diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml
index 1ec4cbf..1682a69 100644
--- a/immich/docker-compose.yml
+++ b/immich/docker-compose.yml
@@ -22,8 +22,23 @@ services:
       - ${PROFILE_LOCATION}:/usr/src/app/upload/profile
       - ${BACKUP_LOCATION}:/usr/src/app/upload/backups
       - /etc/localtime:/etc/localtime:ro
-    env_file:
-      - .env
+    environment:
+      UPLOAD_LOCATION: ${UPLOAD_LOCATION}
+      THUMB_LOCATION: ${THUMB_LOCATION}
+      ENCODED_VIDEO_LOCATION: ${ENCODED_VIDEO_LOCATION}
+      PROFILE_LOCATION: ${PROFILE_LOCATION}
+      BACKUP_LOCATION: ${BACKUP_LOCATION}
+      DB_DATA_LOCATION: ${DB_DATA_LOCATION}
+      IMMICH_VERSION: ${IMMICH_VERSION}
+      DB_PASSWORD: ${DB_PASSWORD}
+      DB_USERNAME: ${DB_USERNAME}
+      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
+      IMMICH_API_KEY: ${IMMICH_API_KEY}
+      IMMICH_URL: ${IMMICH_URL}
+      EXTERNAL_IMMICH_URL: ${EXTERNAL_IMMICH_URL}
+      DB_HOST: ${DB_HOST}
+      DB_PORT: ${DB_PORT}
+      GOOGLE_MAPS_API_KEY: ${GOOGLE_MAPS_API_KEY}
     ports:
       - 12000:2283
     depends_on:
@@ -63,8 +78,23 @@ services:
       service: openvino
     volumes:
       - model-cache:/cache
-    env_file:
-      - .env
+    environment:
+      UPLOAD_LOCATION: ${UPLOAD_LOCATION}
+      THUMB_LOCATION: ${THUMB_LOCATION}
+      ENCODED_VIDEO_LOCATION: ${ENCODED_VIDEO_LOCATION}
+      PROFILE_LOCATION: ${PROFILE_LOCATION}
+      BACKUP_LOCATION: ${BACKUP_LOCATION}
+      DB_DATA_LOCATION: ${DB_DATA_LOCATION}
+      IMMICH_VERSION: ${IMMICH_VERSION}
+      DB_PASSWORD: ${DB_PASSWORD}
+      DB_USERNAME: ${DB_USERNAME}
+      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
+      IMMICH_API_KEY: ${IMMICH_API_KEY}
+      IMMICH_URL: ${IMMICH_URL}
+      EXTERNAL_IMMICH_URL: ${EXTERNAL_IMMICH_URL}
+      DB_HOST: ${DB_HOST}
+      DB_PORT: ${DB_PORT}
+      GOOGLE_MAPS_API_KEY: ${GOOGLE_MAPS_API_KEY}
     restart: unless-stopped
     deploy:
       resources:
@@ -116,8 +146,23 @@ services:
   power-tools:
     container_name: immich_power_tools
     image: ghcr.io/varun-raj/immich-power-tools:latest
-    env_file:
-      - .env
+    environment:
+      UPLOAD_LOCATION: ${UPLOAD_LOCATION}
+      THUMB_LOCATION: ${THUMB_LOCATION}
+      ENCODED_VIDEO_LOCATION: ${ENCODED_VIDEO_LOCATION}
+      PROFILE_LOCATION: ${PROFILE_LOCATION}
+      BACKUP_LOCATION: ${BACKUP_LOCATION}
+      DB_DATA_LOCATION: ${DB_DATA_LOCATION}
+      IMMICH_VERSION: ${IMMICH_VERSION}
+      DB_PASSWORD: ${DB_PASSWORD}
+      DB_USERNAME: ${DB_USERNAME}
+      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
+      IMMICH_API_KEY: ${IMMICH_API_KEY}
+      IMMICH_URL: ${IMMICH_URL}
+      EXTERNAL_IMMICH_URL: ${EXTERNAL_IMMICH_URL}
+      DB_HOST: ${DB_HOST}
+      DB_PORT: ${DB_PORT}
+      GOOGLE_MAPS_API_KEY: ${GOOGLE_MAPS_API_KEY}
     restart: unless-stopped
     depends_on:
       - immich-server
diff --git a/karakeep/docker-compose.yml b/karakeep/docker-compose.yml
index 37693e1..a75e2b1 100644
--- a/karakeep/docker-compose.yml
+++ b/karakeep/docker-compose.yml
@@ -6,12 +6,26 @@ services:
       - /opt/stacks/karakeep/localdata/data:/data
     ports:
       - 17001:3000
-    env_file:
-      - .env
     environment:
+      HOARDER_VERSION: ${HOARDER_VERSION}
+      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
+      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
+      NEXTAUTH_URL: ${NEXTAUTH_URL}
+      MAX_ASSET_SIZE_MB: ${MAX_ASSET_SIZE_MB}
+      OPENAI_API_KEY: ${OPENAI_API_KEY}
+      OPENAI_BASE_URL: ${OPENAI_BASE_URL}
+      INFERENCE_TEXT_MODEL: ${INFERENCE_TEXT_MODEL}
+      INFERENCE_IMAGE_MODEL: ${INFERENCE_IMAGE_MODEL}
+      INFERENCE_CONTEXT_LENGTH: ${INFERENCE_CONTEXT_LENGTH}
+      INFERENCE_JOB_TIMEOUT_SEC: ${INFERENCE_JOB_TIMEOUT_SEC}
+      DISABLE_SIGNUPS: ${DISABLE_SIGNUPS}
+      OAUTH_WELLKNOWN_URL: ${OAUTH_WELLKNOWN_URL}
+      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
+      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
+      OAUTH_PROVIDER_NAME: ${OAUTH_PROVIDER_NAME}
+      OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: ${OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING}
       MEILI_ADDR: http://meilisearch:7700
       BROWSER_WEB_URL: http://chrome:9222
-      # OPENAI_API_KEY: ...
