diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..67db450
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+logs/
+nginx.conf.compiled
+.vscode/
+.local/
+data/db/*
+secrets
+sass
diff --git a/.gitignore b/.gitignore
index 8d95970..a0ec8b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,9 +2,7 @@ logs/
 nginx.conf.compiled
 .vscode/
 .local/
+data/db/*
+secrets/secrets.lua
 data/static/avatars/*
 !data/static/avatars/default.webp
-data/db/*
-secrets.lua
-
-.first_launch.*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..3bfec98
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+# HOW TO:
+#
+# docker build -t porom:latest .
+#
+# Then run the container:
+#
+# docker compose up
+#
+# NOTE: not working yet. i get an error that the db is read-only :(
+#
+FROM openresty/openresty:alpine-fat
+
+RUN apk add --no-cache git make gcc g++ musl-dev libffi-dev openssl-dev sqlite-dev libsodium libsodium-dev imagemagick-dev openssl
+WORKDIR /app
+COPY . .
+RUN eval "$(luarocks --lua-version=5.1 path)"
+RUN luarocks --lua-version=5.1 build --only-deps
+EXPOSE 8080
+RUN chmod +x /app/start.sh
+ENTRYPOINT ["/app/start.sh", "production"]
diff --git a/config.lua b/config.lua
index 6a1fa07..d1e2f5d 100644
--- a/config.lua
+++ b/config.lua
@@ -1,5 +1,5 @@
 local config = require("lapis.config")
-local secrets = require("secrets")
+local secrets = require("secrets.secrets")
 
 config({"development", "production"}, {
   port = 8080,
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..32eefd6
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,10 @@
+services:
+  porom:
+    build:
+      context: .
+    ports:
+      - "8080:8080"
+    volumes:
+      - ./data/static:/app/data/static
+      - ./data/db:/app/data/db
+      - ./secrets:/app/secrets
diff --git a/secrets.lua.example b/secrets/secrets.lua.example
similarity index 100%
rename from secrets.lua.example
rename to secrets/secrets.lua.example
diff --git a/start.sh b/start.sh
index 6e9305c..030def5 100755
--- a/start.sh
+++ b/start.sh
@@ -1,12 +1,18 @@
 #!/bin/bash
 
+set -e
+
 start() {
   lapis serve
 }
 
 first_launch() {
   echo "Setting up for the first time"
-  touch ".first_launch.$LAPIS_ENVIRONMENT"
+  mkdir -p secrets
+  local SECRET
+  SECRET="$(openssl rand -hex 32)"
+  echo "return { key = \"${SECRET}\",}" > secrets/secrets.lua
+  touch "secrets/.touched.$LAPIS_ENVIRONMENT"
   mkdir -p data/db
   luajit schema.lua
   lapis migrate
@@ -22,7 +28,7 @@ fi
 
 echo "Starting in $LAPIS_ENVIRONMENT"
 
-if ! [ -f ".first_launch.$LAPIS_ENVIRONMENT" ]; then
+if ! [ -f ".touched.$LAPIS_ENVIRONMENT" ]; then
   first_launch
 fi