diff --git a/docker-compose.yml b/docker-compose.yml
index d14445f..cb3bf1b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,20 +2,46 @@ services:
   headscale:
     image: headscale/headscale:latest
     container_name: headscale
-    volumes:
-      - ./config:/etc/headscale
-      - ./data:/var/lib/headscale
-    ports:
-      - "8080:8080"
-      - "9090:9090"
-      - "50443:50443"
-    command: serve
-    labels:
-      - "com.centurylinklabs.watchtower.enable=true"
     restart: unless-stopped
     networks:
       - shared-net
 
+    # 環境變數
+    environment:
+      - TZ=Asia/Taipei
+
+    # 健康檢查
+    healthcheck:
+      test: ["CMD-SHELL", "headscale version >/dev/null 2>&1 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+    # 日誌配置
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+    # 卷掛載
+    volumes:
+      - ./config:/etc/headscale:ro
+      - ./data:/var/lib/headscale
+      - /etc/localtime:/etc/localtime:ro
+
+    # 埠位映射
+    ports:
+      - "8080:8080"    # HTTP API
+      - "9090:9090"    # Metrics
+      - "50443:50443"  # gRPC
+
+    # 標籤配置
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+      - "description=Headscale WireGuard control plane"
+
 networks:
   shared-net:
     external: true