diff --git a/.env.example b/.env.template
similarity index 60%
rename from .env.example
rename to .env.template
index 05c08f8..a460fd4 100644
--- a/.env.example
+++ b/.env.template
@@ -1,12 +1,11 @@
-GF_SECURITY_ADMIN_USER=admin
-GF_SECURITY_ADMIN_PASSWORD=notadmin
 ZCASHD_RPCUSER=zcashrpc
-ZCASHD_RPCPASSWORD=notsecure
+ZCASHD_RPCPASSWORD=${PASSWORD_ZCASHD}
 ZCASHD_RPCPORT=38232
 ZCASHD_ALLOWIP=0.0.0.0/0
 ZCASHD_DATADIR=/srv/zcashd/.zcash
 ZCASHD_PARMDIR=/srv/zcashd/.zcash-params
-ZCASHD_NETWORK=testnet
 ZCASHD_GEN=0
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=${PASSWORD_GRAFANA}
 LWD_PORT=9067
-ZCASHD_CONF_PATH=/srv/lightwalletd/zcash.conf
\ No newline at end of file
+ZCASHD_CONF_PATH=/srv/lightwalletd/zcash.conf
diff --git a/buildenv.sh b/buildenv.sh
new file mode 100755
index 0000000..8b127a6
--- /dev/null
+++ b/buildenv.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+for i in "$@"
+do
+case $i in
+  -h|--help)
+  echo HELP
+  exit 0
+  ;;
+  -n=*|--network=*)
+  NETWORK="${i#*=}"
+  shift
+  ;;
+  *)
+  echo Unknown option. Use -h for help.
+  exit -1
+  ;;
+esac
+done
+
+if [ "$NETWORK" == "" ]
+then
+  echo ZCASHD_NETWORK=testnet
+else
+  echo ZCASHD_NETWORK=$NETWORK
+fi
+
+# sanity check openssl first...
+
+if [ `openssl rand -base64 32 | wc -c` != 45 ] 
+then 
+  echo Openssl password generation failed.
+  exit 1 
+fi
+
+PASSWORD_GRAFANA=`openssl rand -base64 32`
+PASSWORD_ZCASHD=`openssl rand -base64 32`
+
+while read TEMPLATE
+do
+  eval echo $TEMPLATE
+done < .env.template