diff --git a/.gitignore b/.gitignore
index 6381c108..109b7361 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@
 .cache
 .coverage
 .deploy
+.env
 __pycache__
 Chart.lock
 coverage.xml
diff --git a/services/Makefile b/services/Makefile
index f076684b..f55acc04 100644
--- a/services/Makefile
+++ b/services/Makefile
@@ -7,7 +7,7 @@
 
 HOST = $(shell hostname -s)
 REGISTRY_URI ?= nexus.instantlinux.net
-SERVICES = haproxy-keepalived minio mythtv-backend nut-upsd restic-server
+SERVICES = garage haproxy-keepalived mythtv-backend nut-upsd restic-server
 ifeq ($(shell test -d /var/adm/admin/services && echo 1),1)
   export ADMIN_PATH=/var/adm/admin/services
 endif
diff --git a/services/garage/docker-compose.yml b/services/garage/docker-compose.yml
new file mode 100644
index 00000000..81c1da7f
--- /dev/null
+++ b/services/garage/docker-compose.yml
@@ -0,0 +1,76 @@
+services:
+  app:
+    image: dxflrs/garage:${VERSION_GARAGE:-latest}
+    configs:
+    - source: garage.toml
+      target: /etc/garage.toml
+      mode: 0444
+    environment:
+      GARAGE_ADMIN_TOKEN_FILE:    /run/secrets/garage-admin-token
+      GARAGE_METRICS_TOKEN_FILE:  /run/secrets/garage-metrics-token
+      GARAGE_RPC_SECRET_FILE:     /run/secrets/garage-rpc-secret
+    network_mode: host
+    ports:
+    - ${PORT_GARAGE_API:-3900}:3900
+    - ${PORT_GARAGE_RPC:-3901}:3901
+    - ${PORT_GARAGE_WEB:-3902}:3902
+    - ${PORT_GARAGE_ADMIN:-3903}:3903
+    restart: unless-stopped
+    secrets:
+    - garage-admin-token
+    - garage-metrics-token
+    - garage-rpc-secret
+    user: ${UID_GARAGE:-2012}:${GID_GARAGE:-565}
+    volumes:
+    - ${GARAGE_ROOT:-/var/lib/garage}/meta:/var/lib/garage/meta
+    - ${GARAGE_ROOT:-/var/lib/garage}/data:/var/lib/garage/data
+  webui:
+    image: genebit/garage-webui:latest
+    configs:
+    - source: garage.toml
+      target: /etc/garage.toml
+    restart: unless-stopped
+    volumes:
+      - webui-data:/data # required: user accounts, audit logs, upload temp files
+    ports:
+      - 3909:3909
+    environment:
+      API_BASE_URL: "http://${GARAGE_HOST:-localhost}:3903"
+      S3_ENDPOINT_URL: "http://${GARAGE_HOST:-}:3900"
+      S3_REGION: ${GARAGE_REGION:-garage}
+secrets:
+  # note - chown these files on the host filesystem to $UID_GARAGE, and chmod 0400 garage-*
+  garage-admin-token:
+    file: /var/adm/secrets/garage-admin-token
+  garage-metrics-token:
+    file: /var/adm/secrets/garage-metrics-token
+  garage-rpc-secret:
+    file: /var/adm/secrets/garage-rpc-secret
+volumes:
+  webui-data:
+configs:
+  garage.toml:
+    content: |
+      data_dir = "/var/lib/garage/data"
+      metadata_dir = "/var/lib/garage/meta"
+      db_engine = "lmdb"
+
+      consistency_mode = "consistent"
+      replication_factor = 1
+      rpc_bind_addr = "[::]:3901"
+      rpc_public_addr = "127.0.0.1:3901"
+      compression_level = 2
+
+      [s3_api]
+      s3_region = "${GARAGE_REGION:-garage}"
+      api_bind_addr = "[::]:3900"
+      root_domain = "api.${GARAGE_DOMAIN:-s3.garage.localhost}"
+
+      [s3_web]
+      bind_addr = "[::]:3902"
+      root_domain = "web.${GARAGE_DOMAIN:-s3.garage.localhost}"
+      index = "index.html"
+
+      [admin]
+      api_bind_addr = "0.0.0.0:3903"
+      admin_token = "${GARAGE_ADMIN_TOKEN:-****}"
diff --git a/services/minio/docker-compose.yml b/services/minio/docker-compose.yml
deleted file mode 100644
index c1530310..00000000
--- a/services/minio/docker-compose.yml
+++ /dev/null
@@ -1,65 +0,0 @@
-services:
-  app:
-    image: quay.io/minio/minio:${VERSION_MINIO:-latest}
-    command: >
-      server /data/vol{1...${MINIO_VOL_COUNT:-4}}/
-       --address "0.0.0.0:9000"
-       --console-address "0.0.0.0:9001"
-       --certs-dir /opt/certs
-    environment:
-      MINIO_ROOT_USER_FILE:     /run/secrets/minio-root-user
-      MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio-root-password
-      MINIO_GID:                ${MINIO_GID:-1000}
-      MINIO_UID:                ${MINIO_UID:-1000}
-      MINIO_GROUPNAME:          ${MINIO_GROUPNAME:-minio}
-      MINIO_USERNAME:           ${MINIO_USERNAME:-minio}
-      MINIO_PROMETHEUS_URL:     ${MINIO_PROMETHEUS_URL:-http://prometheus:9090}
-    ports:
-    - ${PORT_MINIO_API:-9000}:9000
-    - ${PORT_MINIO_CONSOLE:-9001}:9001
-    restart: always
-    secrets:
-    - minio-root-user
-    - minio-root-password
-    volumes:
-    - ${MINIO_ROOT:-/data}:/data
-    - ${MINIO_CERTS_DIR:-~/ssl/minio}:/opt/certs
-  prometheus:
-    image: prom/prometheus:latest
-    command: --config.file=/etc/prometheus/prometheus.yml
-    configs:
-    - source: prometheus.yml
-      target: /etc/prometheus/prometheus.yml
-    ports:
-    - "9090:9090"
-    secrets:
-    - minio-bearer-token
-    volumes:
-    - prometheus-data:/prometheus
-    - ${MINIO_CERTS_DIR:-~/ssl/minio}:/opt/certs
-secrets:
-  minio-bearer-token:
-    file: /var/adm/secrets/minio-bearer-token
-  minio-root-user:
-    file: /var/adm/secrets/minio-root-user
-  minio-root-password:
-    file: /var/adm/secrets/minio-root-password
-volumes:
-  data:
-    driver: local
-  prometheus-data:
-configs:
-  prometheus.yml:
-    content: |
-      global:
-        scrape_interval: 2s
-        evaluation_interval: 2s
-      scrape_configs:
-      - job_name: minio-job
-        bearer_token_file: /run/secrets/minio-bearer-token
-        metrics_path: /minio/v2/metrics/cluster
-        scheme: https
-        static_configs:
-        - targets: ['${MINIO_FQDN:-localhost}:${PORT_MINIO_API:-9000}']
-        tls_config:
-          ca_file: /opt/certs/CAs/ca-root.crt