diff --git a/.kontinuous/env/dev/templates/www.configmap.yaml b/.kontinuous/env/dev/templates/www.configmap.yaml
index f042ab654..88ee879bb 100644
--- a/.kontinuous/env/dev/templates/www.configmap.yaml
+++ b/.kontinuous/env/dev/templates/www.configmap.yaml
@@ -3,15 +3,9 @@ apiVersion: v1
 metadata:
   name: www
 data:
-  ACCOUNT_MAIL_SENDER: "contact@fabrique.social.gouv.fr"
-  GITLAB_PROJECT_ID: "270"
-  GITLAB_URL: https://gitlab.factory.social.gouv.fr/api/v4
   HASURA_GRAPHQL_ENDPOINT: "http://hasura/v1/graphql"
-  JWT_TOKEN_EXPIRES: "15" # 15 min
   MATOMO_URL: "https://matomo.fabrique.social.gouv.fr/"
-  NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES: "10080"
   NODE_ENV: "production"
-  REFRESH_TOKEN_EXPIRES: "43200"
   SENTRY_DSN: "https://a5e2451c6b5840c0afa28d5e94060427@sentry.fabrique.social.gouv.fr/42"
   SMTP_URL: "smtp.tipimail.com"
   STORAGE_CONTAINER: "cdtn-dev-source"
diff --git a/.kontinuous/env/preprod/templates/www.configmap.yaml b/.kontinuous/env/preprod/templates/www.configmap.yaml
index 6cd1be079..3112bc4c2 100644
--- a/.kontinuous/env/preprod/templates/www.configmap.yaml
+++ b/.kontinuous/env/preprod/templates/www.configmap.yaml
@@ -3,15 +3,9 @@ apiVersion: v1
 metadata:
   name: www
 data:
-  ACCOUNT_MAIL_SENDER: "contact@fabrique.social.gouv.fr"
-  GITLAB_PROJECT_ID: "270"
-  GITLAB_URL: https://gitlab.factory.social.gouv.fr/api/v4
   HASURA_GRAPHQL_ENDPOINT: "http://hasura/v1/graphql"
-  JWT_TOKEN_EXPIRES: "15" # 15 min
   MATOMO_URL: "https://matomo.fabrique.social.gouv.fr/"
-  NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES: "10080"
   NODE_ENV: "production"
-  REFRESH_TOKEN_EXPIRES: "43200"
   SENTRY_DSN: "https://a5e2451c6b5840c0afa28d5e94060427@sentry.fabrique.social.gouv.fr/42"
   SMTP_URL: "smtp.tipimail.com"
   STORAGE_CONTAINER: "cdtn-preprod-source"
diff --git a/.kontinuous/env/prod/templates/www.configmap.yaml b/.kontinuous/env/prod/templates/www.configmap.yaml
index a1b48b6e8..a8e384dd1 100644
--- a/.kontinuous/env/prod/templates/www.configmap.yaml
+++ b/.kontinuous/env/prod/templates/www.configmap.yaml
@@ -3,17 +3,11 @@ apiVersion: v1
 metadata:
   name: www
 data:
-  ACCOUNT_MAIL_SENDER: "contact@fabrique.social.gouv.fr"
-  GITLAB_PROJECT_ID: "270"
-  GITLAB_URL: https://gitlab.factory.social.gouv.fr/api/v4
   HASURA_GRAPHQL_ENDPOINT: "http://hasura/v1/graphql"
-  JWT_TOKEN_EXPIRES: "15" # 15 min
   MATOMO_SITE_ID: "27"
   MATOMO_URL: "https://matomo.fabrique.social.gouv.fr/"
-  NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES: "10080"
   NODE_ENV: "production"
   PRODUCTION: "true"
-  REFRESH_TOKEN_EXPIRES: "43200"
   SENTRY_DSN: "https://a5e2451c6b5840c0afa28d5e94060427@sentry.fabrique.social.gouv.fr/42"
   SMTP_URL: "smtp.tipimail.com"
