diff --git a/.env.example b/.env.example
index 3b24dcf..515dd86 100644
--- a/.env.example
+++ b/.env.example
@@ -1,18 +1,25 @@
-# Dokploy / Docker Compose env (copy to .env and edit)
-
-APP_URL=https://wg.example.com
+# App
+APP_PORT=8080
+APP_URL=https://test200.de4ima.uk
 SITE_NAME=Evilfox.cc
 SECURE_COOKIES=true
-SESSION_SECRET=replace-with-long-random-secret
+SESSION_SECRET=change-me-to-long-random-string
 
+# Admin (логин админки — только из env)
 ADMIN_USERNAME=admin
 ADMIN_EMAIL=admin@evilfox.cc
-ADMIN_PASSWORD=replace-with-strong-admin-password
+ADMIN_PASSWORD=change-me-strong-password
 
+# PostgreSQL 17
 POSTGRES_DB=wg
 POSTGRES_USER=wg
-POSTGRES_PASSWORD=replace-with-strong-db-password
+POSTGRES_PASSWORD=change-me-db-password
 
+# Import old MySQL dump once (wg.sql)
 AUTO_IMPORT_MYSQL=true
-APP_PUBLISH_PORT=8080
-TZ=Europe/Moscow
+MYSQL_DUMP_PATH=/data/wg.sql
+
+# Dokploy Domain tab:
+#   Service = app
+#   Port    = 8080
+TZ=UTC
diff --git a/Dockerfile b/Dockerfile
index 893945a..fc00dbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,6 +23,6 @@ ENV APP_ROOT=/app \
     APP_PORT=8080
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
-  CMD curl -fsS http://127.0.0.1:8080/login >/dev/null || exit 1
+  CMD curl -fsS http://127.0.0.1:8080/healthz >/dev/null || exit 1
 USER nobody
 CMD ["/app/wg-panel"]
diff --git a/cmd/server/main.go b/cmd/server/main.go
index e098f6f..7f7d7e7 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -70,6 +70,11 @@ func main() {
 	fileServer(r, "/static/", http.Dir(staticDir))
 
 	r.Get("/", app.Home)
+	r.Get("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
 	r.Get("/login", app.LoginPage)
 	r.Post("/login", app.LoginPost)
 	r.Get("/logout", app.Logout)
diff --git a/docker-compose.yml b/docker-compose.yml
index fb30789..5985c02 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,6 +15,7 @@ services:
       retries: 20
     networks:
       - wg
+      - dokploy-network
 
   app:
     build: .
@@ -22,8 +23,9 @@ services:
     depends_on:
       db:
         condition: service_healthy
-    ports:
-      - "${APP_PUBLISH_PORT:-8080}:8080"
+    # Dokploy/Traefik routes to this internal port — do NOT publish host ports.
+    expose:
+      - "8080"
     environment:
       APP_PORT: "8080"
       APP_URL: ${APP_URL:-http://localhost:8080}
@@ -35,10 +37,11 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD}
       AUTO_IMPORT_MYSQL: ${AUTO_IMPORT_MYSQL:-true}
       MYSQL_DUMP_PATH: /data/wg.sql
-      SECURE_COOKIES: ${SECURE_COOKIES:-false}
+      SECURE_COOKIES: ${SECURE_COOKIES:-true}
       TZ: ${TZ:-UTC}
     networks:
       - wg
+      - dokploy-network
 
 volumes:
   pgdata:
@@ -46,3 +49,6 @@ volumes:
 networks:
   wg:
     driver: bridge
+  # Required so Traefik (Dokploy) can reach containers.
+  dokploy-network:
+    external: true
diff --git a/internal/handlers/handlers.go b/internal/handlers/handlers.go
index 0a99746..54f5a5c 100644
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -66,7 +66,7 @@ func (a *App) SiteOnline(ctx context.Context) (models.SiteStatus, error) {
 
 func (a *App) OfflineMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasPrefix(r.URL.Path, "/login") || strings.HasPrefix(r.URL.Path, "/admin") || strings.HasPrefix(r.URL.Path, "/static") {
+		if strings.HasPrefix(r.URL.Path, "/login") || strings.HasPrefix(r.URL.Path, "/admin") || strings.HasPrefix(r.URL.Path, "/static") || r.URL.Path == "/healthz" {
 			next.ServeHTTP(w, r)
 			return
 		}