diff --git a/ansible/grafana-dashboards/idr-per-server.json b/ansible/grafana-dashboards/idr-per-server.json
index 71bcec43..32e45f56 100644
--- a/ansible/grafana-dashboards/idr-per-server.json
+++ b/ansible/grafana-dashboards/idr-per-server.json
@@ -78,7 +78,7 @@
           "steppedLine": false,
           "targets": [
             {
-              "expr": "(1 - node_filesystem_free{fstype!~\"(nfs|nfs4|overlay|rootfs|rpc_pipefs|tmpfs)\", instance=\"$hostname\"} / node_filesystem_size{fstype!~\"(nfs|nfs4|overlay|rootfs|rpc_pipefs|tmpfs)\", instance=\"$hostname\"}) * 100",
+              "expr": "(1 - node_filesystem_free_bytes{fstype!~\"(nfs|nfs4|overlay|rootfs|rpc_pipefs|tmpfs)\", instance=\"$hostname\"} / node_filesystem_size_bytes{fstype!~\"(nfs|nfs4|overlay|rootfs|rpc_pipefs|tmpfs)\", instance=\"$hostname\"}) * 100",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{mountpoint}} ({{device}})",
diff --git a/ansible/grafana-dashboards/idr-sessions.json b/ansible/grafana-dashboards/idr-sessions.json
index bfeae032..8d35e4fb 100644
--- a/ansible/grafana-dashboards/idr-sessions.json
+++ b/ansible/grafana-dashboards/idr-sessions.json
@@ -309,7 +309,7 @@
           "steppedLine": false,
           "targets": [
             {
-              "expr": "sum(rate(django_http_responses_total_by_status[$quantileint])) without (instance)",
+              "expr": "sum(rate(django_http_responses_total_by_status_total[$quantileint])) without (instance)",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{status}}",
diff --git a/ansible/grafana-dashboards/idr-vertical.json b/ansible/grafana-dashboards/idr-vertical.json
index ceac8dd8..bb3214aa 100644
--- a/ansible/grafana-dashboards/idr-vertical.json
+++ b/ansible/grafana-dashboards/idr-vertical.json
@@ -80,7 +80,7 @@
           "steppedLine": false,
           "targets": [
             {
-              "expr": "(100 - (avg by (instance) (irate(node_cpu{mode=\"idle\", instance=~\".*$servergroup.*\"}[5m])) * 100)) * on(instance)  (count(node_cpu{mode=\"idle\", instance=~\".*$servergroup.*\"}) without (cpu, mode))",
+              "expr": "(100 - (avg by (instance) (irate(node_cpu_seconds_total{mode=\"idle\", instance=~\".*$servergroup.*\"}[5m])) * 100)) * on(instance)  (count(node_cpu_seconds_total{mode=\"idle\", instance=~\".*$servergroup.*\"}) without (cpu, mode))",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{instance}}",
@@ -173,7 +173,7 @@
           "steppedLine": false,
           "targets": [
             {
-              "expr": "node_memory_Active{instance=~\".*$servergroup.*\"} / 1024 / 1024 / 2014",
+              "expr": "node_memory_Active_bytes{instance=~\".*$servergroup.*\"} / 1024 / 1024 / 2014",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 2,
@@ -182,7 +182,7 @@
               "step": 600
             },
             {
-              "expr": "node_memory_Active{instance=~\".*$servergroup.*\"} / node_memory_MemTotal{instance=~\".*$servergroup.*\"} * 100",
+              "expr": "node_memory_Active_bytes{instance=~\".*$servergroup.*\"} / node_memory_MemTotal_bytes{instance=~\".*$servergroup.*\"} * 100",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 2,
@@ -355,7 +355,7 @@
           "steppedLine": false,
           "targets": [
             {
-              "expr": "sum (irate(node_network_receive_bytes{instance=~\".*$servergroup.*\"}[1m])) by (instance) / 1024 / 1024",
+              "expr": "sum (irate(node_network_receive_bytes_total{instance=~\".*$servergroup.*\"}[1m])) by (instance) / 1024 / 1024",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 2,
@@ -365,7 +365,7 @@
               "step": 600
             },
             {
-              "expr": "- sum (irate(node_network_transmit_bytes{instance=~\".*$servergroup.*\"}[1m])) by (instance) / 1024 / 1024",
+              "expr": "- sum (irate(node_network_transmit_bytes_total{instance=~\".*$servergroup.*\"}[1m])) by (instance) / 1024 / 1024",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 2,
@@ -428,12 +428,10 @@
       {
         "allValue": null,
         "current": {
-          "tags": [],
-          "text": "omero + database + docker",
+          "text": "omero + database",
           "value": [
             "omero",
-            "database",
-            "docker"
+            "database"
           ]
         },
         "hide": 0,
@@ -451,14 +449,9 @@
             "selected": true,
             "text": "database",
             "value": "database"
-          },
-          {
-            "selected": true,
-            "text": "docker",
-            "value": "docker"
           }
         ],
-        "query": "omero, database, docker",
+        "query": "omero, database",
         "type": "custom"
       }
     ]
diff --git a/ansible/group_vars/omero-hosts.yml b/ansible/group_vars/omero-hosts.yml
index e52ad578..39409ef3 100644
--- a/ansible/group_vars/omero-hosts.yml
+++ b/ansible/group_vars/omero-hosts.yml
@@ -25,7 +25,7 @@ idr_bf_components:
   - formats-api
   - formats-bsd
   - formats-gpl
-idr_bf_release: "0.6.4"
+idr_bf_release: "0.6.5"
 idr_bf_baseurl: "https://artifacts.openmicroscopy.org/artifactory/maven/idr"
 
