diff --git a/data/environment/production.yaml b/data/environment/production.yaml
new file mode 100644
--- /dev/null
+++ b/data/environment/production.yaml
@@ -0,0 +1,14 @@
+---
+swh::deploy::worker::instances:
+  - checker_deposit
+  - lister
+  - loader_archive
+  - loader_cran
+  - loader_debian
+  - loader_deposit
+  - loader_git
+  - loader_mercurial
+  - loader_nixguix
+  - loader_npm
+  - loader_pypi
+  - loader_svn
diff --git a/data/location/sesi_rocquencourt_staging.yaml b/data/environment/staging.yaml
copy from data/location/sesi_rocquencourt_staging.yaml
copy to data/environment/staging.yaml
--- a/data/location/sesi_rocquencourt_staging.yaml
+++ b/data/environment/staging.yaml
@@ -1,29 +1,24 @@
 ---
+swh::deploy::worker::instances:
+  - checker_deposit
+  - loader_archive
+  - loader_cran
+  - loader_debian
+  - loader_deposit
+  - loader_nixguix
+  - loader_git
+  - loader_mercurial
+  - loader_npm
+  - loader_pypi
+  - loader_svn
+  - vault_cooker
+  - lister
+  - indexer_origin_intrinsic_metadata
+
 swh::deploy::environment: staging
 backups::enable: false
 
 dns::local_cache: false
-dns::nameservers:
-  - 192.168.100.29
-dns::search_domains:
-  - internal.staging.swh.network
-
-dns::local_nameservers:
-  - 192.168.100.29
-  - 192.168.200.22
-
-dns::forwarders:
-  - 193.51.196.130
-  - 193.51.196.131
-dns::forwarder_insecure: true
-
-ntp::servers:
-  - sesi-ntp1.inria.fr
-  - sesi-ntp2.inria.fr
-
-internal_network: 192.168.128.0/24
-
-smtp::relay_hostname: 'smtp.inria.fr'
 
 swh::deploy::worker::loader_nixguix::loglevel: debug
 
@@ -51,22 +46,6 @@
 swh::deploy::worker::lister::db::user: swh-lister
 swh::deploy::worker::lister::db::name: swh-lister
 
-swh::deploy::worker::instances:
-  - checker_deposit
-  - loader_archive
-  - loader_cran
-  - loader_debian
-  - loader_deposit
-  - loader_nixguix
-  - loader_git
-  - loader_mercurial
-  - loader_npm
-  - loader_pypi
-  - loader_svn
-  - vault_cooker
-  - lister
-  - indexer_origin_intrinsic_metadata
-
 #### Rabbitmq instance to use
 # swh::deploy::worker::task_broker::password in private data
 swh::deploy::worker::task_broker: "amqp://swhconsumer:%{hiera('swh::deploy::worker::task_broker::password')}@scheduler0.internal.staging.swh.network:5672/%2f"
diff --git a/data/location/sesi_rocquencourt.yaml b/data/location/sesi_rocquencourt.yaml
--- a/data/location/sesi_rocquencourt.yaml
+++ b/data/location/sesi_rocquencourt.yaml
@@ -12,20 +12,6 @@
   - sesi-ntp1.inria.fr
   - sesi-ntp2.inria.fr
 
-internal_network: 192.168.100.0/24
-
 smtp::relay_hostname: 'smtp.inria.fr'
 
-swh::deploy::worker::instances:
-  - checker_deposit
-  - lister
-  - loader_archive
-  - loader_cran
-  - loader_debian
-  - loader_deposit
-  - loader_git
-  - loader_mercurial
-  - loader_nixguix
-  - loader_npm
-  - loader_pypi
-  - loader_svn
+internal_network: 192.168.100.0/24
diff --git a/data/location/sesi_rocquencourt_staging.yaml b/data/location/sesi_rocquencourt_staging.yaml
--- a/data/location/sesi_rocquencourt_staging.yaml
+++ b/data/location/sesi_rocquencourt_staging.yaml
@@ -1,8 +1,4 @@
 ---
-swh::deploy::environment: staging
-backups::enable: false
-
-dns::local_cache: false
 dns::nameservers:
   - 192.168.100.29
 dns::search_domains:
@@ -24,106 +20,3 @@
 internal_network: 192.168.128.0/24
 
