diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index b89e7b4..d807103 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -1,51 +1,43 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# Container entrypoint: run sync.sh once, or in a loop every
+# SYNC_INTERVAL_SECONDS. There's no systemd/cron inside the container, so a
+# simple sleep-loop is the pragmatic choice.
 set -euo pipefail
 
-SYNC_CRON="${SYNC_CRON:-0 */6 * * *}"
-GIT_SSH_KEY_PATH="${GIT_SSH_KEY_PATH:-/etc/mirror/git-deploy-key}"
+: "${SYNC_INTERVAL_SECONDS:=3600}"
+: "${RUN_ONCE:=false}"
 
-export GNUPGHOME="${GNUPGHOME:-/etc/mirror-gpg}"
-GPG_PRIVATE_KEY_FILE="${GPG_PRIVATE_KEY_FILE:-/run/secrets/gpg_private_key}"
-GPG_KEY_ID_FILE="${GNUPGHOME}/key-id"
+log() { echo "[entrypoint] $(date '+%Y-%m-%d %H:%M:%S') $*"; }
 
-mkdir -p "$GNUPGHOME"
-chmod 700 "$GNUPGHOME"
+run_once() {
+    /opt/rpm-mirror/sync.sh
+}
 
-if [ -f "$GPG_PRIVATE_KEY_FILE" ] && [ ! -s "$GPG_KEY_ID_FILE" ]; then
-  echo "[entrypoint] Importiere Firmen-GPG-Key"
-  gpg --batch --import "$GPG_PRIVATE_KEY_FILE"
-  gpg --batch --list-secret-keys --with-colons \
-    | awk -F: '/^sec/ {print $5; exit}' > "$GPG_KEY_ID_FILE"
+if [[ "$RUN_ONCE" == "true" ]]; then
+    log "RUN_ONCE=true - running sync.sh once and exiting"
+    run_once
+    exit $?
 fi
 
-if [ -s "$GPG_KEY_ID_FILE" ]; then
-  GPG_KEY_ID="$(cat "$GPG_KEY_ID_FILE")"
-  export GPG_KEY_ID
+log "Starting sync loop (interval: ${SYNC_INTERVAL_SECONDS}s)"
 
-  mkdir -p /data/repo
-  gpg --batch --export --armor "$GPG_KEY_ID" > /data/repo/RPM-GPG-KEY-firma
+# Graceful shutdown on docker stop / compose down
+term_handler() {
+    log "Received SIGTERM, shutting down"
+    exit 0
+}
+trap term_handler SIGTERM SIGINT
 
-  {
-    echo "%_gpg_name  ${GPG_KEY_ID}"
-    echo "%_gpg_path  ${GNUPGHOME}"
-  } > /root/.rpmmacros
-else
-  echo "[entrypoint] WARNUNG: kein GPG-Key gefunden, Pakete werden NICHT signiert."
-fi
-
-{
-  echo "CONFIG_REPO_URL=${CONFIG_REPO_URL:-}"
-  echo "CONFIG_REPO_BRANCH=${CONFIG_REPO_BRANCH:-main}"
-  echo "GIT_SSH_KEY_PATH=${GIT_SSH_KEY_PATH}"
-  echo "GNUPGHOME=${GNUPGHOME}"
-  echo "GPG_KEY_ID=${GPG_KEY_ID:-}"
-  echo "${SYNC_CRON} root /usr/local/bin/sync.sh >> /var/log/sync.log 2>&1"
-} > /etc/cron.d/repo-sync
-chmod 0644 /etc/cron.d/repo-sync
-
-touch /var/log/sync.log
-crond
-
-/usr/local/bin/sync.sh || echo "[entrypoint] Initialer Sync fehlgeschlagen, Nginx startet trotzdem."
-
-exec nginx -g 'daemon off;'
\ No newline at end of file
+while true; do
+    # NOTE: don't inline `run_once` into `if ! run_once; then ...`  - inside
+    # that then-branch, $? would reflect the (always-0) negated test itself,
+    # not run_once's real exit code. Capture it explicitly instead.
+    rc=0
+    run_once || rc=$?
+    if [[ $rc -ne 0 ]]; then
+        log "sync.sh failed (exit ${rc}) - will retry after the next interval"
+    fi
+    log "Sleeping ${SYNC_INTERVAL_SECONDS}s until next sync..."
+    sleep "${SYNC_INTERVAL_SECONDS}" &
+    wait $!
+done
\ No newline at end of file