 ice_install_devel: false
@@ -37,6 +37,11 @@ ice_install_python: false
 postgresql_version: "11"
 
 
+######################################################################
+# redis (for OMERO.web and microservices)
+redis_listen: 0.0.0.0
+
+
 ######################################################################
 # openmicroscopy.fluentd vars
 fluentd_source_configs:
diff --git a/ansible/group_vars/proxy-hosts.yml b/ansible/group_vars/proxy-hosts.yml
index 8d35ac7e..288d7745 100644
--- a/ansible/group_vars/proxy-hosts.yml
+++ b/ansible/group_vars/proxy-hosts.yml
@@ -30,6 +30,22 @@ nginx_proxy_log_format: main_timed_cache_upstream
 nginx_proxy_websockets_enable: True
 
 nginx_proxy_upstream_servers:
+- name: omeromsthumbnailreadonly
+  balance: ip_hash
+  servers: "{{ omeroreadonly_omeromsthumbnail_hosts | sort }}"
+- name: omeromsthumbnailreadwrite
+  servers: "{{ omeroreadwrite_omeromsthumbnail_hosts }}"
+- name: omeromsimageregionreadonly
+  balance: ip_hash
+  servers: "{{ omeroreadonly_omeromsimageregion_hosts | sort }}"
+- name: omeromsimageregionreadwrite
+  servers: "{{ omeroreadwrite_omeromsimageregion_hosts }}"
+- name: omeromszarrreadonly
+  balance: ip_hash
+  servers: "{{ omeroreadonly_omeromszarr_hosts | sort }}"
+- name: omeromszarrreadwrite
+  servers: "{{ omeroreadwrite_omeromszarr_hosts }}"
+
 - name: omeroreadonly
   balance: ip_hash
   servers: "{{ omero_omeroreadonly_hosts_reserved | sort }}"
@@ -56,7 +72,48 @@ _nginx_proxy_omero_locations:
 # Gallery is hosted at /
 - /gallery-api/*
 
