diff --git a/.ansible-lint b/.ansible-lint
index d50fc9a060..cc05ba098d 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -67,3 +67,4 @@ skip_list:
   - role-name[path]
   - var-naming[no-role-prefix]
   - no-changed-when
+  - ignore-errors
diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml
index de9aef4e52..2bd8c2eb68 100644
--- a/playbooks/include/proxies-reverseproxy.yml
+++ b/playbooks/include/proxies-reverseproxy.yml
@@ -896,20 +896,6 @@
     keephost: true
     tags: discourse2fedmsg
 
-#  - role: httpd/reverseproxy
-#    website: ipsilon-project.org
-#    destname: ipsilon-website
-#    balancer_name: apps-ocp
-#    balancer_members: "{{ (env == 'staging')|ternary(ocp_nodes_rdu3_stg, ocp_nodes) }}"
-#    targettype: openshift
-#    ocp4: "{{ (env == 'production') | bool }}"
-#    ocp4_rdu3: "{{ (env == 'staging') | bool }}"
-#    # When prod has moved to rdu3:
-#    #ocp4: false
-#    #ocp4_rdu3: true
-#    keephost: true
-#    tags: ipsilon-website
-
   - role: httpd/reverseproxy
     website: awx.fedoraproject.org
     destname: awx
diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml
index 40a7c40ee0..e6ceb68d97 100644
--- a/playbooks/include/proxies-websites.yml
+++ b/playbooks/include/proxies-websites.yml
@@ -1210,18 +1210,6 @@
     tags:
     - fedora.im
 
-#  - role: httpd/website
-#    site_name: ipsilon-project.org
-#    cert_name: ipsilon-project.org
-#    server_aliases:
-#    - ipsilon-project.org
-#    - www.ipsilon-project.org
-#    ssl: true
-#    sslonly: true
-#    certbot: true
-#    tags:
-#    - ipsilon-website
-
   - role: httpd/website
     site_name: directory.fedoraproject.org
     ssl: true
diff --git a/playbooks/manual/ocp4-postinstall-setup.yml b/playbooks/manual/ocp4-postinstall-setup.yml
index 272cf302b2..81f11a183d 100644
--- a/playbooks/manual/ocp4-postinstall-setup.yml
+++ b/playbooks/manual/ocp4-postinstall-setup.yml
@@ -18,3 +18,5 @@
     - gwmngilfen
     - nphilipp
     - zlopez
+    cluster_readonly_appowners:
+    - smoliicek
diff --git a/playbooks/openshift-apps/ipsilon-website.yml b/playbooks/openshift-apps/ipsilon-website.yml
deleted file mode 100644
index 1b94e6fa16..0000000000
--- a/playbooks/openshift-apps/ipsilon-website.yml
+++ /dev/null
@@ -1,58 +0,0 @@
----
-- name: Make the app be real
-  hosts: os_control_stg[0]:os_control[0]
-  user: root
-  gather_facts: false
-
-  vars_files:
-    - /srv/web/infra/ansible/vars/global.yml
-    - "/srv/private/ansible/vars.yml"
-    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  vars:
-
-  roles:
-    - role: openshift/project
-      project_app: ipsilon-website
-      project_description: "ipsilon-project.org"
-      project_appowners:
-        - abompard
-      tags:
-        - apply-appowners
-
-    - role: openshift/imagestream
-      imagestream_app: ipsilon-website
-      imagestream_imagename: ipsilon-website
-
-    - role: openshift/object
-      object_app: ipsilon-website
-      object_template: buildconfig.yml.j2
-      object_objectname: buildconfig.yml
-
-    - role: openshift/object
-      object_app: ipsilon-website
-      object_file: service.yml
-      object_objectname: service.yml
-
-    - role: openshift/route
-      route_app: ipsilon-website
-      route_name: web-internal
-      route_host: "ipsilon-website.apps.ocp{{ env_suffix }}.fedoraproject.org"
-      route_serviceport: web
-      route_servicename: web
-      route_annotations:
-        haproxy.router.openshift.io/timeout: 5m
-
-    - role: openshift/route
-      route_app: ipsilon-website
-      route_name: web
-      route_host: "ipsilon-project.org"
-      route_serviceport: web
-      route_servicename: web
-      route_annotations:
-        haproxy.router.openshift.io/timeout: 5m
-
-    - role: openshift/object
-      object_app: ipsilon-website
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
diff --git a/roles/distgit/templates/lookaside.conf b/roles/distgit/templates/lookaside.conf
index de5b441c14..08d258d5e4 100644
--- a/roles/distgit/templates/lookaside.conf
+++ b/roles/distgit/templates/lookaside.conf
@@ -3,5 +3,12 @@ Alias /lookaside        /srv/cache/lookaside
     Options Indexes FollowSymLinks
     AllowOverride None
     Require all granted
+    
+{% if env == 'staging' %}
+    # Disable global mod_deflate for lookaside cache 
+    # to prevent double-compression and false gzip headers
+    SetEnv no-gzip 1
+    SetEnv dont-vary 1
+{% endif %}
 </Directory>
 
