diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml
index 4f11918747d404196089b10d0a7cc0b70135c404..22c5b06507c0434c98b259b882212242bc58a1f6 100644
--- a/inventory/group_vars/all.yml
+++ b/inventory/group_vars/all.yml
@@ -3,3 +3,11 @@
 hosts:
   alternative-mdx.pt-76.utr.surfcloud.nl:
     hostname: srv4
+    mdserver:
+      test:
+        signer: normal_signer
+        metadir: metadata/test
+    mdproxy:
+      test:
+        signer: 'http://localhost:5001'
+
diff --git a/playbook.yml b/playbook.yml
index e2bd310d8bc81e86b5fd0d6d9c9e875af27365ff..1b3801f4d8e13ebb849613bef1b04319e8792597 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -2,24 +2,26 @@
 - hosts: all
   gather_facts: true
   roles:
-    - {role: base,      tage: ['base']}
+    - {role: base,          tage: ['base']}
 
 - name: geoDNS
   hosts: geodns
   gather_facts: false
   roles:
-    - {role: geodns,    tags: ['geodns']}
+    - {role: geodns,        tags: ['geodns']}
 
 - name: MDServer
   hosts: mdserver
   gather_facts: false
   roles:
-    - {role: apache,    tags: ['apache']}
-    #- {role: mdserver,  tags: ['mdserver']}
+    - {role: apache,        tags: ['apache']}
+    - {role: alternate-mdx, tags: ['altmdx']}
+    - {role: mdserver,      tags: ['mdserver']}
 
