From 045dd3817e6732c340ed7e78073d9f8b76ff93c7 Mon Sep 17 00:00:00 2001
From: Joao Gilberto Magalhaes <joao@byjg.com.br>
Date: Sun, 15 Feb 2026 14:32:16 -0500
Subject: [PATCH] Migrate configuration paths to `/etc/easyhaproxy` and improve
 health check support in E2E tests

- Refactored HAProxy configuration files, templates, and paths to use `/etc/easyhaproxy` instead of `/etc/haproxy`.
- Updated Dockerfile to generate DH params and placeholder certificates in the new configuration directory.
- Added health check support with timeout to `DockerComposeFixture` in E2E test utilities.
- Adjusted tests, templates, and plugins to use the new `Consts`-based configuration paths.
- Introduced pytest fixtures for environment isolation and temporary directory management.
---
 .gitignore                                    |   1 +
 .run/pytest in tests.run.xml                  |   5 +-
 build/Dockerfile                              |  13 +-
 .../etc/easyhaproxy/haproxy/conf.d/README.md  |   5 +
 .../haproxy/errors-custom/400.http            |   2 +-
 .../haproxy/errors-custom/403.http            |   0
 .../haproxy/errors-custom/408.http            |   0
 .../haproxy/errors-custom/500.http            |   0
 .../haproxy/errors-custom/502.http            |   0
 .../haproxy/errors-custom/503.http            |   0
 .../haproxy/errors-custom/504.http            |   0
 build/assets/etc/haproxy/conf.d/README.md     |   3 -
 deploy/docker/docker-compose.yml              |   4 +-
 docs/Plugins/cleanup.md                       |   4 +-
 docs/Plugins/cloudflare.md                    |  28 +--
 docs/Plugins/deny-pages.md                    |   2 +-
 docs/Plugins/fastcgi.md                       |  20 +-
 docs/Plugins/ip-whitelist.md                  |   2 +-
 docs/Plugins/jwt-validator.md                 |  28 +--
 docs/acme.md                                  |   8 +-
 docs/environment-variable.md                  |  29 +--
 docs/kubernetes.md                            |   2 +-
 docs/other.md                                 |   6 +-
 docs/plugin-development.md                    |  46 ++---
 docs/plugins.md                               |  22 +-
 docs/ssl.md                                   |   6 +-
 docs/static.md                                |   4 +-
 docs/volumes.md                               | 194 +++++++++++++++++-
 pyproject.toml                                |   1 +
 src/functions/__init__.py                     |  68 +++++-
 src/plugins/__init__.py                       |   6 +-
 src/plugins/builtin/cloudflare.py             |  10 +-
 src/plugins/builtin/fastcgi.py                |   6 +-
 src/plugins/builtin/jwt_validator.py          |  10 +-
 src/templates/bind.j2                         |   2 +-
 src/templates/haproxy.cfg.j2                  |  14 +-
 src/templates/ssl_default.j2                  |   2 +-
 src/templates/ssl_loose.j2                    |   2 +-
 tests/conftest.py                             |  43 ++++
 tests/expected/docker.txt                     |   4 +-
 tests/expected/no-services.txt                |   2 +-
 tests/expected/services-fcgi.txt              |   2 +-
 tests/expected/services-letsencrypt.txt       |  18 +-
 tests/expected/services-multi-containers.txt  |   2 +-
 tests/expected/services-multiple-hosts.txt    |  16 +-
 tests/expected/services-redirect-ssl.txt      |   4 +-
 tests/expected/services-tcp.txt               |   2 +-
 tests/expected/services.txt                   |   4 +-
 tests/expected/ssl-loose.txt                  |   2 +-
 tests/expected/static.txt                     |  18 +-
 tests/fixtures/services-with-multiple-plugins |   1 -
 tests/test_daemonize.py                       |  11 +-
 tests/test_plugins.py                         |  37 ++--
 tests_e2e/docker/docker-compose-acme-e2e.yml  |   6 +-
 tests_e2e/docker/docker-compose-acme.yml      |   8 +-
 .../docker/docker-compose-cloudflare.yml      |   4 +-
 .../docker/docker-compose-jwt-validator.yml   |   4 +-
 .../docker-compose-plugins-combined.yml       |   6 +-
 tests_e2e/docker/docker-compose-portainer.yml |   4 +-
 tests_e2e/docker/docker-compose.yml           |   2 +-
 tests_e2e/kubernetes/cloudflare.yml           |   4 +-
 tests_e2e/kubernetes/jwt-validator.yml        |   4 +-
 tests_e2e/kubernetes/plugins-combined.yml     |   2 +-
 tests_e2e/static/README.md                    |   2 +-
 tests_e2e/static/conf/config-basic.yml        |   4 +-
 tests_e2e/static/conf/config-certbot.yml      |  12 +-
 tests_e2e/static/conf/config-deny-pages.yml   |   2 +-
 .../static/conf/config-jwt-validator.yml      |  12 +-
 tests_e2e/static/docker-compose.yml           |  10 +-
 tests_e2e/test_docker_compose.py              |  28 +--
 tests_e2e/test_kubernetes.py                  |  12 +-
 tests_e2e/test_static.py                      |   6 +-
 tests_e2e/utils.py                            |  34 ++-
 73 files changed, 600 insertions(+), 287 deletions(-)
 create mode 100644 build/assets/etc/easyhaproxy/haproxy/conf.d/README.md
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/400.http (99%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/403.http (100%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/408.http (100%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/500.http (100%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/502.http (100%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/503.http (100%)
 rename build/assets/etc/{ => easyhaproxy}/haproxy/errors-custom/504.http (100%)
 delete mode 100644 build/assets/etc/haproxy/conf.d/README.md
 create mode 100644 tests/conftest.py

diff --git a/.gitignore b/.gitignore
index 41c15f8..f81b658 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,7 @@ __pycache__
 # Build artifacts
 dist/
 build/
+!build/assets/
 *.egg-info/
 
 /tests_e2e/static/conf/config.yml
diff --git a/.run/pytest in tests.run.xml b/.run/pytest in tests.run.xml
index 9b5784c..c72dc30 100644
--- a/.run/pytest in tests.run.xml	
+++ b/.run/pytest in tests.run.xml	
@@ -5,16 +5,17 @@
     <option name="INTERPRETER_OPTIONS" value="" />
     <option name="PARENT_ENVS" value="true" />
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.12 (docker-easy-haproxy)" />
+    <option name="SDK_NAME" value="uv (docker-easy-haproxy)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/src" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
     <EXTENSION ID="PythonCoverageRunConfigurationExtension" runner="coverage.py" />
+    <option name="RUN_TOOL" value="true" />
     <option name="_new_keywords" value="&quot;&quot;" />
     <option name="_new_parameters" value="&quot;&quot;" />
     <option name="_new_additionalArguments" value="&quot;&quot;" />
-    <option name="_new_target" value="&quot;$PROJECT_DIR$/src/tests&quot;" />
+    <option name="_new_target" value="&quot;$PROJECT_DIR$/tests&quot;" />
     <option name="_new_targetType" value="&quot;PATH&quot;" />
     <method v="2" />
   </configuration>
diff --git a/build/Dockerfile b/build/Dockerfile
index d091659..55d225a 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -10,8 +10,17 @@ RUN apk add --no-cache haproxy bash python3 certbot openssl curl \
     && curl -LsSf https://astral.sh/uv/install.sh | sh \
     && ln -s /root/.local/bin/uv /usr/local/bin/uv
 
-RUN openssl dhparam -out /etc/haproxy/dhparam 2048 \
-    && openssl dhparam -out /etc/haproxy/dhparam-1024 1024
+RUN mkdir -p /etc/easyhaproxy/haproxy \
+    && openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam 2048 \
+    && openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam-1024 1024 \
+    && mkdir -p /etc/easyhaproxy/certs/certbot /etc/easyhaproxy/certs/haproxy \
+    && openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
+        -keyout /tmp/placeholder.key \
+        -out /tmp/placeholder.crt \
+        -subj "/CN=placeholder" \
+    && cat /tmp/placeholder.crt /tmp/placeholder.key > /etc/easyhaproxy/certs/certbot/placeholder.pem \
+    && cat /tmp/placeholder.crt /tmp/placeholder.key > /etc/easyhaproxy/certs/haproxy/placeholder.pem \
+    && rm /tmp/placeholder.key /tmp/placeholder.crt
 
 WORKDIR /scripts
 
diff --git a/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md b/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md
new file mode 100644
index 0000000..c8f8f33
--- /dev/null
+++ b/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md
@@ -0,0 +1,5 @@
+# Custom HAProxy Configuration
+
+Put `.cfg` files here to be included in the HAProxy configuration.
+
+These files will be available at `/etc/easyhaproxy/haproxy/conf.d/` inside the container.
\ No newline at end of file
diff --git a/build/assets/etc/haproxy/errors-custom/400.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
similarity index 99%
rename from build/assets/etc/haproxy/errors-custom/400.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
index 8e653cb..3dd81bb 100644
--- a/build/assets/etc/haproxy/errors-custom/400.http
+++ b/build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
@@ -4,7 +4,7 @@ Connection: close
 Content-Type: text/html
 
 <!DOCTYPE html>
-<html>
+<html>Ins
   <head>
     <meta charset="UTF-8">
     <title>400 Bad request</title>
diff --git a/build/assets/etc/haproxy/errors-custom/403.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/403.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/403.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/403.http
diff --git a/build/assets/etc/haproxy/errors-custom/408.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/408.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/408.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/408.http
diff --git a/build/assets/etc/haproxy/errors-custom/500.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/500.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/500.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/500.http
diff --git a/build/assets/etc/haproxy/errors-custom/502.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/502.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/502.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/502.http
diff --git a/build/assets/etc/haproxy/errors-custom/503.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/503.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/503.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/503.http
diff --git a/build/assets/etc/haproxy/errors-custom/504.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/504.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/504.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/504.http
diff --git a/build/assets/etc/haproxy/conf.d/README.md b/build/assets/etc/haproxy/conf.d/README.md
deleted file mode 100644
index 661ea82..0000000
--- a/build/assets/etc/haproxy/conf.d/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Custom HAProxy
-
-Put files .cfg to be included in the configuration
diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index f988247..7ed6e75 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -3,8 +3,8 @@ services:
     image: byjg/easy-haproxy:5.0.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - certs_certbot:/certs/certbot
-      - certs_haproxy:/certs/haproxy
+      - certs_certbot:/etc/easyhaproxy/certs/certbot
+      - certs_haproxy:/etc/easyhaproxy/certs/haproxy
 
     environment:
       EASYHAPROXY_DISCOVER: docker
diff --git a/docs/Plugins/cleanup.md b/docs/Plugins/cleanup.md
index d1d9ef4..e19bfb2 100644
--- a/docs/Plugins/cleanup.md
+++ b/docs/Plugins/cleanup.md
@@ -28,7 +28,7 @@ Prevents disk space issues by automatically cleaning up temporary files created
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 plugins:
   enabled: [cleanup]
   config:
@@ -53,7 +53,7 @@ Configure the Cleanup plugin globally:
 ### Custom Idle Time (1 hour)
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 plugins:
   enabled: [cleanup]
   config:
diff --git a/docs/Plugins/cloudflare.md b/docs/Plugins/cloudflare.md
index 8949c1e..c3cc77a 100644
--- a/docs/Plugins/cloudflare.md
+++ b/docs/Plugins/cloudflare.md
@@ -17,11 +17,11 @@ Cloudflare replaces the visitor's IP with its own. This plugin restores the orig
 
 ## Configuration Options
 
-| Option            | Description                              | Default                           |
-|-------------------|------------------------------------------|-----------------------------------|
-| `enabled`         | Enable/disable plugin                    | `true`                            |
-| `use_builtin_ips` | Use built-in Cloudflare IP ranges        | `true`                            |
-| `ip_list_path`    | Path to Cloudflare IP list               | `/etc/haproxy/cloudflare_ips.lst` |
+| Option            | Description                              | Default                               |
+|-------------------|------------------------------------------|---------------------------------------|
+| `enabled`         | Enable/disable plugin                    | `true`                                |
+| `use_builtin_ips` | Use built-in Cloudflare IP ranges        | `true`                                |
+| `ip_list_path`    | Path to Cloudflare IP list               | `/etc/easyhaproxy/cloudflare_ips.lst` |
 
 ## Configuration Examples
 
@@ -55,7 +55,7 @@ kind: Ingress
 metadata:
   annotations:
     easyhaproxy.plugins: "cloudflare"
-    easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
+    easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/easyhaproxy/cloudflare_ips.lst"
 spec:
   rules:
     - host: example.com
@@ -72,7 +72,7 @@ spec:
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 plugins:
   config:
     cloudflare:
@@ -84,11 +84,11 @@ plugins:
 
 Configure Cloudflare plugin defaults for all domains:
 
-| Environment Variable                            | Config Key        | Type     | Default                           | Description                           |
-|-------------------------------------------------|-------------------|----------|-----------------------------------|---------------------------------------|
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_ENABLED`         | `enabled`         | boolean  | `true`                            | Enable/disable plugin for all domains |
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_USE_BUILTIN_IPS` | `use_builtin_ips` | boolean  | `true`                            | Use built-in Cloudflare IP ranges     |
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_IP_LIST_PATH`    | `ip_list_path`    | string   | `/etc/haproxy/cloudflare_ips.lst` | Path to Cloudflare IP list file       |
+| Environment Variable                            | Config Key        | Type     | Default                               | Description                           |
+|-------------------------------------------------|-------------------|----------|---------------------------------------|---------------------------------------|
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_ENABLED`         | `enabled`         | boolean  | `true`                                | Enable/disable plugin for all domains |
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_USE_BUILTIN_IPS` | `use_builtin_ips` | boolean  | `true`                                | Use built-in Cloudflare IP ranges     |
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_IP_LIST_PATH`    | `ip_list_path`    | string   | `/etc/easyhaproxy/cloudflare_ips.lst` | Path to Cloudflare IP list file       |
 
 **Note:** Environment variables set defaults for ALL domains. To enable/disable per-domain, use container labels or Kubernetes annotations.
 
