diff --git a/component/babeld/buildout.cfg b/component/babeld/buildout.cfg
index c3b3e21cb3e6bb3eff739ec43a287ee2547462cb..191b721dd9d7c47b3102de545edeb787df95ff88 100644
--- a/component/babeld/buildout.cfg
+++ b/component/babeld/buildout.cfg
@@ -1,10 +1,17 @@
 [buildout]
 parts = babeld
 
+[babeld-repository]
+recipe = slapos.recipe.build:gitclone
+repository = https://lab.nexedi.com/nexedi/babeld.git
+branch = master
+git-executable = ${git:location}/bin/git
+revision = hmac-nxd1
+
 [babeld]
 recipe = slapos.recipe.cmmi
-url = https://lab.nexedi.com/nexedi/babeld/repository/archive.tar.gz?ref=v1.8.4-nxd1
-md5sum = 536cca6abe34eb9faeda8682b80ee7bc
+path = ${babeld-repository:location}
+make-options = CC='gcc -std=gnu99'
 configure-command =
   echo "No configure.."
 
diff --git a/component/caddy/buildout.cfg b/component/caddy/buildout.cfg
index 22ecdcf94f5ee9e3d3264afe30f3bffede1f93eb..eb4008ae57f1f769231e1458031ec95c59614ee6 100644
--- a/component/caddy/buildout.cfg
+++ b/component/caddy/buildout.cfg
@@ -1,26 +1,35 @@
 [buildout]
 extends =
   ../../component/golang/buildout.cfg
-  gowork.cfg
 
 parts =
-  gowork
   caddy
 
 [gowork]
+# Caddy 1.x+ uses go modules, for which gowork does not work yet
 golang  = ${golang1.12:location}
 install =
-  github.com/mholt/caddy
+
+[gowork.goinstall]
+command = :
+depends =
+  ${caddy:recipe}
 
 [caddy]
-recipe  = slapos.recipe.cmmi
-path    = ${go_github.com_mholt_caddy:location}
-go      = ${gowork:golang}/bin/go
-configure-command = :
-make-targets =
-make-binary = cd ${:path}/caddy  && ${:go} install -v
-environment =
-  PATH=${pkgconfig:location}/bin:${gowork:golang}/bin:${buildout:bin-directory}:%(PATH)s
-  GOPATH=${gowork:directory}
+# revision and repository can be used to control which caddy version is used
+revision = v1.0.0
+repository = github.com/mholt/caddy/caddy
+
+recipe  = plone.recipe.command
+update-command = ${:command}
+stop-on-error = True
+# GO111MODULE=on enables go modules support
+# the chmod is needed as modules are fetched with u-w
+command =
+  . ${gowork:env.sh} &&
+  cd ${gowork:directory} &&
+  export GO111MODULE=on &&
+  go get ${:repository}@${:revision} &&
+  chmod -R u+w .
 output = ${gowork:bin}/caddy
 location = ${:output}
diff --git a/component/caddy/gowork.cfg b/component/caddy/gowork.cfg
deleted file mode 100644
index a91934ea8f22dbaa8b1c360ff419480e38fedbdc..0000000000000000000000000000000000000000
--- a/component/caddy/gowork.cfg
+++ /dev/null
@@ -1,13 +0,0 @@
-# Code generated by gowork-snapshot; DO NOT EDIT.
-
-# list of go git repositories to fetch
-[gowork.goinstall]
-depends_gitfetch  =
-    ${go_github.com_mholt_caddy:recipe}
-
-
-[go_github.com_mholt_caddy]
-<= go-git-package
-go.importpath = github.com/mholt/caddy
-repository    = https://lab.nexedi.com/nexedi/caddy.git
-revision      = nxd-v0.11.5-4-g9d3151db
diff --git a/component/geoip2/buildout.cfg b/component/geoip2/buildout.cfg
index 2e184a9dd9649208e2bf8c87b3dd4c8474072338..bef28085a260b650ff9ab368053e8eb6bbe896c4 100644
--- a/component/geoip2/buildout.cfg
+++ b/component/geoip2/buildout.cfg
@@ -17,5 +17,5 @@ rpath = ${:library-dirs}
 [geolite2-country]
 recipe = slapos.recipe.build:download-unpacked
 url = http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.tar.gz#${:md5sum}
-md5sum = 579c2286209e9f9f6c8eb0035fa55974
+md5sum = ff7bcb609291b9f5ab14397ccc506254
 strip-top-level-dir = true
diff --git a/component/golang/buildout.cfg b/component/golang/buildout.cfg
index 1ea786f992c22714896aff9b7dcb7672f44840e7..f4e263b1480f4560b2c9c8a3e0172360dbaf6447 100644
--- a/component/golang/buildout.cfg
+++ b/component/golang/buildout.cfg
@@ -64,8 +64,8 @@ environment-extra =
 
