diff --git a/.env b/.env
new file mode 100644
index 0000000..b14a215
--- /dev/null
+++ b/.env
@@ -0,0 +1,20 @@
+
+# Nextcloud / DB credentials
+NEXTCLOUD_MYSQL_USER=nextcloud
+NEXTCLOUD_MYSQL_PASSWORD=F5vy&46Fzbn:hFnlHji.sWfS*SP~wC
+NEXTCLOUD_MYSQL_DATABASE=nextcloud
+NEXTCLOUD_MYSQL_HOST=db
+
+# Nextcloud reverse proxy / overwrite settings (for fresh install)
+# Use quotes because these values contain spaces.
+NEXTCLOUD_TRUSTED_DOMAINS="nc.awin.one 192.168.1.24:8080 nextcloud"
+TRUSTED_PROXIES="172.18.0.0/16 172.28.0.0/16"
+OVERWRITEPROTOCOL=https
+OVERWRITECLIURL=https://nc.awin.one
+
+# MariaDB root password
+DB_MYSQL_ROOT_PASSWORD=j^hR:t<M(3pX;q/&~)Y?otf(CO!~Vk
+
+# Collabora credentials
+COLLABORA_USERNAME=awin
+COLLABORA_PASSWORD=ji3yjo494su3xk7
diff --git a/docker-compose.yml b/docker-compose.yml
index 351dd4b..7c7798d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,12 +15,36 @@ services:
             - PHP_MEMORY_LIMIT=100G
             - PHP_UPLOAD_LIMIT=1024G
             - POST_MAX_SIZE=100M
-            - NEXTCLOUD_TRUSTED_DOMAINS=nc.awin.one
-            - MYSQL_USER=nextcloud
-            - MYSQL_PASSWORD=F5vy&46Fzbn:hFnlHji.sWfS*SP~wC
-            - MYSQL_DATABASE=nextcloud
-            - MYSQL_HOST=db
+            - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS}
+            - TRUSTED_PROXIES=${TRUSTED_PROXIES}
+            - OVERWRITEPROTOCOL=${OVERWRITEPROTOCOL}
+            - OVERWRITECLIURL=${OVERWRITECLIURL}
+            - MYSQL_USER=${NEXTCLOUD_MYSQL_USER}
+            - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
+            - MYSQL_DATABASE=${NEXTCLOUD_MYSQL_DATABASE}
+            - MYSQL_HOST=${NEXTCLOUD_MYSQL_HOST}
             - REDIS_HOST=redis
+        networks:
+            - default
+            - caddy-network
+
+    notify_push:
+        image: nextcloud
+        restart: unless-stopped
+        user: 33:33  # www-data 的 UID:GID
+        depends_on:
+            - nextcloud
+            - redis
+            - db
+        volumes:
+            - ./data/nextcloud:/var/www/html:ro  # 建議設為唯讀
+        environment:
+            - PORT=7867
+            - NEXTCLOUD_URL=http://nextcloud  # 直連 Nextcloud 服務（走 Docker 內網）
+        entrypoint: ["/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push", "/var/www/html/config/config.php"]
+        networks:
+            - default
+            - caddy-network
 
     db:
         image: mariadb:10.6
@@ -29,10 +53,10 @@ services:
         volumes:
             - ./data/db:/var/lib/mysql
         environment:
-            - MYSQL_ROOT_PASSWORD=j^hR:t<M(3pX;q/&~)Y?otf(CO!~Vk
-            - MYSQL_USER=nextcloud
-            - MYSQL_PASSWORD=F5vy&46Fzbn:hFnlHji.sWfS*SP~wC
-            - MYSQL_DATABASE=nextcloud
+            - MYSQL_ROOT_PASSWORD=${DB_MYSQL_ROOT_PASSWORD}
+            - MYSQL_USER=${NEXTCLOUD_MYSQL_USER}
+            - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
+            - MYSQL_DATABASE=${NEXTCLOUD_MYSQL_DATABASE}
 
     redis:
         image: redis:alpine
@@ -45,8 +69,8 @@ services:
             - 8081:9980
         environment:
             - domain=nc.awin.one # collabora 會被哪個 website 使用
-            - username=awin
-            - password=ji3yjo494su3xk7
+            - username=${COLLABORA_USERNAME}
+            - password=${COLLABORA_PASSWORD}
             - extra_params=--o:ssl.enable=false --o:ssl.termination=true
         volumes:
             - /etc/localtime:/etc/localtime:ro
@@ -54,3 +78,7 @@ services:
             - MKNOD
         links:
             - nextcloud
+
+networks:
+  caddy-network:
+    external: true