
+        $id = "";
+        $uid = "";
+        if (\App\Http\Controllers\HumanVerification::couldBeSpammer($ip)) {
+            $id = hash("sha1", "999.999.999.999");
+            $uid = hash("sha1", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
+        } else {
+            $id = hash("sha1", $ip);
+            $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
+        }
+
+        /**
+         * If the user sends a Password or a key
+         * We will not verificate the user.
+         * If someone that uses a bot finds this out we
+         * might have to change it at some point.
+         */
+        if ($request->filled('password') || $request->filled('key') || Cookie::get('key') !== null || $request->filled('appversion') || !env('BOT_PROTECTION', false)) {
+            $update = false;
+            return $next($request);
+        }
+
+        # Get all Users of this IP
+        $users = Cache::get($prefix . "." . $id, []);
+
+        $user = [];
+        $changed = false;
+        if (empty($users[$uid])) {
+            $user = [
+                'uid' => $uid,
+                'id' => $id,
+                'unusedResultPages' => 0,
+                'whitelist' => false,
+                'locked' => true,
+                "lockedKey" => "",
+                "expiration" => now()->addWeeks(2),
+            ];
+            $changed = true;
+        } else {
+            $user = $users[$uid];
+            if (!$user["locked"]) {
+                $user["locked"] = true;
+                $changed = true;
+            }
+        }
+
+        if ($user["whitelist"]) {
+            $user["expiration"] = now()->addWeeks(2);
+        } else {
+            $user["expiration"] = now()->addHours(72);
+        }
+        if ($changed) {
+            $userList = Cache::get($prefix . "." . $user["id"], []);
+            $userList[$user["uid"]] = $user;
+            Cache::put($prefix . "." . $user["id"], $userList, 2 * 7 * 24 * 60 * 60);
+        }
+        return [$id, $uid];
+    }
 }
diff --git a/app/Http/Controllers/MailController.php b/app/Http/Controllers/MailController.php
index 9ff957dede09aec132a570cfdd8f5b6ee108e70f..86afc3ceb49cb6df4e9d3a8f1267bcf2fa17dae0 100644
--- a/app/Http/Controllers/MailController.php
+++ b/app/Http/Controllers/MailController.php
@@ -8,9 +8,10 @@ use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use LaravelLocalization;
 use Mail;
+use Log;
 use Validator;
-use \PHP_IBAN\IBAN;
-use \PHP_IBAN\IBANCountry;
+use \IBAN;
+use \IBANCountry;
 
 class MailController extends Controller
 {
@@ -148,6 +149,7 @@ class MailController extends Controller
                 $messageType = "success";
                 $messageToUser = "Herzlichen Dank!! Wir haben Ihre Spendenbenachrichtigung erhalten.";
             } catch (\Swift_TransportException $e) {
+                Log::error($e->getMessage());
                 $messageType = "error";
                 $messageToUser = 'Beim Senden Ihrer Spendenbenachrichtigung ist ein Fehler auf unserer Seite aufgetreten. Bitte schicken Sie eine E-Mail an: office@suma-ev.de, damit wir uns darum kümmern können.';
             }
diff --git a/app/Http/Controllers/MetaGerSearch.php b/app/Http/Controllers/MetaGerSearch.php
index 55589b09cd032fcb5454049a6deb038bf6ff6d43..60fc655f1faa5e6362f7d6f447983598eeaa8664 100644
--- a/app/Http/Controllers/MetaGerSearch.php
+++ b/app/Http/Controllers/MetaGerSearch.php
@@ -143,7 +143,13 @@ class MetaGerSearch extends Controller
         $counter = $registry->getOrRegisterCounter('metager', 'query_counter', 'counts total number of search queries', []);
         $counter->inc();
 
-        return $resultpage;
+        // Splitting the response return into multiple parts.
+        // This might speed up page view time for users with slow network
+        $responseArray = str_split($resultpage->render(), 1024);
+        foreach ($responseArray as $responsePart) {
+            echo ($responsePart);
+            flush();
+        }
     }
 
     public function searchTimings(Request $request, MetaGer $metager)
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 24a8c577ad62a61ca1483aa960a79c646daf5593..cb14ae7025a3077233dfb5cd09cd401242a20a52 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -62,5 +62,6 @@ class Kernel extends HttpKernel
         'referer.check' => \App\Http\Middleware\RefererCheck::class,
         'humanverification' => \App\Http\Middleware\HumanVerification::class,
         'useragentmaster' => \App\Http\Middleware\UserAgentMaster::class,
+        'browserverification' => \App\Http\Middleware\BrowserVerification::class,
     ];
 }
diff --git a/app/Http/Middleware/BrowserVerification.php b/app/Http/Middleware/BrowserVerification.php
new file mode 100644
index 0000000000000000000000000000000000000000..e4cf55ed133386d3b90819c63e10950ebca968d5
--- /dev/null
+++ b/app/Http/Middleware/BrowserVerification.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Support\Facades\Redis;
+
+class BrowserVerification
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        ini_set('zlib.output_compression', 'Off');
+        ini_set('output_buffering', 'Off');
+        ini_set('output_handler', '');
+        ob_end_clean();
+
+        $bvEnabled = config("metager.metager.browserverification_enabled");
+        if (empty($bvEnabled) || !$bvEnabled) {
+            return $next($request);
+        }
+
+        $mgv = $request->input('mgv', "");
+        if (!empty($mgv)) {
+            // Verify that key is a md5 checksum
+            if (!preg_match("/^[a-f0-9]{32}$/", $mgv)) {
+                abort(404);
+            }
+            $result = boolval(Redis::connection("cache")->blpop($mgv, 5));
+            if ($result === true) {
+                return $next($request);
+            } else {
+                return redirect("/");
+            }
+        }
+
+        header('Content-type: text/html; charset=utf-8');
+        header('X-Accel-Buffering: no');
+
+        $key = md5($request->ip() . microtime(true));
+
+        echo (view('layouts.resultpage.verificationHeader')->with('key', $key)->render());
+        flush();
+
+        $answer = boolval(Redis::connection("cache")->blpop($key, 2));
+
+        if ($answer === true) {
+            echo (view('layouts.resultpage.resources')->render());
+            flush();
+            $request->request->add(["headerPrinted" => true]);
+            return $next($request);
+        }
+
+        $params = $request->all();
+        $params["mgv"] = $key;
+        $url = route("resultpage", $params);
+
+        echo (view('layouts.resultpage.unverifiedResultPage')
+                ->with('url', $url)
+                ->render());
+
+    }
+}
diff --git a/app/Http/Middleware/HumanVerification.php b/app/Http/Middleware/HumanVerification.php
index 5599671c6102f335ee32d1c2e3b9f8b8eefa2453..34abf5f20bf9fbc7e221c75121dc11fa73d954cc 100644
--- a/app/Http/Middleware/HumanVerification.php
+++ b/app/Http/Middleware/HumanVerification.php
@@ -3,10 +3,8 @@
 namespace App\Http\Middleware;
 
 use Cache;
-use Captcha;
 use Closure;
 use Cookie;
-use Illuminate\Http\Response;
 use Log;
 use URL;
 
@@ -30,11 +28,11 @@ class HumanVerification
             $id = "";
             $uid = "";
             if (\App\Http\Controllers\HumanVerification::couldBeSpammer($ip)) {
-                $id = hash("sha512", "999.999.999.999");
-                $uid = hash("sha512", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
+                $id = hash("sha1", "999.999.999.999");
+                $uid = hash("sha1", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
             } else {
-                $id = hash("sha512", $ip);
-                $uid = hash("sha512", $ip . $_SERVER["AGENT"] . "uid");
+                $id = hash("sha1", $ip);
+                $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
             }
             unset($_SERVER["AGENT"]);
 
@@ -101,19 +99,7 @@ class HumanVerification
 
             # If the user is locked we will force a Captcha validation
             if ($user["locked"]) {
-                sleep(\random_int(1, 8));
-                $captcha = Captcha::create("default", true);
-                $user["lockedKey"] = $captcha["key"];
-                \App\PrometheusExporter::CaptchaShown();
-                return
-                new Response(
-                    view('humanverification.captcha')
-                        ->with('title', "Bestätigung erforderlich")
-                        ->with('uid', $uid)
-                        ->with('id', $id)
-                        ->with('url', url()->full())
-                        ->with('image', $captcha["img"])
-                );
+                return redirect()->route('captcha', ["id" => $id, "uid" => $uid, "url" => url()->full()]);
             }
 
             $user["unusedResultPages"]++;
diff --git a/app/Http/Middleware/LocalizationRedirect.php b/app/Http/Middleware/LocalizationRedirect.php
index c8513b202703ab03885440824e3dab56237c6394..6d2e0e047c3b443af64089c001258512894cd5f9 100644
--- a/app/Http/Middleware/LocalizationRedirect.php
+++ b/app/Http/Middleware/LocalizationRedirect.php
@@ -19,27 +19,31 @@ class LocalizationRedirect
         $locale = LaravelLocalization::getCurrentLocale();
         $host = $request->getHttpHost();
 
-
         // We only redirect to the TLDs in the production version and exclude our onion domain
-        if(env("APP_ENV", "") !== "production" || $host === "b7cxf4dkdsko6ah2.onion" || $request->is('metrics')){
+        if (env("APP_ENV", "") !== "production" || $host === "metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion" || $request->is('metrics')) {
             return $next($request);
         }
 
+        // Redirect from v2 onion to v3 onion
+        if ($host === "b7cxf4dkdsko6ah2.onion") {
+            return redirect("http://metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion");
+        }
+
         $url = url()->full();
         $url = preg_replace("/^http:\/\//", "https://", $url);
-        if($host !== "metager.de" && $locale == "de"){
+        if ($host !== "metager.de" && $locale == "de") {
             $url = str_replace($host, "metager.de", $url);
             $url = preg_replace("/^(https:\/\/[^\/]+)\/de/", "$1", $url);
             return redirect($url);
         }
 
-        if($host !== "metager.es" && $locale == "es"){
+        if ($host !== "metager.es" && $locale == "es") {
             $url = str_replace($host, "metager.es", $url);
             $url = preg_replace("/^(https:\/\/[^\/]+)\/es/", "$1", $url);
             return redirect($url);
         }
 
-        if($host !== "metager.org" && $locale == "en"){
+        if ($host !== "metager.org" && $locale == "en") {
             $url = str_replace($host, "metager.org", $url);
             $url = preg_replace("/^(https:\/\/[^\/]+)\/en/", "$1", $url);
             return redirect($url);
diff --git a/app/MetaGer.php b/app/MetaGer.php
index 247c8104b879aee8d0ffb71fcc5ddb8546e7dc1a..0c53bd95bac952991f94c3552e6853db68c49835 100644
--- a/app/MetaGer.php
+++ b/app/MetaGer.php
@@ -723,8 +723,8 @@ class MetaGer
                 if (!empty($filter->sumas->$engineName)) {
                     if (empty($availableFilter[$filterName])) {
                         $availableFilter[$filterName] = $filter;
-                        foreach($availableFilter[$filterName]->values as $key => $value){
-                            if($key !== "nofilter"){
+                        foreach ($availableFilter[$filterName]->values as $key => $value) {
+                            if ($key !== "nofilter") {
                                 unset($availableFilter[$filterName]->values->{$key});
                             }
                         }
@@ -749,8 +749,8 @@ class MetaGer
                         }
                         if (empty($availableFilter[$filterName])) {
                             $availableFilter[$filterName] = $filter;
-                            foreach($availableFilter[$filterName]->values as $key => $value){
-                                if($key !== "nofilter"){
+                            foreach ($availableFilter[$filterName]->values as $key => $value) {
+                                if ($key !== "nofilter") {
                                     unset($availableFilter[$filterName]->values->{$key});
                                 }
                             }
@@ -899,7 +899,6 @@ class MetaGer
 
     public function parseFormData(Request $request)
     {
-
         # Sichert, dass der request in UTF-8 formatiert ist
         if ($request->input('encoding', 'utf8') !== "utf8") {
             # In früheren Versionen, als es den Encoding Parameter noch nicht gab, wurden die Daten in ISO-8859-1 übertragen
@@ -909,6 +908,8 @@ class MetaGer
             }
             $request->replace($input);
         }
+        $this->headerPrinted = $request->input("headerPrinted", false);
+        $request->request->remove("headerPrinted");
         $this->url = $request->url();
         $this->fullUrl = $request->fullUrl();
         # Zunächst überprüfen wir die eingegebenen Einstellungen:
@@ -928,6 +929,13 @@ class MetaGer
         # Sucheingabe
         $this->eingabe = trim($request->input('eingabe', ''));
         $this->q = $this->eingabe;
+
+        if ($request->filled("mgv")) {
+            $this->framed = true;
+        } else {
+            $this->framed = false;
+        }
+
         # IP
         $this->ip = $this->anonymizeIp($request->ip());
 
@@ -953,16 +961,18 @@ class MetaGer
         # Sprüche
         if (!App::isLocale("de") || (\Cookie::has($this->getFokus() . '_setting_zitate') && \Cookie::get($this->getFokus() . '_setting_zitate') === "off")) {
             $this->sprueche = "off";
-        }else{
+        } else {
             $this->sprueche = "on";
         }
-        if($request->filled("zitate") && $request->input('zitate') === "on" || $request->input('zitate') === "off"){
+        if ($request->filled("zitate") && $request->input('zitate') === "on" || $request->input('zitate') === "off") {
             $this->sprueche = $request->input('quotes');
         }
-        
+
         $this->newtab = $request->input('newtab', 'on');
         if ($this->newtab === "on") {
             $this->newtab = "_blank";
+        } else if ($this->framed) {
+            $this->newtab = "_top";
         } else {
             $this->newtab = "_self";
         }
@@ -1020,19 +1030,19 @@ class MetaGer
         $this->request = $request->replace($request->except(['verification_id', 'uid', 'verification_count']));
 
