diff --git a/.gitignore b/.gitignore
index d2b3edb..3fe20bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,6 @@
 !inventory/group_vars/all.yml.tmpl
 vars.yml
 roles/ezamriy.fail2ban
+roles/geerlingguy.docker
+roles/geerlingguy.redis
 .vscode/*
\ No newline at end of file
diff --git a/README.md b/README.md
index f85fd86..11782f4 100644
--- a/README.md
+++ b/README.md
@@ -159,6 +159,22 @@ rabbitmq_vhost:
 pulp_password:
 ```
 
+## ALTS (production-like deployment)
+Standalone ALTS services (RabbitMQ broker, scheduler with Flower, Celery
+workers) are deployed by separate playbooks using the `inventories/alts`
+inventory. Copy it, put your hosts into `hosts.yml` and adjust
+`group_vars/*.yml` (passwords, JWT secret, Pulp credentials, etc.).
+
+TLS certificates and keys for RabbitMQ and Celery are stored encrypted
+with Ansible Vault in `playbooks/files/alts/{celery,rabbitmq}/`, so the
+playbooks need the vault password:
+```bash
+ansible-galaxy install -r requirements.yml
+ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_rabbitmq.yml
+ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_scheduler.yml -e flower_password=<password>
+ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_celery.yml
+```
+
 ## Contributing to albs-deploy
 Any question? Found a bug? File an [issue](https://github.com/AlmaLinux/build-system/issues).
 Do you want to contribute with source code?
diff --git a/inventories/alts/group_vars/celery.yml b/inventories/alts/group_vars/celery.yml
new file mode 100644
index 0000000..eb83163
--- /dev/null
+++ b/inventories/alts/group_vars/celery.yml
@@ -0,0 +1,47 @@
+---
+
+broker_type: rabbitmq
+logs_uploader_type: pulp
+terraform_plugin_cache_dir: /home/{{ test_system_user }}/.terraform.d/plugins-cache
+test_system_user: test-system
+test_system_vhost: test_system
+test_system_password: some-another-secret-password
+test_system_config_dir: /home/{{ test_system_user }}/.config/alts
+
+rabbitmq_host: localhost
+rabbitmq_port: 5672
+rabbitmq_ssl_port: 5671
+
+celery_ssl: true
+celery_ssl_src_certificate: "files/alts/celery/client_certificate.pem"
+celery_ssl_src_key: "files/alts/celery/client_key.pem"
+celery_src_cacert: "files/alts/celery/ca_certificate.pem"
+celery_ssl_dir: "{{ test_system_config_dir }}/ssl"
+celery_ssl_certificate: "{{ celery_ssl_dir }}/{{ celery_ssl_src_certificate | basename }}"
+celery_ssl_key: "{{ celery_ssl_dir }}/{{ celery_ssl_src_key | basename }}"
+celery_cacert: "{{ celery_ssl_dir }}/{{ celery_src_cacert | basename }}"
+
+result_backend_name: local
+celery_result_folder: /srv/celery_results
+celery_pool_type: prefork
+
+worker_prefetch_multiplier: 1
+result_expires: 3600
+tests_exec_timeout: 3600
+broker_pool: 30
+
+# Optional overrides for environment provisioning
+# cleanup_yum_conf_docs_settings: false
+# ignore_ansible_install_errors: true
+# docker_image_overrides:
+#   - dist_name: almalinux
+#     dist_versions: ['8', '9']
+#     platform: linux/386
+#     image: quay.io/almalinuxautobot/almalinux
+
+celery_log_file_dir: /var/log/celery
+celery_log_file: "{{ celery_log_file_dir }}/celery.log"
+celery_concurrency: 10
+celery_loglevel: INFO
+celery_queues:
+  - "docker-x86_64-0"
diff --git a/inventories/alts/group_vars/rabbitmq.yml b/inventories/alts/group_vars/rabbitmq.yml
new file mode 100644
index 0000000..5ba5fc4
--- /dev/null
+++ b/inventories/alts/group_vars/rabbitmq.yml
@@ -0,0 +1,19 @@
+---
+
+broker_type: rabbitmq
+logs_uploader_type: pulp
+rabbitmq_ssl: true
+rabbitmq_copy_ssl_files: true
+rabbitmq_admin_user: admin
+rabbitmq_admin_password: some-secret-password
+rabbitmq_ssl_folder: "/etc/rabbitmq/ssl/"
+rabbitmq_cacert: "files/alts/rabbitmq/ca_certificate.pem"
+rabbitmq_server_key: "files/alts/rabbitmq/server_key.pem"
+rabbitmq_server_cert: "files/alts/rabbitmq/server_certificate.pem"
+rabbitmq_conf_ssl_options_cacertfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_cacert | basename }}"
+rabbitmq_conf_ssl_options_keyfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_server_key | basename }}"
+rabbitmq_conf_ssl_options_certfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_server_cert | basename }}"
+rabbitmq_ssl_verify: "verify_peer"
+rabbitmq_ssl_fail_if_no_peer_cert: true
+rabbitmq_test_system_password: some-another-secret-password
+rabbitmq_test_system_vhost: /test-system
diff --git a/inventories/alts/group_vars/scheduler.yml b/inventories/alts/group_vars/scheduler.yml
new file mode 100644
index 0000000..19c0f94
--- /dev/null
+++ b/inventories/alts/group_vars/scheduler.yml
@@ -0,0 +1,57 @@
+---
+
+# Firewall management (set to false for cloud instances using security groups)
+manage_firewall: false
+
+broker_type: rabbitmq
+test_system_user: albs
+test_system_vhost: alts
+test_system_password: some-another-secret-password
+test_system_config_dir: ~/.config/alts
+
+rabbitmq_host: localhost
+rabbitmq_port: 5672
+rabbitmq_ssl_port: 5671
+
+celery_ssl: true
+celery_ssl_src_certificate: "files/alts/celery/client_certificate.pem"
+celery_ssl_src_key: "files/alts/celery/client_key.pem"
+celery_src_cacert: "files/alts/celery/ca_certificate.pem"
+celery_ssl_dir: "{{ test_system_config_dir }}/ssl"
+celery_ssl_certificate: "{{ celery_ssl_dir }}/{{ celery_ssl_src_certificate | basename }}"
+celery_ssl_key: "{{ celery_ssl_dir }}/{{ celery_ssl_src_key | basename }}"
+celery_cacert: "{{ celery_ssl_dir }}/{{ celery_src_cacert | basename }}"
+
+# Redis configuration for result backend (geerlingguy.redis role variables)
+redis_bind_interface: 0.0.0.0
+redis_port: 6379
+# redis_requirepass: ""  # Uncomment and set if you need password authentication
+# redis_maxmemory: 512mb
+# redis_maxmemory_policy: allkeys-lru
+
+# Celery result backend configuration
+result_backend_name: redis
+alts_redis_host: localhost
+alts_redis_port: 6379
+alts_redis_results_db: 1
+
+# Legacy local result backend (not used with Redis)
+# result_backend_name: local
+# celery_result_folder: /srv/celery_results
+
+celery_pid_file_dir: /var/run/celery
+celery_pid_file: "{{ celery_pid_file_dir }}/worker.pid"
+celery_concurrency: 10
+celery_loglevel: INFO
+celery_queues:
+  - "docker-x86_64-0"
+
+scheduler_working_directory: /srv/alts/scheduler
+
+# Flower monitoring dashboard (deployed with the scheduler)
+flower_port: 5555
+# flower_password: ""  # Required, pass via --extra-vars or a vaulted vars file
+jwt_secret: very-secret-on5
+broker_pool: 30
+worker_prefetch_multiplier: 1
+result_expires: 3600
diff --git a/inventories/alts/hosts.yml b/inventories/alts/hosts.yml
new file mode 100644
index 0000000..255ac74
--- /dev/null
+++ b/inventories/alts/hosts.yml
@@ -0,0 +1,29 @@
+---
+all:
+  children:
+    rabbitmq:
+      hosts:
+        rabbitmq01:
+    scheduler:
+      hosts:
+        scheduler01:
+    celery:
+      hosts:
+        x86_64-node01:
+          celery_queues:
+            - "docker-x86_64-0"
+        aarch64-node01:
+          terraform_arch: arm
+          celery_queues:
+            - "docker-aarch64-0"
+          build_terraform: true
+          node_arch: aarch64
+          terraform_build_ver: v1.11.4
+          docker_build_ver: 3.6.1
+        s390x-node01:
+          celery_queues:
+            - "docker-s390x-0"
+          build_terraform: true
+          node_arch: s390x
+          terraform_build_ver: v1.11.4
+          docker_build_ver: 3.6.1
diff --git a/playbooks/alts_celery.yml b/playbooks/alts_celery.yml
new file mode 100644
index 0000000..6332667
--- /dev/null
+++ b/playbooks/alts_celery.yml
@@ -0,0 +1,17 @@
+---
+- name: Install ALTS Celery worker
+  hosts: celery
+  vars:
+    docker_users:
+      - "{{ test_system_user }}"
+  roles:
+    - alts_base
+    # TODO: add role for building docker for s390x
+    - role: geerlingguy.docker
+      tags:
+        - install_docker
+    - alts_docker_customization
+    - role: alts_terraform
+      tags:
+        - terraform
+    - alts_celery
diff --git a/playbooks/alts_rabbitmq.yml b/playbooks/alts_rabbitmq.yml
new file mode 100644
index 0000000..40c628d
--- /dev/null
+++ b/playbooks/alts_rabbitmq.yml
@@ -0,0 +1,6 @@
+---
+- name: Install RabbitMQ for ALTS and setup TLS
+  hosts: rabbitmq
+  roles:
+    - alts_base
+    - alts_rabbitmq_server
diff --git a/playbooks/alts_scheduler.yml b/playbooks/alts_scheduler.yml
new file mode 100644
index 0000000..79629b7
--- /dev/null
+++ b/playbooks/alts_scheduler.yml
@@ -0,0 +1,8 @@
+---
+- name: Configure ALTS scheduler
+  hosts: scheduler
+  roles:
+    - alts_base
+    - geerlingguy.redis
+    - alts_scheduler
+    - { role: alts_flower, tags: ["flower-setup"] }
diff --git a/playbooks/files/alts/celery/ca_certificate.pem b/playbooks/files/alts/celery/ca_certificate.pem
new file mode 100644
index 0000000..48efdd0
--- /dev/null
+++ b/playbooks/files/alts/celery/ca_certificate.pem
@@ -0,0 +1,66 @@
+$ANSIBLE_VAULT;1.1;AES256
+30613663326363633063656562663732383763633563356364666436306261653935626163363365
+3238366436326361396337373463343435636264626366370a306165376661386161333961663739
+62363262373262316262393531646364303438636330336461653131326165373034393131363564
+6661656137636661650a343233373037653139373635356630626561663136653835323261643533
+32633937336232623239663537613737626237373963656433306461363362396164376234616431
+66313265653631313836353337336232316661323761666465663733366239373333623931316436
+32323339323264346633613137366136333832636638653464363134663439333738333464333532
+35353438376432363132613230643130353465363236613531666538653135373562303733313463
+35346564306363383862613361656432336632653234626364623133346439333635376166333434
+36373931336633616631393363656235353539393831373761666262666462636139366632616236
+32346562623037376138313737613232303261633066376265353664323062616263326263316161
+65306531313236383661316337353333313239626535396332326165303965663933326339656431
+61623533393365643436363162353136333732323763643331303161313735336337636365643431
+34626436343665326563303666613265353935323262363232316233346664663265653437653966
+65366566386436383237363033663339386636373938343232336166356565396564613832663133
+65636336383535663334373831356162316134393439366563373232333663336239623366363038
+64386132616164323662386436336264666363363463626530646630336137333763383763303238
+62623837396561366139343763636437343762323034326139623438336263313636353465326265
+61363130373366356231323738353333636137616137303339363832353332383932343364356664
