diff --git a/.envrc b/.envrc
index ddf1cea..402262d 100644
--- a/.envrc
+++ b/.envrc
@@ -4,16 +4,6 @@ export TF_VAR_do_token=$(pass jdormit-infra-do-token)
 export DIGITALOCEAN_API_TOKEN=$(pass jdormit-infra-do-token)
 export TF_VAR_spaces_access_id=$(pass jdormit-infra-spaces-access-id)
 export TF_VAR_spaces_secret_key=$(pass jdormit-infra-spaces-secret-key)
-export TF_VAR_netlify_token=$(pass netlify-terraform-access-token)
-export SYNCTHING_USER=$(pass packer-syncthing-user)
-export SYNCTHING_PW=$(pass packer-syncthing-pw)
-export SYNCTHING_API_KEY=$(pass packer-syncthing-api-key)
-export SYNCTHING_CERT_PEM=$(pass packer-syncthing-cert.pem)
-export SYNCTHING_KEY_PEM=$(pass packer-syncthing-key.pem)
-export CERTBOT_EMAIL=$(pass certbot-email)
-export WALLABAG_MAILGUN_PASSWORD=$(pass packer-wallabag-mailgun-password)
-export WALLABAG_SECRET=$(pass packer-wallabag-secret)
-export WALLABAG_PASSWORD=$(pass wallabag.jeremydormitzer.com)
 
 if [ -f ".env.local" ]; then
     echo "sourcing .env.local"
diff --git a/prod/jdormit-website-netlify/terraform/.envrc b/prod/jdormit-website-netlify/terraform/.envrc
new file mode 100644
index 0000000..fdf9587
--- /dev/null
+++ b/prod/jdormit-website-netlify/terraform/.envrc
@@ -0,0 +1,3 @@
+source_up
+
+export TF_VAR_netlify_token=$(pass netlify-terraform-access-token)
diff --git a/prod/syncthing/packer/.envrc b/prod/syncthing/packer/.envrc
new file mode 100644
index 0000000..c4eb045
--- /dev/null
+++ b/prod/syncthing/packer/.envrc
@@ -0,0 +1,8 @@
+source_up
+
+export SYNCTHING_USER=$(pass packer-syncthing-user)
+export SYNCTHING_PW=$(pass packer-syncthing-pw)
+export SYNCTHING_API_KEY=$(pass packer-syncthing-api-key)
+export SYNCTHING_CERT_PEM=$(pass packer-syncthing-cert.pem)
+export SYNCTHING_KEY_PEM=$(pass packer-syncthing-key.pem)
+export CERTBOT_EMAIL=$(pass certbot-email)
diff --git a/prod/wallabag/packer/.envrc b/prod/wallabag/packer/.envrc
new file mode 100644
index 0000000..9e78ee2
--- /dev/null
+++ b/prod/wallabag/packer/.envrc
@@ -0,0 +1,14 @@
+source_up
+
+export WALLABAG_MAILGUN_PASSWORD=$(pass packer-wallabag-mailgun-password)
+export WALLABAG_SECRET=$(pass packer-wallabag-secret)
+export WALLABAG_PASSWORD=$(pass wallabag.jeremydormitzer.com)
+export WALLABAG_WALLABAGER_ID=$(pass packer-wallabag-wallabager-id)
+export WALLABAG_WALLABAGER_SECRET=$(pass packer-wallabag-wallabager-secret)
+export WALLABAG_ANDROID_APP_ID=$(pass packer-wallabag-android-app-id)
+export WALLABAG_ANDROID_APP_SECRET=$(pass packer-wallabag-android-app-secret)
+export WALLABAG_IPAD_ID=$(pass packer-wallabag-ipad-id)
+export WALLABAG_IPAD_SECRET=$(pass packer-wallabag-ipad-secret)
+export WALLABAG_WALLABAG_EL_ID=$(pass packer-wallabag-wallabag.el-id)
+export WALLABAG_WALLABAG_EL_SECRET=$(pass packer-wallabag-wallabag.el-secret)
+export CERTBOT_EMAIL=$(pass certbot-email)