         // Disable freshness filter if custom freshness filter isset
-        if($this->request->filled("ff") && $this->request->filled("f")){
+        if ($this->request->filled("ff") && $this->request->filled("f")) {
             $this->request = $this->request->replace($this->request->except(["f"]));
         }
         // Remove custom time filter if either of the dates isn't set or is not a date
-        if($this->request->input("fc") === "on"){
-            if(!$this->request->filled("ff") || !$this->request->filled("ft")){
+        if ($this->request->input("fc") === "on") {
+            if (!$this->request->filled("ff") || !$this->request->filled("ft")) {
                 $this->request = $this->request->replace($this->request->except(["fc", "ff", "ft"]));
-            }else{
+            } else {
                 $ff = $this->request->input("ff");
                 $ft = $this->request->input("ft");
-                if(!preg_match("/^\d{4}-\d{2}-\d{2}$/", $ff) || !preg_match("/^\d{4}-\d{2}-\d{2}$/", $ft)){
+                if (!preg_match("/^\d{4}-\d{2}-\d{2}$/", $ff) || !preg_match("/^\d{4}-\d{2}-\d{2}$/", $ft)) {
                     $this->request = $this->request->replace($this->request->except(["fc", "ff", "ft"]));
-                }else{
+                } else {
                     // Now Check if there is something wrong with the dates
                     $from = $this->request->input("ff");
                     $to = $this->request->input("ft");
@@ -1040,21 +1050,21 @@ class MetaGer
                     $from = Carbon::createFromFormat("Y-m-d H:i:s", $from . " 00:00:00");
                     $to = Carbon::createFromFormat("Y-m-d H:i:s", $to . " 00:00:00");
 
-                    if($from > Carbon::now()){
+                    if ($from > Carbon::now()) {
                         $from = Carbon::now();
                         $changed = true;
                     }
-                    if($to > Carbon::now()){
+                    if ($to > Carbon::now()) {
                         $to = Carbon::now();
                         $changed = true;
                     }
-                    if($from > $to){
+                    if ($from > $to) {
                         $tmp = $to;
                         $to = $from;
                         $from = $tmp;
                         $changed = true;
                     }
-                    if($changed){
+                    if ($changed) {
                         $oldParameters = $this->request->all();
                         $oldParameters["ff"] = $from->format("Y-m-d");
                         $oldParameters["ft"] = $to->format("Y-m-d");
@@ -1062,7 +1072,7 @@ class MetaGer
                     }
                 }
             }
-        }else if($this->request->filled("ff") || $this->request->filled("ft")){
+        } else if ($this->request->filled("ff") || $this->request->filled("ft")) {
             $this->request = $this->request->replace($this->request->except(["fc", "ff", "ft"]));
         }
 
@@ -1170,7 +1180,7 @@ class MetaGer
             if (($request->filled($filter->{"get-parameter"}) && $request->input($filter->{"get-parameter"}) !== "off") ||
                 \Cookie::get($this->getFokus() . "_setting_" . $filter->{"get-parameter"}) !== null
             ) { # If the filter is set via Cookie
-                $this->parameterFilter[$filterName] = $filter;
+            $this->parameterFilter[$filterName] = $filter;
                 $this->parameterFilter[$filterName]->value = $request->input($filter->{"get-parameter"}, '');
                 if (empty($this->parameterFilter[$filterName]->value)) {
                     $this->parameterFilter[$filterName]->value = \Cookie::get($this->getFokus() . "_setting_" . $filter->{"get-parameter"});
@@ -1349,7 +1359,7 @@ class MetaGer
     public function nextSearchLink()
     {
         if (isset($this->next) && isset($this->next['engines']) && count($this->next['engines']) > 0) {
-            $requestData = $this->request->except(['page', 'out']);
+            $requestData = $this->request->except(['page', 'out', 'submit-query', 'mgv']);
             if ($this->request->input('out', '') !== "results" && $this->request->input('out', '') !== '') {
                 $requestData["out"] = $this->request->input('out');
             }
@@ -1495,7 +1505,7 @@ class MetaGer
 
     public function generateSearchLink($fokus, $results = true)
     {
-        $except = ['page', 'next', 'out'];
+        $except = ['page', 'next', 'out', 'submit-query', 'mgv'];
         # Remove every Filter
         foreach ($this->sumaFile->filter->{"parameter-filter"} as $filterName => $filter) {
             $except[] = $filter->{"get-parameter"};
@@ -1509,7 +1519,7 @@ class MetaGer
 
     public function generateEingabeLink($eingabe)
     {
-        $except = ['page', 'next', 'out', 'eingabe'];
+        $except = ['page', 'next', 'out', 'eingabe', 'submit-query', 'mgv'];
         $requestData = $this->request->except($except);
 
         $requestData['eingabe'] = $eingabe;
@@ -1528,7 +1538,7 @@ class MetaGer
     public function generateSiteSearchLink($host)
     {
         $host = urlencode($host);
-        $requestData = $this->request->except(['page', 'out', 'next']);
+        $requestData = $this->request->except(['page', 'out', 'next', 'submit-query', 'mgv']);
         $requestData['eingabe'] .= " site:$host";
         $requestData['focus'] = "web";
         $link = action('MetaGerSearch@search', $requestData);
@@ -1538,7 +1548,7 @@ class MetaGer
     public function generateRemovedHostLink($host)
     {
         $host = urlencode($host);
-        $requestData = $this->request->except(['page', 'out', 'next']);
+        $requestData = $this->request->except(['page', 'out', 'next', 'submit-query', 'mgv']);
         $requestData['eingabe'] .= " -site:$host";
         $link = action('MetaGerSearch@search', $requestData);
         return $link;
@@ -1547,7 +1557,7 @@ class MetaGer
     public function generateRemovedDomainLink($domain)
     {
         $domain = urlencode($domain);
-        $requestData = $this->request->except(['page', 'out', 'next']);
+        $requestData = $this->request->except(['page', 'out', 'next', 'submit-query', 'mgv']);
         $requestData['eingabe'] .= " -site:*.$domain";
         $link = action('MetaGerSearch@search', $requestData);
         return $link;
@@ -1812,6 +1822,17 @@ class MetaGer
     {
         return $this->engines;
     }
+
+    public function isFramed()
+    {
+        return $this->framed;
+    }
+
+    public function isHeaderPrinted()
+    {
+        return $this->headerPrinted;
+    }
+
     /**
      * Used by JS result loader to restore MetaGer Object of previous request
      */
diff --git a/chart/.gitignore b/chart/.gitignore
deleted file mode 100644
index e6b3ed643d846953e94118ea579d3ee30eda8c9e..0000000000000000000000000000000000000000
--- a/chart/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-charts/*
diff --git a/chart/.gitlab-ci.yml b/chart/.gitlab-ci.yml
deleted file mode 100644
index a20ff2750f793aa68a7aec7fb624f0c6aef7874e..0000000000000000000000000000000000000000
--- a/chart/.gitlab-ci.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-image: "registry.gitlab.com/gitlab-org/gitlab-build-images:alpine-helm"
-
-stages:
-  - test
-  - release
-
-lint:
-  stage: test
-  script:
-    - helm lint .
-
-release-chart:
-  stage: release
-  script:
-    - curl --fail --request POST --form "token=$CI_JOB_TOKEN" --form ref=master https://gitlab.com/api/v4/projects/2860651/trigger/pipeline
-  only:
-    - master@gitlab-org/charts/auto-deploy-app
diff --git a/chart/.helmignore b/chart/.helmignore
deleted file mode 100644
index f0c13194444163d1cba5c67d9e79231a62bc8f44..0000000000000000000000000000000000000000
--- a/chart/.helmignore
+++ /dev/null
@@ -1,21 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
diff --git a/chart/CONTRIBUTING.md b/chart/CONTRIBUTING.md
index 589986f81fb88cbe8fb80647b6eb2bc1e1cfd89a..2354acbbc56c5570432f50fa7327eac208bba6e1 100644
--- a/chart/CONTRIBUTING.md
+++ b/chart/CONTRIBUTING.md
@@ -23,4 +23,31 @@ _This notice should stay as the first item in the CONTRIBUTING.md file._
 We want to create a welcoming environment for everyone who is interested
 in contributing. Please visit our [Code of Conduct
 page](https://about.gitlab.com/contributing/code-of-conduct) to learn
-more about our committment to an open and welcoming environment.
+more about our commitment to an open and welcoming environment.
+
+## Merge request guidelines
+
+Below are some guidelines for merge requests:
+
+- Any new configuration option should be documented in
+  the `Configuration` section in README.md.
+- For any template changes, we encourage a test case be added or
+  updated in the
+  [template tests](https://gitlab.com/gitlab-org/charts/auto-deploy-app/-/blob/master/test/template_test.go).
+
+### Working with the tests
+
+The tests are written in [Go](https://golang.org) (version 1.13 or later,
+with [modules enabled](https://golang.org/cmd/go/#hdr-Module_support)) using
+the [Terratest](https://github.com/gruntwork-io/terratest) library. To work
+on the tests, you need to have [Helm 2](https://v2.helm.sh/docs/) and
+[Go](https://golang.org) installed.
+
+To run the tests, run the following commands from the root of your copy of `auto-deploy-app`:
+
+```shell
+helm init --client-only               # required only once
+helm dependency build .               # required only once
+cd test
+GO111MODULE=auto go test .            # required for every change to the tests or the template
+```
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 66468482be5abf74f69cc3071985aaca34e77b52..87e9a4cf8d0b3c539b3a34fd333fce0335ec5058 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v1
 description: GitLab's Auto-deploy Helm Chart
 name: auto-deploy-app
-version: 0.4.0
+version: 1.0.3
 icon: https://gitlab.com/gitlab-com/gitlab-artwork/raw/master/logo/logo-square.png
diff --git a/chart/README.md b/chart/README.md
index a56d2c0167abf8722fb5353f9b24f203a421c101..095df11e46134d8d0a0602ea6a774e41b0375c8b 100644
--- a/chart/README.md
+++ b/chart/README.md
@@ -1,5 +1,14 @@
 # GitLab's Auto-deploy Helm Chart
 
+## Deprecation Notice
+
+GitLab is moving all development for `auto-deploy-app` into [`auto-deploy-image`](https://gitlab.com/gitlab-org/cluster-integration/auto-deploy-image). 
+Going forward, the `auto-deploy-app` Helm chart will be bundled with `auto-deploy-image`
+and will no longer released as a stand-alone Helm chart. Existing releases of `auto-deploy-app`
+will remain in [GitLab's chart registry](http://charts.gitlab.io/).
+
+If you have any questions, please ask in <https://gitlab.com/gitlab-org/charts/auto-deploy-app/-/issues/70>.
+
 ## Requirements
 
