diff --git a/README.md b/README.md
index ad8acad..b550c7e 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,9 @@ location /yoururl {
 ```
 After this you can access the service running on port `3333` at `http://localhost:8888/yoururl`
 
+It is very important to understand that from now on your application must behave well behind a reverse proxy.
+What this means is all `href`s must point the proxied paths (e.g. links should refer to `/yoururl/register` instead of `/register`) on your HTML pages.
+
 You can learn about configuring nginx in [this](https://www.digitalocean.com/community/tutorials/understanding-the-nginx-configuration-file-structure-and-configuration-contexts) handy little tutorial.
 
 ### supervisor
diff --git a/hack/bootstrap.sh b/hack/bootstrap.sh
new file mode 100755
index 0000000..643a9cc
--- /dev/null
+++ b/hack/bootstrap.sh
@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+set -eu
+set -o pipefail
+set -o errtrace
+shopt -s expand_aliases
+[ "$(uname)" == "Darwin" ] && alias sed="gsed" || :
+
+HERE="$(pwd)"
+CHALLENGE=${CHALLENGE:-test-tutorial-framework}
+BASEIMAGE_NAME="${BASEIMAGE_NAME:-eu.gcr.io/avatao-challengestore/tutorial-framework}"
+BASEIMAGE_REPO="${BASEIMAGE_REPO:-baseimage-tutorial-framework}"
+FRONTEND_REPO="${FRONTEND_REPO:-frontend-tutorial-framework}"
+
+LOGFILE=/tmp/bootstrap_tfw.log
+REMOTEBASE="git@github.com:avatao-content"
+
+run() {
+    trap 'exit 1' INT
+    trap handle_exit EXIT
+    : > "${LOGFILE}"
+
+    check_dependencies
+    clone_required_repos_ask_ssh_or_https
+    local tag
+    tag="${BASEIMAGE_ONLY:-$(remotebase="${REMOTEBASE}" baseimage_latest_upstream_tag)}"
+    tag=${tag} verify_baseimage_tag
+    tag=${tag} build_baseimage
+
+    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
+        tag=${tag} pin_baseimage
+        install_frontend_deps
+        if [ "${TFWDEV:-0}" == "0" ]; then
+            cleanup_repos
+            merge_repos
+        fi
+    else
+        delete_repos
+    fi
+
+    echo 
+    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
+        echo "You can build & start TFW by executing the command: ${CHALLENGE}/hack/tfw.sh start"
+    else
+        echo "Baseimage version ${BASEIMAGE_ONLY} built successfully!"
+    fi
+}
+
+handle_exit() {
+    if [[ $? -ne 0 ]]; then
+        delete_repos
+        showlog
+    fi
+    cleanlog
+}
+
+logged() { "$@" >> "${LOGFILE}" 2>&1; }
+showlog() { echo && echo "Error! Showing logs:" && cat "${LOGFILE}"; }
+cleanlog() { rm "${LOGFILE}"; }
+delete_repos() { cd "${HERE}" && rm -rf "${BASEIMAGE_REPO}" "${FRONTEND_REPO}" "${CHALLENGE}"; }
+
+check_dependencies() {
+    local dependencies=("git" "docker" "yarn" "ng")
+    local missing="0"
+    for dep in ${dependencies[@]}; do
+        if ! type "${dep}" > /dev/null 2>&1; then
+            logged echo "Dependency '${dep}' not found!"
+            missing="1"
+        fi
+    done
+    if [ "${missing}" == "1" ]; then
+        logged echo "Please install the missing packages and retry!"
+        exit 1
+    fi
+
+    if [ "${TFWDEV:-0}" == "0" ]; then
+        if ! docker info > /dev/null 2>&1; then
+            logged echo "The Docker daemon appears to be stopped. Please start it and try again!"
