[Test] Use lupa for templating rspamd configs

43 files changed, 310 insertions, 266 deletions

diff --git a/test/functional/configs/antivirus.conf b/test/functional/configs/antivirus.conf
index d38c69a42..8b971a588 100644
--- a/test/functional/configs/antivirus.conf
+++ b/test/functional/configs/antivirus.conf
@@ -1,18 +1,20 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
 antivirus {
  clam {
     attachments_only = false;
     symbol = "CLAM_VIRUS";
     type = "clamav";
-    servers = "127.0.0.1:${PORT_CLAM}";
+    servers = "127.0.0.1:{= env.PORT_CLAM =}";
   }
   fprot {
     attachments_only = false;
     symbol = "FPROT_VIRUS";
     type = "fprot";
-    servers = "127.0.0.1:${PORT_FPROT}";
+    servers = "127.0.0.1:{= env.PORT_FPROT =}";
     patterns {
       FPROT_EICAR = "^EICAR_Test_File$";
     }
@@ -22,7 +24,7 @@ antivirus {
     attachments_only = false;
     symbol = "FPROT2_VIRUS_DUPLICATE_DEFAULT";
     type = "fprot";
-    servers = "127.0.0.1:${PORT_FPROT2_DUPLICATE}";
+    servers = "127.0.0.1:{= env.PORT_FPROT2_DUPLICATE =}";
     patterns = [
       {FPROT2_VIRUS_DUPLICATE_PATTERN = "^E"},
       {FPROT2_VIRUS_DUPLICATE_NOPE1 = "^EI",
@@ -36,6 +38,6 @@ antivirus {
       attachments_only = false;
       symbol = "AVAST_VIRUS";
       type = "avast";
-      servers = "127.0.0.1:${PORT_AVAST}";
+      servers = "127.0.0.1:{= env.PORT_AVAST =}";
   }
 }
diff --git a/test/functional/configs/arc.conf b/test/functional/configs/arc.conf
index 5f8797fe8..8a8a525c7 100644
--- a/test/functional/configs/arc.conf
+++ b/test/functional/configs/arc.conf
@@ -1 +1,3 @@
-arc { }
\ No newline at end of file
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
+arc { }
diff --git a/test/functional/configs/arc_signing/redis.conf b/test/functional/configs/arc_signing/redis.conf
index b2a9aa134..0d049c372 100644
--- a/test/functional/configs/arc_signing/redis.conf
+++ b/test/functional/configs/arc_signing/redis.conf
@@ -1,8 +1,10 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 arc {
   use_redis = true;
   key_prefix = "TEST_DKIM_KEYS";
   selector_prefix = "TEST_DKIM_SELECTORS";
 }
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
diff --git a/test/functional/configs/arc_signing/simple.conf b/test/functional/configs/arc_signing/simple.conf
index 5807d7346..f559e61bd 100644
--- a/test/functional/configs/arc_signing/simple.conf
+++ b/test/functional/configs/arc_signing/simple.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 arc {
-  path = "${TESTDIR}/configs/dkim.key";
+  path = "{= env.TESTDIR =}/configs/dkim.key";
   check_pubkey = true;
   allow_pubkey_mismatch = false;
   selector = "dkim";
diff --git a/test/functional/configs/composites.conf b/test/functional/configs/composites.conf
index 71e453def..28b645e60 100644
--- a/test/functional/configs/composites.conf
+++ b/test/functional/configs/composites.conf
@@ -1,27 +1,27 @@
 options = {
-    pidfile = "${TMPDIR}/rspamd.pid"
+    pidfile = "{= env.TMPDIR =}/rspamd.pid"
 }
 logging = {
     type = "file",
     level = "debug"
-    filename = "${TMPDIR}/rspamd.log"
+    filename = "{= env.TMPDIR =}/rspamd.log"
 }
 
 worker {
     type = normal
-    bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+    bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
     count = 1
     task_timeout = 60s;
 }
 worker {
     type = controller
-    bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+    bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
     count = 1
     secure_ip = ["127.0.0.1", "::1"];
-    stats_path = "${TMPDIR}/stats.ucl"
+    stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = ${LUA_SCRIPT};
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = {= env.LUA_SCRIPT =};
 
 composites {
     EXPRESSIONS {
@@ -77,7 +77,7 @@ composites {
       score = 6.0;
     }
     SYMOPTS3 {
-      expression = 'OPTS[sym2,/FoO\\//i]';
+      expression = 'OPTS[sym2,/FoO\//i]';
       score = 6.0;
     }
     SYMOPTS4 {
diff --git a/test/functional/configs/dkim.conf b/test/functional/configs/dkim.conf
index cc2f6f250..50712d17b 100644
--- a/test/functional/configs/dkim.conf
+++ b/test/functional/configs/dkim.conf
@@ -1,35 +1,17 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 options = {
   filters = ["dkim"]
-  pidfile = "${TMPDIR}/rspamd.pid"
+  pidfile = "{= env.TMPDIR =}/rspamd.pid"
   dns {
     retransmits = 10;
     timeout = 2s;
-    fake_records = [{ # ed25519
-      name = "test._domainkey.example.com";
-      type = txt;
-      replies = ["k=ed25519; p=yi50DjK5O9pqbFpNHklsv9lqaS0ArSYu02qp1S0DW1Y="];
-    },
-    {
-      name = "brisbane._domainkey.football.example.com";
-      type = txt;
-      replies = ["v=DKIM1; k=ed25519; p=11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="];
-    },
-    {
-      name = "test._domainkey.football.example.com";
-      type = txt;
-      replies = ["v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkHlOQoBTzWRiGs5V6NpP3idY6Wk08a5qhdR6wy5bdOKb2jLQiY/J16JYi0Qvx/byYzCNb3W91y3FutACDfzwQ/BC/e/8uBsCR+yz1Lxj+PL6lHvqMKrM3rG4hstT5QjvHO9PzoxZyVYLzBfO2EeC3Ip3G+2kryOTIKT+l/K4w3QIDAQAB"],
-    },
-    {
-      name = "dkim._domainkey.cacophony.za.org",
-      type = "txt";
-      replies = ["v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXtxBE5IiNRMcq2/lc2zErfdCvDFyQNBnMjbOjBQrPST2k4fdGbtpe5Iu5uS01Met+dAEf94XL8I0hwmYw+n70PP834zfJGi2egwGqrakpaWsCDPvIJZLkxJCJKQRA/zrQ622uEXdvYixVbsEGVw7U4wAGSmT5rU2eU1y63AlOlQIDAQAB"];
-    }];
   }
 }
 logging = {
   type = "file",
   level = "debug"
-  filename = "${TMPDIR}/rspamd.log"
+  filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
   name = "default",
@@ -41,21 +23,21 @@ metric = {
 