@@ -96,7 +96,7 @@ Configure Cloudflare plugin defaults for all domains:
 
 ```haproxy
 # Cloudflare - Restore original visitor IP
-acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst
+acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst
 http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)] if from_cloudflare
 ```
 
@@ -114,7 +114,7 @@ The plugin includes the current Cloudflare IP ranges (22 ranges total):
 - 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32
 - 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32
 
-These ranges are automatically written to `/etc/haproxy/cloudflare_ips.lst` during each discovery cycle.
+These ranges are automatically written to `/etc/easyhaproxy/cloudflare_ips.lst` during each discovery cycle.
 
 ## Important Notes
 
diff --git a/docs/Plugins/deny-pages.md b/docs/Plugins/deny-pages.md
index b62673b..c23a580 100644
--- a/docs/Plugins/deny-pages.md
+++ b/docs/Plugins/deny-pages.md
@@ -73,7 +73,7 @@ spec:
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 containers:
   "example.com:80":
     ip: ["webapp:80"]
diff --git a/docs/Plugins/fastcgi.md b/docs/Plugins/fastcgi.md
index 28db516..0427988 100644
--- a/docs/Plugins/fastcgi.md
+++ b/docs/Plugins/fastcgi.md
@@ -20,7 +20,7 @@ Automatically generates HAProxy `fcgi-app` configuration that defines required C
 | Option            | Description                             | Default                            |
 |-------------------|-----------------------------------------|------------------------------------|
 | `enabled`         | Enable/disable plugin                   | `true`                             |
-| `document_root`   | Document root path                      | `/var/www/html`                    |
+| `document_root`   | Document root path                      | `/etc/easyhaproxy/www`             |
 | `script_filename` | Custom pattern for SCRIPT_FILENAME      | `%[path]` (uses HAProxy's default) |
 | `index_file`      | Default index file                      | `index.php`                        |
 | `path_info`       | Enable PATH_INFO support                | `true`                             |
@@ -40,10 +40,10 @@ services:
       easyhaproxy.http.localport: 9000
       easyhaproxy.http.proto: fcgi
       easyhaproxy.http.plugins: fastcgi
-      easyhaproxy.http.plugin.fastcgi.document_root: /var/www/html
+      easyhaproxy.http.plugin.fastcgi.document_root: /etc/easyhaproxy/www
       easyhaproxy.http.plugin.fastcgi.index_file: index.php
     volumes:
-      - ./app:/var/www/html
+      - ./app:/etc/easyhaproxy/www
 ```
 
 ### Docker/Docker Compose (Unix socket)
@@ -57,10 +57,10 @@ services:
       easyhaproxy.http.socket: /run/php/php-fpm.sock
       easyhaproxy.http.proto: fcgi
       easyhaproxy.http.plugins: fastcgi
-      easyhaproxy.http.plugin.fastcgi.document_root: /var/www/html
+      easyhaproxy.http.plugin.fastcgi.document_root: /etc/easyhaproxy/www
       easyhaproxy.http.plugin.fastcgi.index_file: index.php
     volumes:
-      - ./app:/var/www/html
+      - ./app:/etc/easyhaproxy/www
       - /run/php:/run/php
 ```
 
@@ -82,7 +82,7 @@ kind: Ingress
 metadata:
   annotations:
     easyhaproxy.plugins: "fastcgi"
-    easyhaproxy.plugin.fastcgi.document_root: "/var/www/html"
+    easyhaproxy.plugin.fastcgi.document_root: "/etc/easyhaproxy/www"
     easyhaproxy.plugin.fastcgi.index_file: "index.php"
 spec:
   rules:
@@ -100,7 +100,7 @@ spec:
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 easymapping:
   - host: phpapp.local
     port: 80
@@ -110,7 +110,7 @@ easymapping:
       - fastcgi
     plugin_config:
       fastcgi:
-        document_root: /var/www/html
+        document_root: /etc/easyhaproxy/www
         index_file: index.php
         path_info: true
 ```
@@ -122,7 +122,7 @@ Configure FastCGI plugin defaults for all domains:
 | Environment Variable                         | Config Key        | Type     | Default         | Description                           |
 |----------------------------------------------|-------------------|----------|-----------------|---------------------------------------|
 | `EASYHAPROXY_PLUGIN_FASTCGI_ENABLED`         | `enabled`         | boolean  | `true`          | Enable/disable plugin for all domains |
-| `EASYHAPROXY_PLUGIN_FASTCGI_DOCUMENT_ROOT`   | `document_root`   | string   | `/var/www/html` | Document root path                    |
+| `EASYHAPROXY_PLUGIN_FASTCGI_DOCUMENT_ROOT`   | `document_root`   | string   | `/etc/easyhaproxy/www` | Document root path                    |
 | `EASYHAPROXY_PLUGIN_FASTCGI_SCRIPT_FILENAME` | `script_filename` | string   | `%[path]`       | Custom pattern for SCRIPT_FILENAME    |
 | `EASYHAPROXY_PLUGIN_FASTCGI_INDEX_FILE`      | `index_file`      | string   | `index.php`     | Default index file                    |
 | `EASYHAPROXY_PLUGIN_FASTCGI_PATH_INFO`       | `path_info`       | boolean  | `true`          | Enable PATH_INFO support              |
@@ -136,7 +136,7 @@ The plugin generates a top-level `fcgi-app` section and a `use-fcgi-app` directi
 ```haproxy
 # Top-level fcgi-app definition (added after defaults, before frontends/backends)
 fcgi-app fcgi_phpapp_local
-    docroot /var/www/html
+    docroot /etc/easyhaproxy/www
     index index.php
     path-info ^(/.+\.php)(/.*)?$
 
diff --git a/docs/Plugins/ip-whitelist.md b/docs/Plugins/ip-whitelist.md
index 2ae8f15..c64e7dd 100644
--- a/docs/Plugins/ip-whitelist.md
+++ b/docs/Plugins/ip-whitelist.md
@@ -72,7 +72,7 @@ spec:
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 easymapping:
   - host: admin.example.com
     port: 443
diff --git a/docs/Plugins/jwt-validator.md b/docs/Plugins/jwt-validator.md
index a1b5570..9cd4db8 100644
--- a/docs/Plugins/jwt-validator.md
+++ b/docs/Plugins/jwt-validator.md
@@ -77,9 +77,9 @@ services:
       easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
       easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
       easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
     volumes:
-      - ./pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
 ```
 
 ### Protect Specific Paths Only
@@ -87,7 +87,7 @@ services:
 ```yaml
 labels:
   easyhaproxy.http.plugins: jwt_validator
-  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
   easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
   easyhaproxy.http.plugin.jwt_validator.only_paths: false
 # /api/health, /api/docs, etc. remain publicly accessible
@@ -98,7 +98,7 @@ labels:
 ```yaml
 labels:
   easyhaproxy.http.plugins: jwt_validator
-  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
   easyhaproxy.http.plugin.jwt_validator.paths: /api/public,/api/v1
   easyhaproxy.http.plugin.jwt_validator.only_paths: true
 # All paths except /api/public and /api/v1 are denied
@@ -110,7 +110,7 @@ labels:
 labels:
   easyhaproxy.http.plugin.jwt_validator.issuer: none
   easyhaproxy.http.plugin.jwt_validator.audience: none
-  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+  easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
 ```
 
 ### Allow Anonymous Access (Optional JWT)
@@ -121,10 +121,10 @@ services:
     labels:
       easyhaproxy.http.host: api.example.com
       easyhaproxy.http.plugins: jwt_validator
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
       easyhaproxy.http.plugin.jwt_validator.allow_anonymous: true
     volumes:
-      - ./pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
 # Requests without Authorization header are allowed
 # Requests with Authorization header are validated
 # Invalid JWTs are rejected
@@ -204,7 +204,7 @@ metadata:
     easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
     easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
     easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
-    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
     easyhaproxy.plugin.jwt_validator.paths: "/api/admin,/api/users"
     easyhaproxy.plugin.jwt_validator.only_paths: "false"
 spec:
@@ -227,7 +227,7 @@ spec:
 ### Static YAML Configuration
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 containers:
   "api.example.com:443":
     ip: ["api-service:8080"]
@@ -238,7 +238,7 @@ containers:
         algorithm: RS256
         issuer: https://auth.example.com/
         audience: https://api.example.com
-        pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
 ```
 
 ### Environment Variables
@@ -277,7 +277,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
 http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
 http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ }
 http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
 
 # Validate expiration
 http-request set-var(txn.now) date()
@@ -303,7 +303,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
 
 # Validate JWT (only on protected paths)
 http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 } if jwt_protected_path
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 } if jwt_protected_path
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 } if jwt_protected_path
 
 # Validate expiration
 http-request set-var(txn.now) date() if jwt_protected_path
@@ -332,7 +332,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
 
 # Validate JWT (all requests at this point are on allowed paths)
 http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
 
 # Validate expiration
 http-request set-var(txn.now) date()
@@ -356,7 +356,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
 http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 } if { req.hdr(authorization) -m found }
 http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ } if { req.hdr(authorization) -m found }
 http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com } if { req.hdr(authorization) -m found }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 } if { req.hdr(authorization) -m found }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 } if { req.hdr(authorization) -m found }
 
 # Validate expiration (only if Authorization header is present)
 http-request set-var(txn.now) date() if { req.hdr(authorization) -m found }
diff --git a/docs/acme.md b/docs/acme.md
index 1e1765f..5aa3ac2 100644
--- a/docs/acme.md
+++ b/docs/acme.md
@@ -33,7 +33,7 @@ At a high level, ACME with Easy HAProxy works in two stages:
      - Manually setting `EASYHAPROXY_CERTBOT_SERVER` (and `EASYHAPROXY_CERTBOT_EAB_KID` / `EASYHAPROXY_CERTBOT_EAB_HMAC_KEY` when your CA requires EAB).
    - Always set your contact email via `EASYHAPROXY_CERTBOT_EMAIL`.
    - Ensure ports 80 and 443 are publicly reachable on the EasyHAProxy host.
-   - Persist the folder `/certs/certbot` on a durable volume so issued/renewed certificates survive container restarts and avoid hitting CA rate limits.
+   - Persist the folder `/etc/easyhaproxy/certs/certbot` on a durable volume so issued/renewed certificates survive container restarts and avoid hitting CA rate limits.
    - Challenge method is HTTP-01 only; EasyHAProxy configures a standalone Certbot responder internally.
 
 2. Enable ACME per domain (per service/app)
@@ -44,7 +44,7 @@ At a high level, ACME with Easy HAProxy works in two stages:
 What happens under the hood
 - When a labeled domain is detected and a certificate is needed, EasyHAProxy runs Certbot with `--preferred-challenges http` and a standalone responder bound to internal port 2080.
 - HAProxy temporarily routes `/.well-known/acme-challenge/` for that domain to the Certbot responder, allowing the CA to validate via HTTP-01.
-- On success, EasyHAProxy merges the issued cert and key and stores them under `/certs/certbot` (one PEM per domain), then reloads HAProxy to serve HTTPS for that domain.
+- On success, EasyHAProxy merges the issued cert and key and stores them under `/etc/easyhaproxy/certs/certbot` (one PEM per domain), then reloads HAProxy to serve HTTPS for that domain.
 - Certificates are monitored and renewed automatically before expiry.
 
 Tips
@@ -105,7 +105,7 @@ docker run \
     -e EASYHAPROXY_CERTBOT_EMAIL=john@doe.com \
     -p 80:80 \
     -p 443:443 \
-    -v /path/to/guest/certbot/certs:/certs/certbot \
+    -v /path/to/guest/certbot/certs:/etc/easyhaproxy/certs/certbot \
     ... \
     byjg/easy-haproxy
 ```
@@ -118,7 +118,7 @@ docker run \
 
 :::danger Important: Persist Certbot Certificates
 To avoid hitting rate limits and certificate issuing problems:
-- **You must persist** the container folder `/certs/certbot` outside the container
+- **You must persist** the container folder `/etc/easyhaproxy/certs/certbot` outside the container
 - **Never delete or modify** its contents manually
 - If you don't persist this folder, or if you delete/modify its contents, certificate issuing may not work properly and you may hit rate limits
 ::: 
diff --git a/docs/environment-variable.md b/docs/environment-variable.md
index e591616..68ad738 100644
--- a/docs/environment-variable.md
+++ b/docs/environment-variable.md
@@ -4,20 +4,21 @@ sidebar_position: 12
 
