diff --git a/.dockerignore b/.dockerignore
index fffd364..0581833 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,4 @@ config/
 .vscode/
 Makefile
 README.md
+base/
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 144ae4f..bc7933c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,50 +1,3 @@
-################################################################################
-# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
-################################################################################
-FROM node:20.11-bookworm-slim AS pds-build
-
-RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
-
-# Download and extract the PDS archive
-WORKDIR /app
-ADD https://github.com/bluesky-social/pds/archive/refs/tags/v0.4.74.zip .
-RUN unzip v0.4.74.zip && \
-    mv pds-0.4.74/service/** . && \
-    mv pds-0.4.74/pdsadmin.sh .
-
-RUN pnpm install --prod=true --frozen-lockfile
-
-################################################################################
-# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
-################################################################################
-FROM node:20.11-bookworm-slim AS pds-runtime
-
-RUN apt-get update && apt-get install -y \
-    dumb-init \
-    ca-certificates \
-    curl \
-    gnupg \
-    jq \
-    lsb-release \
-    openssl \
-    sqlite3 \
-    bsdextrautils \ 
-    xxd
-# bsdextrautils for `column` command in the accounts script
-
-WORKDIR /app
-COPY --from=pds-build /app /app
-
-EXPOSE 3000
-ENV PDS_PORT=3000
-ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
-
-LABEL org.opencontainers.image.source="https://github.com/bluesky-social/pds"
-LABEL org.opencontainers.image.description="AT Protocol PDS"
-LABEL org.opencontainers.image.licenses="MIT"
-
 ################################################################################
 # adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/installer.sh
 ################################################################################
@@ -69,11 +22,22 @@ RUN mv pdsadmin.sh /usr/local/bin/pdsadmin && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+
+ENV PUID=1000
+ENV PGID=1000
+
+RUN groupadd --gid ${PGID} pds
+RUN useradd --home=${PDS_DATADIR} --uid=${PUID} --no-user-group pds
+RUN usermod --gid ${PGID} pds
+RUN chown -R pds:pds ${PDS_DATADIR}
+
 ENTRYPOINT ["dumb-init", "--"]
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
-CMD ["/entrypoint.sh"]
+
+CMD ["sh", "-c", "chown -R ${PUID}:${PGID} /pds && su pds && /entrypoint.sh"]
+
 
 LABEL org.opencontainers.image.source="https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker"
 LABEL org.opencontainers.image.url="https://github.com/bluesky-social/pds"
diff --git a/Makefile b/Makefile
index 3903a68..b5f1ce6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,23 +1,20 @@
-REGISTRY=forgejo.gravityfargo.dev
-OWNER=gravityfargo
-IMAGE=bluesky-pds
-TAG=0.4.74
-DOMAIN=sheltersky.social
+REGISTRY = forgejo.gravityfargo.dev
+OWNER = gravityfargo
+IMAGE = bluesky-pds
+TAG ?= 0.4.74
+DOMAIN = sheltersky.social
 
 export DOCKER_BUILDKIT=1
-# export BUILDKIT_PROGRESS=plain
+export BUILDKIT_PROGRESS=plain
+
+.PHONY: build-base
+build-base:
+	docker build --tag pds-runtime ./base
 
 .PHONY: build-tag
 build-tag:
-	docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
-
-.PHONY: build
-build:
-	docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE) .
-
-.PHONY: wsdump
-wsdump:
-	wsdump "wss://$(DOMAIN)/xrpc/com.atproto.sync.subscribeRepos?cursor=0"
+	sudo rm -rf config 
+	docker build --no-cache --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
 
 .PHONY: generate-env
 generate-env:
@@ -28,7 +25,11 @@ generate-env:
 	@echo "PDS_JWT_SECRET=$(PDS_JWT_SECRET)" > .env
 	@echo "PDS_ADMIN_PASSWORD=$(PDS_ADMIN_PASSWORD)" >> .env
 	@echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)" >> .env
-	@echo "PDS_HOSTNAME=$(DOMAIN)" >> .env
+	@echo "PDS_HOSTNAME=" >> .env
+	@echo "PUID=1000" >> .env
+	@echo "PGID=1000" >> .env
+	@echo "URL_NAME:" >> .env
+	@echo "URL_SUFFIX:" >> .env
 
 .PHONY: run
 run:
diff --git a/README.md b/README.md
index e6490b2..52ad38b 100644
--- a/README.md
+++ b/README.md
@@ -1,93 +1,121 @@
 # bluesky-pds-docker
-A self-contained Docker image for the [Bluesky PDS (Personal Data Server) ](https://github.com/bluesky-social/pds). This image is pinned to v0.4.74.
 
-It is required to run the instance behind a proxy (like traefik) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this.
+A self-contained Docker image for the [Bluesky PDS (Personal Data Server) ](https://github.com/bluesky-social/pds) for use with Traefik. This image is pinned to v0.4.74.
 