+            exit 1
+        fi
+    fi
+}
+
+clone_required_repos_ask_ssh_or_https() {
+    if [[ -z "${HTTPS_REMOTES:-}" ]]; then
+        read -p "Repos are pulled over SSH by default. Should I use HTTPS instead? [y/N]" -r -t 5 || :
+        echo
+        if [[ ${REPLY} =~ ^(y|Y|yes|Yes|YES)$ ]]; then
+            HTTPS_REMOTES=1 clone_required_repos
+        else
+            HTTPS_REMOTES=0 clone_required_repos
+        fi
+    else
+        clone_required_repos
+    fi
+}
+
+clone_required_repos() {
+    [[ "${HTTPS_REMOTES:-0}" == "1" ]] && REMOTEBASE="https://github.com/avatao-content"
+
+    echo -n "Cloning TFW repositories... "
+    echo -n "baseimage... " && logged git clone ${REMOTEBASE}/${BASEIMAGE_REPO}.git
+    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
+        echo -n "frontend... " && logged git clone ${REMOTEBASE}/${FRONTEND_REPO}.git
+        echo -n "test... " && logged git clone ${REMOTEBASE}/${CHALLENGE}.git
+    fi
+    echo "Done!"
+}
+
+baseimage_latest_upstream_tag() {
+    echo -n "$(git ls-remote --tags ${remotebase}/${BASEIMAGE_REPO}.git |
+               cut -f2                                                  |
+               grep -oP '(?<=refs/tags/)\w+-\d{8}$'                     |
+               sort -t '-' -k2                                          |
+               tail -n 1)"
+}
+
+verify_baseimage_tag() {
+    pushd "${BASEIMAGE_REPO}"
+    local statuscode
+    if ! git rev-parse --quiet  \
+                       --verify \
+                       "refs/tags/${tag}" &> /dev/null; then
+        logged echo "${tag} is not a valid tag!"
+        exit 1
+    fi
+    popd
+}
+
+pin_baseimage() {
+    echo -n "Pinning TFW baseimage version... "
+    echo -n "which is ${tag}... "
+    sed -i "1 s/.*/&:${tag}/" "${CHALLENGE}/solvable/Dockerfile"
+    echo "Done!"
+}
+
+build_baseimage() {
+    echo -n "Building baseimage at ${tag}... "
+    pushd "${BASEIMAGE_REPO}"
+    logged git checkout "${tag}"
+    spinned logged docker build -t "${BASEIMAGE_NAME}:${tag}" .
+    popd
+    echo "Done!"
+}
+
+install_frontend_deps() {
+    echo -n "Installing frontend dependencies... "
+    pushd "${FRONTEND_REPO}"
+    spinned logged yarn install
+    popd
+    echo "Done!"
+}
+
+cleanup_repos() {
+    rm -rf "${BASEIMAGE_REPO}"
+    rm -rf "${CHALLENGE}/.git"
+    rm -rf "${FRONTEND_REPO}/.git"
+}
+
+merge_repos() {
+    echo -n "Merging repositories... "
+    NESTED_FRONTEND="${CHALLENGE}/solvable/frontend"
+    rm -rf "${NESTED_FRONTEND}"
+    mv "${FRONTEND_REPO}" "${NESTED_FRONTEND}"
+    echo "Done!"
+}
+
+spinned() {
+    "$@" &
+    pid=$!
+    spin=("-" "\\" "|" "/")
+
+    echo -n "${spin[0]}"
+    while kill -0 $pid &> /dev/null; do
+        for i in "${spin[@]}"; do
+            echo -ne "\b$i"
+            sleep 0.1
+        done
+    done
+    echo -ne "\b"
+    wait $pid
+}
+
+pushd() {
+    command pushd "$@" > /dev/null
+}
+
+popd() {
+    command popd "$@" > /dev/null
+}
+
+run
diff --git a/hack/bootstrap_tfw_dev.sh b/hack/bootstrap_tfw_dev.sh
deleted file mode 100755
index 826820c..0000000
--- a/hack/bootstrap_tfw_dev.sh
+++ /dev/null
@@ -1,193 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-set -o pipefail
-set -o errtrace
-shopt -s expand_aliases
-[ "$(uname)" == "Darwin" ] && alias sed="gsed" || :
-
-pushd() { command pushd "$@" > /dev/null; }
-popd() { command popd "$@" > /dev/null; }
-
-TFWDEV="${TFWDEV:-0}"
-HTTPS_REMOTES="${HTTPS_REMOTES:-}"
-
-TFW_POSTFIX=tutorial-framework
-BASEDIR="$(pwd)"
-BASEIMAGE=baseimage-${TFW_POSTFIX}
-TEST=test-${TFW_POSTFIX}
-FRONTEND=frontend-${TFW_POSTFIX}
-BASEIMAGE_NAME="${BASEIMAGE_NAME:-eu.gcr.io/avatao-challengestore/tutorial-framework}"
-
-LOGFILE=/tmp/bootstrap_tfw.log
-
-remotebase="git@github.com:"
-
-run()
-{
-    trap 'exit 1' INT
-    trap handle_exit EXIT
-    : > $LOGFILE
-
-    check_dependencies
-    clone_required_repos_ask_ssh_or_https
-    TAG="${BASEIMAGE_ONLY:-$(fetch_latest_tag)}"
-    TAG=$TAG build_baseimage
-
-    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
-        TAG=$TAG pin_baseimage
-        install_frontend_deps
-        if [ "$TFWDEV" == "0" ]; then
-            cleanup_repos
-            merge_repos
-        fi
-    else
-        delete_repos
-    fi
-
-    echo 
-    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
-        echo "You can build & start TFW by executing the command: ${TEST}/hack/tfw.sh start"
-    else
-        echo "Baseimage version ${BASEIMAGE_ONLY} built successfully!"
