Generate all secrets during the configure stage

Modifying the .env during seeding is just a bad idea,
and also doesn't fit what we e.g. need in openshift.
We're better of generating all secrets during configuring and then be done
with it.

This also means we can read-only mount .env and don't have to
persist the storage folder.