diff --git a/.env.example b/.env.example
index 5500b4b..6938ed3 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,6 @@
 # Traefik Configuration
-TRAEFIK_ACME_MAIL=acme@yourdomain.com
-TRAEFIK_DOMAIN=traefik.yourdomain.com
+TRAEFIK_ACME_MAIL=contact@fungimail.llc
+TRAEFIK_DOMAIN=traefik.fungimail.llc
 # If you're on a internet facing server please comment out following line.
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 # INSECURE=true
@@ -11,13 +11,18 @@ TRAEFIK_DASHBOARD=true
 TRAEFIK_BASIC_AUTH_USERS=
 
 # oCIS Configuration
-OCIS_DOCKER_TAG=latest
-OCIS_DOMAIN=owncloud.yourdomain.com
-OCIS_LOG_LEVEL=info
+OCIS_DOCKER_TAG=7.3.0
+
+OCIS_DOMAIN=owncloud.fungimail.llc
+OCIS_LOG_LEVEL=error
 OCIS_LOG_COLOR=false
 OCIS_INSECURE=false
-PROXY_ENABLE_BASIC_AUTH=false
-ADMIN_PASSWORD=SOME_STRONG_PASSWORD
+OCIS_SERVICE_ACCOUNT_SECRET=REPLACE_WITH_STRONG_SECRET
+OCIS_SERVICE_ACCOUNT_ID=ROOT_USER
+
+#PROXY_ENABLE_BASIC_AUTH=false
+PROXY_ENABLE_BASIC_AUTH=true
+ADMIN_PASSWORD=REPLACE_WITH_STRONG_SECRET
 DEMO_USERS=false
 
 
@@ -25,18 +30,25 @@ DEMO_USERS=false
 # cs3org wopi server version. Defaults to "v8.3.3"
 WOPISERVER_DOCKER_TAG=
 # cs3org wopi server domain. Defaults to "wopiserver.owncloud.test"
-WOPISERVER_DOMAIN=wopi.yourdomain.com
+WOPISERVER_DOMAIN=wopi.fungimail.llc
 # JWT secret which is used for the documents to be request by the Wopi client from the cs3org Wopi server. Must be change in order to have a secure Wopi server. Defaults to "LoremIpsum567"
-WOPI_JWT_SECRET=SOME_JWT_TOKEN
+WOPI_JWT_SECRET=REPLACE_WITH_STRONG_SECRET
 
 ### Collabora settings ###
 # Domain of Collabora, where you can find the frontend. Defaults to "collabora.owncloud.test"
-COLLABORA_DOMAIN=collabora.yourdomain.com
+COLLABORA_DOMAIN=collabora.fungimail.llc
 # Admin user for Collabora. Defaults to blank, provide one to enable access
 COLLABORA_ADMIN_USER=collabora_admin
 # Admin password for Collabora. Defaults to blank, provide one to enable access
-COLLABORA_ADMIN_PASSWORD=SOME_STRONG_PASSWORD
+COLLABORA_ADMIN_PASSWORD=REPLACE_WITH_STRONG_SECRET
 
 ### OnlyOffice settings ###
 # Domain of OnlyOffice, where you can find the frontend. Defaults to "onlyoffice.owncloud.test"
-ONLYOFFICE_DOMAIN=onlyoffice.yourdomain.com
\ No newline at end of file
+ONLYOFFICE_DOMAIN=onlyoffice.fungimail.llc
+
+INBUCKET_DOMAIN=inbucket.fungimail.llc
+
+# ANUBIS
+ANUBIS_DOMAIN=anubis.fungimail.llc
+ANUBIS_COOKIE_DOMAIN=fungimail.llc
+ANUBIS_REDIRECT_DOMAINS=owncloud.fungimail.llc,collabora.fungimail.llc,onlyoffice.fungimail.llc,wopi.fungimail.llc
diff --git a/docker-stack.yml b/docker-stack.yml
index a63e289..8ce34aa 100644
--- a/docker-stack.yml
+++ b/docker-stack.yml
@@ -1,8 +1,45 @@
 version: "3.7"
 