 [golang1.12]
 <= golang-common
-url = https://dl.google.com/go/go1.12.4.src.tar.gz
-md5sum = edb6bac6dc1ce0afc931d9e41ef3d2ef
+url = https://dl.google.com/go/go1.12.6.src.tar.gz
+md5sum = 48a4141fc718dd742d106431294f08bf
 
 # go1.11 needs go1.4 to bootstrap
 environment-extra =
diff --git a/software/caddy-frontend/buildout.hash.cfg b/software/caddy-frontend/buildout.hash.cfg
index d9b9b147987bcc5c0ea04fa3d6b6952f13b8cbca..32a348c636ad629f697edc11583b085dc42db97f 100644
--- a/software/caddy-frontend/buildout.hash.cfg
+++ b/software/caddy-frontend/buildout.hash.cfg
@@ -102,7 +102,7 @@ md5sum = 89839a3f4ab71cab459afd1c27d00326
 
 [template-configuration-state-script]
 filename = templates/configuration-state-script.sh.in
-md5sum = 00dfdc488548d1b14e89ba5f2f08fcb8
+md5sum = 8d55aea0a4ebc262d2f7c2f96dd5428c
 
 [template-rotate-script]
 filename = templates/rotate-script.sh.in
diff --git a/software/caddy-frontend/templates/configuration-state-script.sh.in b/software/caddy-frontend/templates/configuration-state-script.sh.in
index b08f767a983186e513031ec097cf6a4227458595..0295c94d50f8d42ed8bf886d5f911afac0aea58a 100644
--- a/software/caddy-frontend/templates/configuration-state-script.sh.in
+++ b/software/caddy-frontend/templates/configuration-state-script.sh.in
@@ -8,9 +8,11 @@ touch $SIGNATURE_FILE
 {{ sha256sum }} {{ path_list }} 2> /dev/null | sort -k 66 > $NSIGNATURE_FILE
 
 if diff "$SIGNATURE_FILE" "$NSIGNATURE_FILE" > /dev/null ; then
+  # No changes since last run just propagate information
   rm -f ${NSIGNATURE_FILE}
-  exit 1
+  exit 0
 else
+  # Changes since last run, so store new value and propagate information
   mv "$NSIGNATURE_FILE" "$SIGNATURE_FILE"
-  exit 0
+  exit 1
 fi
diff --git a/software/caddy-frontend/test/test.py b/software/caddy-frontend/test/test.py
index 83e88a9e028cbaf30e50ddc0e999e4d434559cce..2e37692ad8eaf843ab08a507a813070122932c37 100644
--- a/software/caddy-frontend/test/test.py
+++ b/software/caddy-frontend/test/test.py
@@ -4782,12 +4782,29 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
 
   @classmethod
   def setUpSlaves(cls):
-    _, cls.slave_key_pem, _, cls.slave_certificate_pem = \
+    _, cls.ssl_from_slave_key_pem, _, cls.ssl_from_slave_certificate_pem = \
       createSelfSignedCertificate(
         [
-          '*.customdomain.example.com',
-          '*.example.com',
+          'sslfromslave.example.com',
         ])
+    _, cls.ssl_from_slave_kedifa_overrides_key_pem, _, \
+        cls.ssl_from_slave_kedifa_overrides_certificate_pem = \
+        createSelfSignedCertificate(
+          [
+            'sslfromslavekedifaoverrides.example.com',
+          ])
+    _, cls.type_notebook_ssl_from_slave_key_pem, _, \
+        cls.type_notebook_ssl_from_slave_certificate_pem = \
+        createSelfSignedCertificate(
+          [
+            'typenotebooksslfromslave.example.com',
+          ])
+    _, cls.type_notebook_ssl_from_slave_kedifa_overrides_key_pem, _, \
+        cls.type_notebook_ssl_from_slave_kedifa_overrides_certificate_pem = \
+        createSelfSignedCertificate(
+          [
+            'typenotebooksslfromslavekedifaoverrides.example.com',
+          ])
 
