diff --git a/.env.duplicity b/.env.duplicity
new file mode 100644
index 0000000..8486b6e
Binary files /dev/null and b/.env.duplicity differ
diff --git a/.env.production b/.env.production
new file mode 100644
index 0000000..37be08d
Binary files /dev/null and b/.env.production differ
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..00321a5
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+.env* filter=git-crypt diff=git-crypt
diff --git a/.gitignore b/.gitignore
index 5e5ed25..7f3be43 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,2 @@
-.env*
 /data
 /tmp
diff --git a/.gitmodules b/.gitmodules
index 40741b1..b368894 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
 [submodule "mastodon"]
 	path = mastodon
-	url = https://github.com/sunoru/mastodon.git
+	url = https://roost.sunoru.com/sunoru/mastodon.git
diff --git a/docker-compose.yml b/docker-compose.yml
index b595fef..8b92cc0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,10 +1,10 @@
 ---
-version: "3"
 services:
   db:
     container_name: mastodon-db
     restart: always
     image: postgres:15-alpine
+    mem_limit: 512mb
     shm_size: 256mb
     networks:
       - internal_network
@@ -19,6 +19,7 @@ services:
     container_name: mastodon-redis
     restart: always
     image: redis:7-alpine
+    mem_limit: 128mb
     networks:
       - internal_network
     healthcheck:
@@ -30,6 +31,7 @@ services:
     container_name: mastodon-web
     build: .
     restart: always
+    mem_limit: 1024mb
     env_file: .env.production
     command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
     networks:
@@ -49,6 +51,7 @@ services:
     container_name: mastodon-streaming
     build: .
     restart: always
+    mem_limit: 128mb
     env_file: .env.production
     command: node ./streaming
     depends_on:
@@ -68,6 +71,7 @@ services:
     container_name: mastodon-sidekiq
     build: .
     restart: always
+    mem_limit: 512mb
     env_file: .env.production
     command: bundle exec sidekiq
     depends_on:
@@ -87,6 +91,7 @@ services:
     container_name: mastodon-nginx
     restart: always
     image: nginx:latest
+    mem_limit: 64mb
     depends_on:
       - web
     networks:
@@ -105,7 +110,8 @@ services:
     container_name: mastodon-duplicity
     hostname: mastodon-duplicity
     restart: always
-    image: ghcr.io/tecnativa/docker-duplicity-postgres-s3:v3.1.1
+    image: ghcr.io/tecnativa/docker-duplicity-postgres-s3:v3.3.1
+    mem_limit: 256mb
     env_file: .env.duplicity
     networks:
       - internal_network