diff --git a/.env.sample b/.env.sample
index 1037f0c..8f9e640 100644
--- a/.env.sample
+++ b/.env.sample
@@ -40,6 +40,9 @@ BRF_CONF_VERSION=v1
 BHDN_CONF_VERSION=v1
 BEG_CONF_VERSION=v1
 AA_CONF_VERSION=v1
+PRES_CONF_VERSION=v1
+DEMO_CONF_VERSION=v1
+FREESWITCH_EX_VERSION=v1
 
 # ====================================
 # ADDITIONS to BigBlueButton
@@ -97,7 +100,7 @@ ENABLE_GREENLIGHT=true
 # CONNECTION
 # ====================================
 
-EXTERNAL_IPv4=
+EXTERNAL_IPv4=0.0.0.0
 # EXTERNAL_IPv6=2010
 
 # STUN SERVER
@@ -113,7 +116,7 @@ STUN_PORT=3478
 # due to high traffic caused by bots, by default the SIP port is blocked.
 # but you can allow access by your providers IP or IP ranges (comma seperated)
 # Hint: if you want to allow requests from every IP, you can use 0.0.0.0/0
-SIP_IP_ALLOWLIST=
+SIP_IP_ALLOWLIST=0.0.0.0/0
 
 # ====================================
 # CUSTOMIZATION
@@ -130,7 +133,7 @@ WELCOME_FOOTER="This server is running <a href='https://docs.bigbluebutton.org/'
 
 # for a different default presentation, place the pdf file in ./conf/ and
 # adjust the following path
-DEFAULT_PRESENTATION=./mod/nginx/default.pdf
+DEFAULT_PRESENTATION=/etc/nginx/bbb/default.pdf
 