 - Helm `2.9.0` and above is required in order support `"helm.sh/hook-delete-policy": before-hook-creation` for migrations
@@ -9,6 +18,9 @@
 | Parameter                     | Description | Default                            |
 | ---                           | ---         | ---                                |
 | replicaCount                  |             | `1`                                |
+| strategyType                  | Pod deployment [strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) | `nil` |
+| enableSelector                | If `true`, enables selector field for the deployment. Only applicable for `extensions/v1beta1`, as selector field will always be included for `apps/v1` | `nil` |
+| deploymentApiVersion          | Sets `apiVersion` field for the deployment. Can be set to either `extensions/v1beta1` or `apps/v1`. | `extensions/v1beta1` |
 | image.repository              |             | `gitlab.example.com/group/project` |
 | image.tag                     |             | `stable`                           |
 | image.pullPolicy              |             | `Always`                           |
@@ -17,7 +29,7 @@
 | application.track             |             | `stable`                           |
 | application.tier              |             | `web`                              |
 | application.migrateCommand    | If present, this variable will run as a shell command within an application Container as a Helm pre-upgrade Hook. Intended to run migration commands. | `nil` |
-| application.initializeCommand | If present, this variable will run as shall command within an application Container as a Helm post-install Hook. Intended to run database initialization commands. | `nil` |
+| application.initializeCommand | If present, this variable will run as shell command within an application Container as a Helm post-install Hook. Intended to run database initialization commands. When set, the Deployment resource will be skipped.| `nil` |
 | application.secretName        | Pass in the name of a Secret which the deployment will [load all key-value pairs from the Secret as environment variables](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables) in the application container. | `nil` |
 | application.secretChecksum    | Pass in the checksum of the secrets referenced by `application.secretName`. | `nil` |
 | hpa.enabled                   | If true, enables horizontal pod autoscaler. A resource request is also required to be set, such as `resources.requests.cpu: 200m`.| `false` |
@@ -37,21 +49,25 @@
 | service.commonName            | If present, this will define the ssl certificate common name to be used by CertManager. `service.url` and `service.additionalHosts` will be added as Subject Alternative Names (SANs) | `nil` |
 | service.externalPort          |             | `5000`                             |
 | service.internalPort          |             | `5000`                             |
+| ingress.enabled               | If true, enables ingress | `true`                |
 | ingress.tls.enabled           | If true, enables SSL | `true`                    |
 | ingress.tls.secretName        | Name of the secret used to terminate SSL traffic | `""` |
 | ingress.modSecurity.enabled | Enable custom configuration for modsecurity, defaulting to [the Core Rule Set](https://coreruleset.org) | `false` |
 | ingress.modSecurity.secRuleEngine | Configuration for [ModSecurity's rule engine](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine) | `DetectionOnly` |
+| ingress.modSecurity.secRules | Configuration for custom [ModSecurity's rules](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#secrule) | `nil` |
 | ingress.annotations           | Ingress annotations | `{kubernetes.io/tls-acme: "true", kubernetes.io/ingress.class: "nginx"}` |
 | livenessProbe.path            | Path to access on the HTTP server on periodic probe of container liveness. | `/`                                |
 | livenessProbe.scheme          | Scheme to access the HTTP server (HTTP or HTTPS). | `HTTP`                                |
 | livenessProbe.initialDelaySeconds | # of seconds after the container has started before liveness probes are initiated. | `15`                               |
 | livenessProbe.timeoutSeconds  | # of seconds after which the liveness probe times out. | `15`                               |
 | livenessProbe.probeType       | Type of [liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes) to use. | `httpGet`
+| livenessProbe.command         | Commands for use with probe type 'exec'. | `{}`
 | readinessProbe.path           | Path to access on the HTTP server on periodic probe of container readiness. | `/`                                |
 | readinessProbe.scheme         | Scheme to access the HTTP server (HTTP or HTTPS). | `HTTP`                                |
 | readinessProbe.initialDelaySeconds | # of seconds after the container has started before readiness probes are initiated. | `5`                                |
 | readinessProbe.timeoutSeconds | # of seconds after which the readiness probe times out. | `3`                                |
 | readinessProbe.probeType     | Type of [readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes) to use. | `httpGet`
+| readinessProbe.command       | Commands for use with probe type 'exec'. | `{}`
 | postgresql.enabled            |             | `true`                             |
 | postgresql.managed            | If true, this will provision a managed Postgres instance via crossplane.            | `false`                             |
 | postgresql.managedClassSelector            | This will allow provisioning a Postgres instance based on label selectors via Crossplane, eg: `managedClassSelector.matchLabels.stack: gitlab`. The `postgresql.managed` value should be true as well for this to be honoured. [Crossplane Configuration](https://docs.gitlab.com/ee/user/clusters/applications.html#crossplane)            | `{}`                             |
@@ -59,3 +75,10 @@
 | podDisruptionBudget.maxUnavailable |             | `1`                            |
 | podDisruptionBudget.minAvailable | If present, this variable will configure minAvailable in the PodDisruptionBudget. :warning: if you have `replicaCount: 1` and `podDisruptionBudget.minAvailable: 1` `kubectl drain` will be blocked.              | `nil`                            |
 | prometheus.metrics            | Annotates the service for prometheus auto-discovery. Also denies access to the `/metrics` endpoint from external addresses with Ingress. | `false` |
+| networkPolicy.enabled         | Enable container network policy | `false` |
+| networkPolicy.spec            | [Network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) definition | `{ podSelector: { matchLabels: {} }, ingress: [{ from: [{ podSelector: { matchLabels: {} } }, { namespaceSelector: { matchLabels: { app.gitlab.com/managed_by: gitlab } } }] }] }` |
+
+## PostgreSQL
+
+This chart depends on version 0.7.1 of the `stable/postgresql` chart.
+For reference the source code for this specific version can be found at https://github.com/helm/charts/tree/b90ad657e1a226eb52c3eb6a2a95ba3d6d494f58/stable/postgresql
\ No newline at end of file
diff --git a/chart/templates/NOTES.txt b/chart/templates/NOTES.txt
index 0ef42bbda93bc99a87ed5b4cd0ba6c86497be815..5491ce9318e4fd2578c6c86de79f2bd268d00739 100644
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -1,5 +1,12 @@
-{{- if .Values.service.enabled -}}
-Application should be accessible at: {{ .Values.service.url }}
+{{- if and .Values.ingress.enabled .Values.service.enabled -}}
+Application should be accessible at
+
+    {{ .Values.service.url }}
 {{- else -}}
-Application will be accessible at: {{ .Values.service.url }} when you deploy stable track.
+Application was deployed reusing the service at
+
+    {{ .Values.service.url }}
+
+It will share a load balancer with the previous release (or be unavailable if
+no service or ingress was previously deployed).
 {{- end -}}
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
index 913145e6ae42383d3f2810a035fc750dd1b0c7b4..add519dae35c3fa7a8f8dd4c67c1bd45b2641594 100644
--- a/chart/templates/_helpers.tpl
+++ b/chart/templates/_helpers.tpl
@@ -20,6 +20,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- printf "%s" $releaseName | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{- define "imagename" -}}
+{{- if eq .Values.image.tag "" -}}
+{{- .Values.image.repository -}}
+{{- else -}}
+{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "trackableappname" -}}
 {{- $trackableName := printf "%s-%s" (include "appname" .) .Values.application.track -}}
 {{- $trackableName | trimSuffix "-stable" | trunc 63 | trimSuffix "-" -}}
@@ -29,5 +37,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 Get a hostname from URL
 */}}
 {{- define "hostname" -}}
-{{- . | trimPrefix "http://" |  trimPrefix "https://" | trimSuffix "/" | quote -}}
+{{- . | trimPrefix "http://" |  trimPrefix "https://" | trimSuffix "/" | trim | quote -}}
 {{- end -}}
+
+{{/*
+Get SecRule's arguments with unescaped single&double quotes
+*/}}
+{{- define "secrule" -}}
+{{- $operator := .operator | quote | replace "\"" "\\\"" | replace "'" "\\'" -}}
+{{- $action := .action | quote | replace "\"" "\\\"" | replace "'" "\\'" -}}
+{{- printf "SecRule %s %s %s" .variable $operator $action -}}
+{{- end -}}
\ No newline at end of file
diff --git a/chart/templates/db-initialize-job.yaml b/chart/templates/db-initialize-job.yaml
index 12fd5112744e2ae3504a71c1bdd5edabd2685657..535731a51a2093396cb212f1b865234dd93ec395 100644
--- a/chart/templates/db-initialize-job.yaml
+++ b/chart/templates/db-initialize-job.yaml
@@ -24,7 +24,7 @@ spec:
 {{ toYaml .Values.image.secrets | indent 10 }}
       containers:
       - name: {{ .Chart.Name }}
-        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        image: {{ template "imagename" . }}
         command: ["/bin/sh"]
         args: ["-c", "{{ .Values.application.initializeCommand }}"]
         imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -36,4 +36,8 @@ spec:
         env:
         - name: DATABASE_URL
           value: {{ .Values.application.database_url | quote }}
+        - name: GITLAB_ENVIRONMENT_NAME
+          value: {{ .Values.gitlab.envName | quote }}
+        - name: GITLAB_ENVIRONMENT_URL
+          value: {{ .Values.gitlab.envURL | quote }}
 {{- end -}}
diff --git a/chart/templates/db-migrate-hook.yaml b/chart/templates/db-migrate-hook.yaml
index b2d5aa7f613ad27fd728b48dcc0f83f23bdf9d56..78b871fea1421f5051acd415954d204c0316d1cf 100644
--- a/chart/templates/db-migrate-hook.yaml
+++ b/chart/templates/db-migrate-hook.yaml
@@ -24,7 +24,7 @@ spec:
 {{ toYaml .Values.image.secrets | indent 10 }}
       containers:
       - name: {{ .Chart.Name }}
-        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        image: {{ template "imagename" . }}
         command: ["/bin/sh"]
         args: ["-c", "{{ .Values.application.migrateCommand }}"]
         imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -36,4 +36,8 @@ spec:
         env:
         - name: DATABASE_URL
           value: {{ .Values.application.database_url | quote }}
+        - name: GITLAB_ENVIRONMENT_NAME
+          value: {{ .Values.gitlab.envName | quote }}
+        - name: GITLAB_ENVIRONMENT_URL
+          value: {{ .Values.gitlab.envURL | quote }}
 {{- end -}}
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index c01a6f1142d516d7048360218bfe80887ce5c063..bdf168cc0e8561bb226705f25721d93c78f8dfba 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -1,5 +1,5 @@
 {{- if not .Values.application.initializeCommand -}}
-apiVersion: extensions/v1beta1
+apiVersion: {{ default "extensions/v1beta1" .Values.deploymentApiVersion }}
 kind: Deployment
 metadata:
   name: {{ template "trackableappname" . }}
@@ -14,7 +14,19 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 spec:
+{{- if or .Values.enableSelector (eq (default "extensions/v1beta1" .Values.deploymentApiVersion) "apps/v1") }}
+  selector:
+    matchLabels:
+      app: {{ template "appname" . }}
+      track: "{{ .Values.application.track }}"
+      tier: "{{ .Values.application.tier }}"
+      release: {{ .Release.Name }}
+{{- end }}
   replicas: {{ .Values.replicaCount }}
+{{- if .Values.strategyType }}
+  strategy:
+    type: {{ .Values.strategyType | quote }}
+{{- end }}
   template:
     metadata:
       annotations:
@@ -30,19 +42,8 @@ spec:
         tier: "{{ .Values.application.tier }}"
         release: {{ .Release.Name }}
     spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: worker
-                operator: NotIn
-                values:
-                - temp
       imagePullSecrets:
 {{ toYaml .Values.image.secrets | indent 10 }}
-      securityContext:
-        fsGroup: 2000
       volumes:
       - name: mglogs-persistent-storage
         persistentVolumeClaim:
@@ -62,8 +63,10 @@ spec:
       - name: blacklist-ad
         secret:
           secretName: metager-ad-blacklist
+      - name: metager-config
+        configMap:
+          name: metager
       containers:
-      # Main PHP-FPM Container
       - name: {{ .Chart.Name }}-phpfpm
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -93,6 +96,9 @@ spec:
           initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
           timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
         volumeMounts:
+        - name: metager-config
+          mountPath: /html/config/metager
+          readOnly: true
         - name: mglogs-persistent-storage
           mountPath: /html/storage/logs/metager
           readOnly: false
diff --git a/chart/templates/ingress.yaml b/chart/templates/ingress.yaml
index ec7cba476deee3d8e013c663c8da077cffda1d9e..b315cdbbd8db857965369e30427064371dc7df55 100644
--- a/chart/templates/ingress.yaml
+++ b/chart/templates/ingress.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.service.enabled -}}
+{{- if and (.Values.service.enabled) (eq .Values.application.track "stable") (or (.Values.ingress.enabled) (not (hasKey .Values.ingress "enabled"))) -}}
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
@@ -12,10 +12,15 @@ metadata:
 {{- if .Values.ingress.annotations }}
 {{ toYaml .Values.ingress.annotations | indent 4 }}
 {{- end }}
-{{- if and .Values.ingress.modSecurity .Values.ingress.modSecurity.enabled }}
+{{- with .Values.ingress.modSecurity }}
+{{- if .enabled }}
+    nginx.ingress.kubernetes.io/modsecurity-transaction-id: "$server_name-$request_id"
     nginx.ingress.kubernetes.io/modsecurity-snippet: |
-      SecRuleEngine {{ .Values.ingress.modSecurity.secRuleEngine | default "DetectionOnly" | title }}
-
+      SecRuleEngine {{ .secRuleEngine | default "DetectionOnly" | title }}
+{{- range $rule := .secRules }}
+{{ (include "secrule" $rule) | indent 6 }}
+{{- end }}
+{{- end }}
 {{- end }}
 {{- if .Values.prometheus.metrics }}
     nginx.ingress.kubernetes.io/server-snippet: |-
@@ -34,7 +39,7 @@ spec:
     - {{ template "hostname" .Values.service.url }}
 {{- if .Values.service.additionalHosts }}
 {{- range $host := .Values.service.additionalHosts }}
-    - {{ $host }}
+    - {{ template "hostname" $host }}
 {{- end -}}
 {{- end }}
     secretName: {{ .Values.ingress.tls.secretName | default (printf "%s-tls" (include "fullname" .)) }}
@@ -48,10 +53,6 @@ spec:
         backend:
           serviceName: {{ template "fullname" . }}
           servicePort: {{ .Values.service.externalPort }}
-      - path: /wsb
-        backend:
-          serviceName: wsb
-          servicePort: 80
 {{- if .Values.service.commonName }}
   - host: {{ template "hostname" .Values.service.commonName }}
     http:
@@ -59,7 +60,7 @@ spec:
 {{- end -}}
 {{- if .Values.service.additionalHosts }}
 {{- range $host := .Values.service.additionalHosts }}
-  - host: {{ $host }}
+  - host: {{ template "hostname" $host }}
     http:
       <<: *httpRule
 {{- end -}}
diff --git a/chart/templates/network-policy.yaml b/chart/templates/network-policy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..79c0ed662514d8deb99bb19382105f8f445ce288
--- /dev/null
+++ b/chart/templates/network-policy.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.networkPolicy.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "fullname" . }}
+  labels:
+    app: {{ template "appname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+{{ toYaml .Values.networkPolicy.spec | indent 2 }}
+{{- end -}}
diff --git a/chart/templates/service.yaml b/chart/templates/service.yaml
index 47c59e2c25f19ed1440bd6b142746c932f2c3f92..676406be11de5feedd801876627055405ac51670 100644
--- a/chart/templates/service.yaml
+++ b/chart/templates/service.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.service.enabled -}}
+{{- if and (.Values.service.enabled) (eq .Values.application.track "stable") -}}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/chart/templates/worker-deployment.yaml b/chart/templates/worker-deployment.yaml
index c59e78efa578deebe1742eea34b71e3271bc1312..050e234195e1064dc1ace110946719a1444aded2 100644
--- a/chart/templates/worker-deployment.yaml
+++ b/chart/templates/worker-deployment.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: List
 items:
 {{- range $workerName, $workerConfig :=  .Values.workers }}
-- apiVersion: extensions/v1beta1
+- apiVersion: {{ default "extensions/v1beta1" $.Values.deploymentApiVersion }}
   kind: Deployment
   metadata:
     name: {{ template "trackableappname" $ }}-{{ $workerName }}
@@ -17,7 +17,18 @@ items:
       release: {{ $.Release.Name }}
       heritage: {{ $.Release.Service }}
   spec:
+  {{- if or $.Values.enableSelector (eq (default "extensions/v1beta1" $.Values.deploymentApiVersion) "apps/v1") }}
+    selector:
+      matchLabels:
+        track: "{{ $.Values.application.track }}"
+        tier: worker
+        release: {{ $.Release.Name }}
+  {{- end }}
     replicas: {{ $workerConfig.replicaCount }}
+  {{- if $workerConfig.strategyType }}
+    strategy:
+      type: {{ $workerConfig.strategyType | quote }}
+  {{- end  }}
     template:
       metadata:
         annotations:
@@ -37,7 +48,7 @@ items:
         terminationGracePeriodSeconds: {{ $workerConfig.terminationGracePeriodSeconds }}
         containers:
         - name: {{ $.Chart.Name }}-{{ $workerName }}
-          image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
