diff --git a/admin/.gitignore b/admin/.gitignore
index a2d05ce19..6bb62f667 100644
--- a/admin/.gitignore
+++ b/admin/.gitignore
@@ -2,7 +2,8 @@ node_modules/
 dist/
 .cache/
 
-.env
+/.env
+/.env.bak
 
 # coverage folder
 coverage/
diff --git a/backend/.gitignore b/backend/.gitignore
index 90ee96052..147e82849 100644
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -1,5 +1,6 @@
 /node_modules/
 /.env
+/.env.bak
 /build/
 package-json.lock
 coverage
diff --git a/backend/src/graphql/directive/isAuthorized.ts b/backend/src/graphql/directive/isAuthorized.ts
index d5c8495bb..89da13ff7 100644
--- a/backend/src/graphql/directive/isAuthorized.ts
+++ b/backend/src/graphql/directive/isAuthorized.ts
@@ -5,10 +5,10 @@ import { AuthChecker } from 'type-graphql'
 import { decode, encode } from '../../auth/JWT'
 import { ROLE_UNAUTHORIZED, ROLE_USER, ROLE_ADMIN } from '../../auth/ROLES'
 import { RIGHTS } from '../../auth/RIGHTS'
-import { ServerUserRepository } from '../../typeorm/repository/ServerUser'
 import { getCustomRepository } from '@dbTools/typeorm'
 import { UserRepository } from '../../typeorm/repository/User'
 import { INALIENABLE_RIGHTS } from '../../auth/INALIENABLE_RIGHTS'
+import { ServerUser } from '@entity/ServerUser'
 
 const isAuthorized: AuthChecker<any> = async ({ context }, rights) => {
   context.role = ROLE_UNAUTHORIZED // unauthorized user
@@ -38,8 +38,7 @@ const isAuthorized: AuthChecker<any> = async ({ context }, rights) => {
     // TODO this implementation is bullshit - two database queries cause our user identifiers are not aligned and vary between email, id and pubKey
     const userRepository = await getCustomRepository(UserRepository)
     const user = await userRepository.findByPubkeyHex(context.pubKey)
-    const serverUserRepository = await getCustomRepository(ServerUserRepository)
-    const countServerUsers = await serverUserRepository.count({ email: user.email })
+    const countServerUsers = await ServerUser.count({ email: user.email })
     context.role = countServerUsers > 0 ? ROLE_ADMIN : ROLE_USER
 
     context.setHeaders.push({ key: 'token', value: encode(decoded.pubKey) })
diff --git a/backend/src/graphql/resolver/AdminResolver.ts b/backend/src/graphql/resolver/AdminResolver.ts
index 2c8cbfe27..bc07c79ec 100644
--- a/backend/src/graphql/resolver/AdminResolver.ts
+++ b/backend/src/graphql/resolver/AdminResolver.ts
@@ -9,7 +9,6 @@ import { CreatePendingCreations } from '../model/CreatePendingCreations'
 import { UpdatePendingCreation } from '../model/UpdatePendingCreation'
 import { RIGHTS } from '../../auth/RIGHTS'
 import { TransactionRepository } from '../../typeorm/repository/Transaction'
-import { TransactionCreationRepository } from '../../typeorm/repository/TransactionCreation'
 import { UserRepository } from '../../typeorm/repository/User'
 import CreatePendingCreationArgs from '../arg/CreatePendingCreationArgs'
 import UpdatePendingCreationArgs from '../arg/UpdatePendingCreationArgs'
@@ -198,13 +197,12 @@ export class AdminResolver {
     transaction = await transactionRepository.save(transaction)
     if (!transaction) throw new Error('Could not create transaction')
 
