diff --git a/.env.sample b/.env.sample
index 75ba12d..3b010f8 100644
--- a/.env.sample
+++ b/.env.sample
@@ -5,8 +5,6 @@ DOMAIN=wallabag.example.com
 #EXTRA_DOMAINS=', `www.wallabag.example.com`'
 LETS_ENCRYPT_ENV=production
 
-SECRET_DB_PASSWORD_VERSION=v1
-SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_APP_SECRET_VERSION=v1
 SECRET_SMTP_PASSWORD_VERSION=v1
 
@@ -15,3 +13,9 @@ SYMFONY__ENV__FOSUSER_REGISTRATION=true
 SYMFONY__ENV__MAILER_HOST=127.0.0.1
 SYMFONY__ENV__MAILER_USER=~
 SYMFONY__ENV__FROM_EMAIL=
+
+COMPOSE_FILE="compose.yml"
+# MariaDB support
+COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
+SECRET_DB_PASSWORD_VERSION=v1
+SECRET_DB_ROOT_PASSWORD_VERSION=v1
diff --git a/compose.mariadb.yml b/compose.mariadb.yml
new file mode 100644
index 0000000..83081a0
--- /dev/null
+++ b/compose.mariadb.yml
@@ -0,0 +1,44 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql
+      - SYMFONY__ENV__DATABASE_HOST=db
+      - SYMFONY__ENV__DATABASE_PORT=3306
+      - SYMFONY__ENV__DATABASE_NAME=wallabag
+      - SYMFONY__ENV__DATABASE_USER=wallabag
+      # FIXME: use Docker secrets, see
+      # https://github.com/wallabag/docker/issues/186
+      - SYMFONY__ENV__DATABASE_PASSWORD_FILE=/run/secrets/db_password
+      - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4
+    secrets:
+      - db_password
+  db:
+    image: mariadb:11.2
+    environment:
+      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
+      - MYSQL_USER=wallabag
+      - MYSQL_DATABASE=wallabag
+      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
+    volumes:
+      - mariadb:/var/lib/mysql
+    networks:
+      - internal
+    secrets:
+      - db_password
+      - db_root_password
+volumes:
+  mariadb:
+
+networks:
+  proxy:
+    external: true
+  internal:
+
+secrets:
+  db_password:
+    external: true
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+  db_root_password:
+    external: true
+    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
diff --git a/compose.yml b/compose.yml
index c51d285..8a0a501 100644
--- a/compose.yml
+++ b/compose.yml
@@ -5,15 +5,6 @@ services:
     environment:
       # Prevent database creation (handled by MySQL service)
       - POPULATE_DATABASE="false"
-      - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql
-      - SYMFONY__ENV__DATABASE_HOST=db
-      - SYMFONY__ENV__DATABASE_PORT=3306
-      - SYMFONY__ENV__DATABASE_NAME=wallabag
-      - SYMFONY__ENV__DATABASE_USER=wallabag
-      # FIXME: use Docker secrets, see
-      # https://github.com/wallabag/docker/issues/186
-      - SYMFONY__ENV__DATABASE_PASSWORD_FILE=/run/secrets/db_password
-      - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4
       - SYMFONY__ENV__MAILER_HOST
       - SYMFONY__ENV__MAILER_USER
       - SYMFONY__ENV__MAILER_PASSWORD_FILE=/run/secrets/smtp_password
@@ -27,7 +18,6 @@ services:
       - proxy
       - internal
     secrets:
-      - db_password
       - app_secret
       - smtp_password
     entrypoint: /custom-entrypoint.sh
@@ -49,27 +39,12 @@ services:
         #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
         #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - "coop-cloud.${STACK_NAME}.version=0.5.2+2.6.8"
-  db:
-    image: mariadb:11.2
-    environment:
-      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
-      - MYSQL_USER=wallabag
-      - MYSQL_DATABASE=wallabag
-      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
-    volumes:
-      - mariadb:/var/lib/mysql
-    networks:
-      - internal
-    secrets:
-      - db_password
-      - db_root_password
   redis:
     image: redis:7.2.4-alpine
     networks:
       - internal
 volumes:
   images:
-  mariadb:
 
 networks:
   proxy:
@@ -77,12 +52,6 @@ networks:
   internal:
 
 secrets:
-  db_password:
-    external: true
-    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
-  db_root_password:
-    external: true
-    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
   app_secret:
     external: true
     name: ${STACK_NAME}_app_secret_${SECRET_APP_SECRET_VERSION}