diff --git a/Dockerfile b/Dockerfile
index 0f9af7a..85e042f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o /out/pane
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o /out/vpn-node ./cmd/node
 
 FROM alpine:3.21
-RUN apk add --no-cache ca-certificates tzdata openssh-client
+RUN apk add --no-cache ca-certificates tzdata openssh-client wget
 WORKDIR /app
 
 COPY --from=builder /out/panel /app/panel
diff --git a/README.md b/README.md
index 50f9a14..6bebf45 100644
--- a/README.md
+++ b/README.md
@@ -11,15 +11,25 @@
 
 ## Быстрый старт (Dokploy / Docker)
 
-1. Скопируйте `.env.example` → `.env` и задайте пароли + `DOMAIN`.
-2. В Dokploy создайте приложение типа **Docker Compose**, укажите этот репозиторий.
-3. Deploy — поднимутся сервисы `app` и `postgres`.
+1. В Dokploy создайте **Docker Compose** приложение из этого репозитория.
+2. Задайте Environment Variables (`.env` в git не лежит):
+
+```env
+APP_SECRET=long-random-secret
+ADMIN_EMAIL=admin@example.com
+ADMIN_PASSWORD=strong-password
+POSTGRES_PASSWORD=strong-db-password
+```
+
+3. Deploy. Домен в Dokploy → сервис **`app`**, порт **`8080`** (не postgres).
+4. Если **Bad Gateway**: смотрите логи `app` — чаще всего падение из‑за БД или домен смотрит не на тот порт.
 
 ```bash
 docker compose up -d --build
+docker compose logs -f app
 ```
 
-Панель: `http://localhost:8080`
+Панель: `http://localhost:8080` · health: `/health`
 
 ## Авторизация админа (из `.env`)
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 5bef1f9..3f5d0f0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,36 +3,53 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: vpn-panel
     restart: unless-stopped
+    # Dokploy Traefik → этот порт. В UI домена укажите service=app, port=8080
     ports:
       - "${APP_PORT:-8080}:8080"
-    env_file:
-      - .env
+    expose:
+      - "8080"
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
+      APP_PORT: ${APP_PORT:-8080}
+      PORT: ${APP_PORT:-8080}
+      APP_SECRET: ${APP_SECRET:-change-me-to-a-long-random-secret-key}
+      APP_ENV: ${APP_ENV:-production}
+      ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@panel.local}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-Admin123!ChangeMe}
+      ADMIN_NAME: ${ADMIN_NAME:-Administrator}
       POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DB: ${POSTGRES_DB:-vpn_panel}
+      POSTGRES_USER: ${POSTGRES_USER:-vpn_admin}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-VpnDb_Secure_Pass_17}
+      DATABASE_URL: postgres://${POSTGRES_USER:-vpn_admin}:${POSTGRES_PASSWORD:-VpnDb_Secure_Pass_17}@postgres:5432/${POSTGRES_DB:-vpn_panel}?sslmode=disable
     depends_on:
       postgres:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 40s
     networks:
       - vpn-net
 
   postgres:
     image: postgres:17-alpine
-    container_name: vpn-panel-db
     restart: unless-stopped
     environment:
-      POSTGRES_DB: ${POSTGRES_DB}
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-vpn_panel}
+      POSTGRES_USER: ${POSTGRES_USER:-vpn_admin}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-VpnDb_Secure_Pass_17}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 5s
       timeout: 5s
       retries: 10
+      start_period: 10s
     networks:
       - vpn-net
 
diff --git a/internal/config/config.go b/internal/config/config.go
index d7d7a07..5b49583 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -25,8 +25,14 @@ type Config struct {
 func Load() (*Config, error) {
 	_ = godotenv.Load()
 
+	// Dokploy / PaaS often set PORT; prefer APP_PORT, then PORT.
+	port := getEnv("APP_PORT", "")
+	if port == "" {
+		port = getEnv("PORT", "8080")
+	}
+
 	cfg := &Config{
-		Port:          getEnv("APP_PORT", "8080"),
+		Port:          port,
 		Secret:        getEnv("APP_SECRET", "dev-secret-change-me"),
 		Env:           getEnv("APP_ENV", "development"),
 		DatabaseURL:   os.Getenv("DATABASE_URL"),