-    const transactionCreationRepository = getCustomRepository(TransactionCreationRepository)
     let transactionCreation = new TransactionCreation()
     transactionCreation.transactionId = transaction.id
     transactionCreation.userId = pendingCreation.userId
     transactionCreation.amount = parseInt(pendingCreation.amount.toString())
     transactionCreation.targetDate = pendingCreation.date
-    transactionCreation = await transactionCreationRepository.save(transactionCreation)
+    transactionCreation = await TransactionCreation.save(transactionCreation)
     if (!transactionCreation) throw new Error('Could not create transactionCreation')
 
     const userTransactionRepository = getCustomRepository(UserTransactionRepository)
@@ -256,9 +254,7 @@ async function getUserCreations(id: number): Promise<number[]> {
   const lastMonthNumber = moment().subtract(1, 'month').format('M')
   const currentMonthNumber = moment().format('M')
 
-  const transactionCreationRepository = getCustomRepository(TransactionCreationRepository)
-  const createdAmountsQuery = await transactionCreationRepository
-    .createQueryBuilder('transaction_creations')
+  const createdAmountsQuery = await TransactionCreation.createQueryBuilder('transaction_creations')
     .select('MONTH(transaction_creations.target_date)', 'target_month')
     .addSelect('SUM(transaction_creations.amount)', 'sum')
     .where('transaction_creations.state_user_id = :id', { id })
diff --git a/backend/src/graphql/resolver/UserResolver.ts b/backend/src/graphql/resolver/UserResolver.ts
index 6753712ab..5c9230b22 100644
--- a/backend/src/graphql/resolver/UserResolver.ts
+++ b/backend/src/graphql/resolver/UserResolver.ts
@@ -18,11 +18,11 @@ import { UserRepository } from '../../typeorm/repository/User'
 import { LoginEmailOptIn } from '@entity/LoginEmailOptIn'
 import { sendResetPasswordEmail } from '../../mailer/sendResetPasswordEmail'
 import { sendAccountActivationEmail } from '../../mailer/sendAccountActivationEmail'
-import { LoginElopageBuysRepository } from '../../typeorm/repository/LoginElopageBuys'
 import { klicktippSignIn } from '../../apis/KlicktippController'
 import { RIGHTS } from '../../auth/RIGHTS'
-import { ServerUserRepository } from '../../typeorm/repository/ServerUser'
 import { ROLE_ADMIN } from '../../auth/ROLES'
+import { LoginElopageBuys } from '@entity/LoginElopageBuys'
+import { ServerUser } from '@entity/ServerUser'
 
 const EMAIL_OPT_IN_RESET_PASSWORD = 2
 const EMAIL_OPT_IN_REGISTER = 1
@@ -298,8 +298,7 @@ export class UserResolver {
     user.coinanimation = coinanimation
 
     // context.role is not set to the actual role yet on login
-    const serverUserRepository = await getCustomRepository(ServerUserRepository)
-    const countServerUsers = await serverUserRepository.count({ email: user.email })
+    const countServerUsers = await ServerUser.count({ email: user.email })
     user.isAdmin = countServerUsers > 0
 
     context.setHeaders.push({
@@ -662,8 +661,7 @@ export class UserResolver {
       return false
     }
 
