diff --git a/.gitignore b/.gitignore
index 42c20e8..a8421ae 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
-.env
+*/.env
 
-data/*
-
-!data/glance/
+**/data/*
+!glance/data/glance/
diff --git a/3x-ui/docker-compose.yaml b/3x-ui/docker-compose.yaml
new file mode 100644
index 0000000..9e0381f
--- /dev/null
+++ b/3x-ui/docker-compose.yaml
@@ -0,0 +1,25 @@
+services:
+  3x-ui:
+    image: ghcr.io/mhsanaei/3x-ui:3.4.2
+    container_name: 3x-ui
+    restart: unless-stopped
+    networks:
+      - proxy
+    volumes:
+      - ./data/3x-ui/db/:/etc/x-ui/
+      - ./data/3x-ui/cert/:/root/cert/
+    tty: true
+    ports:
+      - 2053:2053
+      - 41060:41060
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.3x-ui.loadbalancer.server.port=20530"
+      - "traefik.http.routers.3x-ui.rule=Host(`{3X_UI_HOST}`)"
+      - "traefik.http.routers.3x-ui.entrypoints=websecure"
+      - "traefik.http.routers.3x-ui.tls.certresolver=le"
+
+networks:
+  proxy:
+    name: proxy
+    external: true
diff --git a/3x-ui/env.example b/3x-ui/env.example
new file mode 100644
index 0000000..47e3bb1
--- /dev/null
+++ b/3x-ui/env.example
@@ -0,0 +1,3 @@
+3X_UI_HOST=
+XRAY_VMESS_AEAD_FORCED=false
+XUI_ENABLE_FAIL2BAN=true
diff --git a/gitea/docker-compose.yaml b/gitea/docker-compose.yaml
index 3d43910..11105b9 100644
--- a/gitea/docker-compose.yaml
+++ b/gitea/docker-compose.yaml
@@ -6,7 +6,7 @@ services:
     networks:
       - proxy
     ports:
-      - "22:22"
+      - "22:22"  # switch server ssh to another port beforehand
     volumes:
       - ./data/gitea:/data
       - /etc/timezone:/etc/timezone:ro
diff --git a/memos/docker-compose.yaml b/memos/docker-compose.yaml
index 7a0e2ff..6924f79 100644
--- a/memos/docker-compose.yaml
+++ b/memos/docker-compose.yaml
@@ -7,10 +7,6 @@ services:
       - proxy
     volumes:
       - ./data/memos:/var/opt/memos
-    environment:
-      MEMOS_PORT: 5230
-      MEMOS_DRIVER: sqlite
-      MEMOS_INSTANCE_URL: https://${MEMOS_HOST}/
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.memos.loadbalancer.server.port=5230"
diff --git a/memos/env.example b/memos/env.example
index ec0bd44..4ebc65b 100644
--- a/memos/env.example
+++ b/memos/env.example
@@ -1 +1,4 @@
 MEMOS_HOST=
+MEMOS_PORT=5230
+MEMOS_DRIVER=sqlite
+MEMOS_INSTANCE_URL=https://${MEMOS_HOST}/
diff --git a/miniflux/docker-compose.yaml b/miniflux/docker-compose.yaml
index c6f4be4..fa91a0c 100644
--- a/miniflux/docker-compose.yaml
+++ b/miniflux/docker-compose.yaml
@@ -9,15 +9,6 @@ services:
     networks:
       - proxy
       - miniflux
-    environment:
-      - DATABASE_URL=postgres://miniflux:${MINIFLUX_POSTGRES_PASSWORD}@miniflux-db/miniflux?sslmode=disable
-      - RUN_MIGRATIONS=1
-      - OAUTH2_PROVIDER=oidc
-      - OAUTH2_CLIENT_ID=${MINIFLUX_OAUTH2_CLIENT_ID}
-      - OAUTH2_CLIENT_SECRET=${MINIFLUX_OAUTH2_CLIENT_SECRET}
-      - OAUTH2_REDIRECT_URL=https://${MINIFLUX_HOST}/oauth2/oidc/callback
