ad baseconfig stage, use env vars, move secrets to conf