 smtp::relay_hostname: 'smtp.inria.fr'
-
-swh::deploy::worker::loader_nixguix::loglevel: debug
-
-swh::deploy::storage::db::host: db0.internal.staging.swh.network
-swh::deploy::storage::db::user: swh
-swh::deploy::storage::db::dbname: swh
-
-swh::deploy::indexer::storage::db::host: db0.internal.staging.swh.network
-swh::deploy::indexer::storage::db::user: swh-indexer
-swh::deploy::indexer::storage::db::dbname: swh-indexer
-
-swh::deploy::scheduler::db::host: db0.internal.staging.swh.network
-swh::deploy::scheduler::db::dbname: swh-scheduler
-swh::deploy::scheduler::db::user: swh-scheduler
-
-swh::deploy::deposit::db::host: deposit.internal.staging.swh.network
-swh::deploy::deposit::db::dbuser: swh-deposit
-swh::deploy::deposit::db::dbname: swh-deposit
-
-swh::deploy::vault::db::host: db0.internal.staging.swh.network
-swh::deploy::vault::db::user: swh-vault
-swh::deploy::vault::db::dbname: swh-vault
-
-swh::deploy::worker::lister::db::host: db0.internal.staging.swh.network
-swh::deploy::worker::lister::db::user: swh-lister
-swh::deploy::worker::lister::db::name: swh-lister
-
-swh::deploy::worker::instances:
-  - checker_deposit
-  - loader_archive
-  - loader_cran
-  - loader_debian
-  - loader_deposit
-  - loader_nixguix
-  - loader_git
-  - loader_mercurial
-  - loader_npm
-  - loader_pypi
-  - loader_svn
-  - vault_cooker
-  - lister
-  - indexer_origin_intrinsic_metadata
-
-#### Rabbitmq instance to use
-# swh::deploy::worker::task_broker::password in private data
-swh::deploy::worker::task_broker: "amqp://swhconsumer:%{hiera('swh::deploy::worker::task_broker::password')}@scheduler0.internal.staging.swh.network:5672/%2f"
-
-#### Storage/Indexer/Vault/Scheduler services to use in staging area
-
-swh::remote_service::storage::config::storage0:
-  cls: remote
-  args:
-    url: "http://storage0.internal.staging.swh.network:%{hiera('swh::remote_service::storage::port')}/"
-swh::remote_service::storage::config: "%{alias('swh::remote_service::storage::config::storage0')}"
-swh::remote_service::storage::config::writable: &swh_remote_service_storage_config_writable
-  "%{alias('swh::remote_service::storage::config::storage0')}"
-
-swh::remote_service::vault::config::vault0:
-  cls: remote
-  args:
-    url: "http://vault.internal.staging.swh.network:%{hiera('swh::remote_service::vault::port')}/"
-swh::remote_service::vault::config: "%{alias('swh::remote_service::vault::config::vault0')}"
-swh::remote_service::vault::config::writable: "%{alias('swh::remote_service::vault::config::vault0')}"
-
-swh::remote_service::indexer::config::storage0:
-  cls: remote
-  args:
-    url: "http://storage0.internal.staging.swh.network:%{hiera('swh::remote_service::indexer::port')}/"
-swh::remote_service::indexer::config: "%{alias('swh::remote_service::indexer::config::storage0')}"
-swh::remote_service::indexer::config::writable: "%{alias('swh::remote_service::indexer::config::storage0')}"
-
-swh::remote_service::scheduler::config::scheduler0:
-  cls: remote
-  args:
-    url: "http://scheduler0.internal.staging.swh.network:%{hiera('swh::remote_service::scheduler::port')}/"
-
-swh::remote_service::scheduler::config: "%{alias('swh::remote_service::scheduler::config::scheduler0')}"
-swh::remote_service::scheduler::config::writable: "%{alias('swh::remote_service::scheduler::config::scheduler0')}"
-
-swh::deploy::deposit::url: http://deposit.internal.staging.swh.network
-
-# do not save pack
-swh::deploy::worker::loader_git::save_data_path: ""
-swh::deploy::worker::loader_git::concurrency: 1
-
-zookeeper::clusters:
-  rocquencourt:
-    '1': journal0.internal.staging.swh.network
-
-kafka::clusters:
-  rocquencourt:
-    zookeeper::chroot: '/kafka/softwareheritage'
-    zookeeper::servers:
-      - journal0.internal.staging.swh.network
-    brokers:
-      journal0.internal.staging.swh.network:
-        id: 1
-
-swh::deploy::journal::brokers:
-  - journal0.internal.staging.swh.network
-
-swh::deploy::deposit::vhost::letsencrypt_cert: deposit_staging
-swh::deploy::webapp::vhost::letsencrypt_cert: archive_staging
diff --git a/data/location/vagrant.yaml b/data/location/vagrant.yaml
--- a/data/location/vagrant.yaml
+++ b/data/location/vagrant.yaml
@@ -1,3 +1,8 @@
+networks:
+  eth0:
+      # vagrant admin interface
+      type: dhcp
+
 # forwarder for :
 # - swh network
 # - Inria network
@@ -19,20 +24,6 @@
 
