diff --git a/Caddyfile b/Caddyfile
index 417319a..3e7c599 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,8 +1,7 @@
 :8080 {
-    basicauth /* {
-        # user: admin | pwd: 2/e+h<L9\V6;
-        # regenerate: htpasswd -nbB -C 10 admin NEWPWD | cut -d: -f2 | base64
-        admin JDJ5JDEwJHlaV2tLUzBQL2ZsSndBL2g4WDZBNk9NdEZtTnVqcThOOHZ2aXNGRVVMWHhJUDB0WHhNanZD
+    basic_auth /* {
+        # Set BASIC_AUTH_HASH on the server: caddy hash-password --plaintext 'YOUR_PWD'
+        admin {env.BASIC_AUTH_HASH}
     }
     reverse_proxy localhost:4213
 }
diff --git a/Dockerfile b/Dockerfile
index f14c95e..cf57c22 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,15 +1,9 @@
 FROM debian:12-slim
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-# System deps + Caddy
 RUN apt-get update -qq && \
     apt-get install -y --no-install-recommends \
-        python3 python3-pip python3-venv \
         curl ca-certificates unzip && \
-    # Caddy
     curl -fsSL https://caddyserver.com/install.sh | bash && \
-    # DuckDB CLI
     curl -fsSL \
         "https://github.com/duckdb/duckdb/releases/latest/download/duckdb_cli-linux-amd64.zip" \
         -o /tmp/duckdb.zip && \
@@ -20,10 +14,7 @@ RUN apt-get update -qq && \
 
 WORKDIR /app
 
-COPY requirements.txt .
-RUN pip3 install --no-cache-dir --break-system-packages -r requirements.txt
-
-COPY prepara_db.py Caddyfile start.sh ./
+COPY basedosdados3.duckdb Caddyfile start.sh ./
 RUN chmod +x start.sh
 
 EXPOSE 8080
diff --git a/haloy.yml b/haloy.yml
index 8708fcb..d6b0550 100644
--- a/haloy.yml
+++ b/haloy.yml
@@ -1,10 +1,10 @@
 name: basedosdados
-server: YOUR_SERVER_IP_OR_HOSTNAME
+server: 89.167.95.136
 domains:
   - domain: db.xn--2dk.xyz
 port: 8080
 env:
-  - HETZNER_S3_BUCKET
   - HETZNER_S3_ENDPOINT
   - AWS_ACCESS_KEY_ID
   - AWS_SECRET_ACCESS_KEY
+  - BASIC_AUTH_HASH
diff --git a/requirements.txt b/requirements.txt
deleted file mode 100644
index acb4c9c..0000000
--- a/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-duckdb
-boto3
-python-dotenv
diff --git a/start.sh b/start.sh
index ee8a6ce..aac3152 100644
--- a/start.sh
+++ b/start.sh
@@ -1,11 +1,20 @@
 #!/bin/bash
 set -euo pipefail
 
-echo "[start] Building DuckDB views from S3..."
-python3 prepara_db.py
+# DuckDB init: load S3 credentials from env at session start
+INIT=$(mktemp /tmp/duckdb_init_XXXX.sql)
+S3_ENDPOINT="${HETZNER_S3_ENDPOINT#https://}"
+S3_ENDPOINT="${S3_ENDPOINT#http://}"
+cat > "$INIT" <<SQL
+INSTALL httpfs; LOAD httpfs;
+SET s3_endpoint='${S3_ENDPOINT}';
+SET s3_access_key_id='${AWS_ACCESS_KEY_ID}';
+SET s3_secret_access_key='${AWS_SECRET_ACCESS_KEY}';
+SET s3_url_style='path';
+SQL
 
 echo "[start] Starting Caddy..."
 caddy start --config /app/Caddyfile --adapter caddyfile
 
-echo "[start] Starting DuckDB UI on :4213..."
-exec duckdb --ui basedosdados3.duckdb
+echo "[start] Starting DuckDB UI..."
+exec duckdb --ui -init "$INIT" basedosdados3.duckdb