diff --git a/admin/.gitignore b/admin/.gitignore
index a2d05ce19..6bb62f667 100644
--- a/admin/.gitignore
+++ b/admin/.gitignore
@@ -2,7 +2,8 @@ node_modules/
 dist/
 .cache/
 
-.env
+/.env
+/.env.bak
 
 # coverage folder
 coverage/
diff --git a/backend/.gitignore b/backend/.gitignore
index 90ee96052..147e82849 100644
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -1,5 +1,6 @@
 /node_modules/
 /.env
+/.env.bak
 /build/
 package-json.lock
 coverage
diff --git a/database/.gitignore b/database/.gitignore
index db7aa096e..bce5da58f 100644
--- a/database/.gitignore
+++ b/database/.gitignore
@@ -8,7 +8,8 @@ yarn-error.log*
 test/unit/coverage
 
 package-lock.json
-.env
+/.env
+/.env.bak
 .env.development.local
 .env.production.local
 
diff --git a/deployment/bare_metal/.env.dist b/deployment/bare_metal/.env.dist
index f69ce862e..91e37b594 100644
--- a/deployment/bare_metal/.env.dist
+++ b/deployment/bare_metal/.env.dist
@@ -32,10 +32,10 @@ WEBHOOK_ELOPAGE_SECRET=secret
 
 GDT_API_URL=https://gdt.gradido.net
 
-COMMUNITY_NAME=Gradido Development Stage1
+COMMUNITY_NAME="Gradido Development Stage1"
 COMMUNITY_URL=https://stage1.gradido.net/
 COMMUNITY_REGISTER_URL=https://stage1.gradido.net/register
-COMMUNITY_DESCRIPTION=Gradido Development Stage1 Test Community
+COMMUNITY_DESCRIPTION="Gradido Development Stage1 Test Community"
 
 KLICKTIPP=false
 KLICKTIPP_USER=
diff --git a/deployment/bare_metal/install.sh b/deployment/bare_metal/install.sh
index caa9c1240..37a002794 100755
--- a/deployment/bare_metal/install.sh
+++ b/deployment/bare_metal/install.sh
@@ -14,9 +14,13 @@ set +o allexport
 # NOTE: all config values will be in process.env when starting
 # the services and will therefore take precedence over the .env
 if [ -f "$SCRIPT_DIR/.env" ]; then
-    export $(cat $SCRIPT_DIR/.env | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env
+    set +o allexport
 else
-    export $(cat $SCRIPT_DIR/.env.dist | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env.dist
+    set +o allexport
 fi
 
 # Configure git
@@ -110,7 +114,6 @@ sudo mysql <<EOFMYSQL
 EOFMYSQL
 
 # Configure database
-# TODO - do this in the start.sh to regenerate configs on each deploy
 envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/database/.env.template > $PROJECT_ROOT/database/.env
 
 # Configure backend
diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh
index 3d0589569..616e4b8ab 100755
--- a/deployment/bare_metal/start.sh
+++ b/deployment/bare_metal/start.sh
@@ -10,13 +10,29 @@ PROJECT_ROOT=$SCRIPT_DIR/../..
 NGINX_CONFIG_DIR=$SCRIPT_DIR/nginx/sites-available
 set +o allexport
 
-# Load .env or .env.dist if not present
 # NOTE: all config values will be in process.env when starting
 # the services and will therefore take precedence over the .env
+
+# We have to load the backend .env to get DB_USERNAME, DB_PASSWORD AND JWT_SECRET
+export_var(){
+  export $1=$(grep -v '^#' $PROJECT_ROOT/backend/.env | grep -e "$1" | sed -e 's/.*=//')
+}
+
+if [ -f "$PROJECT_ROOT/backend/.env" ]; then
+    export_var 'DB_USER'
+    export_var 'DB_PASSWORD'
+    export_var 'JWT_SECRET'
+fi
+
+# Load .env or .env.dist if not present
 if [ -f "$SCRIPT_DIR/.env" ]; then
-    export $(cat $SCRIPT_DIR/.env | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env
+    set +o allexport
 else
-    export $(cat $SCRIPT_DIR/.env.dist | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env.dist
+    set +o allexport
 fi
 
 # lock start
@@ -64,6 +80,16 @@ case "$NGINX_SSL" in
 esac
 envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $NGINX_CONFIG_DIR/$TEMPLATE_FILE > $NGINX_CONFIG_DIR/update-page.conf
 
+# Regenerate .env files
+cp -f $PROJECT_ROOT/database/.env $PROJECT_ROOT/database/.env.bak
+cp -f $PROJECT_ROOT/backend/.env $PROJECT_ROOT/backend/.env.bak
+cp -f $PROJECT_ROOT/frontend/.env $PROJECT_ROOT/frontend/.env.bak
+cp -f $PROJECT_ROOT/admin/.env $PROJECT_ROOT/admin/.env.bak
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/database/.env.template > $PROJECT_ROOT/database/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/backend/.env.template > $PROJECT_ROOT/backend/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/frontend/.env.template > $PROJECT_ROOT/frontend/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/admin/.env.template > $PROJECT_ROOT/admin/.env
+
 # Install & build database
 echo 'Updating database<br>' >> $UPDATE_HTML
 cd $PROJECT_ROOT/database
diff --git a/frontend/.gitignore b/frontend/.gitignore
index 74ffc56c3..b868f0a64 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -8,7 +8,8 @@ yarn-error.log*
 test/unit/coverage
 
 package-lock.json
-.env
+/.env
+/.env.bak
 .env.development.local
 .env.production.local