diff --git a/bundles/nextcloud/files/managed.config.php b/bundles/nextcloud/files/managed.config.php
index e34802d..70dcefb 100644
--- a/bundles/nextcloud/files/managed.config.php
+++ b/bundles/nextcloud/files/managed.config.php
@@ -1,44 +1,3 @@
 <?php
 # https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
-$CONFIG = array (
-  "dbuser" => "nextcloud",
-  "dbpassword" => "${db_password}",
-  "dbname" => "nextcloud",
-  "dbhost" => "localhost",
-  "dbtype" => "pgsql",
-  "datadirectory" => "/var/lib/nextcloud",
-  "dbport" => "5432",
-  "apps_paths" => [
-    [
-      "path"     => "/opt/nextcloud/apps",
-      "url"      => "/apps",
-      "writable" => false,
-    ],
-    [
-      "path"     => "/var/lib/nextcloud/.userapps",
-      "url"      => "/userapps",
-      "writable" => true,
-    ],
-  ],
-  "cache_path" => "/var/lib/nextcloud/.cache",
-  "upgrade.disable-web" => true,
-  "memcache.local" => "\\OC\\Memcache\\Redis",
-  "memcache.locking" => "\\OC\\Memcache\\Redis",
-  "memcache.distributed" => "\OC\Memcache\Redis",
-  "redis" => [
-    "host" => "/var/run/redis/nextcloud.sock",
-  ],
-  'trusted_domains' =>
-  array (
-    0 => 'localhost',
-    1 => '127.0.0.1',
-    2 => '${hostname}',
-  ),
-  "log_type" => "syslog",
-  "syslog_tag" => "nextcloud",
-  "logfile" => "",
-  "loglevel" => 3,
-  "default_phone_region" => "DE",
-  "versions_retention_obligation" => "auto, 90",
-  "simpleSignUpLink.shown" => false,
-);
+$CONFIG = json_decode(file_get_contents("/etc/nextcloud/managed.config.json"));
diff --git a/bundles/nextcloud/items.py b/bundles/nextcloud/items.py
index 5488589..700bc77 100644
--- a/bundles/nextcloud/items.py
+++ b/bundles/nextcloud/items.py
@@ -1,8 +1,7 @@
-assert node.has_bundle('php')
+import json
 
-from shlex import quote
-from os.path import join
-from mako.template import Template
+
+assert node.has_bundle('php')
 
 version = node.metadata.get('nextcloud/version')
 
@@ -69,19 +68,22 @@ symlinks = {
 
 files = {
     '/etc/nextcloud/managed.config.php': {
-        'content_type': 'mako',
         'owner': 'www-data',
         'group': 'www-data',
         'mode': '640',
-        'context': {
-            'db_password': node.metadata.get('postgresql/roles/nextcloud/password'),
-            'hostname': node.metadata.get('nextcloud/hostname'),
-        },
         'needs': [
             'directory:/etc/nextcloud',
         ],
     },
-}
+    '/etc/nextcloud/managed.config.json': {
+        'content': json.dumps(node.metadata.get('nextcloud/config'), indent=4, sort_keys=True),
+        'owner': 'www-data',
+        'group': 'www-data',
+        'mode': '640',
+        'needs': [
+            'directory:/etc/nextcloud',
+        ],
+    },}
 
 # SETUP
 
@@ -124,7 +126,7 @@ files['/opt/nextcloud_upgrade_status.php'] = {
         'action:extract_nextcloud',
     ],
 }
-    
+
 actions['upgrade_nextcloud'] = {
     'command': repo.libs.nextcloud.occ('upgrade'),
     'unless': 'sudo -u www-data php /opt/nextcloud_upgrade_status.php; test $? -ne 99',
diff --git a/bundles/nextcloud/metadata.py b/bundles/nextcloud/metadata.py
index f6bbac1..6463052 100644
--- a/bundles/nextcloud/metadata.py
+++ b/bundles/nextcloud/metadata.py
@@ -45,7 +45,8 @@ defaults = {
     },
     'nextcloud': {
         'admin_user': 'admin',
-        'admin_pass': repo.vault.password_for(f'{node.name} nextcloud admin pw'),
+        'admin_pass': repo.vault.password_for(f'{node.name} nextcloud admin pw').value,
+        'config': {},
     },
     'php': {
         'post_max_size': '32G',
@@ -65,7 +66,7 @@ defaults = {
     'postgresql': {
         'roles': {
             'nextcloud': {
-                'password': repo.vault.password_for(f'{node.name} nextcloud db pw'),
+                'password': repo.vault.password_for(f'{node.name} nextcloud db pw').value,
             },
         },
         'databases': {
@@ -93,6 +94,57 @@ defaults = {
 }
 
 
+@metadata_reactor.provides(
+    'nextcloud/config',
+)
+def config(metadata):
+    return {
+        'nextcloud': {
+            'config': {
+                'dbuser': 'nextcloud',
+                'dbpassword': metadata.get('postgresql/roles/nextcloud/password'),
+                'dbname': 'nextcloud',
+                'dbhost': 'localhost',
+                'dbtype': 'pgsql',
+                'datadirectory': '/var/lib/nextcloud',
+                'dbport': '5432',
+                'apps_paths': [
+                    {
+                        'path': '/opt/nextcloud/apps',
+                        'url': '/apps',
+                        'writable': False
+                    },
+                    {
+                        'path': '/var/lib/nextcloud/.userapps',
+                        'url': '/userapps',
+                        'writable': True
+                    }
+                ],
+                'cache_path': '/var/lib/nextcloud/.cache',
+                'upgrade.disable-web': True,
+                'memcache.local': '\OC\Memcache\Redis',
+                'memcache.locking': '\OC\Memcache\Redis',
+                'memcache.distributed': '\OC\Memcache\Redis',
+                'redis':{
+                    'host': '/var/run/redis/nextcloud.sock'
+                },
+                'trusted_domains':[
+                    'localhost',
+                    '127.0.0.1',
+                    metadata.get('nextcloud/hostname'),
+                ],
+                'log_type': 'syslog',
+                'syslog_tag': 'nextcloud',
+                'logfile': '',
+                'loglevel':3,
+                'default_phone_region': 'DE',
+                'versions_retention_obligation': 'auto, 90',
+                'simpleSignUpLink.shown': False,
+            },
+        },
+    }
+
+
 @metadata_reactor.provides(
     'zfs/datasets',
 )