 # Docker environment variables
 
-| Environment Variable     | Description                                                                                                                                                                                    | Default       |
-|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
-| EASYHAPROXY_DISCOVER     | How the services will be discovered to create `haproxy.cfg`:  `static`, `docker`, `swarm` or `kubernetes`                                                                                      | **required**  |
-| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources.                                                                                                                                         | `easyhaproxy` |
-| EASYHAPROXY_CERTBOT_*    | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md)                                                                                                       | *empty*       |
-| EASYHAPROXY_SSL_MODE     | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`     |
-| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds.                                                                                                                                  | 10            |
-| EASYHAPROXY_LOG_LEVEL    | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                | DEBUG         |
-| CERTBOT_LOG_LEVEL        | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | DEBUG         |
-| HAPROXY_LOG_LEVEL        | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | INFO          |
-| HAPROXY_USERNAME         | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set).                                                                                        | `admin`       |
-| HAPROXY_PASSWORD         | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined.                                                                                    | *empty*       |
-| HAPROXY_STATS_PORT       | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined.                                                         | `1936`        |
-| HAPROXY_CUSTOMERRORS     | (Optional) If HAProxy will use custom HTML errors. true/false.                                                                                                                                 | `false`       |
+| Environment Variable     | Description                                                                                                                                                                                    | Default            |
+|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
+| EASYHAPROXY_DISCOVER     | How the services will be discovered to create `haproxy.cfg`:  `static`, `docker`, `swarm` or `kubernetes`                                                                                      | **required**       |
+| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources.                                                                                                                                         | `easyhaproxy`      |
+| EASYHAPROXY_BASE_PATH    | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base.                                                            | `/etc/easyhaproxy` |
+| EASYHAPROXY_CERTBOT_*    | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md)                                                                                                       | *empty*            |
+| EASYHAPROXY_SSL_MODE     | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`          |
+| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds.                                                                                                                                  | 10                 |
+| EASYHAPROXY_LOG_LEVEL    | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                | DEBUG              |
+| CERTBOT_LOG_LEVEL        | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | DEBUG              |
+| HAPROXY_LOG_LEVEL        | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | INFO               |
+| HAPROXY_USERNAME         | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set).                                                                                        | `admin`            |
+| HAPROXY_PASSWORD         | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined.                                                                                     | *empty*            |
+| HAPROXY_STATS_PORT       | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined.                                                         | `1936`             |
+| HAPROXY_CUSTOMERRORS     | (Optional) If HAProxy will use custom HTML errors. true/false.                                                                                                                                 | `false`            |
 
 :::tip HAProxy Stats
 Statistics are only configured when `HAPROXY_PASSWORD` is set. Without a password, the stats section is not generated.
diff --git a/docs/kubernetes.md b/docs/kubernetes.md
index d220751..0a3cdf4 100644
--- a/docs/kubernetes.md
+++ b/docs/kubernetes.md
@@ -177,7 +177,7 @@ metadata:
     easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
     easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
     easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
-    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
 spec:
   ingressClassName: easyhaproxy
 ```
diff --git a/docs/other.md b/docs/other.md
index cc45282..173c322 100644
--- a/docs/other.md
+++ b/docs/other.md
@@ -36,18 +36,18 @@ docker run \
 
 ## Mapping custom .cfg files
 
-You can concatenate valid HAProxy `.cfg` files to the dynamically generated `haproxy.cfg` by mapping the folder `/etc/haproxy/conf.d`.
+You can concatenate valid HAProxy `.cfg` files to the dynamically generated `haproxy.cfg` by mapping the folder `/etc/easyhaproxy/haproxy/conf.d`.
 
 ```bash title="Mount custom config directory"
 docker run \
     /* other parameters */
-    -v /your/local/conf.d:/etc/haproxy/conf.d \
+    -v /your/local/conf.d:/etc/easyhaproxy/haproxy/conf.d \
     -d byjg/easy-haproxy
 ```
 
 ## Setting Custom Errors
 
-If enabled, map the volume : `/etc/haproxy/errors-custom/` to your container and put a file named `ERROR_NUMBER.http`
+If enabled, map the volume : `/etc/easyhaproxy/haproxy/errors-custom/` to your container and put a file named `ERROR_NUMBER.http`
 where ERROR_NUMBER is the HTTP error code (e.g., `503.http`)
 
 ----
diff --git a/docs/plugin-development.md b/docs/plugin-development.md
index fbcc520..29e1d0c 100644
--- a/docs/plugin-development.md
+++ b/docs/plugin-development.md
@@ -127,7 +127,7 @@ Execute **once per discovered domain/host**.
 ### Plugin Loading Order
 
 1. **Builtin plugins** - Loaded from `/src/plugins/builtin/`
-2. **External plugins** - Loaded from `/etc/haproxy/plugins/`
+2. **External plugins** - Loaded from `/etc/easyhaproxy/plugins/`
 
 Plugins are discovered automatically by filename (`*.py` excluding `__*.py`).
 
@@ -160,10 +160,10 @@ HAProxy Reload
 
 ### Step 1: Create Plugin File
 
-Create a new Python file in `/etc/haproxy/plugins/` (or builtin location for core plugins):
+Create a new Python file in `/etc/easyhaproxy/plugins/` (or builtin location for core plugins):
 
 ```python
-# /etc/haproxy/plugins/my_plugin.py
+# /etc/easyhaproxy/plugins/my_plugin.py
 
 import os
 import sys
@@ -248,7 +248,7 @@ services:
 **Via YAML configuration:**
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 plugins:
   enabled: [my_plugin]
   config:
@@ -521,13 +521,13 @@ return PluginResult(
 return PluginResult(
     haproxy_config="use-fcgi-app fcgi_example_com",
     global_configs=[
-        "fcgi-app fcgi_example_com\n    docroot /var/www/html"
+        "fcgi-app fcgi_example_com\n    docroot /etc/easyhaproxy/www"
     ]
 )
 
 # With defaults-level config (new in v2.0)
 return PluginResult(
-    haproxy_config="acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst",
+    haproxy_config="acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst",
     defaults_configs=[
         'log-format "%{+Q}[var(txn.real_ip)]:-/%ci:%cp [%tr] %ft %b/%s"'
     ]
@@ -551,7 +551,7 @@ class PluginManager:
 
         Args:
             plugins_dir: Directory containing plugin files (defaults to
-                        EASYHAPROXY_PLUGINS_DIR env var or /etc/haproxy/plugins)
+                        EASYHAPROXY_PLUGINS_DIR env var or /etc/easyhaproxy/plugins)
             abort_on_error: If True, abort on plugin errors; if False, log and continue
         """
 
@@ -573,7 +573,7 @@ class PluginManager:
 
 **Environment Variables:**
 
-- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/haproxy/plugins`)
+- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/easyhaproxy/plugins`)
 
 **Note:** You typically don't interact with PluginManager directly when writing plugins. It's used by EasyHAProxy core.
 
@@ -712,7 +712,7 @@ The plugin creates:
 
 Configuration:
     - enabled: Enable/disable the plugin (default: true)
-    - document_root: Document root path (default: /var/www/html)
+    - document_root: Document root path (default: /etc/easyhaproxy/www)
     - script_filename: Pattern for SCRIPT_FILENAME (default: %[path])
     - index_file: Default index file (default: index.php)
     - path_info: Enable PATH_INFO support (default: true)
@@ -722,7 +722,7 @@ Example YAML config:
     plugins:
       fastcgi:
         enabled: true
-        document_root: /var/www/html
+        document_root: /etc/easyhaproxy/www
         index_file: index.php
         path_info: true
 
@@ -748,7 +748,7 @@ class FastcgiPlugin(PluginInterface):
 
     def __init__(self):
         self.enabled = True
-        self.document_root = "/var/www/html"
+        self.document_root = "/etc/easyhaproxy/www"
         self.script_filename = "%[path]"
         self.index_file = "index.php"
         self.path_info = True
@@ -885,7 +885,7 @@ Example YAML config:
         algorithm: RS256
         issuer: https://myaccount.auth0.com/
         audience: https://api.mywebsite.com
-        pubkey_path: /etc/haproxy/jwt_keys/pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/pubkey.pem
         paths:
           - /api/admin
           - /api/sensitive
@@ -896,7 +896,7 @@ Example Container Label:
     easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
     easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
     easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-    easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+    easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
     easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
     easyhaproxy.http.plugin.jwt_validator.only_paths: true
 """
@@ -1267,7 +1267,7 @@ class CleanupPlugin(PluginInterface):
 
 ### Core Environment Variables
 
-- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/haproxy/plugins`)
+- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/easyhaproxy/plugins`)
 - `EASYHAPROXY_PLUGINS_ENABLED` - Comma-separated list of enabled plugins
 - `EASYHAPROXY_PLUGINS_ABORT_ON_ERROR` - Abort on plugin errors (default: `false`)
 
@@ -1685,7 +1685,7 @@ services:
       - "443:443"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - ./my_plugin.py:/etc/haproxy/plugins/my_plugin.py
+      - ./my_plugin.py:/etc/easyhaproxy/plugins/my_plugin.py
     environment:
       - EASYHAPROXY_DISCOVER=docker
 ```
@@ -1707,7 +1707,7 @@ Expected output:
 **Verify generated configuration:**
 
 ```bash
-docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
+docker-compose exec haproxy cat /etc/easyhaproxy/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
 ```
 
 ---
@@ -1722,13 +1722,13 @@ docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
 
 1. **File not in plugins directory**
    ```bash
-   ls -la /etc/haproxy/plugins/
+   ls -la /etc/easyhaproxy/plugins/
    # Ensure my_plugin.py exists
    ```
 
 2. **Invalid Python syntax**
    ```bash
-   python3 -m py_compile /etc/haproxy/plugins/my_plugin.py
+   python3 -m py_compile /etc/easyhaproxy/plugins/my_plugin.py
    # Check for syntax errors
    ```
 
@@ -1814,7 +1814,7 @@ docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
 1. **Invalid HAProxy syntax in generated config**
    ```bash
    # Test configuration manually:
-   haproxy -c -f /etc/haproxy/haproxy.cfg
+   haproxy -c -f /etc/easyhaproxy/haproxy/haproxy.cfg
    ```
 
 2. **Missing quotes or escaping**
@@ -1907,7 +1907,7 @@ Share your plugin as a single `.py` file:
 
 ```bash
 # Users copy the file to their plugins directory:
-cp my_plugin.py /etc/haproxy/plugins/
+cp my_plugin.py /etc/easyhaproxy/plugins/
 ```
 
 **Advantages:**
@@ -1935,7 +1935,7 @@ my-easyhaproxy-plugin/
 **Installation:**
 ```bash
 # Users download and install:
-wget https://raw.githubusercontent.com/user/my-plugin/main/my_plugin.py -O /etc/haproxy/plugins/my_plugin.py
+wget https://raw.githubusercontent.com/user/my-plugin/main/my_plugin.py -O /etc/easyhaproxy/plugins/my_plugin.py
 ```
 
 #### Option 3: Docker Image with Plugin
@@ -1949,7 +1949,7 @@ FROM byjg/easy-haproxy:latest
 COPY my_plugin.py /app/src/plugins/builtin/
 
 # Optional: Add default configuration
-COPY plugin_config.yaml /etc/haproxy/static/config.yaml
+COPY plugin_config.yaml /etc/easyhaproxy/static/config.yaml
 ```
 
 **Build and distribute:**
@@ -1977,7 +1977,7 @@ Brief description of what your plugin does.
 
 ### Docker
 \`\`\`bash
-wget https://example.com/my_plugin.py -O /etc/haproxy/plugins/my_plugin.py
+wget https://example.com/my_plugin.py -O /etc/easyhaproxy/plugins/my_plugin.py
 \`\`\`
 
 ### Kubernetes
diff --git a/docs/plugins.md b/docs/plugins.md
index 9adda9a..cb10c44 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -71,7 +71,7 @@ metadata:
     easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
     easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
     easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
-    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
     easyhaproxy.plugin.jwt_validator.paths: "/api/admin,/api/users"
     easyhaproxy.plugin.jwt_validator.only_paths: "false"
     # Configure deny_pages plugin
@@ -124,7 +124,7 @@ services:
 
 ### 3. Static YAML Configuration
 
-Configure plugins in `/etc/haproxy/static/config.yaml`:
+Configure plugins in `/etc/easyhaproxy/static/config.yaml`:
 
 ```yaml
 plugins:
@@ -200,9 +200,9 @@ services:
       easyhaproxy.http.plugins: jwt_validator
       easyhaproxy.http.plugin.jwt_validator.issuer: https://auth0.myapp.com/
       easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
     volumes:
-      - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
 ```
 
 **Protect only admin/sensitive endpoints:**
@@ -213,11 +213,11 @@ services:
     labels:
       easyhaproxy.http.host: api.example.com
       easyhaproxy.http.plugins: jwt_validator
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
       easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/users,/api/billing
       easyhaproxy.http.plugin.jwt_validator.only_paths: false
     volumes:
-      - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
 # /api/health, /api/docs, etc. remain publicly accessible
 ```
 
@@ -229,11 +229,11 @@ services:
     labels:
       easyhaproxy.http.host: api.example.com
       easyhaproxy.http.plugins: jwt_validator
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
       easyhaproxy.http.plugin.jwt_validator.paths: /api/v1,/api/v2
       easyhaproxy.http.plugin.jwt_validator.only_paths: true
     volumes:
-      - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
 # All paths except /api/v1 and /api/v2 are denied
 ```
 
@@ -287,7 +287,7 @@ labels:
 Keep your system clean with automatic temp file removal:
 
 ```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
 plugins:
   enabled: [cleanup]
   config:
@@ -346,13 +346,13 @@ EASYHAPROXY_LOG_LEVEL=DEBUG
 INFO: Loaded builtin plugin: cloudflare (domain)
 INFO: Loaded builtin plugin: cleanup (global)
 DEBUG: Executing domain plugin: cloudflare for domain: example.com
-DEBUG: Plugin cloudflare metadata: {'domain': 'example.com', 'ip_list_path': '/etc/haproxy/cloudflare_ips.lst'}
+DEBUG: Plugin cloudflare metadata: {'domain': 'example.com', 'ip_list_path': '/etc/easyhaproxy/cloudflare_ips.lst'}
 ```
 
 ### Plugin Not Loading
 
 **Check:**
-1. Plugin file exists in `/etc/haproxy/plugins/` or builtin directory
+1. Plugin file exists in `/etc/easyhaproxy/plugins/` or builtin directory
 2. Python syntax is valid
 3. Plugin class inherits from `PluginInterface`
 4. Check logs for load errors
diff --git a/docs/ssl.md b/docs/ssl.md
index 0c50b01..40ceaac 100644
--- a/docs/ssl.md
+++ b/docs/ssl.md
@@ -43,7 +43,7 @@ Add the Base64 string you generated before to the label `easyhaproxy.[definition
 
 ## Map the certificate as a docker volume
 
-EasyHAProxy stores the certificates inside the container folder `/certs/haproxy`.
+EasyHAProxy stores the certificates inside the container folder `/etc/easyhaproxy/certs/haproxy`.
 
