diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..bf7917a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+# avoid to version passwords and other secret stuff
+*secret*
diff --git a/servers/members2/projects/executive/LocalSettings.php b/servers/members2/projects/executive/LocalSettings.php
new file mode 100644
index 0000000..1364eb7
--- /dev/null
+++ b/servers/members2/projects/executive/LocalSettings.php
@@ -0,0 +1,194 @@
+<?php
+# This file was automatically generated by the MediaWiki 1.30.0
+# installer. If you make manual changes, please keep track in case you
+# need to recreate them later.
+#
+# See includes/DefaultSettings.php for all configurable settings
+# and their default values, but don't forget to make changes in _this_
+# file, not there.
+#
+# Further documentation for configuration settings may be found at:
+# https://www.mediawiki.org/wiki/Manual:Configuration_settings
+
+# Protect against web entry
+if ( !defined( 'MEDIAWIKI' ) ) {
+	exit;
+}
+
+## Uncomment this to disable output compression
+# $wgDisableOutputCompression = true;
+
+$wgSitename = "Executive";
+
+## The URL base path to the directory containing the wiki;
+## defaults for all runtime URL paths are based off of this.
+## For more information on customizing the URLs
+## (like /w/index.php/Page_title to /wiki/Page_title) please see:
+## https://www.mediawiki.org/wiki/Manual:Short_URL
+$wgScriptPath = "";
+
+## The protocol and server name to use in fully-qualified URLs
+$wgServer = "https://executive.wikimedia.ch";
+$wgArticlePath = "/wiki/$1";
+
+## The URL path to static resources (images, scripts, etc.)
+$wgResourceBasePath = $wgScriptPath;
+
+## The URL path to the logo.  Make sure you change this from the default,
+## or else you'll overwrite your logo when you upgrade!
+$wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
+
+## UPO means: this is also a user preference option
+
+$wgEnableEmail     = true;
+$wgEnableUserEmail = true; # UPO
+
+$wgEnotifUserTalk      = false; # UPO
+$wgEnotifWatchlist     = false; # UPO
+$wgEmailAuthentication = true;
+
+## Database settings
+$wgDBtype   = 'mysql';
+$wgDBserver = 'localhost';
+$wgDBname   = 'dbwiki_executive';
+$wgDBuser   = 'dbwiki_executive';
+
+// see LocalSettings-secrets.php
+//$wgDBpassword = '';
+
+# MySQL specific settings
+$wgDBprefix = 'mw_';
+
+# MySQL table options to use during installation or update
+$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
+
+# Experimental charset support for MySQL 5.0.
+$wgDBmysql5 = false;
+
+##
+# Inherit users from members2
+# https://www.mediawiki.org/wiki/Manual:Shared_database
+###
+
+# The $wgDBname for the wiki database holding the main user table
+$wgSharedDB = 'dbwiki_members';
+
+# inherit members2' users
+$wgSharedTables[] = 'user';
+
+# inherit members2' privileges
+$wgSharedTables[] = 'user_groups';
+
+# The $wgDBprefix for the shared database
+$wgSharedPrefix = 'members_';
+
+
+## Shared memory settings
+$wgMainCacheType = CACHE_NONE;
+$wgMemCachedServers = [];
+
+## To enable image uploads, make sure the 'images' directory
+## is writable, then set this to true:
+$wgEnableUploads  = true;
+$wgUseImageMagick = true;
+$wgImageMagickConvertCommand = "/usr/bin/convert";
+
+# InstantCommons allows wiki to use images from https://commons.wikimedia.org
+$wgUseInstantCommons = true;
+
+# Periodically send a pingback to https://www.mediawiki.org/ with basic data
+# about this MediaWiki instance. The Wikimedia Foundation shares this data
+# with MediaWiki developers to help guide future development efforts.
+$wgPingback = true;
+
+## If you use ImageMagick (or any other shell command) on a
+## Linux server, this will need to be set to the name of an
+## available UTF-8 locale
+$wgShellLocale = "C.UTF-8";
+
+## Set $wgCacheDirectory to a writable directory on the web server
+## to make your wiki go slightly faster. The directory should not
+## be publically accessible from the web.
+$wgCacheDirectory = '/var/www/wikimedia.ch/executive/cache';
+
+# temporary directory
+$wgTmpDirectory   = '/var/www/wikimedia.ch/executive/tmp';
+
+# Site language code, should be one of the list in ./languages/data/Names.php
+$wgLanguageCode = "en";
+
+# Changing this will log out all existing sessions.
+$wgAuthenticationTokenVersion = "1";
+
+## For attaching licensing metadata to pages, and displaying an
+## appropriate copyright notice / icon. GNU Free Documentation
+## License and Creative Commons licenses are supported so far.