 # language of sound announcements
 # options:
diff --git a/abra.sh b/abra.sh
index 5e0d796..d020851 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,3 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export APP_ENTRYPOINT_VERSION=v1
\ No newline at end of file
+export APP_ENTRYPOINT_VERSION=v1
diff --git a/bbb-webrtc-sfu b/bbb-webrtc-sfu
new file mode 160000
index 0000000..083ec6b
--- /dev/null
+++ b/bbb-webrtc-sfu
@@ -0,0 +1 @@
+Subproject commit 083ec6bae8172514ae14e325d221ad5afded4531
diff --git a/compose.yml b/compose.yml
index 92c42bf..03ddf9e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -43,6 +43,9 @@ services:
   # freeswitch (audio input streaming and telco dial-in support)
   freeswitch:
     image: alangecker/bbb-docker-freeswitch:v1.10.12-v3.0.19
+    deploy:
+      replicas: 1
+      endpoint_mode: dnsrr
     cap_add:
       - IPC_LOCK
       - NET_ADMIN
@@ -86,18 +89,17 @@ services:
     image: alangecker/bbb-docker-nginx:v3.0.19-v5.4.3-1.29
     volumes:
       - bigbluebutton:/var/bigbluebutton
-      - ${DEFAULT_PRESENTATION:-/dev/null}:/www/default.pdf
     tmpfs:
      - /tmp
     configs:
       - source: nginx_conf
         target: /etc/nginx/nginx.conf
         mode: 0555
-      - source: beg_conf
-        target: /etc/nginx/bbb/bbb-exporter.nginx
-        mode: 0555
-      - source: bhdn_conf
-        target: /etc/nginx/bbb/bbb-html5.dev.nginx
+#      - source: beg_conf
+#        target: /etc/nginx/bbb/bbb-exporter.nginx
+#        mode: 0555
+      - source: bhdn_conf # used to be in dev mode
+        target: /etc/nginx/bbb/bbb-html5.nginx
         mode: 0555
       - source: wn_conf
         target: /etc/nginx/bbb/webhooks.nginx
@@ -105,6 +107,12 @@ services:
       - source: wsn_conf
         target: /etc/nginx/bbb/webrtc-sfu.nginx
         mode: 0555
+      - source: pres_conf
+        target: /www/default.pdf
+        mode: 0555
+      - source: demo_conf
+        target: /etc/nginx/bbb/demo.nginx
+        mode: 0555
     networks:
       - proxy
       - internal
@@ -112,7 +120,7 @@ services:
       labels:
         - "traefik.enable=true"
         - "traefik.docker.network=proxy"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=48087"
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
@@ -205,7 +213,7 @@ services:
     environment:
       # ESL_PASSWORD is set via entrypoint.webrtc-sfu.sh
       # ip must be 0.0.0.0 (container can't bind to external host IP)
-      MS_WEBRTC_LISTEN_IPS: '[{"ip":"0.0.0.0", "announcedIp":"${EXTERNAL_IPv4}"}]'
+      MS_WEBRTC_LISTEN_IPS: '[{"ip":"${EXTERNAL_IPv4}", "announcedIp":"${EXTERNAL_IPv4}"}]'
     configs:
       - source: entrypoint_webrtcsfu
         target: /usr/local/bin/docker-entrypoint.sh
@@ -222,8 +230,8 @@ services:
        - fsesl_password
     # network_mode: host would be needed for mediasoup UDP to work from outside;
     # keeping on overlay network for now so other services can reach it by name.
-    # security_opt:
-      # - seccomp:unconfined # allow io_uring access for mediasoup
+    #security_opt:
+    #  - seccomp:unconfined # allow io_uring access for mediasoup
     ulimits:
       memlock: -1 # allow io_uring_register_buffers to allocate enough ram
     networks:
@@ -266,7 +274,7 @@ services:
          target: /etc/bigbluebutton/bbb-html5.yml
          mode: 0555 
        - source: aa_conf
-         target: /etc/bigbluebutton/mod/bbb-apps-akka.conf.tmpl
+         target: /etc/bigbluebutton/bbb-apps-akka.conf.tmpl
          mode: 0555
     secrets:
        - shared_secret
@@ -284,6 +292,7 @@ services:
       - bbb-graphql-actions
     secrets:
       - postgres_password
+      - hasura_admin_secret
     environment:
       POSTGRES_USER: postgres
       # POSTGRES_PASSWORD and HASURA_GRAPHQL_ADMIN_SECRET are set via entrypoint
@@ -292,10 +301,12 @@ services:
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
     entrypoint: /usr/local/bin/docker-entrypoint.sh
-    command: ["graphql-engine", "serve"]
-    secrets:
-      - postgres_password
-      - hasura_admin_secret
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8085/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
     networks:
       - internal
   
@@ -375,9 +386,9 @@ services:
       - turn_secret
     environment:
       ENABLE_HTTPS_PROXY: "false"
-    volumes:
-      - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/cert.pem:/tmp/cert.pem:ro"
-      - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/key.pem:/tmp/key.pem:ro"
+    # volumes:
+    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/cert.pem:/tmp/cert.pem:ro"
+    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/key.pem:/tmp/key.pem:ro"
     # network_mode: host <- mine has this commented out
     network_mode: host
     user: root
@@ -496,7 +507,7 @@ configs:
     file: ./mod/bbb-exporter.nginx
   bhdn_conf:
     name: ${STACK_NAME}_bhdn_conf_${BHDN_CONF_VERSION}
-    file: ./mod/bbb-html5.dev.nginx
+    file: ./mod/nginx/bbb/bbb-html5.nginx
   brf_conf:
     name: ${STACK_NAME}_brf_conf_${BRF_CONF_VERSION}
     file: ./mod/bbb-resync-freeswitch
@@ -512,6 +523,15 @@ configs:
   ws_conf:
     name: ${STACK_NAME}_ws_conf_${WS_CONF_VERSION}
     file: ./mod/webrtc-sfu-config.yaml
+  demo_conf:
+    name: ${STACK_NAME}_demo_conf_${DEMO_CONF_VERSION}
+    file: ./mod/nginx/bbb/demo.nginx
+  pres_conf: # the default presentation for bbb nginx
+    name: ${STACK_NAME}_pres_conf_${PRES_CONF_VERSION}
+    file: ./mod/nginx/default.pdf
+  freeswitch_ex:
+    name: ${STACK_NAME}_freeswitch_ex_${FREESWITCH_EX_VERSION}
+    file: ./mod/freeswitch/conf/sip_profiles/external.xml
 
