diff --git a/nextcloud/nextcloud-backup.hcl b/nextcloud/nextcloud-backup.hcl
index 6d815f0..316f4ad 100644
--- a/nextcloud/nextcloud-backup.hcl
+++ b/nextcloud/nextcloud-backup.hcl
@@ -5,7 +5,8 @@ job "Nextcloud" {
     repo = "/local/repo"
     # Read from secret file
     # Either options.PasswordFile or using readfile()
-    passphrase = "secret phrase"
+    # passphrase = "secret phrase"
+    passwordFile("tmp/passphrase")
   }
 
   task "Create dir for repo" {
diff --git a/nextcloud/nextcloud.nomad b/nextcloud/nextcloud.nomad
index 7f42e37..95ace17 100644
--- a/nextcloud/nextcloud.nomad
+++ b/nextcloud/nextcloud.nomad
@@ -165,9 +165,9 @@ GRANT ALL ON `{{ .Data.data.db_name }}`.* to '{{ .Data.data.db_user }}'@'%';
       template {
         data = <<EOF
         {{ with secret "kv/data/nextcloud" }}
-        MYSQL_DATABASE={{ .Data.data.db_name }}
-        MYSQL_USER={{ .Data.data.db_user }}
-        MYSQL_PASSWORD={{ .Data.data.db_pass }}
+MYSQL_DATABASE={{ .Data.data.db_name }}
+MYSQL_USER={{ .Data.data.db_user }}
+MYSQL_PASSWORD={{ .Data.data.db_pass }}
         {{ end }}
         EOF
         destination = "secrets/db.env"
@@ -214,14 +214,38 @@ GRANT ALL ON `{{ .Data.data.db_name }}`.* to '{{ .Data.data.db_user }}'@'%';
           target = "/jobs"
           source = "jobs"
         }
+
+        mount {
+          type = "bind"
+          target = "/tmp/passphrase"
+          source = "secrets/passphrase"
+        }
       }
 
       env = {
         "MYSQL_HOST" = "${NOMAD_UPSTREAM_IP_mysql_server}"
         "MYSQL_PORT" = "${NOMAD_UPSTREAM_PORT_mysql_server}"
-        "MYSQL_DATABASE" = "${var.nextcloud_db}"
-        "MYSQL_USER" = "${var.nextcloud_user}"
-        "MYSQL_PASSWORD" = "${var.nextcloud_pass}"
+      }
+
+      vault {
+        policies = ["access-tables", "nomad-task"]
+      }
+
+      template {
+        data = "{{ with secret \"kv/data/nextcloud\" }}{{ .Data.data.backup_passphrase }}{{ end }}"
+        destination = "secrets/passphrase"
+      }
+
+      template {
+        data = <<EOF
+        {{ with secret "kv/data/nextcloud" }}
+MYSQL_DATABASE={{ .Data.data.db_name }}
+MYSQL_USER={{ .Data.data.db_user }}
+MYSQL_PASSWORD={{ .Data.data.db_pass }}
+        {{ end }}
+        EOF
+        destination = "secrets/db.env"
+        env = true
       }
 
       template {