diff --git a/REFERENCE.md b/REFERENCE.md
index cba52e43..63410025 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -544,6 +544,7 @@ The following parameters are available in the `icingaweb2::globals` class:
 
 * [`package_name`](#-icingaweb2--globals--package_name)
 * [`conf_dir`](#-icingaweb2--globals--conf_dir)
+* [`state_dir`](#-icingaweb2--globals--state_dir)
 * [`data_dir`](#-icingaweb2--globals--data_dir)
 * [`role_replace`](#-icingaweb2--globals--role_replace)
 * [`comp_db_schema_dir`](#-icingaweb2--globals--comp_db_schema_dir)
@@ -575,6 +576,12 @@ Data type: `Stdlib::Absolutepath`
 
 Path to the config files.
 
+##### <a name="-icingaweb2--globals--state_dir"></a>`state_dir`
+
+Data type: `Stdlib::Absolutepath`
+
+Path to variable application data.
+
 ##### <a name="-icingaweb2--globals--data_dir"></a>`data_dir`
 
 Data type: `Stdlib::Absolutepath`
diff --git a/data/FreeBSD.yaml b/data/FreeBSD.yaml
index 78f0bd5e..7c8d2dd1 100644
--- a/data/FreeBSD.yaml
+++ b/data/FreeBSD.yaml
@@ -1,6 +1,7 @@
 ---
 icingaweb2::globals::package_name: icingaweb2-php74
 icingaweb2::globals::conf_dir: /usr/local/etc/icingaweb2
+icingaweb2::globals::state_dir: /usr/local/var/icingaweb2
 icingaweb2::globals::data_dir: /usr/local/www/icingaweb2
 icingaweb2::globals::comp_db_schema_dir: /usr/local/www/icingaweb2/etc
 icingaweb2::globals::mysql_db_schema: /usr/local/www/icingaweb2/etc/schema/mysql.schema.sql
diff --git a/data/Linux-kernel.yaml b/data/Linux-kernel.yaml
index d99ae378..78a0c00f 100644
--- a/data/Linux-kernel.yaml
+++ b/data/Linux-kernel.yaml
@@ -1,6 +1,7 @@
 ---
 icingaweb2::globals::package_name: icingaweb2
 icingaweb2::globals::conf_dir: /etc/icingaweb2
+icingaweb2::globals::state_dir: /var/lib/icingaweb2
 icingaweb2::globals::data_dir: /usr/share/icingaweb2
 icingaweb2::globals::comp_db_schema_dir: /usr/share/doc/icingaweb2
 icingaweb2::globals::mysql_db_schema: /usr/share/doc/icingaweb2/schema/mysql.schema.sql
diff --git a/manifests/config.pp b/manifests/config.pp
index 27d39417..c865eee4 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -6,12 +6,9 @@
 class icingaweb2::config {
   $conf_dir             = $icingaweb2::globals::conf_dir
   $default_module_path  = $icingaweb2::globals::default_module_path
-  $conf_user            = $icingaweb2::conf_user
-  $conf_group           = $icingaweb2::conf_group
 
   $logging              = $icingaweb2::logging
   $logging_file         = $icingaweb2::logging_file
-  $logging_dir          = dirname($icingaweb2::logging_file)
   $logging_level        = $icingaweb2::logging_level
   $logging_facility     = $icingaweb2::logging_facility
   $logging_application  = $icingaweb2::logging_application
@@ -61,12 +58,6 @@
     cipher   => $icingaweb2::tls_cipher,
   }
 
-  File {
-    mode    => '0660',
-    owner   => $conf_user,
-    group   => $conf_group,
-  }
-
   Exec {
     path     => $facts['path'],
     provider => shell,
@@ -74,16 +65,6 @@
     require  => Icingaweb2::Tls::Client['icingaweb2 tls client config'],
   }
 
-  file { $logging_dir:
-    ensure => directory,
-    mode   => '0750',
-  }
-
-  file { $logging_file:
-    ensure => file,
-    mode   => '0640',
-  }
-
   icingaweb2::inisection { 'config-logging':
     section_name => 'logging',
     target       => "${conf_dir}/config.ini",
@@ -137,16 +118,6 @@
     }
   }
 