+_nginx_proxy_omeromsthumbnail_locations:
+- /webgateway/render_thumbnail/*
+- /webclient/render_thumbnail/*
+- /webgateway/render_birds_eye_view/*
+- /webclient/render_birds_eye_view/*
+- /webgateway/get_thumbnails/*
+- /webclient/get_thumbnails/*
+
+_nginx_proxy_omeromsimageregion_locations:
+- /webgateway/render_image_region/*
+- /webgateway/render_image/*
+- /webclient/render_image_region/*
+- /webclient/render_image/*
+- /webgateway/render_shape_mask/*
+
+_nginx_proxy_omeromszarr_locations:
+- /idr/zarr/*
+
+
+# Order is important since we want the longer omeroms*cached
+# locations to have precedence over the shorter omerocached ones
+# https://www.digitalocean.com/community/tutorials/understanding-nginx-server-and-location-block-selection-algorithms
 _nginx_proxy_backends_omero:
+- name: omeromsthumbnailscached
+  location: ~ {{ _nginx_proxy_omeromsthumbnail_locations | join('|') }}
+  server: http://omeromsthumbnailreadonly
+  cache_validity: 1d
+  maintenance_flag: "{{ omero_maintenance_flag }}"
+  maintenance_uri: "{{ omero_maintenance_uri }}"
+- name: omeromsimagregioncached
+  location: ~ {{ _nginx_proxy_omeromsimageregion_locations | join('|') }}
+  server: http://omeromsimageregionreadonly
+  cache_validity: 1d
+  maintenance_flag: "{{ omero_maintenance_flag }}"
+  maintenance_uri: "{{ omero_maintenance_uri }}"
+- name: omeromszarr
+  location: ~ {{ _nginx_proxy_omeromszarr_locations | join('|') }}
+  server: http://omeromszarrreadonly
+  # Don't cache, files are too large
+  # cache_validity: 1d
+  maintenance_flag: "{{ omero_maintenance_flag }}"
+  maintenance_uri: "{{ omero_maintenance_uri }}"
 - name: omerocached
   location: ~ {{ _nginx_proxy_omero_locations | join('|') }}
   server: http://omeroreadonly
@@ -292,9 +349,11 @@ _nginx_proxy_sites:
   # This enables the default site (configured using the global
   # nginx_proxy_* variables):
   - nginx_proxy_is_default: True
-    # Only add this CORS header to the default public site
+
     nginx_proxy_additional_directives:
-    - "add_header Access-Control-Allow-Origin $allow_origin"
+    # Only add this CORS header to the default public site
+    # Always set a header including on 404 responses
+    - "add_header Access-Control-Allow-Origin $allow_origin always"
     # Study redirects
     - "if ($request_uri ~ /search/\\?query=Name:(?<prefix>idr00)?68) {
        return 302 /about/download.html;}"
@@ -310,6 +369,19 @@ _nginx_proxy_sites:
     nginx_proxy_ssl: False
     nginx_proxy_cachebuster_enabled: True
     nginx_proxy_backends:
+    - name: omeromsthumbnailscached
+      location: ~ {{ _nginx_proxy_omeromsthumbnail_locations | join('|') }}
+      server: http://omeromsthumbnailreadwrite
+      cache_validity: 1d
+    - name: omeromsimageregioncached
+      location: ~ {{ _nginx_proxy_omeromsimageregion_locations | join('|') }}
+      server: http://omeromsimageregionreadwrite
+      cache_validity: 1d
+    - name: omeromszarr
+      location: ~ {{ _nginx_proxy_omeromszarr_locations | join('|') }}
+      server: http://omeromszarrreadwrite
+      # Don't cache, files are too large
+      # cache_validity: 1d
     - name: omerocached
       location: ~ {{ _nginx_proxy_omero_locations | join('|') }}|/mapr/*
       server: http://omeroreadwrite
diff --git a/ansible/idr-02-services.yml b/ansible/idr-02-services.yml
index 647b08bf..1ee030c3 100644
--- a/ansible/idr-02-services.yml
+++ b/ansible/idr-02-services.yml
@@ -3,7 +3,7 @@
 ### TODO: Remove these in the next version
 - include: idr-downloads.yml
 