   STORAGE_CONTAINER: "cdtn"
diff --git a/targets/frontend/.env.sample b/targets/frontend/.env.sample
deleted file mode 100644
index 731822989..000000000
--- a/targets/frontend/.env.sample
+++ /dev/null
@@ -1,35 +0,0 @@
-##
-
-## frontend config
-
-##
-
-##
-
-## Config needed by nextjs at build time
-
-##
-
-# Mail
-
-ACCOUNT_MAIL_SENDER=contact@fabrique.social.gouv.fr
-
-# JWT lifetime (15min)
-
-JWT_TOKEN_EXPIRES=15
-
-# Refresh token lifetime (30 days in minutes)
-
-REFRESH_TOKEN_EXPIRES=43200
-
-# Activation token lifetime (7 days in minutes)
-
-NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES=10080
-
-FRONTEND_URL=http://localhost:3000
-HASURA_GRAPHQL_ENDPOINT=http://localhost:8080/v1/graphql
-HASURA_GRAPHQL_JWT_SECRET={"type": "HS256", "key":"a_pretty_long_secret_key_that_should_be_at_least_32_char"}
-PORT=3000
-
-GITLAB_URL=https://gitlab.factory.social.gouv.fr/api/v4
-GITLAB_PROJECT_ID=270
diff --git a/targets/frontend/src/config.ts b/targets/frontend/src/config.ts
new file mode 100644
index 000000000..e26dffe0d
--- /dev/null
+++ b/targets/frontend/src/config.ts
@@ -0,0 +1,10 @@
+export const ACCOUNT_MAIL_SENDER = "contact@fabrique.social.gouv.fr";
+export const JWT_TOKEN_EXPIRES = 15; // 15 min
+export const REFRESH_TOKEN_EXPIRES = 43200; // 30 days in minutes
+export const ACTIVATION_TOKEN_EXPIRES = 10080; // 7 days in minutes
+export const HASURA_GRAPHQL_JWT_SECRET = process.env
+  .HASURA_GRAPHQL_JWT_SECRET ?? {
+  type: "HS256",
+  key: "a_pretty_long_secret_key_that_should_be_at_least_32_char",
+};
+export const BASE_URL = process.env.FRONTEND_HOST || `http://localhost:3000`;
diff --git a/targets/frontend/src/hoc/CustomUrqlClient.js b/targets/frontend/src/hoc/CustomUrqlClient.js
index 1a9bc6db3..96e387219 100644
--- a/targets/frontend/src/hoc/CustomUrqlClient.js
+++ b/targets/frontend/src/hoc/CustomUrqlClient.js
@@ -1,4 +1,5 @@
 import { withUrqlClient } from "next-urql";
+import { BASE_URL } from "src/config";
 import {
   customAuthExchange,
   customErrorExchange,
@@ -8,9 +9,7 @@ import { cacheExchange, dedupExchange, fetchExchange } from "urql";
 export const withCustomUrqlClient = (Component) =>
   withUrqlClient(
     (ssrExchange, ctx) => {
-      const url = ctx?.req
-        ? `${process.env.FRONTEND_URL}/api/graphql`
-        : `/api/graphql`;
+      const url = ctx?.req ? `${BASE_URL}/api/graphql` : `/api/graphql`;
       console.log(
         "[ withUrqlClient ]",
         ctx ? (ctx?.req ? "server" : "client") : "no ctx",
diff --git a/targets/frontend/src/lib/auth/jwt.js b/targets/frontend/src/lib/auth/jwt.js
index 89b80ae4d..949b5c410 100644
--- a/targets/frontend/src/lib/auth/jwt.js
+++ b/targets/frontend/src/lib/auth/jwt.js
@@ -1,6 +1,8 @@
 import jwt, { verify } from "jsonwebtoken";
 