 worker {
   type = normal
-  bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
   count = 1
   keypair {
-    pubkey = "${KEY_PUB1}";
-    privkey = "${KEY_PVT1}";
+    pubkey = "{= env.KEY_PUB1 =}";
+    privkey = "{= env.KEY_PVT1 =}";
   }
   task_timeout = 60s;
 }
 
 worker {
         type = controller
-        bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
         count = 1
         secure_ip = ["127.0.0.1", "::1"];
-        stats_path = "${TMPDIR}/stats.ucl"
+        stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 
 dkim {
@@ -65,7 +47,7 @@ return function(task)
   local dodkim = task:get_request_header('dodkim')
   if not dodkim then return end
   return {
-    key = "${TESTDIR}/configs/dkim.key",
+    key = "{= env.TESTDIR =}/configs/dkim.key",
     domain = "cacophony.za.org",
     selector = "dkim"
   }
@@ -79,6 +61,6 @@ EOD;
   skip_multi = false;
 }
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
diff --git a/test/functional/configs/dkim_signing/eddsa.conf b/test/functional/configs/dkim_signing/eddsa.conf
index 1a93c9e0b..a8cdfaa78 100644
--- a/test/functional/configs/dkim_signing/eddsa.conf
+++ b/test/functional/configs/dkim_signing/eddsa.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
-  path = "${TESTDIR}/configs/dkim-eddsa.key";
+  path = "{= env.TESTDIR =}/configs/dkim-eddsa.key";
   selector = "eddsa";
   check_pubkey = true;
   allow_pubkey_mismatch = false;
diff --git a/test/functional/configs/dkim_signing/invalidate.conf b/test/functional/configs/dkim_signing/invalidate.conf
index 48b1cec16..b7913cd0a 100644
--- a/test/functional/configs/dkim_signing/invalidate.conf
+++ b/test/functional/configs/dkim_signing/invalidate.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
-  path = "${KEY_DIR}/dkim-eddsa.key";
+  path = "{= env.KEY_DIR =}/dkim-eddsa.key";
   selector = "eddsa";
   check_pubkey = true;
   allow_pubkey_mismatch = false;
diff --git a/test/functional/configs/dkim_signing/milter.conf b/test/functional/configs/dkim_signing/milter.conf
index 263ed0b4e..a373e16b0 100644
--- a/test/functional/configs/dkim_signing/milter.conf
+++ b/test/functional/configs/dkim_signing/milter.conf
@@ -1,8 +1,8 @@
 options = {
 	filters = ["dkim"]
-	url_tld = "${URL_TLD}"
-	pidfile = "${TMPDIR}/rspamd.pid"
-	lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+	url_tld = "{= env.URL_TLD =}"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
+	lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua"
 	dns {
 		nameserver = ["8.8.8.8", "8.8.4.4"];
 		retransmits = 10;
@@ -12,7 +12,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
 	name = "default",
@@ -23,16 +23,16 @@ metric = {
 }
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	task_timeout = 60s;
 }
 worker {
         type = controller
-        bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
         count = 1
         secure_ip = ["127.0.0.1", "::1"];
-        stats_path = "${TMPDIR}/stats.ucl"
+        stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 worker {
 	type = "rspamd_proxy";
@@ -40,28 +40,28 @@ worker {
 	timeout = 120;
 	upstream {
 		local {
-			hosts = "${LOCAL_ADDR}:${PORT_NORMAL}";
+			hosts = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}";
 			default = true;
 		}
 	}
-	bind_socket = "${LOCAL_ADDR}:${PORT_PROXY}";
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_PROXY =}";
 	milter = true;
 }
 dkim_signing {
   domain {
     cacophony.za.org {
       selectors = {
-        path: "${TESTDIR}/configs/dkim.key";
+        path: "{= env.TESTDIR =}/configs/dkim.key";
         selector: "dkim";
       }
       selectors = {
-        path: "${TESTDIR}/configs/dkim-eddsa.key";
+        path: "{= env.TESTDIR =}/configs/dkim-eddsa.key";
         selector: "eddsa";
      }
    }
     invalid.za.org {
       selectors = [ 
-        { path: "${TESTDIR}/configs/dkim-eddsa.key";
+        { path: "{= env.TESTDIR =}/configs/dkim-eddsa.key";
           selector: "eddsa"; }
       ]
    }
@@ -69,8 +69,8 @@ dkim_signing {
   allow_pubkey_mismatch: true;
 }
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/dkim_signing.lua"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/dkim_signing.lua"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = "${INSTALLROOT}/share/rspamd/rules/rspamd.lua"
-lua = "${TESTDIR}/lua/params.lua"
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.INSTALLROOT =}/share/rspamd/rules/rspamd.lua"
+lua = "{= env.TESTDIR =}/lua/params.lua"
diff --git a/test/functional/configs/dkim_signing/multiple.conf b/test/functional/configs/dkim_signing/multiple.conf
index 072842183..029c2b5e9 100644
--- a/test/functional/configs/dkim_signing/multiple.conf
+++ b/test/functional/configs/dkim_signing/multiple.conf
@@ -1,12 +1,14 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
   domain {
     cacophony.za.org {
       selectors = {
-        path: "${TESTDIR}/configs/dkim.key";
+        path: "{= env.TESTDIR =}/configs/dkim.key";
         selector: "dkim";
       }
       selectors = {
-        path: "${TESTDIR}/configs/dkim-eddsa.key";
+        path: "{= env.TESTDIR =}/configs/dkim-eddsa.key";
         selector: "eddsa";
      }
    }
diff --git a/test/functional/configs/dkim_signing/redis.conf b/test/functional/configs/dkim_signing/redis.conf
index 903a13cf4..02dc2eacd 100644
--- a/test/functional/configs/dkim_signing/redis.conf
+++ b/test/functional/configs/dkim_signing/redis.conf
@@ -1,8 +1,10 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
   use_redis = true;
   key_prefix = "TEST_DKIM_KEYS";
   selector_prefix = "TEST_DKIM_SELECTORS";
 }
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
diff --git a/test/functional/configs/dkim_signing/sign_maps.conf b/test/functional/configs/dkim_signing/sign_maps.conf
index 9e63b7fc4..6993f1f21 100644
--- a/test/functional/configs/dkim_signing/sign_maps.conf
+++ b/test/functional/configs/dkim_signing/sign_maps.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
   signing_table = [
     "*@cacophony.za.org cacophony.za.org",
@@ -6,4 +8,4 @@ dkim_signing {
   key_table = [
     "cacophony.za.org %:eddsa:m5kGxtckRfsNe5EuYTe7bvkDjSh7LXaX3aXyIMPGLR0=",
   ];
-}
\ No newline at end of file
+}
diff --git a/test/functional/configs/dkim_signing/simple.conf b/test/functional/configs/dkim_signing/simple.conf
index 14b8d5ec6..9b812ec7e 100644
--- a/test/functional/configs/dkim_signing/simple.conf
+++ b/test/functional/configs/dkim_signing/simple.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dkim_signing {
-  path = "${TESTDIR}/configs/dkim.key";
+  path = "{= env.TESTDIR =}/configs/dkim.key";
   check_pubkey = true;
   allow_pubkey_mismatch = false;
   use_http_headers = true;
diff --git a/test/functional/configs/dmarc.conf b/test/functional/configs/dmarc.conf
index b6164f9d2..130e5612c 100644
--- a/test/functional/configs/dmarc.conf
+++ b/test/functional/configs/dmarc.conf
@@ -1,6 +1,8 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dmarc { }
 spf {
   external_relay = [
-   	"${TESTDIR}/configs/maps/external_relay_ip.list",
+   	"{= env.TESTDIR =}/configs/maps/external_relay_ip.list",
   ];
-}
\ No newline at end of file
+}
diff --git a/test/functional/configs/empty.conf b/test/functional/configs/empty.conf
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/test/functional/configs/empty.conf
diff --git a/test/functional/configs/force_actions.conf b/test/functional/configs/force_actions.conf
index 61732c4ac..aed3d05fa 100644
--- a/test/functional/configs/force_actions.conf
+++ b/test/functional/configs/force_actions.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 force_actions {
 	rules {
     	FORCE_REJECT_TO_ADD_HEADER {
@@ -83,4 +85,4 @@ settings {
     		}
     	}
 	}
-}
\ No newline at end of file
+}
diff --git a/test/functional/configs/fuzzy-encryption-key.conf b/test/functional/configs/fuzzy-encryption-key.conf
new file mode 100644
index 000000000..522081b08
--- /dev/null
+++ b/test/functional/configs/fuzzy-encryption-key.conf
@@ -0,0 +1,2 @@
+# Setting this to null does not work out so it's hidden in an include
+encryption_key = {= env.FUZZY_ENCRYPTION_KEY =};
diff --git a/test/functional/configs/fuzzy.conf b/test/functional/configs/fuzzy.conf
index bc4e72e7b..8af1cfa3f 100644
--- a/test/functional/configs/fuzzy.conf
+++ b/test/functional/configs/fuzzy.conf
@@ -1,12 +1,12 @@
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
 options = {
 	filters = "fuzzy_check";
-	pidfile = "${TMPDIR}/rspamd.pid";
-	control_socket = "${TMPDIR}/rspamd.sock mode=0600";
-	url_tld = "${TESTDIR}/../lua/unit/test_tld.dat";
+	pidfile = "{= env.TMPDIR =}/rspamd.pid";
+	control_socket = "{= env.TMPDIR =}/rspamd.sock mode=0600";
+	url_tld = "{= env.TESTDIR =}/../lua/unit/test_tld.dat";
 	dns {
 		retransmits = 10;
 		timeout = 2s;
@@ -15,7 +15,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
 	name = "default",
@@ -25,36 +25,41 @@ metric = {
 	unknown_weight = 1
         symbol {
             weight = 10.0;
-            name = "${FLAG1_SYMBOL}";
+            name = "{= env.FLAG1_SYMBOL =}";
         }
         symbol {
             weight = -1.0;
-            name = "${FLAG2_SYMBOL}";
+            name = "{= env.FLAG2_SYMBOL =}";
         }
 }
 
