diff --git a/ansible/host_vars/contabo01.a13labs.pt.yml b/ansible/host_vars/contabo01.a13labs.pt.yml
index ec887c7..eda7819 100644
--- a/ansible/host_vars/contabo01.a13labs.pt.yml
+++ b/ansible/host_vars/contabo01.a13labs.pt.yml
@@ -84,6 +84,13 @@ fail2ban_jails:
     findtime: 600
     bantime: 3600
 
+# aide
+install_aide: true
+aide_exclude:
+  - "!/var/lib/snapd"
+  - "!/mnt/microk8s_persistent"
+  - "!/var/lib/encrypted_volumes"
+
 # Unattended upgrades
 unattended_reboot: true
 unattended_reboot_time: "04:30"
diff --git a/ansible/roles/cis/defaults/main/aide.yml b/ansible/roles/cis/defaults/main/aide.yml
new file mode 100644
index 0000000..0033aff
--- /dev/null
+++ b/ansible/roles/cis/defaults/main/aide.yml
@@ -0,0 +1,10 @@
+install_aide: true
+aide_exclude: []
+_default_aide_exclude:
+  - "!/var/lib/docker"
+  - "!/var/lib/lxcfs"
+  - "!/var/lib/private/systemd"
+  - "!/var/log/audit"
+  - "!/var/log/journal"
+
+_aide_exclude: "{{ _default_aide_exclude + aide_exclude }}"
diff --git a/ansible/roles/cis/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml
index 1b8cc82..aedf84b 100644
--- a/ansible/roles/cis/defaults/main/misc.yml
+++ b/ansible/roles/cis/defaults/main/misc.yml
@@ -1,5 +1,4 @@
 ---
-install_aide: false
 reboot_ubuntu: false
 redhat_signing_keys:
   - 567E347AD0044ADE55BA8A5F199E2F91FD431D51
diff --git a/ansible/roles/cis/tasks/aide.yml b/ansible/roles/cis/tasks/aide.yml
index 07927f0..198b0a4 100644
--- a/ansible/roles/cis/tasks/aide.yml
+++ b/ansible/roles/cis/tasks/aide.yml
@@ -69,11 +69,9 @@
     backup: true
     insertafter: EOF
     block: |
-      !/var/lib/docker
-      !/var/lib/lxcfs
-      !/var/lib/private/systemd
-      !/var/log/audit
-      !/var/log/journal
+      {% for exclude in _aide_exclude %}
+      {{ exclude }}
+      {% endfor %}
   when: ansible_os_family == "Debian"
   tags:
     - aide
diff --git a/ansible/roles/cis/tasks/main.yml b/ansible/roles/cis/tasks/main.yml
index cb821bb..f9378d7 100644
--- a/ansible/roles/cis/tasks/main.yml
+++ b/ansible/roles/cis/tasks/main.yml
@@ -221,6 +221,13 @@
   tags:
     - roles::cis::extras
 
+- name: Configure aide
+  ansible.builtin.include_tasks: aide.yml
+  when: install_aide
+  tags:
+    - roles::cis::aide
+
+
 - name: Miscellaneous tasks after all handlers
   ansible.builtin.include_tasks: post.yml
   tags:
diff --git a/terraform/k8sapps/chronograf.tf b/terraform/k8sapps/chronograf.tf
index dbb9edf..99ac92a 100644
--- a/terraform/k8sapps/chronograf.tf
+++ b/terraform/k8sapps/chronograf.tf
@@ -145,7 +145,7 @@ resource "kubernetes_deployment" "chronograf" {
         volume {
           name = "persistent-storage"
           host_path {
-            path = "/mnt/microk8s_persistent/chronograf.data"
+            path = "${local.persistent_folder}/chronograf.data"
           }
         }
         volume {
diff --git a/terraform/k8sapps/config.tf b/terraform/k8sapps/config.tf
index 71183df..c2f4383 100644
--- a/terraform/k8sapps/config.tf
+++ b/terraform/k8sapps/config.tf
@@ -44,6 +44,9 @@ locals {
   # notification
   scaleway_smtp_host = "smtp.tem.scw.cloud"
   scaleway_smtp_port = 587
+
+  # storage
+  persistent_folder = "/mnt/microk8s_persistent"
 }
 
 data "scaleway_account_project" "default" {
diff --git a/terraform/k8sapps/gitea.tf b/terraform/k8sapps/gitea.tf
index 2b23f12..0e7fdd0 100644
--- a/terraform/k8sapps/gitea.tf
+++ b/terraform/k8sapps/gitea.tf
@@ -37,8 +37,8 @@ locals {
     }
   }
 