 smtp::relay_hostname: 'none'
 
-swh::deploy::worker::instances:
-  - checker_deposit
-  - lister
-  - loader_archive
-  - loader_cran
-  - loader_debian
-  - loader_deposit
-  - loader_git
-  - loader_mercurial
-  - loader_nixguix
-  - loader_npm
-  - loader_pypi
-  - loader_svn
-
 dns::forward_zones: { }
 
 netbox::vhost::letsencrypt_cert: inventory-vagrant
diff --git a/data/vagrant/webapp.internal.staging.swh.network.yaml b/data/vagrant/webapp.internal.staging.swh.network.yaml
deleted file mode 100644
--- a/data/vagrant/webapp.internal.staging.swh.network.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-networks:
-    eth0:
-        # vagrant admin interface
-        type: dhcp
diff --git a/data/vagrant/worker0.internal.staging.swh.network.yaml b/data/vagrant/worker0.internal.staging.swh.network.yaml
deleted file mode 100644
--- a/data/vagrant/worker0.internal.staging.swh.network.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-networks:
-  eth0:
-      # vagrant admin interface
-      type: dhcp
diff --git a/data/vagrant/worker01.softwareheritage.org.yaml b/data/vagrant/worker01.softwareheritage.org.yaml
deleted file mode 100644
--- a/data/vagrant/worker01.softwareheritage.org.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-networks:
-  eth0:
-      # vagrant admin interface
-      type: dhcp
diff --git a/hiera-vagrant.yaml b/hiera-vagrant.yaml
deleted file mode 100644
--- a/hiera-vagrant.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-# global hiera configuration
-# used only on the vagrant environement
----
-version: 5
-defaults:
-  datadir: data         # datadir by default moved to 'defaults' folder
-  data_hash: yaml_data  # Default backend
-hierarchy:
-  - path: "../environments/%{::environment}/data/vagrant/%{trusted.certname}.yaml"
-    name: "Vagrant overrides by hostnames"
diff --git a/hiera.yaml b/hiera.yaml
--- a/hiera.yaml
+++ b/hiera.yaml
@@ -14,6 +14,8 @@
     name: "Per hostname override configuration"
   - path: "location/%{::location}.yaml"
     name: "Per location override configuration"
+  - path: "environment/%{::environment}.yaml"
+    name: "Variables set per environment"
   - path: "defaults_security.yaml"
     name: "Public keys configuration"
   - path: "defaults.yaml"