diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..42b1db6
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+# Secrets - nur verschlüsselt committen
+.env
+.env.*
+!.env.enc
+!.env.*.enc
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..672e10e
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: \.env.*$
+    age: "age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr"
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..346f66c
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,35 @@
+networks:
+  arr-chris_network:
+    name: arr-chris_network
+
+services:
+
+
+
+  sonarrCL:
+    container_name: sonarrCL
+    image: ghcr.io/hotio/sonarr:latest
+    restart: always
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - UMASK=022
+      - CONFIG_DIR=/config/sonarrCL
+    networks:
+      - arr-chris_network
+    ports:
+      - 8989:8989
+    volumes:
+    - /app-config/arr/:/config
+    - data:/chris
+
+
+
+volumes:
+  data:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: "addr=192.168.7.106,nolock,soft,rw,vers=3"
+      device: ":/chris"