     cls.ca = CertificateAuthority(
       'TestSlaveSlapOSMasterCertificateCompatibility')
@@ -4836,13 +4853,13 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       },
       'ssl_from_slave': {
         'url': cls.backend_url,
-        'ssl_crt': cls.slave_certificate_pem,
-        'ssl_key': cls.slave_key_pem,
+        'ssl_crt': cls.ssl_from_slave_certificate_pem,
+        'ssl_key': cls.ssl_from_slave_key_pem,
       },
       'ssl_from_slave_kedifa_overrides': {
         'url': cls.backend_url,
-        'ssl_crt': cls.slave_certificate_pem,
-        'ssl_key': cls.slave_key_pem,
+        'ssl_crt': cls.ssl_from_slave_kedifa_overrides_certificate_pem,
+        'ssl_key': cls.ssl_from_slave_kedifa_overrides_key_pem,
       },
       'custom_domain_ssl_crt_ssl_key': {
         'url': cls.backend_url,
@@ -4883,8 +4900,8 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       },
       'type-notebook-ssl_from_slave': {
         'url': cls.backend_url,
-        'ssl_crt': cls.slave_certificate_pem,
-        'ssl_key': cls.slave_key_pem,
+        'ssl_crt': cls.type_notebook_ssl_from_slave_certificate_pem,
+        'ssl_key': cls.type_notebook_ssl_from_slave_key_pem,
         'type': 'notebook',
       },
       'type-notebook-ssl_from_master_kedifa_overrides': {
@@ -4893,8 +4910,10 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       },
       'type-notebook-ssl_from_slave_kedifa_overrides': {
         'url': cls.backend_url,
-        'ssl_crt': cls.slave_certificate_pem,
-        'ssl_key': cls.slave_key_pem,
+        'ssl_crt':
+        cls.type_notebook_ssl_from_slave_kedifa_overrides_certificate_pem,
+        'ssl_key':
+        cls.type_notebook_ssl_from_slave_kedifa_overrides_key_pem,
         'type': 'notebook',
       }
     }
@@ -5079,7 +5098,7 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       parameter_dict['domain'], parameter_dict['public-ipv4'], 'test-path')
 
     self.assertEqual(
-      self.slave_certificate_pem,
+      self.ssl_from_slave_certificate_pem,
       der2pem(result.peercert))
 
     self.assertEqualResultJson(result, 'Path', '/test-path')
@@ -5111,7 +5130,7 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       parameter_dict['domain'], parameter_dict['public-ipv4'], 'test-path')
 
     self.assertEqual(
-      self.slave_certificate_pem,
+      self.ssl_from_slave_kedifa_overrides_certificate_pem,
       der2pem(result.peercert))
 
     self.assertEqualResultJson(result, 'Path', '/test-path')
@@ -5256,7 +5275,7 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       HTTPS_PORT)
 
     self.assertEqual(
-      self.slave_certificate_pem,
+      self.type_notebook_ssl_from_slave_certificate_pem,
       der2pem(result.peercert))
 
     self.assertEqualResultJson(result, 'Path', '/test-path')
@@ -5288,7 +5307,7 @@ class TestSlaveSlapOSMasterCertificateCompatibility(
       HTTPS_PORT)
 
     self.assertEqual(
-      self.slave_certificate_pem,
+      self.type_notebook_ssl_from_slave_kedifa_overrides_certificate_pem,
       der2pem(result.peercert))
 
     self.assertEqualResultJson(result, 'Path', '/test-path')
diff --git a/software/caucase/buildout.hash.cfg b/software/caucase/buildout.hash.cfg
index f825b508a65a32a36bbddec2a94e24b6c816f22d..93bbe8e85e1aaae11fff124901eccef431ae55c7 100644
--- a/software/caucase/buildout.hash.cfg
+++ b/software/caucase/buildout.hash.cfg
@@ -15,7 +15,7 @@
 # not need these here).
 [instance-caucased]
 filename = instance-caucased.cfg.jinja2
-md5sum = 31dc85cce6e419235a92c3c7682a89d1
+md5sum = 442e17a66b6f8d39f87903e147e3edaf
 