+66346366366362393439303564653730393964663330313762613337616361616431366435303138
+63313437303837653034653234393864653731396631643961346666616536373533633231616533
+63656663373037323330616266343131613133376432343535613136623634313737353032636163
+35373663346536613362643838386262643934353638303762303862363436633530373238626264
+38616334363766373065613834303161623338613334353766353836616230613235613065656435
+61383330613836326665393934323039323764656237373464333838326161383863623064626637
+37366230303731306636313936343165623664613331343133663263663938643964396663356665
+36666631616161393639326463316166316136376231383332353861636539633965303364346666
+34373238356664306332303235316134333262333931663335356466663431373337393239656164
+38333062313036336334636563346633323234316230336464366538373638663834363065356133
+62303564613438663265623135336266323666633265653035653634313733646235346362376432
+32643335316461313762323734363737303936373735633437366162366532656435393633323934
+61373736316563326163303330323733336532306366613835653236643533353463386362323531
+30643339636566363564386466303336363132376534376662333437396232613864353262633966
+33613463353036356664306439316565316131336334306533613661373265363332653034626366
+30656232666432386639313338643834653262653663663532353836376633303935626239633364
+35376436623838353733336630653130393161366639626331653061306264613762656366656233
+61323361313565333530616662656632353430393062646361386564393664633461356438316336
+38333565646161663637323461313336386139333561333838666161336566323034633365343033
+33363439633331383035373034353966636662626661636432613030376435333239666666356263
+37353961656365353030323330376564633433613664346132353965663932333039363436626635
+32393461646562333633323664663937363630306139303638333866393464613162303639666565
+65366463656463323632373065626138323831613564343034363534626266343337383261666638
+35343532373136366566306532366531633562356565366235306635646535313662393765623936
+66346663353032316466333061623535393163663134396564663835316133356636613330386235
+32613562333134653233623938636138616332663264363165626433343633333365313235363662
+64393663383630353038386336316130333265663066383063313636613663653136313264373164
+34653766666536613266613666366136373137356338313135323964333631376632363336343363
+65373235333232663031613639366235343962376137326332376361333264333839653733333631
+36373138343735373239643437313430326665633966346566623930646334326238306136623461
+33303161353037343835666662396634323337316362393139363636303435366465626430613165
+31333739633330346136633965623065396137633733316330393566643363313061663037636234
+33306134316462343062373564303039343463653639323436306331343866646262613361353537
+31386463393561303864316231626234376465313663346566656361303862663439383536346339
+30386462613066666438373163393731303039663233313363646530363064613965356434646637
+33356236323634303735636136383130363566666363633864383437393436633633316364663161
+38613932333363633162383133626639316133386638666563656166653430353539353961363666
+63643462616330633435636236393132636238636662326639366630613439336437623232663964
+39663131343032373430326234303361373965393637346137356632616434346339623962373036
+64623834323765343966656636623635366430323938363334343933643835373264393038366564
+37326563303534663531303038366165633034333765366234663163636365333832643938633961
+66313764383065626231643164633232616564373564346536306661393136313462353535626263
+63633338316534346564613330666461366434343330353632383936616166373932336365643430
+36316361383663663131636537346633393066616638396232613963663634343361643465653136
+32333930313762653363366230333136643538356362653336376263646636326631363139333239
+3731
diff --git a/playbooks/files/alts/celery/client_certificate.pem b/playbooks/files/alts/celery/client_certificate.pem
new file mode 100644
index 0000000..dac2382
--- /dev/null
+++ b/playbooks/files/alts/celery/client_certificate.pem
@@ -0,0 +1,65 @@
+$ANSIBLE_VAULT;1.1;AES256
+65613762663337663661643562316666656564336438663061303234636363326532303334333835
+3536393861383930636231636262343639646663366161370a383366396335393165346265386432
+65316233313638396466373261323334303439313865636263373461333234613632613461383135
+3238643636643731640a386535663136323761646566666432656434346435646132626635323239
+63366234636435386338333335306633373034363337326564363435643464636131663362643862
+66383466323138353634326538306536303635653230623936363835616464303338353537366161
+64613833356334633935326262623938633433383234393465653362616665323561643337303735
+65333961316233373739383364306133376432396439393935623363346233396361316563633231
+62343635393465343536636334653636656134636362653536353339613162333131636438346465
+39376663313832306138383934623838333062356264643764653638653437626262336531363962
+64656539393539643532616262383230383839353938663833366364646162633133313861633539
+30663137353565323231623630363639376561636366633363623731373933333462393963333232
+32666466323163643063373633313134386336383032353434613163316531626531666665323861
+62323734623139326130343936636234663463613931363439646332323732623437313761313933
+64316266323264383365616438393766313038343963643363306532663535616462313763623361
+38393138363962646331356333383165343739323064646235646535306235663538363938663663
+31363338376135316137343738323339313638313831303832393639636661623833393331386136
+61316532303361643263616132646565366438636639326339353031383037323333643066343833
+39306364306133663465313230626164333831636335363630633437636535623336623334653534
+66363337393839373934393866316366633762303637613263396465323737633964383538313765
+39633132303638626336653939333261366534656332373662306532333736613438313662396163
+65633431626136623838616165313936633264376639336366396362393035376335626330376162
+39343732343839303361653939373463303839663465386366363062636264393235333762353738
+39653439633533393138616437613034666463636433326337343661616536643664373837646636
+30306134326336373661306562376437613433656437626563666134663339353133626430623337
+30633364326134343462333063653965313136303765656338313964333863663166326361363430
+30333838656431356464316663303236393462303066306436313732326366643031343064323466
+34373563303737303863646465373436383239643564323935663235633635383333633662323035
+61333033323237653538643664373162663033646538373930353163336465333761613830626534
+36373732663264663531313337383931313833646163393931323731653362386264366661663835
+66343634333039303365383338643763323735353634663362633631343239373866373336366366
+36326364663763356338343465393665326265306162646638353536663864383934623632626439
+30653634663661386632303632646163373036323462393339666663336633383136616165663739
+39623164313733396337626266663462366337636537343134356134663461313265643033313963
+32326464383136356130623739656237353666633935363930316563383566396237383630393366
+66333935643761333337353132353537663063333836613136643635646261343932643134363638
+34643266333837613930366535633433363931363137656630393862653763303331373764653039
+36373537663536333230393031623261356134313665373732303661623664613661656631663530
+63623139366135343563623732636635636561616535313934646662633062626531646364303164
+65393161396264353132613436636265373330376463646562656539326431663833396265386137
+62336166636165303566613837653166383834343235373466656136623134646665333230353537
+37666663366235653665666338313236353562323161613231303364343931336139393737393836
+31313735653339356339646236336234613762396365613939373930326532623263363234316535
+38393264353233663066326535663235336133396433373931303963643131643063343064363765
+65633164303062343765343966333433393661656264363732623938626464663837336165643662
+33636132653266656665363333366637363961616232643466663330393632643063643065303830
+61333731626636383362376261636664303534393834326263373330303636396338333262306636
+38653132623566323132306163666666383765383831343132373135646131633633353736396539
+64366161326462366136316165616138353561363764306466613431666439613964393936386538
+31633965643465646137313365396438616433373135613339386330393138626165333736646235
+35663563353733646339653635323730353439366138666438353265316230633264393233373661
+38643766323731643336363663316439383032373662353236646137613739306264343565643135
+62366132303335613231653034663062316133326632356439303265386461633061656463363233
+36303436306436653763396562633265666465646364323764323565396638396562623066366133
+36623263326530663638393530633633373835626531346365343939303936326363383563313138
+62356435626537353839633563623633666433383061626433303932633536346563376164646638
+35313235363436303339336362396361373330353031396333636130376435623130663333353637
+30373938316539326133373733313363663338393735323839663738393039353135303237383165
+62366633646163373032373364613362323239616535393464373937306662333534373536303330
+32343763393066383462653036636533663131356464666130336333643032666465323862306438
+36343030373533326466393339316433306466366161663633303262393431353430636665663362
+32656430373032623837393732326331366464376634333138643766363233633162336339643535
+31303935613463373530383965633137633434643237646335643465373132633862303864356263
+35353435663061316133
diff --git a/playbooks/files/alts/celery/client_key.pem b/playbooks/files/alts/celery/client_key.pem
new file mode 100644
index 0000000..accadca
--- /dev/null
+++ b/playbooks/files/alts/celery/client_key.pem
@@ -0,0 +1,90 @@
+$ANSIBLE_VAULT;1.1;AES256
+62303366646235303233383931633537666364623763636235643935393733356363653165616139
+3734326662653333333338363135636538646262396438360a333262343864663933343332343561
+36623335666130623339316262343865383562646537376265633733326265613130376463316236
+6530373766306232310a356361616131396332656237373332383234363163343663616635356663
+64656632656138376161386235386337316535353731373136646464656262663538663164393133
+66376632343138613231343835353066663333623736353733323239363665313461633831343565
+31663237326539393735303833643433623339313439323236323738386565623962356665303839
+61366133313862383763333433633937393966326466666361393361386666653930313562333737
+61373331303431336634303466346363343337663764656362626462656335643131613233386233
+64646432373438653538663031636531326464613461373638363332346139346565303737343131
+62383463336663633236313731663664383936316136306139303335383264373161393364323363
+39316435613531366333323633356631653266393330316233653035393336633830623965653863