-  file { "${conf_dir}/modules":
-    ensure => directory,
-    mode   => '2770',
-  }
-
-  file { "${conf_dir}/enabledModules":
-    ensure => directory,
-    mode   => '2770',
-  }
-
   # Additional resources
   $resources.each |String $res, Hash $cfg| {
     case $cfg['type'] {
diff --git a/manifests/globals.pp b/manifests/globals.pp
index f6ee81ea..d131b6ed 100644
--- a/manifests/globals.pp
+++ b/manifests/globals.pp
@@ -9,6 +9,9 @@
 # @param conf_dir
 #   Path to the config files.
 #
+# @param state_dir
+#   Path to variable application data.
+#
 # @param data_dir
 #   Location of PHP data files.
 #
@@ -66,6 +69,7 @@
 class icingaweb2::globals (
   String                 $package_name,
   Stdlib::Absolutepath   $conf_dir,
+  Stdlib::Absolutepath   $state_dir,
   Stdlib::Absolutepath   $data_dir,
   Boolean                $role_replace,
   Stdlib::Absolutepath   $comp_db_schema_dir,
diff --git a/manifests/install.pp b/manifests/install.pp
index 68ab535f..ea362b44 100644
--- a/manifests/install.pp
+++ b/manifests/install.pp
@@ -7,20 +7,17 @@
   assert_private("You're not supposed to use this defined type manually.")
 
   $conf_dir       = $icingaweb2::globals::conf_dir
+  $state_dir      = $icingaweb2::globals::state_dir
   $package_name   = $icingaweb2::globals::package_name
+  $data_dir       = $icingaweb2::globals::data_dir
+  $comp_dir       = $icingaweb2::globals::comp_db_schema_dir
   $manage_package = $icingaweb2::manage_package
   $extra_packages = $icingaweb2::extra_packages
-  $conf_user      = $icingaweb2::conf_user
   $conf_group     = $icingaweb2::conf_group
-  $data_dir       = $icingaweb2::globals::data_dir
-  $comp_dir       = $icingaweb2::globals::comp_db_schema_dir
-
-  File {
-    mode    => '0660',
-    owner   => $conf_user,
-    group   => $conf_group,
-  }
 
+  #
+  # Packages
+  #
   if $manage_package {
     package { $package_name:
       ensure => installed,
@@ -36,11 +33,26 @@
     }
   }
 
-  file { prefix(['navigation', 'preferences', 'dashboards'], "${conf_dir}/"):
-    ensure => directory,
-    mode   => '2770',
+  #
+  # Additional filesystem structure
+  #
+  file {
+    default:
+      ensure => directory,
+      owner  => root,
+      group  => $conf_group,
+      ;
+    prefix(['modules', 'enabledModules', 'navigation', 'preferences', 'dashboards'], "${conf_dir}/"):
+      mode => '2770',
+      ;
+    "${state_dir}/certs":
+      mode  => '2770',
+      ;
   }
 
+  #
+  # Compatmode: db schema files were moved in Icinga Web 2.11.0
+  #
   file { $comp_dir:
     ensure => directory,
     owner  => 'root',
diff --git a/spec/classes/config_spec.rb b/spec/classes/config_spec.rb
index 8087308c..c54b1b9a 100644
--- a/spec/classes/config_spec.rb
+++ b/spec/classes/config_spec.rb
@@ -19,16 +19,6 @@
         }
         it { is_expected.to contain_icingaweb2__inisection('config-themes') }
         it { is_expected.not_to contain_icingaweb2__inisection('config-cookie') }
-        it {
-          is_expected.to contain_file('/var/log/icingaweb2')
-            .with_ensure('directory')
-            .with_mode('0750')
-        }
-        it {
-          is_expected.to contain_file('/var/log/icingaweb2/icingaweb2.log')
-            .with_ensure('file')
-            .with_mode('0640')
-        }
 
         it { is_expected.to contain_icingaweb2__resource__database('mysql-icingaweb2') }
         it { is_expected.not_to contain_exec('import schema') }