diff --git a/myspotify/.env.example b/myspotify/.env.example
index 1a938bd..55a0d4b 100644
--- a/myspotify/.env.example
+++ b/myspotify/.env.example
@@ -1,6 +1,3 @@
-# Base path for persistent data
-MYSPOTIFY_DATA=/path/to/myspotify/data
-
 # Domains to access MySpotify / Backend
 MYSPOTIFY_DOMAIN=myspotify.domain
 MYSPOTIFY_BACKEND_DOMAIN=myspotify-backend.domain
@@ -8,3 +5,8 @@ MYSPOTIFY_BACKEND_DOMAIN=myspotify-backend.domain
 # Spotify app public and secret keys
 MYSPOTIFY_APP_PUBLIC=myspotify_app_public
 MYSPOTIFY_APP_SECRET=myspotify_app_secret
+
+# MongoDB root user, created on first start (empty volume only).
+# Use URL-safe characters: they are embedded in the connection string.
+MYSPOTIFY_MONGO_USER=myspotify
+MYSPOTIFY_MONGO_PASSWORD=change_me_url_safe
diff --git a/myspotify/README.md b/myspotify/README.md
index c493a01..71b5bbd 100644
--- a/myspotify/README.md
+++ b/myspotify/README.md
@@ -7,18 +7,49 @@ and frontend client.
 
 ## Environment Variables
 
-| Variable                   | Description                       |
-|----------------------------|-----------------------------------|
-| `MYSPOTIFY_DATA`           | Local path for database storage   |
-| `MYSPOTIFY_DOMAIN`         | Domain to access the web interface|
-| `MYSPOTIFY_BACKEND_DOMAIN` | Domain for the backend API        |
-| `MYSPOTIFY_APP_PUBLIC`     | Spotify application public key    |
-| `MYSPOTIFY_APP_SECRET`     | Spotify application secret key    |
+| Variable                   | Description                        |
+|----------------------------|------------------------------------|
+| `MYSPOTIFY_DOMAIN`         | Domain to access the web interface |
+| `MYSPOTIFY_BACKEND_DOMAIN` | Domain for the backend API         |
+| `MYSPOTIFY_APP_PUBLIC`     | Spotify application public key     |
+| `MYSPOTIFY_APP_SECRET`     | Spotify application secret key     |
+| `MYSPOTIFY_MONGO_USER`     | MongoDB root user                  |
+| `MYSPOTIFY_MONGO_PASSWORD` | MongoDB root password (URL-safe)   |
+
+MongoDB creates the root user only on its first start, with an
+empty volume. Changing these variables later does not change the
+user; update it inside MongoDB as well.
+
+## Volumes
+
+| Volume                 | Mount      | Contents         | Backup  |
+|------------------------|------------|------------------|---------|
+| `myspotify-mongo-data` | `/data/db` | MongoDB database | Dokploy |
+
+The stack does not back itself up. Configure a Dokploy compose
+backup for the `myspotify-mongo` service (database `your_spotify`,
+type MongoDB, with the root credentials above) and test a restore.
+
+## Migrating from the host-path version
+
+Earlier versions stored MongoDB in `${MYSPOTIFY_DATA}/mongo`
+without authentication. The new volume starts empty; nothing is
+migrated automatically.
+
+1. Stop the old stack and dump the old database:
+   `docker exec myspotify-mongo mongodump -d your_spotify --archive --gzip > your_spotify.archive.gz`
+2. Deploy this version, so MongoDB creates the root user in the
+   new volume.
+3. Restore the dump into the new database (Dokploy restore, or
+   `mongorestore --archive --gzip --drop` with the root
+   credentials) before using the app.
 
 ## Networks
 
-Connects to `cloudflare-exposed`
-(must be created by the `cloudflared` service first).
+No network is declared in the compose file — Dokploy
+attaches its own network automatically on deploy.
+The web interface (port 3000) and the API (port 8080) are
+published through Dokploy domains.
 
 ## Kernel 7.0 workaround (MongoDB)
 
diff --git a/myspotify/docker-compose.yml b/myspotify/docker-compose.yml
index c8fe239..3186e0d 100644
--- a/myspotify/docker-compose.yml
+++ b/myspotify/docker-compose.yml
@@ -15,12 +15,10 @@ services:
       timeout: 10s
       retries: 3
       start_period: 30s
-    networks:
-      - cloudflare-exposed
     environment:
       API_ENDPOINT: https://${MYSPOTIFY_BACKEND_DOMAIN}
       CLIENT_ENDPOINT: https://${MYSPOTIFY_DOMAIN}
-      MONGO_ENDPOINT: mongodb://myspotify-mongo:27017/your_spotify
+      MONGO_ENDPOINT: mongodb://${MYSPOTIFY_MONGO_USER:?MYSPOTIFY_MONGO_USER is required}:${MYSPOTIFY_MONGO_PASSWORD:?MYSPOTIFY_MONGO_PASSWORD is required}@myspotify-mongo:27017/your_spotify?authSource=admin
       SPOTIFY_PUBLIC: ${MYSPOTIFY_APP_PUBLIC}
       SPOTIFY_SECRET: ${MYSPOTIFY_APP_SECRET}
     logging:
@@ -44,11 +42,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 30s
-    networks:
-      - cloudflare-exposed
     volumes:
-      - ${MYSPOTIFY_DATA}/mongo:/data/db
+      - myspotify-mongo-data:/data/db
     environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MYSPOTIFY_MONGO_USER:?MYSPOTIFY_MONGO_USER is required}
+      MONGO_INITDB_ROOT_PASSWORD: ${MYSPOTIFY_MONGO_PASSWORD:?MYSPOTIFY_MONGO_PASSWORD is required}
       # MongoDB 8 refuses to start on kernel >= 6.19 unless it is 7.0.14+;
       # Ubuntu HWE reports 7.0.0-N, so it is rejected. See README.
       GLIBC_TUNABLES: glibc.pthread.rseq=1
@@ -73,8 +71,6 @@ services:
       timeout: 10s
       retries: 3
       start_period: 30s
-    networks:
-      - cloudflare-exposed
     environment:
       API_ENDPOINT: https://${MYSPOTIFY_BACKEND_DOMAIN}
     logging:
@@ -84,12 +80,6 @@ services:
         max-file: "3"
     labels:
       - com.centurylinklabs.watchtower.enable=true
-      - homepage.group=Media
-      - homepage.name=My Spotify
-      - homepage.icon=spotify.png
-      - homepage.href=https://${MYSPOTIFY_DOMAIN}
-      - homepage.description=Spotify listening history and stats
 
-networks:
-  cloudflare-exposed:
-    external: true
+volumes:
+  myspotify-mongo-data: