diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..36d2969
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+target/
+.git/
+*.db
+*.db-*
+token.key
diff --git a/DockerFile b/DockerFile
deleted file mode 100644
index 50a6903..0000000
--- a/DockerFile
+++ /dev/null
@@ -1,57 +0,0 @@
-# -------------------------
-# 1️⃣ Build Stage
-# -------------------------
-FROM rust:1.76 as builder
-
-WORKDIR /app
-
-# Install dependencies required for sqlx + native-tls
-RUN apt-get update && apt-get install -y \
-    pkg-config \
-    libssl-dev \
-    ca-certificates \
-    sqlite3 \
-    libsqlite3-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Cache dependencies
-COPY Cargo.toml Cargo.lock ./
-RUN mkdir src && echo "fn main() {}" > src/main.rs
-RUN cargo build --release
-RUN rm -rf src
-
-# Copy real source
-COPY . .
-
-# Build release binary
-RUN cargo build --release
-
-# -------------------------
-# 2️⃣ Runtime Stage
-# -------------------------
-FROM debian:bookworm-slim
-
-WORKDIR /app
-
-# Install runtime deps only
-RUN apt-get update && apt-get install -y \
-    ca-certificates \
-    libssl3 \
-    sqlite3 \
-    libsqlite3-0 \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy compiled binary
-COPY --from=builder /app/target/release/server /app/server
-
-# Create data directory
-RUN mkdir -p /data
-
-# Expose port (change if needed)
-EXPOSE 8080
-
-# Declare volume for SQLite database
-VOLUME ["/data"]
-
-# Run the server
-CMD ["./server"]
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..342a9c0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,42 @@
+# syntax=docker/dockerfile:1
+
+FROM rust:1-slim-bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY . .
+
+# Cache mounts keep the registry and target dir between builds, so only
+# changed crates recompile.
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --locked \
+    && cp target/release/server /usr/local/bin/server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd --system --uid 10001 saturn \
+    && mkdir /data \
+    && chown saturn /data
+
+COPY --from=builder /usr/local/bin/server /usr/local/bin/server
+
+USER saturn
+WORKDIR /data
+
+ENV BIND_ADDR=0.0.0.0:8080 \
+    DATABASE_URL=sqlite:///data/users.db?mode=rwc
+
+EXPOSE 8080
+VOLUME ["/data"]
+
+CMD ["server"]
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..6ec591f
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,13 @@
+services:
+  server:
+    build: .
+    restart: unless-stopped
+    # Published on the host (HOST_PORT, default 8080) and still reachable by
+    # Coolify's proxy; set the domain in Coolify as https://<domain>:8080.
+    ports:
+      - "${HOST_PORT:-8080}:8080"
+    volumes:
+      - server-data:/data
+
+volumes:
+  server-data:
diff --git a/src/main.rs b/src/main.rs
index 1c9ca72..ac49a31 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -13,7 +13,9 @@ use crate::types::SessionMap;
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> session_rs::Result<()> {
     let pool = Arc::new(user::init_db().await);
-    let server = SessionServer::bind("127.0.0.1:8080").await?;
+    let bind_addr = std::env::var("BIND_ADDR").unwrap_or_else(|_| "127.0.0.1:8080".into());
+    let server = SessionServer::bind(&bind_addr).await?;
+    println!("Listening on {bind_addr}");
 
     let sessions: SessionMap = Arc::new(Mutex::new(HashMap::new()));
 
diff --git a/src/user.rs b/src/user.rs
index ecc1bb3..5115c1b 100644
--- a/src/user.rs
+++ b/src/user.rs
@@ -11,7 +11,9 @@ pub struct User {
 
 // Initialize SQLite connection pool
 pub async fn init_db() -> SqlitePool {
-    let pool = SqlitePool::connect("sqlite://users.db?mode=rwc")
+    let database_url =
+        std::env::var("DATABASE_URL").unwrap_or_else(|_| "sqlite://users.db?mode=rwc".into());
+    let pool = SqlitePool::connect(&database_url)
         .await
         .expect("Failed to open database");