 secrets:
   postgres_password:
diff --git a/entrypoint.apps-akka.sh b/entrypoint.apps-akka.sh
index 1ba5b61..7f2a854 100755
--- a/entrypoint.apps-akka.sh
+++ b/entrypoint.apps-akka.sh
@@ -42,5 +42,7 @@ TARGET=/usr/share/bigbluebutton/html5-client/private/config/settings.yml
 yq e -i ".public.kurento.wsUrl = \"wss://$DOMAIN/bbb-webrtc-sfu\"" $TARGET
 yq e -i ".public.pads.url = \"https://$DOMAIN/pad\"" $TARGET
 
+sleep 50
+    
 cd /bbb-apps-akka
 /bbb-apps-akka/bin/bbb-apps-akka
diff --git a/entrypoint.bbb-graphql-server.sh b/entrypoint.bbb-graphql-server.sh
index fad2e3b..863ecdf 100644
--- a/entrypoint.bbb-graphql-server.sh
+++ b/entrypoint.bbb-graphql-server.sh
@@ -31,4 +31,79 @@ else
     exit 1
 fi
 
-exec "$@"
+
+# for psql
+export PGHOST=postgres
+export PGUSER="${POSTGRES_USER}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+
+# for hasura
+export HASURA_GRAPHQL_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hasura_app
+export HASURA_GRAPHQL_METADATA_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hasura_app
+export HASURA_GRAPHQL_LOG_LEVEL=warn
+export HASURA_GRAPHQL_ENABLE_CONSOLE=false
+export HASURA_GRAPHQL_LIVE_QUERIES_MULTIPLEXED_REFETCH_INTERVAL=333
+export HASURA_GRAPHQL_LIVE_QUERIES_MULTIPLEXED_BATCH_SIZE=1000
+export HASURA_GRAPHQL_STREAMING_QUERIES_MULTIPLEXED_REFETCH_INTERVAL=150
+export HASURA_GRAPHQL_STREAMING_QUERIES_MULTIPLEXED_BATCH_SIZE=1000
+export HASURA_GRAPHQL_SERVER_PORT=8085
+export HASURA_GRAPHQL_ENABLE_TELEMETRY=false
+export HASURA_GRAPHQL_WEBSOCKET_KEEPALIVE=10
+export HASURA_GRAPHQL_AUTH_HOOK=http://apps-akka:8901/userInfo
+export HASURA_BBB_GRAPHQL_ACTIONS_ADAPTER_URL=http://bbb-graphql-actions:8093
+
+
+export HASURA_GRAPHQL_BBB_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/bbb_graphql
+
+# echo "Waiting for Postgres..."
+# TIMEOUT=30
+# i=0
+# until (echo > /dev/tcp/$PGHOST/5432) 2>/dev/null; do
+#   i=$((i+1))
+#   if [ $i -ge $TIMEOUT ]; then
+#     echo "Postgres did not start within $TIMEOUT seconds."
+#     exit 1
+#   fi
+#   sleep 1
+# done
+# echo "Postgres is ready!"
+
+cd /app/
+
+# patch database url
+# TODO: this should be possible upstream in BBB via an environment variable
+yq e -i ".[1].configuration.connection_info.database_url = \"$HASURA_GRAPHQL_BBB_DATABASE_URL\"" metadata/databases/databases.yaml
+
+sed -i "s/^admin_secret: .*/admin_secret: $HASURA_GRAPHQL_ADMIN_SECRET/g" /app/config.yaml
+
+echo "SELECT 'CREATE DATABASE hasura_app' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'hasura_app')\gexec" | psql
+
+echo "Restarting database bbb_graphql"
+psql -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE datname = 'bbb_graphql'" > /dev/null
+psql -c "drop database if exists bbb_graphql with (force)"
