diff --git a/config/zoraxy/conf/proxy/app.nextwks.eu.config b/config/zoraxy/conf/proxy/app.nextwks.eu.config
index 57f99fc..2c311e3 100644
--- a/config/zoraxy/conf/proxy/app.nextwks.eu.config
+++ b/config/zoraxy/conf/proxy/app.nextwks.eu.config
@@ -1,16 +1,49 @@
 {
-  "ProxyType": 1,
-  "RootOrMatchingDomain": "app.nextwks.eu",
-  "ActiveOrigins": [
-    {
-      "OriginIpOrDomain": "127.0.0.1:9000",
-      "RequireTLS": false,
-      "Weight": 1,
-      "MaxConn": 0
-    }
-  ],
-  "Disabled": false,
-  "AuthenticationProvider": {
-    "AuthMethod": 4
-  }
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "app.nextwks.eu",
+    "MatchingDomainAlias": [],
+    "ActiveOrigins": [
+        {
+            "OriginIpOrDomain": "127.0.0.1:9000",
+            "RequireTLS": false,
+            "SkipCertValidations": false,
+            "SkipWebSocketOriginCheck": false,
+            "Weight": 1,
+            "MaxConn": 0,
+            "RespTimeout": 0
+        }
+    ],
+    "InactiveOrigins": [],
+    "UseStickySession": false,
+    "UseActiveLoadBalance": false,
+    "Disabled": false,
+    "BypassGlobalTLS": false,
+    "VirtualDirectories": [],
+    "HeaderRewriteRules": {
+        "UserDefinedHeaders": null,
+        "RequestHostOverwrite": "",
+        "HSTSMaxAge": 0,
+        "EnablePermissionPolicyHeader": false,
+        "PermissionPolicy": null,
+        "DisableHopByHopHeaderRemoval": false
+    },
+    "EnableWebsocketCustomHeaders": false,
+    "AuthenticationProvider": {
+        "AuthMethod": 4,
+        "BasicAuthCredentials": null,
+        "BasicAuthExceptionRules": null,
+        "BasicAuthGroupIDs": [],
+        "ForwardAuthURL": "",
+        "ForwardAuthResponseHeaders": [],
+        "ForwardAuthResponseClientHeaders": [],
+        "ForwardAuthRequestHeaders": [],
+        "ForwardAuthRequestExcludedCookies": []
+    },
+    "RequireRateLimit": false,
+    "RateLimit": 0,
+    "DisableUptimeMonitor": false,
+    "AccessFilterUUID": "",
+    "DefaultSiteOption": 0,
+    "DefaultSiteValue": "",
+    "Tags": []
 }
diff --git a/config/zoraxy/conf/proxy/dns.nextwks.eu.config b/config/zoraxy/conf/proxy/dns.nextwks.eu.config
new file mode 100644
index 0000000..d8498aa
--- /dev/null
+++ b/config/zoraxy/conf/proxy/dns.nextwks.eu.config
@@ -0,0 +1,17 @@
+{
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "dns.nextwks.eu",
+    "ActiveOrigins": [
+        {
+            "OriginIpOrDomain": "127.0.0.1:8000",
+            "RequireTLS": false,
+            "Weight": 1,
+            "MaxConn": 0
+        }
+    ],
+    "Disabled": false,
+    "AuthenticationProvider": {
+        "AuthMethod": 4
+    },
+    "BypassGlobalTLS": false
+}
diff --git a/config/zoraxy/conf/proxy/root.config b/config/zoraxy/conf/proxy/root.config
index 5f058f7..4cd6b22 100644
--- a/config/zoraxy/conf/proxy/root.config
+++ b/config/zoraxy/conf/proxy/root.config
@@ -1,9 +1,39 @@
 {
-  "ProxyType": 1,
-  "RootOrMatchingDomain": "*",
-  "ActiveOrigins": [],
-  "Disabled": false,
-  "AuthenticationProvider": {
-    "AuthMethod": 0
-  }
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "*",
+    "MatchingDomainAlias": [],
+    "ActiveOrigins": [],
+    "InactiveOrigins": [],
+    "UseStickySession": false,
+    "UseActiveLoadBalance": false,
+    "Disabled": false,
+    "BypassGlobalTLS": false,
+    "VirtualDirectories": [],
+    "HeaderRewriteRules": {
+        "UserDefinedHeaders": null,
+        "RequestHostOverwrite": "",
+        "HSTSMaxAge": 0,
+        "EnablePermissionPolicyHeader": false,
+        "PermissionPolicy": null,
+        "DisableHopByHopHeaderRemoval": false
+    },
+    "EnableWebsocketCustomHeaders": false,
+    "AuthenticationProvider": {
+        "AuthMethod": 0,
+        "BasicAuthCredentials": null,
+        "BasicAuthExceptionRules": null,
+        "BasicAuthGroupIDs": [],
+        "ForwardAuthURL": "",
+        "ForwardAuthResponseHeaders": [],
+        "ForwardAuthResponseClientHeaders": [],
+        "ForwardAuthRequestHeaders": [],
+        "ForwardAuthRequestExcludedCookies": []
+    },
+    "RequireRateLimit": false,
+    "RateLimit": 0,
+    "DisableUptimeMonitor": false,
+    "AccessFilterUUID": "",
+    "DefaultSiteOption": 0,
+    "DefaultSiteValue": "",
+    "Tags": []
 }
diff --git a/deploy.sh b/deploy.sh
index 9302ae3..5f31bb9 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -8,6 +8,17 @@ BINARY_NAME="nextworkspace"
 HEALTH_CHECK_RETRIES=10
 HEALTH_CHECK_INTERVAL=2
 