 [instance]
 filename = instance.cfg.jinja2
diff --git a/software/caucase/instance-caucase-input-schema.json b/software/caucase/instance-caucase-input-schema.json
index 8ee98087fec339a8fd6ab6ec4ddefe4ede280f4a..f9c851811cae1a9fcc06c834283a1e60ecc49adf 100644
--- a/software/caucase/instance-caucase-input-schema.json
+++ b/software/caucase/instance-caucase-input-schema.json
@@ -11,10 +11,7 @@
       "default": 8009
     },
     "external-url": {
-      "title": "External URL of base port",
-      "description": "When provided, this URL will be added to issued certificate as the CRL distribution point.",
-      "type": "string",
-      "format": "uri"
+      "$comment": "(deprecated)"
     },
     "service-auto-approve-amount": {
       "title": "Number of service certificate requests to automatically approve",
diff --git a/software/caucase/instance-caucased.cfg.jinja2 b/software/caucase/instance-caucased.cfg.jinja2
index 56fd1eb2840372ebbf746de2e4f89afd5fc922f6..db263d05f56151139372cd13284626b102744dca 100644
--- a/software/caucase/instance-caucased.cfg.jinja2
+++ b/software/caucase/instance-caucased.cfg.jinja2
@@ -1,6 +1,5 @@
 {% import "caucase" as caucase with context %}
-{% set ipv6 = (ipv6_set | list)[0] -%}
-{% set netloc = '[' ~ ipv6 ~ ']:' ~ slapparameter_dict.get('base-port', 8009) -%}
+{% set netloc = '[' ~ (ipv6_set | list)[0] ~ ']:' ~ slapparameter_dict.get('base-port', 8009) -%}
 
 [directory]
 recipe = slapos.cookbook:mkdirectory
diff --git a/software/erp5/instance-erp5-input-schema.json b/software/erp5/instance-erp5-input-schema.json
index 7a6dc0c76e9f74ade863793c192d6b5089da7548..0a4a8e05ad2bd0ef307c4cd2ab0e943549e79f1e 100644
--- a/software/erp5/instance-erp5-input-schema.json
+++ b/software/erp5/instance-erp5-input-schema.json
@@ -111,6 +111,11 @@
       },
       "type": "object"
     },
+    "wsgi": {
+      "description": "If set to true, Zope is run as a WSGI application, instead of using the Medusa HTTP server.",
+      "type": "boolean",
+      "default": false
+    },
     "zope-partition-dict": {
       "description": "Zope layout definition",
       "default": {
diff --git a/software/monitor/instance-monitor.cfg.jinja2 b/software/monitor/instance-monitor.cfg.jinja2
index a08f467f0953e65bfbd21bdfe130efee33062575..6128f611a21dde4ae4e9e30baa45b4078c16eb88 100644
--- a/software/monitor/instance-monitor.cfg.jinja2
+++ b/software/monitor/instance-monitor.cfg.jinja2
@@ -68,16 +68,6 @@ mod-ssl = ${:cache}/httpd_mod_ssl
 system-log = ${:private}/system-log
 consumption = ${:log}/consumption
 
-[monitor-httpd-configuration-file]
-context =
-  import json_module json
-  section directory monitor-directory
-  section monitor_parameters monitor-parameters
-  section httpd_configuration monitor-httpd-configuration
-  section monitor_rewrite_rule monitor-rewrite-rule
-  section slave_information slap-configuration
-  key monitor_private_hash slap-configuration:private-hash  
-
 [python-symlink]
 recipe = plone.recipe.command
 command = ln -sf {{ buildout_bin }}/pythonwitheggs ${monitor-directory:bin}/python
diff --git a/software/monitor/software.cfg b/software/monitor/software.cfg
index cf50b7f8dd92ea583c1665f28a19c0088e244b49..dcb105af913dd3f10f662ef4ff8410813ccb0b3f 100644
--- a/software/monitor/software.cfg
+++ b/software/monitor/software.cfg
@@ -28,7 +28,7 @@ mode = 0644
 recipe = slapos.recipe.build:download 
 url = ${:_profile_base_location_}/instance-monitor.cfg.jinja2
 destination = ${buildout:directory}/template-base-monitor.cfg
-md5sum = 2d9436dd6b116ee2e7cc7b30a6305475
+md5sum = dffe797be3a66d6838ffc70ee8f5f3ff
 mode = 0644
 
 [template-monitor-distributor]
diff --git a/software/powerdns/instance-powerdns.cfg b/software/powerdns/instance-powerdns.cfg
index 9a87c06d88dc47e9aa5dce28646719ec891341e2..6234b411d398c25a5d3f578590aefc58f853d94f 100644
--- a/software/powerdns/instance-powerdns.cfg
+++ b/software/powerdns/instance-powerdns.cfg
@@ -139,9 +139,6 @@ extra-context =
 {% endfor %}
 
 ####################
-# Monitoring
-[monitor-rewrite-rule]
-powerdns = http://$${pdns:local-ipv4}:$${pdns:webserver-port}/
 
