diff --git a/.gitignore b/.gitignore
index 15d760d98d..55b8e4c6c1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-/config.yml
 /unsigned/
 /repo/*
 /archive/
@@ -29,3 +28,6 @@ keystore.p12
 !/repo/index.css
 !/repo/index.html
 !/repo/index.png
+
+# source of env vars to store secrets for config.yml
+/variables
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 69a863b4f0..0be576f2d7 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -199,12 +199,11 @@ fdroid lint config:
           - config/*/*.yml
   script:
     - chown -R $(whoami) .
-    - fdroid lint config/*.yml config/*/*.yml
+    - chmod 0600 config.yml config/*.yml config/*/*.yml
+    - export gpghome=foo keystore=foo keystorepass=foo keypass=foo serverwebconfig=foo
+    - fdroid lint config.yml config/*.yml config/*/*.yml
     # Alternate English locales must include the country code, e.g. en-GB.
     - python3 -c "import os; exit(os.path.exists('config/en/'))"
-    # TODO once config.yml is added to fdroiddata, add it to the line above
-    - test -e config.yml || exit 0
-    - fdroid lint config.yml
 
 
 lint:
diff --git a/config.py b/config.py
deleted file mode 100644
index b2e2b36edd..0000000000
--- a/config.py
+++ /dev/null
@@ -1,38 +0,0 @@
-
-repo_url = "http://f-droid.org/repo"
-repo_maxage = 14
-
-archive_older = 3
-archive_url = "https://f-droid.org/archive"
-
-repo_keyalias = 'ciarang'
-repo_pubkey = '3082035e30820246a00302010202044c49cd00300d06092a864886f70d01010505003071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b73301e170d3130303732333137313032345a170d3337313230383137313032345a3071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b7330820122300d06092a864886f70d01010105000382010f003082010a028201010096d075e47c014e7822c89fd67f795d23203e2a8843f53ba4e6b1bf5f2fd0e225938267cfcae7fbf4fe596346afbaf4070fdb91f66fbcdf2348a3d92430502824f80517b156fab00809bdc8e631bfa9afd42d9045ab5fd6d28d9e140afc1300917b19b7c6c4df4a494cf1f7cb4a63c80d734265d735af9e4f09455f427aa65a53563f87b336ca2c19d244fcbba617ba0b19e56ed34afe0b253ab91e2fdb1271f1b9e3c3232027ed8862a112f0706e234cf236914b939bcf959821ecb2a6c18057e070de3428046d94b175e1d89bd795e535499a091f5bc65a79d539a8d43891ec504058acb28c08393b5718b57600a211e803f4a634e5c57f25b9b8c4422c6fd90203010001300d06092a864886f70d0101050500038201010008e4ef699e9807677ff56753da73efb2390d5ae2c17e4db691d5df7a7b60fc071ae509c5414be7d5da74df2811e83d3668c4a0b1abc84b9fa7d96b4cdf30bba68517ad2a93e233b042972ac0553a4801c9ebe07bf57ebe9a3b3d6d663965260e50f3b8f46db0531761e60340a2bddc3426098397fda54044a17e5244549f9869b460ca5e6e216b6f6a2db0580b480ca2afe6ec6b46eedacfa4aa45038809ece0c5978653d6c85f678e7f5a2156d1bedd8117751e64a4b0dcd140f3040b021821a8d93aed8d01ba36db6c82372211fed714d9a32607038cdfd565bd529ffc637212aaa2c224ef22b603eccefb5bf1e085c191d4b24fe742b17ab3f55d4e6f05ef'
-
-gpgkey = '1DBA2E89'
-gpghome = '/home/fdroid/.gnupg'
-
-keystore = '/home/fdroid/keystore.jks'
-keystorepass = 'placeholder'
-keypass = 'placeholder'
-keydname = "CN=FDroid, OU=FDroid, O=fdroid.org, L=ORG, S=ORG, C=UK"
-
-keyaliases = {}
-keyaliases['org.fdroid.fdroid'] = 'ciarang'
-keyaliases['org.fdroid.fdroid.privileged'] = 'ciarang'
-keyaliases['com.ghostsq.commander.samba'] = '@com.ghostsq.commander'
-keyaliases['com.ghostsq.commander.sftp'] = '@com.ghostsq.commander'