 - name: MDProxy
   hosts: mdproxy
   gather_facts: false
   roles:
-    - {role: apache,    tags: ['apache']}
-    #- {role: mdproxy,   tags: ['mdproxy']}
+    - {role: apache,        tags: ['apache']}
+    - {role: alternate-mdx, tags: ['altmdx']}
+    - {role: mdproxy,       tags: ['mdproxy']}
diff --git a/roles/alternate-mdx/defaults/main.yml b/roles/alternate-mdx/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..fbb1c2792a381989ae8e6f3cc1b5fd37eaeec7c7
--- /dev/null
+++ b/roles/alternate-mdx/defaults/main.yml
@@ -0,0 +1,6 @@
+---
+
+altmdx_repo: https://gitlab.geant.org/TI_Incubator/alternate-mdx.git
+altmdx_version: master
+altmdx_dir: /opt/alternate-mdx
+altmdx_metadir: "{{ altmdx_dir }}/metadata"
diff --git a/roles/alternate-mdx/tasks/main.yml b/roles/alternate-mdx/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0ceef431399c502a412ec77504ea780155e4f465
--- /dev/null
+++ b/roles/alternate-mdx/tasks/main.yml
@@ -0,0 +1,21 @@
+---
+
+- name: Install packages
+  apt:
+    state: present
+    name:
+      - virtualenv
+      - python3-virtualenv
+      - swig
+
+- name: Clone alternative-mdx repository
+  ansible.builtin.git:
+    repo: "{{ altmdx_repo }}"
+    dest: "{{ altmdx_dir }}"
+    version: "{{ altmdx_version }}"
+  register: altmdx_git
+
+- name: Create python virtualenv
+  ansible.builtin.pip:
+    virtualenv: "{{ altmdx_dir }}"
+    requirements: "{{ altmdx_dir }}/requirements.txt"
diff --git a/roles/mdproxy/handlers/main.yml b/roles/mdproxy/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0111a860338e4468cdef9fa01b71500c1f8958d6
--- /dev/null
+++ b/roles/mdproxy/handlers/main.yml
@@ -0,0 +1,7 @@
+---
+- name: enable mdproxy job
+  systemd:
+    name: "mdproxy.service"
+    enabled: true
+    state: "restarted"
+    daemon_reload: true
diff --git a/roles/mdproxy/tasks/main.yml b/roles/mdproxy/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..8d6cadb252d1ff2b77d340245b570bc52db0b461
--- /dev/null
+++ b/roles/mdproxy/tasks/main.yml
@@ -0,0 +1,15 @@
+---
+
+- name: Create mdproxy config
+  ansible.builtin.template:
+    src: "mdproxy.yaml.j2"
+    dest: "{{ altmdx_dir }}/mdproxy.yaml"
+  notify:
+    - "enable mdproxy job"
+
+- name: Copy mdproxy service files
+  ansible.builtin.template:
+    src: "mdproxy.service.j2"
+    dest: "/etc/systemd/system/mdproxy.service"
+  notify:
+    - "enable mdproxy job"
diff --git a/roles/mdproxy/templates/mdproxy.service.j2 b/roles/mdproxy/templates/mdproxy.service.j2
new file mode 100644
index 0000000000000000000000000000000000000000..a411e2fd64d6c30a3a8090165f5925ef9ffea784
--- /dev/null
+++ b/roles/mdproxy/templates/mdproxy.service.j2
@@ -0,0 +1,15 @@
+[Unit]
+Description=MDProxy
+After=syslog.target network.target
+
+[Service]
+Type=simple
+WorkingDirectory={{ altmdx_dir }}
+ExecStart={{ altmdx_dir }}/bin/python -u mdproxy.py
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=10
+SyslogIdentifier=mdproxy
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/mdproxy/templates/mdproxy.yaml.j2 b/roles/mdproxy/templates/mdproxy.yaml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..e17c6fe8b22644e21927407b4bc27720df6ddf10
--- /dev/null
+++ b/roles/mdproxy/templates/mdproxy.yaml.j2
@@ -0,0 +1,2 @@
+---
+{{ hosts[inventory_hostname]['mdproxy'] | tojson }}
diff --git a/roles/mdserver/handlers/main.yml b/roles/mdserver/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..8f6dc766a235281ce93568b7ebac931fc59f25f8
--- /dev/null
+++ b/roles/mdserver/handlers/main.yml
@@ -0,0 +1,7 @@
+---
+- name: enable mdserver job
+  systemd:
+    name: "mdserver.service"
+    enabled: true
+    state: "restarted"
+    daemon_reload: true
diff --git a/roles/mdserver/tasks/main.yml b/roles/mdserver/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..9bbf9711ab5a18c98ac772e63e9b95d5facfce94
--- /dev/null
+++ b/roles/mdserver/tasks/main.yml
@@ -0,0 +1,43 @@
+---
+
+- name: Create mdserver config
+  ansible.builtin.template:
+    src: "mdserver.yaml.j2"
+    dest: "{{ altmdx_dir }}/mdserver.yaml"
+  notify:
+    - "enable mdserver job"
+
+- name: Create metadata dir
+  ansible.builtin.file:
+    path: "{{ altmdx_metadir }}"
+    state: directory
+    mode: '0755'
+
+- name: Create metadata subdirs
+  ansible.builtin.file:
+    path: "{{ altmdx_metadir }}/{{ item.key }}"
+    state: directory
+    mode: '0755'
+  with_dict: "{{ hosts[inventory_hostname]['mdserver'] }}"
+
+- name: Check existence of metadata signing cert
+  stat:
+    path: "{{ altmdx_metadir }}/meta.crt"
+  register: mdcert
+
+- name: create self-signed Metadata Signing SSL certs
+  shell: >
+    openssl genrsa -out "{{ altmdx_dir }}/meta.key" 2048;
+    openssl req -new -nodes -x509 -subj "/C=NL/CN=metadata"
+    -days 3650 -key "{{ altmdx_dir }}/meta.key"
+    -out "{{ altmdx_dir }}/meta.crt" -extensions v3_ca
+  args:
+    creates: "{{ altmdx_dir }}/meta.crt"
+  when: not mdcert.stat.exists
+
+- name: Copy mdserver service files
+  ansible.builtin.template:
+    src: "mdserver.service.j2"
+    dest: "/etc/systemd/system/mdserver.service"
+  notify:
+    - "enable mdserver job"
diff --git a/roles/mdserver/templates/mdserver.service.j2 b/roles/mdserver/templates/mdserver.service.j2
new file mode 100644
index 0000000000000000000000000000000000000000..6c6fb2611be0dd2f0d3c85e6a4b2113163cc44b0
--- /dev/null
+++ b/roles/mdserver/templates/mdserver.service.j2
@@ -0,0 +1,15 @@
+[Unit]
+Description=MDServer
+After=syslog.target network.target
+
+[Service]
+Type=simple
+WorkingDirectory={{ altmdx_dir }}
+ExecStart={{ altmdx_dir }}/bin/python -u mdserver.py
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=10
+SyslogIdentifier=mdserver
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/mdserver/templates/mdserver.yaml.j2 b/roles/mdserver/templates/mdserver.yaml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..b8fa37fdff0cfdf01a0609de43c151a1361b8e9a
--- /dev/null
+++ b/roles/mdserver/templates/mdserver.yaml.j2
@@ -0,0 +1,2 @@
+---
+{{ hosts[inventory_hostname]['mdserver'] | to_yaml }}