 1. Run EasyHAProxy with the volume for the certificates:
 
@@ -52,7 +52,7 @@ docker volume create certs_haproxy
 
 docker run \
     /* other parameters */
-    -v certs_haproxy:/certs/haproxy \
+    -v certs_haproxy:/etc/easyhaproxy/certs/haproxy \
     -d byjg/easy-haproxy
 ```
 
@@ -77,7 +77,7 @@ MIIEojCCA4qgAwIBAgIUegW2BimwuL4RzRZ2WYkHA6U5nkAwDQYJKoZIhvcNAQEL
 3. Copy this certificate to EasyHAProxy volume:
 
 ```bash title="Copy certificate to container"
-docker cp single.pem easyhaproxy:/certs/haproxy
+docker cp single.pem easyhaproxy:/etc/easyhaproxy/certs/haproxy
 ```
 
 ----
diff --git a/docs/static.md b/docs/static.md
index e9e17f8..77aa9bb 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -66,12 +66,12 @@ The `containers` format simplifies static configuration:
 - **Clearer mapping**: Format mirrors internal Docker label structure
 :::
 
-Then map this file to `/etc/haproxy/static/config.yml` in your EasyHAProxy container:
+Then map this file to `/etc/easyhaproxy/static/config.yml` in your EasyHAProxy container:
 
 ```bash title="Run EasyHAProxy with static configuration"
 docker run -d \
       --name easy-haproxy-container \
-      -v /my/static/:/etc/haproxy/static/ \
+      -v /my/static/:/etc/easyhaproxy/static/ \
       -e EASYHAPROXY_DISCOVER="static" \
       # + Environment Variables \
       -p 80:80 \
diff --git a/docs/volumes.md b/docs/volumes.md
index c738523..176402e 100644
--- a/docs/volumes.md
+++ b/docs/volumes.md
@@ -8,15 +8,193 @@ sidebar_position: 13
 These volumes allow you to persist certificates, provide custom configurations, and extend EasyHAProxy functionality.
 :::
 
-You can map the following volumes:
+## Directory Structure
 
-| Volume                      | Description                                                                                                                   |
-|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|
-| /etc/haproxy/static/        | The folder that will contain the [config.yml](static.md) file for static configuration                                        |
-| /certs/haproxy/             | The folder that will contain the certificates (`PEM`) for the [SSL](ssl.md)                                                   |
-| /certs/certbot/             | The folder that will contain the certificates (`PEM`) processed by Certbot (e.g. Let's Encrypt). More info: [acme](acme.md).  |
-| /etc/haproxy/conf.d/        | The folder that will contain the [custom configuration](other.md) files.                                                      |
-| /etc/haproxy/errors-custom/ | The folder that will contain the [custom error](other.md) html files.                                                         |
+:::info Base Path
+All EasyHAProxy files are organized under `/etc/easyhaproxy/`. This can be customized using the `EASYHAPROXY_BASE_PATH` environment variable.
+:::
+
+```plaintext title="/etc/easyhaproxy/ Directory Tree"
+/etc/easyhaproxy/
+├── static/                             # 🔧 Runtime (static mode only)
+│   └── config.yml                      # Static service configuration
+│
+├── haproxy/
+│   ├── haproxy.cfg                     # 🔧 Runtime - Generated HAProxy config
+│   ├── conf.d/                         # 📦 Base image
+│   │   ├── README.md
+│   │   └── *.cfg                       # User-provided custom configs
+│   ├── dhparam                         # 📦 Base image - DH params 2048-bit
+│   ├── dhparam-1024                    # 📦 Base image - DH params 1024-bit
+│   └── errors-custom/                  # 📦 Base image
+│       ├── 400.http                    # Bad Request
+│       ├── 403.http                    # Forbidden
+│       ├── 408.http                    # Request Timeout
+│       ├── 500.http                    # Internal Server Error
+│       ├── 502.http                    # Bad Gateway
+│       ├── 503.http                    # Service Unavailable
+│       └── 504.http                    # Gateway Timeout
+│
+├── certs/
+│   ├── live/                           # 🔧 Runtime (Certbot)
+│   │   └── {domain}/
+│   │       ├── cert.pem                # Certificate only
+│   │       ├── chain.pem               # Certificate chain
+│   │       ├── fullchain.pem           # cert.pem + chain.pem
+│   │       ├── privkey.pem             # Private key
+│   │       └── README
+│   ├── archive/                        # 🔧 Runtime (Certbot)
+│   │   └── {domain}/
+│   │       ├── cert1.pem, cert2.pem... # Versioned certificates
+│   │       └── privkey1.pem...         # Versioned keys
+│   ├── work/                           # 🔧 Runtime (Certbot working dir)
+│   ├── logs/                           # 🔧 Runtime (Certbot logs)
+│   │   └── letsencrypt.log
+│   ├── certbot/                        # 📦 Base image
+│   │   ├── {domain}.pem                # 🔧 Runtime - Merged cert+key
+│   │   └── placeholder.pem             # 📦 Base image - Placeholder cert
+│   └── haproxy/                        # 📦 Base image
+│       ├── {domain}.pem                # User-provided cert+key (PEM format)
+│       └── placeholder.pem             # 📦 Base image - Placeholder cert
+│
+├── plugins/                            # Optional - Custom plugins
+│   └── *.py                            # Python plugin files
+│
+├── jwt_keys/                           # Optional - JWT validation
+│   └── *.pem                           # RSA public keys
+│
+├── cloudflare_ips.lst                  # Optional - Cloudflare plugin
+│
+└── www/                                # Optional - FastCGI document root
+    └── index.php
+```
+
+:::tip Legend
+- **📦 Base image** - Included in the Docker image
+- **🔧 Runtime** - Created/generated when EasyHAProxy runs
+- **Optional** - Created only when specific features are used
+:::
+
+## Common Volume Mappings
+
+The most commonly mapped volumes for persistence and customization:
+
+| Volume                                    | Purpose                                                                                               | Required |
+|-------------------------------------------|-------------------------------------------------------------------------------------------------------|----------|
+| `/etc/easyhaproxy/static/`                | [Static configuration](static.md) - mount your `config.yml` here                                      | Optional |
+| `/etc/easyhaproxy/certs/haproxy/`         | [SSL certificates](ssl.md) - user-provided certificates in PEM format                                 | Optional |
+| `/etc/easyhaproxy/certs/certbot/`         | [ACME/Certbot certificates](acme.md) - auto-generated Let's Encrypt certificates                      | Optional |
+| `/etc/easyhaproxy/certs/live/`            | Certbot live certificates - persist across container restarts                                         | Optional |
+| `/etc/easyhaproxy/haproxy/conf.d/`        | [Custom HAProxy config](other.md) - additional `.cfg` files to include                                | Optional |
+| `/etc/easyhaproxy/haproxy/errors-custom/` | [Custom error pages](other.md) - custom HTTP error pages (400, 403, 500, etc.)                        | Optional |
+| `/etc/easyhaproxy/plugins/`               | [Custom plugins](plugins.md) - Python plugin files                                                    | Optional |
+| `/etc/easyhaproxy/jwt_keys/`              | [JWT public keys](Plugins/jwt-validator.md) - RSA public keys for JWT validation                      | Optional |
+| `/etc/easyhaproxy/www/`                   | [FastCGI document root](Plugins/fastcgi.md) - PHP/FastCGI application files                           | Optional |
+
+## Directory Details
+
+### Configuration Files
+
+#### Static Configuration
+```bash
+/etc/easyhaproxy/static/config.yml
+```
+Static service configuration when not using service discovery (Docker/Kubernetes).
+
+:::note
+This directory only exists when `EASYHAPROXY_DISCOVER=static` is set.
+:::
+
+#### HAProxy Configuration
+```bash
+/etc/easyhaproxy/haproxy/haproxy.cfg
+```
+Auto-generated HAProxy configuration file.
+
+:::warning Do Not Edit
+This file is automatically generated by EasyHAProxy. Any manual changes will be overwritten.
+:::
+
+#### Custom Configuration Snippets
+```bash
+/etc/easyhaproxy/haproxy/conf.d/*.cfg
+```
+Place custom HAProxy configuration snippets here. These files are automatically included in the main configuration.
+
+:::tip Example
+```bash
+# Mount your custom config
+docker run -v ./my-custom.cfg:/etc/easyhaproxy/haproxy/conf.d/my-custom.cfg byjg/easy-haproxy
+```
+:::
+
+### SSL/TLS Certificates
+
+#### User-Provided Certificates
+```bash
+/etc/easyhaproxy/certs/haproxy/{domain}.pem
+```
+Place your SSL certificates here in PEM format (certificate + private key combined).
+
+:::info PEM Format
+```bash
+cat domain.crt domain.key > /etc/easyhaproxy/certs/haproxy/domain.com.pem
+```
+:::
+
+#### ACME/Let's Encrypt Certificates
+```bash
+/etc/easyhaproxy/certs/certbot/{domain}.pem  # Merged cert+key for HAProxy
+/etc/easyhaproxy/certs/live/{domain}/        # Certbot live certificates (symlinks)
+/etc/easyhaproxy/certs/archive/{domain}/     # Versioned certificate archive
+```
+
+EasyHAProxy automatically merges Certbot certificates from `/etc/easyhaproxy/certs/live/` into `/etc/easyhaproxy/certs/certbot/` for HAProxy consumption.
+
+:::tip Persist Certbot Certificates
+```yaml
+volumes:
+  - certbot-certs:/etc/easyhaproxy/certs/live
+  - certbot-archive:/etc/easyhaproxy/certs/archive
+```
+:::
+
+### Plugins & Extensions
+
+#### Custom Plugins
+```bash
+/etc/easyhaproxy/plugins/*.py
+```
+Add custom Python plugins to extend EasyHAProxy functionality.
+
+See [Plugin Development](plugin-development.md) for details.
+
+#### JWT Public Keys
+```bash
+/etc/easyhaproxy/jwt_keys/*.pem
+```
+RSA public keys for [JWT token validation](Plugins/jwt-validator.md).
+
+#### Cloudflare IP Ranges
+```bash
+/etc/easyhaproxy/cloudflare_ips.lst
+```
+Cloudflare IP ranges for the [Cloudflare plugin](Plugins/cloudflare.md) to restore real client IPs.
+
+### Error Pages
+
+```bash
+/etc/easyhaproxy/haproxy/errors-custom/{code}.http
+```
+
+Custom HTTP error pages (400, 403, 408, 500, 502, 503, 504). Default error pages are included in the base image.
+
+:::tip Customize Error Pages
+```bash
+# Mount your custom 503 error page
+docker run -v ./custom-503.http:/etc/easyhaproxy/haproxy/errors-custom/503.http byjg/easy-haproxy
+```
+:::
 
 ----
 [Open source ByJG](http://opensource.byjg.com)
diff --git a/pyproject.toml b/pyproject.toml
index 4098b84..07f707a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -67,6 +67,7 @@ markers = [
     "cloudflare: marks tests for Cloudflare IP restoration plugin",
     "custom_label: marks tests for custom label prefix functionality",
     "static: marks tests for static configuration mode",
+    "acme: marks tests for certbot/acme",
 ]
 
 [tool.ruff]
diff --git a/src/functions/__init__.py b/src/functions/__init__.py
index 98dc194..77761e3 100644
--- a/src/functions/__init__.py
+++ b/src/functions/__init__.py
@@ -271,12 +271,55 @@ class Functions:
             return [-99, e]
 