-      - OAUTH2_OIDC_DISCOVERY_ENDPOINT=https://${MINIFLUX_OAUTH2_OIDC_DISCOVERY_ENDPOINT}
-      - OAUTH2_USER_CREATION=1
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.miniflux.loadbalancer.server.port=8080"
@@ -31,10 +22,6 @@ services:
     restart: unless-stopped
     networks:
       - miniflux
-    environment:
-      - POSTGRES_USER=miniflux
-      - POSTGRES_PASSWORD=${MINIFLUX_POSTGRES_PASSWORD}
-      - POSTGRES_DB=miniflux
     volumes:
       - ./data/miniflux-db:/var/lib/postgresql
     healthcheck:
@@ -48,4 +35,4 @@ networks:
     name: proxy
     external: true
   miniflux:
-    name: miniflux
\ No newline at end of file
+    name: miniflux
diff --git a/miniflux/env.example b/miniflux/env.example
index bc9f2af..d5977ee 100644
--- a/miniflux/env.example
+++ b/miniflux/env.example
@@ -1,5 +1,15 @@
 MINIFLUX_HOST=
-MINIFLUX_POSTGRES_PASSWORD=
-MINIFLUX_OAUTH2_CLIENT_ID=
-MINIFLUX_OAUTH2_CLIENT_SECRET=
-MINIFLUX_OAUTH2_OIDC_DISCOVERY_ENDPOINT=
\ No newline at end of file
+POSTGRES_PASSWORD=
+OAUTH2_CLIENT_ID=
+OAUTH2_CLIENT_SECRET=
+OAUTH2_OIDC_DISCOVERY_ENDPOINT=
+
+POSTGRES_USER=miniflux
+POSTGRES_DB=miniflux
+DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@miniflux-db/${POSTGRES_DB}?sslmode=disable
+
+RUN_MIGRATIONS=1
+
+OAUTH2_PROVIDER=oidc
+OAUTH2_REDIRECT_URL=https://${MINIFLUX_HOST}/oauth2/oidc/callback
+OAUTH2_USER_CREATION=1
diff --git a/outline/docker-compose.yaml b/outline/docker-compose.yaml
index 66952c2..6136bd7 100644
--- a/outline/docker-compose.yaml
+++ b/outline/docker-compose.yaml
@@ -6,26 +6,6 @@ services:
     networks:
       - proxy
       - outline
-    environment:
-      - NODE_ENV=production
-      - URL=https://${OUTLINE_HOST}
-      - PORT=3000
-      - FILE_STORAGE_UPLOAD_MAX_SIZE=1024000000
-      - SECRET_KEY=${OUTLINE_SECRET_KEY}
-      - UTILS_SECRET=${OUTLINE_UTILS_SECRET}
-      - POSTGRES_PASSWORD=${OUTLINE_POSTGRES_PASSWORD}
-      - DATABASE_URL=postgres://outline:${OUTLINE_POSTGRES_PASSWORD}@outline-db:5432/outline
-      - PGSSLMODE=disable
-      - REDIS_URL=redis://outline-redis:6379
-      - FILE_STORAGE=local
-      - FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
-      - OIDC_ISSUER_URL=https://${OUTLINE_OIDC_ISSUER_URL}
-      - OIDC_CLIENT_ID=${OUTLINE_OIDC_CLIENT_ID}
-      - OIDC_CLIENT_SECRET=${OUTLINE_OIDC_CLIENT_SECRET}
-      - OIDC_DISPLAY_NAME=Gitea
-      - OIDC_SCOPES=openid profile email
-      - OIDC_USERNAME_CLAIM=preferred_username
-      - OIDC_LOGOUT_URI=https://${OUTLINE_HOST}
     volumes:
       - ./data/outline:/var/lib/outline/data
     depends_on:
@@ -46,10 +26,6 @@ services:
     restart: unless-stopped
     networks:
       - outline
-    environment:
-      POSTGRES_USER: outline
-      POSTGRES_PASSWORD: ${OUTLINE_POSTGRES_PASSWORD}
-      POSTGRES_DB: outline
     volumes:
       - ./data/outline-db:/var/lib/postgresql
     healthcheck:
diff --git a/outline/env.example b/outline/env.example
index 6116cf3..03cb0ec 100644