-- include: idr-mineotaur.yml
+- include: idr-microservices.yml
 
 - include: idr-kubernetes.yml
 # TODO: Not idempotent
diff --git a/ansible/idr-docker.yml b/ansible/idr-docker.yml
index 2e53e37f..bb084902 100644
--- a/ansible/idr-docker.yml
+++ b/ansible/idr-docker.yml
@@ -16,24 +16,3 @@
     yum:
       name: docker-python
       state: present
-
-
-- hosts: "{{ idr_environment | default('idr') }}-dockermanager-hosts"
-
-  pre_tasks:
-  - name: create NFS export directories
-    become: yes
-    file:
-      path: /data/{{ item }}
-      state: directory
-    with_items:
-    - mineotaur
-    - volumes
-
-  roles:
-  - role: ome.versioncontrol_utils
-  - role: ome.nfs_share
-    nfs_shares:
-      /data/mineotaur:
-      - host: "*"
-        options: 'rw'
diff --git a/ansible/idr-downloads.yml b/ansible/idr-downloads.yml
index e6345853..9ced676f 100644
--- a/ansible/idr-downloads.yml
+++ b/ansible/idr-downloads.yml
@@ -19,9 +19,6 @@
     - name: sql
       path: /srv/omero-sql
       comment: PostgreSQL 9.4 database dump of the IDR
-    - name: mineotaur
-      path: /data/mineotaur
-      comment: Neo4j databases for various IDR studies
 
   tasks:
 
diff --git a/ansible/idr-firewall.yml b/ansible/idr-firewall.yml
index d9310ffb..40221233 100644
--- a/ansible/idr-firewall.yml
+++ b/ansible/idr-firewall.yml
@@ -12,7 +12,7 @@
       become: yes
       iptables_raw_25:
         name: default_accept
-        keep_unmanaged: no
+        keep_unmanaged: yes
         rules: |
           -A INPUT -j ACCEPT
           -A FORWARD -j ACCEPT
diff --git a/ansible/idr-ftp-monitoring.yml b/ansible/idr-ftp-monitoring.yml
index ea5ce7aa..dd118519 100644
--- a/ansible/idr-ftp-monitoring.yml
+++ b/ansible/idr-ftp-monitoring.yml
@@ -4,9 +4,9 @@
 - hosts: "{{ idr_environment | default('idr') }}-ftp-hosts"
 
   roles:
-  - role: ome.prometheus_node_0_3_0
+  - role: ome.prometheus_node
 
-  - role: ome.prometheus_0_4_0
+  - role: ome.prometheus
     prometheus_docker_network: monitoring
 