diff --git a/roles/openshift-apps/ipsilon-website/files/service.yml b/roles/openshift-apps/ipsilon-website/files/service.yml
deleted file mode 100644
index cd3876c0a5..0000000000
--- a/roles/openshift-apps/ipsilon-website/files/service.yml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: web
-  labels:
-    app: ipsilon-website
-spec:
-  ports:
-    - name: web
-      port: 8080
-      targetPort: 8080
-  selector:
-    app: ipsilon-website
-    deploymentconfig: web
diff --git a/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2 b/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2
deleted file mode 100644
index 4aa9514f1b..0000000000
--- a/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2
+++ /dev/null
@@ -1,33 +0,0 @@
----
-apiVersion: build.openshift.io/v1
-kind: BuildConfig
-metadata:
-  name: web
-  labels:
-    app: ipsilon-website
-    build: ipsilon-website
-spec:
-  runPolicy: Serial
-  source:
-    type: Git
-    git:
-      uri: https://pagure.io/ipsilon-website.git
-      ref: master
-    contextDir: /
-  strategy:
-    type: Docker
-  output:
-    to:
-      kind: ImageStreamTag
-      name: ipsilon-website:latest
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-  - type: "Generic"
-    generic:
-      secretReference:
-{% if env == "staging" %}
-        name: "{{ ipsilon_website_stg_webhook_secret }}"
-{% else %}
-        name: "{{ ipsilon_website_webhook_secret }}"
-{% endif %}
diff --git a/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2
deleted file mode 100644
index b4435d13e6..0000000000
--- a/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2
+++ /dev/null
@@ -1,59 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: web
-  labels:
-    app: ipsilon-website
-spec:
-  replicas: 1
-  selector:
-    app: ipsilon-website
-    deploymentconfig: web
-  strategy:
-    type: Rolling
-    activeDeadlineSeconds: 21600
-    rollingParams:
-      intervalSeconds: 1
-      maxSurge: 25%
-      maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: ipsilon-website
-        deploymentconfig: web
-    spec:
-      containers:
-        - name: ipsilon-website
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8080
-              # protocol: TCP
-          readinessProbe:
-            timeoutSeconds: 5
-            initialDelaySeconds: 30
-            httpGet:
-              path: /
-              port: 8080
-          livenessProbe:
-            timeoutSeconds: 5
-            initialDelaySeconds: 30
-            httpGet:
-              path: /
-              port: 8080
-          # resources: {}
-          # terminationMessagePath: /dev/termination-log
-          # terminationMessagePolicy: File
-  triggers:
-    - type: ConfigChange
-    - type: ImageChange
-      imageChangeParams:
-        automatic: true
-        containerNames:
-          - ipsilon-website
-        from:
-          kind: ImageStreamTag
-          name: ipsilon-website:latest
diff --git a/roles/openshift/cluster/handlers/main.yaml b/roles/openshift/cluster/handlers/main.yaml
new file mode 100644
index 0000000000..636076db42
--- /dev/null
+++ b/roles/openshift/cluster/handlers/main.yaml
@@ -0,0 +1,7 @@
+---
+- name: Apply changes to openshift
+  ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}"
+  loop: "{{ base_templates + (stg_templates if env == 'staging' else []) }}"
+  changed_when: true
+  tags:
+    - create-resources
diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml
index 76f2ce413b..4f5c46c12e 100644
--- a/roles/openshift/cluster/tasks/main.yaml
+++ b/roles/openshift/cluster/tasks/main.yaml
@@ -10,25 +10,26 @@
   tags:
     - create-resources
 
