diff --git a/ceph/osd/cluster.yml b/ceph/osd/cluster.yml
index 9e98f91..31fa050 100644
--- a/ceph/osd/cluster.yml
+++ b/ceph/osd/cluster.yml
@@ -1,2 +1,8 @@
 classes:
 - service.ceph.osd.cluster
+parameters:
+  linux:
+    system:
+      kernel:
+        sysctl:
+          fs.aio-max-nr: 131072
diff --git a/docker/host.yml b/docker/host.yml
index 7e5fb8c..c3cc808 100644
--- a/docker/host.yml
+++ b/docker/host.yml
@@ -10,3 +10,6 @@
       insecure_registries:
         - ${_param:cluster_vip_address}:5000
         - ${_param:cluster_public_host}:5000
+      options:
+        ipv6: true
+        fixed-cidr-v6: fc00::/7
diff --git a/docker/swarm/stack/jenkins/master.yml b/docker/swarm/stack/jenkins/master.yml
index e974dee..1237fe3 100644
--- a/docker/swarm/stack/jenkins/master.yml
+++ b/docker/swarm/stack/jenkins/master.yml
@@ -2,7 +2,7 @@
 - system.docker
 parameters:
   _param:
-    docker_image_jenkins: tcpcloud/jenkins:2.83
+    docker_image_jenkins: tcpcloud/jenkins:2.89
     jenkins_master_extra_opts: ""
     jenkins_master_executors_num: 4
     jenkins_master_max_concurent_requests: 40
diff --git a/docker/swarm/stack/pushkin.yml b/docker/swarm/stack/pushkin.yml
index a1fc0a8..d0a3bce 100644
--- a/docker/swarm/stack/pushkin.yml
+++ b/docker/swarm/stack/pushkin.yml
@@ -8,6 +8,7 @@
     pushkin_ssl:
       enabled: false
     pushkin_db: pushkin
+    pushkin_db_host: ${_param:haproxy_postgresql_bind_host}
     pushkin_smtp_host: smtp.gmail.com
     pushkin_smtp_port: 587
     webhook_from: your_sender@mail.com
@@ -30,7 +31,7 @@
             POSTGRES_USER: ${_param:pushkin_db_user}
             POSTGRES_PASSWORD: ${_param:pushkin_db_user_password}
             POSTGRES_DB: ${_param:pushkin_db}
-            PUSHKINDBHOST: ${_param:postgresql_bind_host}
+            PUSHKINDBHOST: ${_param:pushkin_db_host}
             PUSHKINELASTICHOST: ${_param:pushkin_elasticsearch}
             WEBHOOK_FROM: ${_param:webhook_from}
             EMAIL_SENDER_PASSWORD: ${_param:pushkin_email_sender_password}
diff --git a/fluentd/label/default_output/file.yml b/fluentd/label/default_output/file.yml
new file mode 100644
index 0000000..5e0050d
--- /dev/null
+++ b/fluentd/label/default_output/file.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    fluentd_default_output_file: /var/log/td-agent/default-all.log
+  fluentd:
+    config:
+      dollar: '$'
+      label:
+        default_output:
+          filter:
+            add_general_fields:
+              tag: "**"
+              type: record_transformer
+              enable_ruby: true
+              record:
+                - name: Type
+                  value: log
+                - name: environment_label
+                  value: ${_param:cluster_domain}
+                - name: Hostname
+                  value: ${fluentd:config:dollar}{ hostname }
+                - name: Timestamp
+                  value: ${fluentd:config:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S%z') }
+          match:
+            everything:
+              tag: '**'
+              type: 'file'
+              path: ${_param:fluentd_default_output_file}
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index daafadd..7d470b6 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -127,6 +127,7 @@
         - staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter bitwiseNegate java.lang.Object
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods toBoolean java.lang.Boolean
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods multiply java.lang.String java.lang.Number
         - method java.io.File listFiles
         - method java.lang.String concat java.lang.String
         - method org.jenkinsci.plugins.workflow.steps.FlowInterruptedException getCauses
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index 699ea82..74665e7 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -296,6 +296,9 @@
             - name: telegraf
               upload_source_package: false
               dist: trusty
+            - name: tinyproxy
+              upload_source_package: false
+              dist: trusty