 
+class classproperty:
+    """Decorator for class-level properties."""
+    def __init__(self, func):
+        self.func = func
+
+    def __get__(self, obj, owner):
+        return self.func(owner)
+
+
 class Consts:
-    easyhaproxy_config = "/etc/haproxy/static/config.yml"
-    haproxy_config = "/etc/haproxy/haproxy.cfg"
-    custom_config_folder = "/etc/haproxy/conf.d"
-    certs_certbot = "/certs/certbot"
-    certs_haproxy = "/certs/haproxy"
+    """Configuration constants with dynamic path resolution based on EASYHAPROXY_BASE_PATH."""
+    _base_path = None
+
+    @classproperty
+    def base_path(cls):
+        """Base directory for all EasyHAProxy files."""
+        if cls._base_path is None:
+            cls._base_path = os.getenv("EASYHAPROXY_BASE_PATH", "/etc/easyhaproxy")
+        return cls._base_path
+
+    @classmethod
+    def reset(cls):
+        """Reset cached base path to pick up environment variable changes."""
+        cls._base_path = None
+
+    @classproperty
+    def easyhaproxy_config(cls):
+        """Path to static configuration file."""
+        return f"{cls.base_path}/static/config.yml"
+
+    @classproperty
+    def haproxy_config(cls):
+        """Path to generated HAProxy configuration file."""
+        return f"{cls.base_path}/haproxy/haproxy.cfg"
+
+    @classproperty
+    def custom_config_folder(cls):
+        """Path to custom HAProxy config snippets directory."""
+        return f"{cls.base_path}/haproxy/conf.d"
+
+    @classproperty
+    def certs_certbot(cls):
+        """Path to Certbot/ACME certificates directory."""
+        return f"{cls.base_path}/certs/certbot"
+
+    @classproperty
+    def certs_haproxy(cls):
+        """Path to user-provided certificates directory."""
+        return f"{cls.base_path}/certs/haproxy"
 
 
 class DaemonizeHAProxy:
@@ -304,12 +347,12 @@ class DaemonizeHAProxy:
             custom_config_files = f"-f {self.custom_config_folder}"
 
         if action == DaemonizeHAProxy.HAPROXY_START or not os.path.exists(pid_file):
-            return f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg {custom_config_files} -p {pid_file} -S /var/run/haproxy.sock"
+            return f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} {custom_config_files} -p {pid_file} -S /var/run/haproxy.sock"
         else:
             return_code, output = Functions().run_bash(logger_haproxy, f"cat {pid_file}", log_output=False)
             pid = "".join(output).rstrip()
             if psutil.pid_exists(int(pid)):
-                return f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg {custom_config_files} -p {pid_file} -x /var/run/haproxy.sock -sf {pid}"
+                return f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} {custom_config_files} -p {pid_file} -x /var/run/haproxy.sock -sf {pid}"
             else:
                 os.unlink(pid_file)
                 logger_haproxy.warning(
@@ -440,6 +483,9 @@ class Certbot:
                     renew_certs.append(host_arg)
 
             certbot_certonly = ('/usr/bin/certbot certonly {acme_server}'
+                                '    --config-dir {base_path}/certs'
+                                '    --work-dir {base_path}/certs/work'
+                                '    --logs-dir {base_path}/certs/logs'
                                 '    --preferred-challenges {challenge}'
                                 '    --agree-tos'
                                 '    --issuance-timeout 90'
@@ -452,7 +498,8 @@ class Certbot:
                                                                      certs=' '.join(request_certs),
                                                                      email=self.email,
                                                                      challenge=self.certbot_preferred_challenges,
-                                                                     acme_server=self.acme_server)
+                                                                     acme_server=self.acme_server,
+                                                                     base_path=Consts.base_path)
                                 )
 
             if 'http' in self.certbot_preferred_challenges:
@@ -476,7 +523,8 @@ class Certbot:
                 ret_reload = True
 
             if len(renew_certs) > 0:
-                return_code_renew, output = Functions.run_bash(logger_certbot, "/usr/bin/certbot renew", return_result=False)
+                certbot_renew = f"/usr/bin/certbot renew --config-dir {Consts.base_path}/certs --work-dir {Consts.base_path}/certs/work --logs-dir {Consts.base_path}/certs/logs"
+                return_code_renew, output = Functions.run_bash(logger_certbot, certbot_renew, return_result=False)
                 ret_reload = True
 
             if ret_reload:
@@ -497,7 +545,7 @@ class Certbot:
         Functions.save(filename, cert + key)
 
     def find_live_certificates(self):
-        certbot_certs = "/etc/letsencrypt/live/"
+        certbot_certs = f"{Consts.base_path}/certs/live/"
         if not os.path.exists(certbot_certs):
             return
         for item in os.listdir(certbot_certs):
diff --git a/src/plugins/__init__.py b/src/plugins/__init__.py
index fb48b95..859ecc6 100644
--- a/src/plugins/__init__.py
+++ b/src/plugins/__init__.py
@@ -6,7 +6,7 @@ from dataclasses import dataclass, field
 from enum import Enum
 from typing import Any
 
-from functions import logger_easyhaproxy
+from functions import logger_easyhaproxy, Consts
 
 
 class PluginType(Enum):
@@ -108,12 +108,12 @@ class PluginManager:
         Initialize the plugin manager
 
         Args:
-            plugins_dir: Directory containing plugin files (defaults to EASYHAPROXY_PLUGINS_DIR env var or /etc/haproxy/plugins)
+            plugins_dir: Directory containing plugin files (defaults to EASYHAPROXY_PLUGINS_DIR env var or /etc/easyhaproxy/plugins)
             abort_on_error: If True, abort on plugin errors; if False, log and continue
         """
         self.plugins_dir = plugins_dir or os.getenv(
             "EASYHAPROXY_PLUGINS_DIR",
-            "/etc/haproxy/plugins"
+            Consts.base_path + "/plugins"
         )
         self.abort_on_error = abort_on_error
         self.plugins: dict[str, PluginInterface] = {}
diff --git a/src/plugins/builtin/cloudflare.py b/src/plugins/builtin/cloudflare.py
index 9e57509..180e4e6 100644
--- a/src/plugins/builtin/cloudflare.py
+++ b/src/plugins/builtin/cloudflare.py
@@ -8,7 +8,7 @@ The plugin includes built-in Cloudflare IP ranges that are automatically
 updated and written to the IP list file.
 
 Configuration:
-    - ip_list_path: Path to file containing Cloudflare IP ranges (default: /etc/haproxy/cloudflare_ips.lst)
+    - ip_list_path: Path to file containing Cloudflare IP ranges (default: /etc/easyhaproxy/cloudflare_ips.lst)
     - ip_list: Base64-encoded list of IP ranges (one per line), takes precedence over ip_list_path
     - use_builtin_ips: Use built-in Cloudflare IP ranges (default: true)
     - update_log_format: Update HAProxy log format to show real visitor IP (default: true)
@@ -17,7 +17,7 @@ Example YAML config:
     plugins:
       cloudflare:
         enabled: true
-        ip_list_path: /etc/haproxy/cloudflare_ips.lst
+        ip_list_path: /etc/easyhaproxy/cloudflare_ips.lst
         use_builtin_ips: true
         update_log_format: true
 
@@ -32,7 +32,7 @@ Example Container Label:
 
 HAProxy Config Generated:
     # Cloudflare - Restore original visitor IP
-    acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst
+    acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst
     http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP) if from_cloudflare
     http-request set-header X-Forwarded-For %[var(txn.real_ip)] if from_cloudflare
 
@@ -48,7 +48,7 @@ import sys
 # Add parent directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
-from functions import logger_easyhaproxy
+from functions import logger_easyhaproxy, Consts
 from plugins import InitializationResult, PluginContext, PluginInterface, PluginResult, PluginType, ResourceRequest
 
 
@@ -85,7 +85,7 @@ class CloudflarePlugin(PluginInterface):
     ]
 
     def __init__(self):
-        self.ip_list_path = "/etc/haproxy/cloudflare_ips.lst"
+        self.ip_list_path = Consts.base_path + "/cloudflare_ips.lst"
         self.enabled = True
         self.use_builtin_ips = True
         self.update_log_format = True
diff --git a/src/plugins/builtin/fastcgi.py b/src/plugins/builtin/fastcgi.py
index a63a5a1..f99855e 100644
--- a/src/plugins/builtin/fastcgi.py
+++ b/src/plugins/builtin/fastcgi.py
@@ -10,7 +10,7 @@ The plugin creates:
 
 Configuration:
     - enabled: Enable/disable the plugin (default: true)
-    - document_root: Document root path (default: /var/www/html)
+    - document_root: Document root path (default: /etc/easyhaproxy/www)
     - script_filename: Pattern for SCRIPT_FILENAME (default: %[path])
     - index_file: Default index file (default: index.php)
     - path_info: Enable PATH_INFO support (default: true)
@@ -39,6 +39,8 @@ Example Kubernetes Annotation:
 import os
 import sys
 
+from functions import Consts
+
 # Add parent directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
@@ -50,7 +52,7 @@ class FastcgiPlugin(PluginInterface):
 
     def __init__(self):
         self.enabled = True
-        self.document_root = "/var/www/html"
+        self.document_root = Consts.base_path + "/www"
         self.script_filename = "%[path]"
         self.index_file = "index.php"
         self.path_info = True
diff --git a/src/plugins/builtin/jwt_validator.py b/src/plugins/builtin/jwt_validator.py
index 3901e1d..1187ec0 100644
--- a/src/plugins/builtin/jwt_validator.py
+++ b/src/plugins/builtin/jwt_validator.py
@@ -47,7 +47,7 @@ Example YAML config:
         algorithm: RS256
         issuer: https://myaccount.auth0.com/
         audience: https://api.mywebsite.com
-        pubkey_path: /etc/haproxy/jwt_keys/pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/pubkey.pem
         paths:
           - /api/admin
           - /api/sensitive
@@ -58,7 +58,7 @@ Example Container Label:
     easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
     easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
     easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-    easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+    easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
     easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
     easyhaproxy.http.plugin.jwt_validator.only_paths: true
 
@@ -86,7 +86,7 @@ HAProxy Config Generated:
     http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
     http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ }
     http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com }
-    http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+    http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
 
     # Validate expiration
     http-request set-var(txn.now) date()
@@ -100,7 +100,7 @@ import sys
 # Add parent directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
-from functions import Functions, logger_easyhaproxy
+from functions import Functions, logger_easyhaproxy, Consts
 from plugins import InitializationResult, PluginContext, PluginInterface, PluginResult, PluginType, ResourceRequest
 
 
@@ -118,7 +118,7 @@ class JwtValidatorPlugin(PluginInterface):
         self.only_paths = False  # If true, only specified paths are accessible
         self.allow_anonymous = False  # If true, allow requests without Authorization header
         # Make JWT_KEYS_DIR configurable via environment variable (for testing)
-        self.jwt_keys_dir = os.getenv("EASYHAPROXY_JWT_KEYS_DIR", "/etc/haproxy/jwt_keys")
+        self.jwt_keys_dir = os.getenv("EASYHAPROXY_JWT_KEYS_DIR", Consts.base_path + "/jwt_keys")
 
     @property
     def name(self) -> str:
diff --git a/src/templates/bind.j2 b/src/templates/bind.j2
index d69de8f..a4b879d 100644
--- a/src/templates/bind.j2
+++ b/src/templates/bind.j2
@@ -1,5 +1,5 @@
     {% if "ssl" in o %}
-    bind *:{{ o["port"] }}  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:{{ o["port"] }}  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     {% elif "h2" in o and o["h2"] %}
     bind *:{{ o["port"] }} proto h2
     option http-use-htx
diff --git a/src/templates/haproxy.cfg.j2 b/src/templates/haproxy.cfg.j2
index a50ac50..86eb965 100644
--- a/src/templates/haproxy.cfg.j2
+++ b/src/templates/haproxy.cfg.j2
@@ -31,13 +31,13 @@ defaults
     timeout client    10s
     timeout server    10m
 {% if data["customerrors"] %}
-    errorfile 400 /etc/haproxy/errors-custom/400.http
-    errorfile 403 /etc/haproxy/errors-custom/403.http
-    errorfile 408 /etc/haproxy/errors-custom/408.http
-    errorfile 500 /etc/haproxy/errors-custom/500.http
-    errorfile 502 /etc/haproxy/errors-custom/502.http
-    errorfile 503 /etc/haproxy/errors-custom/503.http
-    errorfile 504 /etc/haproxy/errors-custom/504.http
+    errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+    errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+    errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+    errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+    errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+    errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+    errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
 {% endif %}
 {% if defaults_plugin_configs %}
 
diff --git a/src/templates/ssl_default.j2 b/src/templates/ssl_default.j2
index 0357561..8548b23 100644
--- a/src/templates/ssl_default.j2
+++ b/src/templates/ssl_default.j2
@@ -9,4 +9,4 @@
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
diff --git a/src/templates/ssl_loose.j2 b/src/templates/ssl_loose.j2
index 0dafc55..6a244f9 100644
--- a/src/templates/ssl_loose.j2
+++ b/src/templates/ssl_loose.j2
@@ -6,5 +6,5 @@
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam-1024
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
 
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..99c67ce
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,43 @@
+"""
+Pytest configuration and fixtures for EasyHAProxy tests.
+
+This module provides session-wide and function-level fixtures for testing.
+"""
+
+import os
+import shutil
+import tempfile
+import pytest
+
+
+# Create a session-wide temporary directory for all tests
+# Use a different prefix to avoid conflicts with cleanup plugin (which looks for "easyhaproxy_*")
+_test_session_dir = tempfile.mkdtemp(prefix="pytest_easyhaproxy_")
+os.environ["EASYHAPROXY_BASE_PATH"] = _test_session_dir
+
+
+@pytest.fixture(scope="function", autouse=True)
+def reset_consts():
+    """
+    Reset Consts before and after each test.
+
+    This ensures:
+    1. Each test picks up the EASYHAPROXY_BASE_PATH environment variable
+    2. Tests don't get permission errors trying to write to /etc/easyhaproxy/
+    3. Consts path cache is cleared between tests for isolation
+    """
+    from functions import Consts
+    Consts.reset()
+    yield
+    Consts.reset()
+
+
+def pytest_sessionfinish(session, exitstatus):
+    """
+    Cleanup session temporary directory after all tests complete.
+    """
+    try:
+        shutil.rmtree(_test_session_dir)
+    except Exception:
+        # Ignore cleanup errors
+        pass
\ No newline at end of file
diff --git a/tests/expected/docker.txt b/tests/expected/docker.txt
index 536d339..215f21f 100644
--- a/tests/expected/docker.txt
+++ b/tests/expected/docker.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
@@ -38,7 +38,7 @@ backend srv_stats
     server Local 127.0.0.1:1936
 
 frontend http_in_443
-    bind *:443  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:443  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     mode http
 
     acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local
diff --git a/tests/expected/no-services.txt b/tests/expected/no-services.txt
index a898508..0fb7fe8 100644
--- a/tests/expected/no-services.txt
+++ b/tests/expected/no-services.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
diff --git a/tests/expected/services-fcgi.txt b/tests/expected/services-fcgi.txt
index f7c1bf5..6051ee0 100644
--- a/tests/expected/services-fcgi.txt
+++ b/tests/expected/services-fcgi.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
diff --git a/tests/expected/services-letsencrypt.txt b/tests/expected/services-letsencrypt.txt
index ffb28c6..8a4110d 100644
--- a/tests/expected/services-letsencrypt.txt
+++ b/tests/expected/services-letsencrypt.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
@@ -21,13 +21,13 @@ defaults
     timeout connect    3s
     timeout client    10s
     timeout server    10m
-    errorfile 400 /etc/haproxy/errors-custom/400.http
-    errorfile 403 /etc/haproxy/errors-custom/403.http
-    errorfile 408 /etc/haproxy/errors-custom/408.http
-    errorfile 500 /etc/haproxy/errors-custom/500.http
-    errorfile 502 /etc/haproxy/errors-custom/502.http
-    errorfile 503 /etc/haproxy/errors-custom/503.http
-    errorfile 504 /etc/haproxy/errors-custom/504.http
+    errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+    errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+    errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+    errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+    errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+    errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+    errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
 
 
 frontend stats
@@ -76,7 +76,7 @@ backend srv_test2_example_org_80
     server srv-0 83d57d592e26:8080 check weight 1
 
 frontend http_in_443
-    bind *:443  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:443  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     mode http
 
     acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org
diff --git a/tests/expected/services-multi-containers.txt b/tests/expected/services-multi-containers.txt
index 0cfedd8..6517bb7 100644
--- a/tests/expected/services-multi-containers.txt
+++ b/tests/expected/services-multi-containers.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
diff --git a/tests/expected/services-multiple-hosts.txt b/tests/expected/services-multiple-hosts.txt
index 0b3a64d..a49a0e0 100644
--- a/tests/expected/services-multiple-hosts.txt
+++ b/tests/expected/services-multiple-hosts.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
@@ -21,13 +21,13 @@ defaults
     timeout connect    3s
     timeout client    10s
     timeout server    10m
-    errorfile 400 /etc/haproxy/errors-custom/400.http
-    errorfile 403 /etc/haproxy/errors-custom/403.http
-    errorfile 408 /etc/haproxy/errors-custom/408.http
-    errorfile 500 /etc/haproxy/errors-custom/500.http
-    errorfile 502 /etc/haproxy/errors-custom/502.http
-    errorfile 503 /etc/haproxy/errors-custom/503.http
-    errorfile 504 /etc/haproxy/errors-custom/504.http
+    errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+    errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+    errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+    errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+    errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+    errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+    errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
 
 
 frontend stats
diff --git a/tests/expected/services-redirect-ssl.txt b/tests/expected/services-redirect-ssl.txt
index 8c51afc..57b1091 100644
--- a/tests/expected/services-redirect-ssl.txt
+++ b/tests/expected/services-redirect-ssl.txt
@@ -9,7 +9,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam-1024
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
 
 
 defaults
@@ -50,7 +50,7 @@ backend srv_host1_local_80
     server srv-0 5b69bc7fea1b:80 check weight 1
 
 frontend http_in_443
-    bind *:443  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:443  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     mode http
 
     acl is_rule_host2_local_443_1 hdr(host) -i host2.local
diff --git a/tests/expected/services-tcp.txt b/tests/expected/services-tcp.txt
index f9a41bd..f5422e0 100644
--- a/tests/expected/services-tcp.txt
+++ b/tests/expected/services-tcp.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
diff --git a/tests/expected/services.txt b/tests/expected/services.txt
index 2c876f9..df0bba0 100644
--- a/tests/expected/services.txt
+++ b/tests/expected/services.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
@@ -68,7 +68,7 @@ backend srv_node-exporter_quantum_example_org_31337
     server srv-0 my-stack_node-exporter:9100 check weight 1
 
 frontend http_in_443
-    bind *:443  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:443  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     mode http
     redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
     redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
diff --git a/tests/expected/ssl-loose.txt b/tests/expected/ssl-loose.txt
index e9cb61f..3aeae3c 100644
--- a/tests/expected/ssl-loose.txt
+++ b/tests/expected/ssl-loose.txt
@@ -9,7 +9,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam-1024
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
 
 
 defaults
diff --git a/tests/expected/static.txt b/tests/expected/static.txt
index ad98988..b10f8ac 100644
--- a/tests/expected/static.txt
+++ b/tests/expected/static.txt
@@ -12,7 +12,7 @@ global
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
 
-    ssl-dh-param-file /etc/haproxy/dhparam
+    ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
 
 defaults
     log global
@@ -21,13 +21,13 @@ defaults
     timeout connect    3s
     timeout client    10s
     timeout server    10m
-    errorfile 400 /etc/haproxy/errors-custom/400.http
-    errorfile 403 /etc/haproxy/errors-custom/403.http
-    errorfile 408 /etc/haproxy/errors-custom/408.http
-    errorfile 500 /etc/haproxy/errors-custom/500.http
-    errorfile 502 /etc/haproxy/errors-custom/502.http
-    errorfile 503 /etc/haproxy/errors-custom/503.http
-    errorfile 504 /etc/haproxy/errors-custom/504.http
+    errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+    errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+    errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+    errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+    errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+    errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+    errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
 
 
 frontend stats
@@ -46,7 +46,7 @@ backend srv_stats
     server Local 127.0.0.1:1936
 
 frontend http_in_443
-    bind *:443  ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+    bind *:443  ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
     mode http
 
     acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
diff --git a/tests/fixtures/services-with-multiple-plugins b/tests/fixtures/services-with-multiple-plugins
index 1b13766..c57c6ab 100644
--- a/tests/fixtures/services-with-multiple-plugins
+++ b/tests/fixtures/services-with-multiple-plugins
@@ -4,7 +4,6 @@
         "easyhaproxy.http.port": "80",
         "easyhaproxy.http.localport": "8080",
         "easyhaproxy.http.plugins": "cloudflare,deny_pages",
-        "easyhaproxy.http.plugin.cloudflare.ip_list_path": "/etc/haproxy/cloudflare_ips.lst",
         "easyhaproxy.http.plugin.deny_pages.paths": "/admin,/private",
         "easyhaproxy.http.plugin.deny_pages.status_code": "403"
     }
diff --git a/tests/test_daemonize.py b/tests/test_daemonize.py
index 2612adf..6ddb9f7 100644
--- a/tests/test_daemonize.py
+++ b/tests/test_daemonize.py
@@ -1,4 +1,5 @@
 import os
+from functions import Consts
 
 from functions import DaemonizeHAProxy
 
@@ -15,12 +16,12 @@ def test_daemonize_haproxy_check_config():
 def test_daemonize_haproxy_get_haproxy_command_start():
     daemon = DaemonizeHAProxy()
     command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
-    assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg  -p /run/haproxy.pid -S /var/run/haproxy.sock"
+    assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config}  -p /run/haproxy.pid -S /var/run/haproxy.sock"
 
 def test_daemonize_haproxy_get_haproxy_command_reload_nopid():
     daemon = DaemonizeHAProxy()
     command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD)
-    assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg  -p /run/haproxy.pid -S /var/run/haproxy.sock"
+    assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config}  -p /run/haproxy.pid -S /var/run/haproxy.sock"
 
 def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
     daemon = DaemonizeHAProxy()
@@ -28,7 +29,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
         with open("/tmp/temp.pid", 'w') as file:
             file.write("-1001")
         command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
-        assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg  -p /tmp/temp.pid -S /var/run/haproxy.sock"
+        assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config}  -p /tmp/temp.pid -S /var/run/haproxy.sock"
     finally:
         assert not os.path.exists("/tmp/temp.pid")
 
@@ -38,7 +39,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_existing_pin():
         with open("/tmp/temp.pid", 'w') as file:
             file.write("1")
         command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
-        assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg  -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
+        assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config}  -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
     finally:
         assert os.path.exists("/tmp/temp.pid")
         os.unlink("/tmp/temp.pid")
@@ -54,4 +55,4 @@ def test_daemonize_haproxy2_check_config():
 def test_daemonize_haproxy2_get_haproxy_command_start():
     daemon = DaemonizeHAProxy(os.path.abspath(os.path.dirname(__file__))  + '/fixtures')
     command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
-    assert command == f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
+    assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
diff --git a/tests/test_plugins.py b/tests/test_plugins.py
index 72ff173..2cb7f40 100644
--- a/tests/test_plugins.py
+++ b/tests/test_plugins.py
@@ -17,6 +17,7 @@ import time
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
 import easymapping
+from functions import Consts
 from plugins import PluginContext, PluginManager
 from plugins.builtin.cleanup import CleanupPlugin
 from plugins.builtin.cloudflare import CloudflarePlugin
@@ -43,7 +44,7 @@ class TestCloudflarePlugin:
         assert plugin.name == "cloudflare"
         assert plugin.enabled is True
         assert plugin.use_builtin_ips is True
-        assert plugin.ip_list_path == "/etc/haproxy/cloudflare_ips.lst"
+        assert plugin.ip_list_path == f"{Consts.base_path}/cloudflare_ips.lst"
         assert len(plugin.CLOUDFLARE_IPS) == 22  # 15 IPv4 + 7 IPv6
 
     def test_cloudflare_plugin_configuration(self):
@@ -85,11 +86,11 @@ class TestCloudflarePlugin:
 
         assert result.haproxy_config is not None
         assert "Cloudflare" in result.haproxy_config
-        assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in result.haproxy_config
+        assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in result.haproxy_config
         assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in result.haproxy_config
         assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in result.haproxy_config
         assert result.metadata["domain"] == "example.com"
-        assert result.metadata["ip_list_path"] == "/etc/haproxy/cloudflare_ips.lst"
+        assert result.metadata["ip_list_path"] == f"{Consts.base_path}/cloudflare_ips.lst"
 
     def test_cloudflare_plugin_disabled(self):
         """Test plugin returns empty config when disabled"""
@@ -123,7 +124,7 @@ class TestCloudflarePlugin:
 
         # Verify Cloudflare config is in the output
         assert "Cloudflare - Restore original visitor IP" in haproxy_config
-        assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in haproxy_config
+        assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in haproxy_config
         assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in haproxy_config
         assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in haproxy_config
         # Verify log-format is in defaults section (from defaults_configs)
@@ -688,7 +689,7 @@ class TestJwtValidatorPlugin:
             "algorithm": "RS256",
             "issuer": "https://auth.example.com/",
             "audience": "https://api.example.com",
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
         })
 
         context = PluginContext(
@@ -712,7 +713,7 @@ class TestJwtValidatorPlugin:
         assert "var(txn.alg) -m str RS256" in result.haproxy_config
         assert "var(txn.iss) -m str https://auth.example.com/" in result.haproxy_config
         assert "var(txn.aud) -m str https://api.example.com" in result.haproxy_config
-        assert 'jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem")' in result.haproxy_config
+        assert f'jwt_verify(txn.alg,"{Consts.base_path}/jwt_keys/api_pubkey.pem")' in result.haproxy_config
         assert "JWT has expired" in result.haproxy_config
         assert result.metadata["domain"] == "api.example.com"
         assert result.metadata["algorithm"] == "RS256"
@@ -742,7 +743,7 @@ class TestJwtValidatorPlugin:
 
         assert result.haproxy_config is not None
         assert "JWT Validator" in result.haproxy_config
-        assert "/etc/haproxy/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
+        assert f"{Consts.base_path}/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
         # Verify the decoded content is stored in metadata
         assert result.metadata["pubkey_content"] == "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqh...\n-----END PUBLIC KEY-----"
 
@@ -750,7 +751,7 @@ class TestJwtValidatorPlugin:
         """Test plugin skips issuer/audience validation when not configured"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
         })
 
         context = PluginContext(
@@ -775,7 +776,7 @@ class TestJwtValidatorPlugin:
         plugin = JwtValidatorPlugin()
         plugin.configure({
             "enabled": "false",
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
         })
 
         context = PluginContext(
@@ -826,7 +827,7 @@ class TestJwtValidatorPlugin:
         """Test plugin with paths configured and only_paths=false"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
             "paths": ["/api/admin", "/api/sensitive"],
             "only_paths": "false"
         })
@@ -860,7 +861,7 @@ class TestJwtValidatorPlugin:
         """Test plugin with paths configured and only_paths=true"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
             "paths": ["/api/public"],
             "only_paths": "true"
         })
@@ -894,7 +895,7 @@ class TestJwtValidatorPlugin:
         """Test plugin parses comma-separated paths from container labels"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
             "paths": "/api/admin,/api/sensitive,/api/protected"
         })
 
@@ -904,7 +905,7 @@ class TestJwtValidatorPlugin:
         """Test plugin parses paths from list (YAML config)"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
             "paths": ["/api/admin", "/api/sensitive"]
         })
 
@@ -914,7 +915,7 @@ class TestJwtValidatorPlugin:
         """Test plugin protects all paths when paths is not configured"""
         plugin = JwtValidatorPlugin()
         plugin.configure({
-            "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+            "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
         })
 
         context = PluginContext(
@@ -947,7 +948,7 @@ class TestFastcgiPlugin:
 
         assert plugin.name == "fastcgi"
         assert plugin.enabled is True
-        assert plugin.document_root == "/var/www/html"
+        assert plugin.document_root == f"{Consts.base_path}/www"
         assert plugin.index_file == "index.php"
         assert plugin.path_info is True
         assert plugin.custom_params == {}
@@ -969,7 +970,7 @@ class TestFastcgiPlugin:
         """Test plugin generates correct HAProxy config"""
         plugin = FastcgiPlugin()
         plugin.configure({
-            "document_root": "/var/www/html",
+            "document_root": f"{Consts.base_path}/www",
             "index_file": "index.php"
         })
 