+38353861626462633965316437353763653233623663333231323031343964663830343936666564
+32633235393164323930646231353066393362326433643139336561643361326430663738646562
+34306332336636303663633766396566343466323263613430356164626163656234323030326536
+34633232643464613634343932623239653331623834326138323636336464303339613037623835
+35343365623635666334373737393330326339303232643033313235646561656430663331386533
+37633563393661366562316666343835636434306162633134633763383338346236313534353865
+31616530353434336666346238386138333438383866353938393033346162633733616565646438
+39656239373166376565313363653836323437346437626131326137656162383462323138306534
+31326430623966396530666639386535656362663562373662643961363438353534613130623034
+61313633663333383438646162333537336132353739653332306137633939376438643461613464
+37653033373936376635623161366331316432346261383731343235383630666436363436306565
+31626563613766343031643039383035636661323738313665613332383764323032303966333639
+37323035613662623735303664613637623137373466646331316331386532653765373932663562
+62653434303636306131303261643135366132636331316365626266306361363963313537613935
+38326263643736326533346238363237393034313439663536343764326166386439663263616339
+32616333323062393934306466373766386361373766343463353135626463393238613939323866
+64303536316435616632333839323730656162336566366265346461346637346639633530363663
+31646435633536633836663434343534353239373136656639383630313064643030663532313233
+32326466303664613535323832666566323562343238613537383862366663343362326331393937
+37616662313865323931373334303832656435663538646338663961343564333236316430613036
+31363638393134646234373836663336646539653463383661363335313336616634636232373831
+38383661643538393136353466663464356337613631346364643066353832653332623166366565
+36393337643635656637383766663864663934353833353235306532303962623639323233333861
+36643638666166613936353362336538663762386365616563336661636234363531323636353731
+63623238633535383564373862303965313161373135643761306237326532646233623031393333
+32626332663738633030663937333965653833343434663032386632306564643266386563353030
+33653336373636646661323464353966356637303236376133363064353537653061336161303534
+32623336373362333537326639306163353934333663333666346339643662633432656635636134
+61356537383737646230383466316465356339393634353365663033626562353330613034386331
+31663139356533376433396632353734303963636465333536353232646564663732663132333130
+39303962613437656434626132653131313335326162316230343566373737343138373237623961
+65303632656335636539396237306435613864626466656330343335396133663962383862646638
+65336665306136383638633765303961353435316637626561333631323863363166393961393431
+35353561343638363761656333353364363633333362393339666262396331356539343631363032
+32363436616133333066326330636435636466663030666464376638303063633937643730393431
+61353265653237613265393164646139356637393730373239323265643966303665343966343238
+34636563666232656230376636393764373739303038346264613931643231646334303335336339
+39643236613637663334643234636332643634323439313261653134373139306130373437363730
+34646663303136636338643865623231386438346266643165613963373066363330663933383361
+32656630346166333332646530326236323435356664343838383735633963666338333261336239
+31643339643266653539323230386233386261643137346330613439323262373639396261323965
+35613866383934313032346361316335356531373238353839653466313438363030366434303439
+64303632383462663532663164663131633034646137336263633738653436343337333736613731
+64633836323934663361353438633838626362666339366333616338356130653366383161353737
+34633734643866343863366463343339323064343235306137316434666531393230643338656661
+61656464623437373264373162303939363738363538393731313934343536303833623436376130
+37333364303634663439353231323163393730336262343336613339623435393130373738313638
+65666334303465306234396337346331666536323962376633363364313331643865333666653232
+36636563633636633261626430636438306363626633303661366436393761643864323333623634
+64663235633333346633336637666366373165616234653137306536613866323438663662306466
+65323930373838313466663863306134623833656134396434343464366362366438633630666664
+62616336646463373862646239303938623131306634313039626231313864393764363461336535
+62646463373265393138623363316239346364323261366534656433343937613134653438303539
+36643866653563313165383034626636386164633461346332373566313839383633356464313932
+63323530343865613366336330366632643964613033616462356531626635343261383066333361
+35623133343431393766376165333262313139636432383436633861646163613938636636636263
+37376338663339336264633733373565313237646335616566613138323432356264333738313337
+66333137653537376463343264636538366234636133333931303337316634356338616633616261
+61336562616136313336663035376665666464363164396262323134333031663561393434326535
+62393238613132613035336134306663353135393366626236653461623861366466346231316338
+30343037303338323936356664323265326138376266313263323334353431353235616636646133
+39376661336261356639306662306435666232656563396261666638353231633865616139396462
+32343637336262346530313431663164643832343364346465313635616563616362366138396433
+39313264363561376663623762363733356332613161613865383261353532653664383532313933
+36386232353339363261356561373434333764633836353861356131383166626337376630323566
+64393863333037393635316238653534653936663139333162393633316366346466306337386338
+32393261323431323335303464373432346235336139303665616464616339343132343561376139
+35653934663064323533666135623537613434623836326463333531393433366561663133656532
+61383162353630663862333334376535613831346666356161633635323638623535616335393730
+39626536366164663864333832353339396665636237643964353538396336643665303639303038
+62336134613564373665333663396361653431306237303065393331316434393161663631653035
+34303061636535363231636163376338313866393864636161343333306539313365313737653137
+31386264633734383565333434316334313263373338316562653530653539343263376335323230
+64316264653131653730356232333336363863306263646630636431643566623033363138353365
+38353536376334346334333930313665633966613435326563333934373365303661633337373137
+66346163396532346436616662313366626532303132306635393039333435656134326231343431
+31386330356266366532393235646333613663333734303862663236636162613232
diff --git a/playbooks/files/alts/rabbitmq/ca_certificate.pem b/playbooks/files/alts/rabbitmq/ca_certificate.pem
new file mode 100644
index 0000000..5373457
--- /dev/null
+++ b/playbooks/files/alts/rabbitmq/ca_certificate.pem
@@ -0,0 +1,66 @@
+$ANSIBLE_VAULT;1.1;AES256
+35663365646632333631636534386163386134316265626430343961306633346637633233366165
+3161353735326164313332353164643839376135346161360a383661383534323861393963623931
+34633962643563393836663761626239306465383230326237613430653665663263353030623738
+6638353834333763360a396665313136393935646461353861326465363164366463646533623066
+36616235636636346238353736613435323936303435626335646265353634303737336332643830
+65636330363236616637346434376565313433373033343134613562326331346133653034326665
+34383939373565623763363137643766343434643738346236656234663431336531313865623863
+34353938636339663962343662626336643736363063613537613732663634366339656162363835
+63366661326363346239373432333238636363313132386331366665376632633232623439626331
+62326666326635393330356338373636383630376238303761323336363032653461373163353738
+66323336313735373364646233343161303662623830623839316132626464356461626531376665
+34353338663735626534313966306563623337623437333363326233393462643232313432363161
+61323936663030613566646561313133323565353239353463303765383832623263323630386536
+66613735626630656131663661663536326137363533313362386664326164343232363561303637
+66616335643636646562653433386131623466656232303935656562393035353536336664653334
+31363936656561636365383537626239373135363362363662303431613565323761363866663864
+61666263336239656665386133333831393139613461303462336562316362633465376661303662
+38313536343731626162613231303661366561346536616132333264363862616332363636623162
+37666363373535623732646532633533393333666464623634326434613566383161373432333938
+35653730356536313435623865326165353731656464626166326139373866643936393833626633
+35363762343038326364313735306632386539386435663033386532306364343731393533613532
+66393730363634623532666461303262336633656632653732373237656262656138323164656538
+62623466616435333164393934623965623266323538396632343965666264316438356237663330
+35653663656534633361333564346536306139623634386461636534663333373562383836663133
+35323432616239323665346666666536396365336331343536656331343932396366303031376439
+64343966313738306364366164623061306662323637396630346361613462346331656535353331
+63393031366330316330373930373333653739373264663063666165656161356437346361626439
+63373839323961653639396331316439326638633734366434303066313633393335323431346462
+34386237376364353936326433396138653436343237643334333063333264643937623136323165
+66336265663738613566353364323932393437303230343838356239373463643533626430643138
+64373138653438646332363836663033343337633261393238666135396164623263316666306438
+30313334386261363465326434393436313638636664343633666261343336616336323433343038
+38663438633964373637316139616535363338653133373236303862656263336339396430303964
+36356261353334623630353436633235653237386132623133353839313936333963383731326662
+34386239623962616339366633663134643961356239313566396162623833323632313132643932
+39366339373632613435623139653431393261373736623938613265636465646139633336316539
+33646435346536326165626437616131323331663262613961313637313735303962333338386239
+66306665613661653132613261623939346531393764376263663665663265383934653666633262
+36373332633032646365353334343238386635366336396332356666316264333739366237616335
+65373735633437626564373432323863623638646365393634343362336532653736383531386230
+31643032623664643761373939333839393237306531356664613238306233643439393037653032
+62386335303061653530616565323038666562303431373034623230333261333635323962623536
+39623834663736653738636265363937343233323236623430396432643938356531633731316630
+65666464323864633262623836653866623461613661623063633735306139323638633533373737
+66373339653963616461633364653933333431343439353165343833323561376261653032353636
+66663861336461623566373464343231313633333838366462323865626338393762643761343364
+65323736616234323632623138646566373138653135376138323062646233653332303934656461
