diff --git a/go.mod b/go.mod
index 2ff43828..dbb56e9d 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/golang/mock v1.6.0
 	github.com/qdm12/dns v1.11.0
 	github.com/qdm12/golibs v0.0.0-20210822203818-5c568b0777b6
-	github.com/qdm12/gosettings v0.3.0-rc7
+	github.com/qdm12/gosettings v0.3.0-rc9
 	github.com/qdm12/goshutdown v0.3.0
 	github.com/qdm12/gosplash v0.1.0
 	github.com/qdm12/gotree v0.2.0
diff --git a/go.sum b/go.sum
index 23f23bd4..27c8917c 100644
--- a/go.sum
+++ b/go.sum
@@ -91,8 +91,8 @@ github.com/qdm12/golibs v0.0.0-20210603202746-e5494e9c2ebb/go.mod h1:15RBzkun0i8
 github.com/qdm12/golibs v0.0.0-20210723175634-a75ca7fd74c2/go.mod h1:6aRbg4Z/bTbm9JfxsGXfWKHi7zsOvPfUTK1S5HuAFKg=
 github.com/qdm12/golibs v0.0.0-20210822203818-5c568b0777b6 h1:bge5AL7cjHJMPz+5IOz5yF01q/l8No6+lIEBieA8gMg=
 github.com/qdm12/golibs v0.0.0-20210822203818-5c568b0777b6/go.mod h1:6aRbg4Z/bTbm9JfxsGXfWKHi7zsOvPfUTK1S5HuAFKg=
-github.com/qdm12/gosettings v0.3.0-rc7 h1:fRIJe+pUIe2uzKjqtNnWIUsZsvpoPbXv5a/xo5utvbs=
-github.com/qdm12/gosettings v0.3.0-rc7/go.mod h1:+hHzN8lsE63T01t6SruGzc6xkpvfsZFod/ooDs8FWnQ=
+github.com/qdm12/gosettings v0.3.0-rc9 h1:/Hr+lXjAeZFQ5LiEX+sKgMyWSckmhvTSs9iGo/Ch+q0=
+github.com/qdm12/gosettings v0.3.0-rc9/go.mod h1:+hHzN8lsE63T01t6SruGzc6xkpvfsZFod/ooDs8FWnQ=
 github.com/qdm12/goshutdown v0.3.0 h1:pqBpJkdwlZlfTEx4QHtS8u8CXx6pG0fVo6S1N0MpSEM=
 github.com/qdm12/goshutdown v0.3.0/go.mod h1:EqZ46No00kCTZ5qzdd3qIzY6ayhMt24QI8Mh8LVQYmM=
 github.com/qdm12/gosplash v0.1.0 h1:Sfl+zIjFZFP7b0iqf2l5UkmEY97XBnaKkH3FNY6Gf7g=
diff --git a/internal/configuration/sources/env/dns.go b/internal/configuration/sources/env/dns.go
index 0360f962..49bdbfad 100644
--- a/internal/configuration/sources/env/dns.go
+++ b/internal/configuration/sources/env/dns.go
@@ -16,7 +16,7 @@ func (s *Source) readDNS() (dns settings.DNS, err error) {
 
 	dns.KeepNameserver, err = env.BoolPtr("DNS_KEEP_NAMESERVER")
 	if err != nil {
-		return dns, fmt.Errorf("environment variable DNS_KEEP_NAMESERVER: %w", err)
+		return dns, err
 	}
 
 	dns.DoT, err = s.readDoT()
@@ -29,18 +29,18 @@ func (s *Source) readDNS() (dns settings.DNS, err error) {
 
 func (s *Source) readDNSServerAddress() (address netip.Addr, err error) {
 	key, value := s.getEnvWithRetro("DNS_ADDRESS", []string{"DNS_PLAINTEXT_ADDRESS"})
-	if value == "" {
+	if value == nil {
 		return address, nil
 	}
 
-	address, err = netip.ParseAddr(value)
+	address, err = netip.ParseAddr(*value)
 	if err != nil {
 		return address, fmt.Errorf("environment variable %s: %w", key, err)
 	}
 
 	// TODO remove in v4
 	if address.Unmap().Compare(netip.AddrFrom4([4]byte{127, 0, 0, 1})) != 0 {
-		s.warner.Warn(key + " is set to " + value +
+		s.warner.Warn(key + " is set to " + *value +
 			" so the DNS over TLS (DoT) server will not be used." +
 			" The default value changed to 127.0.0.1 so it uses the internal DoT serves." +
 			" If the DoT server fails to start, the IPv4 address of the first plaintext DNS server" +
diff --git a/internal/configuration/sources/env/dnsblacklist.go b/internal/configuration/sources/env/dnsblacklist.go
index 6609a2cb..d16b3e88 100644
--- a/internal/configuration/sources/env/dnsblacklist.go
+++ b/internal/configuration/sources/env/dnsblacklist.go
@@ -7,13 +7,12 @@ import (
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
-	"github.com/qdm12/govalid/binary"
 )
 
 func (s *Source) readDNSBlacklist() (blacklist settings.DNSBlacklist, err error) {
 	blacklist.BlockMalicious, err = env.BoolPtr("BLOCK_MALICIOUS")
 	if err != nil {
-		return blacklist, fmt.Errorf("environment variable BLOCK_MALICIOUS: %w", err)
+		return blacklist, err
 	}
 
 	blacklist.BlockSurveillance, err = s.readBlockSurveillance()
@@ -23,7 +22,7 @@ func (s *Source) readDNSBlacklist() (blacklist settings.DNSBlacklist, err error)
 
 	blacklist.BlockAds, err = env.BoolPtr("BLOCK_ADS")
 	if err != nil {
-		return blacklist, fmt.Errorf("environment variable BLOCK_ADS: %w", err)
+		return blacklist, err
 	}
 
 	blacklist.AddBlockedIPs, blacklist.AddBlockedIPPrefixes,
@@ -38,13 +37,8 @@ func (s *Source) readDNSBlacklist() (blacklist settings.DNSBlacklist, err error)
 }
 
 func (s *Source) readBlockSurveillance() (blocked *bool, err error) {
-	key, value := s.getEnvWithRetro("BLOCK_SURVEILLANCE", []string{"BLOCK_NSA"})
-	blocked, err = binary.Validate(value)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", key, err)
-	}
-
-	return blocked, nil
+	key, _ := s.getEnvWithRetro("BLOCK_SURVEILLANCE", []string{"BLOCK_NSA"})
+	return env.BoolPtr(key)
 }
 
