diff --git a/zim/demo-library/dead-kiwix.png b/zim/demo-library/dead-kiwix.png
new file mode 100644
index 0000000..fc0beeb
Binary files /dev/null and b/zim/demo-library/dead-kiwix.png differ
diff --git a/zim/demo-library/dead.html b/zim/demo-library/dead.html
new file mode 100644
index 0000000..14250e8
--- /dev/null
+++ b/zim/demo-library/dead.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Kiwix demo library</title>
+    <link rel="icon" href="/favicon.ico" type="image/x-icon">
+    <link href="https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap" rel="stylesheet">
+    <style>
+        body {
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+            margin: 0;
+            font-family: 'Roboto', sans-serif; 
+            background-color: #f4f4f4;
+            text-align: center;
+        }
+        .content {
+            max-width: 600px;
+            padding: 20px;
+        }
+        img {
+            max-width: 100%;
+            height: auto;
+        }
+        p {
+            margin-top: 20px;
+            font-size: 18px;
+            color: #333;
+        }
+    </style>
+</head>
+<body>
+    <div class="content">
+        <img src="/home/dead-kiwix.png" alt="Image">
+        <p>There is nothing here, your URL is probably wrong.</p>
+    </div>
+</body>
+</html>
diff --git a/zim/demo-library/demo-generator.cronjob.yaml b/zim/demo-library/demo-generator.cronjob.yaml
new file mode 100644
index 0000000..6e38ee5
--- /dev/null
+++ b/zim/demo-library/demo-generator.cronjob.yaml
@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: demo-generator
+  namespace: zim
+spec:
+  schedule: "0 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        spec:
+          containers:
+            - name: debian
+              image: ghcr.io/kiwix/maintenance:latest
+              imagePullPolicy: Always
+              env:
+              - name: INSTALL_SCRIPTS
+                value: "demo-generator#github://kiwix/k8s/zim/library-mgmt/demo-generator.py\n"
+              volumeMounts:
+              - mountPath: "/data/demo"
+                subPath: demo
+                name: library-volume
+              - mountPath: "/data/zim"
+                subPath: zim
+                name: download-volume
+                readOnly: true
+              - mountPath: "/data/hidden-zim"
+                name: hidden-volume
+                readOnly: true
+              args: ["demo-generator"]
+              resources:
+                limits:
+                  cpu: 200m
+                  memory: 256Mi
+          volumes:
+          - name: library-volume
+            persistentVolumeClaim:
+              claimName: kiwix-library-pvc
+          - name: download-volume
+            persistentVolumeClaim:
+              claimName: kiwix-download-pvc
+          - name: hidden-volume
+            persistentVolumeClaim:
+              claimName: hidden-zim-pvc
+          restartPolicy: Never
+          nodeSelector:
+            k8s.kiwix.org/role: "storage"
diff --git a/zim/demo-library/demo-generator.py b/zim/demo-library/demo-generator.py
new file mode 100644
index 0000000..84f9cb3
--- /dev/null
+++ b/zim/demo-library/demo-generator.py
@@ -0,0 +1,383 @@
+#!/usr/bin/env python3
+
+import datetime
+import re
+import shutil
+import tempfile
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any
+
+import requests
+import yaml
+from humanfriendly import format_size as human_size
+from jinja2 import Environment, FileSystemLoader, Template, select_autoescape
+from lxml import etree
+from pydantic import BaseModel
+from zimscraperlib.logging import getLogger  # pyright: ignore [reportMissingTypeStubs]
+from zimscraperlib.zim import Archive  # pyright: ignore [reportMissingTypeStubs]
+
+# in-ZIM metadata to in-library XML attributes
