diff --git a/docker/conf/nginx.conf b/docker/conf/nginx.conf
index c0e87cb..d2f6954 100644
--- a/docker/conf/nginx.conf
+++ b/docker/conf/nginx.conf
@@ -1,123 +1,133 @@
 worker_processes  1;
 
 # Show startup logs on stderr; switch to debug to print, well, debug logs when
 # running nginx-debug
 error_log /dev/stderr info;
 
 events {
   worker_connections 1024;
 }
 
 http {
   include            mime.types;
   default_type       application/octet-stream;
   sendfile           on;
   keepalive_timeout  65;
   client_max_body_size 100M;
 
   # Built-in Docker resolver. Needed to allow on-demand resolution of proxy
   # upstreams.
   resolver           127.0.0.11 valid=30s;
 
   server {
     listen             5080 default_server;
 
     # Add a trailing slash to top level requests (e.g. http://localhost:5080/flower)
 
     rewrite ^/([^/]+)$ /$1/ permanent;
 
     # In this pile of proxies, all upstreams are set using a variable. This
     # makes nginx DNS-resolve the name of the upstream when clients request
     # them, rather than on start. This avoids an unstarted container preventing
     # nginx from starting.
     #
     # Variables need to be set as early as possible, as they're statements from
     # the rewrite module and `rewrite [...] break;` will prevent these
     # statements from being executed.
 
     location /flower/ {
       set $upstream "http://flower:5555";
 
       rewrite ^/flower/(.*)$ /$1 break;
       proxy_pass $upstream;
 
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header Host $host;
       proxy_redirect off;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
       }
     location /rabbitmq/ {
       set $upstream "http://amqp:15672";
 
       rewrite  ^  $request_uri;
       rewrite ^/rabbitmq(/.*)$ $1 break;
 
       proxy_pass $upstream$uri;
     }
     location /scheduler {
       set $upstream "http://swh-scheduler:5008";
 
       rewrite ^/scheduler/(.*)$ /$1 break;
       proxy_pass $upstream;
     }
     location /storage {
       set $upstream "http://swh-storage:5002";
 
       rewrite ^/storage/(.*)$ /$1 break;
       proxy_pass $upstream;
     }
     location /indexer-storage {
       set $upstream "http://swh-idx-storage:5007";
 
       rewrite ^/indexer-storage/(.*)$ /$1 break;
 
       proxy_pass $upstream;
     }
     location /deposit {
       set $upstream "http://swh-deposit:5006";
 
       rewrite ^/deposit/(.*)$ /deposit/$1 break;
       proxy_pass $upstream;
 
       proxy_set_header X-Real-IP $remote_addr;
 	  proxy_set_header X-Forwarded-Host $host:5080;
 	  proxy_set_header SCRIPT_NAME /deposit;
       proxy_redirect off;
     }
     location /objstorage {
       set $upstream "http://swh-objstorage:5003";
 
       rewrite ^/objstorage/(.*)$ /$1 break;
       proxy_pass $upstream;
     }
     location /prometheus {
       set $upstream "http://prometheus:9090";
       proxy_pass $upstream;
     }
     location /grafana {
       set $upstream "http://grafana:3000";
       rewrite ^/grafana/(.*)$ /$1 break;
       proxy_pass $upstream;
     }
     location / {
       set $upstream "http://swh-web:5004";
       proxy_pass $upstream;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-Host $host:5080;
       proxy_redirect off;
     }
     location /keycloak {
       set $upstream "http://keycloak:8080";
       proxy_pass $upstream;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Host $host;
       proxy_set_header X-Forwarded-Server $host;
       proxy_set_header X-Forwarded-Port $server_port;
       proxy_set_header X-Forwarded-Proto $scheme;
     }
+    location /cmak {
+      set $upstream "http://cmak:9000";
+      proxy_pass $upstream;
+      proxy_set_header Host $host;
+      rewrite ^/cmak/(.*)$ /$1 break;
+      sub_filter "href=\"/" "href=\"/cmak/";
+      sub_filter "src=\"/" "src=\"/cmak/";
+      sub_filter "action=\"/" "action=\"/cmak/";
+      sub_filter_once off;
+    }
   }
 }
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index d92f9ec..d768149 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -1,459 +1,471 @@
 version: "2.1"
 
 services:
   amqp:
     image: rabbitmq:3.6-management
     ports:
       - 5072:5672
 
   zookeeper:
     image: wurstmeister/zookeeper
     restart: always
     ports:
       - "5081:2181"
     environment:
         ZOO_LOG4J_PROP: WARN,CONSOLE
 
   kafka:
     image: wurstmeister/kafka
     ports:
       - "9092:9092"
     env_file: ./env/kafka.env
     environment:
       KAFKA_CREATE_TOPICS: swh.journal.objects.content:1:1,
         swh.journal.objects.origin:1:1,
         swh.journal.objects.origin_visit:1:1,
         swh.journal.objects.origin_visit_status:1:1,
         swh.journal.objects.revision:1:1,
         swh.journal.objects.release:1:1,
         swh.journal.indexed.origin_intrinsic_metadata:1:1
     depends_on:
       - zookeeper
     healthcheck:
       test: "[ `JMX_PORT= kafka-topics.sh --list --zookeeper zookeeper:2181 | wc -l` -ge 6 ]"
       interval: 10s
       timeout: 5s
       retries: 10
 
+  cmak:
+    # Note: CMAK does not work out of the box, you need to run this first:
+    # $ docker-compose exec zookeeper ./bin/zkCli.sh
+    #   create /kafka-manager/mutex ""
+    #   create /kafka-manager/mutex/locks ""
+    #   create /kafka-manager/mutex/leases ""
+    # See: https://github.com/yahoo/CMAK/issues/731#issuecomment-643880544
+
+    image: hlebalbau/kafka-manager:stable
+    environment:
+      ZK_HOSTS: "zookeeper:2181"
+
   prometheus:
     image: prom/prometheus
     depends_on:
       - prometheus-statsd-exporter
     command:
       # Needed for the reverse-proxy
       - "--web.external-url=/prometheus"
       - "--config.file=/etc/prometheus/prometheus.yml"
     volumes:
       - "./conf/prometheus.yml:/etc/prometheus/prometheus.yml:ro"
     restart: unless-stopped
 
   prometheus-statsd-exporter:
     image: prom/statsd-exporter
     command:
       - "--statsd.mapping-config=/etc/prometheus/statsd-mapping.yml"
     volumes:
       - "./conf/prometheus-statsd-mapping.yml:/etc/prometheus/statsd-mapping.yml:ro"
     restart: unless-stopped
 
   prometheus-rabbitmq-exporter:
     image: kbudde/rabbitmq-exporter
     restart: unless-stopped
     environment:
       SKIP_QUEUES: "RPC_.*"
       MAX_QUEUES: 5000
       RABBIT_URL: http://amqp:15672
       LOG_LEVEL: warning
 
   grafana:
     image: grafana/grafana
     restart: unless-stopped
     depends_on:
       - prometheus
     environment:
       GF_SERVER_ROOT_URL: http://localhost:5080/grafana
     volumes:
       - "./conf/grafana/provisioning:/etc/grafana/provisioning:ro"
       - "./conf/grafana/dashboards:/var/lib/grafana/dashboards"
 
   nginx:
     image: nginx
     volumes:
       - "./conf/nginx.conf:/etc/nginx/nginx.conf:ro"
     ports:
       - 5080:5080
 
   # Scheduler
 
   swh-scheduler-db:
     image: postgres:12
     env_file:
       - ./env/common_python.env
       - ./env/scheduler-db.env
 