+psql -c "create database bbb_graphql WITH TEMPLATE template0 LC_COLLATE 'C.UTF-8'"
+psql -c "alter database bbb_graphql set timezone to 'UTC'"
+
+echo "Creating tables in bbb_graphql"
+psql -U postgres -d bbb_graphql -q -f bbb_schema.sql --set ON_ERROR_STOP=on
+
+echo "Starting hasura-graphql-engine"
+gosu nobody graphql-engine serve --log-level debug &
+PID=$!
+
+sleep 1
+
+
+#Check if Hasura is ready before applying metadata
+while ! netstat -tuln | grep ":$HASURA_GRAPHQL_SERVER_PORT " > /dev/null; do
+    echo "Waiting for Hasura's port ($HASURA_GRAPHQL_SERVER_PORT) to be ready..."
+    sleep 1
+done
+
+echo "Applying new metadata to Hasura"
+/usr/local/bin/hasura metadata apply --skip-update-check
+
+wait "$PID"
+
+#graphql-engine serve --log-level debug
\ No newline at end of file
diff --git a/entrypoint.bbb-web.sh b/entrypoint.bbb-web.sh
index 37dab05..c223a16 100644
--- a/entrypoint.bbb-web.sh
+++ b/entrypoint.bbb-web.sh
@@ -53,4 +53,4 @@ sleep 100
 cd /usr/share/bbb-web/
 dockerize \
     -template /etc/bigbluebutton/bbb-web.properties.tmpl:/etc/bigbluebutton/bbb-web.properties \
-    gosu bigbluebutton java -Dgrails.env=prod -Dserver.address=0.0.0.0 -Dserver.port=8090 -Dspring.main.allow-circular-references=true -Xms384m -Xmx384m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/bigbluebutton/diagnostics -cp WEB-INF/lib/*:/:WEB-INF/classes/:. org.springframework.boot.loader.WarLauncher
+    gosu bigbluebutton java -Dgrails.env=prod -Dserver.address=0.0.0.0 -Dserver.port=8090 -Dspring.main.allow-circular-references=true -Xms384m -Xmx384m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/bigbluebutton/diagnostics -cp WEB-INF/lib/*:/:WEB-INF/classes/:. org.springframework.boot.loader.launch.WarLauncher
diff --git a/entrypoint.freeswitch.sh b/entrypoint.freeswitch.sh
index 939c639..72e9643 100644
--- a/entrypoint.freeswitch.sh
+++ b/entrypoint.freeswitch.sh
@@ -80,6 +80,13 @@ fi
 
 
 export SOUNDS_PATH=$SOUNDS_DIR/$(echo "$SOUNDS_LANGUAGE" | sed 's|-|/|g')
+sed -i -e 's/10.7.7.10/0.0.0.0/g' /etc/freeswitch/vars.xml.tmpl
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/external.xml
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/external-ipv6.xml
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/internal.xml
+
+sed -i -e 's/$${local_ip_v4}/auto-nat/g' /etc/freeswitch/sip_profiles/external.xml
+#sed -i -e 's/$${local_ip_v4}/auto-nat/g' /etc/freeswitch/sip_profiles/external-ipv6.xml
 
 dockerize \
     -template /etc/freeswitch/vars.xml.tmpl:/etc/freeswitch/vars.xml \
diff --git a/mod/bbb-apps-akka.conf b/mod/bbb-apps-akka.conf
index ae21ad1..c451614 100644
--- a/mod/bbb-apps-akka.conf
+++ b/mod/bbb-apps-akka.conf
@@ -1,9 +1,7 @@
 // include default config from upstream
 include "/bbb-apps-akka/conf/application.conf"
 
