diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml
index bc38582..229e485 100644
--- a/ansible/inventory/group_vars/all.yaml
+++ b/ansible/inventory/group_vars/all.yaml
@@ -21,6 +21,11 @@ domain:
 
 services:
   # common
+  wireguard:
+    domain:
+      public: "vpn"
+    ports:
+      upd: "11290"
   crowdsec:
     domain:
       internal: "crowdsec"
diff --git a/ansible/roles/infra/handlers/main.yaml b/ansible/roles/infra/handlers/main.yaml
index e925898..9f8a6a8 100644
--- a/ansible/roles/infra/handlers/main.yaml
+++ b/ansible/roles/infra/handlers/main.yaml
@@ -12,7 +12,7 @@
 - name: Reload postgresql
   ansible.builtin.command:
     /usr/bin/podman exec -u postgres postgresql sh -c "pg_ctl reload"
-  when: is_postgresql_init.stat.exists
+  when: is_postgresql_init_marker.stat.exists
   changed_when: false
   listen: "notification_reload_postgresql"
   ignore_errors: true # noqa: ignore-errors
@@ -24,7 +24,7 @@
     enabled: true
     daemon_reload: true
     scope: "user"
-  when: is_postgresql_init.stat.exists
+  when: is_postgresql_init_marker.stat.exists
   changed_when: false
   listen: "notification_restart_postgresql"
   ignore_errors: true # noqa: ignore-errors
diff --git a/ansible/roles/infra/tasks/services/set_postgresql.yaml b/ansible/roles/infra/tasks/services/set_postgresql.yaml
index 4f1913b..bae4559 100644
--- a/ansible/roles/infra/tasks/services/set_postgresql.yaml
+++ b/ansible/roles/infra/tasks/services/set_postgresql.yaml
@@ -15,12 +15,6 @@
         | list
       }}
 
-- name: Delete existing init files
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/containers/postgresql/init"
-    state: "absent"
-  become: true
-
 - name: Create postgresql directory
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/{{ item }}"
@@ -101,6 +95,11 @@
   notify: "notification_reload_postgresql"
   no_log: true
 
+- name: Check postgresql .init marker
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/containers/postgresql/.init"
+  register: "is_postgresql_init_marker"
+
 - name: Check initiating SQL file
   ansible.builtin.find:
     path: "{{ node['home_path'] }}/data/containers/postgresql/backups/sql/"
@@ -112,17 +111,6 @@
   become: true
   register: "postgresql_init_sql_files"
 
-- name: Validate initiating SQL file count
-  ansible.builtin.assert:
-    that:
-      - postgresql_init_sql_files.matched == 0 or postgresql_init_sql_files.matched <= ((connected_services | length) + 1)
-    fail_msg: >-
-      Init SQL count mismatch.
-      expected=0 or above {{ (connected_services | length) + 1 }},
-      actual={{ postgresql_init_sql_files.matched }}.
-      Check pg_cluster.sql and pg_<service>.sql files in
-      {{ node['home_path'] }}/data/containers/postgresql/backups/sql/
-
 - name: Remote copy the initiating SQL
   ansible.builtin.copy:
     src: "{{ node['home_path'] }}/data/containers/postgresql/backups/sql/pg_{{ item }}.sql"
@@ -137,6 +125,7 @@
   become: true
   when:
     - (connected_services | length) > 0
+    - not is_postgresql_init_marker.stat.exists
     - postgresql_init_sql_files.matched == (connected_services | length) + 1
 
 - name: Deploy container file
@@ -186,6 +175,14 @@
     scope: "user"
   loop: "{{ connected_services }}"
 
+- name: Create .init file
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/postgresql/.init"
+    state: "touch"
+    mode: "0644"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+
 - name: Check container archive images
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/\
diff --git a/config/node/app/nftables.conf.j2 b/config/node/app/nftables.conf.j2
index 856970a..26a66a9 100644
--- a/config/node/app/nftables.conf.j2
+++ b/config/node/app/nftables.conf.j2
@@ -9,9 +9,9 @@ define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
 define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
 define PORTS_SSH = 22
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}
 
 table inet nat {
     chain prerouting {
diff --git a/config/node/auth/nftables.conf.j2 b/config/node/auth/nftables.conf.j2
index 6b336a5..2d060b3 100644
--- a/config/node/auth/nftables.conf.j2
+++ b/config/node/auth/nftables.conf.j2
@@ -7,9 +7,9 @@ define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | jo
 define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
 define PORTS_SSH = 22
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}
 