+          image: {{ template "imagename" $ }}
           command:
           {{- range $workerConfig.command }}
           - {{ . }}
@@ -52,7 +63,7 @@ items:
           - name: DATABASE_URL
             value: {{ $.Values.application.database_url | quote }}
           - name: GITLAB_ENVIRONMENT_NAME
-            value: {{ $.Values.gitlab.envName }}
+            value: {{ $.Values.gitlab.envName | quote }}
           livenessProbe:
 {{- if eq $.Values.livenessProbe.probeType "httpGet" }}
             httpGet:
@@ -72,7 +83,7 @@ items:
               scheme: {{ $.Values.readinessProbe.scheme }}
               port: {{ $.Values.service.internalPort }}
 {{- else if eq $.Values.readinessProbe.probeType "tcpSocket" }}
-          tcpSocket:
+            tcpSocket:
               port: {{ $.Values.service.internalPort }}
 {{- end }}
             initialDelaySeconds: {{ $.Values.readinessProbe.initialDelaySeconds }}
@@ -87,6 +98,6 @@ items:
                 {{- end }}
           {{- end }}
           resources:
-  {{ toYaml $.Values.resources | indent 14 }}
+{{ toYaml $.Values.resources | indent 12 }}
 {{- end -}}
 {{- end -}}
diff --git a/chart/test/go.mod b/chart/test/go.mod
new file mode 100644
index 0000000000000000000000000000000000000000..4754f016d43ac382520197869527dc51191fb013
--- /dev/null
+++ b/chart/test/go.mod
@@ -0,0 +1,10 @@
+module gitlab.com/gitlab-org/charts/auto-deploy-app/test
+
+go 1.13
+
+require (
+	github.com/gruntwork-io/terratest v0.23.0
+	github.com/stretchr/testify v1.4.0
+	k8s.io/api v0.0.0-20181110191121-a33c8200050f
+	k8s.io/apimachinery v0.0.0-20190704094520-6f131bee5e2c
+)
diff --git a/chart/test/go.sum b/chart/test/go.sum
new file mode 100644
index 0000000000000000000000000000000000000000..8b5b570079168ea0282e9f6e0a576479efc4fd86
--- /dev/null
+++ b/chart/test/go.sum
@@ -0,0 +1,218 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/Azure/azure-sdk-for-go v32.5.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
+github.com/Azure/go-autorest/autorest v0.9.1/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
+github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
+github.com/Azure/go-autorest/autorest/adal v0.6.0/go.mod h1:Z6vX6WXXuyieHAXwMj0S6HY6e6wcHn37qQMBQlvY3lc=
+github.com/Azure/go-autorest/autorest/azure/auth v0.3.0/go.mod h1:CI4BQYBct8NS7BXNBBX+RchsFsUu5+oz+OSyR/ZIi7U=
+github.com/Azure/go-autorest/autorest/azure/cli v0.3.0/go.mod h1:rNYMNAefZMRowqCV0cVhr/YDW5dD7afFq9nXAXL4ykE=
+github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
+github.com/Azure/go-autorest/autorest/date v0.2.0/go.mod h1:vcORJHLJEh643/Ioh9+vPmf1Ij9AEBM5FuBIXLmIy0g=
+github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM=
+github.com/Azure/go-autorest/autorest/to v0.3.0/go.mod h1:MgwOyqaIuKdG4TL/2ywSsIWKAfJfgHDo8ObuUk3t5sA=
+github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=
+github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
+github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/aws/aws-sdk-go v1.23.8 h1:G/azJoBN0pnhB3B+0eeC4yyVFYIIad6bbzg6wwtImqk=
+github.com/aws/aws-sdk-go v1.23.8/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c h1:ZfSZ3P3BedhKGUhzj7BQlPSU4OvT6tfOKe3DVHzOA7s=
+github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/elazarl/goproxy v0.0.0-20190911111923-ecfe977594f1 h1:yY9rWGoXv1U5pl4gxqlULARMQD7x0QG85lqEXTWysik=
+github.com/elazarl/goproxy v0.0.0-20190911111923-ecfe977594f1/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/elazarl/goproxy/ext v0.0.0-20190711103511-473e67f1d7d2 h1:dWB6v3RcOy03t/bUadywsbyrQwCqZeNIEX6M1OtSZOM=
+github.com/elazarl/goproxy/ext v0.0.0-20190711103511-473e67f1d7d2/go.mod h1:gNh8nYJoAm43RfaxurUnxr+N1PwuFV3ZMl/efxlIlY8=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 h1:skJKxRtNmevLqnayafdLe2AsenqRupVmzZSqrvb5caU=
+github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
+github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c h1:jWtZjFEUE/Bz0IeIhqCnyZ3HG6KRXSntXe4SjtuTH7c=
+github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gnostic v0.3.1 h1:WeAefnSUHlBb0iJKwxFDZdbfGwkd7xRNuV+IpXMJhYk=
+github.com/googleapis/gnostic v0.3.1/go.mod h1:on+2t9HRStVgn95RSsFWFz+6Q0Snyqv1awfrALZdbtU=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/gruntwork-io/gruntwork-cli v0.5.1 h1:mVmVsFubUSLSCO8bGigI63HXzvzkC0uWXzm4dd9pXRg=
+github.com/gruntwork-io/gruntwork-cli v0.5.1/go.mod h1:IBX21bESC1/LGoV7jhXKUnTQTZgQ6dYRsoj/VqxUSZQ=
+github.com/gruntwork-io/terratest v0.23.0 h1:JmGeqO0r5zRLAV55T67NEmPZArz9lN3RKd0moAKhIT4=
+github.com/gruntwork-io/terratest v0.23.0/go.mod h1:+fVff0FQYuRzCF3LKpKF9ac+4w384LDcwLZt7O/KmEE=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.3/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/imdario/mergo v0.3.7 h1:Y+UAYTZ7gDEuOfhxKWy+dvb5dRQ6rJjFSdX2HZY1/gI=
+github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af h1:pmfjZENx5imkbgOkpRUYLnmbU7UEFbjtDA2hxJ1ichM=
+github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 h1:Esafd1046DLDQ0W1YjYsBW+p8U2u7vzgW2SQVmlNazg=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/oracle/oci-go-sdk v7.1.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/otp v1.2.0 h1:/A3+Jn+cagqayeR3iHs/L62m5ue7710D35zl1zJ1kok=
+github.com/pquerna/otp v1.2.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/rogpeppe/go-charset v0.0.0-20180617210344-2471d30d28b4/go.mod h1:qgYeAmZ5ZIpBWTGllZSQnw97Dj+woV0toclVaRGI8pc=
+github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/urfave/cli v1.22.1 h1:+mkCCcOFKPnCmVYVcURKps1Xe+3zP90gSYGNfRkjoIY=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586 h1:7KByu05hhLed2MO29w7p1XfZvZ13m8mub3shuVftRs0=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191110163157-d32e6e3b99c4 h1:Hynbrlo6LbYI3H1IqXpkVDOcX/3HiPdhVEuyj5a59RM=
+golang.org/x/sys v0.0.0-20191110163157-d32e6e3b99c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.9.1-0.20190821000710-329ecc3c9c34/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1 h1:QzqyMA1tlu6CgqCDUtU9V+ZKhLFT2dkJuANu5QaxI3I=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.0.0-20181110191121-a33c8200050f h1:BH667AnNr487/iTtY35X+m6c2S8HL02Rft1PFK93kmw=
+k8s.io/api v0.0.0-20181110191121-a33c8200050f/go.mod h1:iuAfoD4hCxJ8Onx9kaTIt30j7jUFS00AXQi6QMi99vA=
+k8s.io/apimachinery v0.0.0-20190704094520-6f131bee5e2c h1:vdEIiO5B0/3EVwZboF6qyYn5kVDdvCbaGSzr7Rcx18A=
+k8s.io/apimachinery v0.0.0-20190704094520-6f131bee5e2c/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
+k8s.io/client-go v0.0.0-20190704095228-386e588352a4 h1:hqylj4/yit+/eO496/Yhgy2YxxumFpSY94YDFX6lBoU=
+k8s.io/client-go v0.0.0-20190704095228-386e588352a4/go.mod h1:7vJpHMYJwNQCWgzmNV+VYUl1zCObLyodBc8nIyt8L5s=
diff --git a/chart/test/template_test.go b/chart/test/template_test.go
new file mode 100644
index 0000000000000000000000000000000000000000..aa69a959abd869b5e9ada5d4f2b472aa85db3ea2
--- /dev/null
+++ b/chart/test/template_test.go
@@ -0,0 +1,845 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gruntwork-io/terratest/modules/helm"
+	"github.com/gruntwork-io/terratest/modules/k8s"
+	"github.com/gruntwork-io/terratest/modules/random"
+	"github.com/stretchr/testify/require"
+	appsV1 "k8s.io/api/apps/v1"
+	coreV1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	netV1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	chartName     = "auto-deploy-app-1.0.3"
+	helmChartPath = ".."
+)
+
+func TestDeploymentTemplate(t *testing.T) {
+	for _, tc := range []struct {
+		CaseName string
+		Release  string
+		Values   map[string]string
+
+		ExpectedName         string
+		ExpectedRelease      string
+		ExpectedStrategyType extensions.DeploymentStrategyType
+		ExpectedSelector     *metav1.LabelSelector
+	}{
+		{
+			CaseName: "happy",
+			Release:  "production",
+			Values: map[string]string{
+				"releaseOverride": "productionOverridden",
+			},
+			ExpectedName:         "productionOverridden",
+			ExpectedRelease:      "production",
+			ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+		},
+		{
+			CaseName:             "long release name",
+			Release:              strings.Repeat("r", 80),
+			ExpectedName:         strings.Repeat("r", 63),
+			ExpectedRelease:      strings.Repeat("r", 80),
+			ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+		},
+		{
+			CaseName: "strategyType",
+			Release:  "production",
+			Values: map[string]string{
+				"strategyType": "Recreate",
+			},
+			ExpectedName:         "production",
+			ExpectedRelease:      "production",
+			ExpectedStrategyType: extensions.RecreateDeploymentStrategyType,
+		},
+		{
+			CaseName: "enableSelector",
+			Release:  "production",
+			Values: map[string]string{
+				"enableSelector": "true",
+			},
+			ExpectedName:         "production",
+			ExpectedRelease:      "production",
+			ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+			ExpectedSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app":     "production",
+					"release": "production",
+					"tier":    "web",
+					"track":   "stable",
+				},
+			},
+		},
+	} {
+		t.Run(tc.CaseName, func(t *testing.T) {
+			namespaceName := "minimal-ruby-app-" + strings.ToLower(random.UniqueId())
+
+			values := map[string]string{
+				"gitlab.app": "auto-devops-examples/minimal-ruby-app",
+				"gitlab.env": "prod",
+			}
+
+			mergeStringMap(values, tc.Values)
+
+			options := &helm.Options{
+				SetValues:      values,
+				KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+			}
+
+			output := helm.RenderTemplate(t, options, helmChartPath, tc.Release, []string{"templates/deployment.yaml"})
+
+			var deployment extensions.Deployment
+			helm.UnmarshalK8SYaml(t, output, &deployment)
+
+			require.Equal(t, tc.ExpectedName, deployment.Name)
+			require.Equal(t, tc.ExpectedStrategyType, deployment.Spec.Strategy.Type)
+
+			require.Equal(t, map[string]string{
+				"app.gitlab.com/app": "auto-devops-examples/minimal-ruby-app",
+				"app.gitlab.com/env": "prod",
+			}, deployment.Annotations)
+			require.Equal(t, map[string]string{
+				"app":      tc.ExpectedName,
+				"chart":    chartName,
+				"heritage": "Tiller",
+				"release":  tc.ExpectedRelease,
+				"tier":     "web",
+				"track":    "stable",
+			}, deployment.Labels)
+
+			require.Equal(t, tc.ExpectedSelector, deployment.Spec.Selector)
+
+			require.Equal(t, map[string]string{
+				"app.gitlab.com/app":           "auto-devops-examples/minimal-ruby-app",
+				"app.gitlab.com/env":           "prod",
+				"checksum/application-secrets": "",
+			}, deployment.Spec.Template.Annotations)
+			require.Equal(t, map[string]string{
+				"app":     tc.ExpectedName,
+				"release": tc.ExpectedRelease,
+				"tier":    "web",
+				"track":   "stable",
+			}, deployment.Spec.Template.Labels)
+		})
+	}
+
+	for _, tc := range []struct {
+		CaseName                string
+		Release                 string
+		Values                  map[string]string
+		ExpectedImageRepository string
+	}{
+		{
+			CaseName: "skaffold",
+			Release:  "production",
+			Values: map[string]string{
+				"image.repository": "skaffold",
+				"image.tag":        "",
+			},
+			ExpectedImageRepository: "skaffold",
+		},
+		{
+			CaseName: "skaffold",
+			Release:  "production",
+			Values: map[string]string{
+				"image.repository": "skaffold",
+				"image.tag":        "stable",
+			},
+			ExpectedImageRepository: "skaffold:stable",
+		},
+	} {
+		t.Run(tc.CaseName, func(t *testing.T) {
+			namespaceName := "minimal-ruby-app-" + strings.ToLower(random.UniqueId())
+
+			values := map[string]string{
+				"gitlab.app": "auto-devops-examples/minimal-ruby-app",
+				"gitlab.env": "prod",
+			}
+
+			mergeStringMap(values, tc.Values)
+
+			options := &helm.Options{
+				SetValues:      values,
+				KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+			}
+
+			output := helm.RenderTemplate(t, options, helmChartPath, tc.Release, []string{"templates/deployment.yaml"})
+
+			var deployment appsV1.Deployment
+			helm.UnmarshalK8SYaml(t, output, &deployment)
+
+			require.Equal(t, tc.ExpectedImageRepository, deployment.Spec.Template.Spec.Containers[0].Image)
+		})
+	}
+
+	for _, tc := range []struct {
+		CaseName string
+		Release  string
+		Values   map[string]string
+
+		ExpectedName         string
+		ExpectedRelease      string
+		ExpectedStrategyType appsV1.DeploymentStrategyType
+		ExpectedSelector     *metav1.LabelSelector
+	}{
+		{
+			CaseName: "appsv1",
+			Release:  "production",
+			Values: map[string]string{
+				"deploymentApiVersion": "apps/v1",
+			},
+			ExpectedName:         "production",
+			ExpectedRelease:      "production",
+			ExpectedStrategyType: appsV1.DeploymentStrategyType(""),
+			ExpectedSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app":     "production",
+					"release": "production",
+					"tier":    "web",
+					"track":   "stable",
+				},
+			},
+		},
+	} {
+		t.Run(tc.CaseName, func(t *testing.T) {
+			namespaceName := "minimal-ruby-app-" + strings.ToLower(random.UniqueId())
+
+			values := map[string]string{
+				"gitlab.app": "auto-devops-examples/minimal-ruby-app",
+				"gitlab.env": "prod",
+			}
+
+			mergeStringMap(values, tc.Values)
+
+			options := &helm.Options{
+				SetValues:      values,
+				KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+			}
+
+			output := helm.RenderTemplate(t, options, helmChartPath, tc.Release, []string{"templates/deployment.yaml"})
+
+			var deployment appsV1.Deployment
+			helm.UnmarshalK8SYaml(t, output, &deployment)
+
+			require.Equal(t, tc.ExpectedName, deployment.Name)
+			require.Equal(t, tc.ExpectedStrategyType, deployment.Spec.Strategy.Type)
+			require.Equal(t, map[string]string{
+				"app.gitlab.com/app": "auto-devops-examples/minimal-ruby-app",
+				"app.gitlab.com/env": "prod",
+			}, deployment.Annotations)
+			require.Equal(t, map[string]string{
+				"app":      tc.ExpectedName,
+				"chart":    chartName,
+				"heritage": "Tiller",
+				"release":  tc.ExpectedRelease,
+				"tier":     "web",
+				"track":    "stable",
+			}, deployment.Labels)
+
+			require.Equal(t, tc.ExpectedSelector, deployment.Spec.Selector)
+
+			require.Equal(t, map[string]string{
+				"app.gitlab.com/app":           "auto-devops-examples/minimal-ruby-app",
+				"app.gitlab.com/env":           "prod",
+				"checksum/application-secrets": "",
+			}, deployment.Spec.Template.Annotations)
+			require.Equal(t, map[string]string{
+				"app":     tc.ExpectedName,
+				"release": tc.ExpectedRelease,
+				"tier":    "web",
+				"track":   "stable",
+			}, deployment.Spec.Template.Labels)
+		})
+	}
+}
+
+func TestWorkerDeploymentTemplate(t *testing.T) {
+	for _, tc := range []struct {
+		CaseName string
+		Release  string
+		Values   map[string]string
+
+		ExpectedName        string
+		ExpectedRelease     string
+		ExpectedDeployments []workerDeploymentTestCase
+	}{
+		{
+			CaseName: "happy",
+			Release:  "production",
+			Values: map[string]string{
+				"releaseOverride":            "productionOverridden",
+				"workers.worker1.command[0]": "echo",
+				"workers.worker1.command[1]": "worker1",
+				"workers.worker2.command[0]": "echo",
+				"workers.worker2.command[1]": "worker2",
+			},
+			ExpectedName:    "productionOverridden",
+			ExpectedRelease: "production",
+			ExpectedDeployments: []workerDeploymentTestCase{
+				{
+					ExpectedName:         "productionOverridden-worker1",
+					ExpectedCmd:          []string{"echo", "worker1"},
+					ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+				},
+				{
+					ExpectedName:         "productionOverridden-worker2",
+					ExpectedCmd:          []string{"echo", "worker2"},
+					ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+				},
+			},
+		},
+		{
+			CaseName: "long release name",
+			Release:  strings.Repeat("r", 80),
+			Values: map[string]string{
+				"workers.worker1.command[0]": "echo",
+				"workers.worker1.command[1]": "worker1",
+			},
+			ExpectedName:    strings.Repeat("r", 63),
+			ExpectedRelease: strings.Repeat("r", 80),
+			ExpectedDeployments: []workerDeploymentTestCase{
+				{
+					ExpectedName:         strings.Repeat("r", 63) + "-worker1",
+					ExpectedCmd:          []string{"echo", "worker1"},
+					ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+				},
+			},
+		},
+		{
+			CaseName: "strategyType",
+			Release:  "production",
+			Values: map[string]string{
+				"workers.worker1.command[0]":   "echo",
+				"workers.worker1.command[1]":   "worker1",
+				"workers.worker1.strategyType": "Recreate",
+			},
+			ExpectedName:    "production",
+			ExpectedRelease: "production",
+			ExpectedDeployments: []workerDeploymentTestCase{
+				{
+					ExpectedName:         "production" + "-worker1",
+					ExpectedCmd:          []string{"echo", "worker1"},
+					ExpectedStrategyType: extensions.RecreateDeploymentStrategyType,
+				},
+			},
+		},
+		{
+			CaseName: "enableSelector",
+			Release:  "production",
+			Values: map[string]string{
+				"enableSelector":             "true",
+				"workers.worker1.command[0]": "echo",
+				"workers.worker1.command[1]": "worker1",
+				"workers.worker2.command[0]": "echo",
+				"workers.worker2.command[1]": "worker2",
+			},
+			ExpectedName:    "production",
+			ExpectedRelease: "production",
+			ExpectedDeployments: []workerDeploymentTestCase{
+				{
+					ExpectedName:         "production-worker1",
+					ExpectedCmd:          []string{"echo", "worker1"},
+					ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+					ExpectedSelector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{
+							"release": "production",
+							"tier":    "worker",
+							"track":   "stable",
+						},
+					},
+				},
+				{
+					ExpectedName:         "production-worker2",
+					ExpectedCmd:          []string{"echo", "worker2"},
+					ExpectedStrategyType: extensions.DeploymentStrategyType(""),
+					ExpectedSelector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{
+							"release": "production",
+							"tier":    "worker",
+							"track":   "stable",
+						},
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tc.CaseName, func(t *testing.T) {
+			namespaceName := "minimal-ruby-app-" + strings.ToLower(random.UniqueId())
+
+			values := map[string]string{
+				"gitlab.app": "auto-devops-examples/minimal-ruby-app",
+				"gitlab.env": "prod",
+			}
+
+			mergeStringMap(values, tc.Values)
+
+			options := &helm.Options{
+				SetValues:      values,
+				KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+			}
+
