diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml
index 64f6ab9..98b5d7f 100644
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@@ -1,24 +1,76 @@
-version: '3'
+version: '3.8'
 
 services:
   ingress:
+    init: true
     image: nginx:alpine
-    restart: unless-stopped
+    depends_on:
+      - certbot
+      - frontend
+    deploy:
+      replicas: 2
+      resources:
+        limits:
+          cpus: '0.10'
+          memory: 32M
+        reservations:
+          cpus: '0.10'
+          memory: 32M
+      update_config:
+        parallelism: 1
+        failure_action: rollback
+        delay: 10s
+        monitor: 10s
+      restart_policy:
+        condition: on-failure
+        window: 30s
     ports:
       - "80:80"
       - "443:443"
     command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
     volumes:
-      - ./data/nginx:/etc/nginx/conf.d
       - ./data/certbot/conf:/etc/letsencrypt
       - ./data/certbot/www:/var/www/certbot
-  frontend:
-    image: declared-frontend
-    restart: unless-stopped
+
   certbot:
+    init: true
     image: certbot/certbot
-    restart: unless-stopped
+    deploy:
+      replicas: 1
+      resources:
+        limits:
+          cpus: '0.05'
+          memory: 16M
+        reservations:
+          cpus: '0.05'
+          memory: 16M
+      restart_policy:
+        condition: on-failure
+        window: 30s
     entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
     volumes:
       - ./data/certbot/conf:/etc/letsencrypt
       - ./data/certbot/www:/var/www/certbot
+  
+  frontend:
+    init: true
+    image: schmelczera/declared-frontend
+    ports:
+      - "80"
+    deploy:
+      replicas: 2
+      resources:
+        limits:
+          cpus: '0.15'
+          memory: 128M
+        reservations:
+          cpus: '0.15'
+          memory: 128M
+      update_config:
+        parallelism: 1
+        failure_action: rollback
+        delay: 10s
+        monitor: 10s
+      restart_policy:
+        condition: on-failure
+        window: 30s
diff --git a/infrastructure/ingress.md b/infrastructure/ingress.md
deleted file mode 100644
index c91ff1b..0000000
--- a/infrastructure/ingress.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# How to configure ingress from digital ocean docker one-click app
-
-## iptables (remote)
-
-```sh
-iptables -L ufw-user-input
-iptables -D ufw-user-input 4
-iptables -D ufw-user-input 4
-iptables -I ufw-user-input -p tcp --dport 80 -j ACCEPT
-iptables -I ufw-user-input -p tcp --dport 443 -j ACCEPT
-```
-> Disable Docker ports and enable HTTP(S) ports
-
-## Other (remote)
-
-```sh
-apt update && apt upgrade -y
-rm -rf /etc/update-motd.d/99-one-click
-```
-
-## Copy (local)
-
-```sh
-scp -r infrastructure root@164.90.220.12:/root/infra
-```
\ No newline at end of file
diff --git a/infrastructure/init-letsencrypt.sh b/infrastructure/init-letsencrypt.sh
index 6a0138a..5cc9d50 100644
--- a/infrastructure/init-letsencrypt.sh
+++ b/infrastructure/init-letsencrypt.sh
@@ -2,26 +2,10 @@
 
 # Source https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
 
-DOCKER_HOST=ssh://root@decla.red 
-
-if ! [ -x "$(command -v docker-compose)" ]; then
-  echo 'Error: docker-compose is not installed.' >&2
-  exit 1
-fi
-
 domains=(decla.red)
 rsa_key_size=4096
 data_path="./data/certbot"
 email="schmelczerandras@gmail.com" # Adding a valid address is strongly recommended
-staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
-
-if [ -d "$data_path" ]; then
-  read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
-  if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
-    exit
-  fi
-fi
-
 
 if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
   echo "### Downloading recommended TLS parameters ..."
@@ -68,9 +52,6 @@ case "$email" in
   *) email_arg="--email $email" ;;
 esac
 
-# Enable staging mode if needed
-if [ $staging != "0" ]; then staging_arg="--staging"; fi
-
 docker-compose run --rm --entrypoint "\
   certbot certonly --webroot -w /var/www/certbot \
     $staging_arg \
diff --git a/infrastructure/init-remote.sh b/infrastructure/init-remote.sh
new file mode 100644
index 0000000..361e1e2
--- /dev/null
+++ b/infrastructure/init-remote.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+REMOTE_ADDRESS=$1
+echo Initializing new machine, $REMOTE_ADDRESS
+
+cat init-remote.sh | ssh $REMOTE_ADDRESS
diff --git a/infrastructure/init.sh b/infrastructure/init.sh
new file mode 100644
index 0000000..b95809c
--- /dev/null
+++ b/infrastructure/init.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+echo Configuring iptables
+echo Start state
+iptables -L ufw-user-input
+
+iptables -D ufw-user-input 4
+iptables -D ufw-user-input 4
+iptables -I ufw-user-input -p tcp --dport 22 -j ACCEPT
+iptables -I ufw-user-input -p tcp --dport 80 -j ACCEPT
+iptables -I ufw-user-input -p tcp --dport 443 -j ACCEPT
+
+echo End state
+iptables -L ufw-user-input
+
+echo Updating system
+apt update              &&\
+apt upgrade -y          &&\
+apt install zsh         &&\
+sh -c "$(CHSH=yes curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
+
+echo Removing banner
+rm -rf /etc/update-motd.d/99-one-click
+
+docker swarm init --advertise-addr eth0
+
+./init-letsencrypt.sh
+
+docker-compose down
diff --git a/ingress/Dockerfile b/ingress/Dockerfile
new file mode 100644
index 0000000..4bc4c14
--- /dev/null
+++ b/ingress/Dockerfile
@@ -0,0 +1,3 @@
+FROM nginx:alpine
+
+COPY app.conf /etc/nginx/conf.d/
diff --git a/infrastructure/data/nginx/app.conf b/ingress/app.conf
similarity index 100%
rename from infrastructure/data/nginx/app.conf
rename to ingress/app.conf