-    const loginElopageBuysRepository = getCustomRepository(LoginElopageBuysRepository)
-    const elopageBuyCount = await loginElopageBuysRepository.count({ payerEmail: userEntity.email })
+    const elopageBuyCount = await LoginElopageBuys.count({ payerEmail: userEntity.email })
     return elopageBuyCount > 0
   }
 }
diff --git a/backend/src/typeorm/repository/LoginElopageBuys.ts b/backend/src/typeorm/repository/LoginElopageBuys.ts
deleted file mode 100644
index 0448c84ee..000000000
--- a/backend/src/typeorm/repository/LoginElopageBuys.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { EntityRepository, Repository } from '@dbTools/typeorm'
-import { LoginElopageBuys } from '@entity/LoginElopageBuys'
-
-@EntityRepository(LoginElopageBuys)
-export class LoginElopageBuysRepository extends Repository<LoginElopageBuys> {}
diff --git a/backend/src/typeorm/repository/LoginEmailOptIn.ts b/backend/src/typeorm/repository/LoginEmailOptIn.ts
deleted file mode 100644
index 0906e8b51..000000000
--- a/backend/src/typeorm/repository/LoginEmailOptIn.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { EntityRepository, Repository } from '@dbTools/typeorm'
-import { LoginEmailOptIn } from '@entity/LoginEmailOptIn'
-
-@EntityRepository(LoginEmailOptIn)
-export class LoginEmailOptInRepository extends Repository<LoginEmailOptIn> {}
diff --git a/backend/src/typeorm/repository/ServerUser.ts b/backend/src/typeorm/repository/ServerUser.ts
deleted file mode 100644
index 0ab33c44a..000000000
--- a/backend/src/typeorm/repository/ServerUser.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { EntityRepository, Repository } from '@dbTools/typeorm'
-import { ServerUser } from '@entity/ServerUser'
-
-@EntityRepository(ServerUser)
-export class ServerUserRepository extends Repository<ServerUser> {}
diff --git a/backend/src/typeorm/repository/TransactionCreation.ts b/backend/src/typeorm/repository/TransactionCreation.ts
deleted file mode 100644
index 938715574..000000000
--- a/backend/src/typeorm/repository/TransactionCreation.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { EntityRepository, Repository } from '@dbTools/typeorm'
-import { TransactionCreation } from '@entity/TransactionCreation'
-
-@EntityRepository(TransactionCreation)
-export class TransactionCreationRepository extends Repository<TransactionCreation> {}
diff --git a/backend/src/webhook/elopage.ts b/backend/src/webhook/elopage.ts
index 0b392abb1..af6b5a097 100644
--- a/backend/src/webhook/elopage.ts
+++ b/backend/src/webhook/elopage.ts
@@ -28,16 +28,13 @@
 */
 
 import { LoginElopageBuys } from '@entity/LoginElopageBuys'
-import { getCustomRepository } from '@dbTools/typeorm'
 import { UserResolver } from '../graphql/resolver/UserResolver'
-import { LoginElopageBuysRepository } from '../typeorm/repository/LoginElopageBuys'
 import { User as dbUser } from '@entity/User'
 
 export const elopageWebhook = async (req: any, res: any): Promise<void> => {
   // eslint-disable-next-line no-console
   console.log('Elopage Hook received', req.body)
   res.status(200).end() // Responding is important
-  const loginElopageBuyRepository = await getCustomRepository(LoginElopageBuysRepository)
   const loginElopageBuy = new LoginElopageBuys()
 
   const {
@@ -82,7 +79,7 @@ export const elopageWebhook = async (req: any, res: any): Promise<void> => {
   }
 
   // Save the hook data
-  await loginElopageBuyRepository.save(loginElopageBuy)
+  await LoginElopageBuys.save(loginElopageBuy)
 
   // create user for certain products
   /*
diff --git a/database/.gitignore b/database/.gitignore
index db7aa096e..bce5da58f 100644
--- a/database/.gitignore
+++ b/database/.gitignore
@@ -8,7 +8,8 @@ yarn-error.log*
 test/unit/coverage
 
 package-lock.json
-.env
+/.env
+/.env.bak
 .env.development.local
 .env.production.local
 
diff --git a/deployment/bare_metal/.env.dist b/deployment/bare_metal/.env.dist
index f69ce862e..91e37b594 100644
--- a/deployment/bare_metal/.env.dist
+++ b/deployment/bare_metal/.env.dist
@@ -32,10 +32,10 @@ WEBHOOK_ELOPAGE_SECRET=secret
 
 GDT_API_URL=https://gdt.gradido.net
 
-COMMUNITY_NAME=Gradido Development Stage1
+COMMUNITY_NAME="Gradido Development Stage1"
 COMMUNITY_URL=https://stage1.gradido.net/
 COMMUNITY_REGISTER_URL=https://stage1.gradido.net/register
-COMMUNITY_DESCRIPTION=Gradido Development Stage1 Test Community
+COMMUNITY_DESCRIPTION="Gradido Development Stage1 Test Community"
 