+			output := helm.RenderTemplate(t, options, helmChartPath, tc.Release, []string{"templates/worker-deployment.yaml"})
+
+			var deployments deploymentList
+			helm.UnmarshalK8SYaml(t, output, &deployments)
+
+			require.Len(t, deployments.Items, len(tc.ExpectedDeployments))
+			for i, expectedDeployment := range tc.ExpectedDeployments {
+				deployment := deployments.Items[i]
+
+				require.Equal(t, expectedDeployment.ExpectedName, deployment.Name)
+				require.Equal(t, expectedDeployment.ExpectedStrategyType, deployment.Spec.Strategy.Type)
+
+				require.Equal(t, map[string]string{
+					"app.gitlab.com/app": "auto-devops-examples/minimal-ruby-app",
+					"app.gitlab.com/env": "prod",
+				}, deployment.Annotations)
+				require.Equal(t, map[string]string{
+					"chart":    chartName,
+					"heritage": "Tiller",
+					"release":  tc.ExpectedRelease,
+					"tier":     "worker",
+					"track":    "stable",
+				}, deployment.Labels)
+
+				require.Equal(t, expectedDeployment.ExpectedSelector, deployment.Spec.Selector)
+
+				require.Equal(t, map[string]string{
+					"app.gitlab.com/app":           "auto-devops-examples/minimal-ruby-app",
+					"app.gitlab.com/env":           "prod",
+					"checksum/application-secrets": "",
+				}, deployment.Spec.Template.Annotations)
+				require.Equal(t, map[string]string{
+					"release": tc.ExpectedRelease,
+					"tier":    "worker",
+					"track":   "stable",
+				}, deployment.Spec.Template.Labels)
+
+				require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
+				require.Equal(t, expectedDeployment.ExpectedCmd, deployment.Spec.Template.Spec.Containers[0].Command)
+			}
+		})
+	}
+
+	for _, tc := range []struct {
+		CaseName string
+		Release  string
+		Values   map[string]string
+
+		ExpectedName        string
+		ExpectedRelease     string
+		ExpectedDeployments []workerDeploymentAppsV1TestCase
+	}{
+		{
+			CaseName: "appsv1",
+			Release:  "production",
+			Values: map[string]string{
+				"deploymentApiVersion":       "apps/v1",
+				"workers.worker1.command[0]": "echo",
+				"workers.worker1.command[1]": "worker1",
+				"workers.worker2.command[0]": "echo",
+				"workers.worker2.command[1]": "worker2",
+			},
+			ExpectedName:    "production",
+			ExpectedRelease: "production",
+			ExpectedDeployments: []workerDeploymentAppsV1TestCase{
+				{
+					ExpectedName:         "production-worker1",
+					ExpectedCmd:          []string{"echo", "worker1"},
+					ExpectedStrategyType: appsV1.DeploymentStrategyType(""),
+					ExpectedSelector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{
+							"release": "production",
+							"tier":    "worker",
+							"track":   "stable",
+						},
+					},
+				},
+				{
+					ExpectedName:         "production-worker2",
+					ExpectedCmd:          []string{"echo", "worker2"},
+					ExpectedStrategyType: appsV1.DeploymentStrategyType(""),
+					ExpectedSelector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{
+							"release": "production",
+							"tier":    "worker",
+							"track":   "stable",
+						},
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tc.CaseName, func(t *testing.T) {
+			namespaceName := "minimal-ruby-app-" + strings.ToLower(random.UniqueId())
+
+			values := map[string]string{
+				"gitlab.app": "auto-devops-examples/minimal-ruby-app",
+				"gitlab.env": "prod",
+			}
+
+			mergeStringMap(values, tc.Values)
+
+			options := &helm.Options{
+				SetValues:      values,
+				KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+			}
+
+			output := helm.RenderTemplate(t, options, helmChartPath, tc.Release, []string{"templates/worker-deployment.yaml"})
+
+			var deployments deploymentAppsV1List
+			helm.UnmarshalK8SYaml(t, output, &deployments)
+
+			require.Len(t, deployments.Items, len(tc.ExpectedDeployments))
+			for i, expectedDeployment := range tc.ExpectedDeployments {
+				deployment := deployments.Items[i]
+
+				require.Equal(t, expectedDeployment.ExpectedName, deployment.Name)
+				require.Equal(t, expectedDeployment.ExpectedStrategyType, deployment.Spec.Strategy.Type)
+
+				require.Equal(t, map[string]string{
+					"app.gitlab.com/app": "auto-devops-examples/minimal-ruby-app",
+					"app.gitlab.com/env": "prod",
+				}, deployment.Annotations)
+				require.Equal(t, map[string]string{
+					"chart":    chartName,
+					"heritage": "Tiller",
+					"release":  tc.ExpectedRelease,
+					"tier":     "worker",
+					"track":    "stable",
+				}, deployment.Labels)
+
+				require.Equal(t, expectedDeployment.ExpectedSelector, deployment.Spec.Selector)
+
+				require.Equal(t, map[string]string{
+					"app.gitlab.com/app":           "auto-devops-examples/minimal-ruby-app",
+					"app.gitlab.com/env":           "prod",
+					"checksum/application-secrets": "",
+				}, deployment.Spec.Template.Annotations)
+				require.Equal(t, map[string]string{
+					"release": tc.ExpectedRelease,
+					"tier":    "worker",
+					"track":   "stable",
+				}, deployment.Spec.Template.Labels)
+
+				require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
+				require.Equal(t, expectedDeployment.ExpectedCmd, deployment.Spec.Template.Spec.Containers[0].Command)
+			}
+		})
+	}
+}
+
+func TestNetworkPolicyDeployment(t *testing.T) {
+	releaseName := "network-policy-test"
+	templates := []string{"templates/network-policy.yaml"}
+	expectedLabels := map[string]string{
+		"app":      releaseName,
+		"chart":    chartName,
+		"release":  releaseName,
+		"heritage": "Tiller",
+	}
+
+	tcs := []struct {
+		name       string
+		valueFiles []string
+		values     map[string]string
+
+		meta        metav1.ObjectMeta
+		podSelector metav1.LabelSelector
+		policyTypes []netV1.PolicyType
+		ingress     []netV1.NetworkPolicyIngressRule
+		egress      []netV1.NetworkPolicyEgressRule
+	}{
+		{
+			name: "defaults",
+		},
+		{
+			name:        "with default policy",
+			values:      map[string]string{"networkPolicy.enabled": "true"},
+			meta:        metav1.ObjectMeta{Name: releaseName + "-auto-deploy", Labels: expectedLabels},
+			podSelector: metav1.LabelSelector{MatchLabels: map[string]string{}},
+			ingress: []netV1.NetworkPolicyIngressRule{
+				{
+					From: []netV1.NetworkPolicyPeer{
+						{PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{}}},
+						{NamespaceSelector: &metav1.LabelSelector{
+							MatchLabels: map[string]string{"app.gitlab.com/managed_by": "gitlab"},
+						}},
+					},
+				},
+			},
+		},
+		{
+			name:        "with custom policy",
+			valueFiles:  []string{"./testdata/custom-policy.yaml"},
+			meta:        metav1.ObjectMeta{Name: releaseName + "-auto-deploy", Labels: expectedLabels},
+			podSelector: metav1.LabelSelector{MatchLabels: map[string]string{"foo": "bar"}},
+			ingress: []netV1.NetworkPolicyIngressRule{
+				{
+					From: []netV1.NetworkPolicyPeer{
+						{PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{}}},
+						{NamespaceSelector: &metav1.LabelSelector{
+							MatchLabels: map[string]string{"name": "foo"},
+						}},
+					},
+				},
+			},
+		},
+		{
+			name:        "with full spec policy",
+			valueFiles:  []string{"./testdata/full-spec-policy.yaml"},
+			meta:        metav1.ObjectMeta{Name: releaseName + "-auto-deploy", Labels: expectedLabels},
+			podSelector: metav1.LabelSelector{MatchLabels: map[string]string{}},
+			policyTypes: []netV1.PolicyType{"Ingress", "Egress"},
+			ingress: []netV1.NetworkPolicyIngressRule{
+				{
+					From: []netV1.NetworkPolicyPeer{
+						{PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{}}},
+					},
+				},
+			},
+			egress: []netV1.NetworkPolicyEgressRule{
+				{
+					To: []netV1.NetworkPolicyPeer{
+						{NamespaceSelector: &metav1.LabelSelector{
+							MatchLabels: map[string]string{"name": "gitlab-managed-apps"},
+						}},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := &helm.Options{
+				ValuesFiles: tc.valueFiles,
+				SetValues:   tc.values,
+			}
+			output := helm.RenderTemplate(t, opts, helmChartPath, releaseName, templates)
+
+			policy := new(netV1.NetworkPolicy)
+			helm.UnmarshalK8SYaml(t, output, policy)
+
+			require.Equal(t, tc.meta, policy.ObjectMeta)
+			require.Equal(t, tc.podSelector, policy.Spec.PodSelector)
+			require.Equal(t, tc.policyTypes, policy.Spec.PolicyTypes)
+			require.Equal(t, tc.ingress, policy.Spec.Ingress)
+			require.Equal(t, tc.egress, policy.Spec.Egress)
+		})
+	}
+}
+
+func TestIngressTemplate_ModSecurity(t *testing.T) {
+	templates := []string{"templates/ingress.yaml"}
+	modSecuritySnippet := "SecRuleEngine DetectionOnly\n"
+	modSecuritySnippetWithSecRules := modSecuritySnippet + `SecRule REQUEST_HEADERS:User-Agent \"scanner\" \"log,deny,id:107,status:403,msg:\'Scanner Identified\'\"
+SecRule REQUEST_HEADERS:Content-Type \"text/plain\" \"log,deny,id:\'20010\',status:403,msg:\'Text plain not allowed\'\"
+`
+	defaultAnnotations := map[string]string{
+		"kubernetes.io/ingress.class": "nginx",
+		"kubernetes.io/tls-acme":      "true",
+	}
+	defaultModSecurityAnnotations := map[string]string{
+		"nginx.ingress.kubernetes.io/modsecurity-transaction-id": "$server_name-$request_id",
+	}
+	modSecurityAnnotations := make(map[string]string)
+	secRulesAnnotations := make(map[string]string)
+	mergeStringMap(modSecurityAnnotations, defaultAnnotations)
+	mergeStringMap(modSecurityAnnotations, defaultModSecurityAnnotations)
+	mergeStringMap(secRulesAnnotations, defaultAnnotations)
+	mergeStringMap(secRulesAnnotations, defaultModSecurityAnnotations)
+	modSecurityAnnotations["nginx.ingress.kubernetes.io/modsecurity-snippet"] = modSecuritySnippet
+	secRulesAnnotations["nginx.ingress.kubernetes.io/modsecurity-snippet"] = modSecuritySnippetWithSecRules
+
+	tcs := []struct {
+		name       string
+		valueFiles []string
+		values     map[string]string
+		meta       metav1.ObjectMeta
+	}{
+		{
+			name: "defaults",
+			meta: metav1.ObjectMeta{Annotations: defaultAnnotations},
+		},
+		{
+			name:   "with modSecurity enabled without custom secRules",
+			values: map[string]string{"ingress.modSecurity.enabled": "true"},
+			meta:   metav1.ObjectMeta{Annotations: modSecurityAnnotations},
+		},
+		{
+			name:       "with custom secRules",
+			valueFiles: []string{"./testdata/modsecurity-ingress.yaml"},
+			meta:       metav1.ObjectMeta{Annotations: secRulesAnnotations},
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := &helm.Options{
+				ValuesFiles: tc.valueFiles,
+				SetValues:   tc.values,
+			}
+			output := helm.RenderTemplate(t, opts, helmChartPath, "", templates)
+
+			ingress := new(extensions.Ingress)
+			helm.UnmarshalK8SYaml(t, output, ingress)
+
+			require.Equal(t, tc.meta.Annotations, ingress.ObjectMeta.Annotations)
+		})
+	}
+}
+
+func TestIngressTemplate_Disable(t *testing.T) {
+	templates := []string{"templates/ingress.yaml"}
+	releaseName := "ingress-disable-test"
+	tcs := []struct {
+		name   string
+		values map[string]string
+
+		expectedrelease string
+	}{
+		{
+			name:            "defaults",
+			expectedrelease: releaseName + "-auto-deploy",
+		},
+		{
+			name:            "with ingress.enabled key undefined, but service is enabled",
+			values:          map[string]string{"ingress.enabled": "null", "service.enabled": "true"},
+			expectedrelease: releaseName + "-auto-deploy",
+		},
+		{
+			name:            "with service enabled and track non-stable",
+			values:          map[string]string{"service.enabled": "true", "application.track": "non-stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with service disabled and track stable",
+			values:          map[string]string{"service.enabled": "false", "application.track": "stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with service disabled and track non-stable",
+			values:          map[string]string{"service.enabled": "false", "application.track": "non-stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with ingress disabled",
+			values:          map[string]string{"ingress.enabled": "false"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with ingress enabled and track non-stable",
+			values:          map[string]string{"ingress.enabled": "true", "application.track": "non-stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with ingress enabled and service disabled",
+			values:          map[string]string{"ingress.enabled": "true", "service.enabled": "false"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with ingress disabled and service enabled and track stable",
+			values:          map[string]string{"ingress.enabled": "false", "service.enabled": "true", "application.track": "stable"},
+			expectedrelease: "",
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := &helm.Options{
+				SetValues: tc.values,
+			}
+			output := helm.RenderTemplate(t, opts, helmChartPath, releaseName, templates)
+
+			ingress := new(extensions.Ingress)
+
+			helm.UnmarshalK8SYaml(t, output, ingress)
+			require.Equal(t, tc.expectedrelease, ingress.ObjectMeta.Name)
+		})
+	}
+}
+
+func TestServiceTemplate_Disable(t *testing.T) {
+	templates := []string{"templates/service.yaml"}
+	releaseName := "service-disable-test"
+	tcs := []struct {
+		name   string
+		values map[string]string
+
+		expectedrelease string
+	}{
+		{
+			name:            "defaults",
+			expectedrelease: releaseName + "-auto-deploy",
+		},
+		{
+			name:            "with service enabled and track non-stable",
+			values:          map[string]string{"service.enabled": "true", "application.track": "non-stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with service disabled and track stable",
+			values:          map[string]string{"service.enabled": "false", "application.track": "stable"},
+			expectedrelease: "",
+		},
+		{
+			name:            "with service disabled and track non-stable",
+			values:          map[string]string{"service.enabled": "false", "application.track": "non-stable"},
+			expectedrelease: "",
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := &helm.Options{
+				SetValues: tc.values,
+			}
+			output := helm.RenderTemplate(t, opts, helmChartPath, releaseName, templates)
+
+			service := new(coreV1.Service)
+
+			helm.UnmarshalK8SYaml(t, output, service)
+
+			require.Equal(t, tc.expectedrelease, service.ObjectMeta.Name)
+		})
+	}
+}
+
+type workerDeploymentTestCase struct {
+	ExpectedName         string
+	ExpectedCmd          []string
+	ExpectedStrategyType extensions.DeploymentStrategyType
+	ExpectedSelector     *metav1.LabelSelector
+}
+
+type workerDeploymentAppsV1TestCase struct {
+	ExpectedName         string
+	ExpectedCmd          []string
+	ExpectedStrategyType appsV1.DeploymentStrategyType
+	ExpectedSelector     *metav1.LabelSelector
+}
+
+type deploymentList struct {
+	metav1.TypeMeta `json:",inline"`
+
+	Items []extensions.Deployment `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+type deploymentAppsV1List struct {
+	metav1.TypeMeta `json:",inline"`
+
+	Items []appsV1.Deployment `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func mergeStringMap(dst, src map[string]string) {
+	for k, v := range src {
+		dst[k] = v
+	}
+}
diff --git a/chart/test/testdata/custom-policy.yaml b/chart/test/testdata/custom-policy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..8cc487aa725b2bb91a704caf5e39c3a3882be055
--- /dev/null
+++ b/chart/test/testdata/custom-policy.yaml
@@ -0,0 +1,13 @@
+networkPolicy:
+  enabled: true
+  spec:
+    podSelector:
+      matchLabels:
+        foo: bar
+    ingress:
+    - from:
+      - podSelector:
+          matchLabels: {}
+      - namespaceSelector:
+          matchLabels:
+            name: foo
diff --git a/chart/test/testdata/full-spec-policy.yaml b/chart/test/testdata/full-spec-policy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..25254b5d2c51802230fd383f206e1848a9517879
--- /dev/null
+++ b/chart/test/testdata/full-spec-policy.yaml
@@ -0,0 +1,17 @@
+networkPolicy:
+  enabled: true
+  spec:
+    podSelector:
+      matchLabels: {}
+    policyTypes:
+    - Ingress
+    - Egress
+    ingress:
+    - from:
+      - podSelector:
+          matchLabels: {}
+    egress:
+    - to:
+      - namespaceSelector:
+          matchLabels:
+            name: gitlab-managed-apps
diff --git a/chart/test/testdata/modsecurity-ingress.yaml b/chart/test/testdata/modsecurity-ingress.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..5b8b469c1ece14cd1fdbdda8b503b5a38026141f
--- /dev/null
+++ b/chart/test/testdata/modsecurity-ingress.yaml
@@ -0,0 +1,10 @@
+ingress:
+  modSecurity:
+    enabled: true
+    secRules:
+      - variable: "REQUEST_HEADERS:User-Agent"
+        operator: "scanner"
+        action: "log,deny,id:107,status:403,msg:'Scanner Identified'"
+      - variable: "REQUEST_HEADERS:Content-Type"
+        operator: "text/plain"
+        action: "log,deny,id:'20010',status:403,msg:'Text plain not allowed'"
\ No newline at end of file
diff --git a/chart/values.yaml b/chart/values.yaml
index 0641dce2ad6efb74a0e22bf123e485308987a060..b7b44df77f6c48c420767fd2cd446cfe6aea0e44 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -2,10 +2,13 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 replicaCount: 1
+strategyType:
+enableSelector:
+deploymentApiVersion: extensions/v1beta1
 image:
   repository: gitlab.example.com/group/project
   tag: stable
-  pullPolicy: Always
+  pullPolicy: IfNotPresent
   secrets:
     - name: gitlab-registry
 podAnnotations: {}
@@ -17,9 +20,9 @@ application:
   secretName:
   secretChecksum:
 hpa:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 20
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
   targetCPUUtilizationPercentage: 80
 gitlab:
   app:
@@ -37,6 +40,7 @@ service:
   externalPort: 5000
   internalPort: 5000
 ingress:
+  enabled: true
   tls:
     enabled: true
     secretName: ""
@@ -46,34 +50,38 @@ ingress:
   modSecurity:
     enabled: false
     secRuleEngine: "DetectionOnly"
+    # secRules:
+    #   - variable: ""
+    #     operator: ""
+    #     action: ""
 prometheus:
   metrics: false
 livenessProbe:
   path: "/"
-  initialDelaySeconds: 20
+  initialDelaySeconds: 15
   timeoutSeconds: 15
   scheme: "HTTP"
   probeType: "httpGet"
 readinessProbe:
   path: "/"
-  initialDelaySeconds: 15
-  timeoutSeconds: 15
+  initialDelaySeconds: 5
+  timeoutSeconds: 3
   scheme: "HTTP"
   probeType: "httpGet"
 postgresql:
-  enabled: false
+  enabled: true
   managed: false
   managedClassSelector:
     #   matchLabels:
     #     stack: gitlab (This is an example. The labels should match the labels on the CloudSQLInstanceClass)
 