+31616635386364356263653365333235393962633764326633623237613763663966663339306435
+61643835343038653062623635633336363362353839303439323136316365346638396564666536
+65663633363830306431626433376436636331393134336130323266313965376231386633373631
+66393434306636333636306239363666363938326339313762313732613038333735623437316537
+39353638656632376662373964643132653136633163356434383531626238356233313637333830
+66636361363437616534396661643434323762623966393035626334373161353266323232366263
+39376138336561336435353533663232383632356538636538363932646164313236373035396136
+36643565646133333335303735636631323634333232373466393537636132336431643036666461
+38623366663664653737303831396534383637663730313632366661666532383237643566653639
+61376664373562333738343830383862343864343532363835313562643266373936393331633835
+31663932376232663062336265643763353931346534663061656533303964393434656365393161
+31303361633933316537633562613736373635363164333132336163366232646330653335316433
+62373263306366373031653532353637393063353439376530613130376636343238626365366330
+34663662616164663034656536366263366664353662313433336164323864366330303837313863
+32653132616566336533626239303432373961623861636334383437623637386165623637386266
+34366335626265636661333139373462653766356264636236343535353134306364313637343137
+38363835396633313862626235663332396130386164383264393938656332653263383638623362
+3434
diff --git a/playbooks/files/alts/rabbitmq/server_certificate.pem b/playbooks/files/alts/rabbitmq/server_certificate.pem
new file mode 100644
index 0000000..3556014
--- /dev/null
+++ b/playbooks/files/alts/rabbitmq/server_certificate.pem
@@ -0,0 +1,70 @@
+$ANSIBLE_VAULT;1.1;AES256
+61303835643464306130613138343537363639636439613362343837613136343934353133313338
+3936636461313237363166346337633061346133366565360a653034633234633931613535316361
+61396661653461343637396434623463623535653761643033393030316138346531653335316536
+6230396131346232650a343331353666333632303438366334313739346236346536633463356562
+62653133666262303134373363376432373162323835346561336364616631623035323037383765
+32653837643966333636633562306663656637366465316336626135356538326464373166306230
+66623265323262653833313762393435303833663931653630616461626364363734653130383262
+30356130313464663461643139383831663334313662366564316636366431616161306334396231
+36653163303266643038316231323565363764333465396530653165376530653362666333303638
+37643133316135353930333833333034396333343137326533343331316666343439383639306662
+33373731656437306462643966353130383264396632613039656131653663386265663165636462
+39623938353163326564663539663038613764626230646532656366663937326536333030646535
+30623739346337346665356563313462323662393163353566386635613136386336336539653664
+65386237623166616265383961353265343631643533386138653730303361333765613664633132
+38356337643235633761363430373630623438343137643634653338393463306131626533323261
+35333631343266623436636235323236613536346262373161656639633136336631373231626131
+39386237646461373538633835653732326164376135616630626437366335316265393136656531
+36376530663733336361643537626538626338363265383733353339306438626430373662616264
+61643533383165663130666536313333656135303031336338383330623334626166393835376635
+61666131306634393933376561326334643561316539353534313132313839353531366539366364
+35646239353863393863636166613463373838643733366263393635616165313732376634346238
+33393936643362333039313233396131666363616231623261646639323630316561663363623039
+30303362313264313161666662633533333537376330313865643863316632396232633136393566
+33363432333737343364336233623663363463356335633862313138303539636239643565613264
+33613435343338623833663230323134363636373766373931313031346134383732333039656466
+64336237663635303163386438393637633633363237396137393539653330383238653732353231
+34373732636438323233323135653537383666623733376131306130333437313837353837333264
+32313563633865376164623035636536376130343966316134353037633263636335353966343338
+30633836646130396433383737356231633864333438616331333730313766323431333732623538
+33326431656164343933643238633930333738393237333731636366633963366332613333663564
+31356535396463316436646333346466373932636133396535613930623738346336613065333930
+64306533643131306465613335313064346263643439623064303738303733303030363763356132
+65356663623139663033666165663335333966323230356364303866303263396237313638636132
+30643031396165396335646330626232663233626462613431316238343737653263326464353862
+65396666353437333534346634343232393136383833666666636362376533623936623166393235
+62613735373963343665353830306131386466353964393538343735383036363630353631613236
+61616630346264333665653933316437376130326535383636396464313738633230653663366435
+31666239336163356161656365643964646236393165316365306434666233646263653630383837
+31326235663032333339363735363631656439393237393435656561663436643737313935643266
+65636336646465663665613235363965396661336462343933656432393338343762326662343663
+30313431643232383334376166313561633065313966636539626466633230346566616532613566
+61663831646232306332376464653438323032323633396633316535333835386465356138643435
+61346364386462343761653835653963633633383237323736376236303263366134343435666439
+33633230633434356138656239353430336238663863363536356135653963313866633266316236
+33623239663165643333373738306539316132613137613637323239643538623938663634333461
+38643838313463643732333438303962353661653335343835613335373230303864326464643462
+30656163396437386566346164643730636532636539383737336330643337383533313562366338
+39343663343630623233333565393235626433373938616533646233623066363931306564386233
+63326466396335663961386431393763633730333338616635343036663533323338336561613164
+30636531373665656665326462376537303838306565393635336333356336343564313164666638
+32623861663634373630366364613730636235653832346631313161303931646638323261633463
+61666130313564666238643738393631306166656531306637313566333661346466653461306263
+62613632303832656439323132373633396130633236383230626237636461353635333130383939
+63383636366263343635393932303238313130393732353936393763323232346633366537623465
+32353262346335313539336563303931366166353133653435613939306432316161333734303166
+38303336343332303038323164373764616665633234353434363739346139373737343936333333
+62306330396636396334623137646335393432383633343630346361346638323563633762616337
+66656565383262646262333032323561393235373830356330353536353139333864333039636164
+65366636326563613732613962373763363861653263336639643464626434313561623834336636
+66643063366466353461653365636662306133306131346233653563396533306531643564373530
+61616630373036386366373461356238323864643933316234623037316330383463356262343262
+32393931353937613136396165343538376534396661343737643531323635386138386339643163
+64366462323865616537656536633831343431353832373232303033643136323835626464396462
+35346233633664656337363165326638626633393135643531666437393939383835663363663531
+62643532326434396363396537353538393937396663326131346363383461386232343464386335
+30663166666238613333306636306564306666343234663538303031356636333034393237386334
+62363466616162663535386534623962363563643230663861643237656366396135373962343836
+62663838323032316164363363303733316234303130656661633435323163323065306236373438
+3062
diff --git a/playbooks/files/alts/rabbitmq/server_key.pem b/playbooks/files/alts/rabbitmq/server_key.pem
new file mode 100644
index 0000000..3750064
--- /dev/null
+++ b/playbooks/files/alts/rabbitmq/server_key.pem
@@ -0,0 +1,90 @@
+$ANSIBLE_VAULT;1.1;AES256
+64663165363261333061303533653835643863623261646462383434313563653565363661623261
+3531313135343264616537316266336566313337633763650a353531373530303937663962373832
+36336337613065323239323334633263633134313339666662396263656339333266623030303233
+3638393132653131610a653732343432316237306236306463613639303839393930356366303132
+64336539313834383134346631303561303231383332333031616233346537623730336461333732
+37303138663235616532333963333737353235326632633839333831303562323161666234383738
+37363032333865363537636263643863326162373530643134323633626263313164666433333566
+30616463323062333762376562356330326165396236313161346639336230336233613232633465
+65663863343561616563323736363030643062393838623332343431623231653931316362323866
+39346234623132623034363734333836303633623762656263623666623866363564626430313239
+63616231336433396161313062313665356433623634373561626637343732343432306366366436
+38346161303433333330386530653731343039646637316663333663343231616134633666336239
+66636432393334346461323038656234353664383162366530303136373535616435313362636266
+33626365646636656635366132646163333839653964346630356162393232386462376235646136
+33366431636238386332336536316639396266643465663463373935383936633034363234663637
+62356137656336373563373665393631343334353833643931633230363366666433613732346265
+62383462323636646539323665313063633331666262666534633334623231616133616636323331
+31623661613935656436313463313539643032653336363631643430626233343931623663613232
+66613263663630363162383236626531396533306563633862313561363039343730303962393533
+31363939326336623934633661313264316138383162363037373937656637363239396537643831
+30326434343830373436386661313866643338363862336565643638376639396234616631616535
+63333638653534306431646234363830623730303438393066353431376239376636626635653138
+33616161653730343033623166663963316666613961393664373031656338656531376239396330
+39623863333132323938623237343230326265633937306561356537646135656561383638346238
+65336262333835623834373334323634663736656338313266383932623530333761363962633361
+66653137616462373662633337303135646563313537383730653634306631306537653130396538
+62323966323932373761383738316332383733383637646434353935386566363665323135303831
+39323335663734363034393933313761613134616163376466323833666232313135626539656333
+32616665616634643239323131366134306232653734373264366462383731613766633136353734
+61623738613837643638643165656531383436633463326362663130373735353732353164376338
+62633334303663623434643730643836643164376534383933383230623733393837346364323861
+66303133633434303862336161643462313363306338396266353134376531383531666637663230
+62383165653736363664613539623037616562633136366466386530646136613061393132373832
+62383261376333623930663639366166306534343237386232356561646137323666306339323234
+35643462623539643532363830333238373138383434376433646234646631656266643663653665
+37383535383935343063633434613363376465353166326639316239616630613334316263316466
