diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..03cdeec
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+secrets.yaml
diff --git a/app.py b/app.py
index 65fb71b..1679962 100644
--- a/app.py
+++ b/app.py
@@ -3,9 +3,17 @@ import threading
 import paho.mqtt as mqtt
 import paho.mqtt.client
 import paho.mqtt.publish
+from pathlib import Path
+import os
+import yaml
 import re
 import json
 
+secrets_path = Path(os.environ.get("LIGHTS_WEB_SECRETS", 'secrets.yaml'))
+config_path = Path(os.environ.get("LIGHTS_WEB_CONFIG", 'config.yaml'))
+config = yaml.safe_load(config_path.read_text())
+config.update(yaml.safe_load(secrets_path.read_text()))
+
 c = threading.Condition()
 application = flask.Flask(__name__)
 application.msg="ab"
@@ -30,7 +38,7 @@ application.lights = [False, False, False, False]
 #    print("MQTT Thread: " + str(threading.current_thread()))
 #        
 #mc = mqtt.client.Client()    
-#mc.username_pw_set("light","MG4Dhp6vCZjgbTzJ")
+#mc.username_pw_set(config['mqtt_rw_username'], config['mqtt_rw_password'])
 #mc.connect("10.8.1.16")
 #mc.on_message = on_message
 #mc.subscribe("devices/#")
@@ -49,68 +57,41 @@ def status():
     c.release()
     return json.dumps(st)
 
-config = {
-    "mqtt_server": "sound.waw.hackerspace.pl",
-    "mqtt_port": 1881,
-    "mqtt_username": "light",
-    "mqtt_password": "MG4Dhp6vCZjgbTzJ",
-    "lights": {
-        "l1" : {
-            "enabled": True,
-            "mqtt_path": "devices/light_904649/light_2/on",
-        },
-        "l2": {
-            "enabled": True,
-            "mqtt_path": "devices/light_904649/light_3/on",
-        },
-        "l3": {
-            "enabled": True,
-            "mqtt_path": "devices/light_904649/light_1/on",
-        },
-        "l4": {
-            "enabled": True,
-            "mqtt_path": "iot/077521/relay/on",
-        },
-        "l7": {
-            "enabled": True,
-            "mqtt_path": "devices/light_904649/light_4/on",
-        },
-    }
-}
 
 @application.route("/config")
 def get_config():
-    return flask.jsonify(config)
+    return flask.jsonify({
+        "mqtt_server": config["mqtt_server"],
+        "mqtt_port": config["mqtt_port"],
+        "mqtt_username": config["mqtt_ro_username"],
+        "mqtt_password": config["mqtt_ro_password"],
+        "lights": config['lights']
+    })
+
+def publish(path, payload):
+    mqtt.publish.single(
+        path,
+        payload,
+        qos=1,
+        hostname=config["mqtt_server"],
+        auth = {
+            'username':config["mqtt_rw_username"],
+            'password':config["mqtt_rw_password"]
+        }
+    ) 
 
 @application.route('/light/<lid>/on/set', methods=['POST'])
 def set_light(lid):
     if lid in config["lights"]:
-        mqtt.publish.single(
-            config["lights"][lid]["mqtt_path"] + "/set",
-            "true",
-            qos=1,
-            hostname=config["mqtt_server"],
-            auth = {
-                'username':config["mqtt_username"],
-                'password':config["mqtt_password"]
-            }
-        ) 
-    return flask.jsonify({"ok": True})
+        publish(config["lights"][lid]["mqtt_path"] + "/set", "true")
+        return flask.jsonify({"ok": True})
+
 
 @application.route('/light/<lid>/on/toggle', methods=['POST'])
 def toggle_light(lid):
     if lid in config["lights"]:
-        mqtt.publish.single(
-            config["lights"][lid]["mqtt_path"] + "/toggle",
-            "true",
-            qos=1,
-            hostname=config["mqtt_server"],
-            auth = {
-                'username':config["mqtt_username"],
-                'password':config["mqtt_password"]
-            }
-        ) 
-    return flask.jsonify({"ok": True})
+        publish(config["lights"][lid]["mqtt_path"] + "/toggle", "true")
+        return flask.jsonify({"ok": True})
     
 if __name__ == "__main__":
     application.run(host='127.0.0.1',port=8000,debug=True)
diff --git a/config.yaml b/config.yaml
new file mode 100644
index 0000000..dd8393f
--- /dev/null
+++ b/config.yaml
@@ -0,0 +1,22 @@
+mqtt_server: "sound.waw.hackerspace.pl"
+mqtt_port: 1881
+
+mqtt_ro_username: "lights-ro"
+mqtt_rw_username: "lights-rw"
+
+lights:
+  l1: 
+      enabled: true
+      mqtt_path: "devices/light_904649/light_2/on"
+  l2:
+      enabled: true
+      mqtt_path: "devices/light_904649/light_3/on"
+  l3: 
+      enabled: true
+      mqtt_path: "devices/light_904649/light_1/on"
+  l4:
+      enabled: true
+      mqtt_path: "iot/077521/relay/on"
+  l7: 
+      enabled: true
+      mqtt_path": "devices/light_904649/light_4/on"
diff --git a/secrets.example.yaml b/secrets.example.yaml
new file mode 100644
index 0000000..9a52b25
--- /dev/null
+++ b/secrets.example.yaml
@@ -0,0 +1,2 @@
+mqtt_ro_password: "readonly_password"
+mqtt_rw_password: "readwrite_password"