move db urls and passwords to environment variables