diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..0541441
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,14 @@
+# =========================
+# General
+# =========================
+
+DOMAIN=tomasrivera.ch
+TZ=Europe/Zurich
+
+
+# =========================
+# ArchiveBox
+# =========================
+
+ARCHIVEBOX_ADMIN_USERNAME=admin
+ARCHIVEBOX_ADMIN_PASSWORD=change_me
diff --git a/.gitignore b/.gitignore
index fea9bbe..be1c21c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,17 @@
-# Ignore build outputs from performing a nix-build or `nix build` command
-result
-result-*
-
-# Ignore automatically generated direnv output
-.direnv
-
-# Ignore NixOS interactive test driver history
-**/.nixos-test-history
-
+# Secrets
 .env
+
+# Docker data
+data/
+volumes/
+
+# Temporary files
+*.tmp
+*.log
+
+# Editor files
+.vscode/
+.idea/
+
+# OS files
+.DS_Store
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..5496c3f
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,3 @@
+archive.tomasrivera.ch {
+    reverse_proxy archivebox:8000
+}
diff --git a/backup.sh b/backup.sh
new file mode 100644
index 0000000..db5a67e
--- /dev/null
+++ b/backup.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+echo "Backup not configured yet"
diff --git a/bootstrap.sh b/bootstrap.sh
index 8eff7ca..083e524 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -15,7 +15,10 @@ apt install -y \
   htop \
   unzip \
   rsync \
+  rclone \
   jq \
+  fail2ban \
+  unattended-upgrades \
   ufw
 
 echo "== Installing Docker repository key =="
@@ -61,7 +64,22 @@ ufw --force enable
 
 echo "== Enabling useful services =="
 systemctl enable --now ssh
+systemctl enable --now fail2ban
+dpkg-reconfigure unattended-upgrades
 
+echo "== installing systemd systems"
+mkdir -p /opt/server/archivebox/archivebox-data
+mkdir -p /mnt/kdrive/Archive
+rclone config
+
+mkdir -p /mnt/kdrive
+cp systemd/kdrive-rclone.service /etc/systemd/system/
+
+systemctl daemon-reload
+systemctl enable kdrive-rclone
+systemctl start kdrive-rclone
+mountpoint /mnt/kdrive
+ls /mnt/kdrive
 echo
 echo "================================"
 echo "Bootstrap finished!"
diff --git a/compose.yml b/compose.yml
new file mode 100644
index 0000000..f0d556a
--- /dev/null
+++ b/compose.yml
@@ -0,0 +1,36 @@
+services:
+
+  caddy:
+    image: caddy:latest
+    container_name: caddy
+    restart: unless-stopped
+
+    ports:
+      - "80:80"
+      - "443:443"
+
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+
+
+  archivebox:
+    image: archivebox/archivebox:latest
+    container_name: archivebox
+    restart: unless-stopped
+
+    environment:
+      - TZ=Europe/Zurich
+
+    volumes:
+      # Local SSD: database + config + metadata
+      - ./archivebox-data:/data
+
+      # kDrive: only the heavy archive content
+      - /mnt/kdrive/Archive:/data/archive
+
+
+volumes:
+  caddy_data:
+  caddy_config:
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100755
index 0000000..2adae35
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+docker compose pull
+docker compose up -d
diff --git a/scripts/init.sh b/scripts/init.sh
new file mode 100644
index 0000000..96226b7
--- /dev/null
+++ b/scripts/init.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+mkdir -p archivebox-data
+
+docker compose run --rm archivebox init --setup
+
+docker compose up -d
diff --git a/scripts/update.sh b/scripts/update.sh
new file mode 100755
index 0000000..35a6f1a
--- /dev/null
+++ b/scripts/update.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+docker compose pull
+docker compose up -d
+docker image prune -f
diff --git a/systemd/kdrive-rclone.service b/systemd/kdrive-rclone.service
new file mode 100644
index 0000000..ecf234d
--- /dev/null
+++ b/systemd/kdrive-rclone.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Mount kDrive with rclone
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/usr/bin/rclone mount kdrive: /mnt/kdrive \
+  --allow-other \
+  --vfs-cache-mode full \
+  --dir-cache-time 1h
+ExecStop=/bin/fusermount -u /mnt/kdrive
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target