 services:
+  anubis:
+    image: ghcr.io/techarohq/anubis:v1.24.0
+    networks:
+      - ocis-net
+    environment:
+      - BIND=:8080
+      - 'TARGET= ' # IMPORTANTE: un espacio tras el '='
+      - PUBLIC_URL=https://${ANUBIS_DOMAIN}
+      - COOKIE_DOMAIN=${ANUBIS_COOKIE_DOMAIN}
+      - REDIRECT_DOMAINS=${ANUBIS_REDIRECT_DOMAINS}
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.docker.network=ocis-net"
+
+        # Router para acceder a Anubis
+        - "traefik.http.routers.anubis.entrypoints=https"
+        - "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
+        - "traefik.http.routers.anubis.tls.certresolver=http"
+        - "traefik.http.services.anubis.loadbalancer.server.port=8080"
+        # Middleware ForwardAuth
+        - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
+        - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+        max_attempts: 3
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+
   traefik:
-    image: traefik:v2.9.1
+    image: traefik:v3.6.7
     networks:
       ocis-net:
         aliases:
@@ -11,6 +48,9 @@ services:
           - ${COLLABORA_DOMAIN}
           - ${ONLYOFFICE_DOMAIN}
     command:
+      # allow big uploads with slow clients
+      - "--entrypoints.http.transport.respondingtimeouts.readtimeout=0"
+      - "--entrypoints.https.transport.respondingtimeouts.readtimeout=0"
       - "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
       # letsencrypt configuration
       - "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL}"
@@ -23,16 +63,27 @@ services:
       - "--entryPoints.http.http.redirections.entryPoint.to=https"
       - "--entryPoints.http.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.https.address=:443"
+      - "--entryPoints.https.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+      - "--entryPoints.http.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
       # docker provider (get configuration from container labels)
-      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
-      - "--providers.docker.exposedByDefault=false"
+      - "--providers.swarm.endpoint=unix:///var/run/docker.sock"
+      - "--providers.swarm.exposedByDefault=false"
+      - "--providers.swarm.network=ocis-net"
+      # TODO: will remove this after changing all the label syntax
+      - "--core.defaultRuleSyntax=v2"
       # access log
       - "--accessLog=true"
       - "--accessLog.format=json"
       - "--accessLog.fields.headers.names.X-Request-Id=keep"
     ports:
-      - "80:80"
-      - "443:443"
+      - target: 80
+        published: 80
+        protocol: tcp
+        mode: host
+      - target: 443
+        published: 443
+        protocol: tcp
+        mode: host
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "certs:/certs"
@@ -40,23 +91,37 @@ services:
       driver: "local"
     deploy:
       labels:
-      - "traefik.enable=${TRAEFIK_DASHBOARD}"
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}" # defaults to admin:admin
-      - "traefik.http.routers.traefik.entrypoints=https"
-      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      - "traefik.http.routers.traefik.tls.certresolver=http"
-      - "traefik.http.routers.traefik.service=api@internal"
+        - "traefik.enable=${TRAEFIK_DASHBOARD}"
+        - "traefik.http.services.dummyService.loadbalancer.server.port=1337"
+        - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}" # defaults to admin:admin
+        - "traefik.http.routers.traefik.entrypoints=https"
+        - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
+        - "traefik.http.routers.traefik.middlewares=traefik-auth"
+        - "traefik.http.routers.traefik.tls.certresolver=http"
+        - "traefik.http.routers.traefik.service=api@internal"
+      update_config:
+        order: stop-first
+        parallelism: 1
+        delay: 10s
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       placement:
         constraints:
           - node.role==manager
       restart_policy:
         condition: on-failure
+        delay: 5s
+        max_attempts: 3
 