 var (
diff --git a/internal/configuration/sources/env/dot.go b/internal/configuration/sources/env/dot.go
index 437312b8..23968162 100644
--- a/internal/configuration/sources/env/dot.go
+++ b/internal/configuration/sources/env/dot.go
@@ -1,8 +1,6 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
@@ -10,12 +8,12 @@ import (
 func (s *Source) readDoT() (dot settings.DoT, err error) {
 	dot.Enabled, err = env.BoolPtr("DOT")
 	if err != nil {
-		return dot, fmt.Errorf("environment variable DOT: %w", err)
+		return dot, err
 	}
 
 	dot.UpdatePeriod, err = env.DurationPtr("DNS_UPDATE_PERIOD")
 	if err != nil {
-		return dot, fmt.Errorf("environment variable DNS_UPDATE_PERIOD: %w", err)
+		return dot, err
 	}
 
 	dot.Unbound, err = readUnbound()
diff --git a/internal/configuration/sources/env/firewall.go b/internal/configuration/sources/env/firewall.go
index ebd58996..cd03aae4 100644
--- a/internal/configuration/sources/env/firewall.go
+++ b/internal/configuration/sources/env/firewall.go
@@ -32,12 +32,12 @@ func (s *Source) readFirewall() (firewall settings.Firewall, err error) {
 
 	firewall.Enabled, err = env.BoolPtr("FIREWALL")
 	if err != nil {
-		return firewall, fmt.Errorf("environment variable FIREWALL: %w", err)
+		return firewall, err
 	}
 
 	firewall.Debug, err = env.BoolPtr("FIREWALL_DEBUG")
 	if err != nil {
-		return firewall, fmt.Errorf("environment variable FIREWALL_DEBUG: %w", err)
+		return firewall, err
 	}
 
 	return firewall, nil
diff --git a/internal/configuration/sources/env/health.go b/internal/configuration/sources/env/health.go
index fbc42989..7f4bfe0f 100644
--- a/internal/configuration/sources/env/health.go
+++ b/internal/configuration/sources/env/health.go
@@ -1,7 +1,6 @@
 package env
 
 import (
-	"fmt"
 	"time"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -9,12 +8,13 @@ import (
 )
 
 func (s *Source) ReadHealth() (health settings.Health, err error) {
-	health.ServerAddress = env.Get("HEALTH_SERVER_ADDRESS")
-	_, health.TargetAddress = s.getEnvWithRetro("HEALTH_TARGET_ADDRESS", []string{"HEALTH_ADDRESS_TO_PING"})
+	health.ServerAddress = env.String("HEALTH_SERVER_ADDRESS")
+	targetAddressEnvKey, _ := s.getEnvWithRetro("HEALTH_TARGET_ADDRESS", []string{"HEALTH_ADDRESS_TO_PING"})
+	health.TargetAddress = env.String(targetAddressEnvKey)
 
 	successWaitPtr, err := env.DurationPtr("HEALTH_SUCCESS_WAIT_DURATION")
 	if err != nil {
-		return health, fmt.Errorf("environment variable HEALTH_SUCCESS_WAIT_DURATION: %w", err)
+		return health, err
 	} else if successWaitPtr != nil {
 		health.SuccessWait = *successWaitPtr
 	}
@@ -37,16 +37,6 @@ func (s *Source) ReadHealth() (health settings.Health, err error) {
 }
 
 func (s *Source) readDurationWithRetro(envKey, retroEnvKey string) (d *time.Duration, err error) {
-	envKey, value := s.getEnvWithRetro(envKey, []string{retroEnvKey})
-	if value == "" {
-		return nil, nil //nolint:nilnil
-	}
-
-	d = new(time.Duration)
-	*d, err = time.ParseDuration(value)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", envKey, err)
-	}
-
-	return d, nil
+	envKey, _ = s.getEnvWithRetro(envKey, []string{retroEnvKey})
+	return env.DurationPtr(envKey)
 }
diff --git a/internal/configuration/sources/env/httproxy.go b/internal/configuration/sources/env/httproxy.go
index 036f0a86..d223fefc 100644
--- a/internal/configuration/sources/env/httproxy.go
+++ b/internal/configuration/sources/env/httproxy.go
@@ -9,8 +9,12 @@ import (
 )
 
 func (s *Source) readHTTPProxy() (httpProxy settings.HTTPProxy, err error) {
-	httpProxy.User = s.readHTTProxyUser()
-	httpProxy.Password = s.readHTTProxyPassword()
+	_, httpProxy.User = s.getEnvWithRetro("HTTPPROXY_USER",
+		[]string{"PROXY_USER", "TINYPROXY_USER"}, env.ForceLowercase(false))
+
+	_, httpProxy.Password = s.getEnvWithRetro("HTTPPROXY_PASSWORD",
+		[]string{"PROXY_PASSWORD", "TINYPROXY_PASSWORD"}, env.ForceLowercase(false))
+
 	httpProxy.ListeningAddress = s.readHTTProxyListeningAddress()
 
 	httpProxy.Enabled, err = s.readHTTProxyEnabled()
@@ -20,7 +24,7 @@ func (s *Source) readHTTPProxy() (httpProxy settings.HTTPProxy, err error) {
 
 	httpProxy.Stealth, err = env.BoolPtr("HTTPPROXY_STEALTH")
 	if err != nil {
-		return httpProxy, fmt.Errorf("environment variable HTTPPROXY_STEALTH: %w", err)
+		return httpProxy, err
 	}
 
 	httpProxy.Log, err = s.readHTTProxyLog()
@@ -31,47 +35,29 @@ func (s *Source) readHTTPProxy() (httpProxy settings.HTTPProxy, err error) {
 	return httpProxy, nil
 }
 
