diff --git a/.gitignore b/.gitignore
index 943c9df2..66e4033a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,6 @@
 *.iml
 .idea
 tmp
-logs
 dependency-reduced-pom.xml
 *.log
 *~
diff --git a/bubble-server/src/main/resources/ansible/install_local.sh.hbs b/bubble-server/src/main/resources/ansible/install_local.sh.hbs
index 5c6821bd..e5d81e09 100644
--- a/bubble-server/src/main/resources/ansible/install_local.sh.hbs
+++ b/bubble-server/src/main/resources/ansible/install_local.sh.hbs
@@ -2,7 +2,7 @@
 
 ANSIBLE_USER="{{node.user}}"
 ANSIBLE_HOME="$(cd ~{{node.user}} && pwd)"
-LOG=/tmp/bubble.ansible.log
+LOG=/var/log/bubble/ansible.log
 
 # Stop unattended upgrades so that apt installs will work
 # unattended upgrades are re-enabled at the end of the ansible run
@@ -17,7 +17,7 @@ set -m
 
 {{#if isNode}}
 # touch algo log and start tailing it
-ALGO_LOG=/tmp/bubble.install_algo.log
+ALGO_LOG=/var/log/bubble/install_algo.log
 touch ${ALGO_LOG} && tail -f ${ALGO_LOG} &
 {{/if}}
 
diff --git a/bubble-server/src/main/resources/ansible/roles/algo/tasks/main.yml b/bubble-server/src/main/resources/ansible/roles/algo/tasks/main.yml
index f1e0ff8a..103069b5 100644
--- a/bubble-server/src/main/resources/ansible/roles/algo/tasks/main.yml
+++ b/bubble-server/src/main/resources/ansible/roles/algo/tasks/main.yml
@@ -14,7 +14,7 @@
 
 # Don't setup algo when in restore mode, bubble_restore_monitor.sh will set it up after the CA key has been restored
 - name: Run algo playbook to install algo
-  shell: bash -c "/root/ansible/roles/algo/algo/install_algo.sh 2>&1 >> /tmp/bubble.install_algo.log"
+  shell: bash -c "/root/ansible/roles/algo/algo/install_algo.sh 2>&1 >> /var/log/bubble/install_algo.log"
   tags: algo_related
 
 # Algo installation clears out iptable rules. Add needed bubble rules back:
diff --git a/bubble-server/src/main/resources/ansible/roles/finalizer/templates/supervisor_bubble.conf.j2 b/bubble-server/src/main/resources/ansible/roles/finalizer/templates/supervisor_bubble.conf.j2
index 6b215aec..8e20c555 100644
--- a/bubble-server/src/main/resources/ansible/roles/finalizer/templates/supervisor_bubble.conf.j2
+++ b/bubble-server/src/main/resources/ansible/roles/finalizer/templates/supervisor_bubble.conf.j2
@@ -1,7 +1,7 @@
 
 [program:bubble]
-stdout_logfile = /home/bubble/logs/bubble-out.log
-stderr_logfile = /home/bubble/logs/bubble-err.log
+stdout_logfile = /var/log/bubble/api-server-out.log
+stderr_logfile = /var/log/bubble/api-server-err.log
 command=sudo -u bubble bash -c "/usr/bin/java \
   -Dfile.encoding=UTF-8 -Djava.net.preferIPv4Stack=true \
   -XX:+UseG1GC -XX:MaxGCPauseMillis=400 {{ bubble_java_opts }} \
diff --git a/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users.sh b/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users.sh
index eca53638..790f21a4 100644
--- a/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users.sh
+++ b/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.algo_refresh_users.log
+LOG=/var/log/bubble/algo_refresh_users.log
 