   ocis:
-    image: owncloud/ocis:latest
+    image: owncloud/ocis:${OCIS_DOCKER_TAG}
     networks:
-      - ocis-net
+      ocis-net:
+        aliases:
+          - ocis
     entrypoint:
       - /bin/sh
     command: ["-c", "ocis init || true; ocis server"]
@@ -65,9 +130,13 @@ services:
       OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL}
       OCIS_LOG_COLOR: ${OCIS_LOG_COLOR}
       PROXY_TLS: "false"
+      OCIS_SERVICE_ACCOUNT_SECRET: ${OCIS_SERVICE_ACCOUNT_SECRET}
+      OCIS_SERVICE_ACCOUNT_ID: ${OCIS_SERVICE_ACCOUNT_ID}
       SETTINGS_GRPC_ADDR: 0.0.0.0:9191
       OCIS_INSECURE: ${OCIS_INSECURE}
       PROXY_ENABLE_BASIC_AUTH: ${PROXY_ENABLE_BASIC_AUTH}
+      PROXY_ENABLE_APP_AUTH: "true"
+      OCIS_ADD_RUN_SERVICES: "auth-app"
       IDM_ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       IDM_CREATE_DEMO_USERS: ${DEMO_USERS}
       # fulltext search
@@ -75,35 +144,60 @@ services:
       SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
       FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
       # make the registry available to the app provider containers
-      MICRO_REGISTRY: "mdns"
+      MICRO_REGISTRY: "nats-js-kv"
+      NATS_NATS_HOST: "0.0.0.0"
+      FRONTEND_ARCHIVER_MAX_SIZE: "53687091200"      # 50 GiB
+      FRONTEND_ARCHIVER_MAX_NUM_FILES: "100000"      # opcional
     volumes:
       - ./config/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
       - ocis-config:/etc/ocis
       - ocis-data:/var/lib/ocis
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.ocis.entrypoints=https"
-      - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
-      - "traefik.http.routers.ocis.tls.certresolver=http"
-      - "traefik.http.routers.ocis.service=ocis"
-      - "traefik.http.services.ocis.loadbalancer.server.port=9200"
     logging:
       driver: "local"
     deploy:
       labels:
         - "traefik.enable=true"
-        - "traefik.http.routers.ocis.entrypoints=https"
-        - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
-        - "traefik.http.routers.ocis.tls.certresolver=http"
-        - "traefik.http.routers.ocis.service=ocis"
+        - "traefik.docker.network=ocis-net"
         - "traefik.http.services.ocis.loadbalancer.server.port=9200"
+
+        # 1) DAV/OCS/etc SIN anubis (prioridad alta)
+        - "traefik.http.routers.ocis-api.entrypoints=https"
+        - "traefik.http.routers.ocis-api.rule=Host(`${OCIS_DOMAIN}`) && (PathPrefix(`/remote.php/dav`) || PathPrefix(`/remote.php/webdav`) || PathPrefix(`/ocs`) || PathPrefix(`/.well-known`) || PathPrefix(`/status.php`))"
+        - "traefik.http.routers.ocis-api.tls.certresolver=http"
+        - "traefik.http.routers.ocis-api.service=ocis"
+        - "traefik.http.routers.ocis-api.priority=100"
+
+        # 2) WebUI CON anubis (prioridad baja)
+        - "traefik.http.routers.ocis-web.entrypoints=https"
+        - "traefik.http.routers.ocis-web.rule=Host(`${OCIS_DOMAIN}`)"
+        - "traefik.http.routers.ocis-web.tls.certresolver=http"
+        - "traefik.http.routers.ocis-web.service=ocis"
+        - "traefik.http.routers.ocis-web.middlewares=anubis@swarm"
+        - "traefik.http.routers.ocis-web.priority=1"
+#        - "traefik.enable=true"
+#        - "traefik.http.routers.ocis.entrypoints=https"
+#        - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
+#        - "traefik.http.routers.ocis.tls.certresolver=http"
+#        - "traefik.http.routers.ocis.service=ocis"
+#        - "traefik.http.services.ocis.loadbalancer.server.port=9200"
+#        - "traefik.http.routers.ocis.middlewares=anubis@swarm"
       restart_policy:
         condition: on-failure
         delay: 5s
         max_attempts: 3
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+
 
   ocis-appprovider-collabora:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
+    image: owncloud/ocis:${OCIS_DOCKER_TAG}
     networks:
       - ocis-net
     command: app-provider server
@@ -124,19 +218,30 @@ services:
       APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
       JWT_SECRET: ${WOPI_JWT_SECRET}
       # share the registry with the ocis container
-      MICRO_REGISTRY: "mdns"
+      MICRO_REGISTRY: "nats-js-kv"
+      OCIS_EVENTS_ENDPOINT: "ocis:9233"
+      MICRO_REGISTRY_ADDRESS: "ocis:9233"
     volumes:
       - ocis-config:/etc/ocis
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
         max_attempts: 3
 