-func (s *Source) readHTTProxyUser() (user *string) {
-	_, value := s.getEnvWithRetro("HTTPPROXY_USER",
-		[]string{"PROXY_USER", "TINYPROXY_USER"}, env.ForceLowercase(false))
-	if value != "" {
-		return &value
-	}
-	return nil
-}
-
-func (s *Source) readHTTProxyPassword() (user *string) {
-	_, value := s.getEnvWithRetro("HTTPPROXY_PASSWORD",
-		[]string{"PROXY_PASSWORD", "TINYPROXY_PASSWORD"}, env.ForceLowercase(false))
-	if value != "" {
-		return &value
-	}
-	return nil
-}
-
 func (s *Source) readHTTProxyListeningAddress() (listeningAddress string) {
 	key, value := s.getEnvWithRetro("HTTPPROXY_LISTENING_ADDRESS",
 		[]string{"PROXY_PORT", "TINYPROXY_PORT", "HTTPPROXY_PORT"})
-	if key == "HTTPPROXY_LISTENING_ADDRESS" {
-		return value
+	if value == nil {
+		return ""
+	} else if key == "HTTPPROXY_LISTENING_ADDRESS" {
+		return *value
 	}
-	return ":" + value
+	return ":" + *value
 }
 
 func (s *Source) readHTTProxyEnabled() (enabled *bool, err error) {
-	key, value := s.getEnvWithRetro("HTTPPROXY",
+	key, _ := s.getEnvWithRetro("HTTPPROXY",
 		[]string{"PROXY", "TINYPROXY"})
-	enabled, err = binary.Validate(value)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", key, err)
-	}
-
-	return enabled, nil
+	return env.BoolPtr(key)
 }
 
 func (s *Source) readHTTProxyLog() (enabled *bool, err error) {
 	key, value := s.getEnvWithRetro("HTTPPROXY_LOG",
 		[]string{"PROXY_LOG_LEVEL", "TINYPROXY_LOG"})
+	if value == nil {
+		return nil, nil //nolint:nilnil
+	}
 
 	var binaryOptions []binary.Option
 	if key != "HTTPROXY_LOG" {
@@ -79,7 +65,7 @@ func (s *Source) readHTTProxyLog() (enabled *bool, err error) {
 		binaryOptions = append(binaryOptions, retroOption)
 	}
 
-	enabled, err = binary.Validate(value, binaryOptions...)
+	enabled, err = binary.Validate(*value, binaryOptions...)
 	if err != nil {
 		return nil, fmt.Errorf("environment variable %s: %w", key, err)
 	}
diff --git a/internal/configuration/sources/env/log.go b/internal/configuration/sources/env/log.go
index 9b499bc7..2bab9def 100644
--- a/internal/configuration/sources/env/log.go
+++ b/internal/configuration/sources/env/log.go
@@ -20,7 +20,7 @@ func readLog() (log settings.Log, err error) {
 }
 
 func readLogLevel() (level *log.Level, err error) {
-	s := env.Get("LOG_LEVEL")
+	s := env.String("LOG_LEVEL")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/openvpn.go b/internal/configuration/sources/env/openvpn.go
index 41f25af3..330c5001 100644
--- a/internal/configuration/sources/env/openvpn.go
+++ b/internal/configuration/sources/env/openvpn.go
@@ -16,37 +16,34 @@ func (s *Source) readOpenVPN() (
 			"OPENVPN_KEY_PASSPHRASE", "OPENVPN_ENCRYPTED_KEY"}, err)
 	}()
 
-	openVPN.Version = env.Get("OPENVPN_VERSION")
-	openVPN.User = s.readOpenVPNUser()
-	openVPN.Password = s.readOpenVPNPassword()
-	confFile := env.Get("OPENVPN_CUSTOM_CONFIG")
-	if confFile != "" {
-		openVPN.ConfFile = &confFile
-	}
+	openVPN.Version = env.String("OPENVPN_VERSION")
+	_, openVPN.User = s.getEnvWithRetro("OPENVPN_USER",
+		[]string{"USER"}, env.ForceLowercase(false))
+	_, openVPN.Password = s.getEnvWithRetro("OPENVPN_PASSWORD",
+		[]string{"PASSWORD"}, env.ForceLowercase(false))
+	openVPN.ConfFile = env.Get("OPENVPN_CUSTOM_CONFIG")
 
 	ciphersKey, _ := s.getEnvWithRetro("OPENVPN_CIPHERS", []string{"OPENVPN_CIPHER"})
 	openVPN.Ciphers = env.CSV(ciphersKey)
 
-	auth := env.Get("OPENVPN_AUTH")
-	if auth != "" {
-		openVPN.Auth = &auth
-	}
-
-	openVPN.Cert = env.StringPtr("OPENVPN_CERT", env.ForceLowercase(false))
-	openVPN.Key = env.StringPtr("OPENVPN_KEY", env.ForceLowercase(false))
-	openVPN.EncryptedKey = env.StringPtr("OPENVPN_ENCRYPTED_KEY", env.ForceLowercase(false))
-
-	openVPN.KeyPassphrase = s.readOpenVPNKeyPassphrase()
+	openVPN.Auth = env.Get("OPENVPN_AUTH")
+	openVPN.Cert = env.Get("OPENVPN_CERT", env.ForceLowercase(false))
+	openVPN.Key = env.Get("OPENVPN_KEY", env.ForceLowercase(false))
+	openVPN.EncryptedKey = env.Get("OPENVPN_ENCRYPTED_KEY", env.ForceLowercase(false))
+	openVPN.KeyPassphrase = env.Get("OPENVPN_KEY_PASSPHRASE", env.ForceLowercase(false))
 
 	openVPN.PIAEncPreset = s.readPIAEncryptionPreset()
 
 	openVPN.MSSFix, err = env.Uint16Ptr("OPENVPN_MSSFIX")
 	if err != nil {
-		return openVPN, fmt.Errorf("environment variable OPENVPN_MSSFIX: %w", err)
+		return openVPN, err
 	}
 
-	_, openVPN.Interface = s.getEnvWithRetro("VPN_INTERFACE",
+	_, openvpnInterface := s.getEnvWithRetro("VPN_INTERFACE",
 		[]string{"OPENVPN_INTERFACE"}, env.ForceLowercase(false))
+	if openvpnInterface != nil {
+		openVPN.Interface = *openvpnInterface
+	}
 
 	openVPN.ProcessUser, err = s.readOpenVPNProcessUser()
 	if err != nil {
@@ -55,72 +52,38 @@ func (s *Source) readOpenVPN() (
 
 	openVPN.Verbosity, err = env.IntPtr("OPENVPN_VERBOSITY")
 	if err != nil {
-		return openVPN, fmt.Errorf("environment variable OPENVPN_VERBOSITY: %w", err)
+		return openVPN, err
 	}
 