 ALGO_BASE=/root/ansible/roles/algo/algo
 REFRESH_MARKER=${ALGO_BASE}/.refreshing_users
diff --git a/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users_monitor.sh b/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users_monitor.sh
index eb006d61..532ba739 100644
--- a/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users_monitor.sh
+++ b/bubble-server/src/main/resources/packer/roles/algo/files/algo_refresh_users_monitor.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.algo_refresh_users_monitor.log
+LOG=/var/log/bubble/algo_refresh_users_monitor.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/algo/files/wg_monitor_connections.sh b/bubble-server/src/main/resources/packer/roles/algo/files/wg_monitor_connections.sh
index e9ea815c..5a29b1bf 100644
--- a/bubble-server/src/main/resources/packer/roles/algo/files/wg_monitor_connections.sh
+++ b/bubble-server/src/main/resources/packer/roles/algo/files/wg_monitor_connections.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.wg_monitor_connections.log
+LOG=/var/log/bubble/wg_monitor_connections.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_restore_monitor.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_restore_monitor.sh
index 7eead8d0..59762f45 100755
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_restore_monitor.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_restore_monitor.sh
@@ -12,7 +12,7 @@ BUBBLE_SELF_NODE="${BUBBLE_HOME}/${SELF_NODE}"
 ADMIN_PORT=${1:?no admin port provided}
 TIMEOUT=${2:-3600}  # 60 minutes default timeout
 
-LOG=/tmp/bubble.restore.log
+LOG=/var/log/bubble/restore.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade.sh
index 8a9c0893..f79ebcd7 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade.sh
@@ -5,7 +5,7 @@
 BUBBLE_HOME="/home/bubble"
 UPGRADE_JAR="${BUBBLE_HOME}/upgrade.jar"
 BUBBLE_JAR="${BUBBLE_HOME}/api/bubble.jar"
-LOG=/tmp/bubble.upgrade.log
+LOG=/var/log/bubble/upgrade.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade_monitor.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade_monitor.sh
index 75522efd..1c4ae801 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade_monitor.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/bubble_upgrade_monitor.sh
@@ -6,7 +6,7 @@ THIS_DIR="$(cd "$(dirname "${0}")" && pwd)"
 
 BUBBLE_HOME="/home/bubble"
 UPGRADE_JAR="${BUBBLE_HOME}/upgrade.jar"
-LOG=/tmp/bubble.upgrade.log
+LOG=/var/log/bubble/upgrade.log
 
 function log {
   echo "$(date): ${1}" >> ${LOG}
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/init_bubble_db.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/init_bubble_db.sh
index fffbbe2b..a70251ad 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/init_bubble_db.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/init_bubble_db.sh
@@ -4,7 +4,7 @@
 #
 echo "$@" > /tmp/init.args
 
-LOG=/tmp/bubble.init_db.log
+LOG=/var/log/bubble/init_db.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/log_manager.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/log_manager.sh
index b254e05a..f3b0d5f4 100755
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/log_manager.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/log_manager.sh
@@ -9,7 +9,7 @@ function die {
   exit 1
 }
 
-BUBBLE_TMP_LOGS=/tmp/bubble.*
+BUBBLE_LOGS_FOLDER=/var/log/bubble
 REDIS_LOG_FLAG_KEY="bubble.StandardSelfNodeService.bubble_server_logs_enabled"
 
 SUPERVISOR_CONFIG_DIR=/etc/supervisor/conf.d
@@ -33,7 +33,7 @@ REDIS_LOG_FLAG=$(test "${REDIS_LOG_FLAG_VALUE}" == "true" && echo true || echo f
 function setLoggingForSupervisorConfig {
   cfgFile=${1}
   logFlag=${2}
-  tmpFile=$(mktemp /tmp/bubble_tmp.log_manager.XXXXXX)
+  tmpFile=$(mktemp /tmp/bubble.log_manager.XXXXXX)
 
   while IFS= read -r line; do
     if [[ ${line} == std???_logfile* ]]; then
@@ -43,8 +43,9 @@ function setLoggingForSupervisorConfig {
       else
         # truncate current log files:
         logFile=$(echo "${line}" | awk -F "=" '{print $2}' | xargs echo)
-        truncate -c - s0 "${logFile}"
-        # also remove old logs if any:
+        # note that current log file will be truncated afterwards at the very end of this shell script together with
+        # other logs from this same folder (the log should be in ${BUBBLE_LOGS_FOLDER}).
+        # remove old logs if any:
         rm "${logFile}.*"
         # finally, set NONE got log output in supervisor config file's line:
         echo "${line/_logfile = NONE # /_logfile = /}" >> "${tmpFile}"
@@ -59,14 +60,14 @@ function setLoggingForSupervisorConfig {
 }
 