   ocis-appprovider-onlyoffice:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
+    image: owncloud/ocis:${OCIS_DOCKER_TAG}
     networks:
       - ocis-net
     user: "0" # needed for apk add in entrypoint script
@@ -163,13 +268,24 @@ services:
       APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN}
       APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
       # share the registry with the ocis container
-      MICRO_REGISTRY: "mdns"
+      MICRO_REGISTRY: "nats-js-kv"
+      OCIS_EVENTS_ENDPOINT: "ocis:9233"
+      MICRO_REGISTRY_ADDRESS: "ocis:9233"
     volumes:
       - ./config/ocis-appprovider-onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
       - ocis-config:/etc/ocis
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -190,16 +306,25 @@ services:
       - ./config/wopiserver/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/wopiserver/wopiserver.conf.dist:/etc/wopi/wopiserver.conf.dist
       - wopi-recovery:/var/spool/wopirecovery
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.wopiserver.entrypoints=https"
-      - "traefik.http.routers.wopiserver.rule=Host(`${WOPISERVER_DOMAIN}`)"
-      - "traefik.http.routers.wopiserver.tls.certresolver=http"
-      - "traefik.http.routers.wopiserver.service=wopiserver"
-      - "traefik.http.services.wopiserver.loadbalancer.server.port=8880"
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.wopiserver.entrypoints=https"
+        - "traefik.http.routers.wopiserver.rule=Host(`${WOPISERVER_DOMAIN}`)"
+        - "traefik.http.routers.wopiserver.tls.certresolver=http"
+        - "traefik.http.routers.wopiserver.service=wopiserver"
+        - "traefik.http.services.wopiserver.loadbalancer.server.port=8880"
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -217,16 +342,25 @@ services:
       password: ${COLLABORA_ADMIN_PASSWORD}
     cap_add:
       - MKNOD
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.collabora.entrypoints=https"
-      - "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
-      - "traefik.http.routers.collabora.tls.certresolver=http"
-      - "traefik.http.routers.collabora.service=collabora"
-      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.collabora.entrypoints=https"
+        - "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
+        - "traefik.http.routers.collabora.tls.certresolver=http"
+        - "traefik.http.routers.collabora.service=collabora"
+        - "traefik.http.services.collabora.loadbalancer.server.port=9980"
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -245,19 +379,28 @@ services:
     volumes:
       - ./config/onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/onlyoffice/local.json:/etc/onlyoffice/documentserver/local.dist.json
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.onlyoffice.entrypoints=https"
-      - "traefik.http.routers.onlyoffice.rule=Host(`${ONLYOFFICE_DOMAIN}`)"
-      - "traefik.http.routers.onlyoffice.tls.certresolver=http"
-      - "traefik.http.routers.onlyoffice.service=onlyoffice"
-      - "traefik.http.services.onlyoffice.loadbalancer.server.port=80"
-      # websockets can't be opened when this is ommitted
-      - "traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.routers.onlyoffice.middlewares=onlyoffice"
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.onlyoffice.entrypoints=https"
+        - "traefik.http.routers.onlyoffice.rule=Host(`${ONLYOFFICE_DOMAIN}`)"
+        - "traefik.http.routers.onlyoffice.tls.certresolver=http"
+        - "traefik.http.routers.onlyoffice.service=onlyoffice"
+        - "traefik.http.services.onlyoffice.loadbalancer.server.port=80"
+        # websockets can't be opened when this is ommitted
+        - "traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto=https"
+        - "traefik.http.routers.onlyoffice.middlewares=onlyoffice"
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -280,16 +423,25 @@ services:
       INBUCKET_SMTP_TLSPRIVKEY: /tmp/server.key
       INBUCKET_SMTP_TLSCERT: /tmp/server.crt
       INBUCKET_STORAGE_MAILBOXMSGCAP: 1000
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.inbucket.entrypoints=https"
-      - "traefik.http.routers.inbucket.rule=Host(`${INBUCKET_DOMAIN}`)"
-      - "traefik.http.routers.inbucket.tls.certresolver=http"
-      - "traefik.http.routers.inbucket.service=inbucket"
-      - "traefik.http.services.inbucket.loadbalancer.server.port=9000"
     logging:
       driver: "local"
-    deploy: 
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.inbucket.entrypoints=https"
+        - "traefik.http.routers.inbucket.rule=Host(`${INBUCKET_DOMAIN}`)"
+        - "traefik.http.routers.inbucket.tls.certresolver=http"
+        - "traefik.http.routers.inbucket.service=inbucket"
+        - "traefik.http.services.inbucket.loadbalancer.server.port=9000"
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -301,6 +453,14 @@ networks:
     external: true
 volumes:
   certs:
+    external: true
+    name: selfhosted-owncloud_certs
   ocis-data:
+    external: true
+    name: selfhosted-owncloud_ocis-data
   ocis-config:
+    external: true
+    name: selfhosted-owncloud_ocis-config
   wopi-recovery:
+    external: true
+    name: selfhosted-owncloud_wopi-recovery