diff --git a/.env.sample b/.env.sample
index 1ce294b..099d18d 100644
--- a/.env.sample
+++ b/.env.sample
@@ -6,3 +6,14 @@ DOMAIN=farmos.example.com
 #EXTRA_DOMAINS=', `www.farmos.example.com`'
 
 LETS_ENCRYPT_ENV=production
+
+SECRET_DB_PASSWORD_VERSION=v1
+
+# Uncomment these settings if you plan to use the `site_install` command
+#SITE_NAME="My FarmOS"
+#SITE_MAIL="farmos@farmos.example.com"
+#
+#FARM_MODULES="default"  # or set to "all" to install all FarmOS modules
+#
+## Admin 
+#ACCOUNT_MAIL="farmos@farmos.example.com"
diff --git a/abra.sh b/abra.sh
new file mode 100644
index 0000000..6896837
--- /dev/null
+++ b/abra.sh
@@ -0,0 +1,8 @@
+
+site_install(){
+		drush site:install \
+			--db-url="postgres://farm:$(cat /run/secrets/db_password)@db/farm" \
+			--site-name "$SITE_NAME" \
+			--site-mail "$SITE_MAIL" --account-mail "$ACCOUNT_MAIL" \
+			farm "$FARM_MODULES"
+}
diff --git a/compose.yml b/compose.yml
index 20e699b..5b08e44 100644
--- a/compose.yml
+++ b/compose.yml
@@ -7,7 +7,13 @@ services:
     volumes:
       #- farmos_sites:/opt/drupal/
       - farmos_sites:/opt/drupal/web/sites/
-    # entrypoint: ['tail', '-f', '/dev/null']
+    environment:
+      - ACCOUNT_MAIL
+      - SITE_NAME
+      - SITE_MAIL
+      - FARM_MODULES
+    secrets:
+      - db_password
     networks:
       - proxy
       - internal
@@ -40,10 +46,18 @@ services:
       - internal
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    secrets:
+      - db_password
     environment:
       POSTGRES_USER: farm
-      POSTGRES_PASSWORD: farm
+      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
       POSTGRES_DB: farm
+    deploy:
+      labels:
+        backupbot.backup: "true"
+        backupbot.backup.pre-hook: "bash -c 'PGPASSWORD=farm pg_dump -U farm farm > /tmp/backup.sql'"
+        backupbot.backup.post-hook: "rm -f /tmp/backup.sql"
+        backupbot.backup.path: "/tmp/backup.sql"
 
 networks:
   proxy:
@@ -53,3 +67,8 @@ networks:
 volumes:
   farmos_sites:
   postgres_data:
+
+secrets:
+  db_password:
+    external: true
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}