-    fi
-}
-
-handle_exit()
-{
-    if [[ $? -ne 0 ]]; then
-        delete_repos
-        showlog
-    fi
-    cleanlog
-}
-
-showlog() { echo && echo "Error! Showing logs:" && cat $LOGFILE; }
-cleanlog() { rm $LOGFILE; }
-delete_repos() { pushd "$BASEDIR" && rm -rf "$BASEIMAGE" "$FRONTEND" "$TEST" && popd; }
-
-check_dependencies()
-{
-    dependencies=("git" "docker" "yarn" "ng")
-    missing="0"
-    for dep in ${dependencies[@]}; do
-        if ! type "$dep" > /dev/null 2>&1; then
-            logged echo "Dependency '${dep}' not found!"
-            missing="1"
-        fi
-    done
-    if [ "$missing" == "1" ]; then
-        logged echo "Please install the missing packages and retry!"
-        exit 1
-    fi
-
-    if [ "$TFWDEV" == "0" ]; then
-        if ! docker info > /dev/null 2>&1; then
-            logged echo "The Docker daemon appears to be stopped. Please start it and try again!"
-            exit 1
-        fi
-    fi
-}
-
-clone_required_repos_ask_ssh_or_https()
-{
-    if [[ -z "$HTTPS_REMOTES" ]]; then
-        read -p "Repos are pulled over SSH by default. Should I use HTTPS instead? [y/N]" -r -t 5 || :
-        echo
-        if [[ $REPLY =~ ^(y|Y|yes|Yes|YES)$ ]]; then
-            HTTPS_REMOTES=1 clone_required_repos
-        else
-            HTTPS_REMOTES=0 clone_required_repos
-        fi
-    else
-        clone_required_repos
-    fi
-}
-
-clone_required_repos()
-{
-    [[ "$HTTPS_REMOTES" == "1" ]] && remotebase="https://github.com/"
-
-    echo -n "Cloning TFW repositories... "
-    echo -n "baseimage... " && logged git clone ${remotebase}avatao-content/${BASEIMAGE}.git
-    if [ -z "${BASEIMAGE_ONLY:-}" ]; then
-        echo -n "frontend... " && logged git clone ${remotebase}avatao-content/${FRONTEND}.git
-        echo -n "test... " && logged git clone ${remotebase}avatao-content/${TEST}.git
-    fi
-    echo "Done!"
-}
-
-install_frontend_deps()
-{
-    echo -n "Installing frontend dependencies... "
-    pushd "$FRONTEND"
-    spinned logged yarn install
-    popd
-    echo "Done!"
-}
-
-fetch_latest_tag()
-{
-    echo -n "$(git ls-remote --tags ${remotebase}avatao-content/${BASEIMAGE}.git   |
-               cut -f2                                                             |
-               grep -oP '(?<=refs/tags/)\w+-\d{8}$'                                |
-               sort -t '-' -k2                                                     |
-               tail -n 1)"
-}
-
-pin_baseimage()
-{
-    echo -n "Pinning TFW baseimage version... "
-    echo -n "which is ${TAG}... "
-    sed -i "1 s/.*/&:${TAG}/" "${TEST}/solvable/Dockerfile"
-    echo "Done!"
-}
-
-build_baseimage()
-{
-    echo -n "Building baseimage at ${TAG}... "
-    pushd "$BASEIMAGE"
-    logged git checkout "$TAG"
-    spinned logged docker build -t "${BASEIMAGE_NAME}:${TAG}" .