@@ -991,9 +992,9 @@ class TestFastcgiPlugin:
         assert len(result.global_configs) == 1
         fcgi_app_def = result.global_configs[0]
         assert "fcgi-app fcgi_phpapp_local" in fcgi_app_def
-        assert "docroot /var/www/html" in fcgi_app_def
+        assert f"docroot {Consts.base_path}/www" in fcgi_app_def
         assert "index index.php" in fcgi_app_def
-        assert result.metadata["document_root"] == "/var/www/html"
+        assert result.metadata["document_root"] == f"{Consts.base_path}/www"
         assert result.metadata["index_file"] == "index.php"
 
     def test_fastcgi_plugin_custom_params(self):
diff --git a/tests_e2e/docker/docker-compose-acme-e2e.yml b/tests_e2e/docker/docker-compose-acme-e2e.yml
index 88c2686..2bde350 100644
--- a/tests_e2e/docker/docker-compose-acme-e2e.yml
+++ b/tests_e2e/docker/docker-compose-acme-e2e.yml
@@ -5,7 +5,7 @@
 # WHAT THIS TESTS:
 # - HAProxy routing of /.well-known/acme-challenge/ to certbot backend
 # - Certbot HTTP-01 challenge completion with Pebble ACME server
-# - Certificate issuance and storage in /certs/certbot/live/{domain}/
+# - Certificate issuance and storage in /etc/easyhaproxy/certs/live/{domain}/
 # - HTTPS serving with issued certificate
 # - Full end-to-end ACME protocol flow
 #
@@ -32,7 +32,7 @@
 # docker compose -f docker-compose-acme-e2e.yml logs haproxy
 #
 # # Verify certificate was issued
-# ls -la ../../certs/certbot/live/test.local/
+# ls -la ../../certs/live/test.local/
 #
 # # Test HTTPS (will show certificate warning - expected for test certs)
 # curl -k https://localhost/ -H "Host: test.local"
@@ -104,7 +104,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Certificate storage (Docker volume for clean test isolation)
-      - certbot-certs:/certs/certbot
+      - certbot-certs:/etc/easyhaproxy/certs
       # Pebble CA certificate (downloaded during test session)
       - ./pebble-ca.pem:/etc/ssl/certs/pebble-ca.pem:ro
     ports:
diff --git a/tests_e2e/docker/docker-compose-acme.yml b/tests_e2e/docker/docker-compose-acme.yml
index 5137ea8..df37d96 100644
--- a/tests_e2e/docker/docker-compose-acme.yml
+++ b/tests_e2e/docker/docker-compose-acme.yml
@@ -20,7 +20,7 @@
 # # - Line 36: easyhaproxy.http.host to your real domain
 #
 # # Create certs directory
-# mkdir -p ./certs/certbot
+# mkdir -p ./certs
 # ```
 #
 # HOW TO START:
@@ -43,7 +43,7 @@
 # # Expected: Issuer: C = US, O = Let's Encrypt
 #
 # # Check certificate files
-# ls -la ./certs/certbot/
+# ls -la ./certs/
 # # Expected: Your domain certificate files
 # ```
 #
@@ -53,7 +53,7 @@
 # # Keep certificates:
 # # docker compose -f docker-compose-acme.yml down
 # # Remove certificates too:
-# # docker compose -f docker-compose-acme.yml down && rm -rf ./certs/certbot
+# # docker compose -f docker-compose-acme.yml down && rm -rf ./certs
 # ```
 #
 # ==============================================================================
@@ -64,7 +64,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Persist the CERTBOT to avoid re-challenge when the server restarts
-      - ./certs/certbot:/certs/certbot
+      - ./certs:/etc/easyhaproxy/certs
     environment:
       EASYHAPROXY_DISCOVER: docker
       HAPROXY_CUSTOMERRORS: "true"
diff --git a/tests_e2e/docker/docker-compose-cloudflare.yml b/tests_e2e/docker/docker-compose-cloudflare.yml
index aa0d456..13a96d9 100644
--- a/tests_e2e/docker/docker-compose-cloudflare.yml
+++ b/tests_e2e/docker/docker-compose-cloudflare.yml
@@ -53,7 +53,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Mount Cloudflare IP list
-      - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
+      - ./cloudflare_ips.lst:/etc/easyhaproxy/cloudflare_ips.lst:ro
     environment:
       EASYHAPROXY_DISCOVER: docker
       HAPROXY_CUSTOMERRORS: "true"
@@ -77,4 +77,4 @@ services:
 
       # Use custom IP list (disable built-in IPs)
       easyhaproxy.http.plugin.cloudflare.use_builtin_ips: false
-      easyhaproxy.http.plugin.cloudflare.ip_list_path: /etc/haproxy/cloudflare_ips.lst
+      easyhaproxy.http.plugin.cloudflare.ip_list_path: /etc/easyhaproxy/cloudflare_ips.lst
diff --git a/tests_e2e/docker/docker-compose-jwt-validator.yml b/tests_e2e/docker/docker-compose-jwt-validator.yml
index d2dd636..019e1c9 100644
--- a/tests_e2e/docker/docker-compose-jwt-validator.yml
+++ b/tests_e2e/docker/docker-compose-jwt-validator.yml
@@ -57,7 +57,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Mount the public key for JWT verification
-      - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
     environment:
       EASYHAPROXY_DISCOVER: docker
       HAPROXY_CUSTOMERRORS: "true"
@@ -85,4 +85,4 @@ services:
       easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
       easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
       easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
diff --git a/tests_e2e/docker/docker-compose-plugins-combined.yml b/tests_e2e/docker/docker-compose-plugins-combined.yml
index ec26370..75a582c 100644
--- a/tests_e2e/docker/docker-compose-plugins-combined.yml
+++ b/tests_e2e/docker/docker-compose-plugins-combined.yml
@@ -68,8 +68,8 @@ services:
     image: byjg/easy-haproxy:local
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
-      - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+      - ./cloudflare_ips.lst:/etc/easyhaproxy/cloudflare_ips.lst:ro
+      - ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
     environment:
       EASYHAPROXY_DISCOVER: docker
       HAPROXY_CUSTOMERRORS: "true"
@@ -114,7 +114,7 @@ services:
       easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
       easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
       easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
-      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
 
       # Block internal/debug endpoints
       easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
diff --git a/tests_e2e/docker/docker-compose-portainer.yml b/tests_e2e/docker/docker-compose-portainer.yml
index 07a279c..3b582d8 100644
--- a/tests_e2e/docker/docker-compose-portainer.yml
+++ b/tests_e2e/docker/docker-compose-portainer.yml
@@ -62,8 +62,8 @@ services:
     image: byjg/easy-haproxy:5.0.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - certs_certbot:/certs/certbot
-#      - certs_haproxy:/certs/haproxy
+      - certs_certbot:/etc/easyhaproxy/certs/certbot
+#      - certs_haproxy:/etc/easyhaproxy/certs/haproxy
 
     environment:
       EASYHAPROXY_DISCOVER: docker
diff --git a/tests_e2e/docker/docker-compose.yml b/tests_e2e/docker/docker-compose.yml
index 460855c..431e2c9 100644
--- a/tests_e2e/docker/docker-compose.yml
+++ b/tests_e2e/docker/docker-compose.yml
@@ -54,7 +54,7 @@ services:
     image: byjg/easy-haproxy:local
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - ./host2.local.pem:/certs/haproxy/host2.local.pem
+      - ./host2.local.pem:/etc/easyhaproxy/certs/haproxy/host2.local.pem
     environment:
       EASYHAPROXY_DISCOVER: docker
       EASYHAPROXY_SSL_MODE: "loose"
diff --git a/tests_e2e/kubernetes/cloudflare.yml b/tests_e2e/kubernetes/cloudflare.yml
index f2d14f6..77c3e25 100644
--- a/tests_e2e/kubernetes/cloudflare.yml
+++ b/tests_e2e/kubernetes/cloudflare.yml
@@ -27,7 +27,7 @@
 # # Edit your EasyHAProxy deployment and add:
 # #   volumeMounts:
 # #     - name: cloudflare-ips
-# #       mountPath: /etc/haproxy/cloudflare_ips.lst
+# #       mountPath: /etc/easyhaproxy/cloudflare_ips.lst
 # #       subPath: cloudflare_ips.lst
 # #   volumes:
 # #     - name: cloudflare-ips
@@ -121,7 +121,7 @@ metadata:
     # easyhaproxy.plugin.cloudflare.ip_list: "MTAuMC4wLjAvOAoxNzIuMTYuMC4wLzEyCjE5Mi4xNjguMC4wLzE2CjEyNy4wLjAuMQ=="
 
     # Optional: Specify custom IP list file path (only used if ip_list is not provided)
-    # easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
+    # easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/easyhaproxy/cloudflare_ips.lst"
   name: webapp-ingress-cloudflare
   namespace: default
 spec:
diff --git a/tests_e2e/kubernetes/jwt-validator.yml b/tests_e2e/kubernetes/jwt-validator.yml
index c31077a..adafc22 100644
--- a/tests_e2e/kubernetes/jwt-validator.yml
+++ b/tests_e2e/kubernetes/jwt-validator.yml
@@ -6,7 +6,7 @@
 # There are three ways to provide the JWT public key:
 #
 # 1. pubkey_path - Mount a file and reference the path (requires ConfigMap or Volume)
-#    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+#    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
 #
 # 2. k8s_secret.pubkey - Reference a Kubernetes secret (RECOMMENDED)
 #    Auto-detect key (tries common variations):
@@ -141,7 +141,7 @@ metadata:
     easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
     easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
     easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
-    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
   name: api-ingress-jwt
   namespace: default
 spec:
diff --git a/tests_e2e/kubernetes/plugins-combined.yml b/tests_e2e/kubernetes/plugins-combined.yml
index fc9ea74..324eadb 100644
--- a/tests_e2e/kubernetes/plugins-combined.yml
+++ b/tests_e2e/kubernetes/plugins-combined.yml
@@ -187,7 +187,7 @@ metadata:
     easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
     easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
     easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
-    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
     # Block internal paths
     easyhaproxy.plugin.deny_pages.paths: "/internal,/debug,/metrics"
     easyhaproxy.plugin.deny_pages.status_code: "403"
diff --git a/tests_e2e/static/README.md b/tests_e2e/static/README.md
index 3955368..a4374a6 100644
--- a/tests_e2e/static/README.md
+++ b/tests_e2e/static/README.md
@@ -18,7 +18,7 @@ Static mode uses explicit YAML configuration files instead of dynamic service di
 
 ## Configuration Files
 
-All scenarios use `/etc/haproxy/static/config.yml` mounted from `./conf/config.yml`.
+All scenarios use `/etc/easyhaproxy/static/config.yml` mounted from `./conf/config.yml`.
 
 Choose one of these pre-made configurations:
 
diff --git a/tests_e2e/static/conf/config-basic.yml b/tests_e2e/static/conf/config-basic.yml
index e1808b0..c7573a8 100644
--- a/tests_e2e/static/conf/config-basic.yml
+++ b/tests_e2e/static/conf/config-basic.yml
@@ -5,8 +5,8 @@
 #
 # To use:
 # 1. Update the container name and ports to match your setup
-# 2. Place SSL certificate at /certs/haproxy/host1.local.pem
-# 3. Mount this config: -v ./conf/config-basic.yml:/etc/haproxy/static/config.yml
+# 2. Place SSL certificate at /etc/easyhaproxy/certs/haproxy/host1.local.pem
+# 3. Mount this config: -v ./conf/config-basic.yml:/etc/easyhaproxy/static/config.yml
 
 stats:
   username: admin
diff --git a/tests_e2e/static/conf/config-certbot.yml b/tests_e2e/static/conf/config-certbot.yml
index 36201f3..216da88 100644
--- a/tests_e2e/static/conf/config-certbot.yml
+++ b/tests_e2e/static/conf/config-certbot.yml
@@ -15,14 +15,14 @@
 #    EASYHAPROXY_CERTBOT_EMAIL=your-email@example.com
 #
 # 4. Mount this config:
-#    -v ./conf/config-certbot.yml:/etc/haproxy/static/config.yml
+#    -v ./conf/config-certbot.yml:/etc/easyhaproxy/static/config.yml
 #
 # 5. Persist certificates:
-#    -v ./certs/certbot:/certs/certbot
+#    -v ./etc/easyhaproxy/certs/certbot:/etc/easyhaproxy/certs/certbot
 #
 # How it works:
 # - EasyHAProxy requests certificates from Let's Encrypt via HTTP-01 challenge
-# - Certificates are stored in /certs/certbot/
+# - Certificates are stored in /etc/easyhaproxy/certs/certbot/
 # - Certificates auto-renew when needed
 #
 # Note: Let's Encrypt has rate limits. Use staging environment for testing:
@@ -56,7 +56,7 @@ containers:
   # Domain without certbot (uses custom certificate)
   "custom.example.com:80":
     ip: ["custom-app:8080"]
-    # No certbot - expects certificate at /certs/haproxy/custom.example.com.pem
+    # No certbot - expects certificate at /etc/easyhaproxy/certs/haproxy/custom.example.com.pem
 
   # HTTPS Port 443
   # Serves HTTPS traffic with auto-generated certificates
@@ -65,7 +65,7 @@ containers:
     ip: ["webapp:8080"]
     ssl: true
     # Certificate path (auto-generated by certbot)
-    # /certs/certbot/example.com/fullchain.pem
+    # /etc/easyhaproxy/certs/certbot/example.com/fullchain.pem
 
   "app.example.com:443":
     ip: ["app:3000"]
@@ -76,7 +76,7 @@ containers:
     ip: ["custom-app:8080"]
     ssl: true
     # Place your certificate at:
-    # /certs/haproxy/custom.example.com.pem
+    # /etc/easyhaproxy/certs/haproxy/custom.example.com.pem
 