 resources:
-  limits:
-    cpu: 1
-    memory: 1Gi
+#  limits:
+#    cpu: 100m
+#    memory: 128Mi
   requests:
-    cpu: 1
-    memory: 1Gi
+#    cpu: 100m
+#    memory: 128Mi
 
 ## Configure PodDisruptionBudget
 ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
@@ -83,7 +91,23 @@ podDisruptionBudget:
   # minAvailable: 1
   maxUnavailable: 1
 
-workers:
+## Configure NetworkPolicy
+## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
+#
+networkPolicy:
+  enabled: false
+  spec:
+    podSelector:
+      matchLabels: {}
+    ingress:
+    - from:
+      - podSelector:
+          matchLabels: {}
+      - namespaceSelector:
+          matchLabels:
+            app.gitlab.com/managed_by: gitlab
+
+workers: {}
   # worker:
   #   replicaCount: 1
   #   terminationGracePeriodSeconds: 60
diff --git a/composer.json b/composer.json
index 9355e6fc34eaa29601f2daeac6f4da7c30793eea..407ce059478e48ba5a5fac922658a3e2356d2965 100644
--- a/composer.json
+++ b/composer.json
@@ -8,18 +8,17 @@
     ],
     "license": "MIT",
     "require": {
-        "laravel/framework": "5.8.*",
         "php": "^7.1.3",
+        "endclothing/prometheus_client_php": "^1.0",
         "fideloper/proxy": "^4.0",
-        "laravel/tinker": "^1.0",
         "globalcitizen/php-iban": "^2.6",
         "jenssegers/agent": "^2.6",
-        "mcamara/laravel-localization": "^1.3",
+        "laravel/framework": "5.8.*",
+        "laravel/tinker": "^1.0",
+        "mcamara/laravel-localization": "dev-master#13f418e481ed06f482e4fca87ec5ff67c2949373",
         "mews/captcha": "^2.2",
-        "monospice/laravel-redis-sentinel-drivers": "^2.6",
         "predis/predis": "^1.1",
-        "symfony/dom-crawler": "^4.1",
-        "endclothing/prometheus_client_php": "^1.0"
+        "symfony/dom-crawler": "^4.1"
     },
     "require-dev": {
         "beyondcode/laravel-dump-server": "^1.0",
diff --git a/config/metager/metager.php b/config/metager/metager.php
new file mode 100644
index 0000000000000000000000000000000000000000..cb7825e6ff35e166caaad4bb108e456ae9960652
--- /dev/null
+++ b/config/metager/metager.php
@@ -0,0 +1,5 @@
+<?php
+
+return [
+    "browserverification_enabled" => true,
+];
diff --git a/config/session.php b/config/session.php
index e769fac0e564350ada90982fc87dff1e1470869f..1db9bc0769c20dc7137d7496682363666723d724 100644
--- a/config/session.php
+++ b/config/session.php
@@ -70,7 +70,7 @@ return [
     |
      */
 
-    'connection' => null,
+    'connection' => "cache",
 
     /*
     |--------------------------------------------------------------------------
diff --git a/resources/js/scriptResultPage.js b/resources/js/scriptResultPage.js
index 9e899d7da05263988bdb29685097afb1cc3d2eb1..ff57833d7f140116ba45b89821a13008f51d2840 100644
--- a/resources/js/scriptResultPage.js
+++ b/resources/js/scriptResultPage.js
@@ -8,9 +8,13 @@ function botProtection() {
   $('.result').find('a').click(function () {
     var link = $(this).attr('href');
     var newtab = false;
+    var top = false;
     if ($(this).attr('target') == '_blank') {
       newtab = true;
+    } else if ($(this).attr('target') == "_top") {
+      top = true;
     }
+
     $.ajax({
       url: '/img/cat.jpg',
       type: 'post',
@@ -20,8 +24,13 @@ function botProtection() {
       timeout: 2000
     })
       .always(function () {
-        if (!newtab)
-          document.location.href = link;
+        if (!newtab) {
+          if (top) {
+            window.top.location.href = link;
+          } else {
+            document.location.href = link;
+          }
+        }
       });
     if (!newtab)
       return false;
diff --git a/resources/lang/de/429.php b/resources/lang/de/429.php
new file mode 100644
index 0000000000000000000000000000000000000000..60911729971a159d9d5853a63ba9a28b4aaf49ee
--- /dev/null
+++ b/resources/lang/de/429.php
@@ -0,0 +1,6 @@
+<?php
+
+return [
+    'title' => '429 - Zu viele Anfragen',
+    'text' => '',
+];
diff --git a/resources/lang/de/hilfe.php b/resources/lang/de/hilfe.php
index 387158d7562747791be1f472764645820e97b4fd..d7091d395166667733879fe21c56f0bbfd0a5675 100644
--- a/resources/lang/de/hilfe.php
+++ b/resources/lang/de/hilfe.php
@@ -88,7 +88,7 @@ return [
 
     "tor.title" => "Tor-Hidden-Service",
     "tor.1" => "Bei MetaGer werden schon seit vielen Jahren die IP-Adressen ausgeblendet und nicht gespeichert. Nichtsdestotrotz sind diese Adressen auf dem MetaGer-Server zeitweise, während eine Suche läuft, sichtbar: wenn MetaGer also einmal kompromittiert sein sollte, dann könnte dieser Angreifer Ihre Adressen mitlesen und speichern. Um dem höchsten Sicherheitsbedürfnis entgegenzukommen, unterhalten wir eine MetaGer-Instanz im Tor-Netzwerk: den MetaGer-TOR-hidden-Service - erreichbar über: <a href=\"/tor/\" target=\"_blank\" rel=\"noopener\">https://metager.de/tor/</a>. Für die Benutzung benötigen Sie einen speziellen Browser, den Sie auf <a href=\"https://www.torproject.org/\" target=\"_blank\" rel=\"noopener\">https://www.torproject.org/</a> herunter laden können.",
-    "tor.2" => "MetaGer erreichen Sie im Tor-Browser dann unter: http://b7cxf4dkdsko6ah2.onion .",
+    "tor.2" => "MetaGer erreichen Sie im Tor-Browser dann unter: http://metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion .",
 
