diff --git a/classes/cluster/virtual-offline-ssl/init.yml b/classes/cluster/virtual-offline-ssl/init.yml
new file mode 100644
index 0000000..fb3c853
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/init.yml
@@ -0,0 +1,78 @@
+classes:
+- system.linux.network.dynamic_hosts
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.system.repo_local.mcp.apt_mirantis.ubuntu
+- system.linux.system.single
+- system.linux.system.single.debian
+- system.rsyslog.client.single
+- system.openssh.server.team.lab
+- system.openssh.server.team.tcpcloud
+- system.openssh.server.team.mcp_qa
+- cluster.virtual-offline-ssl.infra
+- cluster.virtual-offline-ssl.openstack
+parameters:
+  _param:
+    cluster_domain: virtual-offline-ssl.local
+    cluster_name: virtual-offline-ssl
+    salt_minion_ca_host: cfg01.${linux:system:domain}
+    # infra service addresses
+    infra_config_hostname: cfg01
+    infra_config_address: 172.16.10.100
+    local_repos: true
+    local_repo_url: mirror.mcp.mirantis.local.test
+    linux_repo_refresh_db: true
+    aptly_server_address: 10.170.0.226
+    remote_rsyslog_host: 127.0.0.3
+    remote_rsyslog_port: 10514
+  salt:
+    minion:
+      trusted_ca_minions:
+        - cfg01.${linux:system:domain}
+  rsyslog:
+    client:
+      run_user: syslog
+      run_group: adm
+      enabled: true
+      rainerscript:
+        module:
+          imfile: {}
+        input:
+          imfile:
+            nginx:
+              File: "/var/log/nginx/*.log"
+              Tag: "nginx__"
+              Severity: "notice"
+              Facility: "local0"
+              PersistStateInterval: "0"
+              Ruleset: "myapp_logs"
+            apache2:
+              File: "/var/log/apache2/*.log"
+              Tag: "apache2__"
+              Severity: "notice"
+              Facility: "local0"
+              Ruleset: "myapp_logs"
+              PersistStateInterval: "0"
+            rabbitmq:
+              File: "/var/log/rabbitmq/*.log"
+              Tag: "rabbitmq__"
+              Severity: "notice"
+              Facility: "local0"
+              PersistStateInterval: "0"
+              Ruleset: "myapp_logs"
+        template:
+          ImfileFilePath:
+            parameter:
+              type: string
+              string: "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%$.suffix%%msg:::sp-if-no-1st-sp%%msg%\n"
+        ruleset:
+          remote_logs:
+            description: 'action(type="omfwd" Target="${_param:remote_rsyslog_host}" Port="${_param:remote_rsyslog_port}" Protocol="udp" Template="ImfileFilePath")'
+          myapp_logs:
+            description: 'set $.suffix=re_extract($!metadata!filename, "(.*)/([^/]*[^/.log])", 0, 2, "all.log"); call remote_logs'
+      output:
+        remote:
+          somehost.domain:
+            action: "@${_param:remote_rsyslog_host}:${_param:remote_rsyslog_port}"
+            filter: "*.*"
+            enabled: true