 worker {
 	type = normal
-	bind_socket = "${LOCAL_ADDR}:${PORT_NORMAL}";
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}";
 	count = 1
 	task_timeout = 60s;
 }
 
 worker {
         type = controller
-        bind_socket = "${LOCAL_ADDR}:${PORT_CONTROLLER}";
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}";
         count = 1
-        secure_ip = ["${LOCAL_ADDR}"];
-	stats_path = "${TMPDIR}/stats.ucl";
+        secure_ip = ["{= env.LOCAL_ADDR =}"];
+        stats_path = "{= env.TMPDIR =}/stats.ucl";
 }
 
 worker {
 	count = 1;
-	bind_socket = "${LOCAL_ADDR}:${PORT_FUZZY}";
+        backend = "{= env.FUZZY_BACKEND =}";
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_FUZZY =}";
 	type = "fuzzy";
-	hashfile = "${TMPDIR}/fuzzy.db";
-	allow_update = ["${LOCAL_ADDR}"];
-${SETTINGS_FUZZY_WORKER}
+	hashfile = "{= env.TMPDIR =}/fuzzy.db";
+	allow_update = ["{= env.LOCAL_ADDR =}"];
+	encrypted_only = {= env.FUZZY_ENCRYPTED_ONLY =};
+	keypair {
+		privkey = "{= env.KEY_PVT1 =}";
+		pubkey = "{= env.KEY_PUB1 =}";
+	}
 }
 
 fuzzy_check {
@@ -65,23 +70,25 @@ fuzzy_check {
 	rule {
 	  min_bytes = 0;
 	  min_length = 0;
-		algorithm = "${ALGORITHM}";
-		servers = "${LOCAL_ADDR}:${PORT_FUZZY}";
+		algorithm = "{= env.FUZZY_ALGORITHM =}";
+		servers = "{= env.LOCAL_ADDR =}:{= env.PORT_FUZZY =}";
 		symbol = "R_TEST_FUZZY";
 		max_score = 10.0;
 		mime_types = ["application/*"];
 		read_only = false;
 		skip_unknown = true;
-		skip_hashes = "${TMPDIR}/skip_hash.map";
-${SETTINGS_FUZZY_CHECK}
+		skip_hashes = "{= env.TMPDIR =}/skip_hash.map";
+		fuzzy_key = {= env.FUZZY_KEY =};
+		fuzzy_shingles_key = {= env.FUZZY_SHINGLES_KEY =};
+.include "{= env.FUZZY_INCLUDE =}";
 		fuzzy_map = {
-			${FLAG1_SYMBOL} {
+			R_TEST_FUZZY_DENIED {
 				max_score = 10.0;
-				flag = ${FLAG1_NUMBER};
+				flag = {= env.FLAG1_NUMBER =};
 			}
-			${FLAG2_SYMBOL} {
+			R_TEST_FUZZY_WHITE {
 				max_score = 1.0;
-				flag = ${FLAG2_NUMBER};
+				flag = {= env.FLAG2_NUMBER =};
 			}
 		}
 	}
diff --git a/test/functional/configs/greylist.conf b/test/functional/configs/greylist.conf
index 5e12accf9..d47500ce8 100644
--- a/test/functional/configs/greylist.conf
+++ b/test/functional/configs/greylist.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
 greylist {
   check_local = true;
diff --git a/test/functional/configs/lua_script.conf b/test/functional/configs/lua_script.conf
index 2bde672fe..8798bff37 100644
--- a/test/functional/configs/lua_script.conf
+++ b/test/functional/configs/lua_script.conf
@@ -1,25 +1,25 @@
 options = {
-    pidfile = "${TMPDIR}/rspamd.pid"
+    pidfile = "{= env.TMPDIR =}/rspamd.pid"
 }
 logging = {
     type = "file",
     level = "debug"
-    filename = "${TMPDIR}/rspamd.log"
+    filename = "{= env.TMPDIR =}/rspamd.log"
 }
 
