diff --git a/internal/tinyproxy/conf.go b/internal/tinyproxy/conf.go
index 73d06933..d1ae854b 100644
--- a/internal/tinyproxy/conf.go
+++ b/internal/tinyproxy/conf.go
@@ -2,6 +2,7 @@ package tinyproxy
 
 import (
 	"fmt"
+	"sort"
 
 	"github.com/qdm12/golibs/files"
 	"github.com/qdm12/private-internet-access-docker/internal/constants"
@@ -23,7 +24,7 @@ func generateConf(logLevel models.TinyProxyLogLevel, port uint16, user, password
 		"Group":               "tinyproxy",
 		"Port":                fmt.Sprintf("%d", port),
 		"Timeout":             "600",
-		"DefaultErrorFile":    "/usr/share/tinyproxy/default.html",
+		"DefaultErrorFile":    "\"/usr/share/tinyproxy/default.html\"",
 		"MaxClients":          "100",
 		"MinSpareServers":     "5",
 		"MaxSpareServers":     "20",
@@ -31,7 +32,7 @@ func generateConf(logLevel models.TinyProxyLogLevel, port uint16, user, password
 		"MaxRequestsPerChild": "0",
 		"DisableViaHeader":    "Yes",
 		"LogLevel":            string(logLevel),
-		// "StatFile": "/usr/share/tinyproxy/stats.html",
+		// "StatFile": "\"/usr/share/tinyproxy/stats.html\"",
 	}
 	if len(user) > 0 {
 		confMapping["BasicAuth"] = fmt.Sprintf("%s %s", user, password)
@@ -40,5 +41,8 @@ func generateConf(logLevel models.TinyProxyLogLevel, port uint16, user, password
 		line := fmt.Sprintf("%s %s", k, v)
 		lines = append(lines, line)
 	}
+	sort.Slice(lines, func(i, j int) bool {
+		return lines[i] < lines[j]
+	})
 	return lines
 }
diff --git a/internal/tinyproxy/conf_test.go b/internal/tinyproxy/conf_test.go
new file mode 100644
index 00000000..3a1e94de
--- /dev/null
+++ b/internal/tinyproxy/conf_test.go
@@ -0,0 +1,68 @@
+package tinyproxy
+
+import (
+	"testing"
+
+	"github.com/qdm12/private-internet-access-docker/internal/constants"
+	"github.com/qdm12/private-internet-access-docker/internal/models"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_generateConf(t *testing.T) {
+	t.Parallel()
+	tests := map[string]struct {
+		logLevel models.TinyProxyLogLevel
+		port     uint16
+		user     string
+		password string
+		lines    []string
+	}{
+		"No credentials": {
+			logLevel: constants.TinyProxyInfoLevel,
+			port:     2000,
+			lines: []string{
+				"DefaultErrorFile \"/usr/share/tinyproxy/default.html\"",
+				"DisableViaHeader Yes",
+				"Group tinyproxy",
+				"LogLevel Info",
+				"MaxClients 100",
+				"MaxRequestsPerChild 0",
+				"MaxSpareServers 20",
+				"MinSpareServers 5",
+				"Port 2000",
+				"StartServers 10",
+				"Timeout 600",
+				"User nonrootuser",
+			},
+		},
+		"With credentials": {
+			logLevel: constants.TinyProxyErrorLevel,
+			port:     2000,
+			user:     "abc",
+			password: "def",
+			lines: []string{
+				"BasicAuth abc def",
+				"DefaultErrorFile \"/usr/share/tinyproxy/default.html\"",
+				"DisableViaHeader Yes",
+				"Group tinyproxy",
+				"LogLevel Error",
+				"MaxClients 100",
+				"MaxRequestsPerChild 0",
+				"MaxSpareServers 20",
+				"MinSpareServers 5",
+				"Port 2000",
+				"StartServers 10",
+				"Timeout 600",
+				"User nonrootuser",
+			},
+		},
+	}
+	for name, tc := range tests {
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			lines := generateConf(tc.logLevel, tc.port, tc.user, tc.password)
+			assert.Equal(t, tc.lines, lines)
+		})
+	}
+}