The release rpm uses a single file with environment variables for all containers. This makes it easy for testing and for newcomers to the system. This convenience comes at the cost of security and proper segregation of information. As written, all containers have access to the private step-ca environment variables.
We recommend that users separate these into one file for each service following the principle of least privilege.
Instead of separating them here, we should create comment blocks as headers for each file as well as a common section that can copied from file to file. It is up to the user to take on the complexity of separating things for their production system.
systemd/configs/openchami.env