 [buildout]
 parts =
diff --git a/software/powerdns/software.cfg b/software/powerdns/software.cfg
index 1c5733dab0ade160677ec4592e769c2c3290636e..4255f110f3ed55c7ff4cff5de74578698989837e 100644
--- a/software/powerdns/software.cfg
+++ b/software/powerdns/software.cfg
@@ -25,7 +25,7 @@ mode = 0644
 [template-powerdns]
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-powerdns.cfg
-md5sum = e623ae588e14cbfda69e28a3002eaa29
+md5sum = b2301de110ba95be46121dc18d7ca544
 output = ${buildout:directory}/template-powerdns.cfg
 mode = 0644
 
diff --git a/software/re6stnet/software.cfg b/software/re6stnet/software.cfg
index 57fe80afae7404255652e1baebe314f14558a138..8e2ae4149a3875d2b0dc6a705e10aad336b5a36c 100644
--- a/software/re6stnet/software.cfg
+++ b/software/re6stnet/software.cfg
@@ -109,10 +109,10 @@ filename = registry-run.in
 md5sum = 0bf4f2c03e06b55c6c6cc55fa33e65d6
 
 [versions]
-re6stnet = 0.520
+re6stnet = 0.530
 slapos.recipe.template = 4.3
 
 # Required by:
-# re6stnet==0.520
+# re6stnet==0.530
 miniupnpc = 1.9
 
diff --git a/software/slapos-master/buildout.hash.cfg b/software/slapos-master/buildout.hash.cfg
index 1aa48c43ec10d6a9d6465f2f293f9268119b3801..1ea64017de2b87ca6f71feaf6e0d3c03c085302b 100644
--- a/software/slapos-master/buildout.hash.cfg
+++ b/software/slapos-master/buildout.hash.cfg
@@ -14,7 +14,7 @@
 # not need these here).
 [template-erp5]
 filename = instance-erp5.cfg.in
-md5sum = 0c929dcaba31e024d94c63c4aee181d6
+md5sum = f3cc69df4d34d780af012260db9a4cf5
 
 [template-balancer]
 filename = instance-balancer.cfg.in
diff --git a/software/slapos-master/instance-erp5.cfg.in b/software/slapos-master/instance-erp5.cfg.in
index b873e571689e8f224ccfcc4a39ffc5fa79c8a76d..43270aab84fa4304650be11c7d6d6206e7b0c3fb 100644
--- a/software/slapos-master/instance-erp5.cfg.in
+++ b/software/slapos-master/instance-erp5.cfg.in
@@ -204,7 +204,7 @@ software-type = zope
 {%   set section_name = 'request-' ~ partition_name -%}
 {%   set zope_family = zope_parameter_dict.get('family', 'default') -%}
 {%   do zope_family_name_list.append(zope_family) %}
-{%   set backend_path = zope_parameter_dict.get('backend-path', '/') % {'site-id': site_id} %}
+{%   set backend_path = zope_parameter_dict.get('backend-path', '') % {'site-id': site_id} %}
 {#   # default jupyter zope family is first zope family. -#}
 {#   # use list.append() to update it, because in jinja2 set changes only local scope. -#}
 {%   if not jupyter_zope_family_default -%}
@@ -228,6 +228,7 @@ config-longrequest-logger-timeout = {{ dumps(zope_parameter_dict.get('longreques
 config-large-file-threshold = {{ dumps(zope_parameter_dict.get('large-file-threshold', "10MB")) }}
 config-port-base = {{ dumps(zope_parameter_dict.get('port-base', 2200)) }}
 config-webdav = {{ dumps(zope_parameter_dict.get('webdav', False)) }}
+config-wsgi = {{ dumps(slapparameter_dict.get('wsgi', False)) }}
 {%   if test_runner_enabled -%}
 config-test-runner-apache-url-list = ${publish-early:{{ zope_family }}-test-runner-url-list}
 {%   endif -%}
@@ -452,9 +453,6 @@ name = neo-${gen-neo-cluster-base:passwd}
 [gen-smtpd-sasl-password]
 < = gen-password
 
-[monitor-instance-parameter]
-monitor-httpd-port = 8386
-
 {{ root_common.common_section() }}
 
 [monitor-conf-parameters]
diff --git a/software/slaprunner/buildout.hash.cfg b/software/slaprunner/buildout.hash.cfg
index 65b632e18dfe4c320b764d2af86c761e0197c047..ede9a77217b022cd9927c6af7344d21a00de7fef 100644
--- a/software/slaprunner/buildout.hash.cfg
+++ b/software/slaprunner/buildout.hash.cfg
@@ -18,7 +18,7 @@ md5sum = c44a7481bb85e3258128afe3fcf23f44
 