-    popd
-    echo "Done!"
-}
-
-cleanup_repos()
-{
-    rm -rf "${BASEIMAGE}"
-    rm -rf "${TEST}/.git"
-    rm -rf "${FRONTEND}/.git"
-}
-
-merge_repos()
-{
-    echo -n "Merging repositories... "
-    NESTED_FRONTEND="${TEST}/solvable/frontend"
-    rm -rf $NESTED_FRONTEND
-    mv "$FRONTEND" "$NESTED_FRONTEND"
-    echo "Done!"
-}
-
-logged()
-{
-    "$@" >> $LOGFILE 2>&1
-}
-
-spinned()
-{
-    "$@" &
-    pid=$!
-    spin=("-" "\\" "|" "/")
-
-    echo -n "${spin[0]}"
-    while kill -0 $pid &> /dev/null; do
-        for i in "${spin[@]}"; do
-            echo -ne "\b$i"
-            sleep 0.1
-        done
-    done
-    echo -ne "\b"
-    wait $pid
-}
-
-run
diff --git a/hack/libhack/baseimage.sh b/hack/libhack/baseimage.sh
new file mode 100644
index 0000000..22e2e79
--- /dev/null
+++ b/hack/libhack/baseimage.sh
@@ -0,0 +1,119 @@
+# Requires context:
+#     - BASEIMAGE_PATH: absolute path of baseimage repo
+#     - BASEIMAGE_REPO: basename of baseimage repo
+
+BASEIMAGE_NAME="${BASEIMAGE_NAME:-eu.gcr.io/avatao-challengestore/tutorial-framework}"
+
+libhack_dir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+source "${libhack_dir}/common.sh"
+
+
+baseimage::build_as_latest() {
+    pushd "${BASEIMAGE_PATH}"
+    baseimage::build
+    baseimage::tag_as_latest
+    popd
+}
+
+baseimage::build() {
+    pushd "${BASEIMAGE_PATH}"
+    docker build -t "${BASEIMAGE_NAME}:$(releasename)" \
+                 .
+    popd
+}
+
+baseimage::build_if_exists() {
+    if [[ -d "$BASEIMAGE_PATH" ]]; then
+        baseimage::build_as_latest
+    fi
+}
+
+baseimage::tag_as_latest() {
+    docker tag "${BASEIMAGE_NAME}:$(releasename)" "${BASEIMAGE_NAME}:latest"
+}
+
+baseimage::release() {
+    pushd "${BASEIMAGE_PATH}"
+    check_drone_releasename
+
+    local tag
+    tag="$(releasename)"
+    read -p "Tag and push new TFW version \"${tag}\"? [y/N]" -r && echo
+    if [[ $REPLY =~ ^(y|Y|yes|Yes|YES)$ ]]; then
+        prompt_for_tag_description # This command sets $description
+        tag="${tag}" description="${description}" force_push_tag
+    fi
+    popd
+}
+
+baseimage::builddocs() {
+    mount_point="/mnt/docs"
+
+    docker run --rm                                         \
+               -ti                                          \
+               -v "${BASEIMAGE_PATH}"/docs:"${mount_point}" \
+               "${BASEIMAGE_NAME}"                          \
+               /bin/bash -c                                 \
+                    "cd ${mount_point}
+                    pip3 install sphinx
+                    make html
+                    exit"                                   \
+               &> /dev/null
+
+    if [ "$?" == "0" ]; then
+        echo "Built baseimage docs at ${BASEIMAGE_PATH}/docs/build/html!"
+    else
+        echo "Building baseimage docs failed!"
+    fi
+}
+
+releasename() {
+    local version
+    local date
+    version="$(cat VERSION | head -n 1)"
+    date="$(date +%Y%m%d)"
+    printf "${version}-${date}"
+}
+
+check_drone_releasename() {
+    local drone_releasename
+    local actual_releasename
+    drone_releasename="$(grep -oP '(?<=branch:\srefs/tags/).+(?=-.+)' .drone.yml)"
+    actual_releasename="$(releasename | grep -oP ".+(?=-\d{8})")"
+    if [ "${drone_releasename}" != "${actual_releasename}" ]; then
+        echo "Release name '${drone_releasename}' in .drone.yml does not match \
+              actual release name '${actual_releasename}' in VERSION."