     "proxy.title" => "Anonymisierender MetaGer-Proxyserver",
     "proxy.1" => "Um ihn zu verwenden, müssen Sie auf der MetaGer-Ergebnisseite nur auf \"ANONYM ÖFFNEN\" am unteren Rand des Ergebnisses klicken. Dann wird Ihre Anfrage an die Zielwebseite über unseren anonymisierenden Proxy-Server geleitet und Ihre persönlichen Daten bleiben weiterhin völlig geschützt. Wichtig: wenn Sie ab dieser Stelle den Links auf den Seiten folgen, bleiben Sie durch den Proxy geschützt. Sie können aber oben im Adressfeld keine neue Adresse ansteuern. In diesem Fall verlieren Sie den Schutz. Ob Sie noch geschützt sind, sehen Sie ebenfalls im Adressfeld. Es zeigt: https://proxy.suma-ev.de/?url=hier steht die eigentlich Adresse.",
diff --git a/resources/lang/de/tor.php b/resources/lang/de/tor.php
index d5cf9f0ca5cf96121b263832090ebb559eba1e3b..80503cd3dfe8f92d188909f1e1243d7ee640006b 100644
--- a/resources/lang/de/tor.php
+++ b/resources/lang/de/tor.php
@@ -1,5 +1,6 @@
 <?php
 
 return [
-	'torbutton' => 'Hidden-Service öffnen',
+    'description' => 'Nachfolgend finden Sie den Link zum Hidden-Service von MetaGer. Achtung: Dieser Link ist ausschließlich über das Tor-Netzwerk erreichbar. Ihr Browser produziert eine Fehlermeldung, wenn er nicht mit diesem verbunden ist.',
+    'torbutton' => 'Hidden-Service öffnen',
 ];
diff --git a/resources/lang/en/429.php b/resources/lang/en/429.php
new file mode 100644
index 0000000000000000000000000000000000000000..ccc7579bf259d84c33ab5efc69d11978529a0a7d
--- /dev/null
+++ b/resources/lang/en/429.php
@@ -0,0 +1,6 @@
+<?php
+
+return [
+    'title' => '429 - Too many Requests',
+    'text' => '',
+];
diff --git a/resources/lang/en/hilfe.php b/resources/lang/en/hilfe.php
index 0c88f48715a032eb533fbd4e3f2f68f44455228c..9fbdbf728ca4a2bc162194641525660d22d1993c 100644
--- a/resources/lang/en/hilfe.php
+++ b/resources/lang/en/hilfe.php
@@ -89,7 +89,7 @@ return [
 
     "tor.title" => "Tor Hidden Service",
     "tor.1" => "MetaGer provides the highest reachable security level for your privacy (anonymised IP addresses, servers under german privacy protection law). For further security needs or fear of compromised servers you may use the MetaGer-Tor branch. Please download the specialized webbrowser from <a href=\"https://www.torproject.org/\" target=\"_blank\" rel=\"noopener\">https://www.torproject.org/</a>. You will find help there, too.",
-    "tor.2" => "MetaGer Tor address: http://b7cxf4dkdsko6ah2.onion/tor/",
+    "tor.2" => "MetaGer Tor address: http://metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion",
 
     "proxy.title" => "MetaGer proxy server",
     "proxy.1" => "Click or touch \"open anonymously\" to use the MetaGer proxy server. The provided protection is limited to the website you reached from our result page. Protection persists while you see https://proxy.suma-ev.de/?url=...in your webbrowser‘s address field.",
diff --git a/resources/lang/en/tor.php b/resources/lang/en/tor.php
index f884a01f06fac3cf49b52778e9b5e3820c413add..fa32eac9675a5eeb80f586813c9a25f18a51684f 100644
--- a/resources/lang/en/tor.php
+++ b/resources/lang/en/tor.php
@@ -1,5 +1,6 @@
 <?php
 
 return [
-    "torbutton"	=>	"Open TOR-hidden service"
+    'description' => "Below you will find the link to MetaGer's hidden service. Attention: This link can only be reached via the Tor network. Your browser produces an error message if it is not connected to it.",
+    "torbutton" => "Open TOR-hidden service",
 ];
diff --git a/resources/lang/es/tor.php b/resources/lang/es/tor.php
index 53db5286ab7adb3fe2ee30b02a9944208a99fda9..6223da8f87d279c5d68955470260373eb66ecc32 100644
--- a/resources/lang/es/tor.php
+++ b/resources/lang/es/tor.php
@@ -1,5 +1,6 @@
 <?php
 
 return [
-    "torbutton"	=>	"Usar Tor"
-];
\ No newline at end of file
+    'description' => 'A continuación, encontrará el enlace al servicio oculto de MetaGer. Atención: Solo se puede acceder a este enlace a través de la red Tor. Su navegador genera un mensaje de error si no está conectado a él.',
+    "torbutton" => "Usar Tor",
+];
diff --git a/resources/less/metager/pages/resultpage/result.less b/resources/less/metager/pages/resultpage/result.less
index f151b702cae22dbe4c98a9a27faae2d9e7fe27ff..b2e38c19ebf99475052d54b7b591c5c1634ac196 100644
--- a/resources/less/metager/pages/resultpage/result.less
+++ b/resources/less/metager/pages/resultpage/result.less
@@ -59,6 +59,7 @@
         .result-subheadline {
             width: 100%;
             display: flex;
+            align-items: center;
             line-height: 1.3;
             .result-link {
                 .overflow-ellipsis;
@@ -90,7 +91,8 @@
                     top: -2px;
                 }
             }
-            span.partnershop-info {
+            a.partnershop-info {
+                display: block;
                 background-color: white;
                 color: #333;
                 text-shadow: none;
@@ -100,8 +102,6 @@
                 margin-left: 8px;
                 border-radius: 4px;
                 font-size: .6em;
-                position: relative;
-                top: -2px;
             }
         }
     }
diff --git a/resources/less/metager/parts/searchbar.less b/resources/less/metager/parts/searchbar.less
index 582b31449fdacf44108edcb4dafd6285ac43f2a2..957c32659d0c48d2e19148e096f9c2d69bc9c422 100644
--- a/resources/less/metager/parts/searchbar.less
+++ b/resources/less/metager/parts/searchbar.less
@@ -42,6 +42,7 @@
         display: -webkit-box;
         display: -ms-flexbox;
         display: flex;
+        align-items: center;
         
         #search-key {
             display: flex;
@@ -98,7 +99,6 @@
                 border: 0;
                 background-color: transparent;
                 padding: 0;
-                height: 100%;
             }
         }
     }
@@ -173,4 +173,8 @@
     width: 100%;
     max-width: 760px;
     height: 51px;
+}
+
+#searchForm {
+    margin: 0;
 }
\ No newline at end of file
diff --git a/resources/views/errors/404.blade.php b/resources/views/errors/404.blade.php
index f4f87a3057bccc53b632151c4679f545cbdab650..0f928a9db9a03e120b1787b72b5b93c3ff09f5be 100644
--- a/resources/views/errors/404.blade.php
+++ b/resources/views/errors/404.blade.php
@@ -3,6 +3,12 @@
 @section('title', 'Fehler 404 - Seite nicht gefunden')
 