-	flagsStr := env.Get("OPENVPN_FLAGS", env.ForceLowercase(false))
-	if flagsStr != "" {
-		openVPN.Flags = strings.Fields(flagsStr)
+	flagsPtr := env.Get("OPENVPN_FLAGS", env.ForceLowercase(false))
+	if flagsPtr != nil {
+		openVPN.Flags = strings.Fields(*flagsPtr)
 	}
 
 	return openVPN, nil
 }
 
-func (s *Source) readOpenVPNUser() (user *string) {
-	user = new(string)
-	_, *user = s.getEnvWithRetro("OPENVPN_USER",
-		[]string{"USER"}, env.ForceLowercase(false))
-	if *user == "" {
-		return nil
-	}
-
-	// Remove spaces in user ID to simplify user's life, thanks @JeordyR
-	*user = strings.ReplaceAll(*user, " ", "")
-	return user
-}
-
-func (s *Source) readOpenVPNPassword() (password *string) {
-	password = new(string)
-	_, *password = s.getEnvWithRetro("OPENVPN_PASSWORD",
-		[]string{"PASSWORD"}, env.ForceLowercase(false))
-	if *password == "" {
-		return nil
-	}
-
-	return password
-}
-
-func (s *Source) readOpenVPNKeyPassphrase() (passphrase *string) {
-	passphrase = new(string)
-	*passphrase = env.Get("OPENVPN_KEY_PASSPHRASE", env.ForceLowercase(false))
-	if *passphrase == "" {
-		return nil
-	}
-	return passphrase
-}
-
 func (s *Source) readPIAEncryptionPreset() (presetPtr *string) {
-	_, preset := s.getEnvWithRetro(
+	_, presetPtr = s.getEnvWithRetro(
 		"PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET",
 		[]string{"PIA_ENCRYPTION", "ENCRYPTION"})
-	if preset != "" {
-		return &preset
-	}
-	return nil
+	return presetPtr
 }
 
 func (s *Source) readOpenVPNProcessUser() (processUser string, err error) {
 	key, value := s.getEnvWithRetro("OPENVPN_PROCESS_USER",
 		[]string{"OPENVPN_ROOT"})
-	if key == "OPENVPN_PROCESS_USER" {
-		return value, nil
+	if value == nil {
+		return "", nil
+	} else if key == "OPENVPN_PROCESS_USER" {
+		return *value, nil
 	}
 
 	// Retro-compatibility
-	if value == "" {
+	if *value == "" {
 		return "", nil
 	}
-	root, err := binary.Validate(value)
+	root, err := binary.Validate(*value)
 	if err != nil {
 		return "", fmt.Errorf("environment variable %s: %w", key, err)
 	}
diff --git a/internal/configuration/sources/env/openvpnselection.go b/internal/configuration/sources/env/openvpnselection.go
index 66dc8968..daca92dd 100644
--- a/internal/configuration/sources/env/openvpnselection.go
+++ b/internal/configuration/sources/env/openvpnselection.go
@@ -8,15 +8,11 @@ import (
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gosettings/sources/env"
-	"github.com/qdm12/govalid/port"
 )
 
 func (s *Source) readOpenVPNSelection() (
 	selection settings.OpenVPNSelection, err error) {
-	confFile := env.Get("OPENVPN_CUSTOM_CONFIG", env.ForceLowercase(false))
-	if confFile != "" {
-		selection.ConfFile = &confFile
-	}
+	selection.ConfFile = env.Get("OPENVPN_CUSTOM_CONFIG", env.ForceLowercase(false))
 
 	selection.TCP, err = s.readOpenVPNProtocol()
 	if err != nil {
@@ -36,7 +32,11 @@ func (s *Source) readOpenVPNSelection() (
 var ErrOpenVPNProtocolNotValid = errors.New("OpenVPN protocol is not valid")
 
 func (s *Source) readOpenVPNProtocol() (tcp *bool, err error) {
-	envKey, protocol := s.getEnvWithRetro("OPENVPN_PROTOCOL", []string{"PROTOCOL"})
+	envKey, protocolPtr := s.getEnvWithRetro("OPENVPN_PROTOCOL", []string{"PROTOCOL"})
+	if protocolPtr == nil {
+		return nil, nil //nolint:nilnil
+	}
+	protocol := *protocolPtr
 
 	switch strings.ToLower(protocol) {
 	case "":
@@ -52,16 +52,6 @@ func (s *Source) readOpenVPNProtocol() (tcp *bool, err error) {
 }
 
 func (s *Source) readOpenVPNCustomPort() (customPort *uint16, err error) {
-	key, value := s.getEnvWithRetro("VPN_ENDPOINT_PORT", []string{"PORT", "OPENVPN_PORT"})
-	if value == "" {
-		return nil, nil //nolint:nilnil
-	}
-
-	customPort = new(uint16)
-	*customPort, err = port.Validate(value)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", key, err)
-	}
-
-	return customPort, nil
+	key, _ := s.getEnvWithRetro("VPN_ENDPOINT_PORT", []string{"PORT", "OPENVPN_PORT"})
+	return env.Uint16Ptr(key)
 }
diff --git a/internal/configuration/sources/env/portforward.go b/internal/configuration/sources/env/portforward.go
index b1343350..e5e2360c 100644
--- a/internal/configuration/sources/env/portforward.go
+++ b/internal/configuration/sources/env/portforward.go
@@ -1,8 +1,6 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
@@ -16,17 +14,14 @@ func (s *Source) readPortForward() (
 		})
 	portForwarding.Enabled, err = env.BoolPtr(key)
 	if err != nil {
-		return portForwarding, fmt.Errorf("environment variable %s: %w", key, err)
+		return portForwarding, err
 	}
 