+31376561643432346363613535353232366435303033346232343331353931306661636538616462
+31613436343730383431393466326230613131663766303638353433373535386565653865633233
+35333066633961343738663664333762353938323436663335616464396530623337323163643432
+39393464313565363739363738643037326261306163613931353161623761343461356637363539
+33393664363239336161636362656334636136323762316139373030343136353165623837333463
+35366631353064613065363038393138363362356264366536663438396134653133343934323564
+35383461323830336431343164643730303636636163623861623438393235663166626563353138
+66616139613333626563363162616233386163363139303730633131623038623063626330323634
+64356530353538333563306633353163373330313635363130383435656566643935383835656331
+33363263663439656234656435653632623863323638383663373931326137636463383361366235
+65356565343631613263346338373464646431343939653661653731303330626464663433323562
+33363265613365313131653637643331353536326266643964326534626331323764643762333737
+32363036373935303838306136666237643164386431343530366664383664633936613735653365
+64356166323264303330343737643238643730646634306462383665356237616636666537623031
+35353330366338323166336232366233663732373330343738323139303164656562316466313631
+33313036366131316638613935343936643462643361303863363637303137363234343066653439
+37306133333863336266626337326266633738623664313364623836633335353430396538623130
+63613634373037396361306539393765363438656663383530303365356265326134363132646330
+38663565393434636432363063616130363039643638623333396434386530613935333934376539
+30353263303761343166663862323830313338656332376431383839376133326362303938303439
+39626138343661343436363338666538393635356461653361616338376333666530366233393263
+65646439316639303534643535633232356337653134313038653462633830306537663064343238
+62353334343135646565346330616533313832346635633534623762326137393237613563613562
+31326539366562643165313539396433656238306231623865336137666633656266623661313336
+38343537323431656531626333363834326135306264323163336233343861303864343561623163
+38643731643633363461323634356235633730306331666333613865633633396533616364666332
+31363531623435366663306664636130363131343363343934666366346639636337353432653864
+66306539336331323930363465633838393432656464313434376464333034343363343131386534
+64303733666262323362353463633266333165333636333334616632623934343838626430633136
+30343464666235643461393735616431646431653566633233373365366165353765643536303731
+62636232383161663063343463633231643132613431343664303162663534646233373064633037
+36393461663361656665316562393236306163643735363232323865346361393062346236306331
+66383134663163353865623037663864306238376333373931373766323366653266326431616436
+61643232303766333633383365353433633231396537626630666161613831363931366533393034
+30393961333636616434616438613566323737313166356235393933333534613037316135393266
+66313364303731623633306365393562383435303038333735633137656436333130353565623836
+38316339666138353938633838303531653535333664356235333934393265633565353562323461
+31363538313965386430633433376637343865333035356431373565653834316638393534393330
+31663666646332396266666563383233646562613161356135386666663364306466373036663336
+37613430313835323261613638653139396163343033363332613562306439663936643564333164
+37386230323033393437613839353364376263633439633762326238386638396537333933396630
+36646163313836656130303837613438323438326462633639346230613063363633613531346236
+66656134376131303835316137636331626637306131616131376232663037333161303763613038
+35613261363762346339336465316231336135613137363239386330626234393861633863376264
+36386665333865336135393036613637396565353935626238396534393830623935343239663464
+32396530326235643837636636303138313234366337353764333665366635366537373634636665
+34313030343238323439326362613266313166336163663866626536656463386331626532373561
+61613762346431663465356133346430643766303162343733333461383239343734326530376132
+31663261653865666461306462663238626432353566653931643335643838363438386166303636
+65656331613562333762633437303063373439393435303536373137376236363639303031356565
+35663134323631656630313734313531336235653031323964333537393138356536616164373532
+34366637633563303931316239653364643634616536333862316534623266646163643132636431
+36376436323165386635383832323562343033383962303637376565336163636366
diff --git a/playbooks/templates/alts_service_config.yaml.j2 b/playbooks/templates/alts_service_config.yaml.j2
new file mode 100644
index 0000000..3033a61
--- /dev/null
+++ b/playbooks/templates/alts_service_config.yaml.j2
@@ -0,0 +1,134 @@
+---
+{% if celery_ssl %}
+use_ssl: true
+ssl_config:
+  security_key: {{ celery_ssl_key }}
+  security_certificate: {{ celery_ssl_certificate }}
+  broker_ca_certificates: {{ celery_cacert }}
+{% endif %}
+
+broker_config:
+{% if broker_type == 'rabbitmq' %}
+  rabbitmq_host: {{ rabbitmq_host }}
+  rabbitmq_port: {{ rabbitmq_port }}
+{% if celery_ssl %}
+  use_ssl: true
+  rabbitmq_ssl_port: {{ rabbitmq_ssl_port }}
+{% endif %}
+  rabbitmq_user: {{ celery_rabbitmq_user | default(test_system_user, true) }}
+  rabbitmq_password: {{ test_system_password }}
+  rabbitmq_vhost: {{ test_system_vhost }}
+{% elif broker_type == 'redis' and alts_redis_host and alts_redis_port %}
+  redis_host: "{{ alts_redis_host }}"
+  redis_port: {{ alts_redis_port }}
+  redis_db_number: {{ alts_redis_results_db | default(0) }}
+{% if redis_requirepass %}
+  redis_password: "{{ redis_requirepass }}"
+{% endif %}
+{% endif %}
+broker_pool: {{ broker_pool }}
+
+results_backend_config:
+{% if result_backend_name == 'local' and celery_result_folder %}
+  path: file://{{ celery_result_folder }}
+{% elif result_backend_name == 'azure' and azure_connection_str is defined and azureblockblob_container_name is defined %}
+  azureblockblob_container_name: {{ azureblockblob_container_name }}
+  azureblockblob_base_path: 'celery_results/'
+  azure_connection_string: {{ azure_connection_str }}
+{% elif result_backend_name == 's3' %}
+  s3_access_key_id: {{ s3_key_id }}
+  s3_secret_access_key: {{ s3_access_key }}
+  s3_bucket: {{ s3_bucket }}
+  s3_base_path: 'celery_result_backend/'
+  s3_region: {{ s3_region }}
+  s3_endpoint_url:
+{% elif result_backend_name == 'redis' and alts_redis_host and alts_redis_port %}
+  redis_host: "{{ alts_redis_host }}"
+  redis_port: {{ alts_redis_port }}
+  redis_db_number: {{ alts_redis_results_db | default(1) }}
+{% if redis_requirepass %}
+  redis_password: "{{ redis_requirepass }}"
+{% endif %}
+{% else %}
+  result_backend: "{{ result_backend_name }}"
+{% endif %}
+
+task_default_queue: 'default'
+task_acks_late: true
+task_track_started: true
+artifacts_root_directory: 'test_system_artifacts'
+worker_prefetch_multiplier: {{ worker_prefetch_multiplier }}
+result_expires: {{ result_expires }}
+{% if alts_service | default('') == 'scheduler' %}
+jwt_secret: "{{ jwt_secret }}"
+{% endif %}
+
+{% if buildsys_url | default('') %}
+bs_host: "{{ buildsys_url }}"
+{% endif %}
+{% if buildsys_api_token | default('') %}
+bs_token: "{{ buildsys_api_token }}"
+{% endif %}
+logs_uploader_config:
+  pulp_host: {{ pulp_host }}
+  pulp_user: {{ pulp_user }}
+  pulp_password: {{ pulp_password }}
+{% if alts_rhel_flavors is defined %}
+rhel_flavors: {{ alts_rhel_flavors }}
+{% endif %}
+{% if alts_debian_flavors is defined %}
+debian_flavors: {{ alts_debian_flavors }}
+{% endif %}
+{% if alts_uninstall_excluded_pkgs is defined %}
+uninstall_excluded_pkgs: {{ alts_uninstall_excluded_pkgs }}
+{% endif %}
+enable_integrity_tests: False
+{% if deprecated_ansible_virtualenv_directory  is defined %}
+deprecated_ansible_venv: "{{ deprecated_ansible_virtualenv_directory }}"
+{% endif %}
+{% if package_proxy is defined %}
+package_proxy: "{{ package_proxy }}"
+{% endif %}
+{% if cleanup_yum_conf_docs_settings is defined %}
+cleanup_yum_conf_docs_settings: {{ cleanup_yum_conf_docs_settings | bool }}
+{% endif %}
+{% if ignore_ansible_install_errors is defined %}
+ignore_ansible_install_errors: {{ ignore_ansible_install_errors | bool }}
+{% endif %}
+{% if docker_image_overrides is defined %}
+docker_image_overrides: {{ docker_image_overrides | to_json }}
+{% endif %}
+{% if worker_type == 'opennebula' %}
+tests_base_dir: "{{ opennebula_tests_base_dir }}"
+{% if opennebula_rpc_endpoint and opennebula_username and opennebula_password and opennebula_vm_group and opennebula_network %}
+opennebula_config:
+  rpc_endpoint: "{{ opennebula_rpc_endpoint }}"
+  username: "{{ opennebula_username }}"
+  password: "{{ opennebula_password }}"
+  vm_group: "{{ opennebula_vm_group }}"
+  network: "{{ opennebula_network }}"
+{% endif %}
+{% endif %}
+{% if tests_exec_timeout is defined %}
+tests_exec_timeout: {{ tests_exec_timeout }}
+{% endif %}
+{% if centos_baseurl is defined %}
+centos_baseurl: "{{ centos_baseurl }}"
+{% endif %}
+{% if repositories_reference_directory is defined %}
+git_reference_directory: "{{ repositories_reference_directory }}"
+{% endif %}
+authorize_build_repositories: True
+sentry_dsn: "{{ alts_sentry_node_dsn }}"
+sentry_environment: "{{ alts_sentry_env }}"
+sentry_traces_sample_rate: {{ alts_sentry_traces_rate | float }}
+sentry_profiles_sample_rate: {{ alts_sentry_profiles_rate | float }}
+{% if epel_mirror_url is defined %}
+epel_mirror_url: "{{ epel_mirror_url }}"
+{% endif %}
+{% if epel_release_urls is defined %}
+epel_release_urls:
+{% for version, url in epel_release_urls.items() %}
+  "{{ version }}": "{{ url }}"
+{% endfor %}
+{% endif %}
diff --git a/requirements.yml b/requirements.yml
index e13d5b4..0dad480 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -3,6 +3,7 @@ roles:
   - name: ezamriy.fail2ban
     version: v0.1.0
   - name: geerlingguy.docker
+  - name: geerlingguy.redis
 
 collections:
   - name: community.docker
diff --git a/roles/alts_base/tasks/main.yml b/roles/alts_base/tasks/main.yml
new file mode 100644
index 0000000..b7beb0e
--- /dev/null
+++ b/roles/alts_base/tasks/main.yml
@@ -0,0 +1,36 @@
+---
+
+- name: Install yum-utils
+  ansible.builtin.dnf:
+    name: yum-utils
+    state: present
+
+- name: Update all packages
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest
+    skip_broken: true
+    nobest: true
+
+- name: Install EPEL repository
+  ansible.builtin.dnf:
+    name: epel-release
+    state: present
+
+- name: Allow 'wheel' group to have passwordless sudo
