diff --git a/apps/hydra/glance/configmap-assets.yaml b/apps/hydra/glance/configmap-assets.yaml
new file mode 100644
index 0000000..e94bf55
--- /dev/null
+++ b/apps/hydra/glance/configmap-assets.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+data:
+  user.css: |
+    main {
+    }
+kind: ConfigMap
+metadata:
+  name: glance-assets-configmap
+  namespace: glance
diff --git a/apps/hydra/glance/configmap.yaml b/apps/hydra/glance/configmap-glance.yaml
similarity index 93%
rename from apps/hydra/glance/configmap.yaml
rename to apps/hydra/glance/configmap-glance.yaml
index 6f25b8f..a746911 100644
--- a/apps/hydra/glance/configmap.yaml
+++ b/apps/hydra/glance/configmap-glance.yaml
@@ -3,6 +3,15 @@ data:
   glance.yml: |
     server:
       assets-path: /app/assets
+    # proxied: true
+
+    # auth:
+    # secret-key: # this must be set to a random value generated using the secret:make CLI command
+    # users:
+    #   admin:
+    #     password: 123456
+    #   svilen:
+    #     password: 123456
 
     theme:
       # Note: assets are cached by the browser, changes to the CSS file
@@ -102,9 +111,6 @@ data:
                 - go-gitea/gitea
                 - immich-app/immich
                 - syncthing/syncthing
-  user.css: |
-    main {
-    }
 kind: ConfigMap
 metadata:
   name: glance-configmap
diff --git a/apps/hydra/glance/deployment.yaml b/apps/hydra/glance/deployment.yaml
new file mode 100644
index 0000000..7d85811
--- /dev/null
+++ b/apps/hydra/glance/deployment.yaml
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: glance
+  name: glance
+  namespace: glance
+spec:
+  selector:
+    matchLabels:
+      app: glance
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: glance
+    spec:
+      containers:
+      - image: glanceapp/glance:v0.8.4
+        name: glance
+        resources: {}
+        volumeMounts:
+        - mountPath: /app/config
+          name: config
+        - mountPath: /app/assets
+          name: assets
+        - mountPath: /etc/localtime
+          name: localtime
+          readOnly: true
+      volumes:
+      - configMap:
+          name: glance-configmap
+        name: config
+      - configMap:
+          name: glance-assets-configmap
+        name: assets
+      - hostPath:
+          path: /etc/localtime
+          type: File
+        name: localtime
+status: {}
diff --git a/apps/hydra/glance/kustomization.yaml b/apps/hydra/glance/kustomization.yaml
index f59c08a..7b479b0 100644
--- a/apps/hydra/glance/kustomization.yaml
+++ b/apps/hydra/glance/kustomization.yaml
@@ -4,6 +4,8 @@ metadata:
   name: glance
   namespace: glance
 resources:
-- configmap.yaml
+- configmap-assets.yaml
+- configmap-glance.yaml
+- deployment.yaml
 - namespace.yaml
 - service.yaml
diff --git a/config/glance/config/glance.yml b/config/glance/config/glance.yml
index 66ff2f9..6b12ecf 100644
--- a/config/glance/config/glance.yml
+++ b/config/glance/config/glance.yml
@@ -1,5 +1,14 @@
 server:
   assets-path: /app/assets
+# proxied: true
+
+# auth:
+# secret-key: # this must be set to a random value generated using the secret:make CLI command
+# users:
+#   admin:
+#     password: 123456
+#   svilen:
+#     password: 123456
 
 theme:
   # Note: assets are cached by the browser, changes to the CSS file
diff --git a/pkg/glance.go b/pkg/glance.go
index 92fe6d9..b6e5d45 100644
--- a/pkg/glance.go
+++ b/pkg/glance.go
@@ -19,7 +19,8 @@ var Secret = struct {
 var Namespace = kube.Namespace(root.Glance.Name)
 var meta kube.Metadata
 var srv core.Service
-var config_map core.ConfigMap
+var config_glance core.ConfigMap
+var config_assets core.ConfigMap
 
 func init() {
 	meta = kube.NewMetadata(root.Glance.Name, Namespace)
@@ -27,19 +28,21 @@ func init() {
 	srv.Spec.Type = core.ServiceTypeNodePort
 	srv.Spec.Ports[0].NodePort = int32(root.Glance.Public.NodePort)
 
-	config_map = kube.ConfigFromFile("glance.yml", "./config/glance/config/glance.yml", meta)
-	config_map.Data["home.yml"] = string(kube.ReadFileBytes("./config/glance/config/home.yml"))
-	config_map.Data["user.css"] = string(kube.ReadFileBytes("./config/glance/assets/user.css"))
+	config_glance = kube.ConfigFromFile("glance.yml", "./config/glance/config/glance.yml", meta)
+	config_glance.Data["home.yml"] = string(kube.ReadFileBytes("./config/glance/config/home.yml"))
+	meta_assets := kube.NewMetadata(root.Glance.Name+"-assets", Namespace)
+	config_assets = kube.ConfigFromFile("user.css", "./config/glance/assets/user.css", meta_assets)
 }
 
 func Stack() stack.Stack {
 	kz := kube.NewKuztomizedStack(
 		meta,
 		map[string]any{
-			"namespace": Namespace,
-			"service":   srv,
-			"configmap": config_map,
-			// "deployment": Deployment(),
+			"namespace":        Namespace,
+			"service":          srv,
+			"configmap-glance": config_glance,
+			"configmap-assets": config_assets,
+			"deployment":       Deployment(),
 		},
 	)
 	return kz.Stack("glance")
@@ -50,14 +53,42 @@ func Deployment() apps.Deployment {
 	// Config volume - ReadOnly?
 	// Assets volume - ReadOnly?
 	// Mount /etc/localtime (ReadOnly)
+	configVol := kube.NewVolumeFrom(kube.VolumeSourceConfigMap, "config", config_glance.Name)
+	assetsVol := kube.NewVolumeFrom(kube.VolumeSourceConfigMap, "assets", config_assets.Name)
+	localtimeVol := core.Volume{
+		Name: "localtime",
+		VolumeSource: core.VolumeSource{
+			HostPath: &core.HostPathVolumeSource{
+				Path: "/etc/localtime",
+				Type: new(core.HostPathFile),
+			},
+		},
+	}
 	podSpec := core.PodSpec{
 		Containers: []core.Container{{
 			Name:  root.Glance.Name,
 			Image: root.Glance.Image,
-			Env:   kube.NewEnvVarWithSecret(nil, nil, Secret.Name),
+			// Env:   kube.NewEnvVarWithSecret(nil, nil, Secret.Name),
+			VolumeMounts: []core.VolumeMount{
+				{
+					Name:      configVol.Name,
+					MountPath: "/app/config",
+				},
+				{
+					Name:      assetsVol.Name,
+					MountPath: "/app/assets",
+				},
+				{
+					Name:      localtimeVol.Name,
+					MountPath: "/etc/localtime",
+					ReadOnly:  true,
+				},
+			},
 		}},
 		Volumes: []core.Volume{
-			kube.NewVolumeFrom(kube.VolumeSourceConfigMap, "config", config_map.Name),
+			configVol,
+			assetsVol,
+			localtimeVol,
 		},
 	}
 	return kube.NewDeployment(meta, podSpec)