     prometheus_alertmanager_slack_webhook: "{{ idr_secret_management_slack_webhook }}"
diff --git a/ansible/idr-microservices.yml b/ansible/idr-microservices.yml
new file mode 100644
index 00000000..1555ba11
--- /dev/null
+++ b/ansible/idr-microservices.yml
@@ -0,0 +1,131 @@
+# IDR initial test of microservices
+
+
+- hosts: "{{ idr_environment | default('idr') }}-database-hosts"
+# Load hostvars for subsequent playbooks
+
+
+- hosts: "{{ idr_environment | default('idr') }}-omero-hosts"
+
+  # pre_tasks:
+  #   - debug: var=inventory_hostname
+  #   - debug: msg="{{ hostvars[inventory_hostname] | to_yaml }}"
+  #   - fail: msg=stopping
+
+  roles:
+
+    - role: ome.docker
+      docker_use_ipv4_nic_mtu: True
+
+  tasks:
+
+    - name: Install docker-python
+      become: true
+      yum:
+        name: docker-python
+        state: present
+
+    - name: Get IPs of hosts
+      set_fact:
+        omero_host_ip: >-
+          {{ hostvars[inventory_hostname]['ansible_' + (idr_net_iface |
+             default('eth0'))]['ipv4']['address']
+          }}
+        omero_db_host_ansible: >-
+          {{ hostvars[groups[idr_environment |
+             default('idr') + '-database-hosts'][0]][
+             'ansible_' + (idr_net_iface | default('eth0'))]['ipv4']['address']
+          }}
+
+    - name: omero-ms config directories
+      become: true
+      file:
+        path: /etc/omero-ms-{{ item }}
+        state: directory
+      with_items:
+        - thumbnail
+        - imageregion
+        - zarr
+
+    - name: omero-ms config files
+      become: true
+      template:
+        src: templates/omero-ms-{{ item }}-config.yml.j2
+        dest: /etc/omero-ms-{{ item }}/config.yml
+      with_items:
+        - thumbnail
+        - imageregion
+
+    - name: omero-ms custom entrypoints
+      become: true
+      template:
+        src: templates/omero-ms-{{ item }}-entrypoint.sh.j2
+        dest: /etc/omero-ms-{{ item }}/omero-ms-{{ item }}-entrypoint.sh
+        mode: u=rwx,g=rx,o=rx
+      with_items:
+        - imageregion
+        - zarr
+
+    - name: Run docker omero-ms-thumbnail
+      become: true
+      docker_container:
+        image: openmicroscopy/omero-ms-thumbnail:0.5.2
+        name: omero-ms-thumbnail
+        published_ports:
+          - "{{ omero_ms_thumbnail_port }}:8080"
+        state: started
+        restart_policy: always
+        volumes:
+          - "/etc/omero-ms-thumbnail/config.yml:/opt/ms/conf/config.yaml:ro"
+
+    - name: Run docker omero-ms-imageregion
+      become: true
+      docker_container:
+        image: manics/docker-example-omero-microservices-imageregion:0.5.2-0
+        name: omero-ms-imageregion
+        # Override the entrypoint to create a fixed UID and GID
+        entrypoint: /opt/ms/bin/omero-ms-imageregion-entrypoint.sh
+        published_ports:
+          - "{{ omero_ms_imageregion_port }}:8080"
+        state: started
+        restart_policy: always
+        volumes:
+          - "/etc/omero-ms-imageregion/config.yml:/opt/ms/conf/config.yaml:ro"
+          - "/etc/omero-ms-imageregion/omero-ms-imageregion-entrypoint.sh:/opt/ms/bin/omero-ms-imageregion-entrypoint.sh:ro"
+          - "/data:/data:ro"
+          - "/opt/omero/server/OMERO.server/lib/scripts:/opt/omero/server/OMERO.server/lib/scripts:ro"
+          - "/uod/idr:/uod/idr:ro"
+          - "/nfs/bioimage:/nfs/bioimage:ro"
+          - "/nfs/biostudies:/nfs/biostudies:ro"
+
+    - name: Run docker omero-ms-zarr
+      become: true
+      docker_container:
+        image: openmicroscopy/omero-ms-zarr:0.1.6
+        name: omero-ms-zarr
+        # Override the entrypoint to create a fixed UID and GID
+        entrypoint: /usr/local/bin/omero-ms-zarr-entrypoint.sh
+        env:
+          CONFIG_omero_data_dir: /data/OMERO
+          CONFIG_omero_db_host: "{{ omero_db_host_ansible }}"
+          CONFIG_omero_db_user: "{{ omero_server_dbuser }}"
+          CONFIG_omero_db_pass: "{{ omero_server_dbpassword }}"
+          CONFIG_omero_db_name: "{{ omero_server_dbname }}"
+          CONFIG_omero_ms_zarr_net_path_image: /idr/zarr/v0.1/{image}.zarr/
+        published_ports:
+          - "{{ omero_ms_zarr_port }}:8080"
+        state: started
+        restart_policy: always
+        groups:
+          - "{{ idrnfs_groupid | default(0) }}"
+        volumes:
+          - "/etc/omero-ms-zarr/omero-ms-zarr-entrypoint.sh:/usr/local/bin/omero-ms-zarr-entrypoint.sh:ro"
+          - "/data:/data:ro"
+          - "/uod/idr:/uod/idr:ro"
+          - "/nfs/bioimage:/nfs/bioimage:ro"
+          - "/nfs/biostudies:/nfs/biostudies:ro"
+
+  vars:
+    omero_ms_thumbnail_port: "8085"
+    omero_ms_imageregion_port: "8086"
+    omero_ms_zarr_port: "8087"
diff --git a/ansible/idr-mineotaur.yml b/ansible/idr-mineotaur.yml
deleted file mode 100644
index b3ddbaed..00000000
--- a/ansible/idr-mineotaur.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-# IDR Mineotaur data
-
-- hosts: "{{ idr_environment | default('idr') }}-omero-hosts"
-
-- hosts: "{{ idr_environment | default('idr') }}-dockermanager-hosts"
-
-  tasks:
-
-  - name: create mineotaur directory
-    become: yes
-    file:
-      path: "/data/mineotaur/idr0001gramlsysgroscreenA"
-      owner: centos
-      state: directory
-
-  - name: set default rsync mineotaur_url
-    set_fact:
-      default_rsync_mineotaur_url: >-
-        rsync://{{
-          hostvars[groups[idr_environment |
-            default('idr') + '-omeroreadwrite-hosts'][0]]
-          ['ansible_' + (idr_net_iface | default('eth0'))]['ipv4']['address']
-        }}/mineotaur/idr0001gramlsysgroscreenA/
-
-  # When running externally pull down the IDR data by defining:
-  # idr_rsync_mineotaur_url: "rsync://idr.openmicroscopy.org/mineotaur/"
-  - name: download mineotaur data
-    become: yes
-    # centos user has UID 1000 as required by the mineotaur Docker container
-    # https://hub.docker.com/r/imagedata/mineotaur/
-    become_user: centos
-    synchronize:
-      src: >-
-        {{
-          idr_rsync_mineotaur_url | default(default_rsync_mineotaur_url)
-        }}
-      dest: /data/mineotaur/idr0001gramlsysgroscreenA/
-      mode: "pull"
-      owner: no
-      group: no
-    delegate_to: "{{ inventory_hostname }}"
diff --git a/ansible/idr-proxy.yml b/ansible/idr-proxy.yml
index c3ccac8f..5f5c106b 100644
--- a/ansible/idr-proxy.yml
+++ b/ansible/idr-proxy.yml
@@ -53,6 +53,49 @@
             ['ansible_' + (idr_net_iface | default('eth0')), 'ipv4', 'address']) | list
         }}
 