             - name: tftpd-hpa
               upload_source_package: false
               dist: trusty
@@ -608,6 +611,9 @@
             - name: telegraf
               upload_source_package: true
               dist: xenial
+            - name: tinyproxy
+              upload_source_package: true
+              dist: xenial
             - name: tftpd-hpa
               upload_source_package: true
               dist: xenial
diff --git a/jenkins/client/job/deploy/update/upgrade.yml b/jenkins/client/job/deploy/update/upgrade.yml
index efbd153..415e0b4 100644
--- a/jenkins/client/job/deploy/update/upgrade.yml
+++ b/jenkins/client/job/deploy/update/upgrade.yml
@@ -35,3 +35,7 @@
               type: boolean
               default: 'true'
               description: "Rollback if control upgrade fails"
+            SKIP_VM_RELAUNCH:
+              type: boolean
+              default: 'false'
+              description: "Set to true if vms should not be recreated"
diff --git a/jenkins/client/job/oscore/init.yml b/jenkins/client/job/oscore/init.yml
index 171ff6e..fc06d59 100644
--- a/jenkins/client/job/oscore/init.yml
+++ b/jenkins/client/job/oscore/init.yml
@@ -1,5 +1,6 @@
 classes:
   - system.jenkins.client.job.oscore.tests
+  - system.jenkins.client.job.oscore.qa
 parameters:
   jenkins:
     client:
@@ -7,4 +8,4 @@
         "OSCORE":
           enabled: true
           type: ListView
-          include_regex: "^oscore-.*"
\ No newline at end of file
+          include_regex: "^oscore-.*"
diff --git a/jenkins/client/job/oscore/qa.yml b/jenkins/client/job/oscore/qa.yml
new file mode 100644
index 0000000..1fa2ab3
--- /dev/null
+++ b/jenkins/client/job/oscore/qa.yml
@@ -0,0 +1,48 @@
+parameters:
+  jenkins:
+    client:
+      job_template:
+        oscore-build-docker-image:
+          name: "{{job_prefix}}-{{oscore-qa-project}}-build-docker-image"
+          template:
+            discard:
+              build:
+                keep_num: 25
+              artifact:
+                keep_num: 25
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: build-docker-image-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  mcp/{{oscore-qa-project}}:
+                    branches:
+                      - master
+                event:
+                  change:
+                    - merged
+            param:
+              GIT_URL:
+                type: string
+                default: "ssh://mcp-ci-gerrit@gerrit.mcp.mirantis.net:29418/mcp/{{oscore-qa-project}}"
+              GIT_REF:
+                type: string
+                default: "master"
+              GIT_CREDS_ID:
+                type: string
+                default: "mcp-ci-gerrit"
+              IMAGE_NAME:
+                type: string
+                default: "mirantis/oscore/{{oscore-qa-project}}"
+              IMAGE_TAG:
+                type: string
+                default: "latest"
+              DOCKER_REGISTRY:
+                type: string
+                default: "docker-prod-local.docker.mirantis.net"
diff --git a/jenkins/client/job/oscore/tests.yml b/jenkins/client/job/oscore/tests.yml
index 5e5f743..4844708 100644
--- a/jenkins/client/job/oscore/tests.yml
+++ b/jenkins/client/job/oscore/tests.yml
@@ -163,6 +163,9 @@
                 type: string
                 description: Job for results processing
                 default: "{{proc_results_job}}"
+              SLAVE_NODE:
+                type: string
+                default: 'python'
               # salt
               SALT_MASTER_CREDENTIALS:
                 type: string
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index 90a96a0..2de63a5 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -223,6 +223,8 @@
               branches: ${_param:salt_formulas_branches}
             - name: telegraf
               branches: ${_param:salt_formulas_branches}
+            - name: tinyproxy
+              branches: ${_param:salt_formulas_branches}
             - name: varnish
               branches: ${_param:salt_formulas_branches}
             - name: xtrabackup
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 236e4d6..3b3eb43 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -114,7 +114,9 @@
             - name: supervisor
             - name: swift
             - name: taiga
+            - name: tinyproxy
             - name: telegraf
+            - name: tinyproxy
             - name: tftpd-hpa
             - name: varnish
             - name: xtrabackup
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index 5e7e82b..0440b28 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -164,7 +164,7 @@
                 default: "1"
               EXTRA_FORMULAS:
                 type: string
-                default: "xtrabackup docker haproxy aptly keepalived gerrit jenkins openldap maas"
+                default: "xtrabackup docker haproxy aptly keepalived gerrit jenkins openldap maas backupninja"
       job:
         test-salt-model-node:
           name: test-salt-model-node
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index 1c9aafc..6d3ecda 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -59,6 +59,22 @@
                 - smoke
                 - full
               description: Set of Tempest tests to run
+            TEMPEST_CONFIG_REPO:
+              type: string
+              default: ""
+              description: Git repository with configuration files for Tempest
+            TEMPEST_CONFIG_BRANCH:
+              type: string
+              default: ""
+              description: Git branch which will be used during the checkout
+            TEMPEST_REPO:
+              type: string
+              default: ""
+              description: Git repository with Tempest
+            TEMPEST_VERSION:
+              type: string
+              default: ""
+              description: Version of Tempest (tag, branch or commit)
             TEST_K8S_NODE:
               type: string
               default: ""
@@ -102,6 +118,14 @@
               type: string
               default: "m1.tiny"
               description: Flavor name for Rally scenarios
+            RALLY_CONFIG_REPO:
+              type: string
+              default: ""
+              description: Git repository with configuration files for Rally
+            RALLY_CONFIG_BRANCH:
+              type: string
+              default: ""
+              description: Git branch which will be used during the checkout
             AVAILABILITY_ZONE:
               type: string
               default: "nova"
diff --git a/linux/system/repo/saltstack/rhel.yml b/linux/system/repo/saltstack/rhel.yml
index b0f28f3..ba045c5 100644
--- a/linux/system/repo/saltstack/rhel.yml
+++ b/linux/system/repo/saltstack/rhel.yml
@@ -6,9 +6,11 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           humanname: "SaltStack repo for RHEL/CentOS ${rhel_repo_releasever}"
           source: "https://repo.saltstack.com/yum/redhat/${_param:rhel_releasever}/${_param:rhel_basearch}/${_param:salt_version}"
           gpgkey: "https://repo.saltstack.com/yum/redhat/${_param:rhel_releasever}/${_param:rhel_basearch}/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
           gpgcheck: true
           architectures: amd64
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack/trusty.yml b/linux/system/repo/saltstack/trusty.yml
index 68ce215..a4bde9a 100644
--- a/linux/system/repo/saltstack/trusty.yml
+++ b/linux/system/repo/saltstack/trusty.yml
@@ -4,7 +4,9 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version} trusty main"
           architectures: amd64
-          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack/xenial.yml b/linux/system/repo/saltstack/xenial.yml
index aca462a..e63ff41 100644
--- a/linux/system/repo/saltstack/xenial.yml
+++ b/linux/system/repo/saltstack/xenial.yml
@@ -4,7 +4,9 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version} xenial main"
           architectures: amd64
-          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack_2016_3_trusty.yml b/linux/system/repo/saltstack_2016_3_trusty.yml
index c7e03d7..d968734 100644
--- a/linux/system/repo/saltstack_2016_3_trusty.yml
+++ b/linux/system/repo/saltstack_2016_3_trusty.yml
