diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1899047
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+.git
+/target
+*.db
diff --git a/Dockerfile b/Dockerfile
index e8595e3..c488a18 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,6 +5,8 @@ WORKDIR /app
 COPY . .
 
 RUN apk add musl-dev
+
+RUN rm .env # force build from prepared sqlx db info
 RUN cargo build --release
 
 
@@ -14,4 +16,6 @@ LABEL org.opencontainers.image.source https://git.idlestate.org/azdle/zero-to-ax
 
 COPY --from=builder /app/target/release/zero-to-axum /usr/local/bin/zero-to-axum
 
-CMD ["zero-to-axum"]
\ No newline at end of file
+COPY conf/ conf/
+
+CMD ["zero-to-axum"]
diff --git a/conf/default.toml b/conf/default.toml
index aa63ecf..1b6350a 100644
--- a/conf/default.toml
+++ b/conf/default.toml
@@ -1,6 +1,2 @@
-debug = true
-
+[app]
 listen = "[::]:3742"
-
-[database]
-url = "postgres://ztoa:0zpVXAVK20@localhost:5432/ztoa"
diff --git a/conf/dev.toml b/conf/dev.toml
new file mode 100644
index 0000000..13585c4
--- /dev/null
+++ b/conf/dev.toml
@@ -0,0 +1,4 @@
+debug = true
+
+[database]
+url = "postgres://ztoa:0zpVXAVK20@localhost:5432/ztoa"
diff --git a/conf/prod.toml b/conf/prod.toml
new file mode 100644
index 0000000..d9c1f25
--- /dev/null
+++ b/conf/prod.toml
@@ -0,0 +1,4 @@
+debug = false
+
+[database]
+url = "postgresql://z2a:nvasgMDYPBdfQYmo8ptCTEl576yNDBXC@db:5432/z2a?schema=public"
diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 0000000..b69ddf3
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,55 @@
+version: '3'
+
+services:
+  z2a:
+    image: zero-to-axum
+    build: .
+    depends_on:
+      - db
+    environment:
+      RUST_LOG: trace
+      # DATABASE_URL: 'postgresql://z2a:nvasgMDYPBdfQYmo8ptCTEl576yNDBXC@db:5432/z2a?schema=public'
+      DEPLOYMENT_ENVIRONMENT: prod
+    restart: unless-stopped
+    # networks:
+    #   - web
+    #   - internal
+    # labels:
+    #   - traefik.enable=true
+    #   - traefik.docker.network=web
+    #     # HTTP redirect
+    #   - traefik.http.routers.insec-z2a.entryPoints=web
+    #   - traefik.http.routers.insec-z2a.rule=Host(`z2a.example.com`)
+    #   - traefik.http.routers.insec-z2a.service=z2a
+    #     # HTTPS reverse proxy
+    #   - traefik.http.routers.z2a.entryPoints=websecure
+    #   - traefik.http.routers.z2a.rule=Host(`z2a.example.com`)
+    #   - traefik.http.routers.z2a.service=z2a
+    #   - traefik.http.routers.z2a.tls=true
+    #   - traefik.http.routers.z2a.tls.certResolver=default
+    #   - traefik.http.services.z2a.loadbalancer.server.port=3742
+    #   - traefik.http.services.z2a.loadbalancer.passHostHeader=true
+    ports:
+      - 3742:3742
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: z2a
+      POSTGRES_USER: z2a
+      POSTGRES_PASSWORD: nvasgMDYPBdfQYmo8ptCTEl576yNDBXC
+    restart: unless-stopped
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    # networks:
+    #   - internal
+
+volumes:
+  db_data:
+
+# networks:
+#   web:
+#     external: true
+#   internal:
+#     external: false
+
diff --git a/src/conf.rs b/src/conf.rs
index 764a961..89a329a 100644
--- a/src/conf.rs
+++ b/src/conf.rs
@@ -8,17 +8,24 @@ pub struct Database {
     pub url: String,
 }
 
+#[derive(Debug, Deserialize, Clone)]
+pub struct App {
+    pub listen: SocketAddr,
+}
+
 #[derive(Debug, Deserialize, Clone)]
 #[allow(unused)]
 pub struct Conf {
     pub debug: bool,
     pub database: Database,
-    pub listen: SocketAddr,
+    pub app: App,
 }
 
 impl Conf {
     pub fn read() -> Result<Self> {
-        let mode = env::var("MODE").unwrap_or_else(|_| "dev".into());
+        let mode = env::var("DEPLOYMENT_ENVIRONMENT").unwrap_or_else(|_| "dev".into());
+
+        println!("mode: {mode}");
 
         let s = Config::builder()
             .add_source(File::with_name("conf/default"))
diff --git a/src/server/mod.rs b/src/server/mod.rs
index 86d1bd7..1e32477 100644
--- a/src/server/mod.rs
+++ b/src/server/mod.rs
@@ -57,7 +57,9 @@ impl ZeroToAxum {
             .with_state(app_state)
             .layer(TraceLayer::new_for_http());
 
-        let listener = tokio::net::TcpListener::bind(&conf.listen).await.unwrap();
+        let listener = tokio::net::TcpListener::bind(&conf.app.listen)
+            .await
+            .unwrap();
         let bound_addr = listener.local_addr().unwrap();
         let server = axum::serve(listener, app).with_graceful_shutdown(shutdown_signal());
 
diff --git a/tests/basic.rs b/tests/basic.rs
index b334c02..7fc5c9f 100644
--- a/tests/basic.rs
+++ b/tests/basic.rs
@@ -19,7 +19,7 @@ async fn config_reads_defaults() {
     let conf = zero_to_axum::Conf::read().unwrap();
 
     assert_eq!(
-        conf.listen,
+        conf.app.listen,
         "[::]:3742".parse().unwrap(),
         "parse server listen addr"
     );
diff --git a/tests/fixture/mod.rs b/tests/fixture/mod.rs
index a17b953..446b4a3 100644
--- a/tests/fixture/mod.rs
+++ b/tests/fixture/mod.rs
@@ -16,7 +16,7 @@ use tokio::sync::OnceCell;
 use tokio::task::JoinHandle;
 use tokio::time::sleep;
 use tracing::{debug, trace};
-use zero_to_axum::{Conf, ZeroToAxum};
+use zero_to_axum::{conf, Conf, ZeroToAxum};
 
 static SHARED_DB: OnceCell<Arc<TestDb>> = OnceCell::const_new();
 async fn get_shared_db() -> Arc<TestDb> {
@@ -43,8 +43,10 @@ impl TestServer {
         let url = dbg!(db.get_url());
 
         let server = ZeroToAxum::serve(Conf {
-            listen: "[::]:0".parse().unwrap(),
-            database: zero_to_axum::conf::Database { url },
+            app: conf::App {
+                listen: "[::]:0".parse().unwrap(),
+            },
+            database: conf::Database { url },
             debug: true,
         })
         .await