 worker {
     type = normal
-    bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+    bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
     count = 1
     task_timeout = 60s;
 }
 worker {
     type = controller
-    bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+    bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
     count = 1
     secure_ip = ["127.0.0.1", "::1"];
-    stats_path = "${TMPDIR}/stats.ucl"
+    stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = ${LUA_SCRIPT};
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.LUA_SCRIPT =}";
diff --git a/test/functional/configs/lua_test.conf b/test/functional/configs/lua_test.conf
index ebdcff860..1d36536dd 100644
--- a/test/functional/configs/lua_test.conf
+++ b/test/functional/configs/lua_test.conf
@@ -1,8 +1,8 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${URL_TLD}"
-	pidfile = "${TMPDIR}/rspamd.pid"
-	map_watch_interval = ${MAP_WATCH_INTERVAL};
+	url_tld = "{= env.URL_TLD =}"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
+	map_watch_interval = {= env.MAP_WATCH_INTERVAL =};
 	dns {
 		retransmits = 10;
 		timeout = 2s;
@@ -24,7 +24,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 	log_usec = true;
 }
 metric = {
@@ -37,16 +37,16 @@ metric = {
 
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	task_timeout = 10s;
 }
 worker {
 	type = controller
-	bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
 	count = 1
 	secure_ip = ["127.0.0.1", "::1"];
-	stats_path = "${TMPDIR}/stats.ucl"
+	stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = ${LUA_SCRIPT};
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.LUA_SCRIPT =}";
diff --git a/test/functional/configs/mid.conf b/test/functional/configs/mid.conf
index 49f5cb568..ce024299a 100644
--- a/test/functional/configs/mid.conf
+++ b/test/functional/configs/mid.conf
@@ -1,9 +1,11 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 mid = {
     source = {
         url = [
             "https://maps.rspamd.com/rspamd/mid.inc.zst",
-            "fallback+file://${TESTDIR}/../../../conf/mid.inc",
-            "file://${TESTDIR}/configs/maps/mid.list"
+            "fallback+file://{= env.TESTDIR =}/../../../conf/mid.inc",
+            "file://{= env.TESTDIR =}/configs/maps/mid.list"
         ];
     }
 }
diff --git a/test/functional/configs/milter.conf b/test/functional/configs/milter.conf
index e09ee48d8..aaf148c12 100644
--- a/test/functional/configs/milter.conf
+++ b/test/functional/configs/milter.conf
@@ -1,8 +1,8 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${URL_TLD}"
-	pidfile = "${TMPDIR}/rspamd.pid"
-	lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua";
+	url_tld = "{= env.URL_TLD =}"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
+	lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua";
 	enable_test_patterns = true;
 	dns {
 		nameserver = ["8.8.8.8", "8.8.4.4"];
@@ -13,7 +13,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
 	name = "default",
@@ -24,16 +24,16 @@ metric = {
 }
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	task_timeout = 60s;
 }
 worker {
         type = controller
-        bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
         count = 1
         secure_ip = ["127.0.0.1", "::1"];
-        stats_path = "${TMPDIR}/stats.ucl"
+        stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 worker {
 	type = "rspamd_proxy";
@@ -41,19 +41,19 @@ worker {
 	timeout = 120;
 	upstream {
 		local {
-			hosts = "${LOCAL_ADDR}:${PORT_NORMAL}";
+			hosts = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}";
 			default = true;
 		}
 	}
-	bind_socket = "${LOCAL_ADDR}:${PORT_PROXY}";
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_PROXY =}";
 	milter = true;
 }
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = "${INSTALLROOT}/share/rspamd/rules/rspamd.lua"
-lua = "${TESTDIR}/lua/params.lua"
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.INSTALLROOT =}/share/rspamd/rules/rspamd.lua"
+lua = "{= env.TESTDIR =}/lua/params.lua"
 milter_headers {
 	extended_spam_headers = true;
 	skip_local = false;
diff --git a/test/functional/configs/mime_types.conf b/test/functional/configs/mime_types.conf
index e28feba98..82bd4187c 100644
--- a/test/functional/configs/mime_types.conf
+++ b/test/functional/configs/mime_types.conf
@@ -1,7 +1,9 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 mime_types {
     file = [
       "https://maps.rspamd.com/rspamd/mime_types.inc.zst",
-      "fallback+file://${TESTDIR}/../../../conf/mime_types.inc"
+      "fallback+file://{= env.TESTDIR =}/../../../conf/mime_types.inc"
      ];
     extension_map {
         html = "text/html";
@@ -15,5 +17,5 @@ mime_types {
             "application/pdf",
         ]
     }
-    filename_whitelist = "${TESTDIR}/configs/maps/mime_types.wl";
+    filename_whitelist = "{= env.TESTDIR =}/configs/maps/mime_types.wl";
 }
diff --git a/test/functional/configs/multimap.conf b/test/functional/configs/multimap.conf
index 9158f657c..c59c1ac57 100644
--- a/test/functional/configs/multimap.conf
+++ b/test/functional/configs/multimap.conf
@@ -1,8 +1,10 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 asn {
 }
 spf {}
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
   expand_keys = true;
 }
 multimap {
@@ -12,76 +14,76 @@ multimap {
   }
   IP_MAP {
     type = "ip";
-    map = "${TESTDIR}/configs/maps/ip.list";
+    map = "{= env.TESTDIR =}/configs/maps/ip.list";
   }
   FROM_MAP {
     type = "from";
     filter = "email:domain";
-    map = "${TESTDIR}/configs/maps/domains.list";
+    map = "{= env.TESTDIR =}/configs/maps/domains.list";
   }