 @section('content')
+	<style>
+		main#main-content {
+			align-items: center;
+			justify-content: center;
+		}
+	</style>
 	<h1>{{ trans('404.title') }}</h1>
 	<p>{{ trans('404.text') }}</p>
 @endsection
diff --git a/resources/views/errors/429.blade.php b/resources/views/errors/429.blade.php
new file mode 100644
index 0000000000000000000000000000000000000000..4592b922a7e228614cd567fbd511d165be4fd9f7
--- /dev/null
+++ b/resources/views/errors/429.blade.php
@@ -0,0 +1,14 @@
+@extends('layouts.subPages')
+
+@section('title', trans('429.title'))
+
+@section('content')
+	<style>
+		main#main-content {
+			align-items: center;
+			justify-content: center;
+		}
+	</style>
+	<h1>{{ trans('429.title') }}</h1>
+	<p>{{ trans('429.text') }}</p>
+@endsection
diff --git a/resources/views/layouts/researchandtabs.blade.php b/resources/views/layouts/researchandtabs.blade.php
index 9e9596e0cc281bb673cf0a82750fbd6df5e41859..17a26ccd3eae3913021bea12859c68c075c6baac 100644
--- a/resources/views/layouts/researchandtabs.blade.php
+++ b/resources/views/layouts/researchandtabs.blade.php
@@ -3,10 +3,10 @@
 	<div id="research-bar-container">
 		<div id="research-bar">
 			<div id="header-logo">
-				<a class="screen-large" href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/") }}" tabindex="4">
+				<a class="screen-large" href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/") }}" @if(!empty($metager) && $metager->isFramed())target="_top" @endif tabindex="4">
 					<h1><img src="/img/metager.svg" alt="MetaGer" /></h1>
 				</a>
-				<a class="screen-small" href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/") }}">
+				<a class="screen-small" href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/") }}" @if(!empty($metager) && $metager->isFramed())target="_top" @endif>
 					<h1><img src="/img/metager-schloss-orange.svg" alt="MetaGer" /></h1>
 				</a>
 			</div>
diff --git a/resources/views/layouts/result.blade.php b/resources/views/layouts/result.blade.php
index c09efba694028c8631a68bef542aaa29aa930888..04c53ea16b3cc83fe47b59f84a7f122639bd1c35 100644
--- a/resources/views/layouts/result.blade.php
+++ b/resources/views/layouts/result.blade.php
@@ -16,8 +16,8 @@
 				{{ $result->anzeigeLink }}
 			</a>
 			@if( isset($result->partnershop) && $result->partnershop === TRUE)
-				<a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/partnershops") }}" target="_blank" rel="noopener">
-					<span class="partnershop-info">{!! trans('result.options.4') !!}</span>
+				<a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/partnershops") }}" target="_blank" class="partnershop-info" rel="noopener">
+					<span>{!! trans('result.options.4') !!}</span>
 				</a>
 			@endif
 		</div>
@@ -49,7 +49,7 @@
 	</div>
 	<input type="checkbox" id="result-toggle-{{$result->hash}}" class="result-toggle" style="display: none">
 	<div class="result-footer">
-		<a class="result-open" href="{{ $result->link }}" target="_self" rel="noopener">
+		<a class="result-open" href="{{ $result->link }}" @if($metager->isFramed())target="_top"@else target="_self"@endif rel="noopener">
 			{!! trans('result.options.7') !!}
 		</a>
 		<a class="result-open-newtab" href="{{ $result->link }}" target="_blank" rel="noopener">
@@ -75,19 +75,19 @@
 					</li>
 					@if(strlen($metager->getSite()) === 0)
 						<li>
-							<a href="{{ $metager->generateSiteSearchLink($result->strippedHost) }}">
+							<a href="{{ $metager->generateSiteSearchLink($result->strippedHost) }}" @if($metager->isFramed())target="_top"@else target="_self"@endif>
 								<nobr>{!! trans('result.options.1') !!}</nobr>
 							</a>
 						</li>
 					@endif
 					<li>
-						<a href="{{ $metager->generateRemovedHostLink($result->strippedHost) }}">
+						<a href="{{ $metager->generateRemovedHostLink($result->strippedHost) }}" @if($metager->isFramed())target="_top"@else target="_self"@endif>
 							<nobr>{!! trans('result.options.2', ['host' => $result->strippedHost]) !!}</nobr>
 						</a>
 					</li>
 					@if( $result->strippedHost !== $result->strippedDomain )
 						<li>
-							<a href="{{ $metager->generateRemovedDomainLink($result->strippedDomain) }}">
+							<a href="{{ $metager->generateRemovedDomainLink($result->strippedDomain) }}" @if($metager->isFramed())target="_top"@else target="_self"@endif>
 								<nobr>{!! trans('result.options.3', ['domain' => $result->strippedDomain]) !!}</nobr>
 							</a>
 						</li>
diff --git a/resources/views/layouts/resultPage.blade.php b/resources/views/layouts/resultPage.blade.php
index 697c6ecdec8683a5fd2eaac6de7d67e7409f9741..55c5df2edefb5a7735d7a9a135a04797b5a1d94a 100644
--- a/resources/views/layouts/resultPage.blade.php
+++ b/resources/views/layouts/resultPage.blade.php
@@ -1,8 +1,8 @@
+@if(!$metager->isHeaderPrinted())
 <!DOCTYPE html>
 <html lang="{!! trans('staticPages.meta.language') !!}">
 	<head>
 		<meta charset="utf-8">
-		<title>{{ $eingabe }} - MetaGer</title>
 		<link href="/favicon.ico" rel="icon" type="image/x-icon" />
 		<link href="/favicon.ico" rel="shortcut icon" type="image/x-icon" />
 		<link rel="apple-touch-icon" href="/img/apple/touch-icon.png">
@@ -14,6 +14,14 @@
 		<link rel="apple-touch-icon" sizes="144x144" href="/img/apple/touch-icon-144.png">
 		<link rel="apple-touch-icon" sizes="152x152" href="/img/apple/touch-icon-152.png">
 		<link rel="apple-touch-icon" sizes="180x180" href="/img/apple/touch-icon-180.png">
+		<link rel="search" type="application/opensearchdescription+xml" title="{!! trans('resultPage.opensearch') !!}" href="{{  LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), action('StartpageController@loadPlugin')) }}">
+		<link href="/fonts/liberationsans/stylesheet.css" rel="stylesheet">
+		<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome.css') }}" />
+		<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome-solid.css') }}" />
+		<link type="text/css" rel="stylesheet alternate" href="{{ mix('css/themes/metager-dark.css') }}" title="MetaGer Dark"/>
+		<link type="text/css" rel="stylesheet" href="{{ mix('css/themes/metager.css') }}" title="MetaGer"/>
+@endif
+		<title>{{ $eingabe }} - MetaGer</title>
 		<meta content="width=device-width, initial-scale=1.0, user-scalable=no" name="viewport" />
 		<meta name="p" content="{{ getmypid() }}" />
 		<meta name="q" content="{{ $eingabe }}" />
@@ -21,12 +29,6 @@
 		<meta name="mm" content="{{ $metager->getVerificationId() }}" />
 		<meta name="mn" content="{{ $metager->getVerificationCount() }}" />
 		<meta name="searchkey" content="{{ $metager->getSearchUid() }}" />
-		<link rel="search" type="application/opensearchdescription+xml" title="{!! trans('resultPage.opensearch') !!}" href="{{  LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), action('StartpageController@loadPlugin')) }}">
-		<link href="/fonts/liberationsans/stylesheet.css" rel="stylesheet">
-		<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome.css') }}" />
-		<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome-solid.css') }}" />
-		<link type="text/css" rel="stylesheet alternate" href="{{ mix('css/themes/metager-dark.css') }}" title="MetaGer Dark"/>
-		<link type="text/css" rel="stylesheet" href="{{ mix('css/themes/metager.css') }}" title="MetaGer"/>
 		<meta name="referrer" content="origin">
 		<meta name="age-meta-label" content="age=18"/>
 		@include('parts.utility')
diff --git a/resources/views/layouts/resultpage/resources.blade.php b/resources/views/layouts/resultpage/resources.blade.php
new file mode 100644
index 0000000000000000000000000000000000000000..827b5b286292e9308fc4b4bbb9e74d39fe810fd2
--- /dev/null
+++ b/resources/views/layouts/resultpage/resources.blade.php
@@ -0,0 +1,17 @@
+    <link href="/favicon.ico" rel="icon" type="image/x-icon" />
+	<link href="/favicon.ico" rel="shortcut icon" type="image/x-icon" />
+	<link rel="apple-touch-icon" href="/img/apple/touch-icon.png">
+	<link rel="apple-touch-icon" sizes="57x57" href="/img/apple/touch-icon-57.png">
+	<link rel="apple-touch-icon" sizes="72x72" href="/img/apple/touch-icon-72.png">
+	<link rel="apple-touch-icon" sizes="76x76" href="/img/apple/touch-icon-76.png">
+	<link rel="apple-touch-icon" sizes="114x114" href="/img/apple/touch-icon-114.png">
+	<link rel="apple-touch-icon" sizes="120x120" href="/img/apple/touch-icon-120.png">
+	<link rel="apple-touch-icon" sizes="144x144" href="/img/apple/touch-icon-144.png">
+	<link rel="apple-touch-icon" sizes="152x152" href="/img/apple/touch-icon-152.png">
+	<link rel="apple-touch-icon" sizes="180x180" href="/img/apple/touch-icon-180.png">
+	<link rel="search" type="application/opensearchdescription+xml" title="{!! trans('resultPage.opensearch') !!}" href="{{  LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), action('StartpageController@loadPlugin')) }}">
+	<link href="/fonts/liberationsans/stylesheet.css" rel="stylesheet">
+	<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome.css') }}" />
+	<link type="text/css" rel="stylesheet" href="{{ mix('css/fontawesome-solid.css') }}" />
+	<link type="text/css" rel="stylesheet alternate" href="{{ mix('css/themes/metager-dark.css') }}" title="MetaGer Dark"/>
+	<link type="text/css" rel="stylesheet" href="{{ mix('css/themes/metager.css') }}" title="MetaGer"/>
diff --git a/resources/views/layouts/resultpage/unverifiedResultPage.blade.php b/resources/views/layouts/resultpage/unverifiedResultPage.blade.php
new file mode 100644
index 0000000000000000000000000000000000000000..0f9f0f229e3e2b8a88aa8f74f60214b8ae82b374
--- /dev/null
+++ b/resources/views/layouts/resultpage/unverifiedResultPage.blade.php
@@ -0,0 +1,6 @@
+<title>{{ Request::input('eingabe', '') }} - MetaGer</title>
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
+</head>
+<body>
+    <iframe id="mg-framed" src="{{ $url }}" autofocus="true" onload="this.contentWindow.focus();"></iframe>
+</body>
diff --git a/resources/views/layouts/resultpage/verificationCss.blade.php b/resources/views/layouts/resultpage/verificationCss.blade.php
new file mode 100644
index 0000000000000000000000000000000000000000..2c5cfc5b67d757ceb0ca991cfe7eb5f75a3c856d
--- /dev/null
+++ b/resources/views/layouts/resultpage/verificationCss.blade.php
@@ -0,0 +1,16 @@
+html {
+    height: 100%;
+}
+
+body {
+    margin: 0;
+    height: 100%;
+}
+
+iframe#mg-framed {
+    display: block;
+    width: 100%;
+    border: 0;
+    height: 100%;
+    height: 100vh;
+}
\ No newline at end of file
diff --git a/resources/views/layouts/resultpage/verificationHeader.blade.php b/resources/views/layouts/resultpage/verificationHeader.blade.php
new file mode 100644
index 0000000000000000000000000000000000000000..f982f6dd6017e1d165f5b01f4cf2a4f8baf175c2
--- /dev/null
+++ b/resources/views/layouts/resultpage/verificationHeader.blade.php
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html lang="{!! trans('staticPages.meta.language') !!}">
+<head>
+    <meta charset="UTF-8">
+    <link rel="stylesheet" href="/index.css?id={{ $key }}">
diff --git a/resources/views/parts/filter.blade.php b/resources/views/parts/filter.blade.php
index 9eec9fc6bbcb6dae976e73ddc911ab923ec73d69..e69889e2b196a818d414eda4c714c84aec79b88c 100644
--- a/resources/views/parts/filter.blade.php
+++ b/resources/views/parts/filter.blade.php
@@ -1,7 +1,7 @@
 	<div id="options">
 		<div id="toggle-box">
 			<div id="settings">
-				<a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), route('settings', ["fokus" => $metager->getFokus(), "url" => url()->full()])) }}">
+				<a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), route('settings', ["fokus" => $metager->getFokus(), "url" => $metager->generateSearchLink($metager->getFokus())])) }}" @if(!empty($metager) && $metager->isFramed())target="_top" @endif>
 					<i class="fas fa-cogs"></i>
 					@if($metager->getSavedSettingCount() > 0) <span class="badge badge-primary"></span>{{ $metager->getSavedSettingCount() }}@endif
 					@lang('metaGer.settings')&hellip;
@@ -17,7 +17,7 @@
 				@endif
 				@if($metager->getManualParameterFilterSet())
 				<div id="options-reset">
-					<a href="{{$metager->generateSearchLink($metager->getFokus())}}"><nobr>{{ trans('metaGer.filter.reset') }}</nobr></a>
+					<a href="{{$metager->generateSearchLink($metager->getFokus())}}" @if(!empty($metager) && $metager->isFramed())target="_top" @endif><nobr>{{ trans('metaGer.filter.reset') }}</nobr></a>
 				</div>
 				@endif
 			</div>
diff --git a/resources/views/parts/foki.blade.php b/resources/views/parts/foki.blade.php
index b0648202d1822881c09ef7aef64bec1a2b8d1258..3905c52c9f4c503f809a5eda87bfb9027922ac01 100644
--- a/resources/views/parts/foki.blade.php
+++ b/resources/views/parts/foki.blade.php
@@ -1,11 +1,11 @@
 @foreach($metager->getSumaFile()->foki as $name => $fokus)
 	<div id="{{$name}}" @if($metager->getFokus() === $name)class="active"@endif>
-		<a href="@if($metager->getFokus() === $name)#@else{!!$metager->generateSearchLink($name)!!}@endif" target="_self" tabindex="0">@lang($fokus->{"display-name"})</a>
+		<a href="@if($metager->getFokus() === $name)#@else{!!$metager->generateSearchLink($name)!!}@endif" @if(!empty($metager) && $metager->isFramed())target="_top" @else target="_self"@endif tabindex="0">@lang($fokus->{"display-name"})</a>
 	</div>
 @endforeach
 @if (LaravelLocalization::getCurrentLocale() == "de")
 <div id="maps">
-	<a href="https://maps.metager.de/map/{{ urlencode($metager->getQ()) }}/9.7380161,52.37119740000003,12" target="_blank">
+	<a href="https://maps.metager.de/map/{{ urlencode($metager->getQ()) }}/9.7380161,52.37119740000003,12" @if(!empty($metager) && $metager->isFramed())target="_top" @else target="_blank"@endif>
 		Maps
 	</a>
 </div>
diff --git a/resources/views/parts/footer.blade.php b/resources/views/parts/footer.blade.php
index 1634790b6b9a776c5f4680ecc279a7f8daa28791..90c948debeb9ffd0fca91dc119fd0d05fd925a09 100644
--- a/resources/views/parts/footer.blade.php
+++ b/resources/views/parts/footer.blade.php
@@ -1,13 +1,13 @@
 @if ($type === 'startpage' || $type === 'subpage' || $type === 'resultpage')
 <footer class="{{ $id }} noprint">
   <div>
-    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "kontakt") }}">{{ trans('sidebar.nav5') }}</a>
-    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "impressum") }}">{{ trans('sidebar.nav8') }}</a>
-    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "datenschutz") }}">{{ trans('sidebar.nav3') }}</a>
+    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "kontakt") }}" @if(!empty($metager) && $metager->isFramed())target="_top"@endif>{{ trans('sidebar.nav5') }}</a>
+    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "impressum") }}" @if(!empty($metager) && $metager->isFramed())target="_top"@endif>{{ trans('sidebar.nav8') }}</a>
+    <a href="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "datenschutz") }}" @if(!empty($metager) && $metager->isFramed())target="_top"@endif>{{ trans('sidebar.nav3') }}</a>
   </div>
   @if($type !== 'startpage')
   <div>
-    <span class="hidden-xs">{{ trans('footer.sumaev.1') }} <a href="{{ trans('footer.sumaev.link') }}">{{ trans('footer.sumaev.2') }}</a></span>
+    <span class="hidden-xs">{{ trans('footer.sumaev.1') }} <a href="{{ trans('footer.sumaev.link') }}" @if(!empty($metager) && $metager->isFramed())target="_top"@endif>{{ trans('footer.sumaev.2') }}</a></span>
   </div>
   @endif
 </footer>
diff --git a/resources/views/parts/pager.blade.php b/resources/views/parts/pager.blade.php
index 5bb3011ca9911019820cf0c06f4c652da82320c9..9e17061b71c80fa278ab6da19f6529f9bdb2a4a1 100644
--- a/resources/views/parts/pager.blade.php
+++ b/resources/views/parts/pager.blade.php
@@ -4,6 +4,6 @@
         <a @if($metager->getPage() !== 1) href="javascript:history.back()" @endif>{{ trans('results.zurueck') }}</a>
     </div>
     <div id="next-search-link" @if($metager->nextSearchLink() === "#") class="disabled" @endif>
-        <a @if($metager->nextSearchLink() !== "#") href="{{ $metager->nextSearchLink() }}" @endif>{{ trans('results.weiter') }}</a>
+        <a @if($metager->nextSearchLink() !== "#") href="{{ $metager->nextSearchLink() }}" @endif @if($metager->isFramed())target="_top"@else target="_self"@endif>{{ trans('results.weiter') }}</a>
     </div>
 </nav>
diff --git a/resources/views/parts/searchbar.blade.php b/resources/views/parts/searchbar.blade.php
index eefb203ef4463ba7717863df7352993d50234fbc..af89e43e96135a9399b113e1817861ac815fb7b6 100644
--- a/resources/views/parts/searchbar.blade.php
+++ b/resources/views/parts/searchbar.blade.php
@@ -1,9 +1,9 @@
 <fieldset>
-	<form id="searchForm" method={{ $request }} action="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/meta/meta.ger3 ") }}" accept-charset="UTF-8">
+	<form id="searchForm" method={{ $request }} @if(!empty($metager) && $metager->isFramed())target="_top" @endif action="{{ LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), "/meta/meta.ger3 ") }}" accept-charset="UTF-8">
 		<div class="searchbar {{$class ?? ''}}">
 			<div class="search-input-submit">
 				<div id="search-key">
-					<a id="key-link" @if(isset($apiAuthorized) && $apiAuthorized)class="authorized" @else class="unauthorized"@endif href="{{ action('KeyController@index', ['redirUrl' => url()->full() ]) }}" data-tooltip="{{ trans ('index.key.tooltip') }}" tabindex="0">
+					<a id="key-link" @if(isset($apiAuthorized) && $apiAuthorized)class="authorized" @else class="unauthorized"@endif href="{{ action('KeyController@index', ['redirUrl' => !empty($metager) ? $metager->generateSearchLink($metager->getFokus()) : url()->full() ]) }}" @if(!empty($metager) && $metager->isFramed())target="_top" @endif data-tooltip="{{ trans ('index.key.tooltip') }}" tabindex="0">
 						<i class="fa fa-key" aria-hidden="true"></i>
 					</a>
 				</div>
diff --git a/resources/views/tor.blade.php b/resources/views/tor.blade.php
index e7acf2e16995b70501e34225bdc1245fe960dcd9..fba63f18a0aaf93f57b7170f54097fad8da78e07 100644
--- a/resources/views/tor.blade.php
+++ b/resources/views/tor.blade.php
@@ -4,5 +4,6 @@
 
 @section('content')
 	<h1>MetaGer hidden service</h1>
-	<a class="btn btn-primary" href="http://b7cxf4dkdsko6ah2.onion/" role="button">{{trans('tor.torbutton')}}</a>
+	<p>@lang('tor.description')</p>
+	<a class="btn btn-primary" href="http://metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion/" role="button">{{trans('tor.torbutton')}}</a>
 @endsection
diff --git a/routes/web.php b/routes/web.php
index caf716a5e8aad65efd1db41fcf78f767980d6a89..b614fa1e8d305194edf4df2fd43f56a1d8916828 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -195,12 +195,14 @@ Route::group(
             return redirect(LaravelLocalization::getLocalizedURL(LaravelLocalization::getCurrentLocale(), '/'));
         });
 
-        Route::match(['get', 'post'], 'meta/meta.ger3', 'MetaGerSearch@search')->middleware('humanverification', 'useragentmaster');
+        Route::match(['get', 'post'], 'meta/meta.ger3', 'MetaGerSearch@search')->middleware('browserverification', 'humanverification', 'useragentmaster')->name("resultpage");
 
         Route::get('meta/loadMore', 'MetaGerSearch@loadMore');
         Route::post('img/cat.jpg', 'HumanVerification@remove');
+        Route::get('verify/metager/{id}/{uid}', ['as' => 'captcha', 'uses' => 'HumanVerification@captcha', 'middleware' => 'throttle:12,1']);
         Route::get('r/metager/{mm}/{pw}/{url}', ['as' => 'humanverification', 'uses' => 'HumanVerification@removeGet']);
         Route::post('img/dog.jpg', 'HumanVerification@whitelist');
+        Route::get('index.css', 'HumanVerification@browserVerification');
 
         Route::get('meta/picture', 'Pictureproxy@get');
         Route::get('clickstats', 'LogController@clicklog');