   swh-scheduler:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/scheduler-db.env
       - ./env/scheduler.env
     environment:
       SWH_CONFIG_FILENAME: /scheduler.yml
       SWH_SCHEDULER_CONFIG_FILE: /scheduler.yml
     entrypoint: /entrypoint.sh
     depends_on:
       - swh-scheduler-db
     ports:
       - 5008:5008
     volumes:
       - "./conf/scheduler.yml:/scheduler.yml:ro"
       - "./services/swh-scheduler/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-scheduler-listener:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/scheduler-db.env
       - ./env/scheduler.env
     environment:
       SWH_CONFIG_FILENAME: /scheduler.yml
       SWH_SCHEDULER_CONFIG_FILE: /scheduler.yml
     entrypoint: /entrypoint.sh
     command: start-listener
     depends_on:
       - swh-scheduler
       - amqp
     volumes:
       - "./conf/scheduler.yml:/scheduler.yml:ro"
       - "./services/swh-scheduler-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-scheduler-runner:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/scheduler-db.env
       - ./env/scheduler.env
     environment:
       SWH_CONFIG_FILENAME: /scheduler.yml
       SWH_SCHEDULER_CONFIG_FILE: /scheduler.yml
     entrypoint: /entrypoint.sh
     command: start-runner --period 10
     depends_on:
       - swh-scheduler
       - amqp
     volumes:
       - "./conf/scheduler.yml:/scheduler.yml:ro"
       - "./services/swh-scheduler-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-scheduler-runner-priority:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/scheduler-db.env
       - ./env/scheduler.env
     environment:
       SWH_CONFIG_FILENAME: /scheduler.yml
       SWH_SCHEDULER_CONFIG_FILE: /scheduler.yml
     entrypoint: /entrypoint.sh
     command: start-runner --period 10 --with-priority --task-type load-git --task-type load-svn --task-type load-hg --task-type load-archive-files
     depends_on:
       - swh-scheduler
       - amqp
     volumes:
       - "./conf/scheduler.yml:/scheduler.yml:ro"
       - "./services/swh-scheduler-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   # Graph storage
 
   swh-storage-db:
     image: postgres:12
     env_file:
       - ./env/storage-db.env
 
   swh-storage:
     image: swh/stack
     build: ./
     ports:
       - 5002:5002
     depends_on:
       - swh-storage-db
       - swh-objstorage
       - kafka
     env_file:
       - ./env/common_python.env
       - ./env/storage.env
     environment:
       SWH_CONFIG_FILENAME: /storage.yml
       STORAGE_BACKEND: postgresql
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/storage.yml:/storage.yml:ro"
       - "./services/swh-storage/entrypoint.sh:/entrypoint.sh:ro"
 
   # Object storage
 
   swh-objstorage:
     build: ./
     image: swh/stack
     ports:
       - 5003:5003
     env_file:
       - ./env/common_python.env
     environment:
       SWH_CONFIG_FILENAME: /objstorage.yml
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/objstorage.yml:/objstorage.yml:ro"
       - "./services/swh-objstorage/entrypoint.sh:/entrypoint.sh:ro"
 
   # Indexer storage
 
   swh-idx-storage-db:
     image: postgres:12
     env_file:
       - ./env/indexers-db.env
 
   swh-idx-storage:
     image: swh/stack
     build: ./
     ports:
       - 5007:5007
     depends_on:
       - swh-idx-storage-db
     env_file:
       - ./env/common_python.env
       - ./env/indexers-db.env
       - ./env/indexers.env
     environment:
       SWH_CONFIG_FILENAME: /indexer_storage.yml
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/indexer_storage.yml:/indexer_storage.yml:ro"
       - "./services/swh-indexer-storage/entrypoint.sh:/entrypoint.sh:ro"
 
   # Web interface
   swh-web-db:
     image: postgres:12
     env_file:
       - ./env/01-web-db.env
 
   swh-web:
     build: ./
     image: swh/stack
     ports:
       - 3000:3000
       - 5004:5004
     depends_on:
       - swh-idx-storage
       - swh-scheduler
       - swh-storage
       - swh-web-db
     env_file:
       - ./env/common_python.env
       - ./env/01-web-db.env
       - ./env/02-web-db.env
     environment:
       VERBOSITY: 3
       DJANGO_SETTINGS_MODULE: swh.web.settings.production
       SWH_CONFIG_FILENAME: /web.yml
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/web.yml:/web.yml:ro"
       - "./services/swh-web/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-deposit-db:
     image: postgres:12
     env_file:
       - ./env/deposit-db.env
 
   swh-deposit:
     image: swh/stack
     build: ./
     ports:
       - 5006:5006
     depends_on:
       - swh-deposit-db
       - swh-scheduler
     env_file:
       - ./env/common_python.env
       - ./env/deposit-db.env
       - ./env/deposit.env
     environment:
       VERBOSITY: 3
       SWH_CONFIG_FILENAME: /deposit.yml
       DJANGO_SETTINGS_MODULE: swh.deposit.settings.production
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/deposit.yml:/deposit.yml:ro"
       - "./services/swh-deposit/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-vault-db:
     image: postgres:12
     env_file:
       - ./env/vault-db.env
 