-keyaliases['com.ghostsq.commander.smb'] = '@com.ghostsq.commander'
-keyaliases['com.termux.api'] = '@com.termux'
-keyaliases['com.termux.widget'] = '@com.termux'
-keyaliases['com.termux.styling'] = '@com.termux'
-keyaliases['com.termux.tasker'] = '@com.termux'
-keyaliases['com.termux.window'] = '@com.termux'
-keyaliases['com.termux.boot'] = '@com.termux'
-keyaliases['com.termux.gui'] = '@com.termux'
-keyaliases['com.nextcloud.talk2'] = '@com.nextcloud.client'
-
-serverwebroot = 'fdroid@example.com:/home/fdroid/public_html'
-nonstandardwebroot = True
-
-build_server_always = True
-make_current_version_link = False
diff --git a/config.yml b/config.yml
new file mode 100644
index 0000000000..e3edd9fce3
--- /dev/null
+++ b/config.yml
@@ -0,0 +1,40 @@
+---
+
+repo_url: "https://f-droid.org/repo"
+repo_maxage: 14
+repo_web_base_url: "https://f-droid.org/packages"
+
+archive_older: 3
+archive_url: "https://f-droid.org/archive"
+
+repo_keyalias: ciarang
+repo_pubkey: 3082035e30820246a00302010202044c49cd00300d06092a864886f70d01010505003071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b73301e170d3130303732333137313032345a170d3337313230383137313032345a3071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b7330820122300d06092a864886f70d01010105000382010f003082010a028201010096d075e47c014e7822c89fd67f795d23203e2a8843f53ba4e6b1bf5f2fd0e225938267cfcae7fbf4fe596346afbaf4070fdb91f66fbcdf2348a3d92430502824f80517b156fab00809bdc8e631bfa9afd42d9045ab5fd6d28d9e140afc1300917b19b7c6c4df4a494cf1f7cb4a63c80d734265d735af9e4f09455f427aa65a53563f87b336ca2c19d244fcbba617ba0b19e56ed34afe0b253ab91e2fdb1271f1b9e3c3232027ed8862a112f0706e234cf236914b939bcf959821ecb2a6c18057e070de3428046d94b175e1d89bd795e535499a091f5bc65a79d539a8d43891ec504058acb28c08393b5718b57600a211e803f4a634e5c57f25b9b8c4422c6fd90203010001300d06092a864886f70d0101050500038201010008e4ef699e9807677ff56753da73efb2390d5ae2c17e4db691d5df7a7b60fc071ae509c5414be7d5da74df2811e83d3668c4a0b1abc84b9fa7d96b4cdf30bba68517ad2a93e233b042972ac0553a4801c9ebe07bf57ebe9a3b3d6d663965260e50f3b8f46db0531761e60340a2bddc3426098397fda54044a17e5244549f9869b460ca5e6e216b6f6a2db0580b480ca2afe6ec6b46eedacfa4aa45038809ece0c5978653d6c85f678e7f5a2156d1bedd8117751e64a4b0dcd140f3040b021821a8d93aed8d01ba36db6c82372211fed714d9a32607038cdfd565bd529ffc637212aaa2c224ef22b603eccefb5bf1e085c191d4b24fe742b17ab3f55d4e6f05ef
+
+gpgkey: 1DBA2E89
+gpghome: {env: gpghome}
+
+keystore: {env: keystore}
+keydname: "CN=FDroid, OU=FDroid, O=fdroid.org, L=ORG, S=ORG, C=UK"
+keystorepass: {env: keystorepass}
+keypass: {env: keypass}
+
+serverwebroot: {env: serverwebroot}
+nonstandardwebroot: true
+
+build_server_always: true
+make_current_version_link: false
+
+keyaliases:
+  com.ghostsq.commander.samba: '@com.ghostsq.commander'
+  com.ghostsq.commander.sftp: '@com.ghostsq.commander'
+  com.ghostsq.commander.smb: '@com.ghostsq.commander'
+  com.nextcloud.talk2: '@com.nextcloud.client'
+  com.termux.api: '@com.termux'
+  com.termux.boot: '@com.termux'
+  com.termux.gui: '@com.termux'
+  com.termux.styling: '@com.termux'
+  com.termux.tasker: '@com.termux'
+  com.termux.widget: '@com.termux'
+  com.termux.window: '@com.termux'
+  org.fdroid.fdroid.privileged: 'ciarang'
+  org.fdroid.fdroid: 'ciarang'