@@ -3,6 +3,8 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3 trusty main"
-          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack_2016_3_xenial.yml b/linux/system/repo/saltstack_2016_3_xenial.yml
index 413294f..ee2189a 100644
--- a/linux/system/repo/saltstack_2016_3_xenial.yml
+++ b/linux/system/repo/saltstack_2016_3_xenial.yml
@@ -3,6 +3,8 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3 xenial main"
-          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/nginx/server/proxy/graphite_web.yml b/nginx/server/proxy/graphite_web.yml
index 02035cd..2f3e1e8 100644
--- a/nginx/server/proxy/graphite_web.yml
+++ b/nginx/server/proxy/graphite_web.yml
@@ -8,7 +8,7 @@
           type: nginx_proxy
           name: graphite
           proxy:
-            host: mon
+            host: ${_param:stacklight_monitor_hostname}
             port: 80
             protocol: http
           host:
diff --git a/nginx/server/proxy/infra/sphinx.yml b/nginx/server/proxy/infra/sphinx.yml
index 5f733ac..b7bbfc1 100644
--- a/nginx/server/proxy/infra/sphinx.yml
+++ b/nginx/server/proxy/infra/sphinx.yml
@@ -8,7 +8,7 @@
           type: nginx_proxy
           name: sphinx
           proxy:
-            host: prx
+            host: ${_param:openstack_proxy_hostname}
             port: 8090
             protocol: http
           host:
diff --git a/nginx/server/proxy/openstack_api.yml b/nginx/server/proxy/openstack_api.yml
index 2b84993..4b0b3f4 100644
--- a/nginx/server/proxy/openstack_api.yml
+++ b/nginx/server/proxy/openstack_api.yml
@@ -88,7 +88,7 @@
         nginx_proxy_openstack_api_heat_cloudwatch:
           enabled: true
           type: nginx_proxy
-          name: openstack_api_heat_cfn
+          name: openstack_api_heat_cloudwatch
           proxy:
             host: ${_param:heat_service_host}
             port: 8003
@@ -100,7 +100,7 @@
         nginx_proxy_openstack_api_heat_cfn:
           enabled: true
           type: nginx_proxy
-          name: openstack_api_heat_cloudwatch
+          name: openstack_api_heat_cfn
           proxy:
             host: ${_param:heat_service_host}
             port: 8000
diff --git a/nginx/server/proxy/sensu_web.yml b/nginx/server/proxy/sensu_web.yml
index e06120d..c250a49 100644
--- a/nginx/server/proxy/sensu_web.yml
+++ b/nginx/server/proxy/sensu_web.yml
@@ -8,7 +8,7 @@
           type: nginx_proxy
           name: sensu
           proxy:
-            host: mon
+            host: ${_param:stacklight_monitor_hostname}
             port: 3000
             protocol: http
           host:
diff --git a/nginx/server/proxy/sphinx_web.yml b/nginx/server/proxy/sphinx_web.yml
index 5f733ac..b7bbfc1 100644
--- a/nginx/server/proxy/sphinx_web.yml
+++ b/nginx/server/proxy/sphinx_web.yml
@@ -8,7 +8,7 @@
           type: nginx_proxy
           name: sphinx
           proxy:
-            host: prx
+            host: ${_param:openstack_proxy_hostname}
             port: 8090
             protocol: http
           host:
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index 5d0e6a1..e8b29cc 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -1,5 +1,6 @@
 classes:
 - service.nova.compute.kvm
+- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -94,3 +95,15 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
+      libvirt:
+        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
+  iptables:
+    service:
+      enabled: true
+      chain:
+        INPUT:
+          rules:
+            # deny any connections to libvirt port
+            - destination_port: 16509
+              protocol: tcp
+              jump: DROP
\ No newline at end of file
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index b915145..d5126df 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -2,6 +2,7 @@
 - nova
 classes:
 - service.nova.compute.kvm
+- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -90,3 +91,15 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
+      libvirt:
+        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
+  iptables:
+    service:
+      enabled: true
