diff --git a/.env.pg b/.env.pg
index 488ca00..00c29c9 100644
--- a/.env.pg
+++ b/.env.pg
@@ -1,7 +1,6 @@
 #!/bin/bash
 # this is for the backup cron job, NOT for the docker-compose.yml
 
-POSTGRES_PASSWORD=$(< $HOME/git/.pg.pw)
+POSTGRES_PASSWORD=$(</srv/forgejo/.pg.pw)
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
-
diff --git a/docker-compose.yml b/docker-compose.yml
index 238b09e..d766847 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,6 @@
-version: "2"
-
 services:
-  server:
-    image: codeberg.org/forgejo/forgejo:7.0.5-rootless
+  forgejo:
+    image: codeberg.org/forgejo/forgejo:7.0.15-rootless
     restart: always
     volumes:
       - ./data:/var/lib/gitea
@@ -15,13 +13,13 @@ services:
       - "2222:2222"
     labels:
       traefik.enable: true
-      traefik.http.routers.gitea.rule: Host(`git.tams.tech`, `git.techwork.zone`)
+      traefik.http.routers.gitea.rule: Host(`git.tams.tech`) || Host(`git.techwork.zone`)
       traefik.http.routers.gitea.tls: true
-      traefik.http.routers.gitea.tls.certresolver: letsencrypt
+      traefik.http.routers.gitea.tls.certresolver: letsencrypt_standalone
       traefik.http.services.gitea-service.loadbalancer.server.port: 3000
     networks:
+      - public
       - gitea
-      - web
     environment: {}
       # GITEA__database__DB_TYPE: postgres
       # GITEA__database__HOST: database:5432
@@ -35,14 +33,14 @@ services:
       # GITEA__mailer__USER__FILE: /run/secrets/mail_api_key
       # GITEA__mailer__PASSWD__FILE: /run/secrets/mail_secret
     depends_on:
-      - database
+      - forgejo-database
     secrets:
       - mail_api_key
       - mail_secret
       - pg_password
 
-  database:
-    image: postgres:14
+  forgejo-database:
+    image: postgres:17
     restart: always
     environment:
       POSTGRES_USER: gitea
@@ -52,6 +50,7 @@ services:
       - ./db:/var/lib/postgresql/data
     networks: [ gitea ]
     secrets: [ pg_password ]
+    labels:
 
 secrets:
   pg_password:
@@ -64,5 +63,3 @@ secrets:
 networks:
   gitea:
     internal: true
-  web:
-    external: true