diff --git a/.env.pg b/.env.pg
index 00c29c9..488ca00 100644
--- a/.env.pg
+++ b/.env.pg
@@ -1,6 +1,7 @@
 #!/bin/bash
 # this is for the backup cron job, NOT for the docker-compose.yml
 
-POSTGRES_PASSWORD=$(</srv/forgejo/.pg.pw)
+POSTGRES_PASSWORD=$(< $HOME/git/.pg.pw)
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
+
diff --git a/docker-compose.yml b/docker-compose.yml
index d766847..7547216 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,8 @@
+version: "2"
+
 services:
-  forgejo:
-    image: codeberg.org/forgejo/forgejo:7.0.15-rootless
+  server:
+    image: codeberg.org/forgejo/forgejo:7.0.2-rootless
     restart: always
     volumes:
       - ./data:/var/lib/gitea
@@ -13,13 +15,13 @@ services:
       - "2222:2222"
     labels:
       traefik.enable: true
-      traefik.http.routers.gitea.rule: Host(`git.tams.tech`) || Host(`git.techwork.zone`)
+      traefik.http.routers.gitea.rule: Host(`git.tams.tech`, `git.techwork.zone`)
       traefik.http.routers.gitea.tls: true
-      traefik.http.routers.gitea.tls.certresolver: letsencrypt_standalone
+      traefik.http.routers.gitea.tls.certresolver: letsencrypt
       traefik.http.services.gitea-service.loadbalancer.server.port: 3000
     networks:
-      - public
       - gitea
+      - web
     environment: {}
       # GITEA__database__DB_TYPE: postgres
       # GITEA__database__HOST: database:5432
@@ -33,14 +35,14 @@ services:
       # GITEA__mailer__USER__FILE: /run/secrets/mail_api_key
       # GITEA__mailer__PASSWD__FILE: /run/secrets/mail_secret
     depends_on:
-      - forgejo-database
+      - database
     secrets:
       - mail_api_key
       - mail_secret
       - pg_password
 
-  forgejo-database:
-    image: postgres:17
+  database:
+    image: postgres:14
     restart: always
     environment:
       POSTGRES_USER: gitea
@@ -50,7 +52,6 @@ services:
       - ./db:/var/lib/postgresql/data
     networks: [ gitea ]
     secrets: [ pg_password ]
-    labels:
 
 secrets:
   pg_password:
@@ -63,3 +64,5 @@ secrets:
 networks:
   gitea:
     internal: true
+  web:
+    external: true