-	_, value := s.getEnvWithRetro("VPN_PORT_FORWARDING_STATUS_FILE",
+	_, portForwarding.Filepath = s.getEnvWithRetro("VPN_PORT_FORWARDING_STATUS_FILE",
 		[]string{
 			"PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING_STATUS_FILE",
 			"PORT_FORWARDING_STATUS_FILE",
 		}, env.ForceLowercase(false))
-	if value != "" {
-		portForwarding.Filepath = ptrTo(value)
-	}
 
 	return portForwarding, nil
 }
diff --git a/internal/configuration/sources/env/pprof.go b/internal/configuration/sources/env/pprof.go
index db724926..891a7a52 100644
--- a/internal/configuration/sources/env/pprof.go
+++ b/internal/configuration/sources/env/pprof.go
@@ -1,8 +1,6 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/pprof"
 	"github.com/qdm12/gosettings/sources/env"
 )
@@ -10,20 +8,20 @@ import (
 func readPprof() (settings pprof.Settings, err error) {
 	settings.Enabled, err = env.BoolPtr("PPROF_ENABLED")
 	if err != nil {
-		return settings, fmt.Errorf("environment variable PPROF_ENABLED: %w", err)
+		return settings, err
 	}
 
 	settings.BlockProfileRate, err = env.IntPtr("PPROF_BLOCK_PROFILE_RATE")
 	if err != nil {
-		return settings, fmt.Errorf("environment variable PPROF_BLOCK_PROFILE_RATE: %w", err)
+		return settings, err
 	}
 
 	settings.MutexProfileRate, err = env.IntPtr("PPROF_MUTEX_PROFILE_RATE")
 	if err != nil {
-		return settings, fmt.Errorf("environment variable PPROF_MUTEX_PROFILE_RATE: %w", err)
+		return settings, err
 	}
 
-	settings.HTTPServer.Address = env.Get("PPROF_HTTP_SERVER_ADDRESS")
+	settings.HTTPServer.Address = env.String("PPROF_HTTP_SERVER_ADDRESS")
 
 	return settings, nil
 }
diff --git a/internal/configuration/sources/env/provider.go b/internal/configuration/sources/env/provider.go
index cc20fbed..ef73e7b9 100644
--- a/internal/configuration/sources/env/provider.go
+++ b/internal/configuration/sources/env/provider.go
@@ -31,15 +31,16 @@ func (s *Source) readProvider(vpnType string) (provider settings.Provider, err e
 }
 
 func (s *Source) readVPNServiceProvider(vpnType string) (vpnProviderPtr *string) {
-	_, value := s.getEnvWithRetro("VPN_SERVICE_PROVIDER", []string{"VPNSP"})
-	if value == "" {
-		if vpnType != vpn.Wireguard && env.Get("OPENVPN_CUSTOM_CONFIG") != "" {
+	_, valuePtr := s.getEnvWithRetro("VPN_SERVICE_PROVIDER", []string{"VPNSP"})
+	if valuePtr == nil {
+		if vpnType != vpn.Wireguard && env.Get("OPENVPN_CUSTOM_CONFIG") != nil {
 			// retro compatibility
 			return ptrTo(providers.Custom)
 		}
 		return nil
 	}
 
+	value := *valuePtr
 	value = strings.ToLower(value)
 	if value == "pia" { // retro compatibility
 		return ptrTo(providers.PrivateInternetAccess)
diff --git a/internal/configuration/sources/env/publicip.go b/internal/configuration/sources/env/publicip.go
index 4a61e697..a12f7107 100644
--- a/internal/configuration/sources/env/publicip.go
+++ b/internal/configuration/sources/env/publicip.go
@@ -1,44 +1,18 @@
 package env
 
 import (
-	"fmt"
-	"time"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
 
 func (s *Source) readPublicIP() (publicIP settings.PublicIP, err error) {
-	publicIP.Period, err = readPublicIPPeriod()
+	publicIP.Period, err = env.DurationPtr("PUBLICIP_PERIOD")
 	if err != nil {
 		return publicIP, err
 	}
 
-	publicIP.IPFilepath = s.readPublicIPFilepath()
+	_, publicIP.IPFilepath = s.getEnvWithRetro("PUBLICIP_FILE",
+		[]string{"IP_STATUS_FILE"}, env.ForceLowercase(false))
 
 	return publicIP, nil
 }
-
-func readPublicIPPeriod() (period *time.Duration, err error) {
-	s := env.Get("PUBLICIP_PERIOD")
-	if s == "" {
-		return nil, nil //nolint:nilnil
-	}
-
-	period = new(time.Duration)
-	*period, err = time.ParseDuration(s)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable PUBLICIP_PERIOD: %w", err)
-	}
-
-	return period, nil
-}
-
-func (s *Source) readPublicIPFilepath() (filepath *string) {
-	_, value := s.getEnvWithRetro("PUBLICIP_FILE",
-		[]string{"IP_STATUS_FILE"}, env.ForceLowercase(false))
-	if value != "" {
-		return &value
-	}
-	return nil
-}
diff --git a/internal/configuration/sources/env/reader.go b/internal/configuration/sources/env/reader.go
index 6a72e4b6..004cb1cc 100644
--- a/internal/configuration/sources/env/reader.go
+++ b/internal/configuration/sources/env/reader.go
@@ -96,19 +96,19 @@ func (s *Source) onRetroActive(oldKey, newKey string) {
 			", please consider changing it to " + newKey)
 }
 
-// getEnvWithRetro returns the first environment variable
-// key and corresponding non empty value from the environment
+// getEnvWithRetro returns the first set environment variable
+// key and corresponding value from the environment
 // variable keys given. It first goes through the retroKeys
 // and end on returning the value corresponding to the currentKey.
 // Note retroKeys should be in order from oldest to most
 // recent retro-compatibility key.
 func (s *Source) getEnvWithRetro(currentKey string,
-	retroKeys []string, options ...env.Option) (key, value string) {
+	retroKeys []string, options ...env.Option) (key string, value *string) {
 	// We check retro-compatibility keys first since
 	// the current key might be set in the Dockerfile.
 	for _, key = range retroKeys {
 		value = env.Get(key, options...)
-		if value != "" {
+		if value != nil {
 			s.onRetroActive(key, currentKey)
 			return key, value
 		}
diff --git a/internal/configuration/sources/env/server.go b/internal/configuration/sources/env/server.go
index c27d64d2..3babf7a2 100644
--- a/internal/configuration/sources/env/server.go
+++ b/internal/configuration/sources/env/server.go
@@ -1,15 +1,12 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
-	"github.com/qdm12/govalid/binary"
 )
 
 func (s *Source) readControlServer() (controlServer settings.ControlServer, err error) {
-	controlServer.Log, err = readControlServerLog()
+	controlServer.Log, err = env.BoolPtr("HTTP_CONTROL_SERVER_LOG")
 	if err != nil {
 		return controlServer, err
 	}
@@ -19,27 +16,18 @@ func (s *Source) readControlServer() (controlServer settings.ControlServer, err
 	return controlServer, nil
 }
 