+# --- Load .env from runtime root ---
+ENV_FILE="$TARGET_DIR/.env"
+if [ -f "$ENV_FILE" ]; then
+    set -a
+    source "$ENV_FILE"
+    set +a
+fi
+
+# Default domain if .env wasn't loaded
+DOMAIN="${DOMAIN:-nextwks.eu}"
+
 # --- Mode detection ---
 GREENFIELD=false
 if [ "${1:-}" = "--destroy" ]; then
@@ -39,21 +50,87 @@ if [ "$GREENFIELD" = true ]; then
     mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
     mkdir -p "$TARGET_DIR/data/zoraxy"
     mkdir -p "$TARGET_DIR/compose"
-    mkdir -p "$TARGET_DIR/logs/zoraxy"
+    mkdir -p "$TARGET_DIR/logs"
 
     echo "[5/8] Copying binary..."
     cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
 
-    echo "[6/8] Copying config files..."
-    cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
-    cp -r config/zoraxy/* "$TARGET_DIR/config/zoraxy/"
+    echo "[6/8] Deploying Zoraxy..."
     cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
-
-    echo "[7/8] Deploying Zoraxy..."
     podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"
 
-    echo "[8/8] Writing systemd service and starting launcher..."
-    mkdir -p "$TARGET_DIR"
+    # Generate Zoraxy proxy configs with actual domain
+    echo "[*] Generating Zoraxy proxy configs..."
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
+{
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "app.$DOMAIN",
+    "ActiveOrigins": [{
+        "OriginIpOrDomain": "127.0.0.1:9000",
+        "RequireTLS": false,
+        "Weight": 1,
+        "MaxConn": 0
+    }],
+    "Disabled": false,
+    "AuthenticationProvider": {"AuthMethod": 4}
+}
+ZORAXY_APP
+
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/dns.$DOMAIN.config" <<ZORAXY_DNS
+{
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "dns.$DOMAIN",
+    "ActiveOrigins": [{
+        "OriginIpOrDomain": "127.0.0.1:8000",
+        "RequireTLS": false,
+        "Weight": 1,
+        "MaxConn": 0
+    }],
+    "Disabled": false,
+    "AuthenticationProvider": {"AuthMethod": 4}
+}
+ZORAXY_DNS
+
+    # Copy launcher config files
+    cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
+
+    # Create Zoraxy admin account
+    echo "[*] Creating Zoraxy admin account..."
+    ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
+
+    # Wait for Zoraxy to be ready
+    for i in $(seq 1 15); do
+        if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
+            break
+        fi
+        echo "  Waiting for Zoraxy... ($i/15)"
+        sleep 2
+    done
+
+    # Fetch CSRF token from Zoraxy login page
+    CSRF_TOKEN=$(curl -s http://127.0.0.1:8000/ | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+    if [ -z "$CSRF_TOKEN" ]; then
+        echo "[WARN] Could not fetch CSRF token, trying without it..."
+        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
+            -d "username=${ADMIN_USERNAME:-admin}" \
