diff --git a/Dockerfile b/Dockerfile
index e4ada1d..42f3d4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 
 ############################################
-# Stage 1: fetch source (pin to tag/sha)
+# Stage 1: fetch source
 ############################################
 FROM alpine:3.20 AS source
 ARG DALOREF=master
@@ -13,10 +13,9 @@ RUN apk add --no-cache git && \
 # Stage 2: runtime (PHP 8, Apache)
 ############################################
 FROM php:8.3-apache
-
 ENV TZ=UTC
 
-# System deps (no php-pear package here)
+# System deps
 RUN apt-get update && apt-get -y upgrade && \
     apt-get install -y --no-install-recommends \
       ca-certificates tzdata curl git \
@@ -30,7 +29,7 @@ RUN apt-get update && apt-get -y upgrade && \
 RUN docker-php-ext-configure gd --with-freetype --with-jpeg && \
     docker-php-ext-install gd mysqli pdo_mysql
 
-# Install PEAR manually, then required PEAR packages
+# PEAR + required packages
 RUN curl -fsSL https://pear.php.net/install-pear-nozlib.phar -o /tmp/pear.phar \
  && php /tmp/pear.phar \
  && rm /tmp/pear.phar \
@@ -42,30 +41,25 @@ RUN curl -fsSL https://pear.php.net/install-pear-nozlib.phar -o /tmp/pear.phar \
 # App
 COPY --from=source /src/app/ /var/www/html/daloradius/
 COPY --from=source /src/app/common/includes/daloradius.conf.php.sample /opt/daloradius.conf.php.tmpl
-COPY --from=source /src/contrib/scripts/apache-config.sh /usr/local/bin/apache-config.sh
 
-# Apache + perms (+ run helper to set DocumentRoot=/var/www/html/daloradius)
-RUN chown -R www-data:www-data /var/www/html && \
-    chmod +x /usr/local/bin/apache-config.sh && \
-    a2enmod rewrite && \
-    /usr/local/bin/apache-config.sh && \
-    printf 'ServerName localhost\n' > /etc/apache2/conf-available/servername.conf && a2enconf servername
+# Our Apache vhost (replace default)
+COPY apache/000-default.conf /etc/apache2/sites-available/000-default.conf
+RUN a2enmod rewrite && apache2ctl -t
 
+# (Optional) silence ServerName warning
+RUN printf 'ServerName localhost\n' > /etc/apache2/conf-available/servername.conf && a2enconf servername
 
-# Entry script renders config from env only if not bind-mounted or if forced
+# Entry script: seed/refresh config from env only when needed
 COPY <<'EOF' /entrypoint.sh
 #!/usr/bin/env bash
 set -euo pipefail
-
 CFG="/var/www/html/daloradius/common/includes/daloradius.conf.php"
 TMPL="/opt/daloradius.conf.php.tmpl"
 
-# If no config present, seed from template
-if [ ! -f "$CFG" ]; then
-  cp "$TMPL" "$CFG"
-fi
+# Seed if missing
+if [ ! -f "$CFG" ]; then cp "$TMPL" "$CFG"; fi
 
-# Only edit if envs are provided and not explicitly skipped
+# Render if forced or empty
 if [ "${FORCE_RENDER:-0}" = "1" ] || [ ! -s "$CFG" ]; then
   : "${DBHOST:?set DBHOST}"; : "${DBNAME:?set DBNAME}"; : "${DBUSER:?set DBUSER}"; : "${DBPASS:?set DBPASS}"
   sed -i \
@@ -78,27 +72,8 @@ fi
 
 exec apachectl -DFOREGROUND
 EOF
-
-# Make "/" serve the users UI
-RUN set -e; \
-  cat >/etc/apache2/sites-available/000-default.conf <<'EOF'
-<VirtualHost *:80>
-  ServerName localhost
-  DocumentRoot /var/www/html/daloradius/users
-  <Directory /var/www/html/daloradius/users>
-    AllowOverride All
-    Require all granted
-  </Directory>
-  DirectoryIndex index.php
-  ErrorLog ${APACHE_LOG_DIR}/error.log
-  CustomLog ${APACHE_LOG_DIR}/access.log combined
-</VirtualHost>
-EOF
-
-
-
-
-HEALTHCHECK --interval=30s --timeout=5s --retries=5 CMD curl -fsS http://localhost/ || exit 1
-
 RUN chmod +x /entrypoint.sh
 
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=5s --retries=5 CMD curl -fsS http://localhost/ || exit 1
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/apache/000-default.conf b/apache/000-default.conf
new file mode 100644
index 0000000..1f77b79
--- /dev/null
+++ b/apache/000-default.conf
@@ -0,0 +1,12 @@
+<VirtualHost *:80>
+  ServerName localhost
+  DocumentRoot /var/www/html/daloradius
+  <Directory /var/www/html/daloradius>
+    Options -Indexes +FollowSymLinks
+    AllowOverride All
+    Require all granted
+  </Directory>
+  DirectoryIndex index.php
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>