+        echo "Please make them match before releasing!"
+        exit 1
+    fi
+}
+
+prompt_for_tag_description() {
+    local editor
+    local tempfile
+    editor="$(git config --global core.editor)"
+    tempfile="$(mktemp)"
+
+    printf "\n\n" >> "${tempfile}"
+    echo "# Please enter the description for this release." >> "${tempfile}"
+    echo "# Lines starting with '#' will be ignored." >> "${tempfile}"
+    echo "# An empty description aborts the release." >> "${tempfile}"
+
+    ${editor} "${tempfile}"
+    sed -i -e 's/#.*$//' -e '/^$/d' "${tempfile}"
+    sed -i 's/\n/ /g' "${tempfile}"
+    if [[ ! -s "${tempfile}" ]]; then
+        echo "Aborting release due to empty description."
+        exit 1
+    fi
+
+    description="$(tr '\n' ' ' < "${tempfile}")"
+    rm "${tempfile}"
+}
+
+force_push_tag() {
+    git tag -d "${tag}" > /dev/null 2>&1 || :
+    git push --delete origin "${tag}" > /dev/null 2>&1 || :
+    git tag -s -m "${description}" "${tag}"
+    git push origin "${tag}"
+}
diff --git a/hack/libhack/challenge.sh b/hack/libhack/challenge.sh
new file mode 100644
index 0000000..d756e3c
--- /dev/null
+++ b/hack/libhack/challenge.sh
@@ -0,0 +1,52 @@
+# Requires context:
+#     - TFW_PATH: absolute path of the parent directory of TFW repos
+#     - BASEIMAGE_PATH: absolute path of baseimage repo
+#     - CHALLENGE_PATH: absolute path of challenge repo
+
+IMAGE_NAME="${IMAGE_NAME:-"$(basename "${CHALLENGE_PATH}")"}"
+BUILD_CONTEXT="${BUILD_CONTEXT:-solvable}"
+CHALLENGE_PORT="${CHALLENGE_PORT:-8888}"
+AVATAO_SECRET="${AVATAO_SECRET:-secret}"
+
+libhack_dir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+source "${libhack_dir}/common.sh"
+
+
+challenge::build() {
+    pushd "${CHALLENGE_PATH}"
+    args="--build-arg NOFRONTEND=1" build_challenge_internal
+    popd
+}
+
+challenge::build_with_frontend() {
+    pushd "${CHALLENGE_PATH}"
+    args="--no-cache" build_challenge_internal
+    popd
+}
+
+build_challenge_internal() {
+    docker build -t "${IMAGE_NAME}"                           \
+                 -f "${BUILD_CONTEXT}/Dockerfile"             \
+                 --build-arg BUILD_CONTEXT="${BUILD_CONTEXT}" \
+                 ${args} .
+}
+
+challenge::run() {
+    pushd "${TFW_PATH}"
+    local mount_baseimage
+    local mount_challenge
+    local mount_volumes
+    if [[ "${HOTRELOAD:-0}" == "1" ]]; then
+        if [[ -d "${BASEIMAGE_PATH}" ]]; then
+            mount_baseimage="-v ${BASEIMAGE_PATH}/lib/tfw:/usr/local/lib/tfw"
+        fi
+        mount_challenge="-v ${CHALLENGE_PATH}/solvable/src:/srv/.tfw"
+        mount_volumes="${mount_baseimage:-} ${mount_challenge}"
+    fi
+    popd
+    docker run --rm                                          \
+               -p ${CHALLENGE_PORT}:${CHALLENGE_PORT}        \
+               ${mount_volumes:-}                            \
+               ${@:-}                                        \
+               -e AVATAO_SECRET="${AVATAO_SECRET}" ${IMAGE_NAME}
+}
diff --git a/hack/libhack/common.sh b/hack/libhack/common.sh
new file mode 100644
index 0000000..95a908b
--- /dev/null
+++ b/hack/libhack/common.sh
@@ -0,0 +1,7 @@
+pushd() {
+    command pushd "$@" > /dev/null
+}
+
+popd() {
+    command popd "$@" > /dev/null
+}
diff --git a/hack/libhack/frontend.sh b/hack/libhack/frontend.sh
new file mode 100644
index 0000000..64bfee5
--- /dev/null
+++ b/hack/libhack/frontend.sh
@@ -0,0 +1,14 @@
+# Requires context:
+#     - FRONTEND_PATH: absolute path of frontend repo
+#     - CHALLENGE_PATH: absolute path of challenge repo
+
+
+frontend::run() {
+    local frontend_in_challenge="${CHALLENGE_PATH}/solvable/frontend"
+    if [[ "$(find "${frontend_in_challenge}" | wc -l)" -gt 2 ]];then
+        cd "${frontend_in_challenge}"
+    else
+        cd "${FRONTEND_PATH}"
+    fi
+    yarn start
+}
diff --git a/hack/oneline_install.sh b/hack/oneline_install.sh
deleted file mode 100644
index dc1b5e3..0000000
--- a/hack/oneline_install.sh
+++ /dev/null
@@ -1 +0,0 @@
-URL=https://git.io/vxBfj SHA=d81057610588e16666251a4167f05841fc8b66ccd6988490c1a2d2deb6de8ffa bash -c 'cmd="$(curl -fsSL $URL)" && [ $(echo "$cmd" | sha256sum | cut -d " " -f1) == $SHA ] && echo "$cmd" | bash || echo Checksum mismatch!'