-  gitea_path       = "/mnt/microk8s_persistent/gitea"
-  gitea_mysql_path = "/mnt/microk8s_persistent/mysql.gitea"
+  gitea_path       = "${local.persistent_folder}/gitea"
+  gitea_mysql_path = "${local.persistent_folder}/mysql.gitea"
 }
 
 #
@@ -108,8 +108,9 @@ module "gitea_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
-  cron_schedule  = local.gitea_files_backup_cron_schedule
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.gitea_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 # 
diff --git a/terraform/k8sapps/m3uproxy.tf b/terraform/k8sapps/m3uproxy.tf
index 1b62fa6..945b248 100644
--- a/terraform/k8sapps/m3uproxy.tf
+++ b/terraform/k8sapps/m3uproxy.tf
@@ -1,5 +1,5 @@
 locals {
-  m3uproxy_path       = "/mnt/microk8s_persistent/m3uproxy"
+  m3uproxy_path       = "${local.persistent_folder}/m3uproxy"
   m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
   squid_app_path      = "${local.m3uproxy_path}/squid"
   geoip_path          = "${local.m3uproxy_path}/geoip"
diff --git a/terraform/k8sapps/modules/k8s_mariadb/variables.tf b/terraform/k8sapps/modules/k8s_mariadb/variables.tf
index b4541ca..a4907a9 100644
--- a/terraform/k8sapps/modules/k8s_mariadb/variables.tf
+++ b/terraform/k8sapps/modules/k8s_mariadb/variables.tf
@@ -24,7 +24,6 @@ variable "app_password" {
 
 variable "host_storage_path" {
   description = "host storage path"
-  default     = "/srv"
   type        = string
 }
 
diff --git a/terraform/k8sapps/modules/scw_backup_job/variables.tf b/terraform/k8sapps/modules/scw_backup_job/variables.tf
index 05bb10d..203a988 100644
--- a/terraform/k8sapps/modules/scw_backup_job/variables.tf
+++ b/terraform/k8sapps/modules/scw_backup_job/variables.tf
@@ -39,7 +39,6 @@ variable "cron_schedule" {
 
 variable "host_storage_path" {
   description = "Host path"
-  default     = "/var/lib"
   type        = string
 }
 
diff --git a/terraform/k8sapps/nextcloud.tf b/terraform/k8sapps/nextcloud.tf
index 40b1b9a..84116a2 100644
--- a/terraform/k8sapps/nextcloud.tf
+++ b/terraform/k8sapps/nextcloud.tf
@@ -74,8 +74,8 @@ locals {
     }
   }
 
-  nextcloud_path       = "/mnt/microk8s_persistent/nextcloud"
-  nextcloud_mysql_path = "/mnt/microk8s_persistent/mysql.nextcloud"
+  nextcloud_path       = "${local.persistent_folder}/nextcloud"
+  nextcloud_mysql_path = "${local.persistent_folder}/mysql.nextcloud"
 }
 
 #
@@ -170,8 +170,9 @@ module "nextcloud_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
-  cron_schedule  = local.nextcloud_files_backup_cron_schedule
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.nextcloud_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 # 
diff --git a/terraform/k8sapps/wordpress.tf b/terraform/k8sapps/wordpress.tf
index 8f6869c..608a4d8 100644
--- a/terraform/k8sapps/wordpress.tf
+++ b/terraform/k8sapps/wordpress.tf
@@ -1,6 +1,6 @@
 locals {
-  wordpress_path       = "/mnt/microk8s_persistent/wordpress"
-  wordpress_mysql_path = "/mnt/microk8s_persistent/mysql.wordpress"
+  wordpress_path       = "${local.persistent_folder}/wordpress"
+  wordpress_mysql_path = "${local.persistent_folder}/mysql.wordpress"
 }
 
 resource "kubernetes_namespace" "wordpress" {
@@ -54,8 +54,9 @@ module "wordpress_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
-  cron_schedule  = local.wordpress_files_backup_cron_schedule
+  retention_days    = local.local_backup_retention_days
+  cron_schedule     = local.wordpress_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 #