+NAMES_MAP: dict[str, str] = {
+    "Title": "title",
+    "Description": "description",
+    "Language": "language",
+    "Creator": "creator",
+    "Publisher": "publisher",
+    "Name": "name",
+    "Flavour": "flavour",
+    "Tags": "tags",
+    "Date": "date",
+}
+
+COPIED_KEYS = ["id", "size", "url", "mediaCount", "articleCount", "path"] + list(
+    NAMES_MAP.values()
+)
+
+
+FILENAME_FMT = re.compile(
+    r"^(?P<project>.+?_)(?P<lang>[a-z\-]{2,10}?_|)"
+    r"(?P<option>.+_|)(?P<year>[\d]{4}|)\-(?P<month>[\d]{2})(?P<version>[a-z]{0,2})$",
+    re.IGNORECASE,
+)
+
+REQUESTS_TIMEOUT = 10
+
+
+# Define Pydantic models
+class Demo(BaseModel):
+    name: str
+    zims: list[str]
+    expired_on: datetime.date
+
+
+class Config(BaseModel):
+    demos: list[Demo]
+
+
+class ZimInfo(BaseModel):
+    path: Path
+    infos: dict[str, Any] = {}
+
+
+def binary_human_size(size: float):
+    return human_size(size, binary=True)
+
+
+def install_demo(demo: Demo, demo_tmpl: Template):
+    demo_path = demos_path / demo.name
+    demo_path.mkdir(exist_ok=True)
+    (demo_path / "index.html").write_text(
+        demo_tmpl.render(
+            {"zims": [zims[zim_archive].infos for zim_archive in demo.zims]}
+        )
+    )
+
+
+# constants
+demos_path = Path("/data/demo")
+normal_zim_path = Path("/data/zim")
+hidden_zim_path = Path("/data/hidden-zim")
+demo_library = demos_path / "demo_library.xml"
+demo_config = demos_path / "demos.yaml"
+demo_dead_html = demos_path / "dead.html"
+demo_favicon = demos_path / "favicon.ico"
+demo_dead_kiwix_png = demos_path / "dead-kiwix.png"
+demo_home_tmpl_path = demos_path / "demo-home.jinja2"
+favicons_path = demos_path / "favicons"
+favicons_path.mkdir(exist_ok=True)
+logger = getLogger("demo-generator")
+assets_base_url = (
+    "https://raw.githubusercontent.com/kiwix/operations/main/zim/demo-library/"
+)
+logger.info(f"Assets will be downloaded from {assets_base_url}")
+varnish_cache_url = "http://demo-library-webcache-service"
+
+
+def zim_date_key(zim_filename: str) -> tuple[str, int, str, str]:
+    """Function to be used as sorting criteria for ZIM names.
+
+    Function properly sort by name then date, including versions suffix in the date
+
+    E.g. sorted(
+        [
+            "tests_eng_test_2024-01aa.zim",
+            "tests_eng_test_2024-01b.zim",
+            "tests_eng_test_2024-01.zim",
+            "tests_eng_test_2023-01.zim",
+        ],
+        key=zim_date_key,
+    ) == [
+        "tests_eng_test_2023-01.zim",
+        "tests_eng_test_2024-01.zim",
+        "tests_eng_test_2024-01b.zim",
+        "tests_eng_test_2024-01aa.zim",
+    ]
+
+    The "trick" is to return first up to the xxxx-xx part, then the length of optional
+    ll suffix, then the suffix itself. Python takes care of the rest (first compare the
+    prefix, then the lenght of the suffix, then the suffix itself)
+    """
+    fm = re.match(
+        r"^(?P<name_with_date>.+_\d{4}-\d{2})(?P<ll>[a-z]*)\.(?P<ext>.*?)$",
+        zim_filename,
+    )
+    if not fm:
+        return (zim_filename, 0, "", "")  # Just in case ...
+    return (
+        fm.group("name_with_date"),
+        len(fm.group("ll")),
+        fm.group("ll"),
+        fm.group("ext"),
+    )
+
+
+class BadZimNameError(Exception):
+    """ZIM matching passed name has not been found on the storage"""
+
+    pass
+
+
+class ZimNotFoundError(Exception):
+    """ZIM has not been found on the storage"""
+
+    pass
+
+
+def get_ziminfo(zim_archive: str) -> ZimInfo:
+    """Get informations about a given ZIM archive
+
+    Supports either a full ZIM path (ted/ted_mul_all_2024-07.zim) or a incomplete path
+    (ted/ted_mul_all) for which the latest version will be search for.
+
+    Supports both prod and .hidden paths.