 # Multiple domains with different backends
 # Certbot will request separate certificates for each domain
diff --git a/tests_e2e/static/conf/config-deny-pages.yml b/tests_e2e/static/conf/config-deny-pages.yml
index 01309a2..7afec5e 100644
--- a/tests_e2e/static/conf/config-deny-pages.yml
+++ b/tests_e2e/static/conf/config-deny-pages.yml
@@ -6,7 +6,7 @@
 #
 # To use:
 # 1. Update container names and ports
-# 2. Mount this config: -v ./conf/config-deny-pages.yml:/etc/haproxy/static/config.yml
+# 2. Mount this config: -v ./conf/config-deny-pages.yml:/etc/easyhaproxy/static/config.yml
 # 3. Test blocked paths:
 #    curl http://host1.local/admin        # Should return 404
 #    curl http://host2.local/wp-admin     # Should return 403 (different config)
diff --git a/tests_e2e/static/conf/config-jwt-validator.yml b/tests_e2e/static/conf/config-jwt-validator.yml
index 91bf1ed..4fcb560 100644
--- a/tests_e2e/static/conf/config-jwt-validator.yml
+++ b/tests_e2e/static/conf/config-jwt-validator.yml
@@ -11,11 +11,11 @@
 #    openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
 #
 # 2. Mount public keys:
-#    -v ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
-#    -v ./jwt_pubkey2.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
+#    -v ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
+#    -v ./jwt_pubkey2.pem:/etc/easyhaproxy/jwt_keys/admin_pubkey.pem:ro
 #
 # 3. Mount this config:
-#    -v ./conf/config-jwt-validator.yml:/etc/haproxy/static/config.yml
+#    -v ./conf/config-jwt-validator.yml:/etc/easyhaproxy/static/config.yml
 #
 # 4. Test:
 #    # Without token - should fail
@@ -42,7 +42,7 @@ containers:
         algorithm: RS256
         issuer: https://auth.example.com/
         audience: https://api.example.com
-        pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
 
   # Internal API - validate signature only (no issuer/audience check)
   "internal-api.local:80":
@@ -52,7 +52,7 @@ containers:
       jwt_validator:
         algorithm: RS256
         # No issuer/audience = skip those validations
-        pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
 
   # Admin API - different issuer and key
   "admin-api.local:80":
@@ -63,7 +63,7 @@ containers:
         algorithm: RS256
         issuer: https://admin-auth.example.com/
         audience: https://admin.example.com
-        pubkey_path: /etc/haproxy/jwt_keys/admin_pubkey.pem
+        pubkey_path: /etc/easyhaproxy/jwt_keys/admin_pubkey.pem
       deny_pages:
         paths:
           - /internal
diff --git a/tests_e2e/static/docker-compose.yml b/tests_e2e/static/docker-compose.yml
index fc9ac41..832d2b4 100644
--- a/tests_e2e/static/docker-compose.yml
+++ b/tests_e2e/static/docker-compose.yml
@@ -5,7 +5,7 @@
 # WHAT THIS DEMONSTRATES:
 # - EasyHAProxy using static YAML configuration (no service discovery)
 # - Useful for non-containerized backends, VMs, or bare metal servers
-# - Configuration via /etc/haproxy/static/config.yml
+# - Configuration via /etc/easyhaproxy/static/config.yml
 #
 # REQUIREMENTS (run these first):
 # ```bash
@@ -65,10 +65,10 @@ services:
       context: ../..
       dockerfile: build/Dockerfile
     volumes:
-      - ./conf/:/etc/haproxy/static/
-      - ../static/host1.local.pem:/certs/haproxy/host1.local.pem:ro
-      - ../docker/jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
-      - ../docker/jwt_pubkey.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
+      - ./conf/:/etc/easyhaproxy/static/
+      - ../static/host1.local.pem:/etc/easyhaproxy/certs/haproxy/host1.local.pem:ro
+      - ../docker/jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
+      - ../docker/jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/admin_pubkey.pem:ro
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       EASYHAPROXY_DISCOVER: static
diff --git a/tests_e2e/test_docker_compose.py b/tests_e2e/test_docker_compose.py
index 3a2bd4c..2d0a33d 100644
--- a/tests_e2e/test_docker_compose.py
+++ b/tests_e2e/test_docker_compose.py
@@ -201,7 +201,7 @@ class TestBasicSSL:
     def test_haproxy_config(self, docker_compose_basic_ssl):
         """Test HAProxy configuration has SSL and redirect configurations"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -280,7 +280,7 @@ class TestJWTValidator:
     def test_haproxy_config(self, docker_compose_jwt_validator):
         """Test HAProxy configuration has JWT validator rules in the correct backend"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -308,7 +308,7 @@ class TestJWTValidator:
         assert "var(txn.aud) -m str https://api.example.com" in backend_block
 
         # Verify JWT signature verification
-        assert 'jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem")' in backend_block
+        assert 'jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem")' in backend_block
 
         # Verify expiration check
         assert "JWT has expired" in backend_block
@@ -350,7 +350,7 @@ class TestMultiContainers:
     def test_haproxy_config(self, docker_compose_multi_containers):
         """Test HAProxy configuration has multiple backend servers for load balancing"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -409,7 +409,7 @@ class TestPHPFPM:
     def test_haproxy_config(self, docker_compose_php_fpm):
         """Test HAProxy configuration has FastCGI plugin configuration"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -495,7 +495,7 @@ class TestPluginsCombined:
     def test_haproxy_config(self, docker_compose_plugins_combined):
         """Test HAProxy configuration has all plugin configurations in correct backends"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -506,7 +506,7 @@ class TestPluginsCombined:
         website_block = extract_backend_block(config, "srv_website_local_80")
         assert website_block, "Backend srv_website_local_80 not found"
         assert "# Cloudflare - Restore original visitor IP" in website_block
-        assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in website_block
+        assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in website_block
         assert "# Deny Pages - Block specific paths" in website_block
         assert "acl denied_path path_beg /admin /wp-admin /wp-login.php /.env /config" in website_block
         assert "http-request deny deny_status 404 if denied_path" in website_block
@@ -604,7 +604,7 @@ class TestIPWhitelist:
     def test_haproxy_config(self, docker_compose_ip_whitelist):
         """Test HAProxy configuration has IP whitelist rules in the correct backend"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -657,7 +657,7 @@ class TestCloudflare:
     def test_haproxy_config(self, docker_compose_cloudflare):
         """Test HAProxy configuration has Cloudflare plugin rules in the correct backend"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -672,7 +672,7 @@ class TestCloudflare:
         assert "# Cloudflare - Restore original visitor IP" in backend_block
 
         # Verify ACL for Cloudflare IPs
-        assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in backend_block
+        assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in backend_block
 
         # Verify transaction variable for real IP
         assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP) if from_cloudflare" in backend_block
@@ -767,7 +767,7 @@ class TestChangedLabel:
     def test_haproxy_config(self, docker_compose_changed_label):
         """Test HAProxy configuration with custom label prefix"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -878,7 +878,7 @@ class TestACME:
     def test_haproxy_config(self, docker_compose_acme):
         """Test HAProxy configuration has ACME challenge routing"""
         result = subprocess.run(
-            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -952,8 +952,8 @@ class TestACME:
                 f"HAProxy cannot connect to Pebble ACME server. Check docker network.\nLogs:\n{logs[-2000:]}"
 
         # Verify merged certificate file exists
-        # EasyHAProxy merges cert+key from /etc/letsencrypt/live/ to /certs/certbot/{domain}.pem
-        merged_cert_path = "/certs/certbot/test.local.pem"
+        # EasyHAProxy merges cert+key from /etc/easyhaproxy/certs/live/ to /etc/easyhaproxy/certs/certbot/{domain}.pem
+        merged_cert_path = "/etc/easyhaproxy/certs/certbot/test.local.pem"
         result = subprocess.run(
             ["docker", "exec", "docker-haproxy-1", "test", "-f", merged_cert_path],
             capture_output=True
diff --git a/tests_e2e/test_kubernetes.py b/tests_e2e/test_kubernetes.py
index d475a89..b44d466 100644
--- a/tests_e2e/test_kubernetes.py
+++ b/tests_e2e/test_kubernetes.py
@@ -1145,7 +1145,7 @@ class TestIPWhitelist:
         # Get HAProxy configuration
         result = subprocess.run(
             [kubectl, "exec", "-n", "easyhaproxy", pod_name,
-             "--", "cat", "/etc/haproxy/haproxy.cfg"],
+             "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             check=True,
             capture_output=True,
             text=True
@@ -1292,7 +1292,7 @@ class TestJWTValidatorSecret:
         # Get HAProxy configuration
         result = subprocess.run(
             [kubectl, "exec", "-n", "easyhaproxy", pod_name,
-             "--", "cat", "/etc/haproxy/haproxy.cfg"],
+             "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             check=True,
             capture_output=True,
             text=True
@@ -1327,7 +1327,7 @@ class TestJWTValidatorSecret:
             "JWT audience validation not found in API backend"
 
         # Verify JWT keys directory is used in this backend
-        assert "/etc/haproxy/jwt_keys/" in backend_block, \
+        assert "/etc/easyhaproxy/jwt_keys/" in backend_block, \
             "JWT keys directory not found in API backend"
 
     def test_access_without_token_denied(self, k8s_jwt_validator_secret):
@@ -1589,7 +1589,7 @@ class TestCloudflare:
         # Get HAProxy configuration
         result = subprocess.run(
             [kubectl, "exec", "-n", "easyhaproxy", pod_name,
-             "--", "cat", "/etc/haproxy/haproxy.cfg"],
+             "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             check=True,
             capture_output=True,
             text=True
@@ -1606,7 +1606,7 @@ class TestCloudflare:
             "Cloudflare plugin comment not found in myapp backend"
 
         # Verify ACL for Cloudflare IPs is in this backend
-        assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in backend_block, \
+        assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in backend_block, \
             "Cloudflare IP ACL not found in myapp backend"
 
         # Verify real IP extraction from CF-Connecting-IP header is in this backend
@@ -1639,7 +1639,7 @@ class TestCloudflare:
         # Read the Cloudflare IP list file
         result = subprocess.run(
             [kubectl, "exec", "-n", "easyhaproxy", pod_name,
-             "--", "cat", "/etc/haproxy/cloudflare_ips.lst"],
+             "--", "cat", "/etc/easyhaproxy/cloudflare_ips.lst"],
             check=True,
             capture_output=True,
             text=True
diff --git a/tests_e2e/test_static.py b/tests_e2e/test_static.py
index 1747083..83438fa 100644
--- a/tests_e2e/test_static.py
+++ b/tests_e2e/test_static.py
@@ -101,7 +101,7 @@ class TestStaticBasic:
     def test_haproxy_config(self, static_basic):
         """Test HAProxy configuration has SSL and redirect configurations"""
         result = subprocess.run(
-            ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -155,7 +155,7 @@ class TestStaticDenyPages:
     def test_haproxy_config(self, static_deny_pages):
         """Test HAProxy configuration has deny pages rules"""
         result = subprocess.run(
-            ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
@@ -209,7 +209,7 @@ class TestStaticJWTValidator:
     def test_haproxy_config(self, static_jwt_validator):
         """Test HAProxy configuration has JWT validation rules"""
         result = subprocess.run(
-            ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+            ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
             capture_output=True,
             text=True,
             check=True
diff --git a/tests_e2e/utils.py b/tests_e2e/utils.py
index ea20c28..ebf53c5 100644
--- a/tests_e2e/utils.py
+++ b/tests_e2e/utils.py
@@ -10,6 +10,7 @@ import subprocess
 import tempfile
 import time
 from pathlib import Path
+import requests
 import jwt as jwt_lib
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.backends import default_backend
@@ -21,9 +22,12 @@ _docker_image_built = False
 class DockerComposeFixture:
     """Helper class to manage docker-compose lifecycle"""
 
-    def __init__(self, compose_file: str, startup_wait: int = 3, build: bool = None):
+    def __init__(self, compose_file: str, startup_wait: int = 3, build: bool = None,
+                 health_check: callable = None, health_check_timeout: int = 60):
         self.compose_file = compose_file
         self.startup_wait = startup_wait
+        self.health_check = health_check
+        self.health_check_timeout = health_check_timeout
 
         # Smart build strategy: build on first call, skip on subsequent calls
         global _docker_image_built
@@ -60,9 +64,31 @@ class DockerComposeFixture:
         if self.build:
             _docker_image_built = True
 
-        print(f"  ✓ Services started, waiting {self.startup_wait}s for initialization...")
-        time.sleep(self.startup_wait)
-        print(f"  ✓ Services ready")
+        # Use health check if provided, otherwise fall back to fixed delay
+        if self.health_check:
+            print(f"  ✓ Services started, waiting for health check (timeout: {self.health_check_timeout}s)...")
+            start_time = time.time()
+            poll_interval = 1
+
+            while time.time() - start_time < self.health_check_timeout:
+                try:
+                    if self.health_check():
+                        elapsed = time.time() - start_time
+                        print(f"  ✓ Services ready (health check passed in {elapsed:.1f}s)")
+                        return
+                except Exception:
+                    # Health check not ready yet, continue polling
+                    pass
+
+                time.sleep(poll_interval)
+
+            # Health check timed out
+            elapsed = time.time() - start_time
+            raise TimeoutError(f"Health check did not pass within {elapsed:.1f}s")
+        else:
+            print(f"  ✓ Services started, waiting {self.startup_wait}s for initialization...")
+            time.sleep(self.startup_wait)
+            print(f"  ✓ Services ready")
 
     def down(self):
         """Stop and remove docker-compose services"""