diff --git a/terraform/aws-iac/sectool.json b/terraform/aws-iac/sectool.json
deleted file mode 100644
index 6618a28..0000000
--- a/terraform/aws-iac/sectool.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "provider": "bitwarden",
-    "bitwarden": {
-        "api_url": "https://api.bitwarden.eu",
-        "identity_url": "https://identity.bitwarden.eu"
-    }
-}
\ No newline at end of file
diff --git a/terraform/k8sapps/mail.tf b/terraform/k8sapps/mail.tf
index 099675d..b65ff9a 100644
--- a/terraform/k8sapps/mail.tf
+++ b/terraform/k8sapps/mail.tf
@@ -392,6 +392,7 @@ resource "kubernetes_deployment" "dovecot" {
   }
   depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
   lifecycle {
+    ignore_changes = [spec[0].template[0].metadata[0].annotations]
     replace_triggered_by = [
       kubernetes_config_map.dovecot_config,
       kubernetes_secret.dovecot_users,
@@ -504,6 +505,7 @@ resource "kubernetes_deployment" "postfix" {
   }
   depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
   lifecycle {
+    ignore_changes = [spec[0].template[0].metadata[0].annotations]
     replace_triggered_by = [
       kubernetes_config_map.postfix_config,
       kubernetes_secret.relay_mail_credentials,
diff --git a/terraform/k8sapps/secrets.tf b/terraform/k8sapps/secrets.tf
new file mode 100644
index 0000000..51bb84a
--- /dev/null
+++ b/terraform/k8sapps/secrets.tf
@@ -0,0 +1,77 @@
+variable "wordpress_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+  sensitive   = true
+}
+
+variable "mysql_root_password" {
+  description = "MySQL root password"
+  type        = string
+  sensitive   = true
+}
+
+variable "gitea_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_access_key" {
+  description = "Scaleway Access key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_secret_key" {
+  description = "Scaleway Secret key"
+  type        = string
+  sensitive   = true
+}
+
+variable "nextcloud_mysql_password" {
+  description = "MySQL access password"
+  type        = string
+  sensitive   = true
+}
+
+variable "nextcloud_admin_password" {
+  description = "Nextcloud access password"
+  type        = string
+  sensitive   = true
+}
+
+variable "wireguard_private_key" {
+  description = "Wireguard public key"
+  type        = string
+  sensitive   = true
+}
+
+variable "m3uproxy_admin_password" {
+  description = "M3UProxy access password"
+  type        = string
+  sensitive   = true
+}
+
+variable "m3uproxy_secret" {
+  description = "M3UProxy HMAC secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "maxmind_license_key" {
+  description = "Maxmind license key"
+  type        = string
+  sensitive   = true
+}
+
+variable "rustdesk_private_key" {
+  description = "Rustdesk private key"
+  type        = string
+  sensitive   = true
+}
+
+variable "alexpires_me_email_password" {
+  description = "POP3 password"
+  type        = string
+  sensitive   = true
+}
diff --git a/terraform/k8sapps/variables.tf b/terraform/k8sapps/variables.tf
index eb4a8c9..9339561 100644
--- a/terraform/k8sapps/variables.tf
+++ b/terraform/k8sapps/variables.tf
@@ -1,32 +1,6 @@
-variable "wordpress_mysql_password" {
-  description = "MySQL access password"
-  type        = string
-}
-
-variable "mysql_root_password" {
-  description = "MySQL root password"
-  type        = string
-}
-
-variable "gitea_mysql_password" {
-  description = "MySQL access password"
-  type        = string
-}
-
-variable "scaleway_access_key" {
-  description = "Scaleway Access key"
-  type        = string
-}
-
-variable "scaleway_secret_key" {
-  description = "Scaleway Secret key"
-  type        = string
-}
-
 variable "scaleway_user_id" {
   description = "Scaleway User Id"
   type        = string
-  sensitive   = true
 }
 
 variable "scaleway_project_id" {
@@ -39,63 +13,22 @@ variable "scaleway_organization_id" {
   type        = string
 }
 
-
-variable "nextcloud_mysql_password" {
-  description = "MySQL access password"
-  type        = string
-}
-
-variable "nextcloud_admin_password" {
-  description = "Nextcloud access password"
-  type        = string
-}
-
-variable "wireguard_private_key" {
-  description = "Wireguard public key"
-  type        = string
-}
-
-variable "wireguard_public_key" {
-  description = "Wireguard public key"
-  type        = string
-}
-
-variable "m3uproxy_admin_password" {
-  description = "M3UProxy access password"
-  type        = string
-}
-
-variable "m3uproxy_secret" {
-  description = "M3UProxy HMAC secret"
-  type        = string
-}
-
 variable "maxmind_account_id" {
   description = "Maxmind account ID"
   type        = string
 }
 
-variable "maxmind_license_key" {
-  description = "Maxmind license key"
-  type        = string
-}
-
-variable "rustdesk_private_key" {
-  description = "Rustdesk private key"
-  type        = string
-}
-
-variable "rustdesk_public_key" {
-  description = "Rustdesk public key"
-  type        = string
-}
-
 variable "alexpires_me_email_username" {
   description = "POP3 username"
   type        = string
 }
 
-variable "alexpires_me_email_password" {
-  description = "POP3 password"
+variable "wireguard_public_key" {
+  description = "Wireguard public key"
+  type        = string
+}
+
+variable "rustdesk_public_key" {
+  description = "Rustdesk public key"
   type        = string
 }