   swh-vault:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/vault-db.env
       - ./env/vault.env
     environment:
       SWH_CONFIG_FILENAME: /vault.yml
     command: server
     ports:
       - 5005:5005
     depends_on:
       - swh-vault-db
       - swh-objstorage
       - swh-storage
       - swh-scheduler
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/vault.yml:/vault.yml:ro"
       - "./services/swh-vault/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-vault-worker:
     image: swh/stack
     build: ./
     command: worker
     env_file:
       - ./env/common_python.env
       - ./env/workers.env
     environment:
       SWH_CONFIG_FILENAME: /cooker.yml
     depends_on:
       - swh-vault
       - swh-storage
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/vault-worker.yml:/cooker.yml:ro"
       - "./services/swh-vault/entrypoint.sh:/entrypoint.sh:ro"
 
   # Lister Celery workers
 
   swh-lister:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/listers.env
       - ./env/workers.env
     user: swh
     environment:
       SWH_WORKER_INSTANCE: listers
       SWH_CONFIG_FILENAME: /lister.yml
     depends_on:
       - swh-scheduler
       - swh-scheduler-runner
       - amqp
     entrypoint: /entrypoint.sh
     volumes:
       - "./conf/lister.yml:/lister.yml:ro"
       - "./services/swh-listers-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   # Loader + deposit checker Celery workers
 
   swh-loader:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/workers.env
     user: swh
     environment:
       SWH_WORKER_INSTANCE: loader
       SWH_CONFIG_FILENAME: /loader.yml
     entrypoint: /entrypoint.sh
     depends_on:
       - swh-storage
       - swh-scheduler
       - amqp
     volumes:
       - "./conf/loader.yml:/loader.yml:ro"
       - "./services/swh-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-loader-deposit:
     image: swh/stack
     build: ./
     env_file:
       - ./env/common_python.env
       - ./env/workers.env
     user: swh
     environment:
       SWH_WORKER_INSTANCE: loader-deposit
       SWH_CONFIG_FILENAME: /loader-deposit.yml
     entrypoint: /entrypoint.sh
     depends_on:
       - swh-storage
       - swh-scheduler
       - swh-deposit
       - amqp
     volumes:
       - "./conf/loader-deposit.yml:/loader-deposit.yml:ro"
       - "./services/swh-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   # Indexer Celery workers
 
   swh-indexer:
     image: swh/stack
     build: ./
     user: swh
     env_file:
       - ./env/common_python.env
       - ./env/indexers-db.env
       - ./env/indexers.env
       - ./env/workers.env
     environment:
       SWH_WORKER_INSTANCE: indexer
       SWH_CONFIG_FILENAME: /indexer.yml
       CONCURRENCY: 4
     entrypoint: /entrypoint.sh
     depends_on:
       - swh-scheduler-runner
       - swh-idx-storage
       - swh-storage
       - swh-objstorage
       - amqp
     volumes:
       - "./conf/indexer.yml:/indexer.yml:ro"
       - "./services/swh-indexer-worker/entrypoint.sh:/entrypoint.sh:ro"
 
   # Journal related
 
   swh-indexer-journal-client:
     image: swh/stack
     build: ./
     entrypoint: /entrypoint.sh
     env_file:
       - ./env/common_python.env
     depends_on:
       kafka:
         condition: service_healthy
       swh-storage:
         condition: service_started
       swh-scheduler:
         condition: service_started
 
     volumes:
       - "./conf/indexer_journal_client.yml:/etc/softwareheritage/indexer/journal_client.yml:ro"
       - "./services/swh-indexer-journal-client/entrypoint.sh:/entrypoint.sh:ro"
 
   swh-scheduler-journal-client:
     image: swh/stack
     build: ./
     entrypoint: /entrypoint.sh
     env_file:
       - ./env/common_python.env
     depends_on:
       kafka:
         condition: service_healthy
       swh-scheduler:
         condition: service_started
     volumes:
       - "./conf/scheduler_journal_client.yml:/etc/softwareheritage/scheduler/journal_client.yml:ro"
       - "./services/swh-scheduler-journal-client/entrypoint.sh:/entrypoint.sh:ro"