+    """
+    is_hidden = zim_archive.startswith(".hidden/")
+    base_path = hidden_zim_path if is_hidden else normal_zim_path
+    if is_hidden:
+        zim_archive = zim_archive[8:]
+    if zim_archive.endswith(".zim"):
+        zim_path = base_path / zim_archive
+        if not zim_path.exists():
+            raise ZimNotFoundError()
+    else:
+        zim_book_versions = list(base_path.glob(zim_archive + "_*.zim"))
+        bad_zim_book_versions = [
+            zim_book
+            for zim_book in zim_book_versions
+            if not FILENAME_FMT.match(zim_book.stem)
+        ]
+        for bad_zim_book in bad_zim_book_versions:
+            logger.warning(
+                f"Ignoring {bad_zim_book}, does not match expected filename pattern"
+            )
+        zim_book_versions = [
+            zim_book
+            for zim_book in zim_book_versions
+            if zim_book not in bad_zim_book_versions
+        ]
+        if len(zim_book_versions) == 0:
+            raise ZimNotFoundError()
+        zim_path = sorted(zim_book_versions, key=lambda path: zim_date_key(path.name))[
+            -1
+        ]
+
+    zim_infos: dict[str, Any] = {"path": str(zim_path)}
+
+    filename_match = FILENAME_FMT.match(zim_path.stem)
+    if not filename_match:
+        raise BadZimNameError()
+
+    values = filename_match.groupdict()
+
+    donwload_url = (
+        f"https://mirror.download.kiwix.org/zim/.hidden/{zim_path.relative_to(base_path)}"
+        if is_hidden
+        else f"https://download.kiwix.org/zim/{zim_path.relative_to(base_path)}"
+    )
+    zim_infos.update(
+        {
+            "project": values["project"][:-1],
+            "lang": values["lang"][:-1] if values.get("lang") else "en",
+            "option": values["option"][:-1] if values.get("option") else "",
+            "month": values["month"],
+            "year": values["year"],
+            "core": zim_path.stem,
+            "rsize": zim_path.stat().st_size,
+            "size": str(int(zim_path.stat().st_size / 1024)),
+            "url": str(f"{donwload_url}.meta4"),
+        }
+    )
+
+    zim_archive = Archive(zim_path)
+
+    zim_infos.update(
+        {
+            "id": str(
+                zim_archive.uuid  # pyright: ignore [reportUnknownMemberType, reportUnknownArgumentType]
+            ),
+            "mediaCount": str(
+                zim_archive.media_count  # pyright: ignore [reportUnknownMemberType, reportUnknownArgumentType]
+            ),
+            "articleCount": str(
+                zim_archive.article_count  # pyright: ignore [reportUnknownMemberType, reportUnknownArgumentType]
+            ),
+        }
+    )
+
+    for meta_name in NAMES_MAP.keys():
+        try:
+            if meta_name == "Tags":
+                zim_infos[NAMES_MAP[meta_name]] = ";".join(
+                    zim_archive.get_tags(libkiwix=True)
+                )
+                continue
+            zim_infos[NAMES_MAP[meta_name]] = zim_archive.get_text_metadata(meta_name)
+        except RuntimeError:
+            if meta_name == "Title":
+                zim_infos[NAMES_MAP[meta_name]] = zim_path.stem.replace("_", " ")
+            continue
+    if zim_archive.has_illustration(48):  # pyright: ignore [reportUnknownMemberType]
+        (favicons_path / f"{zim_infos['id']}.png").write_bytes(
+            zim_archive.get_illustration_item(  # pyright: ignore [reportUnknownMemberType, reportUnknownArgumentType]
+                48
+            ).content
+        )
+
+    return ZimInfo(path=zim_path, infos=zim_infos)
+
+
+def get_tmp(fpath: Path) -> Path:
+    """path to use to write fpath temporarily"""
+    return Path(
+        tempfile.NamedTemporaryFile(
+            prefix=fpath.stem, suffix=fpath.suffix, delete=False
+        ).name
+    )
+
+
+def swap(tmp: Path, final: Path):
+    """moves* tmp to its final dest via copy + rm to prevent cross-fs errors"""
+    shutil.copy2(tmp, final)
+    tmp.unlink()
+
+
+@contextmanager
+def open_chmod(file: Path, mode: str = "r", chmod: int | None = None):
+    """open a file and then chmod it after use"""
+    with open(file, mode=mode) as fh:
+        yield fh
+    if chmod:
+        file.chmod(chmod)
+
+
+logger.info(f"Downloading demo configuration…")
+resp = requests.get(
+    assets_base_url + "demos.yaml",
+    timeout=REQUESTS_TIMEOUT,
+)
+resp.raise_for_status()
+demo_config.write_bytes(resp.content)
+
+for static_file in [
+    demo_dead_html,
+    demo_favicon,
+    demo_dead_kiwix_png,
+    demo_home_tmpl_path,
+]:
+    if not static_file.exists():
+        logger.info(f"Downloading {static_file.name}…")
+        resp = requests.get(
+            assets_base_url + static_file.name,
+            timeout=REQUESTS_TIMEOUT,
+        )
+        resp.raise_for_status()
+        static_file.write_bytes(resp.content)
+
+logger.info(f"Preparing…")
+zims: dict[str, ZimInfo] = {}
+
+jinja_env = Environment(
+    autoescape=select_autoescape(), loader=FileSystemLoader(demos_path)
+)
+
+jinja_env.filters["human_size"] = (  # pyright: ignore [reportUnknownMemberType]
+    binary_human_size
+)
+demo_tmpl = jinja_env.get_template(demo_home_tmpl_path.name)
+
+logger.info("Parsing demo configuration…")
+config = Config(**yaml.safe_load(demo_config.read_text()))
+
+# Filter demos based on expired datetime