-I can confirm it works behind Cloudflare's DNS Proxy with Full (strict). 
+It is required to run the instance behind a proxy (like traefik) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this. A wildcard DNS assignment along with a wildcard SSL certificate is required. I use Cloudflare for this, see the screenshot below.
+
+I can confirm it works behind Cloudflare's DNS Proxy with Full (strict).
+
+This is not intended for production, and I am not responsible for any data loss or security issues. This is a personal project, and I am not affiliated with Bluesky.
 
 ## Deployment
 
+Before changing images or upgrading, backup the files made in the volume.
+
+### Reqirements
+
+I haven't verified these are the minimum requirements, but they are what I found to be necessary after starting this readme. I probably had some dependencies installed already.
+
+#### Manjaro/Arch
+
+```bash
+sudo pacman -S jq
+```
+
+#### Debian/Ubunutu
+
+```bash
+sudo apt install make xxd
+```
+
+### Setup
+
+Generate secrets and add them to `.env` file. See [example.env](example.env) as an example.
+
 ```bash
 # Generate secret environment variables
 echo PDS_ADMIN_PASSWORD: $(openssl rand --hex 16)
+
 echo PDS_JWT_SECRET: $(openssl rand --hex 16)
+
 echo PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: $(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
-
-# pull and run the container
-docker pull forgejo.gravityfargo.dev/gravityfargo/bluesky-pds
-docker-compose up -d
-
-# Create an account
-docker exec -it bluesky-pds bash
-pdsadmin account create
-pdsadmin account list
-pdsadmin request-crawl bsky.network # useful if you re-deploy the same instance multiple times
 ```
 
-In your browser:
+### Docker Compose Setup
 
-- Go to https://bsky-debug.app/handle and enter your new user, "HTTP Verification Method" needs to pass.
-- [websocket-tester](https://piehost.com/websocket-tester) "wss://example.com/xrpc/com.atproto.sync.subscribeRepos?cursor=0" needs to display "Connection Established"
-- https://boat.kelinci.net/ has a helpful tool to export your data.
-- Log in with your new user and go to https://bsky.app/
+Full list of additional Environment Variables provided by bluesky upstream can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts)
 
+By default, the image uses 1000:1000 as the UID:GID for the user. This can be changed by setting the `PUID` and `PGID` environment variables.
 
-### Example Docker Compose
+The compose element `hostname` must be the same value as `PDS_HOSTNAME`.
 
-Full list of additional Environment Variables can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts)
+#### Traefik
 
 ```yaml
+# Traefik Proxy
 services:
   bluesky-pds:
     container_name: bluesky-pds
-    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds
+    hostname: example.com
+    image: gravityfargo/bluesky-pds:0.4.74
+    networks:
+      - proxy
     environment:
+      # Define variables here or in a .env file
       PDS_JWT_SECRET: ...
       PDS_ADMIN_PASSWORD: ...
       PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ...
-      PDS_HOSTNAME: ...
-      PDS_EMAIL_SMTP_URL: ""
-      PDS_EMAIL_FROM_ADDRESS: ""
-    volumes:
-      - ./bluesky-pds:/pds
-```
-
-### Example Docker Compose with Traefik
-
-```yaml
-services:
-  bluesky-pds:
-    container_name: bluesky-pds
-    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:latest
-    networks:
-      - proxy
-    env_file:
-      PDS_ADMIN_PASSWORD: ""
-      PDS_JWT_SECRET: ""
-      PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ""
       PDS_HOSTNAME: example.com
       PDS_EMAIL_SMTP_URL: ""
       PDS_EMAIL_FROM_ADDRESS: ""
+      PUID: 1005
+      PGID: 1005
     volumes:
       - ./bluesky-pds:/pds
     labels:
       traefik.enable: "true"
       traefik.http.routers.bluesky-pds-insecure.entrypoints: http
-      traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`)
+      traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
+      # traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
       traefik.http.routers.bluesky-pds-secure.entrypoints: https
-      traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`)
+      traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
       traefik.http.routers.bluesky-pds-secure.tls: "true"
       traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http
       traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000
-      traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file
-      traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
+      # traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file
+```
+
+#### Standalone
+
+I do not run this, but it should be possible.
+
+```yaml
+# Standalone, you'll need to add a proxy in front of this with SSL.
+services:
+  bluesky-pds:
+    container_name: bluesky-pds
+    hostname: example.com
+    image: gravityfargo/bluesky-pds:0.4.74
+    environment:
+      # Define variables here or in a .env file
+      PDS_JWT_SECRET: ...
+      PDS_ADMIN_PASSWORD: ...
+      PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ...
+      PDS_HOSTNAME: example.com
+      PDS_EMAIL_SMTP_URL: ""
+      PDS_EMAIL_FROM_ADDRESS: ""
+      PUID: 1005
+      PGID: 1005
+    volumes:
+      - ./bluesky-pds:/pds
 ```
 
 #### Middleware
 
-I think file configs are cleaner than having a billion labels.
+I think file configs are cleaner than having a billion labels. This is not required, but it's nice to have.
 
 ```yaml
+# middleware.yaml
 http:
   middlewares:
     BlueskyHeaders:
@@ -104,8 +132,54 @@ http:
         stsSeconds: 63072000
 ```
 