-const { HASURA_GRAPHQL_JWT_SECRET, JWT_TOKEN_EXPIRES } = process.env;
+import { HASURA_GRAPHQL_JWT_SECRET } from "../../config";
+
+import { JWT_TOKEN_EXPIRES } from "../../config";
 
 let jwtSecret;
 try {
diff --git a/targets/frontend/src/lib/auth/setJwtCookie.js b/targets/frontend/src/lib/auth/setJwtCookie.js
index dc0faa86c..4a4a4ccdf 100644
--- a/targets/frontend/src/lib/auth/setJwtCookie.js
+++ b/targets/frontend/src/lib/auth/setJwtCookie.js
@@ -1,10 +1,11 @@
 import cookie from "cookie";
+import { REFRESH_TOKEN_EXPIRES } from "../../config";
 
 export function setJwtCookie(res, refresh_token, jwt_token) {
   const cookies = [
     cookie.serialize("refresh_token", refresh_token, {
       httpOnly: true,
-      maxAge: parseInt(process.env.REFRESH_TOKEN_EXPIRES, 10) * 60, // maxAge in second
+      maxAge: parseInt(REFRESH_TOKEN_EXPIRES, 10) * 60, // maxAge in second
       path: "/",
       sameSite: "Strict",
       secure: process.env.NODE_ENV === "production",
diff --git a/targets/frontend/src/lib/auth/token.js b/targets/frontend/src/lib/auth/token.js
index 0544ed077..d848029e0 100644
--- a/targets/frontend/src/lib/auth/token.js
+++ b/targets/frontend/src/lib/auth/token.js
@@ -39,9 +39,7 @@ export async function auth(ctx) {
   try {
     console.log("[auth] refresh token");
     const tokenData = await request(
-      ctx?.req
-        ? `${process.env.FRONTEND_URL}/api/refresh_token`
-        : "/api/refresh_token",
+      ctx?.req ? `${BASE_URL}/api/refresh_token` : "/api/refresh_token",
       {
         body: {},
         credentials: "include",
diff --git a/targets/frontend/src/lib/emails/activateAccount.ts b/targets/frontend/src/lib/emails/activateAccount.ts
index 76b56040a..5dc7e370e 100644
--- a/targets/frontend/src/lib/emails/activateAccount.ts
+++ b/targets/frontend/src/lib/emails/activateAccount.ts
@@ -1,8 +1,6 @@
+import { BASE_URL } from "src/config";
 import sendmail from "./sendmail";
 
-const BASE_URL =
-  process.env.FRONTEND_HOST || `http://localhost:${process.env.PORT}`;
-
 export function sendActivateAccountEmail(email: string, secret_token: string) {
   const subject = "Activation de votre compte";
   const activateUrl = `${BASE_URL}/change_password?token=${secret_token}&activate=1`; // todo: dynamic hostname
diff --git a/targets/frontend/src/lib/emails/lostPassword.js b/targets/frontend/src/lib/emails/lostPassword.js
index f76b1b177..35d6bae69 100644
--- a/targets/frontend/src/lib/emails/lostPassword.js
+++ b/targets/frontend/src/lib/emails/lostPassword.js
@@ -1,8 +1,6 @@
+import { BASE_URL } from "../../config";
 import sendmail from "./sendmail";
 