-func readControlServerLog() (enabled *bool, err error) {
-	s := env.Get("HTTP_CONTROL_SERVER_LOG")
-	log, err := binary.Validate(s)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable HTTP_CONTROL_SERVER_LOG: %w", err)
-	}
-	return log, nil
-}
-
 func (s *Source) readControlServerAddress() (address *string) {
 	key, value := s.getEnvWithRetro("HTTP_CONTROL_SERVER_ADDRESS",
 		[]string{"CONTROL_SERVER_ADDRESS"})
-	if value == "" {
+	if value == nil {
 		return nil
 	}
 
 	if key == "HTTP_CONTROL_SERVER_ADDRESS" {
-		return &value
+		return value
 	}
 
 	address = new(string)
-	*address = ":" + value
+	*address = ":" + *value
 	return address
 }
diff --git a/internal/configuration/sources/env/serverselection.go b/internal/configuration/sources/env/serverselection.go
index 502afdf9..75ad2eb2 100644
--- a/internal/configuration/sources/env/serverselection.go
+++ b/internal/configuration/sources/env/serverselection.go
@@ -49,8 +49,8 @@ func (s *Source) readServerSelection(vpnProvider, vpnType string) (
 	serverNamesKey, _ := s.getEnvWithRetro("SERVER_NAMES", []string{"SERVER_NAME"})
 	ss.Names = env.CSV(serverNamesKey)
 
-	if csv := env.Get("SERVER_NUMBER"); csv != "" {
-		numbersStrings := strings.Split(csv, ",")
+	if csv := env.Get("SERVER_NUMBER"); csv != nil {
+		numbersStrings := strings.Split(*csv, ",")
 		numbers := make([]uint16, len(numbersStrings))
 		for i, numberString := range numbersStrings {
 			const base, bitSize = 10, 16
@@ -76,25 +76,25 @@ func (s *Source) readServerSelection(vpnProvider, vpnType string) (
 	// VPNUnlimited and ProtonVPN only
 	ss.FreeOnly, err = env.BoolPtr("FREE_ONLY")
 	if err != nil {
-		return ss, fmt.Errorf("environment variable FREE_ONLY: %w", err)
+		return ss, err
 	}
 
 	// VPNSecure only
 	ss.PremiumOnly, err = env.BoolPtr("PREMIUM_ONLY")
 	if err != nil {
-		return ss, fmt.Errorf("environment variable PREMIUM_ONLY: %w", err)
+		return ss, err
 	}
 
 	// VPNUnlimited only
 	ss.MultiHopOnly, err = env.BoolPtr("MULTIHOP_ONLY")
 	if err != nil {
-		return ss, fmt.Errorf("environment variable MULTIHOP_ONLY: %w", err)
+		return ss, err
 	}
 
 	// VPNUnlimited only
 	ss.MultiHopOnly, err = env.BoolPtr("STREAM_ONLY")
 	if err != nil {
-		return ss, fmt.Errorf("environment variable STREAM_ONLY: %w", err)
+		return ss, err
 	}
 
 	ss.OpenVPN, err = s.readOpenVPNSelection()
@@ -116,11 +116,11 @@ var (
 
 func (s *Source) readOpenVPNTargetIP() (ip netip.Addr, err error) {
 	envKey, value := s.getEnvWithRetro("VPN_ENDPOINT_IP", []string{"OPENVPN_TARGET_IP"})
-	if value == "" {
+	if value == nil {
 		return ip, nil
 	}
 
-	ip, err = netip.ParseAddr(value)
+	ip, err = netip.ParseAddr(*value)
 	if err != nil {
 		return ip, fmt.Errorf("environment variable %s: %w", envKey, err)
 	}
@@ -130,9 +130,5 @@ func (s *Source) readOpenVPNTargetIP() (ip netip.Addr, err error) {
 
 func (s *Source) readOwnedOnly() (ownedOnly *bool, err error) {
 	envKey, _ := s.getEnvWithRetro("OWNED_ONLY", []string{"OWNED"})
-	ownedOnly, err = env.BoolPtr(envKey)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", envKey, err)
-	}
-	return ownedOnly, nil
+	return env.BoolPtr(envKey)
 }
diff --git a/internal/configuration/sources/env/shadowsocks.go b/internal/configuration/sources/env/shadowsocks.go
index adc8cb08..7864e27f 100644
--- a/internal/configuration/sources/env/shadowsocks.go
+++ b/internal/configuration/sources/env/shadowsocks.go
@@ -1,9 +1,6 @@
 package env
 
 import (
-	"fmt"
-	"strings"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
@@ -11,16 +8,16 @@ import (
 func (s *Source) readShadowsocks() (shadowsocks settings.Shadowsocks, err error) {
 	shadowsocks.Enabled, err = env.BoolPtr("SHADOWSOCKS")
 	if err != nil {
-		return shadowsocks, fmt.Errorf("environment variable SHADOWSOCKS: %w", err)
+		return shadowsocks, err
 	}
 
 	shadowsocks.Address = s.readShadowsocksAddress()
 	shadowsocks.LogAddresses, err = env.BoolPtr("SHADOWSOCKS_LOG")
 	if err != nil {
-		return shadowsocks, fmt.Errorf("environment variable SHADOWSOCKS_LOG: %w", err)
+		return shadowsocks, err
 	}
 	shadowsocks.CipherName = s.readShadowsocksCipher()
-	shadowsocks.Password = env.StringPtr("SHADOWSOCKS_PASSWORD", env.ForceLowercase(false))
+	shadowsocks.Password = env.Get("SHADOWSOCKS_PASSWORD", env.ForceLowercase(false))
 
 	return shadowsocks, nil
 }
@@ -28,20 +25,20 @@ func (s *Source) readShadowsocks() (shadowsocks settings.Shadowsocks, err error)
 func (s *Source) readShadowsocksAddress() (address string) {
 	key, value := s.getEnvWithRetro("SHADOWSOCKS_LISTENING_ADDRESS",
 		[]string{"SHADOWSOCKS_PORT"})
-	if value == "" {
+	if value == nil {
 		return ""
 	}
 
 	if key == "SHADOWSOCKS_LISTENING_ADDRESS" {
-		return value
+		return *value
 	}
 
 	// Retro-compatibility
-	return ":" + value
+	return ":" + *value
 }
 
 func (s *Source) readShadowsocksCipher() (cipher string) {
-	_, cipher = s.getEnvWithRetro("SHADOWSOCKS_CIPHER",
+	envKey, _ := s.getEnvWithRetro("SHADOWSOCKS_CIPHER",
 		[]string{"SHADOWSOCKS_METHOD"})
-	return strings.ToLower(cipher)
+	return env.String(envKey)
 }
diff --git a/internal/configuration/sources/env/system.go b/internal/configuration/sources/env/system.go
index b82006c2..f3a5617d 100644
--- a/internal/configuration/sources/env/system.go
+++ b/internal/configuration/sources/env/system.go
@@ -26,7 +26,7 @@ func (s *Source) readSystem() (system settings.System, err error) {
 		return system, err
 	}
 