+$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
+$wgRightsUrl  = "";
+$wgRightsText = "";
+$wgRightsIcon = "";
+
+# Path to the GNU diff3 utility. Used for conflict resolution.
+$wgDiff3 = "/bin/diff3";
+
+## Default skin: you can change the default skin. Use the internal symbolic
+## names, ie 'vector', 'monobook':
+$wgDefaultSkin = "vector";
+
+# Enabled skins.
+# The following skins were automatically enabled:
+//wfLoadSkin( 'CologneBlue' );
+//wfLoadSkin( 'Modern' );
+wfLoadSkin( 'MonoBook' );
+wfLoadSkin( 'Vector' );
+
+# End of automatically generated settings.
+# Add more configuration options below.
+
+#Set Default Timezone
+$wgLocaltimezone = "Europe/Rome";
+date_default_timezone_set( $wgLocaltimezone );
+
+$wgLogo = $wgScriptPath . '/images/wiki.png';
+
+// prevent new user registrations except by sysops
+$wgGroupPermissions['*']['createaccount'] = false;
+
+// inherit privileges
+$wgGroupPermissions['Member'] = $wgGroupPermissions['user'];
+$wgGroupPermissions['sysop']['read'] = true;
+$wgGroupPermissions['sysop']['edit'] = true;
+$wgGroupPermissions['Board']  = $wgGroupPermissions['sysop'];
+$wgGroupPermissions['Staff']  = $wgGroupPermissions['sysop'];
+
+// anonymous users and normal members cannot read executive stuff
+foreach( [ '*', 'autoconfirmed', 'user', 'Member' ] as $role ) {
+
+	// disable reading for non-authorized roles
+	$wgGroupPermissions[ $role ]['read'] = false;
+
+	// disable editing for non-authorized roles
+	$wgGroupPermissions[ $role ]['edit'] = false;
+}
+
+$wgFileExtensions[] = 'svg';
+$wgFileExtensions[] = 'pdf';
+
+// decomment when enabled service
+$wgJobRunRate = 0;
+
+wfLoadExtension( 'ParserFunctions' );
+wfLoadExtension( 'Renameuser' );
+wfLoadExtension( 'Cite' );
+wfLoadExtension( 'WikiEditor' );
+wfLoadExtension( 'InputBox' );
+
+wfLoadExtension( 'Babel' );
+wfLoadExtension( 'UniversalLanguageSelector' );
+wfLoadExtension( 'cldr' );
+
+wfLoadExtension( 'Echo' );
+wfLoadExtension( 'Thanks' );
+
+// require some secret configurations
+require 'LocalSettings-secret.php';
diff --git a/servers/members2/projects/executive/apache.conf b/servers/members2/projects/executive/apache.conf
new file mode 100644
index 0000000..96d1e53
--- /dev/null
+++ b/servers/members2/projects/executive/apache.conf
@@ -0,0 +1,51 @@
+<VirtualHost *:443>
+
+	ServerName executive.wikimedia.ch
+
+	# public directory
+	DocumentRoot /var/www/wikimedia.ch/executive/www
+
+	# cute URLs thanks to PATH_INFO
+	Alias /wiki /var/www/wikimedia.ch/executive/www/index.php
+
+	# fix mediawiki package
+	SetEnv MW_INSTALL_PATH /var/www/wikimedia.ch/executive/www
+
+	# adopt custom temporary dir
+	php_admin_value upload_tmp_dir /var/www/wikimedia.ch/executive/tmp
+	php_admin_value sys_temp_dir   /var/www/wikimedia.ch/executive/tmp
+
+	# allow big files
+	php_admin_value post_max_size       30M
+	php_admin_value upload_max_filesize 30M
+
+	# harden the installation
+	php_admin_value open_basedir /var/www/wikimedia.ch/executive:/usr/share/mediawiki:/var/lib/mediawiki:/etc/wmch-infrastructure:/dev/null:/usr/bin:/bin
+
+	# certificates
+	SSLEngine on
+	SSLCertificateFile      /etc/letsencrypt/live/executive.wikimedia.ch/fullchain.pem
+	SSLCertificateKeyFile   /etc/letsencrypt/live/executive.wikimedia.ch/privkey.pem
+
+	# public directory - same as DocumentRoot
+	<Directory /var/www/wikimedia.ch/executive/www>
+
+		# disable unused and slow .htaccess feature
+		AllowOverride none
+
+		# avoid listing files in the images directory
+		Options -Indexes
+	</Directory>
+
+	# certbot goodies
+	Include /etc/letsencrypt/options-ssl-apache.conf
+</VirtualHost>
+
+# redirect unsecure traffic
+<VirtualHost *:80>
+
+	ServerName executive.wikimedia.ch
+
+	Redirect permanent / https://executive.wikimedia.ch/
+
+</VirtualHost>
diff --git a/servers/members2/projects/members/LocalSettings.php b/servers/members2/projects/members/LocalSettings.php
new file mode 100644
index 0000000..27eb544
--- /dev/null
+++ b/servers/members2/projects/members/LocalSettings.php
@@ -0,0 +1,192 @@
+<?php
+# This file was automatically generated by the MediaWiki 1.30.0
+# installer. If you make manual changes, please keep track in case you
+# need to recreate them later.