diff --git a/hack/tfw.sh b/hack/tfw.sh
index dad09a4..46a843b 100755
--- a/hack/tfw.sh
+++ b/hack/tfw.sh
@@ -5,211 +5,79 @@ set -o errtrace
 shopt -s expand_aliases
 [ "$(uname)" == "Darwin" ] && alias readlink="greadlink" || :
 
-here="$(pwd)"
-SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
-TAO_PATH="${TAO_PATH:-$SCRIPT_DIR/../..}"
+SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+TFW_PATH="${TFW_PATH:-$SCRIPT_DIR/../..}"
+
 BASEIMAGE_REPO="${BASEIMAGE_REPO:-baseimage-tutorial-framework}"
-TEST_REPO="${TEST_REPO:-"$(basename "$(realpath "${SCRIPT_DIR}/..")")"}"
+CHALLENGE_REPO="${CHALLENGE_REPO:-"$(basename "$(realpath "${SCRIPT_DIR}/..")")"}"
 FRONTEND_REPO="${FRONTEND_REPO:-frontend-tutorial-framework}"
-BASEIMAGE_PATH="${TAO_PATH}/${BASEIMAGE_REPO}"
-TEST_PATH="${TAO_PATH}/${TEST_REPO}"
-FRONTEND_PATH="${TAO_PATH}/${FRONTEND_REPO}"
 
-BASEIMAGE_NAME="${BASEIMAGE_NAME:-eu.gcr.io/avatao-challengestore/tutorial-framework}"
-IMAGE_NAME="${IMAGE_NAME:-test-tutorial-framework}"
-TEST_PORT="${TEST_PORT:-8888}"
-AVATAO_SECRET="${AVATAO_SECRET:-secret}"
-BUILD_CONTEXT="${BUILD_CONTEXT:-solvable}"
+BASEIMAGE_PATH="${TFW_PATH}/${BASEIMAGE_REPO}"
+CHALLENGE_PATH="${TFW_PATH}/${CHALLENGE_REPO}"
+FRONTEND_PATH="${TFW_PATH}/${FRONTEND_REPO}"
 
-build_baseimage()
-{
-    [ ! -d "$BASEIMAGE_PATH" ] && return || :
-    cd $BASEIMAGE_PATH
-    docker build -t "${BASEIMAGE_NAME}:${TFWTAG:-$(baseimage_releasename)}" \
-                 -t "${BASEIMAGE_NAME}:latest"                              \
-                 .
