diff --git a/Makefile b/Makefile
index 57f5e0e..2fd462c 100644
--- a/Makefile
+++ b/Makefile
@@ -3,20 +3,20 @@ clean-dev:
 	docker compose -f docker-compose.yml -f docker-compose.dev.yml down --volumes --remove-orphans
 
 dev:
-	docker compose -f docker-compose.yml -f docker-compose.dev.yml build
-	docker compose -f docker-compose.yml -f docker-compose.dev.yml up --remove-orphans
+	docker compose --env-file .env.dev -f docker-compose.yml -f docker-compose.dev.yml build
+	docker compose --env-file .env.dev -f docker-compose.yml -f docker-compose.dev.yml up --remove-orphans
 
 
 dev-redis-only:
-	docker compose -f docker-compose.yml -f docker-compose.dev.yml build redis
-	docker compose -f docker-compose.yml -f docker-compose.dev.yml up --remove-orphans redis
+	docker compose --env-file .env.dev -f docker-compose.yml -f docker-compose.dev.yml build redis
+	docker compose --env-file .env.dev -f docker-compose.yml -f docker-compose.dev.yml up --remove-orphans redis
 
 stop-dev:
 	docker compose -f docker-compose.yml -f docker-compose.dev.yml down --volumes
 
 prod:
-	docker compose build
-	docker compose up -d --remove-orphans
+	docker compose --env-file .env.prod build
+	docker compose --env-file .env.prod up -d --remove-orphans
 	docker buildx prune --keep-storage 20gb -f
 	docker image prune -f
 	docker system df
diff --git a/app/logs/.gitkeep b/app/logs/.gitkeep
deleted file mode 100644
index e69de29..0000000
diff --git a/app/shared/settings.py b/app/shared/settings.py
index e3b4f77..e962f1d 100644
--- a/app/shared/settings.py
+++ b/app/shared/settings.py
@@ -1,15 +1,16 @@
 
 from functools import lru_cache
+import os
 from fastapi_mail import ConnectionConfig
-from pydantic_settings import BaseSettings
-from pydantic import ConfigDict
+from pydantic_settings import BaseSettings, SettingsConfigDict
 from typing import Annotated, Set
 from annotated_types import Len
 
 
 class Settings(BaseSettings):
-    model_config = ConfigDict(extra='ignore', str_strip_whitespace=True)
     
+    model_config = SettingsConfigDict(env_file=os.environ.get("ENVIRONMENT_FILE") , env_file_encoding='utf-8', extra='ignore', str_strip_whitespace=True)
+
 	# general
     SERVE_LOCAL_ARCHIVE: str = ""
     USER_GROUPS_FILENAME: str = "user-groups.yaml"
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 3f5b264..5a8bc83 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -6,6 +6,7 @@ services:
     volumes:
       - ./app:/aa-api/app # for --reload to work
     environment:
+      - ENVIRONMENT_FILE=.env.dev
       - SERVE_LOCAL_ARCHIVE=/aa-api/app/local_archive # See orchestration.yaml local_storage.save_to
       - ALLOWED_ORIGINS=["http://localhost:8000","http://localhost:8004","http://localhost:8081","chrome-extension://ojcimmjndnlmmlgnjaeojoebaceokpdp"]
       - USER_GROUPS_FILENAME=/aa-api/app/user-groups.dev.yaml
@@ -20,7 +21,6 @@ services:
       - ./app:/aa-api/app # for watchmedo
 
   redis:
-    command: redis-server /conf/redis.conf --requirepass ${REDIS_PASSWORD}
     restart: "no"
     env_file: .env.dev
     ports:
diff --git a/docker-compose.yml b/docker-compose.yml
index d59e1c0..7c5cbd9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,11 +7,12 @@ services:
   web:
     build: 
       context: .
-      dockerfile: worker.Dockerfile
+      dockerfile: web.Dockerfile
     restart: always
     env_file: .env.prod
     environment:
       CELERY_BROKER_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
+      ENVIRONMENT_FILE: .env.prod
     ports:
       - "127.0.0.1:8004:8000"
     #TODO: should prod have the --reload flag?
@@ -42,6 +43,7 @@ services:
       - crawls:/crawls # BROWSERTRIX_HOME_HOST:BROWSERTRIX_HOME_CONTAINER, do not change /crawls
     environment:
       CELERY_BROKER_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
+      ENVIRONMENT_FILE: .env.prod
       WACZ_ENABLE_DOCKER: 1 # Enable calling docker from this container
       BROWSERTRIX_HOME_HOST: auto-archiver-api_crawls
       BROWSERTRIX_HOME_CONTAINER: /crawls
@@ -57,6 +59,7 @@ services:
   redis:
     image: redis:6-alpine
     restart: always
+    env_file: .env.prod
     command: redis-server /conf/redis.conf --requirepass ${REDIS_PASSWORD}
     volumes:
       - ./redis/data:/data
diff --git a/web.Dockerfile b/web.Dockerfile
new file mode 100644
index 0000000..9c73efc
--- /dev/null
+++ b/web.Dockerfile
@@ -0,0 +1,23 @@
+# Stage 1: install dependencies
+FROM python:3.10-slim AS build
+
+WORKDIR /aa-api
+# TODO: multistage build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    gcc \
+    g++ \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip install --no-cache-dir poetry
+COPY pyproject.toml poetry.lock .
+RUN poetry install --with web --no-interaction --no-ansi --no-root --no-cache
+
+# Copy the application code
+COPY alembic.ini ./
+COPY .env* ./app/
+COPY ./secrets/ ./secrets/
+COPY ./app/ ./app/
+
+# Run the FastAPI app with Uvicorn
+ENTRYPOINT ["poetry", "run"]