diff --git a/stacks/identity-and-security/authentik/.env b/stacks/identity-and-security/authentik/.env
index 538abf7..302ea6e 100644
--- a/stacks/identity-and-security/authentik/.env
+++ b/stacks/identity-and-security/authentik/.env
@@ -3,9 +3,6 @@ AUTHENTIK_URL=https://authentik.local.example.com
 # Exposed HTTP port
 COMPOSE_PORT_HTTP=9000
 
-# Volume Home
-DOCKER=/path/to/docker_volumes
-
 AUTHENTIK_EMAIL__HOST=smtp.example.com
 AUTHENTIK_EMAIL__PORT=587
 AUTHENTIK_EMAIL__USERNAME=notifications@example.com
diff --git a/stacks/identity-and-security/authentik/.env.secrets.ctmpl b/stacks/identity-and-security/authentik/.env.secrets.ctmpl
index d336c2a..048c4f7 100644
--- a/stacks/identity-and-security/authentik/.env.secrets.ctmpl
+++ b/stacks/identity-and-security/authentik/.env.secrets.ctmpl
@@ -1,4 +1,3 @@
 AUTHENTIK_SECRET_KEY={{ with secret "kv/host/authentik" }}{{ .Data.data.authentik_secret_key }}{{ end }}
 AUTHENTIK_EMAIL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.email_password }}{{ end }}
-POSTGRES_PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
-AUTHENTIK_POSTGRESQL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
+PG_PASS={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
diff --git a/stacks/identity-and-security/vaultwarden/.env b/stacks/identity-and-security/vaultwarden/.env
index f996ad0..c2999b3 100644
--- a/stacks/identity-and-security/vaultwarden/.env
+++ b/stacks/identity-and-security/vaultwarden/.env
@@ -8,5 +8,3 @@ TZ=Etc/UTC
 PUID=1000
 PGID=1000
 
-# Volume Home
-DOCKER=/path/to/docker_volumes
diff --git a/stacks/identity-and-security/wazuh/.env b/stacks/identity-and-security/wazuh/.env
index 727b7c3..24e3832 100644
--- a/stacks/identity-and-security/wazuh/.env
+++ b/stacks/identity-and-security/wazuh/.env
@@ -1,2 +1 @@
-DOCKER=/path/to/docker_volumes
 TZ=Etc/UTC
diff --git a/stacks/platform/caddy-internal/.env b/stacks/platform/caddy-internal/.env
new file mode 100644
index 0000000..97547e1
--- /dev/null
+++ b/stacks/platform/caddy-internal/.env
@@ -0,0 +1,3 @@
+# Exposed HTTP port
+HTTPS_PORT=443
+
diff --git a/stacks/platform/caddy/.env b/stacks/platform/caddy/.env
new file mode 100644
index 0000000..97547e1
--- /dev/null
+++ b/stacks/platform/caddy/.env
@@ -0,0 +1,3 @@
+# Exposed HTTP port
+HTTPS_PORT=443
+
diff --git a/stacks/platform/dashy/.env b/stacks/platform/dashy/.env
new file mode 100644
index 0000000..634e214
--- /dev/null
+++ b/stacks/platform/dashy/.env
@@ -0,0 +1,7 @@
+# Exposed HTTP port
+HTTP_PORT=10981
+
+# ID's
+PUID=1000
+PGID=1000
+
diff --git a/stacks/platform/dockhand/.env b/stacks/platform/dockhand/.env
new file mode 100644
index 0000000..10248c5
--- /dev/null
+++ b/stacks/platform/dockhand/.env
@@ -0,0 +1,2 @@
+# Exposed HTTP port
+HTTP_PORT=3030
diff --git a/stacks/platform/gitea/.env b/stacks/platform/gitea/.env
new file mode 100644
index 0000000..d85035f
--- /dev/null
+++ b/stacks/platform/gitea/.env
@@ -0,0 +1,17 @@
+# System
+PUID=1000
+PGID=1000
+TZ=Etc/UTC
+
+# Ports
+HTTP_PORT=3000
+SSH_PORT=2222
+
+# Postgres (shared creds, separate DBs/instances)
+# POSTGRES_PASSWORD — see .env.secrets (Vault)
+POSTGRES_USER=gitea
+POSTGRES_DB=gitea
+
+# App URL
+GITEA_DOMAIN=gitea.local.example.com
+GITEA_ROOT_URL=https://gitea.local.example.com/