 [template-runner]
 filename = instance-runner.cfg
-md5sum = 8f1da15d78ed08d9904ae94844a6893d
+md5sum = a5e2ae493b78a0f42d61cc79a0b2e686
 
 [template-runner-import-script]
 filename = template/runner-import.sh.jinja2
diff --git a/software/slaprunner/instance-runner-input-schema.json b/software/slaprunner/instance-runner-input-schema.json
index 869e28d2be8bd9ac1dbd17bafe03a63fc1bacbde..afd3053a63c983368d128c1aa1a562df4b5381d0 100644
--- a/software/slaprunner/instance-runner-input-schema.json
+++ b/software/slaprunner/instance-runner-input-schema.json
@@ -115,12 +115,17 @@
       ],
       "default": "false"
     },
-    "monitor-port": {
+    "slaprunner-httpd-port": {
+      "title": "Webrunner Server Port",
+      "description": "Port of the Apache server serving the Webrunner interface.",
+      "type": "integer",
+      "default": 9686
+    },
+    "monitor-httpd-port": {
       "title": "Monitor Port",
-      "description": "Allow to manually change the port on wich the apache server running monitoring interface is listening. The default value for the webrunner is different from the default value of the standalone stack-monitor server (default 9684)",
+      "description": "Port of the Apache server serving the monitoring interface.",
       "type": "integer",
-      "minimum": 9683,
-      "exclusiveMinimum": true
+      "default": 8386
     },
     "monitor-interface-url": {
       "title": "Monitor Web Interface URL",
diff --git a/software/slaprunner/instance-runner.cfg b/software/slaprunner/instance-runner.cfg
index a10abdb103d181d02a2418b2b8f27bf0a860bbcd..3a3e517cb1d3d50516fa02713b22a480721b1eb5 100644
--- a/software/slaprunner/instance-runner.cfg
+++ b/software/slaprunner/instance-runner.cfg
@@ -170,7 +170,7 @@ pidfile-instance = $${directory:run}/slapgrid-sr.pid
 ssh_client = ${openssh:location}/bin/ssh
 public_key = $${runner-sshd-raw-server:rsa-keyfile}.pub
 private_key = $${runner-sshd-raw-server:rsa-keyfile}
-instance-monitor-url = https://[$${:ipv6}]:$${monitor-parameters:port}
+instance-monitor-url = https://[$${:ipv6}]:$${slap-parameter:monitor-httpd-port}
 etc_dir = $${directory:etc}
 log_dir =  $${directory:log}
 run_dir = $${directory:run}
@@ -413,7 +413,6 @@ project_public_folder = $${runnerdirectory:public-project}
 runner_home = $${runnerdirectory:home}
 git_http_backend = ${git:location}/libexec/git-core/git-http-backend
 cgid_sock = $${directory:run}/cgid.sock
-#cgi_httpd_conf = $${monitor-httpd-configuration-file:rendered}
 httpd_cors_file = $${slaprunner-httpd-cors:location}
 
 [httpd-conf]
@@ -669,18 +668,12 @@ slapos-reference = 1.0
 auto-deploy = false
 auto-deploy-instance = true
 autorun = false
-slaprunner-httpd-port = $${:monitor-port}
-# XXX - for backward compatibility, monitor-port was for slaprunner httpd server
-monitor-port = 9686
+slaprunner-httpd-port = 9686
 instance-name =
 monitor-cors-domains =
 monitor-interface-url =
-# XXX - define a new port for monitor here and use monitor-port for backward compatibility
 monitor-httpd-port = 8386
 
-[monitor-parameters]
-port = $${slap-parameter:monitor-port}
-
 [slapos-cfg]
 recipe = slapos.recipe.template:jinja2
 template = ${template-slapos-cfg:location}/${template-slapos-cfg:filename}
diff --git a/stack/caucase/buildout.cfg b/stack/caucase/buildout.cfg
index 37845ea262d64d2f7022801e6545a996375a77e2..4f35b43232a32825b2d27a91951abeefa9e7544b 100644
--- a/stack/caucase/buildout.cfg
+++ b/stack/caucase/buildout.cfg
@@ -15,6 +15,8 @@ scripts =
   caucase
   caucase-probe
   caucase-updater
+  caucase-rerequest
+  caucase-key-id
   caucased
   caucased-manage
 
diff --git a/stack/erp5/buildout.cfg b/stack/erp5/buildout.cfg
index 41f307ddb9ada1493b152b5c8aaf01b90d98a522..1e8dc2e6275aecf9912864e1900a4982f9400c43 100644
--- a/stack/erp5/buildout.cfg
+++ b/stack/erp5/buildout.cfg
@@ -564,18 +564,25 @@ eggs = ${neoppod:eggs}
   unidiff
   jsonpickle
 