+  ansible.builtin.lineinfile:
+    dest: /etc/sudoers
+    state: present
+    regexp: '^%wheel'
+    line: '%wheel ALL=(ALL) NOPASSWD: ALL'
+    validate: 'visudo -cf %s'
+
+- name: Add "{{ test_system_user }}" user
+  ansible.builtin.user:
+    name: "{{ test_system_user }}"
+    groups: wheel
+    append: yes
+    generate_ssh_key: yes
+    ssh_key_bits: 4096
+    ssh_key_file: .ssh/id_rsa
+    state: present
diff --git a/roles/alts_celery/defaults/main.yml b/roles/alts_celery/defaults/main.yml
new file mode 100644
index 0000000..595bc58
--- /dev/null
+++ b/roles/alts_celery/defaults/main.yml
@@ -0,0 +1,8 @@
+---
+
+celery_venv_dir: /home/{{ test_system_user }}/.venv-celery
+plugin_cache_dir: "$HOME/.terraform.d/plugin-cache"
+opennebula_endpoint:
+opennebula_user:
+opennebula_password:
+opennebula_vm_group:
\ No newline at end of file
diff --git a/roles/alts_celery/handlers/main.yml b/roles/alts_celery/handlers/main.yml
new file mode 100644
index 0000000..500f351
--- /dev/null
+++ b/roles/alts_celery/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: Reload Celery service file
+  ansible.builtin.systemd:
+    service: alts-celery
+    state: reloaded
diff --git a/roles/alts_celery/tasks/main.yml b/roles/alts_celery/tasks/main.yml
new file mode 100644
index 0000000..2be159e
--- /dev/null
+++ b/roles/alts_celery/tasks/main.yml
@@ -0,0 +1,119 @@
+---
+
+- name: Detect PowerTools (CRB) repository name
+  set_fact:
+    powertools_repository_name: powertools
+  when: "ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'"
+
+- name: Detect PowerTools (CRB) repository name
+  set_fact:
+    powertools_repository_name: crb
+  when: "ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'"
+
+
+- name: Install needed packages
+  ansible.builtin.dnf:
+    name: [
+      "python3-pip", "python3-virtualenv", "librabbitmq",
+      "cmake", "libtool", "autoconf", "git", "ansible", "python3-devel",
+      "rust", "cargo", "openssl-devel"
+    ]
+    state: present
+    enablerepo:
+      - epel
+      - "{{ powertools_repository_name }}"
+
+- name: Configure Celery user
+  become: yes
+  become_user: "{{ test_system_user }}"
+  block:
+    - name: Clone ALTS repository
+      ansible.builtin.git:
+        repo: https://github.com/AlmaLinux/alts
+        dest: /home/{{ test_system_user }}/alts
+        force: true
+      tags:
+        - update
+
+    - name: Install Celery dependencies
+      ansible.builtin.pip:
+        virtualenv: "{{ celery_venv_dir }}"
+        requirements: /home/{{ test_system_user }}/alts/requirements/celery.txt
+      tags:
+        - update
+
+    - name: Create config and SSL folder
+      ansible.builtin.file:
+        path: "{{ item }}"
+        mode: 0755
+        state: directory
+      with_items:
+        - "{{ test_system_config_dir }}"
+        - "{{ celery_ssl_dir }}"
+
+    - name: Copy the ssl certificates
+      ansible.builtin.copy:
+        src: "{{ item.src }}"
+        dest: "{{ item.dest }}"
+        owner: "{{ test_system_user }}"
+        group: "{{ test_system_user }}"
+        mode: 0600
+        backup: "yes"
+      with_items:
+        - { src: "{{ celery_src_cacert }}", dest: "{{ celery_cacert }}" }
+        - { src: "{{ celery_ssl_src_key }}", dest: "{{ celery_ssl_key }}" }
+        - { src: "{{ celery_ssl_src_certificate }}", dest: "{{ celery_ssl_certificate }}" }
+      when: celery_ssl
+
+    - name: Create Celery config
+      ansible.builtin.template:
+        src: alts_service_config.yaml.j2
+        dest: "{{ test_system_config_dir }}/celery.yaml"
+      tags:
+        - celery-config
+        - update
+
+- name: Create Celery Systemd service file
+  ansible.builtin.template:
+    src: alts-celery.service.j2
+    dest: /etc/systemd/system/alts-celery.service
+    mode: 0644
+  tags:
+    - update
+
+- name: Create log files directory for Celery service
+  ansible.builtin.file:
+    path: "{{ celery_log_file_dir }}"
+    mode: 0755
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    state: directory
+  tags:
+    - update
+
+- name: Create folder for Celery local results
+  ansible.builtin.file:
+    path: "{{ celery_result_folder }}"
+    mode: 0755
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    state: directory
+  when: result_backend_name is defined and result_backend_name == 'local'
+
+- name: Create logrotate config
+  ansible.builtin.template:
+    src: celery-logrotate.j2
+    dest: /etc/logrotate.d/celery
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Enable and start Celery service
+  ansible.builtin.systemd:
+    name: alts-celery
+    masked: no
+    state: restarted
+    daemon_reload: yes
+    enabled: yes
+  tags:
+    - update
diff --git a/roles/alts_celery/templates/alts-celery.service.j2 b/roles/alts_celery/templates/alts-celery.service.j2
new file mode 100644
index 0000000..eac3a3e
--- /dev/null
+++ b/roles/alts_celery/templates/alts-celery.service.j2
@@ -0,0 +1,22 @@
+[Unit]
+Description=Celery worker for AL test system
+After=network.target
+
+[Service]
+User={{ test_system_user }}
+Group={{ test_system_user }}
+WorkingDirectory=/home/{{ test_system_user }}/alts
+Environment=CELERY_CONFIG_PATH={{ test_system_config_dir }}/celery.yaml
+ExecStartPre=-/usr/bin/find /tmp -maxdepth 1 -type d -name {{ worker_type }}_test_runner* -exec rm -rf {} +
+# Start through /bin/sh like alts-scheduler: under SELinux, systemd may not
+# execute binaries labelled as user home content directly
+ExecStart=/bin/sh -c 'exec {{ celery_venv_dir }}/bin/celery -A alts.worker.app worker \
+    --pool={{ celery_pool_type }} \
+    --concurrency={{ celery_concurrency }} \
+    -O fair \
+    -Q {{ celery_queues|join(",") }} \
+    --loglevel={{ celery_loglevel }} \
+    --logfile {{ celery_log_file }}'
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/alts_celery/templates/celery-logrotate.j2 b/roles/alts_celery/templates/celery-logrotate.j2
new file mode 100644
index 0000000..17aefa1
--- /dev/null
+++ b/roles/alts_celery/templates/celery-logrotate.j2
@@ -0,0 +1,8 @@
+compress
+missingok
+notifempty
+weekly
+copytruncate
+{{ celery_log_file }} {
+    rotate 4
+}
diff --git a/roles/alts_docker_customization/defaults/main.yml b/roles/alts_docker_customization/defaults/main.yml
new file mode 100644
index 0000000..6663212
--- /dev/null
+++ b/roles/alts_docker_customization/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+
+docker_open_files: 2048
diff --git a/roles/alts_docker_customization/files/docker-moby.conf b/roles/alts_docker_customization/files/docker-moby.conf
new file mode 100644
index 0000000..d1f9ac7
--- /dev/null
+++ b/roles/alts_docker_customization/files/docker-moby.conf
@@ -0,0 +1,7 @@
+[Service]
+EnvironmentFile=-/etc/sysconfig/docker
+ExecStart=
+ExecStart=/usr/bin/dockerd \
+          --host=fd:// \
+          --exec-opt native.cgroupdriver=systemd \
+          $OPTIONS
\ No newline at end of file
diff --git a/roles/alts_docker_customization/tasks/main.yml b/roles/alts_docker_customization/tasks/main.yml
new file mode 100644
index 0000000..414c43f
--- /dev/null
+++ b/roles/alts_docker_customization/tasks/main.yml
@@ -0,0 +1,48 @@
+---
+
+- set_fact:
+    docker_service_state: started
+
+- set_fact:
+    docker_proxy_path: "/usr/libexec/docker/docker-proxy"
+  when: "ansible_distribution == 'Fedora'"
+
+- set_fact:
+    docker_proxy_path: "/usr/bin/docker-proxy"
+  when: "ansible_facts.os_family == 'RedHat'"
+
+- name: Deploy docker options file
+  ansible.builtin.template:
+    src: docker-options.j2
+    dest: /etc/sysconfig/docker
+    mode: 0644
+    owner: root
+    group: root
+
+- name: Create docker service config directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/docker.service.d
+    state: directory
+    mode: 0755
+    owner: root
+    group: root
+
+- name: Deploy custom docker service configuration
+  ansible.builtin.copy:
+    src: docker-moby.conf
+    dest: /etc/systemd/system/docker.service.d/docker-moby.conf
+    mode: 0644
+    owner: root
+    group: root
+  register: config_deploy
+
+- set_fact:
+    docker_service_state: restarted
+  when: "config_deploy.changed"
+
+- name: Restart docker service if needed
+  ansible.builtin.systemd:
+    name: docker
+    state: "{{ docker_service_state }}"
+    enabled: yes
+    daemon_reload: yes
diff --git a/roles/alts_docker_customization/templates/docker-options.j2 b/roles/alts_docker_customization/templates/docker-options.j2
new file mode 100644
index 0000000..8336678
--- /dev/null
+++ b/roles/alts_docker_customization/templates/docker-options.j2
@@ -0,0 +1,7 @@
+# Modify these options if you want to change the way the docker daemon runs
+OPTIONS="--log-driver=journald \
+  --live-restore \
+  --default-ulimit nofile={{ docker_open_files }}:{{ docker_open_files }} \
+  --init-path /usr/libexec/docker/docker-init \
+  --userland-proxy-path {{ docker_proxy_path }} \
+"
\ No newline at end of file
diff --git a/roles/alts_flower/defaults/main.yml b/roles/alts_flower/defaults/main.yml
new file mode 100644
index 0000000..9f424a1
--- /dev/null
+++ b/roles/alts_flower/defaults/main.yml
@@ -0,0 +1,13 @@
+---
+
+flower_port: 5555
+flower_log_dir: /var/log/alts-flower
+flower_venv_dir: /home/{{ test_system_user }}/.venv-flower
+flower_version: 2.0.1
+flower_requirements_file: /home/{{ test_system_user }}/alts/requirements/base.txt
+# Celery config Flower takes broker settings from (scheduler config by default)
+flower_celery_config: "{{ test_system_config_dir }}/scheduler.yaml"
+flower_env_file: /etc/sysconfig/alts-flower
+flower_user: alts-mon
+# Must be set, Flower UI allows revoking tasks and controlling workers
+flower_password: ""
diff --git a/roles/alts_flower/tasks/main.yml b/roles/alts_flower/tasks/main.yml
new file mode 100644
index 0000000..1a3159b
--- /dev/null
+++ b/roles/alts_flower/tasks/main.yml
@@ -0,0 +1,102 @@
+---
+
+- name: Ensure Flower password is set
+  ansible.builtin.assert:
+    that:
+      - flower_password | length > 0
+    fail_msg: flower_password must be set to enable Flower basic auth
+    quiet: true
+  no_log: true
+  tags:
+    - update
+
+- name: Create Flower service log directory
+  ansible.builtin.file:
+    path: "{{ flower_log_dir }}"
+    state: directory
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    mode: "0755"
+  tags:
+    - update
+
+# Flower imports the ALTS Celery app, so it needs the ALTS dependencies.