       DATA_DIR: /data
     deploy:
       resources:
@@ -70,9 +84,8 @@ services:
   meilisearch:
     image: getmeili/meilisearch:v1.11.1
     container_name: karakeep_meilisearch
-    env_file:
-      - .env
     environment:
+      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
       MEILI_NO_ANALYTICS: "true"
     volumes:
       #      - meilisearch:/meili_data
@@ -92,4 +105,7 @@ services:
       retries: 3
       start_period: 40s
     restart: unless-stopped
-networks: {}
\ No newline at end of file
+networks:
+  default:
+    external: true
+    name: shared_backend
diff --git a/n8n/docker-compose.yml b/n8n/docker-compose.yml
index 74a7b81..618443f 100644
--- a/n8n/docker-compose.yml
+++ b/n8n/docker-compose.yml
@@ -12,7 +12,7 @@ services:
         - DB_POSTGRESDB_PORT=5432
         - DB_POSTGRESDB_DATABASE=n8n
         - DB_POSTGRESDB_USER=n8n
-        - DB_POSTGRESDB_PASSWORD
+        - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
         - N8N_DIAGNOSTICS_ENABLED=false
         - N8N_PERSONALIZATION_ENABLED=false
         - N8N_ENCRYPTION_KEY
@@ -29,7 +29,6 @@ services:
         - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
         - N8N_ADDITIONAL_NON_UI_ROUTES=auth
         - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
-    env_file: .env
     hostname: n8n
     container_name: n8n
     restart: unless-stopped
@@ -50,7 +49,7 @@ services:
       retries: 10
     volumes:
       - /opt/stacks/n8n/data:/home/node/.n8n
-      - ./hooks.js:/home/node/hooks.js:ro
+      - /opt/stacks/n8n/hooks.js:/home/node/hooks.js:ro
     labels:
       - "homepage.group=productivity"
       - "homepage.name=n8n"
diff --git a/paperless-ngx/docker-compose.yml b/paperless-ngx/docker-compose.yml
index b4ea838..04d961c 100644
--- a/paperless-ngx/docker-compose.yml
+++ b/paperless-ngx/docker-compose.yml
@@ -71,8 +71,17 @@ services:
       - /mnt/pve/unas/media/documents/public/paperless-ngx/library:/usr/src/paperless/media
       - /mnt/pve/unas/media/documents/public/paperless-ngx/export:/usr/src/paperless/export
       - /mnt/pve/unas/media/documents/public/paperless-ngx/consume:/usr/src/paperless/consume
-    env_file: .env
     environment:
+      USERMAP_UID: ${USERMAP_UID}
+      USERMAP_GID: ${USERMAP_GID}
+      PAPERLESS_OCR_LANGUAGES: ${PAPERLESS_OCR_LANGUAGES}
+      PAPERLESS_OCR_LANGUAGE: ${PAPERLESS_OCR_LANGUAGE}
+      PAPERLESS_SECRET_KEY: ${PAPERLESS_SECRET_KEY}
+      PAPERLESS_TIME_ZONE: ${PAPERLESS_TIME_ZONE}
+      PAPERLESS_CONSUMER_DELETE_DUPLICATES: ${PAPERLESS_CONSUMER_DELETE_DUPLICATES}
+      PAPERLESS_CONSUMER_POLLING: ${PAPERLESS_CONSUMER_POLLING}
+      PAPERLESS_CONSUMER_INOTIFY_DELAY: ${PAPERLESS_CONSUMER_INOTIFY_DELAY}
+      PAPERLESS_FILENAME_FORMAT: ${PAPERLESS_FILENAME_FORMAT}
       PAPERLESS_REDIS: redis://broker:6379
       PAPERLESS_DBHOST: 192.168.1.6
       PAPERLESS_TIKA_ENABLED: 1
diff --git a/traccar/docker-compose.yml b/traccar/docker-compose.yml
index 3406e35..b36fcf9 100644
--- a/traccar/docker-compose.yml
+++ b/traccar/docker-compose.yml
@@ -33,7 +33,6 @@ services:
       - /mnt/pve/unas/services/traccar/traccar.xml:/opt/traccar/conf/traccar.xml:ro
       - /opt/stacks/traccar/data:/opt/traccar/data:rw
     image: traccar/traccar:latest
-    environment:
 networks:
   default:
     external: true
diff --git a/vaultwarden/docker-compose.yml b/vaultwarden/docker-compose.yml
index 15776d4..388fa8b 100644
--- a/vaultwarden/docker-compose.yml
+++ b/vaultwarden/docker-compose.yml
@@ -18,9 +18,8 @@ services:
       - "homepage.href=https://vault.nuclide.systems"
       - "homepage.instance.internal.href=http://192.168.1.40:11001"
       - "homepage.instance.public.href=https://vault.nuclide.systems"
-    env_file:
-      - .env
     environment:
+      VW_PG_PASSWORD: ${VW_PG_PASSWORD}
       DOMAIN: https://vault.nuclide.systems # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments
       SIGNUPS_ALLOWED: false # Deactivate this with "false" after you have created your account so that no strangers can register
       SIGNUPS_DOMAINS_WHITELIST: nucli.de