+#
+# See includes/DefaultSettings.php for all configurable settings
+# and their default values, but don't forget to make changes in _this_
+# file, not there.
+#
+# Further documentation for configuration settings may be found at:
+# https://www.mediawiki.org/wiki/Manual:Configuration_settings
+
+# Protect against web entry
+if ( !defined( 'MEDIAWIKI' ) ) {
+	exit;
+}
+
+## Uncomment this to disable output compression
+# $wgDisableOutputCompression = true;
+
+$wgSitename = "WMCH Members";
+
+## The URL base path to the directory containing the wiki;
+## defaults for all runtime URL paths are based off of this.
+## For more information on customizing the URLs
+## (like /w/index.php/Page_title to /wiki/Page_title) please see:
+## https://www.mediawiki.org/wiki/Manual:Short_URL
+$wgScriptPath = "";
+
+## The protocol and server name to use in fully-qualified URLs
+$wgServer = "https://members.wikimedia.ch";
+$wgArticlePath = "/wiki/$1";
+
+## The URL path to static resources (images, scripts, etc.)
+$wgResourceBasePath = $wgScriptPath;
+
+## The URL path to the logo.  Make sure you change this from the default,
+## or else you'll overwrite your logo when you upgrade!
+$wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
+
+// name of the Project namespace
+$wgMetaNamespace = 'Wikimedia CH';
+
+## UPO means: this is also a user preference option
+
+$wgEnableEmail = true;
+$wgEnableUserEmail = true; # UPO
+
+$wgEnotifUserTalk = false; # UPO
+$wgEnotifWatchlist = false; # UPO
+$wgEmailAuthentication = true;
+
+## Database settings
+$wgDBtype = "mysql";
+$wgDBserver = "localhost";
+$wgDBname = "dbwiki_members";
+$wgDBuser = "dbwiki_members";
+
+// see LocalSettings-secret.php
+//$wgDBpassword = '';
+
+# MySQL specific settings
+$wgDBprefix = 'members_';
+
+# MySQL table options to use during installation or update
+$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
+
+# Experimental charset support for MySQL 5.0.
+$wgDBmysql5 = false;
+
+## Shared memory settings
+$wgMainCacheType = CACHE_NONE;
+$wgMemCachedServers = [];
+
+## To enable image uploads, make sure the 'images' directory
+## is writable, then set this to true:
+$wgEnableUploads = true;
+$wgUseImageMagick = true;
+$wgImageMagickConvertCommand = "/usr/bin/convert";
+
+# InstantCommons allows wiki to use images from https://commons.wikimedia.org
+$wgUseInstantCommons = false;
+
+# Periodically send a pingback to https://www.mediawiki.org/ with basic data
+# about this MediaWiki instance. The Wikimedia Foundation shares this data
+# with MediaWiki developers to help guide future development efforts.
+$wgPingback = true;
+
+## If you use ImageMagick (or any other shell command) on a
+## Linux server, this will need to be set to the name of an
+## available UTF-8 locale
+$wgShellLocale = "C.UTF-8";
+
+## Set $wgCacheDirectory to a writable directory on the web server
+## to make your wiki go slightly faster. The directory should not
+## be publically accessible from the web.
+$wgCacheDirectory = "/var/www/wikimedia.ch/members/cache";
+
+# temp directory
+$wgTmpDirectory = '/var/www/wikimedia.ch/members/tmp';
+
+# Site language code, should be one of the list in ./languages/data/Names.php
+$wgLanguageCode = 'en';
+
+# Changing this will log out all existing sessions.
+$wgAuthenticationTokenVersion = "1";
+
+## For attaching licensing metadata to pages, and displaying an
+## appropriate copyright notice / icon. GNU Free Documentation
+## License and Creative Commons licenses are supported so far.
+$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
+$wgRightsUrl  = "";
+$wgRightsText = "";
+$wgRightsIcon = "";
+
+# Path to the GNU diff3 utility. Used for conflict resolution.
+$wgDiff3 = "/bin/diff3";
+
+## Default skin: you can change the default skin. Use the internal symbolic
+## names, ie 'vector', 'monobook':
+$wgDefaultSkin = "vector";
+
+# Enabled skins.