-redis {
-    host="redis"
-}
+redis.host = "redis" 
 
 services {
   bbbWebAPI="https://DOMAIN/bigbluebutton/api"
diff --git a/mod/freeswitch/conf/sip_profiles/external.xml b/mod/freeswitch/conf/sip_profiles/external.xml
index 53c9de1..6a21ffb 100644
--- a/mod/freeswitch/conf/sip_profiles/external.xml
+++ b/mod/freeswitch/conf/sip_profiles/external.xml
@@ -101,8 +101,8 @@
     <param name="tls-verify-in-subjects" value=""/>
     <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 -->
     <param name="tls-version" value="$${sip_tls_version}"/>
-    <param name="ws-binding"  value=":5066"/>
-    <param name="wss-binding"  value=":7443"/>
+    <param name="ws-binding"  value="0.0.0.0:5066"/>
+    <param name="wss-binding"  value="0.0.0.0:7443"/>
 
     <!-- enable rtcp on every channel also can be done per leg basis with rtcp_audio_interval_msec variable set to passthru to pass it across a call-->
     <param name="rtcp-audio-interval-msec" value="5000"/>
diff --git a/mod/freeswitch/conf/vars.xml.tmpl b/mod/freeswitch/conf/vars.xml.tmpl
index b86502d..ec672c2 100644
--- a/mod/freeswitch/conf/vars.xml.tmpl
+++ b/mod/freeswitch/conf/vars.xml.tmpl
@@ -60,7 +60,7 @@
       affect the sip authentication.  Please review conf/directory/default.xml for more
       information on this topic.
   -->
-  <X-PRE-PROCESS cmd="set" data="local_ip_v4=10.7.7.10"/>
+  <X-PRE-PROCESS cmd="set" data="local_ip_v4=0.0.0.0"/>
   <X-PRE-PROCESS cmd="set" data="external_ip_v4={{ .Env.EXTERNAL_IPv4 }}"/>
 
   <X-PRE-PROCESS cmd="set" data="domain={{ .Env.DOMAIN }}"/>
diff --git a/mod/nginx/bbb/demo.nginx b/mod/nginx/bbb/demo.nginx
index 8b68775..5b9e3f7 100644
--- a/mod/nginx/bbb/demo.nginx
+++ b/mod/nginx/bbb/demo.nginx
@@ -3,24 +3,8 @@
         location = /demo/ {
           return 301 /demo/demo1.jsp;
         }
+        # temporarily since the original used host networking
         location /demo {
-           proxy_pass         http://host.docker.internal:8001;
-           proxy_redirect     default;
-           proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
-
-        # Allow 30M uploaded presentation document.
-           client_max_body_size       30m;
-           client_body_buffer_size    128k;
-
-           proxy_connect_timeout      90;
-           proxy_send_timeout         90;
-           proxy_read_timeout         90;
-
-           proxy_buffer_size          4k;
-           proxy_buffers              4 32k;
-           proxy_busy_buffers_size    64k;
-           proxy_temp_file_write_size 64k;
-
-           include    fastcgi_params;
+         return 404;
         }
 
diff --git a/mod/webrtc-sfu-config.yaml b/mod/webrtc-sfu-config.yaml
index 45c72da..b86f3dc 100644
--- a/mod/webrtc-sfu-config.yaml
+++ b/mod/webrtc-sfu-config.yaml
@@ -1,9 +1,11 @@
 kurento: []
 redisHost: redis
-clientHost: webrtc-sfu
+
+clientHost: 0.0.0.0 # this changed
+
 recordingAdapter: bbb-webrtc-recorder
 
-mcs-host: webrtc-sfu
+mcs-host: 0.0.0.0 # this changed
 mcs-address: webrtc-sfu
 freeswitch:
   ip: freeswitch
@@ -29,7 +31,7 @@ mediasoup:
     # Must match the port range published in compose.yml (24577-24676)
     rtcMinPort: 24577
     rtcMaxPort: 24676
-
+    disableLiburing: true
   plainRtp:
     listenIp:
       ip: "0.0.0.0"