diff --git a/.envrc.sample b/.envrc.sample
index 62d3083..f004c62 100644
--- a/.envrc.sample
+++ b/.envrc.sample
@@ -10,3 +10,5 @@ export MEDIAWIKI_EMAIL_FROM="wiki@wiki.example.com"
 
 export DB_ROOT_PASSWD_VERSION=v1
 export DB_PASSWD_VERSION=v1
+export LOCAL_SETTINGS_CONF_VERSION=v1
+export ENTRYPOINT_CONF_VERSION=v1
diff --git a/LocalSettings.php.tmpl b/LocalSettings.php.tmpl
new file mode 100644
index 0000000..e65582a
--- /dev/null
+++ b/LocalSettings.php.tmpl
@@ -0,0 +1,162 @@
+<?php
+# This file was automatically generated by the MediaWiki 1.32.1
+# installer. If you make manual changes, please keep track in case you
+# need to recreate them later.
+#
+# See includes/DefaultSettings.php for all configurable settings
+# and their default values, but don't forget to make changes in _this_
+# file, not there.
+#
+# Further documentation for configuration settings may be found at:
+# https://www.mediawiki.org/wiki/Manual:Configuration_settings
+
+# Protect against web entry
+if ( !defined( 'MEDIAWIKI' ) ) {
+	exit;
+}
+
+
+## Uncomment this to disable output compression
+# $wgDisableOutputCompression = true;
+
+$wgSitename = "{{ env "MEDIAWIKI_SITENAME" }}";
+$wgMetaNamespace = "{{ env "MEDIAWIKI_SITENAMESPACE" }}";
+
+## The URL base path to the directory containing the wiki;
+## defaults for all runtime URL paths are based off of this.
+## For more information on customizing the URLs
+## (like /w/index.php/Page_title to /wiki/Page_title) please see:
+## https://www.mediawiki.org/wiki/Manual:Short_URL
+$wgScriptPath = "";
+
+## The protocol and server name to use in fully-qualified URLs
+$wgServer = "https://{{ env "DOMAIN" }}";
+
+## The URL path to static resources (images, scripts, etc.)
+$wgResourceBasePath = $wgScriptPath;
+
+## The URL path to the logo.  Make sure you change this from the default,
+## or else you'll overwrite your logo when you upgrade!
+$wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
+
+## UPO means: this is also a user preference option
+
+$wgEnableEmail = true;
+$wgEnableUserEmail = true; # UPO
+
+$wgEmergencyContact = "{{ env "MEDIAWIKI_EMAIL_CONTACT" }}";
+$wgPasswordSender = "{{ env "MEDIAWIKI_EMAIL_FROM" }}";
+
+$wgEnotifUserTalk = false; # UPO
+$wgEnotifWatchlist = false; # UPO
+$wgEmailAuthentication = true;
+
+## Database settings
+$wgDBtype = "mysql";
+$wgDBserver = "mariadb";
+$wgDBname = "mediawiki";
+$wgDBuser = "mediawiki";
+$wgDBpassword = "{{ secret "db_password" }}";
+
+# MySQL specific settings
+$wgDBprefix = "";
+
+# MySQL table options to use during installation or update
+$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
+
+## Shared memory settings
+$wgMainCacheType = CACHE_ACCEL;
+$wgMemCachedServers = [];
+
+## To enable image uploads, make sure the 'images' directory
+## is writable, then set this to true:
+$wgEnableUploads = true;
+$wgUseImageMagick = true;
+$wgImageMagickConvertCommand = "/usr/bin/convert";
+
+# InstantCommons allows wiki to use images from https://commons.wikimedia.org
+$wgUseInstantCommons = false;
+
+# Periodically send a pingback to https://www.mediawiki.org/ with basic data
+# about this MediaWiki instance. The Wikimedia Foundation shares this data
+# with MediaWiki developers to help guide future development efforts.
+$wgPingback = false;
+
+## If you use ImageMagick (or any other shell command) on a
+## Linux server, this will need to be set to the name of an
+## available UTF-8 locale
+$wgShellLocale = "C.UTF-8";
+
+## Set $wgCacheDirectory to a writable directory on the web server
+## to make your wiki go slightly faster. The directory should not
+## be publically accessible from the web.
+#$wgCacheDirectory = "$IP/cache";
+
+# Site language code, should be one of the list in ./languages/data/Names.php
+$wgLanguageCode = "en";
+
+$wgSecretKey = "8a83180cd66683c2a379882211187d6f79a1d40749b962598148f67893ff10cf";
+
+# Changing this will log out all existing sessions.
+$wgAuthenticationTokenVersion = "1";
+
+# Site upgrade key. Must be set to a string (default provided) to turn on the
+# web installer while LocalSettings.php is in place
+$wgUpgradeKey = "";
+
+## For attaching licensing metadata to pages, and displaying an
+## appropriate copyright notice / icon. GNU Free Documentation
+## License and Creative Commons licenses are supported so far.
+$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
+$wgRightsUrl = "";
+$wgRightsText = "";
+$wgRightsIcon = "";
+
+# Path to the GNU diff3 utility. Used for conflict resolution.
+$wgDiff3 = "/usr/bin/diff3";
+
+# The following permissions were set based on your choice in the installer
+$wgGroupPermissions['*']['createaccount'] = false;
+$wgGroupPermissions['*']['edit'] = false;
+$wgGroupPermissions['*']['read'] = false;
+
+## Default skin: you can change the default skin. Use the internal symbolic
+## names, ie 'vector', 'monobook':
+$wgDefaultSkin = "vector";
+
+# Enabled skins.
+# The following skins were automatically enabled:
+wfLoadSkin( 'MonoBook' );
+wfLoadSkin( 'Timeless' );
+wfLoadSkin( 'Vector' );
+
+
+# Enabled extensions. Most of the extensions are enabled by adding
+# wfLoadExtensions('ExtensionName');
+# to LocalSettings.php. Check specific extension documentation for more details.
+# The following extensions were automatically enabled:
+wfLoadExtension( 'VisualEditor' );
+
+# End of automatically generated settings.
+# Add more configuration options below.
+
+$wgDefaultUserOptions['visualeditor-enable'] = 1;
+
+$wgVisualEditorAllowLossySwitching = false;
+
+$wgVirtualRestConfig['modules']['parsoid'] = [
+	// URL to the Parsoid instance - use port 8142 if you use the Debian package - the parameter 'URL' was first used but is now deprecated (string)
+	'url' => 'http://localhost:8000/',
+	// Parsoid "domain" (string, optional) - MediaWiki >= 1.26
+	'domain' => 'localhost',
+	// Parsoid "prefix" (string, optional) - deprecated since MediaWiki 1.26, use 'domain'
+	'prefix' => 'localhost',
+	// Forward cookies in the case of private wikis (string or false, optional)
+	'forwardCookies' => true,
+	// request timeout in seconds (integer or null, optional)
+	'timeout' => null,
+	// Parsoid HTTP proxy (string or null, optional)
+	'HTTPProxy' => null,
+	// whether to parse URL as if they were meant for RESTBase (boolean or null, optional)
+	'restbaseCompat' => null,
+];
diff --git a/compose.yml b/compose.yml
index 844cd79..cafb686 100644
--- a/compose.yml
+++ b/compose.yml
@@ -27,11 +27,23 @@ services:
     environment:
       - DOMAIN=${DOMAIN}
       - STACK_NAME=${STACK_NAME}
+      - MEDIAWIKI_EMAIL_CONTACT=${MEDIAWIKI_EMAIL_CONTACT}
+      - MEDIAWIKI_EMAIL_FROM=${MEDIAWIKI_EMAIL_FROM}
+      - MEDIAWIKI_SITENAME=${MEDIAWIKI_SITENAME}
+      - MEDIAWIKI_SITENAMESPACE=${MEDIAWIKI_SITENAMESPACE}
     volumes:
-      - 'mediawiki:/var/www/html'
+      - 'mediawiki_images:/var/www/html/images'
       - 'parsoid:/usr/lib/parsoid'
+    configs:
+      - source: LocalSettings_conf
+        target: /var/www/html/LocalSettings.php
+      - source: entrypoint2_conf
+        target: /docker-entrypoint2.sh
+        mode: 0555
     depends_on:
       - mariadb
+    secrets:
+      - db_password
     networks:
       - proxy
       - internal
@@ -44,10 +56,11 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+    entrypoint: /docker-entrypoint2.sh
 