-## Development Notes
+#### Optional Proxy Network
 
 ```bash
-pamac install jq
+docker network create --subnet=192.168.1.0/24 --ipv6 --attachable proxy
+# /etc/docker/daemon.json
+# {
+#   "ipv6": true,
+#   "fixed-cidr-v6": "2001:db8:1::/64"
+# }
+
+```
+
+#### Cloudflare DNS
+
+![alt text](assets/image.png)
+
+## Development
+
+The development enviornment must be behind a proxy to generate SSL certificates. This will not work otherwise. In my case, I use Traefik installed on a VPS that's dedicated to development.
+
+I suggest buying a domain name for testing. I have one I use that's for a seperate project, but getting a throwaway domain is also an option. Millage may vary.
+
+```bash
+make generate-env
+```
+
+Then set the variables
+
+- `PDS_HOSTNAME=example.com`
+- `URL_NAME=example`
+- `URL_SUFFIX=com`
+
+Build the base image. This will take a while.
+
+```bash
+make build-base
+```
+
+Make edits as needed. Then build the dev image for testing.
+
+```bash
+make build-tag TAG=dev
+```
+
+Run the dev image.
+
+```bash
+make run
+# or
+docker-compose up
 ```
diff --git a/assets/image.png b/assets/image.png
new file mode 100644
index 0000000..6f435c4
Binary files /dev/null and b/assets/image.png differ
diff --git a/base/Dockerfile b/base/Dockerfile
new file mode 100644
index 0000000..a30a0a1
--- /dev/null
+++ b/base/Dockerfile
@@ -0,0 +1,48 @@
+################################################################################
+# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
+################################################################################
+FROM node:20.11-bookworm-slim AS pds-build
+
+RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
+
+# Download and extract the PDS archive
+WORKDIR /app
+ADD https://github.com/bluesky-social/pds/archive/refs/tags/v0.4.74.zip .
+RUN unzip v0.4.74.zip && \
+    mv pds-0.4.74/service/** . && \
+    mv pds-0.4.74/pdsadmin.sh .
+
+RUN pnpm install --prod=true --frozen-lockfile
+
+################################################################################
+# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
+################################################################################
+FROM node:20.11-bookworm-slim
+
+RUN apt-get update && apt-get install -y \
+    dumb-init \
+    ca-certificates \
+    curl \
+    gnupg \
+    jq \
+    lsb-release \
+    openssl \
+    sqlite3 \
+    bsdextrautils \ 
+    xxd
+# bsdextrautils for `column` command in the accounts script
+
+WORKDIR /app
+COPY --from=pds-build /app /app
+
+EXPOSE 3000
+ENV PDS_PORT=3000
+ENV NODE_ENV=production
+# potential perf issues w/ io_uring on this version of node
+ENV UV_USE_IO_URING=0
+
+RUN userdel node
+
+LABEL org.opencontainers.image.source="https://github.com/bluesky-social/pds"
+LABEL org.opencontainers.image.description="AT Protocol PDS"
+LABEL org.opencontainers.image.licenses="MIT"
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 95bb265..1d5aec5 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,11 +1,26 @@
+networks:
+  proxy:
+    external: true
+
 services:
   bluesky-pds-dev:
     container_name: bluesky-pds-dev
-    hostname: sheltersky.social
-    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:0.4.74
-    ports:
-      - 3000:3000
+    hostname: ${PDS_HOSTNAME}
+    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:dev
+    networks:
+      - proxy
+    env_file:
+      - .env
     volumes:
       - ./config:/pds
-    env_file:
-      - .env
\ No newline at end of file
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.bluesky-pds-insecure.entrypoints: http
+      traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
+      traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
+      traefik.http.routers.bluesky-pds-secure.entrypoints: https
+      traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
+      traefik.http.routers.bluesky-pds-secure.tls: "true"
+      traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http
+      traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000
+      traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file
diff --git a/entrypoint.sh b/entrypoint.sh
index 378c2e9..03073f4 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -20,9 +20,9 @@ function main {
         exit 1
     fi
 
-    # set PDS_HOSTNAME to hostname if not set
-    if [[ -z "${PDS_HOSTNAME}" ]]; then
-        echo "PDS_HOSTNAME not specified"
+    # if hostname is not the same as the PDS_HOSTNAME then quit
+    if [[ "${PDS_HOSTNAME}" != "${HOSTNAME}" ]]; then
+        echo "PDS_HOSTNAME does not match the hostname"
         exit 1
     fi
 
diff --git a/example.env b/example.env
new file mode 100644
index 0000000..24781bc
--- /dev/null
+++ b/example.env
@@ -0,0 +1,8 @@
+PDS_JWT_SECRET=
+PDS_ADMIN_PASSWORD=
+PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=
+PDS_HOSTNAME=
+PDS_EMAIL_SMTP_URL=
+PDS_EMAIL_FROM_ADDRESS=
+PUID=1000
+PGID=1000
\ No newline at end of file