+  - name: Get microservice IPs
+    # For now these are the same as omero_omeroreadonly_hosts_reserved
+    # In future we may scale to additional servers separate from OMERO
+    set_fact:
+      # If you're wondering about the use of \1 here vs \\1 in other playbooks
+      # see https://github.com/ansible/ansible/issues/33202
+      omeroreadonly_omeromsthumbnail_hosts: >-
+        {{
+          omero_omeroreadonly_hosts_reserved |
+          map('regex_replace', '^(.*)$', '\1:8085') |
+          list
+        }}
+      omeroreadwrite_omeromsthumbnail_hosts: >-
+        {{
+          omero_omeroreadwrite_hosts |
+          map('regex_replace', '^(.*)$', '\1:8085') |
+          list
+        }}
+      omeroreadonly_omeromsimageregion_hosts: >-
+        {{
+          omero_omeroreadonly_hosts_reserved |
+          map('regex_replace', '^(.*)$', '\1:8086') |
+          list
+        }}
+      omeroreadwrite_omeromsimageregion_hosts: >-
+        {{
+          omero_omeroreadwrite_hosts |
+          map('regex_replace', '^(.*)$', '\1:8086') |
+          list
+        }}
+      omeroreadonly_omeromszarr_hosts: >-
+        {{
+          omero_omeroreadonly_hosts_reserved |
+          map('regex_replace', '^(.*)$', '\1:8087') |
+          list
+        }}
+      omeroreadwrite_omeromszarr_hosts: >-
+        {{
+          omero_omeroreadwrite_hosts |
+          map('regex_replace', '^(.*)$', '\1:8087') |
+          list
+        }}
+
   - name: Get rsync IP
     # TODO: get all readonly
     set_fact:
diff --git a/ansible/management-grafana.yml b/ansible/management-grafana.yml
index 7b26ba3a..215833bb 100644
--- a/ansible/management-grafana.yml
+++ b/ansible/management-grafana.yml
@@ -9,7 +9,7 @@
   - name: Run docker grafana
     become: yes
     docker_container:
-      image: grafana/grafana:5.1.3
+      image: grafana/grafana:7.2.0
       env:
         # Enable anonymous login
         GF_AUTH_ANONYMOUS_ENABLED: "true"
@@ -39,7 +39,7 @@
       status_code: [200, 404]
     register: grafana_get_user
     check_mode: no
-    until: grafana_get_user | succeeded
+    until: grafana_get_user is succeeded
     retries: 5
     delay: 5
 
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
index b0942a56..32ffc424 100644
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -180,26 +180,16 @@
   version: 0.3.0
 
