diff --git a/wg-easy/readme.md b/wg-easy/readme.md
index 90dc28e..d6cc0f9 100644
--- a/wg-easy/readme.md
+++ b/wg-easy/readme.md
@@ -23,11 +23,9 @@ Written in javascript.
     └── docker/
         └── wg-easy/
             ├── 🗁 wireguard_data/
-            ├── 🗋 .env
             └── 🗋 docker-compose.yml
 ```              
 * `wireguard_data/` - a directory with wireguard config files
-* `.env` - a file containing environment variables for docker compose
 * `docker-compose.yml` - a docker compose file, telling docker how to run the container
 
 # Compose
@@ -37,62 +35,50 @@ Written in javascript.
 services:
 
   wg-easy:
-    image: ghcr.io/wg-easy/wg-easy:14
+    image: ghcr.io/wg-easy/wg-easy:15.4
     container_name: wg-easy
     hostname: wg-easy
     restart: unless-stopped
-    env_file: .env
     volumes:
       - ./wireguard_data:/etc/wireguard
+      - /lib/modules:/lib/modules:ro
     ports:
       - "51820:51820/udp"  # vpn traffic
-      - "51821:51821"      # web interface
+    expose:
+      - "51821"  # web interface
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
     sysctls:
       - net.ipv4.ip_forward=1
       - net.ipv4.conf.all.src_valid_mark=1
+    environment:
+      - INSECURE=true
+      - DISABLE_IPV6=true
+      # unattended setup on first run
+      - INIT_ENABLED=true
+      - INIT_USERNAME=myspecialadmin
+      - INIT_PASSWORD=mysecretpasswordthatislong12charAtleast
+      - INIT_HOST=vpn.example.com
+      - INIT_PORT=51820
+      - INIT_DNS=
+      - INIT_ALLOWED_IPS=192.168.1.0/24
 
 networks:
   default:
-    name: $DOCKER_MY_NETWORK
+    name: caddy_net
     external: true
 ```
 
-`.env`
-```bash
-# GENERAL
-DOCKER_MY_NETWORK=caddy_net
-TZ=Europe/Bratislava
-
-#WG-EASY
-WG_HOST=vpn.example.com           # can also be just public IP
-# PASSWORD=supersecretpassword
-PASSWORD_HASH=$$2a$$12$$52a84HoSf99aLL7lmt9NsO0hlhZmGuJnyBK.bToiSdbQhTvMjV3ce
-WG_PORT=51820
-WG_DEFAULT_ADDRESS=10.221.221.x
-WG_ALLOWED_IPS=192.168.1.0/24
-WG_DEFAULT_DNS=
-```
-
-In version 14 `PASSWORD` as env variable is no longer allowed
-and `PASSWORD_HASH` must be used.<br>
-It is [a bcrypt hash](https://github.com/wg-easy/wg-easy/blob/master/How_to_generate_an_bcrypt_hash.md)
-of the password and in compose it must be without quotation marks
-and any `$` symbol needs to be doubled - replaced with `$$`.
-
-DNS is set to null as I had issues with it set, but it should be tried,
-set it to ip address where at port 53 dns server answers. Test then with nslookup.
-
 # Reverse proxy
 
-Caddy v2 is used, details
-[here](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/caddy_v2).</br>
+Caddy is used, that's why the web interface port is just exposed and not mapped
+and why the insecure is set to true for just http.<br>
+Details [here](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/caddy_v2).</br>
 
 `Caddyfile`
 ```php
-vpn.{$MY_DOMAIN} {
+vpn.example.com {
     reverse_proxy wg-easy:51821
 }
 ```
@@ -101,11 +87,17 @@ vpn.{$MY_DOMAIN} {
 
 ![loginpic](https://i.imgur.com/V30cDwq.png)
 
-Login with the password from the .env file.<br>
-Add user, download config, use it.
+If you need to import old config, you need to change env variable `INIT_ENABLED=false` <br>
+It then guides you through setup and one of the steps is import of old config.
 
 # Trouble shooting
 
+Make sure you forward udp port `51820`.
+
+# Site-to-Site
+
+[https://www.procustodibus.com/blog/2020/12/wireguard-site-to-site-config/](https://www.procustodibus.com/blog/2020/12/wireguard-site-to-site-config/)
+
 # Update
 
 Manual image update:
@@ -114,3 +106,6 @@ Manual image update:
 - `docker compose up -d`</br>
 - `docker image prune`
 
+# Alternative
+
+[netbird](https://github.com/netbirdio/netbird)