+# Flower itself is pinned here rather than in the checkout's requirements,
+# so the role works with whatever ALTS revision is deployed
+- name: Install ALTS requirements for Flower
+  become: true
+  become_user: "{{ test_system_user }}"
+  ansible.builtin.pip:
+    virtualenv: "{{ flower_venv_dir }}"
+    requirements: "{{ flower_requirements_file }}"
+  register: flower_requirements
+  tags:
+    - update
+
+- name: Install Flower
+  become: true
+  become_user: "{{ test_system_user }}"
+  ansible.builtin.pip:
+    virtualenv: "{{ flower_venv_dir }}"
+    name: "flower=={{ flower_version }}"
+  register: flower_package
+  tags:
+    - update
+
+- name: Create Flower environment file
+  ansible.builtin.template:
+    src: alts-flower.env.j2
+    dest: "{{ flower_env_file }}"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  register: flower_env
+  tags:
+    - update
+
+- name: Create Flower Systemd service file
+  ansible.builtin.template:
+    src: alts-flower.service.j2
+    dest: /etc/systemd/system/alts-flower.service
+    owner: root
+    group: root
+    mode: "0644"
+  register: flower_unit_file
+  tags:
+    - update
+
+- name: Create logrotate config for Flower
+  ansible.builtin.template:
+    src: logrotate-flower.j2
+    dest: /etc/logrotate.d/alts-flower
+    owner: root
+    group: root
+    mode: "0644"
+  tags:
+    - update
+
+- name: Add Flower port to firewall
+  ansible.posix.firewalld:
+    zone: public
+    port: "{{ flower_port }}/tcp"
+    state: enabled
+    permanent: true
+    immediate: true
+  when: manage_firewall | default(true) | bool
+
+# Flower imports the ALTS Celery app from the checkout made by the
+# scheduler role, so it also needs a restart when that code changes
+- name: Enable and start Flower service
+  ansible.builtin.systemd:
+    name: alts-flower
+    enabled: true
+    daemon_reload: true
+    state: >-
+      {{ 'restarted'
+         if flower_requirements.changed or flower_package.changed
+            or flower_env.changed or flower_unit_file.changed
+            or (scheduler_code.changed | default(false))
+         else 'started' }}
+  tags:
+    - update
diff --git a/roles/alts_flower/templates/alts-flower.env.j2 b/roles/alts_flower/templates/alts-flower.env.j2
new file mode 100644
index 0000000..3a90f67
--- /dev/null
+++ b/roles/alts_flower/templates/alts-flower.env.j2
@@ -0,0 +1,2 @@
+CELERY_CONFIG_PATH={{ flower_celery_config }}
+FLOWER_BASIC_AUTH={{ flower_user }}:{{ flower_password }}
diff --git a/roles/alts_flower/templates/alts-flower.service.j2 b/roles/alts_flower/templates/alts-flower.service.j2
new file mode 100644
index 0000000..2ca51d1
--- /dev/null
+++ b/roles/alts_flower/templates/alts-flower.service.j2
@@ -0,0 +1,20 @@
+[Unit]
+Description=Flower monitoring dashboard for AL test system Celery
+After=network.target
+
+[Service]
+User={{ test_system_user }}
+Group={{ test_system_user }}
+WorkingDirectory=/home/{{ test_system_user }}/alts
+EnvironmentFile={{ flower_env_file }}
+# Start through /bin/sh like alts-scheduler: under SELinux, systemd may not
+# execute binaries labelled as user home content directly
+ExecStart=/bin/sh -c 'exec {{ flower_venv_dir }}/bin/celery -A alts.worker.app flower \
+    --port={{ flower_port }}'
+StandardOutput=append:{{ flower_log_dir }}/output.log
+StandardError=append:{{ flower_log_dir }}/error.log
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/alts_flower/templates/logrotate-flower.j2 b/roles/alts_flower/templates/logrotate-flower.j2
new file mode 100644
index 0000000..489fc1a
--- /dev/null
+++ b/roles/alts_flower/templates/logrotate-flower.j2
@@ -0,0 +1,11 @@
+compress
+missingok
+notifempty
+weekly
+copytruncate
+{{ flower_log_dir }}/output.log {
+    rotate 2
+}
+{{ flower_log_dir }}/error.log {
+    rotate 4
+}
diff --git a/roles/alts_rabbitmq_server/defaults/main.yml b/roles/alts_rabbitmq_server/defaults/main.yml
new file mode 100644
index 0000000..0ee676a
--- /dev/null
+++ b/roles/alts_rabbitmq_server/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+
+rabbitmq_port: 5672
+rabbitmq_ssl_port: 5671
diff --git a/roles/alts_rabbitmq_server/handlers/main.yml b/roles/alts_rabbitmq_server/handlers/main.yml
new file mode 100644
index 0000000..5b760ef
--- /dev/null
+++ b/roles/alts_rabbitmq_server/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: restart rabbitmq
+  service:
+    name: rabbitmq-server
+    state: restarted
diff --git a/roles/alts_rabbitmq_server/tasks/main.yml b/roles/alts_rabbitmq_server/tasks/main.yml
new file mode 100644
index 0000000..b74f0f2
--- /dev/null
+++ b/roles/alts_rabbitmq_server/tasks/main.yml
@@ -0,0 +1,162 @@
+---
+
+- name: Install RabbitMQ repository
+  block:
+    - name: Download repository setup script
+      get_url:
+        url: https://packagecloud.io/install/repositories/rabbitmq/rabbitmq-server/script.rpm.sh
+        dest: /tmp/rabbitm-repo-setup.sh
+        mode: 0755
+
+    - name: Execute repository setup script
+      command: /tmp/rabbitm-repo-setup.sh
+      environment:
+        os: el
+        dist: 8
+
+    - name: Delete setup script
+      file:
+        path: /tmp/rabbitm-repo-setup.sh
+        state: absent
+
+- name: Add Erlang repository
+  yum_repository:
+    name: erlang-latest
+    file: erlang
+    description: Erlang repository
+    baseurl: https://packagecloud.io/rabbitmq/erlang/el/$releasever/$basearch
+    gpgcheck: yes
+    state: present
+
+- name: Add Erlang repository GPG key
+  rpm_key:
+    key: https://packagecloud.io/rabbitmq/erlang/gpgkey
+    state: present
+
+- name: Install RabbitMQ server
+  yum:
+    name: rabbitmq-server
+    state: present
+    enablerepo: epel,powertools
+
+- name: Enable management plugin
+  rabbitmq_plugin:
+    names: rabbitmq_management
+    state: enabled
+  notify:
+    - restart rabbitmq
+
+- name: Flush handlers
+  meta: flush_handlers
+
+- name: Add RabbitMQ user
+  rabbitmq_user:
+    user: "{{ rabbitmq_admin_user }}"
+    password: "{{ rabbitmq_admin_password }}"
+    vhost: /
+    tags: administrator
+    configure_priv: .*
+    read_priv: .*
+    write_priv: .*
+    state: present
+
+- name: Add test system vhost
+  rabbitmq_vhost:
+    name: "{{ rabbitmq_test_system_vhost }}"
+    state: present
+
+- name: Add RabbitMQ test system user
+  rabbitmq_user:
+    user: "{{ test_system_user }}"
+    password: "{{ rabbitmq_test_system_password }}"
+    vhost: "{{ rabbitmq_test_system_vhost }}"
+    tags: test-system
+    configure_priv: .*
+    read_priv: .*
+    write_priv: .*
+    state: present
+
+- name: Add AMQP port to firewall
+  firewalld:
+    zone: public
+    port: "{{ item }}"
+    state: enabled
+    permanent: yes
+    immediate: yes
+  with_items:
+    - "{{ rabbitmq_port }}/tcp"
+    - "{{ rabbitmq_port }}/udp"
+
+- name: Configure SSL
+  block:
+    - name: Create SSL folder for rabbitmq
+      file:
+        path: "/etc/rabbitmq/ssl/"
+        owner: "rabbitmq"
+        group: "rabbitmq"
+        mode: 0750
+        state: "directory"
+      when: rabbitmq_ssl and rabbitmq_copy_ssl_files
+
+    - name: Copy the ssl certificates
+      copy:
+        src: "{{ item.src }}"
+        dest: "{{ item.dest }}"
+        owner: "rabbitmq"
+        group: "rabbitmq"
+        mode: 0640
+        backup: "yes"
+      with_items:
+        - { src: "{{ rabbitmq_cacert }}", dest: "{{ rabbitmq_conf_ssl_options_cacertfile }}" }
+        - { src: "{{ rabbitmq_server_key }}", dest: "{{ rabbitmq_conf_ssl_options_keyfile }}" }
+        - { src: "{{ rabbitmq_server_cert }}", dest: "{{ rabbitmq_conf_ssl_options_certfile }}" }
+
+    - name: Update configuration file as per parameters
+      ini_file:
+        path: /etc/rabbitmq/rabbitmq.conf
+        section:
+        option: "{{ item.name }}"
+        value: "{{ item.value }}"
+        state: present
+      with_items:
+        - { name: listeners.ssl.default, value: "{{ rabbitmq_ssl_port }}" }
+        - { name: ssl_options.verify, value: "{{ rabbitmq_ssl_verify }}" }
+        - { name: ssl_options.fail_if_no_peer_cert, value: "{{ rabbitmq_ssl_fail_if_no_peer_cert | to_json }}" }
+        - { name: ssl_options.cacertfile, value: "{{ rabbitmq_conf_ssl_options_cacertfile }}" }
+        - { name: ssl_options.certfile, value: "{{ rabbitmq_conf_ssl_options_certfile }}" }
+        - { name:  ssl_options.keyfile, value: "{{ rabbitmq_conf_ssl_options_keyfile }}" }
+
+      notify:
+        - restart rabbitmq
+
+    - name: Add AMQPS port to firewall
+      firewalld:
+        zone: public
+        port: "{{ item }}"
+        state: enabled
+        permanent: yes
+        immediate: yes
+      with_items:
+        - "{{ rabbitmq_ssl_port }}/tcp"
+        - "{{ rabbitmq_ssl_port }}/udp"
+
+    - name: Flush handlers
+      meta: flush_handlers
+
+  when: rabbitmq_ssl and rabbitmq_copy_ssl_files
+
+- name: Enable AMQP/AMQPS services on firewall
+  firewalld:
+    zone: public
+    service: "{{ item }}"
+    state: enabled
+    permanent: yes
+  with_items:
+    - amqp
+    - amqps