   FREEMAIL_CC {
     type = "header";
     header = "Cc";
     filter = "email:domain";
-    map = "${TESTDIR}/configs/maps/domains.list.2";
+    map = "{= env.TESTDIR =}/configs/maps/domains.list.2";
     score = 1.0;
   }
   REGEXP_MAP {
     type = "from";
     filter = "email:addr";
     regexp = true;
-    map = "${TESTDIR}/configs/maps/regexp.list";
+    map = "{= env.TESTDIR =}/configs/maps/regexp.list";
   }
   DEPS_MAP {
     type = "from";
     filter = "email:addr";
     regexp = true;
-    map = "${TESTDIR}/configs/maps/regexp.list";
+    map = "{= env.TESTDIR =}/configs/maps/regexp.list";
     require_symbols = "(R_SPF_ALLOW|R_SPF_DNSFAIL) & REGEXP_MAP & !FROM_MAP";
   }
   RCPT_DOMAIN {
     type = "rcpt";
     filter = "email:domain";
-    map = "${TESTDIR}/configs/maps/domains.list";
+    map = "{= env.TESTDIR =}/configs/maps/domains.list";
   }
   RCPT_USER {
     type = "rcpt";
     filter = "email:user";
-    map = "${TESTDIR}/configs/maps/users.list";
+    map = "{= env.TESTDIR =}/configs/maps/users.list";
   }
   RCPT_MAP {
     type = "rcpt";
     filter = "email:addr";
     symbols = ["SYM1"];
-    map = "${TESTDIR}/configs/maps/multiple.list";
+    map = "{= env.TESTDIR =}/configs/maps/multiple.list";
     score = 1.0;
   }
   RCPT_MAP_NOMULTISYM {
     type = "rcpt";
     filter = "email:addr";
     disable_multisymbol = true;
-    map = "${TESTDIR}/configs/maps/multiple.list";
+    map = "{= env.TESTDIR =}/configs/maps/multiple.list";
     score = 1.0;
   }
   HEADER_MAP {
     type = "header";
     header = "To";
     filter = "email:name";
-    map = "${TESTDIR}/configs/maps/utf.list";
+    map = "{= env.TESTDIR =}/configs/maps/utf.list";
     regexp = true;
   }
   HOSTNAME_MAP {
     type = "hostname";
-    map = "${TESTDIR}/configs/maps/domains.list";
+    map = "{= env.TESTDIR =}/configs/maps/domains.list";
   }
   HOSTNAME_TOP_MAP {
     type = "hostname";
     filter = "top";
-    map = "${TESTDIR}/configs/maps/top.list";
+    map = "{= env.TESTDIR =}/configs/maps/top.list";
   }
   CDB_HOSTNAME {
     type = "hostname";
-    map = "cdb://${TESTDIR}/configs/maps/domains.cdb";
+    map = "cdb://{= env.TESTDIR =}/configs/maps/domains.cdb";
   }
   REDIS_HOSTNAME {
     type = "hostname";
@@ -89,7 +91,7 @@ multimap {
   }
   REDIS_HOSTNAME_EXPANSION {
     type = "hostname";
-    map = "redis://\${ip}.\${principal_recipient_domain}";
+    map = "redis://${ip}.${principal_recipient_domain}";
   }
   REDIS_IPADDR {
     type = "ip";
@@ -151,12 +153,12 @@ multimap {
   RCVD_TEST_01 {
     type = "received";
     max_pos = 1;
-    map = "${TESTDIR}/configs/maps/rcvd.list";
+    map = "{= env.TESTDIR =}/configs/maps/rcvd.list";
   }
   RCVD_TEST_02 {
     type = "received";
     min_pos = -1;
-    map = "${TESTDIR}/configs/maps/rcvd.list";
+    map = "{= env.TESTDIR =}/configs/maps/rcvd.list";
   }
   RCVD_TEST_REDIS_01 {
     type = "received";
@@ -164,13 +166,13 @@ multimap {
   }
   RCVD_AUTHED_ONE {
     type = "received";
-    map = "${TESTDIR}/configs/maps/rcvd2.list";
+    map = "{= env.TESTDIR =}/configs/maps/rcvd2.list";
     flags = ["authenticated"];
     nflags = ["ssl"];
   }
   RCVD_AUTHED_TWO {
     type = "received";
-    map = "${TESTDIR}/configs/maps/rcvd2.list";
+    map = "{= env.TESTDIR =}/configs/maps/rcvd2.list";
     flags = ["authenticated", "ssl"];
   }
   COMBINED_MAP_AND {
@@ -178,11 +180,11 @@ multimap {
     rules {
       ip = {
         type = "radix";
-        map = "${TESTDIR}/configs/maps/ip.list";
+        map = "{= env.TESTDIR =}/configs/maps/ip.list";
         selector = "ip";
       }
       from {
-        map = "${TESTDIR}/configs/maps/domains.list";
+        map = "{= env.TESTDIR =}/configs/maps/domains.list";
         selector = "from:domain";
       }
     }
@@ -195,11 +197,11 @@ multimap {
     rules {
       ip = {
         type = "radix";
-        map = "${TESTDIR}/configs/maps/ip.list";
+        map = "{= env.TESTDIR =}/configs/maps/ip.list";
         selector = "ip";
       }
       from {
-        map = "${TESTDIR}/configs/maps/domains.list";
+        map = "{= env.TESTDIR =}/configs/maps/domains.list";
         selector = "from:domain";
       }
     }
diff --git a/test/functional/configs/neural.conf b/test/functional/configs/neural.conf
index 871a549fe..7a7f36ffc 100644
--- a/test/functional/configs/neural.conf
+++ b/test/functional/configs/neural.conf
@@ -1,7 +1,7 @@
 options = {
-  url_tld = "${URL_TLD}"
-  pidfile = "${TMPDIR}/rspamd.pid"
-  lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+  url_tld = "{= env.URL_TLD =}"
+  pidfile = "{= env.TMPDIR =}/rspamd.pid"
+  lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua"
   filters = [];
   explicit_modules = ["settings"];
 }
@@ -9,7 +9,7 @@ options = {
 logging = {
   type = "file",
   level = "debug"
-  filename = "${TMPDIR}/rspamd.log"
+  filename = "{= env.TMPDIR =}/rspamd.log"
   log_usec = true;
 }
 metric = {
@@ -22,23 +22,23 @@ metric = {
 }
 worker {
   type = normal
-  bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
   count = 1
   task_timeout = 10s;
 }
 worker {
   type = controller
-  bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
   count = 1
   secure_ip = ["127.0.0.1", "::1"];
-  stats_path = "${TMPDIR}/stats.ucl"
+  stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 
 modules {
-  path = "${TESTDIR}/../../src/plugins/lua/"
+  path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
 
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
 
 neural {
   rules {
@@ -76,8 +76,8 @@ neural {
 
 }
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
   expand_keys = true;
 }
 
