diff --git a/playbooks/groups/download.yml b/playbooks/groups/download.yml
index 7b1351a5dd..de70e8522d 100644
--- a/playbooks/groups/download.yml
+++ b/playbooks/groups/download.yml
@@ -49,13 +49,13 @@
   roles:
   - base
   - rkhunter
-  - denyhosts
+  - { role: denyhosts, when: ansible_distribution_major_version != '7' }
   - nagios_client
   - hosts
   - fas_client
   - collectd/base
   - download
-  - mod_limitipconn
+  - { role: mod_limitipconn, when: ansible_distribution_major_version != '7'}
   - rsyncd
   - { role: nfs/client, when: datacenter == "phx2", mnt_dir: '/srv/pub',  nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub' }
   - { role: nfs/client, when: datacenter == "rdu", mnt_dir: '/srv/pub',  nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub' }
diff --git a/roles/download/files/httpd/dl.fedoraproject.org/secondary.conf b/roles/download/files/httpd/dl.fedoraproject.org/secondary.conf
index 15dd4f7822..8adff7de1a 100644
--- a/roles/download/files/httpd/dl.fedoraproject.org/secondary.conf
+++ b/roles/download/files/httpd/dl.fedoraproject.org/secondary.conf
@@ -2,12 +2,45 @@ Alias /pub /srv/pub
 
 DocumentRoot /srv/web
 
-<Directory /srv/pub>
-  Options Indexes FollowSymLinks
+<Directory /srv/web>
   HeaderName /HEADER.html
   ReadmeName /FOOTER.html
+  Options Indexes FollowSymLinks
+  <IfModule mod_authz_core.c>
+    # Apache 2.4
+    Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    # Apache 2.2
+    Order allow,deny
+    Allow from all
+  </IfModule>
+</Directory>
+
+<Directory /srv/pub>
+  HeaderName /HEADER.html
+  ReadmeName /FOOTER.html
+  Options Indexes FollowSymLinks
+  <IfModule mod_authz_core.c>
+    # Apache 2.4
+    Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    # Apache 2.2
+    Order allow,deny
+    Allow from all
+  </IfModule>
 </Directory>
 
 <Directory /srv/pub/archive>
   ReadmeName /pub/archive/README.html
+  <IfModule mod_authz_core.c>
+    # Apache 2.4
+    Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    # Apache 2.2
+    Order allow,deny
+    Allow from all
+  </IfModule>
 </Directory>
diff --git a/roles/fedmsg/base/tasks/main.yml b/roles/fedmsg/base/tasks/main.yml
index aa132c0d02..28e2f2d14b 100644
--- a/roles/fedmsg/base/tasks/main.yml
+++ b/roles/fedmsg/base/tasks/main.yml
@@ -42,6 +42,7 @@
   - endpoints-summershum.py
   - endpoints-kerneltest.py
   - endpoints-github2fedmsg.py
+  - endpoints-bugzilla2fedmsg.py
   - relay.py
   - pkgdb.py
   - logging.py
diff --git a/roles/fedmsg/base/templates/endpoints-bugzilla2fedmsg.py.j2 b/roles/fedmsg/base/templates/endpoints-bugzilla2fedmsg.py.j2
new file mode 100644
index 0000000000..f73c56e0cc
--- /dev/null
+++ b/roles/fedmsg/base/templates/endpoints-bugzilla2fedmsg.py.j2
@@ -0,0 +1,13 @@
+{% if env == 'staging' %}
+suffix  = 'stg.phx2.fedoraproject.org'
+{% else %}
+suffix = 'phx2.fedoraproject.org'
+{% endif %}
+
+config = dict(
+    endpoints={
+        "bugzilla2fedmsg.bugzilla2fedmsg01": [
+            "tcp://bugzilla2fedmsg01.%s:3000" % suffix,
+        ],
+    },
+)
diff --git a/roles/fedmsg/base/templates/ssl.py.j2 b/roles/fedmsg/base/templates/ssl.py.j2
index f9445c2e24..7ff5fed0b6 100644
--- a/roles/fedmsg/base/templates/ssl.py.j2
+++ b/roles/fedmsg/base/templates/ssl.py.j2
@@ -25,6 +25,10 @@ config = dict(
 
     certnames=dict(
     [
+        ("bugzilla2fedmsg.bugzilla2fedmsg01", "bugzilla2fedmsg-bugzilla2fedmsg01.%s" % suffix)
+    ] + [
+        ("shell.bugzilla2fedmsg01", "shell-bugzilla2fedmsg01.%s" % suffix)
+    ] + [
         ("github2fedmsg.github2fedmsg0%i" % i, "github2fedmsg-github2fedmsg0%i.%s" % (i, suffix))
         for i in range(1, 3)
     ] + [