-	system.Timezone = env.Get("TZ")
+	system.Timezone = env.String("TZ")
 
 	return system, nil
 }
@@ -35,10 +35,11 @@ var ErrSystemIDNotValid = errors.New("system ID is not valid")
 
 func (s *Source) readID(key, retroKey string) (
 	id *uint32, err error) {
-	idEnvKey, idString := s.getEnvWithRetro(key, []string{retroKey})
-	if idString == "" {
+	idEnvKey, idStringPtr := s.getEnvWithRetro(key, []string{retroKey})
+	if idStringPtr == nil {
 		return nil, nil //nolint:nilnil
 	}
+	idString := *idStringPtr
 
 	const base = 10
 	const bitSize = 64
diff --git a/internal/configuration/sources/env/unbound.go b/internal/configuration/sources/env/unbound.go
index ebdc3e79..1df6b9f6 100644
--- a/internal/configuration/sources/env/unbound.go
+++ b/internal/configuration/sources/env/unbound.go
@@ -1,8 +1,6 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
@@ -12,27 +10,27 @@ func readUnbound() (unbound settings.Unbound, err error) {
 
 	unbound.Caching, err = env.BoolPtr("DOT_CACHING")
 	if err != nil {
-		return unbound, fmt.Errorf("environment variable DOT_CACHING: %w", err)
+		return unbound, err
 	}
 
 	unbound.IPv6, err = env.BoolPtr("DOT_IPV6")
 	if err != nil {
-		return unbound, fmt.Errorf("environment variable DOT_IPV6: %w", err)
+		return unbound, err
 	}
 
 	unbound.VerbosityLevel, err = env.Uint8Ptr("DOT_VERBOSITY")
 	if err != nil {
-		return unbound, fmt.Errorf("environment variable DOT_VERBOSITY: %w", err)
+		return unbound, err
 	}
 
 	unbound.VerbosityDetailsLevel, err = env.Uint8Ptr("DOT_VERBOSITY_DETAILS")
 	if err != nil {
-		return unbound, fmt.Errorf("environment variable DOT_VERBOSITY_DETAILS: %w", err)
+		return unbound, err
 	}
 
 	unbound.ValidationLogLevel, err = env.Uint8Ptr("DOT_VALIDATION_LOGLEVEL")
 	if err != nil {
-		return unbound, fmt.Errorf("environment variable DOT_VALIDATION_LOGLEVEL: %w", err)
+		return unbound, err
 	}
 
 	return unbound, nil
diff --git a/internal/configuration/sources/env/updater.go b/internal/configuration/sources/env/updater.go
index 7626012d..b182d6be 100644
--- a/internal/configuration/sources/env/updater.go
+++ b/internal/configuration/sources/env/updater.go
@@ -1,15 +1,12 @@
 package env
 
 import (
-	"fmt"
-	"time"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
 
 func readUpdater() (updater settings.Updater, err error) {
-	updater.Period, err = readUpdaterPeriod()
+	updater.Period, err = env.DurationPtr("UPDATER_PERIOD")
 	if err != nil {
 		return updater, err
 	}
@@ -21,7 +18,7 @@ func readUpdater() (updater settings.Updater, err error) {
 
 	updater.MinRatio, err = env.Float64("UPDATER_MIN_RATIO")
 	if err != nil {
-		return updater, fmt.Errorf("environment variable UPDATER_MIN_RATIO: %w", err)
+		return updater, err
 	}
 
 	updater.Providers = env.CSV("UPDATER_VPN_SERVICE_PROVIDERS")
@@ -29,19 +26,6 @@ func readUpdater() (updater settings.Updater, err error) {
 	return updater, nil
 }
 
-func readUpdaterPeriod() (period *time.Duration, err error) {
-	s := env.Get("UPDATER_PERIOD")
-	if s == "" {
-		return nil, nil //nolint:nilnil
-	}
-	period = new(time.Duration)
-	*period, err = time.ParseDuration(s)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable UPDATER_PERIOD: %w", err)
-	}
-	return period, nil
-}
-
 func readUpdaterDNSAddress() (address string, err error) {
 	// TODO this is currently using Cloudflare in
 	// plaintext to not be blocked by DNS over TLS by default.
diff --git a/internal/configuration/sources/env/version.go b/internal/configuration/sources/env/version.go
index 2574fe53..773265b5 100644
--- a/internal/configuration/sources/env/version.go
+++ b/internal/configuration/sources/env/version.go
@@ -1,32 +1,15 @@
 package env
 
 import (
-	"fmt"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
-	"github.com/qdm12/govalid/binary"
 )
 
 func readVersion() (version settings.Version, err error) {
-	version.Enabled, err = readVersionEnabled()
+	version.Enabled, err = env.BoolPtr("VERSION_INFORMATION")
 	if err != nil {
 		return version, err
 	}
 
 	return version, nil
 }
-
-func readVersionEnabled() (enabled *bool, err error) {
-	s := env.Get("VERSION_INFORMATION")
-	if s == "" {
-		return nil, nil //nolint:nilnil
-	}
-
-	enabled, err = binary.Validate(s)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable VERSION_INFORMATION: %w", err)
-	}
-
-	return enabled, nil
-}
diff --git a/internal/configuration/sources/env/vpn.go b/internal/configuration/sources/env/vpn.go
index 7900757e..2a4e1f97 100644
--- a/internal/configuration/sources/env/vpn.go
+++ b/internal/configuration/sources/env/vpn.go
@@ -2,14 +2,13 @@ package env
 