 KLICKTIPP=false
 KLICKTIPP_USER=
diff --git a/deployment/bare_metal/install.sh b/deployment/bare_metal/install.sh
index caa9c1240..37a002794 100755
--- a/deployment/bare_metal/install.sh
+++ b/deployment/bare_metal/install.sh
@@ -14,9 +14,13 @@ set +o allexport
 # NOTE: all config values will be in process.env when starting
 # the services and will therefore take precedence over the .env
 if [ -f "$SCRIPT_DIR/.env" ]; then
-    export $(cat $SCRIPT_DIR/.env | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env
+    set +o allexport
 else
-    export $(cat $SCRIPT_DIR/.env.dist | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env.dist
+    set +o allexport
 fi
 
 # Configure git
@@ -110,7 +114,6 @@ sudo mysql <<EOFMYSQL
 EOFMYSQL
 
 # Configure database
-# TODO - do this in the start.sh to regenerate configs on each deploy
 envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/database/.env.template > $PROJECT_ROOT/database/.env
 
 # Configure backend
diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh
index 3d0589569..616e4b8ab 100755
--- a/deployment/bare_metal/start.sh
+++ b/deployment/bare_metal/start.sh
@@ -10,13 +10,29 @@ PROJECT_ROOT=$SCRIPT_DIR/../..
 NGINX_CONFIG_DIR=$SCRIPT_DIR/nginx/sites-available
 set +o allexport
 
-# Load .env or .env.dist if not present
 # NOTE: all config values will be in process.env when starting
 # the services and will therefore take precedence over the .env
+
+# We have to load the backend .env to get DB_USERNAME, DB_PASSWORD AND JWT_SECRET
+export_var(){
+  export $1=$(grep -v '^#' $PROJECT_ROOT/backend/.env | grep -e "$1" | sed -e 's/.*=//')
+}
+
+if [ -f "$PROJECT_ROOT/backend/.env" ]; then
+    export_var 'DB_USER'
+    export_var 'DB_PASSWORD'
+    export_var 'JWT_SECRET'
+fi
+
+# Load .env or .env.dist if not present
 if [ -f "$SCRIPT_DIR/.env" ]; then
-    export $(cat $SCRIPT_DIR/.env | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env
+    set +o allexport
 else
-    export $(cat $SCRIPT_DIR/.env.dist | sed 's/#.*//g' | xargs)
+    set -o allexport
+    source $SCRIPT_DIR/.env.dist
+    set +o allexport
 fi
 
 # lock start
@@ -64,6 +80,16 @@ case "$NGINX_SSL" in
 esac
 envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $NGINX_CONFIG_DIR/$TEMPLATE_FILE > $NGINX_CONFIG_DIR/update-page.conf
 
+# Regenerate .env files
+cp -f $PROJECT_ROOT/database/.env $PROJECT_ROOT/database/.env.bak
+cp -f $PROJECT_ROOT/backend/.env $PROJECT_ROOT/backend/.env.bak
+cp -f $PROJECT_ROOT/frontend/.env $PROJECT_ROOT/frontend/.env.bak
+cp -f $PROJECT_ROOT/admin/.env $PROJECT_ROOT/admin/.env.bak
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/database/.env.template > $PROJECT_ROOT/database/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/backend/.env.template > $PROJECT_ROOT/backend/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/frontend/.env.template > $PROJECT_ROOT/frontend/.env
+envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < $PROJECT_ROOT/admin/.env.template > $PROJECT_ROOT/admin/.env
+
 # Install & build database
 echo 'Updating database<br>' >> $UPDATE_HTML
 cd $PROJECT_ROOT/database
diff --git a/frontend/.gitignore b/frontend/.gitignore
index 74ffc56c3..b868f0a64 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -8,7 +8,8 @@ yarn-error.log*
 test/unit/coverage
 
 package-lock.json
-.env
+/.env
+/.env.bak
 .env.development.local
 .env.production.local