+# WSGI server
+  zope.globalrequest
+  waitress
+
 # parameterizing the version of the generated python interpreter name by the
 # python section version causes dependency between this egg section and the
 # installation of python, which we don't want on an instance
 interpreter = ${buildout:python}
+entry-points =
+  runwsgi=Products.ERP5.bin.zopewsgi:runwsgi
 scripts =
   apachedex
   repozo
+  runwsgi
   runzope
   runzeo
   tidstoraged
   tidstorage_repozo
-  web_checker_utility = erp5.util.webchecker:web_checker_utility
+  web_checker_utility
 
 extra-paths =
   ${erp5:location}
@@ -739,6 +746,8 @@ zbarlight = 2.0
 cloudpickle = 0.5.3
 dask = 0.18.1
 toolz = 0.9.0
+zope.globalrequest = 1.5
+waitress = 1.3.0
 
 # Re-add for as it is required to be there for uninstallation
 erp5.recipe.w3validator = 1.0.2
diff --git a/stack/erp5/buildout.hash.cfg b/stack/erp5/buildout.hash.cfg
index 62f27bc20312c952385277e7d86a4c03ff30e1a7..c00ac1d60b3fab7149ca85a5e017662459ceb959 100644
--- a/stack/erp5/buildout.hash.cfg
+++ b/stack/erp5/buildout.hash.cfg
@@ -34,7 +34,7 @@ md5sum = 13315c109deab534b81e7a45e7320eea
 
 [template-zope-conf]
 filename = zope.conf.in
-md5sum = adb25a1ab15c8aecf40a3952528f81c2
+md5sum = 114e0ac43281b943931754ed317ebc36
 
 [site-zcml]
 filename = site.zcml
@@ -78,7 +78,7 @@ md5sum = d41d8cd98f00b204e9800998ecf8427e
 
 [template-erp5]
 filename = instance-erp5.cfg.in
-md5sum = ff2f4d9f806fa783421d34204f2a74c8
+md5sum = fdecf814ba21b519612317061c2bd097
 
 [template-zeo]
 filename = instance-zeo.cfg.in
@@ -86,7 +86,7 @@ md5sum = 10a01b85c966ad9fe13bc981f1ddabe8
 
 [template-zope]
 filename = instance-zope.cfg.in
-md5sum = d9da770b4a83a58db8637f0eba97f4e8
+md5sum = 646f10824178eaa817cdef3479853bcf
 
 [template-balancer]
 filename = instance-balancer.cfg.in
diff --git a/stack/erp5/instance-erp5.cfg.in b/stack/erp5/instance-erp5.cfg.in
index 17362a63c0f54b48a3a816be96180f6d3d03d0b2..1fac5e7b78fbb65866865958f370db79b7d695a5 100644
--- a/stack/erp5/instance-erp5.cfg.in
+++ b/stack/erp5/instance-erp5.cfg.in
@@ -203,7 +203,7 @@ software-type = zope
 {%   set section_name = 'request-' ~ partition_name -%}
 {%   set zope_family = zope_parameter_dict.get('family', 'default') -%}
 {%   do zope_family_name_list.append(zope_family) %}
-{%   set backend_path = zope_parameter_dict.get('backend-path', '/') % {'site-id': site_id} %}
+{%   set backend_path = zope_parameter_dict.get('backend-path', '') % {'site-id': site_id} %}
 {#   # default jupyter zope family is first zope family. -#}
 {#   # use list.append() to update it, because in jinja2 set changes only local scope. -#}
 {%   if not jupyter_zope_family_default -%}
@@ -227,6 +227,7 @@ config-longrequest-logger-timeout = {{ dumps(zope_parameter_dict.get('longreques
 config-large-file-threshold = {{ dumps(zope_parameter_dict.get('large-file-threshold', "10MB")) }}
 config-port-base = {{ dumps(zope_parameter_dict.get('port-base', 2200)) }}
 config-webdav = {{ dumps(zope_parameter_dict.get('webdav', False)) }}
+config-wsgi = {{ dumps(slapparameter_dict.get('wsgi', False)) }}
 {%   if test_runner_enabled -%}
 config-test-runner-apache-url-list = ${publish-early:{{ zope_family }}-test-runner-url-list}
 {%   endif -%}
@@ -409,9 +410,6 @@ name = neo-${gen-neo-cluster-base:passwd}
 [gen-smtpd-sasl-password]
 < = gen-password
 