-}
+source "${SCRIPT_DIR}/libhack/baseimage.sh"
+source "${SCRIPT_DIR}/libhack/challenge.sh"
+source "${SCRIPT_DIR}/libhack/frontend.sh"
 
-release_baseimage()
-{
-    [ ! -d "$BASEIMAGE_PATH" ] && return || :
-    cd $BASEIMAGE_PATH
-    check_drone_releasename
 
-    TAG="$(baseimage_releasename)"
-    read -p "Tag and push new TFW version \"${TAG}\"? [y/N]" -r && echo
-    if [[ $REPLY =~ ^(y|Y|yes|Yes|YES)$ ]]
-    then
-        description=""
-        prompt_for_tag_description # This command overwrites $description
-        TAG="$TAG" DESCRIPTION="$description" force_push_tag
-    fi
-}
-
-check_drone_releasename()
-{
-    DRONEYML_RELEASENAME="$(grep -oP '(?<=branch:\srefs/tags/).+(?=-.+)' .drone.yml)"
-    ACTUAL_RELEASENAME="$(baseimage_releasename | grep -oP ".+(?=-\d{8})")"
-    if [ "$DRONEYML_RELEASENAME" != "$ACTUAL_RELEASENAME" ]; then
-        echo "Release name '${DRONEYML_RELEASENAME}' in .drone.yml does not match actual release name '${ACTUAL_RELEASENAME}' in VERSION."
-        echo "Please make them match before releasing!"
-        exit 1
-    fi
-}
-
-prompt_for_tag_description()
-{
-    editor="$(git config --global core.editor)"
-    tempfile="$(mktemp)"
-
-    printf "\n\n" >> "$tempfile"
-    echo "# Please enter the description for this release." >> "$tempfile"
-    echo "# Lines starting with '#' will be ignored." >> "$tempfile"
-    echo "# An empty description aborts the release." >> "$tempfile"
-
-    $editor "$tempfile"
-    sed -i -e 's/#.*$//' -e '/^$/d' "$tempfile"
-    sed -i 's/\n/ /g' "$tempfile"
-    if [[ ! -s "$tempfile" ]]; then
-        echo "Aborting release due to empty description."
-        exit 1
-    fi
-
-    description="$(tr '\n' ' ' < "$tempfile")"
-    rm "$tempfile"
-}
-
-force_push_tag()
-{
-    git tag -d "$TAG" > /dev/null 2>&1 || :
-    git push --delete origin "$TAG" > /dev/null 2>&1 || :
-    git tag -s -m "$DESCRIPTION" "$TAG"
-    git push origin "$TAG"
-}
-
-baseimage_releasename()
-{
-    VERSION="$(cat VERSION | head -n 1)"
-    DATE="$(date +%Y%m%d)"
-    printf "${VERSION}-${DATE}"
-}
-
-build_test_internal()
-{
-    build_baseimage
-    cd $TEST_PATH
-    docker build -t $IMAGE_NAME                           \
-                 -f ${BUILD_CONTEXT}/Dockerfile           \
-                 --build-arg BUILD_CONTEXT=$BUILD_CONTEXT \
-                 ${ARGS} .
-}
-
-build_test()
-{
-    ARGS="--build-arg NOFRONTEND=1" build_test_internal
-}
-
-build_test_withfrontend()
-{
-    ARGS="--no-cache" build_test_internal
-}
-
-run_test()
-{
-    cd "$TAO_PATH"
-    if [ "${HOTRELOAD:-0}" == "1" ]; then
-        [ -d "$BASEIMAGE_PATH" ] && mount_baseimage="-v ${BASEIMAGE_PATH}/lib/tfw:/usr/local/lib/tfw"
-        mount_test="-v ${TEST_PATH}/solvable/src:/srv/.tfw"
-        mount_volumes="${mount_baseimage:-} ${mount_test}"
-    fi
-    docker run --rm                                          \
-               -p $TEST_PORT:$TEST_PORT                      \
-               ${mount_volumes:-}                            \
-               ${@:-}                                        \
-               -e AVATAO_SECRET=$AVATAO_SECRET $IMAGE_NAME
-}
-
-run_frontend()
-{
-    FRONTEND_IN_TEST="${TEST_PATH}/solvable/frontend"
-    if [ "$(find "$FRONTEND_IN_TEST" | wc -l)" -gt 2 ]
-    then
-        cd $FRONTEND_IN_TEST
-    else
-        cd $FRONTEND_PATH
-    fi
-    yarn start
-}
-
-start_test()
-{
+start_challenge_and_frontend() {
     trap 'exit' INT TERM
     trap 'kill 0' EXIT
-    [[ "${RUN_FRONTEND:-1}" == "1" ]] && run_frontend &
-    [[ "${BUILD:-1}" == "1" ]] && build_test
-    run_test $@
+    [[ "${RUN_FRONTEND:-1}" == "1" ]] && frontend::run &
+    [[ "${BUILD:-1}" == "1" ]] && challenge::build
+    challenge::run $@
     wait
 }
 
-build_docs()
-{
-    mount_point="/mnt/docs"
-
-    docker run --rm                                     \
-               -ti                                      \
-               -v "$BASEIMAGE_PATH"/docs:"$mount_point" \
-               "$BASEIMAGE_NAME"                        \
-               /bin/bash -c                             \
-                    "cd $mount_point
-                    pip3 install sphinx
-                    make html
-                    exit"                               \
-               &> /dev/null
-
-    if [ "$?" == "0" ]; then
-        echo "Built baseimage docs at ${BASEIMAGE_PATH}/docs/build/html!"