diff --git a/stacks/platform/gitea/.env.secrets.ctmpl b/stacks/platform/gitea/.env.secrets.ctmpl
new file mode 100644
index 0000000..6d3948b
--- /dev/null
+++ b/stacks/platform/gitea/.env.secrets.ctmpl
@@ -0,0 +1 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/gitea" }}{{ .Data.data.postgres_password }}{{ end }}
diff --git a/stacks/platform/grafana-stack/.env b/stacks/platform/grafana-stack/.env
new file mode 100644
index 0000000..a6b544b
--- /dev/null
+++ b/stacks/platform/grafana-stack/.env
@@ -0,0 +1,14 @@
+# Exposed HTTP_PORT_prometheus
+HTTP_PORT_prometheus=9796
+
+# Exposed HTTP_PORT_grafana
+HTTP_PORT_grafana=3693
+
+# Exposed HTTP_PORT_loki
+HTTP_PORT_loki=3100
+
+GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id
+# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault)
+AUTHENTIK_URL=https://authentik.caddy.example.com
+GRAFANA_URL=https://grafana.local.example.com
+# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault)
diff --git a/stacks/platform/grafana-stack/.env.secrets.ctmpl b/stacks/platform/grafana-stack/.env.secrets.ctmpl
new file mode 100644
index 0000000..b4e5b8a
--- /dev/null
+++ b/stacks/platform/grafana-stack/.env.secrets.ctmpl
@@ -0,0 +1,2 @@
+GRAFANA_ADMIN_PASSWORD={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.admin_password | replaceAll "$" "$$" }}{{ end }}
+GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.oauth_client_secret | replaceAll "$" "$$" }}{{ end }}
diff --git a/stacks/platform/hawser/.env b/stacks/platform/hawser/.env
new file mode 100644
index 0000000..e0f2ec8
--- /dev/null
+++ b/stacks/platform/hawser/.env
@@ -0,0 +1,6 @@
+# Exposed HTTP_PORT
+HTTP_PORT=2376
+
+# System time zone
+TZ=Etc/UTC
+
diff --git a/stacks/platform/hawser/.env.secrets.ctmpl b/stacks/platform/hawser/.env.secrets.ctmpl
new file mode 100644
index 0000000..86dab18
--- /dev/null
+++ b/stacks/platform/hawser/.env.secrets.ctmpl
@@ -0,0 +1 @@
+TOKEN={{ with secret "kv/host/hawser" }}{{ .Data.data.token }}{{ end }}
diff --git a/stacks/platform/kestra/.env b/stacks/platform/kestra/.env
new file mode 100644
index 0000000..33ba2e1
--- /dev/null
+++ b/stacks/platform/kestra/.env
@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=10374
+
+# Basic-auth login
+USERNAME=admin@example.com
+
+# Postgres Creds
+# POSTGRES_PASSWORD — see .env.secrets (Vault)
+POSTGRES_USER=kestra
+POSTGRES_DB=kestra
diff --git a/stacks/platform/kestra/.env.secrets.ctmpl b/stacks/platform/kestra/.env.secrets.ctmpl
new file mode 100644
index 0000000..87a7499
--- /dev/null
+++ b/stacks/platform/kestra/.env.secrets.ctmpl
@@ -0,0 +1,2 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.postgres_password }}{{ end }}
+PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.ui_password }}{{ end }}
diff --git a/stacks/platform/kopia/.env b/stacks/platform/kopia/.env
new file mode 100644
index 0000000..ce179c4
--- /dev/null
+++ b/stacks/platform/kopia/.env
@@ -0,0 +1,7 @@
+# Exposed HTTP port
+HTTP_PORT=51515
+
+# System time zone
+TZ=Etc/UTC
+
+USERNAME=user
diff --git a/stacks/platform/kopia/.env.secrets.ctmpl b/stacks/platform/kopia/.env.secrets.ctmpl
new file mode 100644
index 0000000..52054d9
--- /dev/null
+++ b/stacks/platform/kopia/.env.secrets.ctmpl
@@ -0,0 +1 @@
+SECRET_PASSWORD={{ with secret "kv/host/kopia" }}{{ .Data.data.secret_password }}{{ end }}