+- name: Set template lists
+  ansible.builtin.set_fact:
+    base_templates:
+      - sysadmin-openshift-group.yml
+      - sysadmin-openshift-rolebinding.yml
+      - webhooks-clusterrolebinding.yml
+      - forward-logs-to-log01.yml
+    stg_templates:
+      - sysadmin-openshift-readonly-rolebinding.yml
+      - sysadmin-openshift-readonly-role.yml
+      - sysadmin-openshift-readonly-group.yml
+
 # generate the templates for project to be created
-- name: Copy the templates
+- name: Copy templates
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ cluster_filepath }}/{{ item }}"
     mode: "0640"
-  with_items:
-    - sysadmin-openshift-group.yml
-    - sysadmin-openshift-rolebinding.yml
-    - webhooks-clusterrolebinding.yml
-    - forward-logs-to-log01.yml
+  with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}"
   register: cluster_template_result
-  tags:
-    - create-resources
-
-# apply created openshift resources
-- name: Oc apply resources
-  ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}"
-  with_items: "{{ cluster_template_result.results }}"
-  when: item.changed
+  notify: Apply changes to openshift
   tags:
     - create-resources
diff --git a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2
new file mode 100644
index 0000000000..78a30dd1b4
--- /dev/null
+++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2
@@ -0,0 +1,9 @@
+---
+kind: Group
+apiVersion: user.openshift.io/v1
+metadata:
+  name: "sysadmin-openshift-readonly"
+users:
+{% for item in cluster_readonly_appowners %}
+- "{{ item }}"
+{% endfor %}
diff --git a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2
new file mode 100644
index 0000000000..44da84d331
--- /dev/null
+++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2
@@ -0,0 +1,22 @@
+---
+kind: Role
+apiVersion: user.openshift.io/v1
+metadata:
+  name: "sysadmin-openshift-readonly"
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - persistentvolumeclaims
+  - persistentvolumeclaims/status
+  - pods
+  - replicationcontrollers
+  - replicationcontrollers/scale
+  - serviceaccounts
+  - services
+  - services/status
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2
new file mode 100644
index 0000000000..13ed76a271
--- /dev/null
+++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2
@@ -0,0 +1,13 @@
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: "sysadmin-openshift-readonly"
+subjects:
+  - kind: Group
+    apiGroup: rbac.authorization.k8s.io
+    name: "sysadmin-openshift-readonly"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-readonly
diff --git a/roles/zabbix/sslchecks/tasks/sslcheck.yml b/roles/zabbix/sslchecks/tasks/sslcheck.yml
index 049f536a45..1a2954981d 100644
--- a/roles/zabbix/sslchecks/tasks/sslcheck.yml
+++ b/roles/zabbix/sslchecks/tasks/sslcheck.yml
@@ -12,7 +12,6 @@
   tags:
     - zabbix_agent
     - zabbix_api
-    - pagure
   block:
     - name: Create {{ item.name }} cert age item
       community.zabbix.zabbix_item:
@@ -25,9 +24,12 @@
           units: 'days'
           timeout: '10s'
           interval: '12h'
+          preprocessing:
+            - type: check_unsupported
+              error_handler: set_custom_error_message
+              error_handler_params: 'failed to execute zext_ssl_cert.sh'
+              params: '-1'  # corresponds to 'any value' in the UI params
           tags:
-            - tag: application
-              value: pagure
             - tag: component
               value: ssl
 
diff --git a/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh b/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh
index 0f9e70925c..788ff84310 100755
--- a/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh
+++ b/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh
@@ -14,7 +14,7 @@ EXPIRY=$(echo | timeout 5 openssl s_client -servername $HOST -connect $HOST:$POR
   openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
 
 if [ -z "$EXPIRY" ]; then
-  echo 0
+  echo "timeout connecting to $HOST"
   exit 1
 fi