-    else
-        echo "Building baseimage docs failed!"
-    fi
-}
-
 case ${1:-} in
     start)
-        RUN_FRONTEND=1 start_test ${@:2}
+        baseimage::build_if_exists
+        BUILD=1 RUN_FRONTEND=1 start_challenge_and_frontend ${@:2}
     ;;
     run)
-        BUILD=0 RUN_FRONTEND=1 start_test ${@:2}
+        BUILD=0 RUN_FRONTEND=1 start_challenge_and_frontend ${@:2}
     ;;
     startcontainer)
-        RUN_FRONTEND=0 start_test ${@:2}
+        baseimage::build_if_exists
+        BUILD=1 RUN_FRONTEND=0 start_challenge_and_frontend ${@:2}
     ;;
     runcontainer)
-        BUILD=0 RUN_FRONTEND=0 start_test ${@:2}
+        BUILD=0 RUN_FRONTEND=0 start_challenge_and_frontend ${@:2}
+    ;;
+    runfrontend)
+        frontend::run
     ;;
     buildtfw)
-        build_baseimage
+        baseimage::build_if_exists
     ;;
     build)
-        build_test
+        baseimage::build_if_exists
+        challenge::build
     ;;
     buildwithfrontend)
-        build_test_withfrontend
+        baseimage::build_if_exists
+        challenge::build_with_frontend
     ;;
     releasetfw)
-        release_baseimage
+        if [[ -d "$BASEIMAGE_PATH" ]]; then
+            baseimage::release
+        fi
     ;;
     builddocs)
-        build_docs
+        if [[ -d "$BASEIMAGE_PATH" ]]; then
+            baseimage::builddocs
+        fi
     ;;
     *)
-        echo "Usage: tfw.sh [start|buildtfw|build|buildwithfrontend|releasetfw]"
-        echo "          |--- start:             build & run TFW test and Angular frontend"
-        echo "          |--- run:               run TFW test and Angular frontend"
-        echo "          |--- startcontainer:    build & run TFW test, container only"
-        echo "          |--- runcontainer:      run TFW test, container only"
+        echo "Usage: tfw.sh [COMMAND]"
+        echo "          |--- start:             build & run TFW challenge and Angular frontend"
+        echo "          |--- run:               run TFW challenge and Angular frontend"
+        echo "          |--- startcontainer:    build & run TFW challenge, container only"
+        echo "          |--- runcontainer:      run TFW challenge, container only"
         echo "          |--- buildtfw:          build TFW baseimage"
-        echo "          |--- build:             build TFW baseimage and test"
-        echo "          |--- buildwithfrontend: build TFW baseimage and test, include frontend in image"
+        echo "          |--- build:             build TFW baseimage and challenge"
+        echo "          |--- buildwithfrontend: build TFW baseimage and challenge, include frontend in image"
         echo "          |--- releasetfw:        tag TFW baseimage and push to upstream"
         echo "          |--- builddocs:         build baseimage documentation (in docs/build/html)"
     ;;
diff --git a/hack/update_oneline_install.sh b/hack/update_oneline_install.sh
deleted file mode 100755
index f7c3be0..0000000
--- a/hack/update_oneline_install.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-set -o pipefail
-set -o errtrace
-shopt -s expand_aliases
-
-if [ "$(uname)" == "Darwin" ]; then
-    alias readlink="greadlink" 
-    alias sed="gsed"
-fi
-SCRIPT_DIR="$(dirname $(readlink -f $0))"
-
-sed -i "s/SHA=\w\+/SHA=$(sha256sum hack/bootstrap_tfw_dev.sh | cut -d ' ' -f1)/g" "${SCRIPT_DIR}/oneline_install.sh"