diff --git a/.env.sample b/.env.sample
index f90a695..6e16b7d 100644
--- a/.env.sample
+++ b/.env.sample
@@ -6,3 +6,12 @@ DOMAIN=grist.example.com
 #EXTRA_DOMAINS=', `www.grist.example.com`'
 
 LETS_ENCRYPT_ENV=production
+GRIST_SUPPORT_ANON=false
+SECRET_GRIST_SESSION_SECRET_VERSION=v1
+#GRIST_SANDBOX_FLAVOR=
+GRIST_SINGLE_ORG="yourorg"
+GRIST_ORG_IN_PATH=true
+COOKIE_MAX_AGE=7776000000
+GRIST_FORCE_LOGIN=true
+GRIST_HIDE_UI_ELEMENTS=billing,sendToDrive
+GRIST_DEFAULT_EMAIL=grist@example.com
diff --git a/.env.sample~ b/.env.sample~
new file mode 100644
index 0000000..f90a695
--- /dev/null
+++ b/.env.sample~
@@ -0,0 +1,8 @@
+TYPE=grist
+
+DOMAIN=grist.example.com
+
+## Domain aliases
+#EXTRA_DOMAINS=', `www.grist.example.com`'
+
+LETS_ENCRYPT_ENV=production
diff --git a/compose.yml b/compose.yml
index 81c1590..aab4fe1 100644
--- a/compose.yml
+++ b/compose.yml
@@ -1,16 +1,19 @@
 services:
-  grist:
+  app:
     image: gristlabs/grist:1.1.7
     networks:
       - proxy
       - internal
     environment:
       - GRIST_DATABASE_URL=postgresql://${STACK_NAME}_db:5432/grist
-      - GRIST_REDIS_URL=redis://${STACK_NAME}_redis:6379
+      - TYPEORM_DATABASE=grist
+      - TYPEORM_TYPE=postgres
+      - TYPEORM_USERNAME=grist
+      - REDIS_URL=redis://${STACK_NAME}_redis:6379
       - GRIST_DATA_DIR=/var/grist-data
       - GRIST_SUPPORT_ANON
-      - GRIST_SESSION_SECRET
-      - GRIST_SANDBOX_FLAVOR
+      - SESSION_SECRET_FILE=/run/secrets/
+      - GRIST_SANDBOX_FLAVOR=unsandboxed
       - APP_HOME_URL=https://${DOMAIN}
       - APP_DOC_URL=https://${DOMAIN}
       - GRIST_SINGLE_ORG
@@ -19,8 +22,9 @@ services:
       - GRIST_FORCE_LOGIN
       - GRIST_HIDE_UI_ELEMENTS
       - GRIST_DEFAULT_EMAIL
+    secrets:
+      - session_secret
     volumes:
-      - grist_keys:/keys
       - grist_data:/persist
     depends_on:
       - db
@@ -59,13 +63,15 @@ services:
 secrets:
   db_password:
     external: true
-    name: ${STACK_NAME}_db_password
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+  session_secret:
+    external: true
+    name: ${STACK_NAME}_session_secret_${SECRET_SESSION_SECRET_VERSION}
 
 volumes:
   postgresql_data:
   redis_data:
   grist_data:
-  grist_keys:
 
 
 networks: