diff --git a/freshrss/.env.example b/freshrss/.env.example
new file mode 100644
index 0000000..25f29b4
--- /dev/null
+++ b/freshrss/.env.example
@@ -0,0 +1,11 @@
+# set IS_ARM to :arm for ARM version
+IS_ARM=
+
+FRESHRSS_DOMAIN=freshrss.ykz.app
+CRON_MIN=2,32
+
+# Variables below are only used at the very first run
+ADMIN_USERNAME=admin_username_goes_here
+ADMIN_EMAIL=admin_email_goes_here
+ADMIN_PASSWORD=admin_password_goes_here
+ADMIN_API_PASSWORD=admin_api_password_goes_here
diff --git a/freshrss/docker-compose.yml b/freshrss/docker-compose.yml
new file mode 100644
index 0000000..fe213f5
--- /dev/null
+++ b/freshrss/docker-compose.yml
@@ -0,0 +1,48 @@
+version: "3.9"
+
+networks:
+  public:
+    external: true
+
+services:
+  freshrss:
+    image: freshrss/freshrss${IS_ARM}
+    container_name: freshrss
+    restart: always
+    logging:
+      options:
+        max-size: 10m
+    volumes:
+      - "./freshrss-data:/var/www/FreshRSS/data"
+      - "./freshrss-extensions-data:/var/www/FreshRSS/extensions"
+    environment:
+      TZ: Asia/Singapore
+      CRON_MIN: '${CRON_MIN}'
+      FRESHRSS_INSTALL: |-
+        --api_enabled
+        --default_user ${ADMIN_USERNAME}
+        --language en
+      FRESHRSS_USER: |-
+        --api_password ${ADMIN_API_PASSWORD}
+        --email ${ADMIN_EMAIL}
+        --language en
+        --password ${ADMIN_PASSWORD}
+        --user ${ADMIN_USERNAME}
+    # ports:
+    #   - "80:80"
+    networks:
+      - public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.freshrss.rule=Host(`${FRESHRSS_DOMAIN}`)"
+      - "traefik.http.routers.freshrss.service=freshrss-service"
+      - "traefik.http.services.freshrss-service.loadbalancer.server.port=80"
+      - "traefik.http.routers.freshrss.tls=true"
+      - "traefik.http.routers.freshrss.tls.certresolver=le"
+      - traefik.http.middlewares.freshrssM1.compress=true
+      - traefik.http.middlewares.freshrssM2.headers.browserXssFilter=true
+      - traefik.http.middlewares.freshrssM2.headers.forceSTSHeader=true
+      - traefik.http.middlewares.freshrssM2.headers.frameDeny=true
+      - traefik.http.middlewares.freshrssM2.headers.referrerPolicy=no-referrer-when-downgrade
+      - traefik.http.middlewares.freshrssM2.headers.stsSeconds=31536000
+      - traefik.http.routers.freshrss.middlewares=freshrssM1,freshrssM2