diff --git a/stacks/platform/mosquitto/.env b/stacks/platform/mosquitto/.env
new file mode 100644
index 0000000..03384b3
--- /dev/null
+++ b/stacks/platform/mosquitto/.env
@@ -0,0 +1,2 @@
+# Exposed HTTP_PORT
+HTTP_PORT=1883
diff --git a/stacks/platform/nocodb/.env b/stacks/platform/nocodb/.env
new file mode 100644
index 0000000..a99aaee
--- /dev/null
+++ b/stacks/platform/nocodb/.env
@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=8090
+
+# System time zone
+TZ=Etc/UTC
+
+
+# DB Creds
+POSTGRES_DB=nocodb
+POSTGRES_USER=nocodb
diff --git a/stacks/platform/nocodb/.env.secrets.ctmpl b/stacks/platform/nocodb/.env.secrets.ctmpl
new file mode 100644
index 0000000..27a697e
--- /dev/null
+++ b/stacks/platform/nocodb/.env.secrets.ctmpl
@@ -0,0 +1,3 @@
+NC_DB=pg://nocodb_db:5432?u=nocodb&p={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}&d=nocodb
+JWT_SECRET={{ with secret "kv/host/nocodb" }}{{ .Data.data.jwt_secret }}{{ end }}
+POSTGRES_PASSWORD={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}
diff --git a/stacks/platform/node-red/.env b/stacks/platform/node-red/.env
new file mode 100644
index 0000000..60ba8d3
--- /dev/null
+++ b/stacks/platform/node-red/.env
@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=1856
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
diff --git a/stacks/platform/node-red/.env.secrets.ctmpl b/stacks/platform/node-red/.env.secrets.ctmpl
new file mode 100644
index 0000000..f4c351c
--- /dev/null
+++ b/stacks/platform/node-red/.env.secrets.ctmpl
@@ -0,0 +1,21 @@
+PAPERLESS_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.paperless_api_token }}{{ end }}
+FIREFLY_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.firefly_api_token }}{{ end }}
+{{ with secret "kv/host/node-red" }}
+ABS_TOKEN={{ .Data.data.abs_token }}
+AUTHENTIK_TOKEN={{ .Data.data.authentik_token }}
+BAZARR_KEY={{ .Data.data.bazarr_key }}
+JELLYFIN_KEY={{ .Data.data.jellyfin_key }}
+KESTRA_PASS={{ .Data.data.kestra_pass }}
+LIDARR_KEY={{ .Data.data.lidarr_key }}
+NOCODB_TOKEN={{ .Data.data.nocodb_token }}
+PBS_API_TOKEN={{ .Data.data.pbs_api_token }}
+PVE_API_TOKEN={{ .Data.data.pve_api_token }}
+RADARR_KEY={{ .Data.data.radarr_key }}
+SEERR_KEY={{ .Data.data.seerr_key }}
+SLACK_TOKEN={{ .Data.data.slack_token }}
+SONARR_KEY={{ .Data.data.sonarr_key }}
+TECHNITIUM_TOKEN={{ .Data.data.technitium_token }}
+VAULT_TOKEN={{ .Data.data.vault_token }}
+WAZUH_API_PASS={{ .Data.data.wazuh_api_pass }}
+WAZUH_INDEXER_AUTH={{ .Data.data.wazuh_indexer_auth }}
+{{ end }}
diff --git a/stacks/platform/speedtest-tracker/.env b/stacks/platform/speedtest-tracker/.env
new file mode 100644
index 0000000..4725d49
--- /dev/null
+++ b/stacks/platform/speedtest-tracker/.env
@@ -0,0 +1,16 @@
+# Exposed HTTP port
+HTTPS_PORT=6443
+
+# System time zone
+TZ=Etc/UTC
+
+# Display time zone
+DISPLAY_TIMEZONE=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+
+#App URL
+APP_URL=https://speedtest-tracker.local.example.com
diff --git a/stacks/platform/speedtest-tracker/.env.secrets.ctmpl b/stacks/platform/speedtest-tracker/.env.secrets.ctmpl
new file mode 100644
index 0000000..53f5c4c
--- /dev/null
+++ b/stacks/platform/speedtest-tracker/.env.secrets.ctmpl
@@ -0,0 +1 @@
+APP_KEY={{ with secret "kv/host/speedtest-tracker" }}{{ .Data.data.app_key }}{{ end }}