since we place files/.env.tmpl under blackbox, there is no need
to maintain files/env.gpg anymore. still we keep files/.env gitignored
because we will write sensitive data to it from files/.env.tmpl