 volumes:
   mariadb:
-  mediawiki:
+  mediawiki_images:
   parsoid:
 
 networks:
@@ -57,8 +70,18 @@ networks:
 
 secrets:
   db_root_password:
-    name: ${STACK_NAME}_db_root_password_${DB_ROOT_PASSWD_VERSION}
+    name: ${STACK_NAME}_db_root_password_${DB_ROOT_PASSWORD_VERSION}
     external: true
   db_password:
-    name: ${STACK_NAME}_db_password_${DB_PASSWD_VERSION}
+    name: ${STACK_NAME}_db_password_${DB_PASSWORD_VERSION}
     external: true
+
+configs:
+  LocalSettings_conf:
+    name: ${STACK_NAME}_local_settings_${LOCAL_SETTINGS_CONF_VERSION}
+    file: LocalSettings.php.tmpl
+    template_driver: golang
+  entrypoint2_conf:
+    name: ${STACK_NAME}_entrypoint2_${ENTRYPOINT_CONF_VERSION}
+    file: entrypoint.sh
+    template_driver: golang
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100755
index 0000000..1ce4733
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+init_db() {
+		set -eu
+
+		apt update && apt install -y mariadb-client
+
+		PASSWORD=`cat /run/secrets/db_password`
+		TABLE_COUNT=$(mysql -u mediawiki --password="$PASSWORD" -h mariadb mediawiki -e "SELECT count(*) AS TOTAL FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = 'mediawiki';" -N -B)
+
+    if [[ "${TABLE_COUNT}" == "0" ]]; then
+			mysql -u mediawiki --password="$PASSWORD" -h mariadb mediawiki < /var/www/html/maintenance/tables.sql
+		else
+			php /var/www/html/maintenance/update.php
+		fi
+}
+
+main() {
+		set -eu
+
+		init_db
+}
+
+main
+
+/docker-entrypoint.sh apache2-foreground "$@"