-lua = "${TESTDIR}/lua/neural.lua";
\ No newline at end of file
+lua = "{= env.TESTDIR =}/lua/neural.lua";
diff --git a/test/functional/configs/neural_noauto.conf b/test/functional/configs/neural_noauto.conf
index 55f0a4283..e228da850 100644
--- a/test/functional/configs/neural_noauto.conf
+++ b/test/functional/configs/neural_noauto.conf
@@ -1,7 +1,7 @@
 options = {
-  url_tld = "${URL_TLD}"
-  pidfile = "${TMPDIR}/rspamd.pid"
-  lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+  url_tld = "{= env.URL_TLD =}"
+  pidfile = "{= env.TMPDIR =}/rspamd.pid"
+  lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua"
   filters = [];
   explicit_modules = ["settings"];
 }
@@ -9,7 +9,7 @@ options = {
 logging = {
   type = "file",
   level = "debug"
-  filename = "${TMPDIR}/rspamd.log"
+  filename = "{= env.TMPDIR =}/rspamd.log"
   log_usec = true;
 }
 metric = {
@@ -22,23 +22,23 @@ metric = {
 }
 worker {
   type = normal
-  bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
   count = 1
   task_timeout = 10s;
 }
 worker {
   type = controller
-  bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
   count = 1
   secure_ip = ["127.0.0.1", "::1"];
-  stats_path = "${TMPDIR}/stats.ucl"
+  stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 
 modules {
-  path = "${TESTDIR}/../../src/plugins/lua/"
+  path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
 
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
 
 neural {
   rules {
@@ -78,8 +78,8 @@ neural {
 
 }
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
   expand_keys = true;
 }
 
-lua = "${TESTDIR}/lua/neural.lua";
+lua = "{= env.TESTDIR =}/lua/neural.lua";
diff --git a/test/functional/configs/p0f.conf b/test/functional/configs/p0f.conf
index 69303772a..cb492f9b7 100644
--- a/test/functional/configs/p0f.conf
+++ b/test/functional/configs/p0f.conf
@@ -1,8 +1,10 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
 p0f {
-  socket = "${P0F_SOCKET}";
+  socket = "{= env.P0F_SOCKET =}";
   patterns {
     WINDOWS = '^Windows.*';
     ETHER = '^Ethernet.*';
diff --git a/test/functional/configs/password.conf b/test/functional/configs/password.conf
index 922301844..27b88eec3 100644
--- a/test/functional/configs/password.conf
+++ b/test/functional/configs/password.conf
@@ -1,7 +1,7 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${TESTDIR}/../lua/unit/test_tld.dat"
-	pidfile = "${TMPDIR}/rspamd.pid"
+	url_tld = "{= env.TESTDIR =}/../lua/unit/test_tld.dat"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
 	dns {
 		retransmits = 10;
 		timeout = 2s;
@@ -10,7 +10,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
 	name = "default",
@@ -22,24 +22,24 @@ metric = {
 
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	keypair {
-		pubkey = "${KEY_PUB1}";
-		privkey = "${KEY_PVT1}";
+		pubkey = "{= env.KEY_PUB1 =}";
+		privkey = "{= env.KEY_PVT1 =}";
 	}
 	task_timeout = 60s;
 }
 worker {
 	type = controller
-	bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
 	count = 1
 	keypair {
-		pubkey = "${KEY_PUB1}";
-		privkey = "${KEY_PVT1}";
+		pubkey = "{= env.KEY_PUB1 =}";
+		privkey = "{= env.KEY_PVT1 =}";
 	}
-	password = ${PASSWORD};
-	enable_password = ${ENABLE_PASSWORD};
-	stats_path = "${TMPDIR}/stats.ucl";
+	password = {= env.PASSWORD =};
+	enable_password = {= env.ENABLE_PASSWORD =};
+	stats_path = "{= env.TMPDIR =}/stats.ucl";
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
diff --git a/test/functional/configs/phishing.conf b/test/functional/configs/phishing.conf
index 2b029f687..aa6eb8fe9 100644
--- a/test/functional/configs/phishing.conf
+++ b/test/functional/configs/phishing.conf
@@ -1,11 +1,13 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 phishing {
   symbol = "PHISHING";
   strict_domains = {
     STRICT_PHISHING = [
-      "${TESTDIR}/configs/maps/strict.phishing",
+      "{= env.TESTDIR =}/configs/maps/strict.phishing",
     ];
     STRICTER_PHISHING = [
-      "${TESTDIR}/configs/maps/stricter.phishing"
+      "{= env.TESTDIR =}/configs/maps/stricter.phishing"
     ]
   }
 }
diff --git a/test/functional/configs/plugins.conf b/test/functional/configs/plugins.conf
index 35a2ce347..803eccefe 100644
--- a/test/functional/configs/plugins.conf
+++ b/test/functional/configs/plugins.conf
@@ -1,8 +1,8 @@
 options = {
   filters = [ "dkim", "regexp"]
-  url_tld = "${URL_TLD}"
-  pidfile = "${TMPDIR}/rspamd.pid"
-  lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+  url_tld = "{= env.URL_TLD =}"
+  pidfile = "{= env.TMPDIR =}/rspamd.pid"
+  lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua"
   explicit_modules = ["settings", "bayes_expiry"];
   dns {
     nameserver = ["8.8.8.8", "8.8.4.4"];
@@ -732,7 +732,7 @@ options = {
 logging = {
   type = "file",
   level = "debug"
-  filename = "${TMPDIR}/rspamd.log"
+  filename = "{= env.TMPDIR =}/rspamd.log"
   log_usec = true;
 }
 metric = {
@@ -745,21 +745,20 @@ metric = {
 }
 worker {
   type = normal
-  bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+  bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
   count = 1
   task_timeout = 10s;
 }
 worker {
         type = controller
-        bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
         count = 1
         secure_ip = ["127.0.0.1", "::1"];
-        stats_path = "${TMPDIR}/stats.ucl"
+        stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
 spf {}
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = "${INSTALLROOT}/share/rspamd/rules/rspamd.lua"
-${PLUGIN_CONFIG}
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.INSTALLROOT =}/share/rspamd/rules/rspamd.lua";
diff --git a/test/functional/configs/proxy.conf b/test/functional/configs/proxy.conf
index c2bb3902d..ff31eaea0 100644
--- a/test/functional/configs/proxy.conf
+++ b/test/functional/configs/proxy.conf
@@ -1,8 +1,8 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${URL_TLD}"
-	pidfile = "${TMPDIR}/rspamd.pid"
-	lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+	url_tld = "{= env.URL_TLD =}"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
+	lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua"
 	dns {
 		nameserver = ["8.8.8.8", "8.8.4.4"];
 		retransmits = 10;
@@ -12,15 +12,15 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 worker "rspamd_proxy" {
-    bind_socket = "${LOCAL_ADDR}:${PORT_PROXY}";
+    bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_PROXY =}";
     upstream {
-        name = "${LOCAL_ADDR}";
+        name = "{= env.LOCAL_ADDR =}";
         default = yes;
-        hosts = "${LOCAL_ADDR}:${PORT_NORMAL}";
+        hosts = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}";
     }
     count = 1;
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
diff --git a/test/functional/configs/rbl.conf b/test/functional/configs/rbl.conf
index 4999e60d7..c5caa2e50 100644
--- a/test/functional/configs/rbl.conf
+++ b/test/functional/configs/rbl.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 rbl {
   rbls {
     fake {
@@ -33,7 +35,7 @@ rbl {
     }
     RSPAMD_EMAILBL {
       rbl = "test8.uribl";
-      url_compose_map = "${TESTDIR}/configs/maps/url_compose_map_for_mails.list";
+      url_compose_map = "{= env.TESTDIR =}/configs/maps/url_compose_map_for_mails.list";
       ignore_defaults = true;
       emails = true;
       emails_domainonly = true
diff --git a/test/functional/configs/redis.conf b/test/functional/configs/redis.conf
index 2da10faf7..8b3f0c484 100644
--- a/test/functional/configs/redis.conf
+++ b/test/functional/configs/redis.conf
@@ -1,5 +1,7 @@
-lua = ${LUA_SCRIPT};
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
+lua = "{= env.LUA_SCRIPT =}";
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
   expand_keys = true;
 }
diff --git a/test/functional/configs/regexp.conf b/test/functional/configs/regexp.conf
index 5b4047b5b..06f22c998 100644
--- a/test/functional/configs/regexp.conf
+++ b/test/functional/configs/regexp.conf
@@ -1,6 +1,8 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 regexp {
   SA_BODY_WORD_BOUNDARY_ON_NEWLINE {
-    re =  '/\\bhello\\s/{sa_body}',
+    re =  '/\bhello\s/{sa_body}',
     score = 0.0,
     description = 'Test if word boundary works correctly on sa_body regexes',
     group = 'body',
@@ -24,25 +26,25 @@ regexp {
     group = 'body',
   }
   SA_BODY_WORD_WITH_SPACE_BOUNDARIES {
-    re =  '/\\bhello world\\b/{sa_body}',
+    re =  '/\bhello world\b/{sa_body}',
     score = 0.0,
     description = 'Test if regex matches word separated with newline (should work - newline is replaced with space)',
     group = 'body',
   }
   SA_BODY_WORD_WITH_SPACE_BOUNDARIES_2 {
-    re =  '/\\shello\\sworld\\s/{sa_body}',
+    re =  '/\shello\sworld\s/{sa_body}',
     score = 0.0,
     description = 'Test if regex matches word separated with newline (should work - newline is replaced with space)',
     group = 'body',
   }
   SA_BODY_WORD_WITH_SPACE_BOUNDARIES_3 {
-    re =  '/\\shello\\sworld\\sthis\\s/{sa_body}',
+    re =  '/\shello\sworld\sthis\s/{sa_body}',
     score = 0.0,
     description = 'Test if regex matches word separated with newline (should work - newline is replaced with space)',
     group = 'body',
   }
   SA_BODY_WORD_WITH_SPACE_AND_DOT {
-    re =  '/\\bword\\.\\sagain\\b/{sa_body}',
+    re =  '/\bword\.\sagain\b/{sa_body}',
     score = 0.0,
     description = 'Test if regex matches word separated with newline (should work - newline is replaced with space)',
     group = 'body',
@@ -50,13 +52,13 @@ regexp {
 }
 