+            -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
+    else
+        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
+            -H "X-CSRF-Token: $CSRF_TOKEN" \
+            -d "username=${ADMIN_USERNAME:-admin}" \
+            -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
+    fi
+
+    if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
+        echo "[OK] Zoraxy admin account created"
+    elif echo "$ADMIN_CREATE" | grep -qi '"error"'; then
+        echo "[WARN] Admin account may already exist: $ADMIN_CREATE"
+    else
+        echo "[INFO] Admin API response: $ADMIN_CREATE"
+    fi
+
+    # Write systemd service and start launcher
+    echo "[7/8] Writing systemd service and starting launcher..."
     cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
 [Unit]
 Description=NextWorkspace Launcher
diff --git a/install.sh b/install.sh
index b82c18c..3b72492 100755
--- a/install.sh
+++ b/install.sh
@@ -4,7 +4,51 @@ set -euo pipefail
 # NextWorkspace Installer — bootstraps a bare Linux VM
 # Idempotent: safe to run multiple times.
 
-echo "=== NextWorkspace Installer ==="
+TARGET_DIR="/opt/nextworkspace"
+
+# --- Create runtime directory structure ---
+echo "=== NextWorkspace Setup ==="
+mkdir -p "$TARGET_DIR/config/nextworkspace"
+mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
+mkdir -p "$TARGET_DIR/data/zoraxy"
+mkdir -p "$TARGET_DIR/compose"
+mkdir -p "$TARGET_DIR/logs"
+
+# --- Interactive prompts ---
+read -p "Domain [nextwks.eu]: " DOMAIN
+DOMAIN="${DOMAIN:-nextwks.eu}"
+
+read -p "TLS email (Let's Encrypt) [den@2-4-h.net]: " TLS_EMAIL
+TLS_EMAIL="${TLS_EMAIL:-den@2-4-h.net}"
+
+read -p "Admin username [master]: " ADMIN_USERNAME
+ADMIN_USERNAME="${ADMIN_USERNAME:-master}"
+
+read -p "Admin password [auto-generated]: " ADMIN_PASSWORD
+if [ -z "$ADMIN_PASSWORD" ]; then
+    ADMIN_PASSWORD="9Aku7MfklZU9ldnZ"
+fi
+
+echo ""
+echo "========================================"
+echo "  Admin username: $ADMIN_USERNAME"
+echo "  Admin password: $ADMIN_PASSWORD"
+echo "  Save this password — it won't be shown again!"
+echo "========================================"
+echo ""
+
+# Write .env file at runtime root
+ENV_FILE="$TARGET_DIR/.env"
+cat > "$ENV_FILE" <<EOF
+# NextWorkspace Configuration
+# This file is auto-generated by install.sh — do not edit manually
+DOMAIN=$DOMAIN
+TLS_EMAIL=$TLS_EMAIL
+ADMIN_USERNAME=$ADMIN_USERNAME
+ADMIN_PASSWORD=$ADMIN_PASSWORD
+EOF
+
+chmod 600 "$ENV_FILE"
 
 # ---- Go ----
 if command -v go &>/dev/null; then
@@ -23,9 +67,9 @@ else
 fi
 
 # ---- System deps ----
-echo "[INSTALL] git, build-essential, podman..."
+echo "[INSTALL] git, build-essential, podman, podman-compose..."
 apt-get update -qq
-apt-get install -y -qq git build-essential curl podman
+apt-get install -y -qq git build-essential curl podman podman-compose
 
 # ---- Clone / pull repo ----
 REPO_DIR="/opt/NextWks"