 import (
 	"fmt"
-	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
 )
 
 func (s *Source) readVPN() (vpn settings.VPN, err error) {
-	vpn.Type = strings.ToLower(env.Get("VPN_TYPE"))
+	vpn.Type = env.String("VPN_TYPE")
 
 	vpn.Provider, err = s.readProvider(vpn.Type)
 	if err != nil {
diff --git a/internal/configuration/sources/env/wireguard.go b/internal/configuration/sources/env/wireguard.go
index 1f8b6fb7..e77f9680 100644
--- a/internal/configuration/sources/env/wireguard.go
+++ b/internal/configuration/sources/env/wireguard.go
@@ -13,18 +13,19 @@ func (s *Source) readWireguard() (wireguard settings.Wireguard, err error) {
 	defer func() {
 		err = unsetEnvKeys([]string{"WIREGUARD_PRIVATE_KEY", "WIREGUARD_PRESHARED_KEY"}, err)
 	}()
-	wireguard.PrivateKey = env.StringPtr("WIREGUARD_PRIVATE_KEY", env.ForceLowercase(false))
-	wireguard.PreSharedKey = env.StringPtr("WIREGUARD_PRESHARED_KEY", env.ForceLowercase(false))
-	_, wireguard.Interface = s.getEnvWithRetro("VPN_INTERFACE",
+	wireguard.PrivateKey = env.Get("WIREGUARD_PRIVATE_KEY", env.ForceLowercase(false))
+	wireguard.PreSharedKey = env.Get("WIREGUARD_PRESHARED_KEY", env.ForceLowercase(false))
+	envKey, _ := s.getEnvWithRetro("VPN_INTERFACE",
 		[]string{"WIREGUARD_INTERFACE"}, env.ForceLowercase(false))
-	wireguard.Implementation = env.Get("WIREGUARD_IMPLEMENTATION")
+	wireguard.Interface = env.String(envKey)
+	wireguard.Implementation = env.String("WIREGUARD_IMPLEMENTATION")
 	wireguard.Addresses, err = s.readWireguardAddresses()
 	if err != nil {
 		return wireguard, err // already wrapped
 	}
 	mtuPtr, err := env.Uint16Ptr("WIREGUARD_MTU")
 	if err != nil {
-		return wireguard, fmt.Errorf("environment variable WIREGUARD_MTU: %w", err)
+		return wireguard, err
 	} else if mtuPtr != nil {
 		wireguard.MTU = *mtuPtr
 	}
@@ -32,13 +33,13 @@ func (s *Source) readWireguard() (wireguard settings.Wireguard, err error) {
 }
 
 func (s *Source) readWireguardAddresses() (addresses []netip.Prefix, err error) {
-	key, addressesCSV := s.getEnvWithRetro("WIREGUARD_ADDRESSES",
+	key, value := s.getEnvWithRetro("WIREGUARD_ADDRESSES",
 		[]string{"WIREGUARD_ADDRESS"})
-	if addressesCSV == "" {
+	if value == nil {
 		return nil, nil
 	}
 
-	addressStrings := strings.Split(addressesCSV, ",")
+	addressStrings := strings.Split(*value, ",")
 	addresses = make([]netip.Prefix, len(addressStrings))
 	for i, addressString := range addressStrings {
 		addressString = strings.TrimSpace(addressString)
diff --git a/internal/configuration/sources/env/wireguardselection.go b/internal/configuration/sources/env/wireguardselection.go
index a7fd1520..3053fa11 100644
--- a/internal/configuration/sources/env/wireguardselection.go
+++ b/internal/configuration/sources/env/wireguardselection.go
@@ -6,7 +6,6 @@ import (
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gosettings/sources/env"
-	"github.com/qdm12/govalid/port"
 )
 
 func (s *Source) readWireguardSelection() (
@@ -21,18 +20,18 @@ func (s *Source) readWireguardSelection() (
 		return selection, err
 	}
 
-	selection.PublicKey = env.Get("WIREGUARD_PUBLIC_KEY", env.ForceLowercase(false))
+	selection.PublicKey = env.String("WIREGUARD_PUBLIC_KEY", env.ForceLowercase(false))
 
 	return selection, nil
 }
 
 func (s *Source) readWireguardEndpointIP() (endpointIP netip.Addr, err error) {
 	key, value := s.getEnvWithRetro("VPN_ENDPOINT_IP", []string{"WIREGUARD_ENDPOINT_IP"})
-	if value == "" {
+	if value == nil {
 		return endpointIP, nil
 	}
 
-	endpointIP, err = netip.ParseAddr(value)
+	endpointIP, err = netip.ParseAddr(*value)
 	if err != nil {
 		return endpointIP, fmt.Errorf("environment variable %s: %w", key, err)
 	}
@@ -41,16 +40,6 @@ func (s *Source) readWireguardEndpointIP() (endpointIP netip.Addr, err error) {
 }
 
 func (s *Source) readWireguardCustomPort() (customPort *uint16, err error) {
-	key, value := s.getEnvWithRetro("VPN_ENDPOINT_PORT", []string{"WIREGUARD_ENDPOINT_PORT"})
-	if value == "" {
-		return nil, nil //nolint:nilnil
-	}
-
-	customPort = new(uint16)
-	*customPort, err = port.Validate(value)
-	if err != nil {
-		return nil, fmt.Errorf("environment variable %s: %w", key, err)
-	}
-
-	return customPort, nil
+	envKey, _ := s.getEnvWithRetro("VPN_ENDPOINT_PORT", []string{"WIREGUARD_ENDPOINT_PORT"})
+	return env.Uint16Ptr(envKey)
 }
diff --git a/internal/configuration/sources/secrets/helpers.go b/internal/configuration/sources/secrets/helpers.go
index e5e23f9d..5c7d6799 100644
--- a/internal/configuration/sources/secrets/helpers.go
+++ b/internal/configuration/sources/secrets/helpers.go
@@ -10,7 +10,7 @@ import (
 
 func readSecretFileAsStringPtr(secretPathEnvKey, defaultSecretPath string) (
 	stringPtr *string, err error) {
-	path := env.Get(secretPathEnvKey)
+	path := env.String(secretPathEnvKey)
 	if path == "" {
 		path = defaultSecretPath
 	}