 options {
-  dynamic_conf = "${TESTDIR}/configs/dynamic.conf";
+  dynamic_conf = "{= env.TESTDIR =}/configs/dynamic.conf";
 }
 dmarc { }
 spf { }
 dkim { }
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
 
-lua = "${TESTDIR}/lua/regex_test.lua"
+lua = "{= env.TESTDIR =}/lua/regex_test.lua"
diff --git a/test/functional/configs/selector.conf b/test/functional/configs/selector.conf
index d4e872d36..b99ae5639 100644
--- a/test/functional/configs/selector.conf
+++ b/test/functional/configs/selector.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 regexp {
   CONFIG_SELECTOR_RE_RCPT_SUBJECT {
     re =  'test=/test@user.com some subject/$',
@@ -5,4 +7,4 @@ regexp {
   }
 }
 
-lua = "${TESTDIR}/lua/selector_test.lua"
+lua = "{= env.TESTDIR =}/lua/selector_test.lua"
diff --git a/test/functional/configs/settings.conf b/test/functional/configs/settings.conf
index 8155ded91..db7c3ca5e 100644
--- a/test/functional/configs/settings.conf
+++ b/test/functional/configs/settings.conf
@@ -1,4 +1,6 @@
-lua = ${LUA_SCRIPT};
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
+lua = "{= env.LUA_SCRIPT =}";
 
 settings {
   id_test {
diff --git a/test/functional/configs/spamassassin.conf b/test/functional/configs/spamassassin.conf
index 53aa89ec7..0b669512a 100644
--- a/test/functional/configs/spamassassin.conf
+++ b/test/functional/configs/spamassassin.conf
@@ -1,5 +1,7 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 spamassassin {
-	rules = "${TESTDIR}/configs/spamassassin.rules"
+	rules = "{= env.TESTDIR =}/configs/spamassassin.rules"
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
-lua = "${TESTDIR}/lua/simple.lua"
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/simple.lua"
diff --git a/test/functional/configs/stats.conf b/test/functional/configs/stats.conf
index f79729f39..bfa39b426 100644
--- a/test/functional/configs/stats.conf
+++ b/test/functional/configs/stats.conf
@@ -1,7 +1,7 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${TESTDIR}/../lua/unit/test_tld.dat"
-	pidfile = "${TMPDIR}/rspamd.pid"
+	url_tld = "{= env.TESTDIR =}/../lua/unit/test_tld.dat"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid"
 	dns {
 		retransmits = 10;
 		timeout = 2s;
@@ -15,7 +15,7 @@ options = {
 logging = {
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log"
+	filename = "{= env.TMPDIR =}/rspamd.log"
 }
 metric = {
 	name = "default",
@@ -27,51 +27,51 @@ metric = {
 
