diff --git a/plays/traefik.yml b/plays/traefik.yml
index b002eaf..f679df3 100644
--- a/plays/traefik.yml
+++ b/plays/traefik.yml
@@ -4,5 +4,4 @@
   roles:
     - role: roles/firewall
     - role: roles/docker
-    - role: roles/env
     - role: roles/traefik
diff --git a/roles/traefik/defaults/main.yml b/roles/traefik/defaults/main.yml
index fff0b66..02f27b2 100644
--- a/roles/traefik/defaults/main.yml
+++ b/roles/traefik/defaults/main.yml
@@ -7,7 +7,7 @@ traefik_metrics_port: 8100
 traefik_dashboard_insecure: true   # ufw should only allow from tailscale or vnet
 traefik_acme_staging: "{{ lookup('env', 'TRAEFIK_ACME_STAGING') | default('false', true) }}"
 
-domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
+traefik_domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
 # Single source of truth for static routing. Expected to be overridden
 # from group_vars, -e, or an env-var lookup at the play level — see
 # playbook.yml for the TRAEFIK_ROUTES example.
diff --git a/roles/traefik/tasks/install.yml b/roles/traefik/tasks/install.yml
index 6fc4302..0504cd5 100644
--- a/roles/traefik/tasks/install.yml
+++ b/roles/traefik/tasks/install.yml
@@ -5,7 +5,7 @@
       traefik_web_private_ips is empty. Set the WEB_IPS env var
       (JSON list) before running, or override the variable directly, e.g.
       -e traefik_web_private_ips='["10.0.1.11","10.0.1.12"]'
-  when: env_vars.WEB_IPS | length == 0
+  when: traefik_web_private_ips | length == 0
 
 - name: Ensure Traefik config directories exist
   ansible.builtin.file:
diff --git a/roles/traefik/templates/dynamic-analytics.yml.j2 b/roles/traefik/templates/dynamic-analytics.yml.j2
index 42ce8fc..1b95aa2 100644
--- a/roles/traefik/templates/dynamic-analytics.yml.j2
+++ b/roles/traefik/templates/dynamic-analytics.yml.j2
@@ -3,22 +3,22 @@
 http:
   routers:
     analytics:
-      rule: "Host(`analytics.{{ env_vars.DOMAIN }}`)"
+      rule: "Host(`analytics.{{ traefik_domain }}`)"
       entryPoints:
         - websecure
       service: analytics-svc
       tls:
         certResolver: letsencrypt
         domains:
-          - main: "analytics.{{ env_vars.DOMAIN }}"
+          - main: "analytics.{{ traefik_domain }}"
             sans:
-              - "blog.{{ env_vars.DOMAIN }}"
+              - "blog.{{ traefik_domain }}"
 
   services:
     analytics-svc:
       loadBalancer:
         servers:
-          - url: "http://{{ env_vars.ANALYTICS_IP }}:3000"
+          - url: "http://{{ traefik_analytics_private_ip }}:3000"
         healthCheck:
           path: /api/heartbeat
           interval: "10s"
diff --git a/roles/traefik/templates/dynamic-hosts.yml.j2 b/roles/traefik/templates/dynamic-hosts.yml.j2
index 5844d6f..4d57a95 100644
--- a/roles/traefik/templates/dynamic-hosts.yml.j2
+++ b/roles/traefik/templates/dynamic-hosts.yml.j2
@@ -3,22 +3,22 @@
 http:
   routers:
     retailor-web:
-      rule: "Host(`app.{{ env_vars.DOMAIN }}`)"
+      rule: "Host(`app.{{ traefik_domain }}`)"
       service: retailor-web-svc
       entryPoints:
         - websecure
       tls:
         certResolver: letsencrypt
         domains:
-          - main: "app.{{ env_vars.DOMAIN }}"
+          - main: "app.{{ traefik_domain }}"
             sans:
-              - "blog.{{ env_vars.DOMAIN }}"
+              - "blog.{{ traefik_domain }}"
 
   services:
     retailor-web-svc:
       loadBalancer:
         servers:
-{% for web_ip in env_vars.WEB_IPS | from_json %}
+{% for web_ip in traefik_web_private_ips | from_json %}
           - url: "http://{{ web_ip }}:80"
 {% endfor %}
         healthCheck: