diff --git a/cmd/zrok/accessPrivate.go b/cmd/zrok/accessPrivate.go
index 9f485c5a..6927b57f 100644
--- a/cmd/zrok/accessPrivate.go
+++ b/cmd/zrok/accessPrivate.go
@@ -8,7 +8,7 @@ import (
 	"github.com/openziti/zrok/endpoints/proxy"
 	"github.com/openziti/zrok/endpoints/tcpTunnel"
 	"github.com/openziti/zrok/endpoints/udpTunnel"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
@@ -48,16 +48,16 @@ func newAccessPrivateCommand() *accessPrivateCommand {
 func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 	shrToken := args[0]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		tui.Error("error loading environment", err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
@@ -65,11 +65,11 @@ func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := share.NewAccessParams()
 	req.Body = &rest_model_zrok.AccessRequest{
 		ShrToken: shrToken,
-		EnvZID:   zrd.Env.ZId,
+		EnvZID:   env.Environment().ZitiIdentity,
 	}
 	accessResp, err := zrok.Share.Access(req, auth)
 	if err != nil {
@@ -168,7 +168,7 @@ func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 	go func() {
 		<-c
-		cmd.destroy(accessResp.Payload.FrontendToken, zrd.Env.ZId, shrToken, zrok, auth)
+		cmd.destroy(accessResp.Payload.FrontendToken, env.Environment().ZitiIdentity, shrToken, zrok, auth)
 		os.Exit(0)
 	}()
 
@@ -203,7 +203,7 @@ func (cmd *accessPrivateCommand) run(_ *cobra.Command, args []string) {
 		}
 
 		close(requests)
-		cmd.destroy(accessResp.Payload.FrontendToken, zrd.Env.ZId, shrToken, zrok, auth)
+		cmd.destroy(accessResp.Payload.FrontendToken, env.Environment().ZitiIdentity, shrToken, zrok, auth)
 	}
 }
 
diff --git a/cmd/zrok/adminCreateFrontend.go b/cmd/zrok/adminCreateFrontend.go
index 2b88bc10..430ecc59 100644
--- a/cmd/zrok/adminCreateFrontend.go
+++ b/cmd/zrok/adminCreateFrontend.go
@@ -1,14 +1,13 @@
 package main
 
 import (
-	"github.com/openziti/zrok/environment/env_v0_3"
-	"os"
-
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/tui"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"os"
 )
 
 func init() {
@@ -35,12 +34,12 @@ func (cmd *adminCreateFrontendCommand) run(_ *cobra.Command, args []string) {
 	publicName := args[1]
 	urlTemplate := args[2]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		panic(err)
 	}
diff --git a/cmd/zrok/adminCreateIdentity.go b/cmd/zrok/adminCreateIdentity.go
index e6da348f..74723ffb 100644
--- a/cmd/zrok/adminCreateIdentity.go
+++ b/cmd/zrok/adminCreateIdentity.go
@@ -2,7 +2,7 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -32,7 +32,11 @@ func newAdminCreateIdentity() *adminCreateIdentity {
 func (cmd *adminCreateIdentity) run(_ *cobra.Command, args []string) {
 	name := args[0]
 
-	zif, err := env_v0_3.ZitiIdentityFile(name)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+	zif, err := env.ZitiIdentityFile(name)
 	if err != nil {
 		panic(err)
 	}
@@ -41,12 +45,7 @@ func (cmd *adminCreateIdentity) run(_ *cobra.Command, args []string) {
 		os.Exit(1)
 	}
 
-	zrd, err := env_v0_3.Load()
-	if err != nil {
-		panic(err)
-	}
-
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		panic(err)
 	}
@@ -59,7 +58,7 @@ func (cmd *adminCreateIdentity) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if err := env_v0_3.SaveZitiIdentity(name, resp.Payload.Cfg); err != nil {
+	if err := env.SaveZitiIdentity(name, resp.Payload.Cfg); err != nil {
 		panic(err)
 	}
 
diff --git a/cmd/zrok/adminDeleteFrontend.go b/cmd/zrok/adminDeleteFrontend.go
index b715d44f..9d806df7 100644
--- a/cmd/zrok/adminDeleteFrontend.go
+++ b/cmd/zrok/adminDeleteFrontend.go
@@ -1,7 +1,7 @@
 package main
 
 import (
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/sirupsen/logrus"
@@ -30,12 +30,12 @@ func newAdminDeleteFrontendCommand() *adminDeleteFrontendCommand {
 func (cmd *adminDeleteFrontendCommand) run(_ *cobra.Command, args []string) {
 	feToken := args[0]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		panic(err)
 	}
diff --git a/cmd/zrok/adminGenerate.go b/cmd/zrok/adminGenerate.go
index 5740ca26..9576646d 100644
--- a/cmd/zrok/adminGenerate.go
+++ b/cmd/zrok/adminGenerate.go
@@ -3,7 +3,7 @@ package main
 import (
 	"fmt"
 	"github.com/jaevor/go-nanoid"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/sirupsen/logrus"
@@ -43,12 +43,12 @@ func (cmd *adminGenerateCommand) run(_ *cobra.Command, args []string) {
 		}
 	}
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		logrus.Error("error loading environment", err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			logrus.Error("error creating zrok api client", err)
diff --git a/cmd/zrok/adminListFrontends.go b/cmd/zrok/adminListFrontends.go
index 818acca3..ee7ece19 100644
--- a/cmd/zrok/adminListFrontends.go
+++ b/cmd/zrok/adminListFrontends.go
@@ -3,7 +3,7 @@ package main
 import (
 	"fmt"
 	"github.com/jedib0t/go-pretty/v6/table"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/spf13/cobra"
 	"os"
@@ -31,12 +31,12 @@ func newAdminListFrontendsCommand() *adminListFrontendsCommand {
 }
 
 func (cmd *adminListFrontendsCommand) run(_ *cobra.Command, _ []string) {
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		panic(err)
 	}
diff --git a/cmd/zrok/adminUpdateFrontend.go b/cmd/zrok/adminUpdateFrontend.go
index f1d434a3..2c77513d 100644
--- a/cmd/zrok/adminUpdateFrontend.go
+++ b/cmd/zrok/adminUpdateFrontend.go
@@ -1,7 +1,7 @@
 package main
 
 import (
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/admin"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/sirupsen/logrus"
@@ -38,12 +38,12 @@ func (cmd *adminUpdateFrontendCommand) run(_ *cobra.Command, args []string) {
 		panic("must specify at least one of public name or url template")
 	}
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		panic(err)
 	}
diff --git a/cmd/zrok/configGet.go b/cmd/zrok/configGet.go
index ef8e2208..45480da4 100644
--- a/cmd/zrok/configGet.go
+++ b/cmd/zrok/configGet.go
@@ -2,7 +2,7 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/spf13/cobra"
 )
 
@@ -28,15 +28,15 @@ func newConfigGetCommand() *configGetCommand {
 func (cmd *configGetCommand) run(_ *cobra.Command, args []string) {
 	configName := args[0]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
 	switch configName {
 	case "apiEndpoint":
-		if zrd.Cfg != nil && zrd.Cfg.ApiEndpoint != "" {
-			fmt.Printf("apiEndpoint = %v\n", zrd.Cfg.ApiEndpoint)
+		if env.Config() != nil && env.Config().ApiEndpoint != "" {
+			fmt.Printf("apiEndpoint = %v\n", env.Config().ApiEndpoint)
 		} else {
 			fmt.Println("apiEndpoint = <unset>")
 		}
diff --git a/cmd/zrok/configSet.go b/cmd/zrok/configSet.go
index eb84f697..553102e9 100644
--- a/cmd/zrok/configSet.go
+++ b/cmd/zrok/configSet.go
@@ -2,12 +2,12 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
-	"net/url"
-	"os"
-
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/tui"
 	"github.com/spf13/cobra"
+	"net/url"
+	"os"
 )
 
 func init() {
@@ -33,17 +33,13 @@ func (cmd *configSetCommand) run(_ *cobra.Command, args []string) {
 	configName := args[0]
 	value := args[1]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	modified := false
 	switch configName {
 	case "apiEndpoint":
-		if zrd.Cfg == nil {
-			zrd.Cfg = &env_v0_3.Config{}
-		}
 		ok, err := isFullyValidUrl(value)
 		if err != nil {
 			tui.Error("unable to validate api endpoint", err)
@@ -51,25 +47,26 @@ func (cmd *configSetCommand) run(_ *cobra.Command, args []string) {
 		if !ok {
 			tui.Error("invalid apiEndpoint; please make sure URL starts with http:// or https://", nil)
 		}
-		zrd.Cfg.ApiEndpoint = value
-		modified = true
+		if env.Config() == nil {
+			if err := env.SetConfig(&env_core.Config{ApiEndpoint: value}); err != nil {
+				tui.Error("unable to save config", err)
+			}
+		} else {
+			cfg := env.Config()
+			cfg.ApiEndpoint = value
+			if err := env.SetConfig(cfg); err != nil {
+				tui.Error("unable to save config", err)
+			}
+		}
+		fmt.Println("zrok configuration updated")
+		if env.IsEnabled() {
+			fmt.Printf("\n[%v]: because you have a %v-d environment, you won't see your config change until you run %v first!\n\n", tui.WarningLabel, tui.Code.Render("zrok enable"), tui.Code.Render("zrok disable"))
+		}
 
 	default:
 		fmt.Printf("unknown config name '%v'\n", configName)
 		os.Exit(1)
 	}
-
-	if modified {
-		if err := zrd.Save(); err != nil {
-			panic(err)
-		}
-		fmt.Println("zrok configuration updated")
-		if zrd.Env != nil && configName == "apiEndpoint" {
-			fmt.Printf("\n[%v]: because you have a %v-d environment, you won't see your config change until you run %v first!\n\n", tui.WarningLabel, tui.Code.Render("zrok enable"), tui.Code.Render("zrok disable"))
-		}
-	} else {
-		fmt.Println("zrok configuration not changed")
-	}
 }
 
 func isFullyValidUrl(rawUrl string) (bool, error) {
diff --git a/cmd/zrok/configUnset.go b/cmd/zrok/configUnset.go
index 72eeda46..a7cb6930 100644
--- a/cmd/zrok/configUnset.go
+++ b/cmd/zrok/configUnset.go
@@ -2,7 +2,8 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/tui"
 	"github.com/spf13/cobra"
 	"os"
@@ -30,33 +31,23 @@ func newConfigUnsetCommand() *configUnsetCommand {
 func (cmd *configUnsetCommand) run(_ *cobra.Command, args []string) {
 	configName := args[0]
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	modified := false
 	switch configName {
 	case "apiEndpoint":
-		if zrd.Cfg != nil && zrd.Cfg.ApiEndpoint != "" {
-			zrd.Cfg.ApiEndpoint = ""
-			modified = true
+		if err := env.SetConfig(&env_core.Config{}); err != nil {
+			tui.Error("unable to save config", err)
+		}
+		fmt.Println("zrok configuration updated")
+		if env.IsEnabled() {
+			fmt.Printf("\n[%v]: because you have a %v-d environment, you won't see your config change until you run %v first!\n\n", tui.WarningLabel, tui.Code.Render("zrok enable"), tui.Code.Render("zrok disable"))
 		}
 
 	default:
 		fmt.Printf("unknown config name '%v'\n", configName)
 		os.Exit(1)
 	}
-
-	if modified {
-		if err := zrd.Save(); err != nil {
-			panic(err)
-		}
-		fmt.Println("zrok configuration updated")
-		if zrd.Env != nil && configName == "apiEndpoint" {
-			fmt.Printf("\n[%v]: because you have a %v-d environment, you won't see your config change until you run %v first!\n\n", tui.WarningLabel, tui.Code.Render("zrok enable"), tui.Code.Render("zrok disable"))
-		}
-	} else {
-		fmt.Println("zrok configuration not changed")
-	}
 }
diff --git a/cmd/zrok/console.go b/cmd/zrok/console.go
index 34024ff6..72de2ce4 100644
--- a/cmd/zrok/console.go
+++ b/cmd/zrok/console.go
@@ -2,7 +2,7 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/tui"
 	"github.com/spf13/cobra"
 )
@@ -27,7 +27,7 @@ func newConsoleCommand() *consoleCommand {
 }
 
 func (cmd *consoleCommand) run(_ *cobra.Command, _ []string) {
-	env, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		tui.Error("unable to load environment", err)
 	}
diff --git a/cmd/zrok/disable.go b/cmd/zrok/disable.go
index 20764f3c..79c03e61 100644
--- a/cmd/zrok/disable.go
+++ b/cmd/zrok/disable.go
@@ -3,7 +3,7 @@ package main
 import (
 	"fmt"
 	httpTransport "github.com/go-openapi/runtime/client"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	restEnvironment "github.com/openziti/zrok/rest_client_zrok/environment"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/tui"
@@ -31,7 +31,7 @@ func newDisableCommand() *disableCommand {
 }
 
 func (cmd *disableCommand) run(_ *cobra.Command, _ []string) {
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load environment", err)
@@ -39,33 +39,33 @@ func (cmd *disableCommand) run(_ *cobra.Command, _ []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("no environment found; nothing to disable!", nil)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("could not create zrok client", err)
 		}
 		panic(err)
 	}
-	auth := httpTransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httpTransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := restEnvironment.NewDisableParams()
 	req.Body = &rest_model_zrok.DisableRequest{
-		Identity: zrd.Env.ZId,
+		Identity: env.Environment().ZitiIdentity,
 	}
 	_, err = zrok.Environment.Disable(req, auth)
 	if err != nil {
 		logrus.Warnf("share cleanup failed (%v); will clean up local environment", err)
 	}
-	if err := env_v0_3.DeleteEnvironment(); err != nil {
+	if err := env.DeleteEnvironment(); err != nil {
 		if !panicInstead {
 			tui.Error("error removing zrok environment", err)
 		}
 		panic(err)
 	}
-	if err := env_v0_3.DeleteZitiIdentity("backend"); err != nil {
+	if err := env.DeleteZitiIdentity("backend"); err != nil {
 		if !panicInstead {
 			tui.Error("error removing zrok backend identity", err)
 		}
diff --git a/cmd/zrok/enable.go b/cmd/zrok/enable.go
index b9e84d36..d0e5d2d3 100644
--- a/cmd/zrok/enable.go
+++ b/cmd/zrok/enable.go
@@ -2,20 +2,20 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
-	"github.com/sirupsen/logrus"
-	"os"
-	user2 "os/user"
-	"time"
-
 	"github.com/charmbracelet/bubbles/spinner"
 	tea "github.com/charmbracelet/bubbletea"
 	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/environment/env_core"
 	restEnvironment "github.com/openziti/zrok/rest_client_zrok/environment"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/tui"
 	"github.com/shirou/gopsutil/v3/host"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"os"
+	user2 "os/user"
+	"time"
 )
 
 func init() {
@@ -42,13 +42,13 @@ func newEnableCommand() *enableCommand {
 }
 
 func (cmd *enableCommand) run(_ *cobra.Command, args []string) {
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 	token := args[0]
 
-	if zrd.Env != nil {
+	if env.IsEnabled() {
 		tui.Error(fmt.Sprintf("you already have an enabled environment, %v first before you %v", tui.Code.Render("zrok disable"), tui.Code.Render("zrok enable")), nil)
 	}
 
@@ -64,9 +64,9 @@ func (cmd *enableCommand) run(_ *cobra.Command, args []string) {
 	if cmd.description == "<user>@<hostname>" {
 		cmd.description = fmt.Sprintf("%v@%v", user.Username, hostName)
 	}
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
-		cmd.endpointError(zrd.ApiEndpoint())
+		cmd.endpointError(env.ApiEndpoint())
 		tui.Error("error creating service client", err)
 	}
 	auth := httptransport.APIKeyAuth("X-TOKEN", "header", token)
@@ -110,15 +110,14 @@ func (cmd *enableCommand) run(_ *cobra.Command, args []string) {
 		case <-done:
 		case <-time.After(1 * time.Second):
 		}
-		cmd.endpointError(zrd.ApiEndpoint())
+		cmd.endpointError(env.ApiEndpoint())
 		os.Exit(1)
 	}
 	if err != nil {
 		prg.Send("writing the environment details...")
 	}
-	apiEndpoint, _ := zrd.ApiEndpoint()
-	zrd.Env = &env_v0_3.Environment{Token: token, ZId: resp.Payload.Identity, ApiEndpoint: apiEndpoint}
-	if err := zrd.Save(); err != nil {
+	apiEndpoint, _ := env.ApiEndpoint()
+	if err := env.SetEnvironment(&env_core.Environment{Token: token, ZitiIdentity: resp.Payload.Identity, ApiEndpoint: apiEndpoint}); err != nil {
 		if !cmd.headless && prg != nil {
 			prg.Send(fmt.Sprintf("there was an error saving the new environment: %v", err))
 			prg.Quit()
@@ -131,7 +130,7 @@ func (cmd *enableCommand) run(_ *cobra.Command, args []string) {
 		}
 		os.Exit(1)
 	}
-	if err := env_v0_3.SaveZitiIdentity("backend", resp.Payload.Cfg); err != nil {
+	if err := env.SaveZitiIdentity("backend", resp.Payload.Cfg); err != nil {
 		if !cmd.headless && prg != nil {
 			prg.Send(fmt.Sprintf("there was an error writing the environment: %v", err))
 			prg.Quit()
diff --git a/cmd/zrok/invite.go b/cmd/zrok/invite.go
index dd268c73..0695474f 100644
--- a/cmd/zrok/invite.go
+++ b/cmd/zrok/invite.go
@@ -2,19 +2,18 @@ package main
 
 import (
 	"fmt"
-	"github.com/openziti/zrok/environment/env_v0_3"
-	"os"
-	"strings"
-
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/account"
 	"github.com/openziti/zrok/rest_client_zrok/metadata"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/tui"
 	"github.com/openziti/zrok/util"
 	"github.com/spf13/cobra"
+	"os"
+	"strings"
 )
 
 func init() {
@@ -42,15 +41,15 @@ func newInviteCommand() *inviteCommand {
 }
 
 func (cmd *inviteCommand) run(_ *cobra.Command, _ []string) {
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		tui.Error("error loading environment", err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
-			cmd.endpointError(zrd.ApiEndpoint())
+			cmd.endpointError(env.ApiEndpoint())
 			tui.Error("error creating zrok api client", err)
 		}
 		panic(err)
@@ -63,7 +62,7 @@ func (cmd *inviteCommand) run(_ *cobra.Command, _ []string) {
 
 	if md != nil {
 		if !md.GetPayload().InvitesOpen {
-			apiEndpoint, _ := zrd.ApiEndpoint()
+			apiEndpoint, _ := env.ApiEndpoint()
 			tui.Error(fmt.Sprintf("'%v' is not currently accepting new users", apiEndpoint), nil)
 		}
 		cmd.tui.invitesOpen = md.GetPayload().InvitesOpen
@@ -86,7 +85,7 @@ func (cmd *inviteCommand) run(_ *cobra.Command, _ []string) {
 		}
 		_, err = zrok.Account.Invite(req)
 		if err != nil {
-			cmd.endpointError(zrd.ApiEndpoint())
+			cmd.endpointError(env.ApiEndpoint())
 			tui.Error("error creating invitation", err)
 		}
 
diff --git a/cmd/zrok/release.go b/cmd/zrok/release.go
index 12f891b0..f68ec68a 100644
--- a/cmd/zrok/release.go
+++ b/cmd/zrok/release.go
@@ -2,7 +2,7 @@ package main
 
 import (
 	httptransport "github.com/go-openapi/runtime/client"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/tui"
@@ -31,7 +31,7 @@ func newReleaseCommand() *releaseCommand {
 
 func (cmd *releaseCommand) run(_ *cobra.Command, args []string) {
 	shrToken := args[0]
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load environment", err)
@@ -39,11 +39,11 @@ func (cmd *releaseCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
@@ -51,10 +51,10 @@ func (cmd *releaseCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := share.NewUnshareParams()
 	req.Body = &rest_model_zrok.UnshareRequest{
-		EnvZID:   zrd.Env.ZId,
+		EnvZID:   env.Environment().ZitiIdentity,
 		ShrToken: shrToken,
 		Reserved: true,
 	}
diff --git a/cmd/zrok/reserve.go b/cmd/zrok/reserve.go
index c6d1b179..68c4c123 100644
--- a/cmd/zrok/reserve.go
+++ b/cmd/zrok/reserve.go
@@ -2,7 +2,7 @@ package main
 
 import (
 	httptransport "github.com/go-openapi/runtime/client"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
@@ -60,7 +60,7 @@ func (cmd *reserveCommand) run(_ *cobra.Command, args []string) {
 		target = args[1]
 	}
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("error loading environment", err)
@@ -68,21 +68,21 @@ func (cmd *reserveCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
 		}
 		panic(err)
 	}
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
-		EnvZID:               zrd.Env.ZId,
+		EnvZID:               env.Environment().ZitiIdentity,
 		ShareMode:            shareMode,
 		BackendMode:          cmd.backendMode,
 		BackendProxyEndpoint: target,
diff --git a/cmd/zrok/sharePrivate.go b/cmd/zrok/sharePrivate.go
index 4b54bfbc..68daa5cd 100644
--- a/cmd/zrok/sharePrivate.go
+++ b/cmd/zrok/sharePrivate.go
@@ -9,7 +9,7 @@ import (
 	"github.com/openziti/zrok/endpoints/proxy"
 	"github.com/openziti/zrok/endpoints/tcpTunnel"
 	"github.com/openziti/zrok/endpoints/udpTunnel"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
@@ -78,7 +78,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 		tui.Error(fmt.Sprintf("invalid backend mode '%v'; expected {proxy, web, tcpTunnel}", cmd.backendMode), nil)
 	}
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load environment", err)
@@ -86,11 +86,11 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zif, err := env_v0_3.ZitiIdentityFile("backend")
+	zif, err := env.ZitiIdentityFile("backend")
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load ziti identity configuration", err)
@@ -98,7 +98,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
@@ -106,10 +106,10 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
-		EnvZID:               zrd.Env.ZId,
+		EnvZID:               env.Environment().ZitiIdentity,
 		ShareMode:            "private",
 		BackendMode:          cmd.backendMode,
 		BackendProxyEndpoint: target,
@@ -139,7 +139,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 	go func() {
 		<-c
-		cmd.destroy(zrd.Env.ZId, resp.Payload.ShrToken, zrok, auth)
+		cmd.destroy(env.Environment().ZitiIdentity, resp.Payload.ShrToken, zrok, auth)
 		os.Exit(0)
 	}()
 
@@ -250,7 +250,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 		}
 
 		close(requestsChan)
-		cmd.destroy(zrd.Env.ZId, resp.Payload.ShrToken, zrok, auth)
+		cmd.destroy(env.Environment().ZitiIdentity, resp.Payload.ShrToken, zrok, auth)
 	}
 }
 
diff --git a/cmd/zrok/sharePublic.go b/cmd/zrok/sharePublic.go
index e8a7f95b..2e40fe0f 100644
--- a/cmd/zrok/sharePublic.go
+++ b/cmd/zrok/sharePublic.go
@@ -7,7 +7,7 @@ import (
 	httptransport "github.com/go-openapi/runtime/client"
 	"github.com/openziti/zrok/endpoints"
 	"github.com/openziti/zrok/endpoints/proxy"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
@@ -72,7 +72,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		tui.Error(fmt.Sprintf("invalid backend mode '%v'; expected {proxy, web}", cmd.backendMode), nil)
 	}
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load environment", err)
@@ -80,11 +80,11 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zif, err := env_v0_3.ZitiIdentityFile("backend")
+	zif, err := env.ZitiIdentityFile("backend")
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load ziti identity configuration", err)
@@ -92,7 +92,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
@@ -100,10 +100,10 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
-		EnvZID:               zrd.Env.ZId,
+		EnvZID:               env.Environment().ZitiIdentity,
 		ShareMode:            "public",
 		FrontendSelection:    cmd.frontendSelection,
 		BackendMode:          cmd.backendMode,
@@ -134,7 +134,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 	go func() {
 		<-c
-		cmd.destroy(zrd.Env.ZId, resp.Payload.ShrToken, zrok, auth)
+		cmd.destroy(env.Environment().ZitiIdentity, resp.Payload.ShrToken, zrok, auth)
 		os.Exit(0)
 	}()
 
@@ -204,7 +204,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		}
 
 		close(requestsChan)
-		cmd.destroy(zrd.Env.ZId, resp.Payload.ShrToken, zrok, auth)
+		cmd.destroy(env.Environment().ZitiIdentity, resp.Payload.ShrToken, zrok, auth)
 	}
 }
 
diff --git a/cmd/zrok/shareReserved.go b/cmd/zrok/shareReserved.go
index d485487f..59f8c419 100644
--- a/cmd/zrok/shareReserved.go
+++ b/cmd/zrok/shareReserved.go
@@ -6,7 +6,7 @@ import (
 	httptransport "github.com/go-openapi/runtime/client"
 	"github.com/openziti/zrok/endpoints"
 	"github.com/openziti/zrok/endpoints/proxy"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/rest_client_zrok/metadata"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
@@ -44,7 +44,7 @@ func (cmd *shareReservedCommand) run(_ *cobra.Command, args []string) {
 	shrToken := args[0]
 	var target string
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("error loading environment", err)
@@ -52,18 +52,18 @@ func (cmd *shareReservedCommand) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
 
-	zrok, err := zrd.Client()
+	zrok, err := env.Client()
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to create zrok client", err)
 		}
 		panic(err)
 	}
-	auth := httptransport.APIKeyAuth("X-TOKEN", "header", zrd.Env.Token)
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", env.Environment().Token)
 	req := metadata.NewGetShareDetailParams()
 	req.ShrToken = shrToken
 	resp, err := zrok.Metadata.GetShareDetail(req, auth)
@@ -78,7 +78,7 @@ func (cmd *shareReservedCommand) run(_ *cobra.Command, args []string) {
 		target = resp.Payload.BackendProxyEndpoint
 	}
 
-	zif, err := env_v0_3.ZitiIdentityFile("backend")
+	zif, err := env.ZitiIdentityFile("backend")
 	if err != nil {
 		if !panicInstead {
 			tui.Error("unable to load ziti identity configuration", err)
diff --git a/cmd/zrok/status.go b/cmd/zrok/status.go
index 60c62d97..d9d2af99 100644
--- a/cmd/zrok/status.go
+++ b/cmd/zrok/status.go
@@ -3,7 +3,7 @@ package main
 import (
 	"fmt"
 	"github.com/jedib0t/go-pretty/v6/table"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/tui"
 	"github.com/spf13/cobra"
 	"os"
@@ -34,7 +34,7 @@ func newStatusCommand() *statusCommand {
 func (cmd *statusCommand) run(_ *cobra.Command, _ []string) {
 	_, _ = fmt.Fprintf(os.Stderr, "\n")
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		tui.Error("error loading environment", err)
 	}
@@ -44,12 +44,12 @@ func (cmd *statusCommand) run(_ *cobra.Command, _ []string) {
 	t.SetOutputMirror(os.Stdout)
 	t.SetStyle(table.StyleColoredDark)
 	t.AppendHeader(table.Row{"Config", "Value", "Source"})
-	apiEndpoint, from := zrd.ApiEndpoint()
+	apiEndpoint, from := env.ApiEndpoint()
 	t.AppendRow(table.Row{"apiEndpoint", apiEndpoint, from})
 	t.Render()
 	_, _ = fmt.Fprintf(os.Stderr, "\n")
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Warning("Unable to load your local environment!\n")
 		_, _ = fmt.Fprintf(os.Stderr, "To create a local environment use the %v command.\n", tui.Code.Render("zrok enable"))
 	} else {
@@ -60,17 +60,17 @@ func (cmd *statusCommand) run(_ *cobra.Command, _ []string) {
 		t.SetStyle(table.StyleColoredDark)
 		t.AppendHeader(table.Row{"Property", "Value"})
 		if cmd.secrets {
-			t.AppendRow(table.Row{"Secret Token", zrd.Env.Token})
-			t.AppendRow(table.Row{"Ziti Identity", zrd.Env.ZId})
+			t.AppendRow(table.Row{"Secret Token", env.Environment().Token})
+			t.AppendRow(table.Row{"Ziti Identity", env.Environment().ZitiIdentity})
 		} else {
 			secretToken := "<<SET>>"
-			if zrd.Env.Token == "" {
+			if env.Environment().Token == "" {
 				secretToken = "<<UNSET>>"
 			}
 			t.AppendRow(table.Row{"Secret Token", secretToken})
 
 			zId := "<<SET>>"
-			if zrd.Env.ZId == "" {
+			if env.Environment().ZitiIdentity == "" {
 				zId = "<<UNSET>>"
 			}
 			t.AppendRow(table.Row{"Ziti Identity", zId})
diff --git a/cmd/zrok/testLoopPublic.go b/cmd/zrok/testLoopPublic.go
index c99420de..2342ab7f 100644
--- a/cmd/zrok/testLoopPublic.go
+++ b/cmd/zrok/testLoopPublic.go
@@ -8,7 +8,8 @@ import (
 	httptransport "github.com/go-openapi/runtime/client"
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/sdk-golang/ziti/edge"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
@@ -105,7 +106,7 @@ func (cmd *testLoopPublicCommand) run(_ *cobra.Command, _ []string) {
 type looper struct {
 	id            int
 	cmd           *testLoopPublicCommand
-	env           *env_v0_3.Environment
+	env           *env_core.Environment
 	done          chan struct{}
 	listener      edge.Listener
 	zif           string
@@ -175,28 +176,28 @@ func (l *looper) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func (l *looper) startup() {
 	logrus.Infof("starting #%d", l.id)
 
-	zrd, err := env_v0_3.Load()
+	env, err := environment.LoadRoot()
 	if err != nil {
 		panic(err)
 	}
 
-	if zrd.Env == nil {
+	if !env.IsEnabled() {
 		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
 	}
-	l.env = zrd.Env
+	l.env = env.Environment()
 
-	l.zif, err = env_v0_3.ZitiIdentityFile("backend")
+	l.zif, err = env.ZitiIdentityFile("backend")
 	if err != nil {
 		panic(err)
 	}
-	l.zrok, err = zrd.Client()
+	l.zrok, err = env.Client()
 	if err != nil {
 		panic(err)
 	}
 	l.auth = httptransport.APIKeyAuth("x-token", "header", l.env.Token)
 	tunnelReq := share.NewShareParams()
 	tunnelReq.Body = &rest_model_zrok.ShareRequest{
-		EnvZID:               l.env.ZId,
+		EnvZID:               l.env.ZitiIdentity,
 		ShareMode:            "public",
 		FrontendSelection:    l.cmd.frontendSelection,
 		BackendMode:          "proxy",
@@ -272,7 +273,7 @@ func (l *looper) shutdown() {
 
 	untunnelReq := share.NewUnshareParams()
 	untunnelReq.Body = &rest_model_zrok.UnshareRequest{
-		EnvZID:   l.env.ZId,
+		EnvZID:   l.env.ZitiIdentity,
 		ShrToken: l.shrToken,
 	}
 	if _, err := l.zrok.Share.Unshare(untunnelReq, l.auth); err != nil {
diff --git a/controller/bootstrap.go b/controller/bootstrap.go
index fdfd9300..2ee0be15 100644
--- a/controller/bootstrap.go
+++ b/controller/bootstrap.go
@@ -14,7 +14,7 @@ import (
 	zrok_config "github.com/openziti/zrok/controller/config"
 	"github.com/openziti/zrok/controller/store"
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -133,7 +133,11 @@ func assertZrokProxyConfigType(edge *rest_management_api_client.ZitiEdgeManageme
 }
 
 func getIdentityId(identityName string) (string, error) {
-	zif, err := env_v0_3.ZitiIdentityFile(identityName)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return "", errors.Wrap(err, "error opening environment root")
+	}
+	zif, err := env.ZitiIdentityFile(identityName)
 	if err != nil {
 		return "", errors.Wrapf(err, "error opening identity '%v' from environment", identityName)
 	}
@@ -177,6 +181,11 @@ func assertIdentity(zId string, edge *rest_management_api_client.ZitiEdgeManagem
 }
 
 func bootstrapIdentity(name string, edge *rest_management_api_client.ZitiEdgeManagement) (string, error) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return "", errors.Wrap(err, "error loading environment root")
+	}
+
 	idc, err := zrokEdgeSdk.CreateIdentity(name, rest_model_edge.IdentityTypeDevice, nil, edge)
 	if err != nil {
 		return "", errors.Wrapf(err, "error creating '%v' identity", name)
@@ -195,7 +204,7 @@ func bootstrapIdentity(name string, edge *rest_management_api_client.ZitiEdgeMan
 	if err != nil {
 		return "", errors.Wrapf(err, "error encoding identity config '%v'", name)
 	}
-	if err := env_v0_3.SaveZitiIdentity(name, out.String()); err != nil {
+	if err := env.SaveZitiIdentity(name, out.String()); err != nil {
 		return "", errors.Wrapf(err, "error saving identity config '%v'", name)
 	}
 	return zId, nil
diff --git a/endpoints/proxy/frontend.go b/endpoints/proxy/frontend.go
index db1ede67..b5002060 100644
--- a/endpoints/proxy/frontend.go
+++ b/endpoints/proxy/frontend.go
@@ -6,7 +6,7 @@ import (
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/zrok/endpoints"
 	"github.com/openziti/zrok/endpoints/publicProxy/notFoundUi"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/util"
 	"github.com/pkg/errors"
@@ -40,7 +40,11 @@ type Frontend struct {
 }
 
 func NewFrontend(cfg *FrontendConfig) (*Frontend, error) {
-	zCfgPath, err := env_v0_3.ZitiIdentityFile(cfg.IdentityName)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return nil, errors.Wrap(err, "error loading environment root")
+	}
+	zCfgPath, err := env.ZitiIdentityFile(cfg.IdentityName)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting ziti identity '%v' from environment", cfg.IdentityName)
 	}
diff --git a/endpoints/publicProxy/http.go b/endpoints/publicProxy/http.go
index 51a422c1..70effb12 100644
--- a/endpoints/publicProxy/http.go
+++ b/endpoints/publicProxy/http.go
@@ -7,7 +7,7 @@ import (
 	"github.com/openziti/zrok/endpoints"
 	"github.com/openziti/zrok/endpoints/publicProxy/healthUi"
 	"github.com/openziti/zrok/endpoints/publicProxy/notFoundUi"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/util"
 	"github.com/pkg/errors"
@@ -26,7 +26,11 @@ type httpFrontend struct {
 }
 
 func NewHTTP(cfg *Config) (*httpFrontend, error) {
-	zCfgPath, err := env_v0_3.ZitiIdentityFile(cfg.Identity)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return nil, errors.Wrap(err, "error loading environment root")
+	}
+	zCfgPath, err := env.ZitiIdentityFile(cfg.Identity)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting ziti identity '%v' from environment", cfg.Identity)
 	}
diff --git a/endpoints/tcpTunnel/frontend.go b/endpoints/tcpTunnel/frontend.go
index 2280e429..136b6137 100644
--- a/endpoints/tcpTunnel/frontend.go
+++ b/endpoints/tcpTunnel/frontend.go
@@ -3,7 +3,7 @@ package tcpTunnel
 import (
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/zrok/endpoints"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -29,7 +29,11 @@ func NewFrontend(cfg *FrontendConfig) (*Frontend, error) {
 	if err != nil {
 		return nil, errors.Wrapf(err, "error resolving tcp address '%v'", cfg.BindAddress)
 	}
-	zCfgPath, err := env_v0_3.ZitiIdentityFile(cfg.IdentityName)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return nil, errors.Wrap(err, "error loading environment root")
+	}
+	zCfgPath, err := env.ZitiIdentityFile(cfg.IdentityName)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting ziti identity '%v' from environment", cfg.IdentityName)
 	}
diff --git a/endpoints/udpTunnel/frontend.go b/endpoints/udpTunnel/frontend.go
index 3463aa8c..d9daec56 100644
--- a/endpoints/udpTunnel/frontend.go
+++ b/endpoints/udpTunnel/frontend.go
@@ -3,7 +3,7 @@ package udpTunnel
 import (
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/zrok/endpoints"
-	"github.com/openziti/zrok/environment/env_v0_3"
+	"github.com/openziti/zrok/environment"
 	"github.com/openziti/zrok/model"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -99,7 +99,11 @@ func NewFrontend(cfg *FrontendConfig) (*Frontend, error) {
 	if err != nil {
 		return nil, errors.Wrapf(err, "error resolving udp address '%v'", cfg.BindAddress)
 	}
-	zCfgPath, err := env_v0_3.ZitiIdentityFile(cfg.IdentityName)
+	env, err := environment.LoadRoot()
+	if err != nil {
+		return nil, errors.Wrap(err, "error loading environment root")
+	}
+	zCfgPath, err := env.ZitiIdentityFile(cfg.IdentityName)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting ziti identity '%v' from environment", cfg.IdentityName)
 	}
diff --git a/environment/api.go b/environment/api.go
index b0bce452..71ee4261 100644
--- a/environment/api.go
+++ b/environment/api.go
@@ -2,7 +2,6 @@ package environment
 
 import (
 	"github.com/openziti/zrok/environment/env_core"
-	"github.com/openziti/zrok/environment/env_v0_3x"
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/pkg/errors"
 )
@@ -15,20 +14,21 @@ type Root interface {
 	Client() (*rest_client_zrok.Zrok, error)
 	ApiEndpoint() (string, string)
 	Environment() *env_core.Environment
+	SetEnvironment(env *env_core.Environment) error
 	DeleteEnvironment() error
-	IsEnabled() (bool, error)
+	IsEnabled() bool
 	ZitiIdentityFile(name string) (string, error)
 	SaveZitiIdentity(name, data string) error
 	DeleteZitiIdentity(name string) error
 	Obliterate() error
 }
 
-func ListRoots() ([]*env_core.Metadata, error) {
-	return nil, nil
+func LoadRoot() (Root, error) {
+	return env_v0_3.Load()
 }
 
-func LoadRoot() (Root, error) {
-	return env_v0_3x.Load()
+func ListRoots() ([]*env_core.Metadata, error) {
+	return nil, nil
 }
 
 func LoadRootVersion(m *env_core.Metadata) (Root, error) {
@@ -36,8 +36,8 @@ func LoadRootVersion(m *env_core.Metadata) (Root, error) {
 		return nil, errors.Errorf("specify metadata version")
 	}
 	switch m.V {
-	case env_v0_3x.V:
-		return env_v0_3x.Load()
+	case env_v0_3.V:
+		return env_v0_3.Load()
 
 	default:
 		return nil, errors.Errorf("unknown metadata version '%v'", m.V)
@@ -45,7 +45,7 @@ func LoadRootVersion(m *env_core.Metadata) (Root, error) {
 }
 
 func NeedsUpdate(r Root) bool {
-	return r.Metadata().V != env_v0_3x.V
+	return r.Metadata().V != env_v0_3.V
 }
 
 func UpdateRoot(r Root) (Root, error) {
diff --git a/environment/env_v0_3/api.go b/environment/env_v0_3/api.go
new file mode 100644
index 00000000..be8bdb34
--- /dev/null
+++ b/environment/env_v0_3/api.go
@@ -0,0 +1,151 @@
+package env_v0_3
+
+import (
+	"github.com/go-openapi/runtime"
+	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+	"github.com/openziti/zrok/build"
+	"github.com/openziti/zrok/environment/env_core"
+	"github.com/openziti/zrok/rest_client_zrok"
+	"github.com/pkg/errors"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+)
+
+func (r *Root) Metadata() *env_core.Metadata {
+	return r.meta
+}
+
+func (r *Root) HasConfig() (bool, error) {
+	return r.cfg != nil, nil
+}
+
+func (r *Root) Config() *env_core.Config {
+	return r.cfg
+}
+
+func (r *Root) SetConfig(cfg *env_core.Config) error {
+	if err := saveConfig(cfg); err != nil {
+		return err
+	}
+	r.cfg = cfg
+	return nil
+}
+
+func (r *Root) Client() (*rest_client_zrok.Zrok, error) {
+	apiEndpoint, _ := r.ApiEndpoint()
+	apiUrl, err := url.Parse(apiEndpoint)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error parsing api endpoint '%v'", r)
+	}
+	transport := httptransport.New(apiUrl.Host, "/api/v1", []string{apiUrl.Scheme})
+	transport.Producers["application/zrok.v1+json"] = runtime.JSONProducer()
+	transport.Consumers["application/zrok.v1+json"] = runtime.JSONConsumer()
+
+	zrok := rest_client_zrok.New(transport, strfmt.Default)
+	v, err := zrok.Metadata.Version(nil)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error getting version from api endpoint '%v': %v", apiEndpoint, err)
+	}
+	// allow reported version string to be optionally prefixed with
+	// "refs/heads/" or "refs/tags/"
+	re := regexp.MustCompile(`^(refs/(heads|tags)/)?` + build.Series)
+	if !re.MatchString(string(v.Payload)) {
+		return nil, errors.Errorf("expected a '%v' version, received: '%v'", build.Series, v.Payload)
+	}
+
+	return zrok, nil
+}
+
+func (r *Root) ApiEndpoint() (string, string) {
+	apiEndpoint := "https://api.zrok.io"
+	from := "binary"
+
+	if r.Config() != nil && r.Config().ApiEndpoint != "" {
+		apiEndpoint = r.Config().ApiEndpoint
+		from = "config"
+	}
+
+	env := os.Getenv("ZROK_API_ENDPOINT")
+	if env != "" {
+		apiEndpoint = env
+		from = "ZROK_API_ENDPOINT"
+	}
+
+	if r.IsEnabled() {
+		apiEndpoint = r.Environment().ApiEndpoint
+		from = "env"
+	}
+
+	return apiEndpoint, from
+}
+
+func (r *Root) Environment() *env_core.Environment {
+	return r.env
+}
+
+func (r *Root) SetEnvironment(env *env_core.Environment) error {
+	if err := saveEnvironment(env); err != nil {
+		return err
+	}
+	r.env = env
+	return nil
+}
+
+func (r *Root) DeleteEnvironment() error {
+	ef, err := environmentFile()
+	if err != nil {
+		return errors.Wrap(err, "error getting environment file")
+	}
+	if err := os.Remove(ef); err != nil {
+		return errors.Wrap(err, "error removing environment file")
+	}
+	r.env = nil
+	return nil
+}
+
+func (r *Root) IsEnabled() bool {
+	return r.env != nil
+}
+
+func (r *Root) ZitiIdentityFile(name string) (string, error) {
+	return identityFile(name)
+}
+
+func (r *Root) SaveZitiIdentity(name, data string) error {
+	zif, err := r.ZitiIdentityFile(name)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(zif), os.FileMode(0700)); err != nil {
+		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(zif))
+	}
+	if err := os.WriteFile(zif, []byte(data), os.FileMode(0600)); err != nil {
+		return errors.Wrapf(err, "error writing ziti identity file '%v'", zif)
+	}
+	return nil
+}
+
+func (r *Root) DeleteZitiIdentity(name string) error {
+	zif, err := r.ZitiIdentityFile(name)
+	if err != nil {
+		return errors.Wrapf(err, "error getting ziti identity file path for '%v'", name)
+	}
+	if err := os.Remove(zif); err != nil {
+		return errors.Wrapf(err, "error removing ziti identity file '%v'", zif)
+	}
+	return nil
+}
+
+func (r *Root) Obliterate() error {
+	zrd, err := rootDir()
+	if err != nil {
+		return err
+	}
+	if err := os.RemoveAll(zrd); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/environment/env_v0_3/client.go b/environment/env_v0_3/client.go
deleted file mode 100644
index 319377fb..00000000
--- a/environment/env_v0_3/client.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package env_v0_3
-
-import (
-	"github.com/go-openapi/runtime"
-	httptransport "github.com/go-openapi/runtime/client"
-	"github.com/go-openapi/strfmt"
-	"github.com/openziti/zrok/build"
-	"github.com/openziti/zrok/rest_client_zrok"
-	"github.com/pkg/errors"
-	"net/url"
-	"os"
-	"regexp"
-)
-
-func (r *Root) Client() (*rest_client_zrok.Zrok, error) {
-	apiEndpoint, _ := r.ApiEndpoint()
-	apiUrl, err := url.Parse(apiEndpoint)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error parsing api endpoint '%v'", r)
-	}
-	transport := httptransport.New(apiUrl.Host, "/api/v1", []string{apiUrl.Scheme})
-	transport.Producers["application/zrok.v1+json"] = runtime.JSONProducer()
-	transport.Consumers["application/zrok.v1+json"] = runtime.JSONConsumer()
-
-	zrok := rest_client_zrok.New(transport, strfmt.Default)
-	v, err := zrok.Metadata.Version(nil)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error getting version from api endpoint '%v': %v", apiEndpoint, err)
-	}
-	// allow reported version string to be optionally prefixed with
-	// "refs/heads/" or "refs/tags/"
-	re := regexp.MustCompile(`^(refs/(heads|tags)/)?` + build.Series)
-	if !re.MatchString(string(v.Payload)) {
-		return nil, errors.Errorf("expected a '%v' version, received: '%v'", build.Series, v.Payload)
-	}
-
-	return zrok, nil
-}
-
-func (r *Root) ApiEndpoint() (apiEndpoint string, from string) {
-	apiEndpoint = "https://api.zrok.io"
-	from = "binary"
-
-	if r.Cfg != nil && r.Cfg.ApiEndpoint != "" {
-		apiEndpoint = r.Cfg.ApiEndpoint
-		from = "config"
-	}
-
-	env := os.Getenv("ZROK_API_ENDPOINT")
-	if env != "" {
-		apiEndpoint = env
-		from = "ZROK_API_ENDPOINT"
-	}
-
-	if r.Env != nil && r.Env.ApiEndpoint != "" {
-		apiEndpoint = r.Env.ApiEndpoint
-		from = "env"
-	}
-
-	return apiEndpoint, from
-}
diff --git a/environment/env_v0_3/config.go b/environment/env_v0_3/config.go
deleted file mode 100644
index 0aafdc04..00000000
--- a/environment/env_v0_3/config.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package env_v0_3
-
-import (
-	"encoding/json"
-	"github.com/pkg/errors"
-	"os"
-	"path/filepath"
-)
-
-type Config struct {
-	ApiEndpoint string `json:"api_endpoint"`
-}
-
-func HasConfig() (bool, error) {
-	cf, err := configFile()
-	if err != nil {
-		return false, errors.Wrap(err, "error getting config file path")
-	}
-	_, err = os.Stat(cf)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, errors.Wrapf(err, "error stat-ing config file '%v'", cf)
-	}
-	return true, nil
-}
-
-func LoadConfig() (*Config, error) {
-	cf, err := configFile()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting config file path")
-	}
-	data, err := os.ReadFile(cf)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error reading config file '%v'", cf)
-	}
-	cfg := &Config{}
-	if err := json.Unmarshal(data, cfg); err != nil {
-		return nil, errors.Wrapf(err, "error unmarshaling config file '%v'", cf)
-	}
-	return cfg, nil
-}
-
-func SaveConfig(cfg *Config) error {
-	data, err := json.MarshalIndent(cfg, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "error marshaling config")
-	}
-	cf, err := configFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting config file path")
-	}
-	if err := os.MkdirAll(filepath.Dir(cf), os.FileMode(0700)); err != nil {
-		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(cf))
-	}
-	if err := os.WriteFile(cf, data, os.FileMode(0600)); err != nil {
-		return errors.Wrap(err, "error saving config file")
-	}
-	return nil
-}
diff --git a/environment/env_v0_3x/dirs.go b/environment/env_v0_3/dirs.go
similarity index 64%
rename from environment/env_v0_3x/dirs.go
rename to environment/env_v0_3/dirs.go
index 10a70de7..ec382f7f 100644
--- a/environment/env_v0_3x/dirs.go
+++ b/environment/env_v0_3/dirs.go
@@ -1,6 +1,7 @@
-package env_v0_3x
+package env_v0_3
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 )
@@ -36,3 +37,19 @@ func environmentFile() (string, error) {
 	}
 	return filepath.Join(zrd, "environment.json"), nil
 }
+
+func identitiesDir() (string, error) {
+	zrd, err := rootDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(zrd, "identities"), nil
+}
+
+func identityFile(name string) (string, error) {
+	idd, err := identitiesDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(idd, fmt.Sprintf("%v.json", name)), nil
+}
diff --git a/environment/env_v0_3/environment.go b/environment/env_v0_3/environment.go
deleted file mode 100644
index fe4cd270..00000000
--- a/environment/env_v0_3/environment.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package env_v0_3
-
-import (
-	"encoding/json"
-	"github.com/pkg/errors"
-	"os"
-	"path/filepath"
-)
-
-type Environment struct {
-	Token       string `json:"zrok_token"`
-	ZId         string `json:"ziti_identity"`
-	ApiEndpoint string `json:"api_endpoint"`
-}
-
-func IsEnabled() (bool, error) {
-	ef, err := environmentFile()
-	if err != nil {
-		return false, errors.Wrap(err, "error getting environment file path")
-	}
-	_, err = os.Stat(ef)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, errors.Wrapf(err, "error stat-ing environment file '%v'", ef)
-	}
-	return true, nil
-}
-
-func loadEnvironment() (*Environment, error) {
-	ef, err := environmentFile()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting environment file")
-	}
-	data, err := os.ReadFile(ef)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error reading environment file '%v'", ef)
-	}
-	env := &Environment{}
-	if err := json.Unmarshal(data, env); err != nil {
-		return nil, errors.Wrapf(err, "error unmarshaling environment file '%v'", ef)
-	}
-	return env, nil
-}
-
-func saveEnvironment(env *Environment) error {
-	data, err := json.MarshalIndent(env, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "error marshaling environment")
-	}
-	ef, err := environmentFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting environment file")
-	}
-	if err := os.MkdirAll(filepath.Dir(ef), os.FileMode(0700)); err != nil {
-		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(ef))
-	}
-	if err := os.WriteFile(ef, data, os.FileMode(0600)); err != nil {
-		return errors.Wrap(err, "error saving environment file")
-	}
-	return nil
-}
-
-func DeleteEnvironment() error {
-	ef, err := environmentFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting environment file")
-	}
-	if err := os.Remove(ef); err != nil {
-		return errors.Wrap(err, "error removing environment file")
-	}
-
-	return nil
-}
diff --git a/environment/env_v0_3/identity.go b/environment/env_v0_3/identity.go
deleted file mode 100644
index 2b5f4dc2..00000000
--- a/environment/env_v0_3/identity.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package env_v0_3
-
-import (
-	"github.com/pkg/errors"
-	"os"
-	"path/filepath"
-)
-
-func ZitiIdentityFile(name string) (string, error) {
-	return identityFile(name)
-}
-
-func SaveZitiIdentity(name, data string) error {
-	zif, err := ZitiIdentityFile(name)
-	if err != nil {
-		return err
-	}
-	if err := os.MkdirAll(filepath.Dir(zif), os.FileMode(0700)); err != nil {
-		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(zif))
-	}
-	if err := os.WriteFile(zif, []byte(data), os.FileMode(0600)); err != nil {
-		return errors.Wrapf(err, "error writing ziti identity file '%v'", zif)
-	}
-	return nil
-}
-
-func DeleteZitiIdentity(name string) error {
-	zif, err := ZitiIdentityFile(name)
-	if err != nil {
-		return errors.Wrapf(err, "error getting ziti identity file path for '%v'", name)
-	}
-	if err := os.Remove(zif); err != nil {
-		return errors.Wrapf(err, "error removing ziti identity file '%v'", zif)
-	}
-	return nil
-}
diff --git a/environment/env_v0_3/root.go b/environment/env_v0_3/root.go
index e5be4064..842ef128 100644
--- a/environment/env_v0_3/root.go
+++ b/environment/env_v0_3/root.go
@@ -1,179 +1,234 @@
 package env_v0_3
 
 import (
-	"fmt"
+	"encoding/json"
+	"github.com/openziti/zrok/environment/env_core"
 	"github.com/pkg/errors"
 	"os"
 	"path/filepath"
-	"strings"
 )
 
-type Root struct {
-	Env        *Environment
-	Cfg        *Config
-	identities map[string]struct{}
-}
+const V = "v0.3"
 
-func Initialize() (*Root, error) {
-	zrd, err := rootDir()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting environment path")
-	}
-	if err := os.MkdirAll(zrd, os.FileMode(0700)); err != nil {
-		return nil, errors.Wrapf(err, "error creating environment root path '%v'", zrd)
-	}
-	if err := DeleteEnvironment(); err != nil {
-		return nil, errors.Wrap(err, "error deleting environment")
-	}
-	idd, err := identitiesDir()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting environment identities path")
-	}
-	if err := os.MkdirAll(idd, os.FileMode(0700)); err != nil {
-		return nil, errors.Wrapf(err, "error creating environment identities root path '%v'", idd)
-	}
-	return Load()
+type Root struct {
+	meta *env_core.Metadata
+	cfg  *env_core.Config
+	env  *env_core.Environment
 }
 
 func Load() (*Root, error) {
-	if err := checkMetadata(); err != nil {
-		return nil, err
-	}
-
-	zrd := &Root{}
-
-	ids, err := listIdentities()
+	r := &Root{}
+	exists, err := rootExists()
 	if err != nil {
 		return nil, err
 	}
-	zrd.identities = ids
+	if exists {
+		if meta, err := loadMetadata(); err == nil {
+			r.meta = meta
+		} else {
+			return nil, err
+		}
 
-	hasCfg, err := HasConfig()
-	if err != nil {
-		return nil, err
-	}
-	if hasCfg {
-		cfg, err := LoadConfig()
+		if cfg, err := loadConfig(); err == nil {
+			r.cfg = cfg
+		}
+
+		if env, err := loadEnvironment(); err == nil {
+			r.env = env
+		}
+
+	} else {
+		root, err := rootDir()
 		if err != nil {
 			return nil, err
 		}
-		zrd.Cfg = cfg
-	}
-
-	hasEnv, err := IsEnabled()
-	if err != nil {
-		return nil, err
-	}
-	if hasEnv {
-		env, err := loadEnvironment()
-		if err != nil {
-			return nil, err
-		}
-		zrd.Env = env
-	}
-
-	return zrd, nil
-}
-
-func (r *Root) Save() error {
-	if err := writeMetadata(); err != nil {
-		return errors.Wrap(err, "error saving metadata")
-	}
-	if r.Env != nil {
-		if err := saveEnvironment(r.Env); err != nil {
-			return errors.Wrap(err, "error saving environment")
+		r.meta = &env_core.Metadata{
+			V:        V,
+			RootPath: root,
 		}
 	}
-	if r.Cfg != nil {
-		if err := SaveConfig(r.Cfg); err != nil {
-			return errors.Wrap(err, "error saving config")
-		}
-	}
-	return nil
+	return r, nil
 }
 
-func Obliterate() error {
-	zrd, err := rootDir()
+func rootExists() (bool, error) {
+	mf, err := metadataFile()
 	if err != nil {
-		return err
+		return false, err
 	}
-	if err := os.RemoveAll(zrd); err != nil {
-		return err
-	}
-	return nil
-}
-
-func listIdentities() (map[string]struct{}, error) {
-	ids := make(map[string]struct{})
-
-	idd, err := identitiesDir()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting environment identities path")
-	}
-	_, err = os.Stat(idd)
+	_, err = os.Stat(mf)
 	if os.IsNotExist(err) {
-		return ids, nil
+		return false, nil
 	}
 	if err != nil {
-		return nil, errors.Wrapf(err, "error stat-ing environment identities root '%v'", idd)
+		return false, err
 	}
-	des, err := os.ReadDir(idd)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error listing environment identities from '%v'", idd)
-	}
-	for _, de := range des {
-		if strings.HasSuffix(de.Name(), ".json") && !de.IsDir() {
-			name := strings.TrimSuffix(de.Name(), ".json")
-			ids[name] = struct{}{}
-		}
-	}
-	return ids, nil
+	return true, err
 }
 
-func configFile() (string, error) {
-	zrd, err := rootDir()
+func loadMetadata() (*env_core.Metadata, error) {
+	mf, err := metadataFile()
 	if err != nil {
-		return "", err
+		return nil, err
 	}
-	return filepath.Join(zrd, "config.json"), nil
+	data, err := os.ReadFile(mf)
+	if err != nil {
+		return nil, err
+	}
+	m := &metadata{}
+	if err := json.Unmarshal(data, m); err != nil {
+		return nil, errors.Wrapf(err, "error unmarshaling metadata file '%v'", mf)
+	}
+	if m.V != V {
+		return nil, errors.Errorf("got metadata version '%v', expected '%v'", m.V, V)
+	}
+	rf, err := rootDir()
+	if err != nil {
+		return nil, err
+	}
+	out := &env_core.Metadata{
+		V:        m.V,
+		RootPath: rf,
+	}
+	return out, nil
 }
 
-func environmentFile() (string, error) {
-	zrd, err := rootDir()
+func writeMetadata() error {
+	mf, err := metadataFile()
 	if err != nil {
-		return "", err
+		return err
 	}
-	return filepath.Join(zrd, "environment.json"), nil
+	data, err := json.Marshal(&metadata{V: V})
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(mf), os.FileMode(0700)); err != nil {
+		return err
+	}
+	if err := os.WriteFile(mf, data, os.FileMode(0600)); err != nil {
+		return err
+	}
+	return nil
 }
 
-func identityFile(name string) (string, error) {
-	idd, err := identitiesDir()
+func loadConfig() (*env_core.Config, error) {
+	cf, err := configFile()
 	if err != nil {
-		return "", err
+		return nil, errors.Wrap(err, "error getting config file path")
 	}
-	return filepath.Join(idd, fmt.Sprintf("%v.json", name)), nil
+	data, err := os.ReadFile(cf)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error reading config file '%v'", cf)
+	}
+	cfg := &config{}
+	if err := json.Unmarshal(data, cfg); err != nil {
+		return nil, errors.Wrapf(err, "error unmarshaling config file '%v'", cf)
+	}
+	out := &env_core.Config{
+		ApiEndpoint: cfg.ApiEndpoint,
+	}
+	return out, nil
 }
 
-func identitiesDir() (string, error) {
-	zrd, err := rootDir()
+func saveConfig(cfg *env_core.Config) error {
+	in := &config{ApiEndpoint: cfg.ApiEndpoint}
+	data, err := json.MarshalIndent(in, "", "  ")
 	if err != nil {
-		return "", err
+		return errors.Wrap(err, "error marshaling config")
 	}
-	return filepath.Join(zrd, "identities"), nil
+	cf, err := configFile()
+	if err != nil {
+		return errors.Wrap(err, "error getting config file path")
+	}
+	if err := os.MkdirAll(filepath.Dir(cf), os.FileMode(0700)); err != nil {
+		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(cf))
+	}
+	if err := os.WriteFile(cf, data, os.FileMode(0600)); err != nil {
+		return errors.Wrap(err, "error saving config file")
+	}
+	return nil
 }
 
-func metadataFile() (string, error) {
-	zrd, err := rootDir()
+func isEnabled() (bool, error) {
+	ef, err := environmentFile()
 	if err != nil {
-		return "", err
+		return false, errors.Wrap(err, "error getting environment file path")
 	}
-	return filepath.Join(zrd, "metadata.json"), nil
+	_, err = os.Stat(ef)
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, errors.Wrapf(err, "error stat-ing environment file '%v'", ef)
+	}
+	return true, nil
 }
 
-func rootDir() (string, error) {
-	home, err := os.UserHomeDir()
+func loadEnvironment() (*env_core.Environment, error) {
+	ef, err := environmentFile()
 	if err != nil {
-		return "", err
+		return nil, errors.Wrap(err, "error getting environment file")
 	}
-	return filepath.Join(home, ".zrok"), nil
+	data, err := os.ReadFile(ef)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error reading environment file '%v'", ef)
+	}
+	env := &environment{}
+	if err := json.Unmarshal(data, env); err != nil {
+		return nil, errors.Wrapf(err, "error unmarshaling environment file '%v'", ef)
+	}
+	out := &env_core.Environment{
+		Token:        env.Token,
+		ZitiIdentity: env.ZId,
+		ApiEndpoint:  env.ApiEndpoint,
+	}
+	return out, nil
+}
+
+func saveEnvironment(env *env_core.Environment) error {
+	in := &environment{
+		Token:       env.Token,
+		ZId:         env.ZitiIdentity,
+		ApiEndpoint: env.ApiEndpoint,
+	}
+	data, err := json.MarshalIndent(in, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "error marshaling environment")
+	}
+	ef, err := environmentFile()
+	if err != nil {
+		return errors.Wrap(err, "error getting environment file")
+	}
+	if err := os.MkdirAll(filepath.Dir(ef), os.FileMode(0700)); err != nil {
+		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(ef))
+	}
+	if err := os.WriteFile(ef, data, os.FileMode(0600)); err != nil {
+		return errors.Wrap(err, "error saving environment file")
+	}
+	return nil
+}
+
+func deleteEnvironment() error {
+	ef, err := environmentFile()
+	if err != nil {
+		return errors.Wrap(err, "error getting environment file")
+	}
+	if err := os.Remove(ef); err != nil {
+		return errors.Wrap(err, "error removing environment file")
+	}
+
+	return nil
+}
+
+type metadata struct {
+	V string `json:"v"`
+}
+
+type config struct {
+	ApiEndpoint string `json:"api_endpoint"`
+}
+
+type environment struct {
+	Token       string `json:"zrok_token"`
+	ZId         string `json:"ziti_identity"`
+	ApiEndpoint string `json:"api_endpoint"`
 }
diff --git a/environment/env_v0_3/version.go b/environment/env_v0_3/version.go
deleted file mode 100644
index 1416126c..00000000
--- a/environment/env_v0_3/version.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package env_v0_3
-
-import (
-	"encoding/json"
-	"github.com/openziti/zrok/tui"
-	"github.com/pkg/errors"
-	"os"
-	"path/filepath"
-)
-
-const V = "v0.3"
-
-type Metadata struct {
-	V string `json:"v"`
-}
-
-func checkMetadata() error {
-	mf, err := metadataFile()
-	if err != nil {
-		return err
-	}
-	data, err := os.ReadFile(mf)
-	if err != nil {
-		tui.Warning("unable to open environment metadata; ignoring\n")
-		return nil
-	}
-	m := &Metadata{}
-	if err := json.Unmarshal(data, m); err != nil {
-		return errors.Wrapf(err, "error unmarshaling metadata file '%v'", mf)
-	}
-	if m.V != V {
-		return errors.Errorf("invalid environment metadata version '%v'", m.V)
-	}
-	return nil
-}
-
-func writeMetadata() error {
-	mf, err := metadataFile()
-	if err != nil {
-		return err
-	}
-	data, err := json.Marshal(&Metadata{V: V})
-	if err != nil {
-		return err
-	}
-	if err := os.MkdirAll(filepath.Dir(mf), os.FileMode(0700)); err != nil {
-		return err
-	}
-	if err := os.WriteFile(mf, data, os.FileMode(0600)); err != nil {
-		return err
-	}
-	return nil
-}
diff --git a/environment/env_v0_3x/api.go b/environment/env_v0_3x/api.go
deleted file mode 100644
index fb19186b..00000000
--- a/environment/env_v0_3x/api.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package env_v0_3x
-
-import (
-	"github.com/openziti/zrok/environment/env_core"
-	"github.com/openziti/zrok/rest_client_zrok"
-)
-
-func (r *Root) Metadata() *env_core.Metadata {
-	return r.meta
-}
-
-func (r *Root) HasConfig() (bool, error) {
-	return r.cfg != nil, nil
-}
-
-func (r *Root) Config() *env_core.Config {
-	return r.cfg
-}
-
-func (r *Root) SetConfig(cfg *env_core.Config) error {
-	if err := saveConfig(cfg); err != nil {
-		return err
-	}
-	r.cfg = cfg
-	return nil
-}
-
-func (r *Root) Client() (*rest_client_zrok.Zrok, error) {
-	return nil, nil
-}
-
-func (r *Root) ApiEndpoint() (string, string) {
-	if r.env != nil {
-		return r.env.ApiEndpoint, "env"
-	}
-	return "", ""
-}
-
-func (r *Root) Environment() *env_core.Environment {
-	return r.env
-}
-
-func (r *Root) DeleteEnvironment() error {
-	return nil
-}
-
-func (r *Root) IsEnabled() (bool, error) {
-	return r.env != nil, nil
-}
-
-func (r *Root) ZitiIdentityFile(name string) (string, error) {
-	return "", nil
-}
-
-func (r *Root) SaveZitiIdentity(name, data string) error {
-	return nil
-}
-
-func (r *Root) DeleteZitiIdentity(name string) error {
-	return nil
-}
-
-func (r *Root) Obliterate() error {
-	return nil
-}
diff --git a/environment/env_v0_3x/root.go b/environment/env_v0_3x/root.go
deleted file mode 100644
index 2a725376..00000000
--- a/environment/env_v0_3x/root.go
+++ /dev/null
@@ -1,216 +0,0 @@
-package env_v0_3x
-
-import (
-	"encoding/json"
-	"github.com/openziti/zrok/environment/env_core"
-	"github.com/pkg/errors"
-	"os"
-	"path/filepath"
-)
-
-const V = "v0.3"
-
-type Root struct {
-	meta *env_core.Metadata
-	cfg  *env_core.Config
-	env  *env_core.Environment
-}
-
-func Load() (*Root, error) {
-	r := &Root{}
-	exists, err := rootExists()
-	if err != nil {
-		return nil, err
-	}
-	if exists {
-		if meta, err := loadMetadata(); err == nil {
-			r.meta = meta
-		} else {
-			return nil, err
-		}
-
-		if cfg, err := loadConfig(); err == nil {
-			r.cfg = cfg
-		}
-
-		if env, err := loadEnvironment(); err == nil {
-			r.env = env
-		}
-
-	} else {
-		root, err := rootDir()
-		if err != nil {
-			return nil, err
-		}
-		r.meta = &env_core.Metadata{
-			V:        V,
-			RootPath: root,
-		}
-	}
-	return r, nil
-}
-
-func rootExists() (bool, error) {
-	mf, err := metadataFile()
-	if err != nil {
-		return false, err
-	}
-	_, err = os.Stat(mf)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	return true, err
-}
-
-func loadMetadata() (*env_core.Metadata, error) {
-	mf, err := metadataFile()
-	if err != nil {
-		return nil, err
-	}
-	data, err := os.ReadFile(mf)
-	if err != nil {
-		return nil, err
-	}
-	m := &metadata{}
-	if err := json.Unmarshal(data, m); err != nil {
-		return nil, errors.Wrapf(err, "error unmarshaling metadata file '%v'", mf)
-	}
-	if m.V != V {
-		return nil, errors.Errorf("got metadata version '%v', expected '%v'", m.V, V)
-	}
-	rf, err := rootDir()
-	if err != nil {
-		return nil, err
-	}
-	out := &env_core.Metadata{
-		V:        m.V,
-		RootPath: rf,
-	}
-	return out, nil
-}
-
-func loadConfig() (*env_core.Config, error) {
-	cf, err := configFile()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting config file path")
-	}
-	data, err := os.ReadFile(cf)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error reading config file '%v'", cf)
-	}
-	cfg := &config{}
-	if err := json.Unmarshal(data, cfg); err != nil {
-		return nil, errors.Wrapf(err, "error unmarshaling config file '%v'", cf)
-	}
-	out := &env_core.Config{
-		ApiEndpoint: cfg.ApiEndpoint,
-	}
-	return out, nil
-}
-
-func saveConfig(cfg *env_core.Config) error {
-	in := &config{ApiEndpoint: cfg.ApiEndpoint}
-	data, err := json.MarshalIndent(in, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "error marshaling config")
-	}
-	cf, err := configFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting config file path")
-	}
-	if err := os.MkdirAll(filepath.Dir(cf), os.FileMode(0700)); err != nil {
-		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(cf))
-	}
-	if err := os.WriteFile(cf, data, os.FileMode(0600)); err != nil {
-		return errors.Wrap(err, "error saving config file")
-	}
-	return nil
-}
-
-func isEnabled() (bool, error) {
-	ef, err := environmentFile()
-	if err != nil {
-		return false, errors.Wrap(err, "error getting environment file path")
-	}
-	_, err = os.Stat(ef)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, errors.Wrapf(err, "error stat-ing environment file '%v'", ef)
-	}
-	return true, nil
-}
-
-func loadEnvironment() (*env_core.Environment, error) {
-	ef, err := environmentFile()
-	if err != nil {
-		return nil, errors.Wrap(err, "error getting environment file")
-	}
-	data, err := os.ReadFile(ef)
-	if err != nil {
-		return nil, errors.Wrapf(err, "error reading environment file '%v'", ef)
-	}
-	env := &environment{}
-	if err := json.Unmarshal(data, env); err != nil {
-		return nil, errors.Wrapf(err, "error unmarshaling environment file '%v'", ef)
-	}
-	out := &env_core.Environment{
-		Token:        env.Token,
-		ZitiIdentity: env.ZId,
-		ApiEndpoint:  env.ApiEndpoint,
-	}
-	return out, nil
-}
-
-func saveEnvironment(env *env_core.Environment) error {
-	in := &environment{
-		Token:       env.Token,
-		ZId:         env.ZitiIdentity,
-		ApiEndpoint: env.ApiEndpoint,
-	}
-	data, err := json.MarshalIndent(in, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "error marshaling environment")
-	}
-	ef, err := environmentFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting environment file")
-	}
-	if err := os.MkdirAll(filepath.Dir(ef), os.FileMode(0700)); err != nil {
-		return errors.Wrapf(err, "error creating environment path '%v'", filepath.Dir(ef))
-	}
-	if err := os.WriteFile(ef, data, os.FileMode(0600)); err != nil {
-		return errors.Wrap(err, "error saving environment file")
-	}
-	return nil
-}
-
-func deleteEnvironment() error {
-	ef, err := environmentFile()
-	if err != nil {
-		return errors.Wrap(err, "error getting environment file")
-	}
-	if err := os.Remove(ef); err != nil {
-		return errors.Wrap(err, "error removing environment file")
-	}
-
-	return nil
-}
-
-type metadata struct {
-	V string `json:"v"`
-}
-
-type config struct {
-	ApiEndpoint string `json:"api_endpoint"`
-}
-
-type environment struct {
-	Token       string `json:"zrok_token"`
-	ZId         string `json:"ziti_identity"`
-	ApiEndpoint string `json:"api_endpoint"`
-}
diff --git a/sdk/share.go b/sdk/share.go
index 15d33f2d..5e4bb07f 100644
--- a/sdk/share.go
+++ b/sdk/share.go
@@ -1,8 +1,6 @@
 package sdk
 
 import (
-	"github.com/openziti/zrok/environment/env_v0_3"
-	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/pkg/errors"
 )
 
@@ -28,15 +26,3 @@ func newPrivateShare(request *ShareRequest) (*Share, error) {
 func newPublicShare(request *ShareRequest) (*Share, error) {
 	return nil, nil
 }
-
-func loadEnvironment(request *ShareRequest) (*env_v0_3.Root, error) {
-	env, err := env_v0_3.Load()
-	if err != nil {
-		return nil, errors.Wrap(err, "error loading environment")
-	}
-	return env, nil
-}
-
-func createShare(zrd *env_v0_3.Root, req *rest_model_zrok.ShareRequest) (*Share, error) {
-	return nil, nil
-}