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	keypair {
-		pubkey = "${KEY_PUB1}";
-		privkey = "${KEY_PVT1}";
+		pubkey = "{= env.KEY_PUB1 =}";
+		privkey = "{= env.KEY_PVT1 =}";
 	}
 	task_timeout = 60s;
 }
 worker {
 	type = controller
-	bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
 	count = 1
 	keypair {
-		pubkey = "${KEY_PUB1}";
-		privkey = "${KEY_PVT1}";
+		pubkey = "{= env.KEY_PUB1 =}";
+		privkey = "{= env.KEY_PVT1 =}";
 	}
 	secure_ip = ["127.0.0.1", "::1"];
-	stats_path = "${TMPDIR}/stats.ucl";
+	stats_path = "{= env.TMPDIR =}/stats.ucl";
 }
 
 classifier {
 	languages_enabled = true;
 	tokenizer {
 		name = "osb";
-		${STATS_HASH}
-		${STATS_KEY}
+		hash = {= env.STATS_HASH =};
+		key = {= env.STATS_KEY =};
 	}
-	backend = ${STATS_BACKEND}
+	backend = "{= env.STATS_BACKEND =}";
 	statfile {
 		spam = true;
 		symbol = BAYES_SPAM;
 		size = 1M;
-		${REDIS_SERVER}
+		server = {= env.REDIS_SERVER =}
 	}
 	statfile {
 		spam = false;
 		symbol = BAYES_HAM;
 		size = 1M;
-		${REDIS_SERVER}
+		server = {= env.REDIS_SERVER =}
 	}
 
 	cache {
-		${REDIS_SERVER}
+		server = {= env.REDIS_SERVER =}
 	}
 }
-lua = "${TESTDIR}/lua/test_coverage.lua";
+lua = "{= env.TESTDIR =}/lua/test_coverage.lua";
 
 settings {}
diff --git a/test/functional/configs/surbl.conf b/test/functional/configs/surbl.conf
index 6e3a40e18..fe6368277 100644
--- a/test/functional/configs/surbl.conf
+++ b/test/functional/configs/surbl.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 surbl {
     "whitelist" = [
     "rspamd-test.com"
@@ -66,7 +68,7 @@ EOD;
     }
     "BAD_SUBDOMAIN" {
       suffix = "test7.uribl";
-      url_compose_map = "${TESTDIR}/configs/maps/url_compose_map.list";
+      url_compose_map = "{= env.TESTDIR =}/configs/maps/url_compose_map.list";
       check_dkim = true;
       check_emails = false;
     }
@@ -88,4 +90,4 @@ emails {
         replyto = true;
       }
   }
-}
\ No newline at end of file
+}
diff --git a/test/functional/configs/trivial.conf b/test/functional/configs/trivial.conf
index 5d4aa0af6..97e3a301e 100644
--- a/test/functional/configs/trivial.conf
+++ b/test/functional/configs/trivial.conf
@@ -1,8 +1,8 @@
 options = {
 	filters = ["spf", "dkim", "regexp"]
-	url_tld = "${TESTDIR}/../lua/unit/test_tld.dat"
-	pidfile = "${TMPDIR}/rspamd.pid";
-	lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua";
+	url_tld = "{= env.TESTDIR =}/../lua/unit/test_tld.dat"
+	pidfile = "{= env.TMPDIR =}/rspamd.pid";
+	lua_path = "{= env.INSTALLROOT =}/share/rspamd/lib/?.lua";
 	dns {
 	nameserver = ["8.8.8.8", "8.8.4.4"];
       retransmits = 10;
@@ -13,7 +13,7 @@ logging = {
 	log_urls = true;
 	type = "file",
 	level = "debug"
-	filename = "${TMPDIR}/rspamd.log";
+	filename = "{= env.TMPDIR =}/rspamd.log";
 	log_usec = true;
 }
 metric = {
@@ -26,25 +26,25 @@ metric = {
 
 worker {
 	type = normal
-	bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+	bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_NORMAL =}"
 	count = 1
 	keypair {
-		pubkey = "${KEY_PUB1}";
-		privkey = "${KEY_PVT1}";
+		pubkey = "{= env.KEY_PUB1 =}";
+		privkey = "{= env.KEY_PVT1 =}";
 	}
 	task_timeout = 10s;
 }
 
 worker {
         type = controller
-        bind_socket = ${LOCAL_ADDR}:${PORT_CONTROLLER}
+        bind_socket = "{= env.LOCAL_ADDR =}:{= env.PORT_CONTROLLER =}"
         count = 1
         secure_ip = ["127.0.0.1", "::1"];
-        stats_path = "${TMPDIR}/stats.ucl"
+        stats_path = "{= env.TMPDIR =}/stats.ucl"
 }
 
 modules {
-    path = "${TESTDIR}/../../src/plugins/lua/"
+    path = "{= env.TESTDIR =}/../../src/plugins/lua/"
 }
-lua = "${INSTALLROOT}/share/rspamd/rules/rspamd.lua"
+lua = "{= env.INSTALLROOT =}/share/rspamd/rules/rspamd.lua"
 
diff --git a/test/functional/configs/url_redirector.conf b/test/functional/configs/url_redirector.conf
index f61fa3086..e6009ba66 100644
--- a/test/functional/configs/url_redirector.conf
+++ b/test/functional/configs/url_redirector.conf
@@ -1,6 +1,8 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 redis {
-  servers = "${REDIS_ADDR}:${REDIS_PORT}";
+  servers = "{= env.REDIS_ADDR =}:{= env.REDIS_PORT =}";
 }
 url_redirector {
-  redirector_hosts_map = "${TESTDIR}/configs/maps/redir.map";
+  redirector_hosts_map = "{= env.TESTDIR =}/configs/maps/redir.map";
 }
diff --git a/test/functional/configs/whitelist.conf b/test/functional/configs/whitelist.conf
index d7592fc35..db264aa42 100644
--- a/test/functional/configs/whitelist.conf
+++ b/test/functional/configs/whitelist.conf
@@ -1,3 +1,5 @@
+.include(duplicate=append,priority=0) "{= env.TESTDIR =}/configs/plugins.conf"
+
 dmarc {}
 spf {}
 whitelist {
@@ -9,7 +11,7 @@ whitelist {
             valid_dmarc = true;
             valid_spf = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             score = -3.0;
             inverse_symbol = "BLACKLIST_DDS";
@@ -18,7 +20,7 @@ whitelist {
         "WHITELIST_DKIM" = {
             valid_dkim = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             description = "Mail comes from the whitelisted domain and has a valid DKIM signature";
             score = -1.0;
@@ -28,7 +30,7 @@ whitelist {
         "WHITELIST_SPF" = {
             valid_spf = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             score = -1.0
             inverse_multiplier = 3.0
@@ -40,7 +42,7 @@ whitelist {
             valid_spf = true;
             valid_dkim = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list"
+                "{= env.TESTDIR =}/configs/maps/domains.list"
             ];
             score = -3.0;
             description = "Mail comes from the whitelisted domain and has a valid SPF policy and valid DKIM signature";
@@ -51,7 +53,7 @@ whitelist {
             valid_dmarc = true;
             valid_dkim = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             score = -2.0;
             description = "Mail comes from the whitelisted domain and has valid DMARC and DKIM policies";
@@ -61,7 +63,7 @@ whitelist {
         "WHITELIST_DMARC" = {
             valid_dmarc = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             score = -2.0;
             description = "Mail comes from the whitelisted domain and has valid DMARC policy";
@@ -72,7 +74,7 @@ whitelist {
             strict = true;
             valid_dmarc = true;
             domains = [
-                "${TESTDIR}/configs/maps/domains.list",
+                "{= env.TESTDIR =}/configs/maps/domains.list",
             ];
             score = -3.0;
         }