diff --git a/global/overlay/etc/puppet/manifests/cosmos-site.pp b/global/overlay/etc/puppet/manifests/cosmos-site.pp
index 7512b473..e807c88c 100644
--- a/global/overlay/etc/puppet/manifests/cosmos-site.pp
+++ b/global/overlay/etc/puppet/manifests/cosmos-site.pp
@@ -315,6 +315,11 @@ class eidas_de_middleware_hsm($version="110-fixes-sc-p11",$hostname='localhost')
 
    file {['/opt/eidas-middleware','/opt/eidas-middleware/configuration','/opt/eidas-middleware/database']: ensure => directory } ->
    file {['/etc/luna','/etc/luna/cert']: ensure => directory } ->
+   file { '/opt/eidas-middleware/configuration/POSeIDAS.xml.sh':
+      ensure  => present,
+      content => template('eid/demw/POSeIDAS.xml.sh.erb'),
+      mode    => '0744',
+      }
    sunet::docker_run {'eidas-demw':
       image    => 'docker.sunet.se/eidas-demw',
       imagetag => $_version,
@@ -333,7 +338,6 @@ class eidas_de_middleware_hsm($version="110-fixes-sc-p11",$hostname='localhost')
                    "PKCS11_PIN=$pkcs11_pin",
                    "PKCS11_CONFIG_LOCATION=/opt/eidas-middleware/configuration/hsm/pkcs11.properties",
                    "POSEIDAS_ADMIN_HASHED_PASSWORD=$poseidas_admin_hashed_password",
-                   "DEMW_TLS_CLIENT_KEY=$demw_tls_client_key",
                    "DEMW_TLS_CLIENT_CERT=$demw_tls_client_cert",
                    "DEMW_TLS_SERVER_CERT=$demw_tls_server_cert",
                    "SPRING_DATASOURCE_PASSWORD=$spring_datasource_password"],
diff --git a/demw-1.qa.sveidas.se/overlay/opt/eidas-middleware/configuration/POSeIDAS.xml.sh b/global/overlay/etc/puppet/modules/eid/templates/demw/POSeIDAS.xml.sh.erb
old mode 100755
new mode 100644
similarity index 99%
rename from demw-1.qa.sveidas.se/overlay/opt/eidas-middleware/configuration/POSeIDAS.xml.sh
rename to global/overlay/etc/puppet/modules/eid/templates/demw/POSeIDAS.xml.sh.erb
index 1cab6945..586be20d
--- a/demw-1.qa.sveidas.se/overlay/opt/eidas-middleware/configuration/POSeIDAS.xml.sh
+++ b/global/overlay/etc/puppet/modules/eid/templates/demw/POSeIDAS.xml.sh.erb
@@ -25,7 +25,7 @@ cat<<EOF
                 <sslKeys id="default">
                     <serverCertificate>MIIJzzCCCLegAwIBAgIQFMkYM/fihYkf2zwDkIUk4zANBgkqhkiG9w0BAQsFADCB3zELMAkGA1UEBhMCREUxJTAjBgNVBAoMHFQtU3lzdGVtcyBJbnRlcm5hdGlvbmFsIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxHDAaBgNVBAgME05vcmRyaGVpbiBXZXN0ZmFsZW4xDjAMBgNVBBEMBTU3MjUwMRAwDgYDVQQHDAdOZXRwaGVuMSAwHgYDVQQJDBdVbnRlcmUgSW5kdXN0cmllc3RyLiAyMDEmMCQGA1UEAwwdVGVsZVNlYyBTZXJ2ZXJQYXNzIENsYXNzIDIgQ0EwHhcNMjAxMjIyMTM1MTI5WhcNMjExMjI3MjM1OTU5WjCBgzELMAkGA1UEBhMCREUxITAfBgNVBAoMGEdvdmVybmlrdXMgR21iSCAmIENvLiBLRzELMAkGA1UECxMCU0UxDzANBgNVBAgTBkJyZW1lbjEPMA0GA1UEBxMGQnJlbWVuMSIwIAYDVQQDExlkdmNhLXIxLmdvdmVybmlrdXMtZWlkLmRlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApD2cLcZddztiHnWF2coJCT83OC2/qJRqgoMs+YNtWWolN0qX+0mH1l6gMiX/fn0kVOCXNRqjHG/8ljDOYgdQ/jMjllAjc31rG1pxJGpPyd9jsfD3ZsJLmsxmUgv584LIzKrJAGZ6xNRQx9i3+heo3CR0RL9U+RzoqvvgSCW9P4lQlZHdEsXy5vTV2g+diq2sYLku7AhA/qCPk2q6ybPKCHJOlmN/p1QY/g1HV0KYGzsoAXIHpqxIPMZlyfcLPtxZE2HQWyVjL4826j5QE+IuQ/4gu829uEksNw6U0cMDsyx1WtEzQmCXEhpE25IfIvASbf8qhQLVzAZA40TsTL2hotW0lPX+9J1JdayW+11g02VKreyutQ/ee3ZNM7yg2ntoOm6KnRYjerEZADuG7fFHqWHXHie+GKAMYEqKneIJjJ9CoAWuMtTSGAIPdk9MhBCwDpnUeGqFMFHnNb0RuDmlyIzdprAL40GmUVIV+eX+WfSFg2z5r4iWKN4P+3V9KNu+xUQXdpmzLNsmhNhknte1YmwgklIHgZ1oGcivTmyw9mFjOPVASrCB9CguSsJeCh17RNVjJs+seu0RQXVN12fya4vjIW6AMrUDuHKamtYHcbh9KC4JTHpN1UwrmY4bbuQwoiNRxfYZmlVQFv8QA0nyJLQqaKQq0bOrEwwHUBvWe88CAwEAAaOCBN8wggTbMB8GA1UdIwQYMBaAFJTIdEb1OrRGSCb4K8o0HlYmBBIAMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFGmYca4w8aU9vhOXmrMTyPCAYA2xMGUGA1UdIAReMFwwUAYKKwYBBAG9Rw0XATBCMEAGCCsGAQUFBwIBFjRodHRwOi8vZG9jcy5zZXJ2ZXJwYXNzLnRlbGVzZWMuZGUvY3BzL3NlcnZlcnBhc3MuaHRtMAgGBmeBDAECAjBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8vY3JsLnNlcnZlcnBhc3MudGVsZXNlYy5kZS9ybC9TZXJ2ZXJQYXNzX0NsYXNzXzIuY3JsMIGZBggrBgEFBQcBAQSBjDCBiTAzBggrBgEFBQcwAYYnaHR0cDovL29jc3Auc2VydmVycGFzcy50ZWxlc2VjLmRlL29jc3ByMFIGCCsGAQUFBzAChkZodHRwOi8vY3JsLnNlcnZlcnBhc3MudGVsZXNlYy5kZS9jcnQvVGVsZVNlY19TZXJ2ZXJQYXNzX0NsYXNzXzJfQ0EuY2VyMAwGA1UdEwEB/wQCMAAwJAYDVR0RBB0wG4IZZHZjYS1yMS5nb3Zlcm5pa3VzLWVpZC5kZTCCAuQGCisGAQQB1nkCBAIEggLUBIIC0ALOAHYAfT7y+I//iFVoJMLAyp5SiXkrxQ54CX8uapdomX4i8NcAAAF2irga2gAABAMARzBFAiEAvaF2YLJ/w2OQkZhQjeTtAoisXxZWYCb6QScffEsfh8oCIA3u582jShxT/LCY64Vcm4QIjy6u8Z1hsp425PfyTj/dAHYAb1N2rDHwMRnYmQCkURX/dxUcEdkCwQApBo2yCJo32RMAAAF2irgbhAAABAMARzBFAiEA9r/yo5Ukrxx7f8/xXN7AIR23NMG0xHcjywv6+86Y6KkCIAns95gErnCUwrL6YzHFDEVan4atNekpJ6mQbqYs555qAHYARJRlLrDuzq/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAF2irgbSAAABAMARzBFAiA1mL62VSica7xmG+zdM5SW8FHLof0VV29UBSIY+xbJ3QIhAPke7rLTOSLAoheo2wH6mvxhYq0d4ktRMr9Igi/12D++AHUA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAF2irgbCQAABAMARjBEAiBQEduOkCuTscbEaIU4EkPgserY7pVVI4diuRl844mMwgIgWa8pYn4YjjT+szRQnC4MQcNIIqmOhATcdfsx+8y6GKYAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAXaKuByiAAAEAwBHMEUCIQDXIS0kgvrXdJsz7JDje1HX5MmEmk7G4h7kofWMejKdvwIgUPPTLNkOgtUAZk+LZ4R6car4JIeGc2P6Ipn7M7EDcqsAdQBc3EOS/uarRUSxXprUVuYQN/vV+kfcoXOUsl7m9scOygAAAXaKuB0lAAAEAwBGMEQCIAxHwbO6WaW8XH6NJ6cwVFgbjNDj3m7UwQaH4GHoUeJwAiAmpiz925MTCmxzxHGwgrGGRqnIDbgoZ8SLkpTd7ZyNdjANBgkqhkiG9w0BAQsFAAOCAQEAZSVx0OejdS9xObK1kqlbQ4fz5cJJafr5RZWvdjjGQD4TSb2+ifalqA028JbfNH8BOzNMsSN7ZxCLDNDsJ5JO8zl4n37WMQuMH/X2OA8tfg62Rh27nFG6HM+8eELRII8i9kw9huiGuPkKByHvCBvVJyeCy73d1kfJ++BJazbYbBE2evgnKXRWPnyDNfQRvbuLnQ0Ji2vFPTupNUenzRYT6VFZcZFksB7lRfViiJyI8YPog4pJ7d71n1B7yqOf0QqgTISc1n3SjR1nCv48MxXGcc6NwSbGMo7kjQqgwJhJSFNxeiLuQnrGYw9soNtVe0Pcmve0hMGefR9T1RLK5DJZYA==</serverCertificate>
                     <clientCertificate>${DEMW_TLS_CLIENT_CERT}</clientCertificate>
-                    <clientKey>${DEMW_TLS_CLIENT_KEY}</clientKey>
+                    <clientKey><%= @demw_tls_client_key %></clientKey>
                 </sslKeys>
                 <terminalAuthService sslKeysId="default">
                     <url>https://dvca-r1.governikus-eid.de/gov_dvca/ta-service</url>
@@ -45,4 +45,4 @@ cat<<EOF
         </EPAConnectorConfiguration>
     </ServiceProvider>
 </CoreConfiguration>
-EOF
+EOF
\ No newline at end of file