 - src: ome.omero_web_django_prometheus
-  version: 0.3.0
+  version: 0.4.0
 
 - src: ome.prometheus
-  version: 0.3.1
+  version: 0.4.0
 
 - name: ome.prometheus_jmx
   version: 0.2.2
 
 - src: ome.prometheus_node
-  version: 0.2.2
+  version: 0.3.0
 
 - src: ome.prometheus_postgres
   version: 0.4.0
-
-- name: ome.prometheus_0_4_0
-  src:
-    https://github.com/ome/ansible-role-prometheus/archive/0.4.0.tar.gz
-  version: 0.4.0
-
-- name: ome.prometheus_node_0_3_0
-  src:
-    https://github.com/ome/ansible-role-prometheus-node/archive/0.3.0.tar.gz
-  version: 0.3.0
diff --git a/ansible/templates/omero-client.json.j2 b/ansible/templates/omero-client.json.j2
index e94dc548..023636d8 100644
--- a/ansible/templates/omero-client.json.j2
+++ b/ansible/templates/omero-client.json.j2
@@ -1,9 +1,5 @@
 [
-"--Ice.Default.Router=OMERO.Glacier2/router
-{%- for backend in omero_omeroreadonly_hosts_external -%}
-:ssl -p {{ idr_haproxy_frontend_omero_offset + loop.index0 | int }} -h @omero.host@
-{%- endfor -%}",
-"--Ice.Default.Router.EndpointSelection=Random",
+"--Ice.Default.Router=OMERO.Glacier2/router:wss -p 443 -h @omero.host@ -r /omero-ws",
 "--omero.user=public",
 "--omero.pass=public"
 ]
diff --git a/ansible/templates/omero-ms-imageregion-config.yml.j2 b/ansible/templates/omero-ms-imageregion-config.yml.j2
new file mode 100644
index 00000000..378f2d04
--- /dev/null
+++ b/ansible/templates/omero-ms-imageregion-config.yml.j2
@@ -0,0 +1,71 @@
+# https://github.com/glencoesoftware/omero-ms-image-region/blob/v0.5.2/src/dist/conf/config.yaml
+
+# The port that the microservice will listen on
+port: 8080
+
+# Number of threads in the worker pool
+# worker_pool_size: 1
+
+# Configuration for request parsing limits
+#  * https://vertx.io/docs/apidocs/io/vertx/core/http/HttpServerOptions.html#setMaxInitialLineLength-int-
+#  * https://vertx.io/docs/apidocs/io/vertx/core/http/HttpServerOptions.html#setMaxHeaderSize-int-
+#  * https://vertx.io/docs/apidocs/io/vertx/core/http/HttpServerOptions.html#setMaxChunkSize-int-
+#  * https://netty.io/4.0/api/io/netty/handler/codec/http/HttpRequestDecoder.html#HttpRequestDecoder--
+# max-initial-line-length: 4096
+# max-header-size: 8192
+# max-chunk-size: 8192
+# Max number of channels to allow per request
+max-active-channels: 6
+
+# OMERO server that the microservice will communicate with (as a client)
+omero:
+  host: "{{ omero_host_ip }}"
+  # integer
+  port: 4064
+
+# Copy of the OMERO server configuration which will be reused
+# All values must be strings
+omero.server:
+  omero.data.dir: /data/OMERO
+  omero.db.host: "{{ omero_db_host_ansible }}"
+  omero.db.name: "{{ omero_server_dbname }}"
+  omero.db.port: "5432"
+  omero.db.user: "{{ omero_server_dbuser }}"
+  omero.db.pass: "{{ omero_server_dbpassword }}"
+  # Needed because LUTs are stored here
+  omero.script_repo_root: /opt/omero/server/OMERO.server/lib/scripts/
+  omero.pixeldata.max_tile_length: "2048"
+
+# OMERO.web configuration
+omero.web:
+  # see group_vars/omero-hosts.yml
+  session_cookie_name: "sessionid_{{ idr_environment | default('idr') }}"
+
+# Information about the session store.
+session-store:
+  #type is either "postgres" or "redis"
+  type: redis
+  #synchronicity is either "sync" or "async"
+  synchronicity: async
+  #uri for either postgres db or redis
+  # * https://jdbc.postgresql.org/documentation/80/connect.html