-[monitor-instance-parameter]
-monitor-httpd-port = 8386
-
 {{ root_common.common_section() }}
 
 [monitor-conf-parameters]
diff --git a/stack/erp5/instance-zope.cfg.in b/stack/erp5/instance-zope.cfg.in
index b3d2484c7667296fddc6a57be9713559f3e10d5e..460eee36fe7373ae1bdc9d7961813d1506288566 100644
--- a/stack/erp5/instance-zope.cfg.in
+++ b/stack/erp5/instance-zope.cfg.in
@@ -1,3 +1,5 @@
+{% set wsgi = slapparameter_dict['wsgi'] -%}
+{% set webdav = slapparameter_dict['webdav'] -%}
 {% set use_ipv6 = slapparameter_dict.get('use-ipv6', False) -%}
 {% set next_port = itertools.count(slapparameter_dict['port-base']).next -%}
 {% set site_id = slapparameter_dict['site-id'] -%}
@@ -182,7 +184,11 @@ pem = {{dumps(storage_dict.pop(k))}}
 [runzope-base]
 <= run-common
 instance-home = ${directory:instance}
+{% if wsgi -%}
+wrapped-command-line = '{{ bin_directory }}/runwsgi' {% if webdav %}-w{% endif %} {{ ipv4 }}:${:port} '${:configuration-file}'
+{% else -%}
 wrapped-command-line = '{{ bin_directory }}/runzope' -C '${:configuration-file}'
+{%- endif %}
 private-dev-shm = {{ slapparameter_dict['private-dev-shm'] }}
 
 [{{ section('zcml') }}]
@@ -249,13 +255,13 @@ tidstorage-port = {{ dumps(slapparameter_dict['tidstorage-port']) }}
 {% set thread_amount = slapparameter_dict['thread-amount'] -%}
 {% set large_file_threshold = slapparameter_dict['large-file-threshold']  -%}
 thread-amount = {{ thread_amount }}
-{% set webdav = slapparameter_dict['webdav'] -%}
 webdav = {{ dumps(webdav) }}
 {% if webdav -%}
 {%   set timerserver_interval = 0 -%}
 {% else -%}
 {%   set timerserver_interval = slapparameter_dict['timerserver-interval'] -%}
 {%- endif %}
+wsgi = {{ dumps(wsgi) }}
 timerserver-interval = {{ dumps(timerserver_interval) }}
 
 [zope-conf-base]
@@ -315,6 +321,9 @@ context =
 < = runzope-base
 wrapper-path = ${directory:service-on-watch}/{{ name }}
 configuration-file = {{ '${' ~ conf_name ~ ':rendered}' }}
+{%- if wsgi %}
+port = {{ port }}
+{%- endif %}
 
 [{{ section("promise-" ~ name) }}]
 recipe = slapos.cookbook:check_port_listening
diff --git a/stack/erp5/zope.conf.in b/stack/erp5/zope.conf.in
index ff9c8ca95a925ac75974a20aad0175a1b57e57ed..66a0557cf77be80325911bd96f6992ad17141262 100644
--- a/stack/erp5/zope.conf.in
+++ b/stack/erp5/zope.conf.in
@@ -22,15 +22,17 @@ rest-output-encoding utf-8
 # XXX: isn't this entry implicit ?
 products {{ parameter_dict['instance-products'] }}
 
-{% if parameter_dict['webdav'] -%}
+{% if not parameter_dict['wsgi'] -%}
+{%   if parameter_dict['webdav'] -%}
 <webdav-source-server>
   address {{ parameter_dict['ip'] }}:{{ parameter_dict['port'] }}
   force-connection-close off
 </webdav-source-server>
-{% else %}
+{%   else %}
 <http-server>
   address {{ parameter_dict['ip'] }}:{{ parameter_dict['port'] }}
 </http-server>
+{%   endif %}
 {%- endif %}
 
 <zoperunner>
@@ -68,7 +70,11 @@ large-file-threshold {{ parameter_dict['large-file-threshold'] }}
 
 {% set timerserver_interval = parameter_dict['timerserver-interval'] -%}
 {% if timerserver_interval -%}
+{%   if parameter_dict['wsgi'] -%}
+%import Products.TimerService.timerserver
+{%   else %}
 %import timerserver
+{%   endif -%}
 <timer-server>
   interval {{ timerserver_interval }}
 </timer-server>