- Export vyos active configuration with `show configuration json` - Replace secrets (encrypted-password, OTP key) with variables from secrets.env - Replace dynamic values (public IP) with variables from vyos.env