--- a/outline/env.example
+++ b/outline/env.example
@@ -1,7 +1,30 @@
 OUTLINE_HOST=
-OUTLINE_SECRET_KEY=  # openssl rand -hex 32
-OUTLINE_UTILS_SECRET=
-OUTLINE_POSTGRES_PASSWORD=
-OUTLINE_OIDC_CLIENT_ID=
-OUTLINE_OIDC_CLIENT_SECRET=
-OUTLINE_OIDC_ISSUER_URL=
+
+# openssl rand -hex 32
+SECRET_KEY=
+
+# openssl rand -hex 32
+UTILS_SECRET=
+
+POSTGRES_PASSWORD=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_ISSUER_URL=
+
+POSTGRES_USER=outline
+POSTGRES_DB=outline
+
+NODE_ENV=production
+URL=https://${OUTLINE_HOST}
+PORT=3000
+FILE_STORAGE_UPLOAD_MAX_SIZE=1024000000
+
+DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@outline-db:5432/${POSTGRES_DB}
+PGSSLMODE=disable
+REDIS_URL=redis://outline-redis:6379
+FILE_STORAGE=local
+FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
+OIDC_DISPLAY_NAME=Gitea
+OIDC_SCOPES=openid profile email
+OIDC_USERNAME_CLAIM=preferred_username
+OIDC_LOGOUT_URI=https://${OUTLINE_HOST}
diff --git a/vaultwarden/docker-compose.yaml b/vaultwarden/docker-compose.yaml
index 596ef4f..e30d99b 100644
--- a/vaultwarden/docker-compose.yaml
+++ b/vaultwarden/docker-compose.yaml
@@ -5,15 +5,6 @@ services:
     restart: unless-stopped
     networks:
       - proxy
-    environment:
-      DOMAIN: "https://${VAULTWARDEN_HOST}"
-      SIGNUPS_ALLOWED: "false"
-      SSO_ENABLED: "true"
-      SSO_ONLY: "true"
-      SSO_SIGNUPS_MATCH_EMAIL: "true"
-      SSO_AUTHORITY: https://${VAULTWARDEN_SSO_AUTHORITY}
-      SSO_CLIENT_ID: ${VAULTWARDEN_SSO_CLIENT_ID}
-      SSO_CLIENT_SECRET: ${VAULTWARDEN_SSO_CLIENT_SECRET}
     volumes:
       - ./data/vaultwarden:/data/
     labels:
diff --git a/vaultwarden/env.example b/vaultwarden/env.example
index 55ced13..f2a89bc 100644
--- a/vaultwarden/env.example
+++ b/vaultwarden/env.example
@@ -1,4 +1,10 @@
 VAULTWARDEN_HOST=
-VAULTWARDEN_SSO_AUTHORITY=
-VAULTWARDEN_SSO_CLIENT_ID=
-VAULTWARDEN_SSO_CLIENT_SECRET=
+SSO_AUTHORITY=
+SSO_CLIENT_ID=
+SSO_CLIENT_SECRET=
+
+DOMAIN="https://${VAULTWARDEN_HOST}"
+SIGNUPS_ALLOWED="false"
+SSO_ENABLED="true"
+SSO_ONLY="true"
+SSO_SIGNUPS_MATCH_EMAIL="true"
diff --git a/wireguard/docker-compose.yaml b/wireguard/docker-compose.yaml
new file mode 100644
index 0000000..d57901a
--- /dev/null
+++ b/wireguard/docker-compose.yaml
@@ -0,0 +1,20 @@
+services:
+  wireguard:
+    image: lscr.io/linuxserver/wireguard:latest
+    container_name: wireguard
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    volumes:
+      - ./data/wireguard:/config
+    ports:
+      - 51820:51820/udp
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+
+networks:
+  proxy:
+    name: proxy
+    external: true
diff --git a/wireguard/env.example b/wireguard/env.example
new file mode 100644
index 0000000..f2e9b88
--- /dev/null
+++ b/wireguard/env.example
@@ -0,0 +1,10 @@
+WIREGUARD_HOST=
+
+PUID=1000
+PGID=1000
+TZ="Europe/Moscow"
+SERVERURL=${WIREGUARD_HOST}
+SERVERPORT=51820
+PEERS=100
+PEERDNS=77.88.8.8
+INTERNAL_SUBNET=10.100.100.0