+
+- name: Enable and start RabbitMQ service
+  service:
+    name: rabbitmq-server
+    enabled: yes
+    state: started
diff --git a/roles/alts_scheduler/defaults/main.yml b/roles/alts_scheduler/defaults/main.yml
new file mode 100644
index 0000000..e57a52c
--- /dev/null
+++ b/roles/alts_scheduler/defaults/main.yml
@@ -0,0 +1,9 @@
+---
+
+scheduler_venv_dir: /home/{{ test_system_user }}/.venv-scheduler
+
+opennebula_endpoint:
+opennebula_user:
+opennebula_password:
+opennebula_vm_group:
+scheduler_http_port: 8000
diff --git a/roles/alts_scheduler/tasks/main.yml b/roles/alts_scheduler/tasks/main.yml
new file mode 100644
index 0000000..5aeeffc
--- /dev/null
+++ b/roles/alts_scheduler/tasks/main.yml
@@ -0,0 +1,136 @@
+---
+
+- name: Install python-pip and python-venv
+  yum:
+    name: ["python3-pip", "python3-virtualenv"]
+    state: present
+
+- name: Install git
+  yum:
+    name: git
+    state: present
+
+- name: Add scheduler user
+  user:
+    name: "{{ test_system_user }}"
+    generate_ssh_key: yes
+    ssh_key_bits: 4096
+    ssh_key_file: .ssh/id_rsa
+    state: present
+
+- name: Configure scheduler user
+  become: yes
+  become_user: "{{ test_system_user }}"
+  block:
+    - name: Clone ALTS repository
+      git:
+        repo: https://github.com/AlmaLinux/alts
+        dest: ~/alts
+      register: scheduler_code
+      tags:
+        - update
+
+    - name: Install scheduler dependencies
+      pip:
+        virtualenv: "{{ scheduler_venv_dir }}"
+        requirements: ~/alts/requirements/scheduler.txt
+      register: scheduler_requirements
+      tags:
+        - update
+
+    - name: Create config and SSL folder
+      file:
+        path: "{{ item }}"
+        mode: 0755
+        state: directory
+      with_items:
+        - "{{ test_system_config_dir }}"
+        - "{{ celery_ssl_dir }}"
+
+    - name: Copy the ssl certificates
+      copy:
+        src: "{{ item.src }}"
+        dest: "{{ item.dest }}"
+        owner: "{{ test_system_user }}"
+        group: "{{ test_system_user }}"
+        mode: 0600
+        backup: "yes"
+      with_items:
+        - {src: "{{ celery_src_cacert }}", dest: "{{ celery_cacert }}"}
+        - {src: "{{ celery_ssl_src_key }}", dest: "{{ celery_ssl_key }}"}
+        - {src: "{{ celery_ssl_src_certificate }}", dest: "{{ celery_ssl_certificate }}"}
+      when: celery_ssl
+
+    - name: Create scheduler config
+      template:
+        src: alts_service_config.yaml.j2
+        dest: "{{ test_system_config_dir }}/scheduler.yaml"
+      vars:
+        alts_service: scheduler
+      register: scheduler_config
+      tags:
+        - update
+
+- name: Create scheduler working directory
+  file:
+    path: "{{ scheduler_working_directory }}"
+    mode: 0755
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    state: directory
+  when: scheduler_working_directory is defined and scheduler_working_directory
+
+- name: Install firewalld
+  yum:
+    name: ["firewalld", "python3-firewall"]
+    state: present
+  when: manage_firewall | default(true) | bool
+
+- name: Ensure firewalld is running
+  service:
+    name: firewalld
+    state: started
+    enabled: yes
+  when: manage_firewall | default(true) | bool
+
+- name: Enable HTTP/HTTPS services on firewall
+  firewalld:
+    zone: public
+    service: "{{ item }}"
+    state: enabled
+    permanent: yes
+  with_items:
+    - http
+    - https
+  when: manage_firewall | default(true) | bool
+
+- name: Add scheduler port to firewall
+  firewalld:
+    zone: public
+    port: "{{ scheduler_http_port }}/tcp"
+    state: enabled
+    permanent: yes
+    immediate: yes
+  when: manage_firewall | default(true) | bool
+
+- name: Create scheduler Systemd service file
+  template:
+    src: alts-scheduler.service.j2
+    dest: /etc/systemd/system/alts-scheduler.service
+    mode: 0644
+  register: scheduler_unit_file
+  tags:
+    - update
+
+- name: Enable and start scheduler service
+  systemd:
+    name: alts-scheduler
+    enabled: yes
+    daemon_reload: yes
+    state: >-
+      {{ 'restarted'
+         if scheduler_code.changed or scheduler_requirements.changed
+            or scheduler_config.changed or scheduler_unit_file.changed
+         else 'started' }}
+  tags:
+    - update
diff --git a/roles/alts_scheduler/templates/alts-scheduler.service.j2 b/roles/alts_scheduler/templates/alts-scheduler.service.j2
new file mode 100644
index 0000000..a885718
--- /dev/null
+++ b/roles/alts_scheduler/templates/alts-scheduler.service.j2
@@ -0,0 +1,14 @@
+[Unit]
+Description=Scheduler service for AL test system
+After=network.target
+
+[Service]
+User={{ test_system_user }}
+Group={{ test_system_user }}
+Environment=CELERY_CONFIG_PATH={{ test_system_config_dir }}/scheduler.yaml
+Environment=SCHEDULER_FILE_PATH={{ test_system_config_dir }}/scheduler.yaml
+ExecStart=/bin/sh -c 'source {{ scheduler_venv_dir }}/bin/activate && cd ~/alts && uvicorn --host 0.0.0.0 \
+    --port {{ scheduler_http_port }} alts.scheduler.app:app'
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/alts_terraform/defaults/main.yml b/roles/alts_terraform/defaults/main.yml
new file mode 100644
index 0000000..291a8b0
--- /dev/null
+++ b/roles/alts_terraform/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+
+terraform_plugin_cache_dir: /home/{{ test_system_user }}/.terraform.d/plugins-cache
+terraform_version: 1.12.1
+terraform_arch: amd64
diff --git a/roles/alts_terraform/tasks/main.yml b/roles/alts_terraform/tasks/main.yml
new file mode 100644
index 0000000..49610ea
--- /dev/null
+++ b/roles/alts_terraform/tasks/main.yml
@@ -0,0 +1,124 @@
+---
+
+- name: Install unzip package
+  ansible.builtin.yum:
+    name: unzip
+    state: present
+  when: build_terraform is not defined
+
+- name: Download Terraform
+  ansible.builtin.get_url:
+    url: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_{{ terraform_arch }}.zip"
+    dest: /tmp/terraform.zip
+  when: build_terraform is not defined
+
+- name: Unpack Terraform
+  ansible.builtin.unarchive:
+    src: /tmp/terraform.zip
+    dest: /usr/local/bin
+    remote_src: yes
+  when: build_terraform is not defined
+
+- name: Delete archive
+  ansible.builtin.file:
+    path: /tmp/terraform.zip
+    state: absent
+  when: build_terraform is not defined
+
+- name: Install golang
+  ansible.builtin.yum:
+    name: golang
+    state: present
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Clone terraform repository
+  ansible.builtin.git:
+    repo: https://github.com/hashicorp/terraform.git
+    dest: /tmp/terraform
+    version: "{{ terraform_build_ver }}"
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Build terraform
+  ansible.builtin.shell: |
+    cd /tmp/terraform
+    GOBIN="/usr/local/bin/" go install .
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Verify terraform installation
+  ansible.builtin.command: terraform version
+
+- name: Remove terraform git directory
+  ansible.builtin.file:
+    path: /tmp/terraform
+    state: absent
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Clone docker provider
+  ansible.builtin.git:
+    repo: https://github.com/kreuzwerker/terraform-provider-docker.git
+    dest: /tmp/docker-provider
+    version: v"{{ docker_build_ver }}"
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Prepare dir for docker provider
+  ansible.builtin.file:
+    path: /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/
+    state: directory
+    mode: 0755
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Build docker provider
+  ansible.builtin.shell: |
+    cd /tmp/docker-provider
+    go build -o /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/terraform-provider-docker_{{ docker_build_ver }}
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Change provider ownership and permissions
+  ansible.builtin.file:
+    path: /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/terraform-provider-docker_{{ docker_build_ver }}
+    mode: 0755
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Remove docker provider git directory
+  ansible.builtin.file:
+    path: /tmp/docker-provider
+    state: absent
+  when: build_terraform is defined
+  tags:
+    - build-terraform
+
+- name: Add Terraform plugin cache directory
+  ansible.builtin.file:
+    path: "{{ terraform_plugin_cache_dir }}"
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    mode: 0755
+    state: directory
+
+- name: Create Terraform configuration file
+  ansible.builtin.template:
+    src: terraformrc.j2
+    dest: /home/{{ test_system_user }}/.terraformrc
+    owner: "{{ test_system_user }}"
+    group: "{{ test_system_user }}"
+    mode: 0644
diff --git a/roles/alts_terraform/templates/terraformrc.j2 b/roles/alts_terraform/templates/terraformrc.j2
new file mode 100644
index 0000000..35cee18
--- /dev/null
+++ b/roles/alts_terraform/templates/terraformrc.j2
@@ -0,0 +1,2 @@
+plugin_cache_dir = "{{ terraform_plugin_cache_dir }}"
+plugin_cache_may_break_dependency_lock_file = true
\ No newline at end of file