 
-if [[ "${REDIS_LOG_FLAG}" != "true" ]]; then
-  # truncate tmp bubble log files each time as those might have some output in between:
-  ls "${BUBBLE_TMP_LOGS}" | xargs truncate -c - s0
-fi
-
 if [[ "${SUPERVISOR_LOG_FLAG}" != "${REDIS_LOG_FLAG}" ]]; then
   # change log setup on supervisor configs to match value from redis
   for cfgFile in ${SUPERVISOR_CONFIG_DIR}/* ; do
     setLoggingForSupervisorConfig cfgFile REDIS_LOG_FLAG
   done
 fi
+
+if [[ "${REDIS_LOG_FLAG}" != "true" ]]; then
+  # truncate tmp bubble log files each time as those might have some output in between:
+  ls "${BUBBLE_LOGS_FOLDER}/*" | xargs truncate -c - s0
+fi
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys.sh
index 63e3247c..007789b1 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.refresh_bubble_ssh_keys.log
+LOG=/var/log/bubble/refresh_bubble_ssh_keys.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys_monitor.sh b/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys_monitor.sh
index 7ee94aa0..2f91f5ea 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys_monitor.sh
+++ b/bubble-server/src/main/resources/packer/roles/bubble/files/refresh_bubble_ssh_keys_monitor.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.ssh_keys_monitor.log
+LOG=/var/log/bubble/ssh_keys_monitor.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/bubble/tasks/main.yml b/bubble-server/src/main/resources/packer/roles/bubble/tasks/main.yml
index 24fc9c92..683a4a45 100644
--- a/bubble-server/src/main/resources/packer/roles/bubble/tasks/main.yml
+++ b/bubble-server/src/main/resources/packer/roles/bubble/tasks/main.yml
@@ -9,6 +9,10 @@
 
 - import_tasks: postgresql.yml
 
+- name: Create bubble-log group
+  group:
+    name: bubble-log
+
 - name: Create bubble user
   user:
     name: bubble
@@ -16,6 +20,7 @@
     shell: /bin/bash
     system: yes
     home: /home/bubble
+    groups: bubble-log
 
 - name: Creates bubble API dir
   file:
@@ -27,9 +32,9 @@
 
 - name: Creates bubble logs dir
   file:
-    path: /home/bubble/logs
+    path: /var/log/bubble
     owner: bubble
-    group: root
+    group: bubble-log
     mode: 0770
     state: directory
 
diff --git a/bubble-server/src/main/resources/packer/roles/common/files/ensure_file_exists.sh b/bubble-server/src/main/resources/packer/roles/common/files/ensure_file_exists.sh
index db0313d1..e65f5ee3 100644
--- a/bubble-server/src/main/resources/packer/roles/common/files/ensure_file_exists.sh
+++ b/bubble-server/src/main/resources/packer/roles/common/files/ensure_file_exists.sh
@@ -4,7 +4,7 @@
 #
 TARGET_FILE=${1:?no target file provided}
 TIMEOUT=${2:?no timeout provided}
-LOG=/tmp/bubble.ensure_file_$(echo ${TARGET_FILE} | tr '/' '_').log
+LOG=/var/log/bubble/ensure_file_$(echo ${TARGET_FILE} | tr '/' '_').log
 
 start=$(date +%s)
 while [[ ! -s ${TARGET_FILE} && $(expr $(date +%s) - ${start}) -le ${TIMEOUT} ]] ; do
diff --git a/bubble-server/src/main/resources/packer/roles/finalizer/files/snapshot_ansible.sh b/bubble-server/src/main/resources/packer/roles/finalizer/files/snapshot_ansible.sh
index 991346e2..cad0965b 100644
--- a/bubble-server/src/main/resources/packer/roles/finalizer/files/snapshot_ansible.sh
+++ b/bubble-server/src/main/resources/packer/roles/finalizer/files/snapshot_ansible.sh
@@ -5,7 +5,7 @@
 SCRIPT="${0}"
 SCRIPT_DIR=$(cd $(dirname ${SCRIPT}) && pwd)
 