+  # * https://github.com/lettuce-io/lettuce-core/wiki/Redis-URI-and-connection-details
+  # uri: "jdbc:postgresql://database:5432/omero?user=omero&password=omero"
+  # Currently each omero node runs its own OMERO.server, OMERO.web, Redis
+  uri: "redis://{{ omero_host_ip }}:6379/0"
+
+# Configuration for zipkin http tracing
+# http-tracing:
+#   enabled: true
+#   zipkin-url: "http://localhost:9411/api/v2/spans"
+
+# Enable JMX Prometheus Metrics
+jmx-metrics:
+  enabled: true
+
+# Enable Vertx Prometheus Metrics
+vertx-metrics:
+  enabled: true
+
+# The string to be used as the Cache-Control header provided in responses
+# cache-control-header: "private, max-age=3600"
diff --git a/ansible/templates/omero-ms-imageregion-entrypoint.sh.j2 b/ansible/templates/omero-ms-imageregion-entrypoint.sh.j2
new file mode 100644
index 00000000..fb29de70
--- /dev/null
+++ b/ansible/templates/omero-ms-imageregion-entrypoint.sh.j2
@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+
+grep imageregion /etc/group || addgroup -g {{ idrnfs_groupid | default(1000) }} imageregion
+grep imageregion /etc/passwd || adduser -D -u 1000 -G imageregion imageregion
+
+exec su imageregion -c "cd /opt/ms; /opt/ms/bin/omero-ms-image-region $@"
diff --git a/ansible/templates/omero-ms-thumbnail-config.yml.j2 b/ansible/templates/omero-ms-thumbnail-config.yml.j2
new file mode 100644
index 00000000..7a0138b3
--- /dev/null
+++ b/ansible/templates/omero-ms-thumbnail-config.yml.j2
@@ -0,0 +1,31 @@
+# The port that the microservice will listen on
+port: 8080
+# OMERO server that the microservice will communicate with (as a client)
+omero:
+  host: "{{ omero_host_ip }}"
+  port: 4064
+# OMERO.web configuration
+omero.web:
+  # see group_vars/omero-hosts.yml
+  session_cookie_name: "sessionid_{{ idr_environment | default('idr') }}"
+# Information about the session store.
+session-store:
+  #type is either "postgres" or "redis"
+  type: "redis"
+  #synchronicity is either "sync" or "async"
+  synchronicity: "async"
+  #uri for either postgres db or redis
+  # * https://jdbc.postgresql.org/documentation/80/connect.html
+  # * https://github.com/lettuce-io/lettuce-core/wiki/Redis-URI-and-connection-details
+  # uri: "jdbc:postgresql://database:5432/omero?user=omero&password=omero"
+  # Currently each omero node runs its own OMERO.server, OMERO.web, Redis
+  uri: "redis://{{ omero_host_ip }}:6379/0"
+
+# Configuration for zipkin http tracing
+# http-tracing:
+#   enabled: true
+#   zipkin-url: "http://localhost:9411/api/v2/spans"
+
+# Enable JMX Prometheus Metrics
+jmx-metrics:
+  enabled: true
diff --git a/ansible/templates/omero-ms-zarr-entrypoint.sh.j2 b/ansible/templates/omero-ms-zarr-entrypoint.sh.j2
new file mode 100644
index 00000000..675aca09
--- /dev/null
+++ b/ansible/templates/omero-ms-zarr-entrypoint.sh.j2
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+grep omerozarr /etc/group || addgroup -g {{ idrnfs_groupid | default(1000) }} omerozarr
+grep omerozarr /etc/passwd || adduser -D -u 1000 -G omerozarr omerozarr
+
+# https://github.com/ome/omero-ms-zarr/blob/v0.1.6/Dockerfile#L20
+exec su omerozarr -c "java -cp /lib/omero-ms-zarr-0.1.6-all.jar org.openmicroscopy.ms.zarr.ConfigEnv $@"
diff --git a/kubespray b/kubespray
index d8d5474d..fb6e5c40 160000
--- a/kubespray
+++ b/kubespray
@@ -1 +1 @@
-Subproject commit d8d5474dcc0b492946b4fd29e1c0a51ad08c8c20
+Subproject commit fb6e5c408460b2b5d4876475c78cc3db27f72f7b