+# The following skins were automatically enabled:
+//wfLoadSkin( 'CologneBlue' );
+//wfLoadSkin( 'Modern' );
+wfLoadSkin( 'MonoBook' );
+wfLoadSkin( 'Vector' );
+
+# End of automatically generated settings.
+# Add more configuration options below.
+
+#Set Default Timezone
+$wgLocaltimezone = "Europe/Rome";
+date_default_timezone_set( $wgLocaltimezone );
+
+$wgLogo = $wgScriptPath . '/images/wiki.png';
+
+// disable reading by anonymous users
+$wgGroupPermissions['*']['read'] = false;
+
+// preevent new user registrations except by sysops
+$wgGroupPermissions['*']['createaccount'] = false;
+
+// disable editing by everyone but "Member"s and above
+foreach( [ '*', 'user', 'autoconfirmed' ] as $role ) {
+
+	// Disable anonymous editing
+	$wgGroupPermissions[ $role ]['edit'] = false;
+}
+
+// custom privileges
+$wgGroupPermissions['Member'] = $wgGroupPermissions['user'];
+$wgGroupPermissions['Board']  = $wgGroupPermissions['sysop'];
+$wgGroupPermissions['Staff']  = $wgGroupPermissions['sysop'];
+
+// allow Members to edit pages
+$wgGroupPermissions['Member']['edit'] = true;
+
+// allow other files
+$wgFileExtensions[] = 'svg';
+$wgFileExtensions[] = 'pdf';
+
+// very useful
+$wgUseInstantCommons = true;
+
+// save errors and debugging information to a log
+$wgDebugLogFile = '/var/log/wmch/members.log';
+
+// decomment when enabled service
+$wgJobRunRate = 0;
+
+// extensions
+wfLoadExtension( 'ParserFunctions' );
+wfLoadExtension( 'Renameuser' );
+wfLoadExtension( 'Cite' );
+wfLoadExtension( 'WikiEditor' );
+wfLoadExtension( 'InputBox' );
+
+wfLoadExtension( 'Babel' );
+wfLoadExtension( 'UniversalLanguageSelector' );
+wfLoadExtension( 'cldr' );
+
+wfLoadExtension( 'Echo' );
+wfLoadExtension( 'Thanks' );
+
+// require some secret configurations:
+//  $wgDBpassword
+//  $wgSMTP
+//  $wgSecretKey
+//  $wgUpgradeKey
+require 'LocalSettings-secret.php';
diff --git a/servers/members2/projects/members/apache.conf b/servers/members2/projects/members/apache.conf
new file mode 100644
index 0000000..c3c79be
--- /dev/null
+++ b/servers/members2/projects/members/apache.conf
@@ -0,0 +1,51 @@
+<VirtualHost *:443>
+
+	ServerName members.wikimedia.ch
+
+	DocumentRoot /var/www/wikimedia.ch/members/www
+
+	# cute URLs thanks to PATH_INFO
+	Alias /wiki /var/www/wikimedia.ch/members/www/index.php
+
+	# fix mediawiki package
+	SetEnv MW_INSTALL_PATH /var/www/wikimedia.ch/members/www
+
+	# adopt custom temporary dir
+	php_admin_value upload_tmp_dir /var/www/wikimedia.ch/members/tmp
+	php_admin_value sys_temp_dir   /var/www/wikimedia.ch/members/tmp
+
+	# allow big files
+	php_admin_value post_max_size       30M
+	php_admin_value upload_max_filesize 30M
+
+	# harden the installation
+	php_admin_value open_basedir /var/www/wikimedia.ch/members:/usr/share/mediawiki:/var/lib/mediawiki:/var/log/wmch:/etc/wmch-infrastructure:/dev/null:/usr/bin:/bin
+
+	# certificates
+	SSLEngine on
+	SSLCertificateFile      /etc/letsencrypt/live/members.wikimedia.ch/cert.pem
+	SSLCertificateKeyFile   /etc/letsencrypt/live/members.wikimedia.ch/privkey.pem
+	SSLCertificateChainFile /etc/letsencrypt/live/members.wikimedia.ch/chain.pem
+
+	# disable unused, slow, insecure features
+	<Directory /var/www/wikimedia.ch/members/www>
+
+		# disable unused and slow .htaccess feature
+		AllowOverride none
+
+		# avoid listing images
+		Options -Indexes
+	</Directory>
+
+	# certbot goodies
+	Include /etc/letsencrypt/options-ssl-apache.conf
+</VirtualHost>
+
+# redirect unsecure traffic
+<VirtualHost *:80>
+
+	ServerName members.wikimedia.ch
+
+	Redirect permanent / https://members.wikimedia.ch/
+
+</VirtualHost>