+      chain:
+        INPUT:
+          rules:
+            # deny any connections to libvirt port
+            - destination_port: 16509
+              protocol: tcp
+              jump: DROP
\ No newline at end of file
diff --git a/openssh/server/team/members/crh.yml b/openssh/server/team/members/crh.yml
new file mode 100644
index 0000000..8179415
--- /dev/null
+++ b/openssh/server/team/members/crh.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        crh:
+          enabled: true
+          name: crh
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        crh:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
+          user: ${linux:system:user:crh}
diff --git a/openssh/server/team/stacklight.yml b/openssh/server/team/stacklight.yml
index 403e7e1..e1f09f3 100644
--- a/openssh/server/team/stacklight.yml
+++ b/openssh/server/team/stacklight.yml
@@ -102,6 +102,13 @@
           full_name: Szymon Banka
           home: /home/sbanka
           email: sbanka@mirantis.com
+        crh:
+          enabled: true
+          name: crh
+          sudo: true
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
   openssh:
     client:
       enabled: true
@@ -178,6 +185,11 @@
           public_keys:
           - ${public_keys:sbanka}
           user: ${linux:system:user:sbanka}
+        crh:
+          enabled: true
+          public_keys:
+          - ${public_keys:crh}
+          user: ${linux:system:user:crh}
   public_keys:
     newt:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3odU+3V2uDA2ptAFL9hrJRPNEEdAyztWOZFQ5Oyd9oerTGOU3p4xmrgWWjfKFKbYGhiiIUcYAol5PkTfKukGEkkjCHYA1t023soCaaAj85wCZCnw2zQNAziwxTYmAzTqgxiSvtZNMMrtJvFHRIRDzJ3M1lV0prWNWkMM1/3FAd4W49y6VT3fkMCo8uqG7CfGdgR2DgBCxf9KaNPfW5eDEPOgmE5lK8tVSEI6T+Cg7hbcTf4lFYnlFBnlQgp/0JstsM4Vbwb4B34LOpOsf2S8rrWk2xQMjwaMHXkc2s/E8iW3F5nVFuyEXYISFQIiAHw8dzC6CHgLcyHUVWwznKawZ newt@newt-dev1
@@ -207,3 +219,5 @@
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/UtqwBD6qkEoWSrmO0jXa9sUcwumySxmkX2XCTlAj+e8tzCNndNhaUueu01pbcNrGrB7xvCHyTa5cxgJEv0RAJRxZnObTjluegiuW+/KNSGwiSDy90bwPVb6zWalrDg12xGh8C0ybmv90uC+GrGO1UXFpm5N1qL3ZsUvSjWBRZ70xXjUI4self+fWxBYJhu7hGZ0RVCeA8TjRutzdOWcSZwN2Arn2Oq+fx9n5HP8iXlPcfM6aWj+QvkXphvKjUhDYiImQ07kJctYvxEwMei5pM1dAPZefQ6FRsUP1gKYKPVp1CiBHPIKLG3LMwxp0/LWQmHB4umZvA6HYplSUXZLMd+FhCRuocVFdxe308JWeIFWyw7og/qEBlpxqW4BUk0bR3c4deI9QDKWCuuunTDB4oEB8ZnkI7utknpx7sqO72Ev2UNS/CSi3yyqgOajojQ3l+McWn9bm08KSLzuuMaexETRYQ9dgjE79N7fH+DEt5Ryii+GA2a8Gl3iRtTZs9WA94mTb/KjZBrVxh+PixpQ6s3oGFelFCPMKSPWIEb+rwuAUi0Ulrqb2UZDzJYhT50QfbCzRN2MU+8bR7PJt/xpAADvQX0iMMrMUvAVngs2YrXKapJliyHhTZxOmVdDRIyCQ1YpK2ktBJf+E+RXl3R5XUmbJkT4jZ1R6cA1QJOEKVQ== nzaporozhets@mirantis.com
     sbanka:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMdgjQ/jeWwQTaPyy7G5JJAkM+QPNPFkzMldPHJzOxEBzt/M5zAooj0XgbRIDIztolhXhmj8N5QSG5n3Wn9T9e2KpoxrLaVhMV5WGTgMrXMmyT8oXLV3gLxGNHMWFvplSbHLK78EsZQQ1/kBQMyPXB1+FpIuSHVOxaospOQObJ08lvQfvlO7AUUV4ecpFj3PpV5vkKPRS+KfiRm84BeGIu51BL1BClZcOyHZPBQT+DUBjm8y4Nd7pVZRjsiBzZBvUotCbn5+RqWJnu4kyoGoRNmk8pvCx7jGL1G9rE8NNsKlCUWedvyNkDeoWKvleJuzkj3ggfuCj/iTtDoXFR95e3
+    crh:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
diff --git a/prometheus/alertmanager/notification/pushkin.yml b/prometheus/alertmanager/notification/pushkin.yml
index 905a292..9d27a8b 100644
--- a/prometheus/alertmanager/notification/pushkin.yml
+++ b/prometheus/alertmanager/notification/pushkin.yml
@@ -18,5 +18,5 @@
             enabled: true
             webhook_configs:
               pushkin-vip:
-                url: "${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight"
+                url: "http://${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight"
                 send_resolved: true
diff --git a/salt/master/formula/pkg/foundation.yml b/salt/master/formula/pkg/foundation.yml
index 3111419..5d530d4 100644
--- a/salt/master/formula/pkg/foundation.yml
+++ b/salt/master/formula/pkg/foundation.yml
@@ -34,3 +34,6 @@
             lldp:
               source: pkg
               name: salt-formula-lldp
+            tinyproxy:
+              source: pkg
+              name: salt-formula-tinyproxy