db user via env var
deployment pw, secret via env vars