 table inet nat {
     chain prerouting {
diff --git a/config/node/common/hosts.j2 b/config/node/common/hosts.j2
index 4d06e61..b899aeb 100644
--- a/config/node/common/hosts.j2
+++ b/config/node/common/hosts.j2
@@ -25,12 +25,12 @@
 {{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }}
 {{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }}
 # DB, LDAP, CA, Prometheus, Loki, mail (infra)
-{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} mail.{{ domain['internal'] }} ca.{{ domain['internal'] }}
+{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
 # IPv6
 # Crowdsec, blocky, bind(fw)
 {{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }}
 # DB, LDAP, CA, Prometheus, Loki, mail (infra)
-{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} mail.{{ domain['internal'] }} ca.{{ domain['internal'] }}
+{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
 {% endif %}
diff --git a/config/node/fw/nftables.conf.j2 b/config/node/fw/nftables.conf.j2
index 6d942cb..56e3ff2 100644
--- a/config/node/fw/nftables.conf.j2
+++ b/config/node/fw/nftables.conf.j2
@@ -48,7 +48,7 @@ define PORTS_WEB = { 80, 443 }
 define PORTS_DHCP = { 67, 68, 546, 547 }
 define PORTS_DNS = 53
 define PORTS_NTP = 123
-define PORTS_VPN = 11290
+define PORTS_VPN = {{ services['wireguard']['ports']['udp'] }}
 define PORTS_CROWDSEC = {{ services['crowdsec']['ports']['https'] }}
 
 table inet nat {
diff --git a/config/node/fw/wireguard/30-fw-wg0.netdev b/config/node/fw/wireguard/30-fw-wg0.netdev
index 9569f01..74a0949 100644
--- a/config/node/fw/wireguard/30-fw-wg0.netdev
+++ b/config/node/fw/wireguard/30-fw-wg0.netdev
@@ -2,7 +2,7 @@
 Name=wg0
 Kind=wireguard
 [WireGuard]
-ListenPort=11290
+ListenPort={{ services['wireguard']['ports']['udp'] }}
 PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }}
 [WireGuardPeer]
 PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }}
diff --git a/config/node/infra/nftables.conf.j2 b/config/node/infra/nftables.conf.j2
index b6588aa..607c832 100644
--- a/config/node/infra/nftables.conf.j2
+++ b/config/node/infra/nftables.conf.j2
@@ -13,9 +13,9 @@ define PORTS_CA = {{ services['ca']['ports']['https'] }}
 define PORTS_LDAPS = 636
 define PORTS_LDAPS_FORWARD = {{ services['ldap']['ports']['ldaps'] }}
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}
 define PORTS_PROMETHEUS = {{ services['prometheus']['ports']['https'] }}
 define PORTS_LOKI = {{ services['loki']['ports']['https'] }}
 define PORTS_SMTP = 587
diff --git a/config/services/containers/infra/maddy/maddy.container.j2 b/config/services/containers/infra/maddy/maddy.container.j2
index e559be7..82d36d7 100644
--- a/config/services/containers/infra/maddy/maddy.container.j2
+++ b/config/services/containers/infra/maddy/maddy.container.j2
@@ -4,8 +4,8 @@ DefaultDependencies=false
 [Unit]
 Description=Maddy
 
-After=network-online.target
-Wants=network-online.target
+After=postgresql.service ldap.service
+Requires=postgresql.service ldap.service
 
 [Container]
 Image=docker.io/foxcpp/maddy:{{ version['containers']['maddy'] }}
@@ -19,15 +19,17 @@ PublishPort={{ services['maddy']['ports']['imaps'] }}:993/tcp
 AddHost={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
 AddHost={{ services['ldap']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
 
-Volume=%h/containers/maddy/maddy.conf:/data/maddy.conf:ro
 Volume=%h/containers/maddy/ssl:/etc/ssl/maddy:ro
 Volume=%h/data/containers/maddy/data:/data:rw
+Volume=%h/containers/maddy/maddy.conf:/data/maddy.conf:ro
 
 Environment="TZ={{ timezone }}"
 Secret=MADDY_LDAP_BIND_PASSWORD,type=env
 Secret=MADDY_POSTGRES_URL,type=env
 
 [Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} 636
 Restart=always
 RestartSec=10s
 TimeoutStopSec=120