-const BASE_URL =
-  process.env.FRONTEND_HOST || `http://localhost:${process.env.PORT}`;
-
 export function sendLostPasswordEmail(email, secret_token) {
   const activateUrl = `${BASE_URL}/change_password?token=${secret_token}`; // todo: dynamic hostname
   const subject = "Réinitialisation de votre mot de passe";
diff --git a/targets/frontend/src/pages/api/graphql.js b/targets/frontend/src/pages/api/graphql.js
index e8c907512..8261842c8 100644
--- a/targets/frontend/src/pages/api/graphql.js
+++ b/targets/frontend/src/pages/api/graphql.js
@@ -20,7 +20,8 @@ const proxy = createProxyMiddleware({
   },
   pathRewrite: { "^/api/graphql": "/v1/graphql" },
   prependPath: false,
-  target: process.env.HASURA_GRAPHQL_ENDPOINT,
+  target:
+    process.env.HASURA_GRAPHQL_ENDPOINT ?? "http://localhost:8080/v1/graphql",
   ws: true,
   xfwd: true, // proxy websockets
 });
diff --git a/targets/frontend/src/pages/api/login.js b/targets/frontend/src/pages/api/login.js
index 81490541a..c30d8982a 100644
--- a/targets/frontend/src/pages/api/login.js
+++ b/targets/frontend/src/pages/api/login.js
@@ -9,7 +9,9 @@ import { getExpiryDate } from "src/lib/duration";
 
 import { loginQuery, refreshTokenMutation } from "./login.gql";
 
-const { REFRESH_TOKEN_EXPIRES = "", JWT_TOKEN_EXPIRES = "" } = process.env;
+const { REFRESH_TOKEN_EXPIRES = "" } = process.env;
+
+import { JWT_TOKEN_EXPIRES } from "../../config";
 
 export default async function login(req, res) {
   const apiError = createErrorFor(res);
diff --git a/targets/frontend/src/pages/api/refresh_token.js b/targets/frontend/src/pages/api/refresh_token.js
index 02e61bfc0..5c574cbe5 100644
--- a/targets/frontend/src/pages/api/refresh_token.js
+++ b/targets/frontend/src/pages/api/refresh_token.js
@@ -6,6 +6,7 @@ import { generateJwtToken } from "src/lib/auth/jwt";
 import { setJwtCookie } from "src/lib/auth/setJwtCookie";
 import { getExpiryDate } from "src/lib/duration";
 import { v4 as uuidv4 } from "uuid";
+import { REFRESH_TOKEN_EXPIRES, JWT_TOKEN_EXPIRES } from "../../config";
 
 import {
   deletePreviousRefreshTokenMutation,
@@ -66,9 +67,7 @@ export default async function refreshToken(req, res) {
   result = await client
     .mutation(deletePreviousRefreshTokenMutation, {
       new_refresh_token_data: {
-        expires_at: getExpiryDate(
-          parseInt(process.env.REFRESH_TOKEN_EXPIRES, 10)
-        ),
+        expires_at: getExpiryDate(parseInt(REFRESH_TOKEN_EXPIRES, 10)),
         refresh_token: new_refresh_token,
         user_id: user.id,
       },
@@ -87,9 +86,7 @@ export default async function refreshToken(req, res) {
 
   res.json({
     jwt_token,
-    jwt_token_expiry: getExpiryDate(
-      parseInt(process.env.JWT_TOKEN_EXPIRES, 10) || 15
-    ),
+    jwt_token_expiry: getExpiryDate(parseInt(JWT_TOKEN_EXPIRES, 10) || 15),
     refresh_token: new_refresh_token,
   });
 }
diff --git a/targets/frontend/src/pages/api/reset_password.js b/targets/frontend/src/pages/api/reset_password.js
index d887aeb41..89d6676a2 100644
--- a/targets/frontend/src/pages/api/reset_password.js
+++ b/targets/frontend/src/pages/api/reset_password.js
@@ -4,6 +4,7 @@ import { client } from "@shared/graphql-client";
 import { createErrorFor } from "src/lib/apiError";
 import { getExpiryDate } from "src/lib/duration";
 import { v4 as uuidv4 } from "uuid";
+import { ACTIVATION_TOKEN_EXPIRES } from "../../config";
 