-LOG=/tmp/bubble.snapshot_ansible.log
+LOG=/var/log/bubble/snapshot_ansible.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/finalizer/files/supervisor_bubble_nodemanager.conf b/bubble-server/src/main/resources/packer/roles/finalizer/files/supervisor_bubble_nodemanager.conf
index 2605be5f..a42b625a 100644
--- a/bubble-server/src/main/resources/packer/roles/finalizer/files/supervisor_bubble_nodemanager.conf
+++ b/bubble-server/src/main/resources/packer/roles/finalizer/files/supervisor_bubble_nodemanager.conf
@@ -1,5 +1,5 @@
 
 [program:nodemanager]
-stdout_logfile = /home/bubble/logs/nodemanager-out.log
-stderr_logfile = /home/bubble/logs/nodemanager-err.log
+stdout_logfile = /var/log/bubble/nodemanager-out.log
+stderr_logfile = /var/log/bubble/nodemanager-err.log
 command=/usr/sbin/bubble-nodemanager
diff --git a/bubble-server/src/main/resources/packer/roles/mitmproxy/files/mitm_monitor.sh b/bubble-server/src/main/resources/packer/roles/mitmproxy/files/mitm_monitor.sh
index 16062951..ea7443ba 100644
--- a/bubble-server/src/main/resources/packer/roles/mitmproxy/files/mitm_monitor.sh
+++ b/bubble-server/src/main/resources/packer/roles/mitmproxy/files/mitm_monitor.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.mitm_monitor.log
+LOG=/var/log/bubble/mitm_monitor.log
 
 function die {
   echo 1>&2 "${1}"
diff --git a/bubble-server/src/main/resources/packer/roles/mitmproxy/tasks/main.yml b/bubble-server/src/main/resources/packer/roles/mitmproxy/tasks/main.yml
index 61097c0a..d6435fd0 100644
--- a/bubble-server/src/main/resources/packer/roles/mitmproxy/tasks/main.yml
+++ b/bubble-server/src/main/resources/packer/roles/mitmproxy/tasks/main.yml
@@ -27,6 +27,7 @@
     shell: /bin/bash
     system: yes
     home: /home/mitmproxy
+    groups: bubble-log
 
 - name: Creates mitmproxy dir
   file:
diff --git a/bubble-server/src/main/resources/packer/roles/nginx/files/init_certbot.sh b/bubble-server/src/main/resources/packer/roles/nginx/files/init_certbot.sh
index e77afa9f..668292c4 100755
--- a/bubble-server/src/main/resources/packer/roles/nginx/files/init_certbot.sh
+++ b/bubble-server/src/main/resources/packer/roles/nginx/files/init_certbot.sh
@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
-LOG=/tmp/bubble.init_certbot.log
+LOG=/var/log/bubble/init_certbot.log
 
 function log {
   echo "$(date): ${1}" >> ${LOG}
diff --git a/bubble-server/src/main/resources/packer/roles/nginx/files/init_dhparams.sh b/bubble-server/src/main/resources/packer/roles/nginx/files/init_dhparams.sh
index 15dfd2fb..858e8bcc 100644
--- a/bubble-server/src/main/resources/packer/roles/nginx/files/init_dhparams.sh
+++ b/bubble-server/src/main/resources/packer/roles/nginx/files/init_dhparams.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-LOG=/tmp/bubble.dhparams.log
+LOG=/var/log/bubble/dhparams.log
 DH_PARAMS=/etc/nginx/dhparams.pem
 
 function log {