diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..0e6c961
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,2 @@
+#github: [pgollor]
+custom: ['https://paypal.me/pgollor']
diff --git a/README.md b/README.md
index 6a4c513..997c5e2 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# nextcloud
+# Nextcloud
 
 - [![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://paypal.me/pgollor) [![Docker Pulls](https://img.shields.io/docker/pulls/pgollor/nextcloud.svg)](https://hub.docker.com/r/pgollor/nextcloud/)
 - app: [![Build Status](https://jenkins.pgollor.de/job/nextcloud-docker-app/badge/icon)](https://jenkins.pgollor.de/job/nextcloud-docker-app-dev/) [![](https://images.microbadger.com/badges/image/pgollor/nextcloud:app-dev-latest.svg)](https://microbadger.com/images/pgollor/nextcloud:app-dev-latest "Get your own image badge on microbadger.com") [![](https://images.microbadger.com/badges/version/pgollor/nextcloud:app-dev-latest.svg)](https://microbadger.com/images/pgollor/nextcloud:app-dev-latest "Get your own version badge on microbadger.com") [![based on nextcloud-version](https://img.shields.io/badge/dynamic/json.svg?label=based%20on&url=https%3A%2F%2Fapi.microbadger.com%2Fv1%2Fimages%2Fpgollor%2Fnextcloud%3Aapp-dev-latest&query=%24.Labels.nv&colorB=brightgreen&prefix=nextcloud-)](https://hub.docker.com/_/nextcloud/)
@@ -7,17 +7,23 @@
 Docker compose files for nextcloud
 
 
-## information
+## Information
 
 Get additional infos from https://hub.docker.com/_/nextcloud/ and from https://github.com/nextcloud/docker/tree/master/.examples .
 
-## update hints
+### occ Command
+```
+docker-compose exec --user www-data nextcloud-app php occ [command]
+```
+
+
+## Update hints
 
 ### 14.0.4 to 14.0.16
 
 If you get a database error for the `activity` table, please have a look at this [issue](https://github.com/nextcloud/activity/issues/309#issuecomment-436929111).
 
-## first start
+## First start
 ```
 mkdir data/data
 chown www-data data/data
diff --git a/backup.sh b/backup.sh
index 3850d8b..7721b8e 100755
--- a/backup.sh
+++ b/backup.sh
@@ -2,7 +2,10 @@
 
 
 # backup directory
-backupDir=$PWD/backup
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+backupDir=${SCRIPT_DIR}/backup
+
+# create directories
 mkdir -p ${backupDir}/app
 mkdir -p ${backupDir}/docker-conf
 mkdir -p ${backupDir}/data
@@ -18,10 +21,10 @@
 tar -cj ${dbFile} -f "${dbFile}.tbz2"
 rm ${dbFile}
 
-# backup app data as root because of permissions
+# backup app data as root because of permission problems
 sudo tar -C data -I pbzip2 -pc app -f "${backupDir}/app/${currentDate}.tbz2"
 
-# backup data as root because of permissions
+# backup data as root because of permission problems
 #sudo tar -C data -I pbzip2 -pc data -f "${backupDir}/data/${currentDate}.tbz2"
 
 # backup config files
diff --git a/docker-compose.yml b/docker-compose.yml
index 80b1cb4..f778bfa 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,7 @@
       - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
       - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
       - NEXTCLOUD_DATA_DIR=/srv/data
+      - REDIS_HOST=redis
       - TZ=${TZ}
     tmpfs:
       - /tmp
@@ -50,7 +51,7 @@
           - web
 
   nextcloud-database:
-    image: mariadb:10.3
+    image: mariadb
     restart: always
     mem_limit: 1g
     command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
@@ -72,7 +73,7 @@
 
   nextcloud-redis:
     mem_limit: 1g
-    image: redis
+    image: redis:alpine
     restart: always
     networks:
       nextcloud-network:
@@ -93,18 +94,19 @@
     entrypoint: |
       bash -c 'bash -s <<EOF
         trap "break;exit" SIGHUP SIGINT SIGTERM
-        
+    
         while [ ! -f /var/www/html/config/config.php ]; do
           sleep 1
         done
-        
+    
         while true; do
           php -f /var/www/html/cron.php
           sleep 15m
         done
       EOF'
     depends_on:
-      - nextcloud-app
+      - nextcloud-database
+      - nextcloud-redis
     networks:
       nextcloud-network:
 
diff --git a/docker/app/Dockerfile b/docker/app/Dockerfile
index b5f9172..08301f2 100644
--- a/docker/app/Dockerfile
+++ b/docker/app/Dockerfile
@@ -1,5 +1,4 @@
-#FROM nextcloud:fpm
-FROM pgollor/nextcloud-fpm
+FROM nextcloud:18-rc-fpm
 
 ARG NV
 ARG VCS_REF
diff --git a/docker/web/nginx.conf b/docker/web/nginx.conf
index 0687ec1..0b5a096 100644
--- a/docker/web/nginx.conf
+++ b/docker/web/nginx.conf
@@ -1,4 +1,4 @@
-worker_processes  1;
+worker_processes auto;
 
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
@@ -41,21 +41,25 @@
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
 
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -70,15 +74,19 @@
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
 
-        #location = /.well-known/carddav {
-        #    return 301 $scheme://$host/remote.php/dav;
-        #}
-        #location = /.well-known/caldav {
-        #    return 301 $scheme://$host/remote.php/dav;
-        #}
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
+
+        location = /.well-known/carddav {
+            return 301 $scheme://$host:$server_port/remote.php/dav;
+        }
+
+        location = /.well-known/caldav {
+            return 301 $scheme://$host:$server_port/remote.php/dav;
+        }
 
         # set max upload size
         client_max_body_size 10G;
@@ -97,64 +105,69 @@
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|ocm-provider\/.+)\.php(?:$|\/) {
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
             fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
             #
             # WARNING: Only add the preload option once you read about
             # the consequences in https://hstspreload.org/. This option
             # will add the domain to a hardcoded list that is shipped
             # in all major browsers and getting removed from this list
             # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
 
             # Optional: Don't log access to assets
             access_log off;
         }
 
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
             try_files $uri /index.php$request_uri;
             # Optional: Don't log access to other assets
             access_log off;