 export default async function reset_password(req, res) {
   const apiError = createErrorFor(res);
@@ -28,9 +29,7 @@ export default async function reset_password(req, res) {
   const result = await client
     .mutation(udpateSecretTokenMutation, {
       email,
-      expires: getExpiryDate(
-        parseInt(process.env.NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES, 10)
-      ),
+      expires: getExpiryDate(parseInt(ACTIVATION_TOKEN_EXPIRES, 10)),
       secret_token,
     })
     .toPromise();
diff --git a/targets/frontend/src/pages/api/storage/[path].js b/targets/frontend/src/pages/api/storage/[path].js
index a148f0504..5bfd18c83 100644
--- a/targets/frontend/src/pages/api/storage/[path].js
+++ b/targets/frontend/src/pages/api/storage/[path].js
@@ -2,9 +2,10 @@ import Boom from "@hapi/boom";
 import { verify } from "jsonwebtoken";
 import { createErrorFor } from "src/lib/apiError";
 import { deleteBlob } from "src/lib/azure";
+import { HASURA_GRAPHQL_JWT_SECRET } from "../../../config";
 
 const container = process.env.STORAGE_CONTAINER;
-const jwtSecret = JSON.parse(process.env.HASURA_GRAPHQL_JWT_SECRET);
+const jwtSecret = JSON.parse(HASURA_GRAPHQL_JWT_SECRET);
 
 export default async function deleteFiles(req, res) {
   const apiError = createErrorFor(res);
diff --git a/targets/frontend/src/pages/api/storage/index.js b/targets/frontend/src/pages/api/storage/index.js
index 49c399d02..9d114442b 100644
--- a/targets/frontend/src/pages/api/storage/index.js
+++ b/targets/frontend/src/pages/api/storage/index.js
@@ -5,9 +5,10 @@ import { createErrorFor } from "src/lib/apiError";
 import { getContainerBlobs, uploadBlob } from "src/lib/azure";
 import { isUploadFileSafe } from "src/lib/secu";
 import * as stream from "stream";
+import { HASURA_GRAPHQL_JWT_SECRET } from "../../../config";
 
 const container = process.env.STORAGE_CONTAINER;
-const jwtSecret = JSON.parse(process.env.HASURA_GRAPHQL_JWT_SECRET);
+const jwtSecret = JSON.parse(HASURA_GRAPHQL_JWT_SECRET);
 
 async function endPoint(req, res) {
   const apiError = createErrorFor(res);
diff --git a/targets/frontend/src/pages/fichiers.js b/targets/frontend/src/pages/fichiers.js
index 66a0b7ca2..1387d8a4f 100644
--- a/targets/frontend/src/pages/fichiers.js
+++ b/targets/frontend/src/pages/fichiers.js
@@ -30,7 +30,7 @@ import {
 } from "@mui/material";
 
 const listFiles = () =>
-  request(`${process.env.FRONTEND_URL || ""}/api/storage`, {
+  request(`/api/storage`, {
     headers: { token: getToken()?.jwt_token || "" },
   });
 
diff --git a/targets/frontend/src/pages/user/new.js b/targets/frontend/src/pages/user/new.js
index 68dc81e65..10edc24d2 100644
--- a/targets/frontend/src/pages/user/new.js
+++ b/targets/frontend/src/pages/user/new.js
@@ -7,6 +7,7 @@ import { withUserProvider } from "src/hoc/UserProvider";
 import { getExpiryDate } from "src/lib/duration";
 import { useMutation } from "urql";
 import { Alert } from "@mui/material";
+import { ACTIVATION_TOKEN_EXPIRES } from "../../config";
 
 const registerUserMutation = `
 mutation registerUser($user: auth_users_insert_input! ) {
@@ -29,7 +30,7 @@ function prepareMutationData(input) {
     user: {
       ...input,
       secret_token_expires_at: getExpiryDate(
-        parseInt(process.env.NEXT_PUBLIC_ACTIVATION_TOKEN_EXPIRES, 10)
+        parseInt(ACTIVATION_TOKEN_EXPIRES, 10)
       ),
       user_roles: { data: { role: input.default_role } },
     },