+now = datetime.date.today()
+config.demos = [demo for demo in config.demos if demo.expired_on > now]
+
+logger.info("Searching for declared ZIMs and extracting infos…")
+for demo in config.demos:
+    for zim_archive in demo.zims:
+        logger.info(f"- {zim_archive}")
+        try:
+            zims[zim_archive] = get_ziminfo(zim_archive)
+        except ZimNotFoundError:
+            logger.warning(f"No ZIM found for {zim_archive}")
+        except BadZimNameError:
+            logger.warning(
+                f"Ignoring {zim_archive}, does not match expected filename pattern"
+            )
+
+logger.info("Generating Demo Library XML…")
+demo_library_tmp = get_tmp(demo_library)
+# chmod is not mandatory but still usefull since this file is not private at all
+with open_chmod(demo_library_tmp, "wb", chmod=0o644) as fh:
+    fh.write(
+        b'<?xml version="1.0" encoding="UTF-8" ?>\n' b'<library version="20110515">\n'
+    )
+    for zim_infos in zims.values():
+        elem = etree.Element("book")
+        for attr in COPIED_KEYS:
+            if value := zim_infos.infos.get(attr):
+                elem.set(attr, value)
+        fh.write(etree.tostring(elem, encoding="UTF-8"))
+        fh.write(b"\n")
+    fh.write(b"</library>\n")
+
+logger.info("Verifying Demo Library XML…")
+etree.parse(str(demo_library_tmp))
+
+logger.info("Swaping Demo Library files…")
+swap(demo_library_tmp, demo_library)
+
+logger.info("Cleaning unused favicons…")
+active_favicons = [
+    favicons_path / f"{zim_info.infos['id']}.png" for zim_info in zims.values()
+]
+for favicon in favicons_path.iterdir():
+    if favicon.is_file() and not favicon in active_favicons:
+        favicon.unlink()
+
+logger.info("Generating demos homepage…")
+
+for demo in config.demos:
+    install_demo(demo, demo_tmpl)
+
+logger.info("Cleaning-up old demos homepage…")
+for file in demos_path.iterdir():
+    if not file.is_dir():
+        continue
+    if file.name in [demo.name for demo in config.demos] + ["favicons"]:
+        continue
+    shutil.rmtree(demos_path / file.name)
+
+logger.info(f"Requesting cache purge…")
+resp = requests.request(
+    method="PURGE",
+    url=varnish_cache_url,
+    headers={"X-Purge-Type": "all"},
+    timeout=REQUESTS_TIMEOUT,
+)
+if not resp.ok:
+    logger.error(f"Error while purging cache: HTTP {resp.status_code}/{resp.reason}")
+
+
+logger.info(f"Done.")
diff --git a/zim/demo-library/demo-home.jinja2 b/zim/demo-library/demo-home.jinja2
new file mode 100644
index 0000000..79b50d8
--- /dev/null
+++ b/zim/demo-library/demo-home.jinja2
@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+    <html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title>Kiwix demo library</title>
+        <link rel="icon" href="../favicon.ico" type="image/x-icon">
+        <link href="https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap" rel="stylesheet">
+        <style>
+            body {
+                display: flex;
+                justify-content: center;
+                align-items: center;
+                min-height: 100vh;
+                margin: 0;
+                font-family: 'Roboto', sans-serif; 
+                background-color: #f4f4f4;
+                text-align: center;
+            }
+            .content {
+                max-width: 800px;
+                margin: 0 auto;
+            }
+            table {
+                width: 100%;
+                border-collapse: collapse;
+                margin: 25px 0;
+                font-size: 18px;
+                text-align: left;
+            }
+            th, td {
+                padding: 12px;
+                border-bottom: 1px solid #ddd;
+                max-width: 150px;
+                word-wrap: break-word;
+            }
+            th {
+                background-color: #f4f4f4;
+            }
+            tr:hover {
+                background-color: #f1f1f1;
+            }
+            a {
+                color: #3498db;
+                text-decoration: none;
+            }
+            a:hover {
+                text-decoration: underline;
+                color: #2c3e50;
+            }
+        </style>
+    </head>
+    <body>
+        <div class="content">
+            <table>
+                <thead>
+                    <tr>
+                        <th>Illustration</th>
+                        <th>Title</th>
+                        <th>Description</th>
+                        <th>Lang(s)</th>
+                        <th>Tag(s)</th>
+                        <th>Size</th>
+                    </tr>
+                </thead>
+                {% for zim in zims %}
+                <tr>
+                    <td><img src="../favicons/{{zim["id"]}}.png"></td>
+                    <td><a href="/viewer#{{zim["name"]}}">{{zim["title"]}}</a></td>
+                    <td>{{zim["description"]}}</td>
+                    <td>{{zim["language"]}}</td>
+                    <td>{{zim["tags"]}}</td>
+                    <td>{{zim["rsize"] | human_size}}</td>
+                </tr>
+                {% endfor %}
+            </table>
+        </div>
+    </body>
+    </html>
\ No newline at end of file
diff --git a/zim/demo-library/demo.library.kiwix.org.certificate.yaml b/zim/demo-library/demo.library.kiwix.org.certificate.yaml
new file mode 100644
index 0000000..3ffd49b
--- /dev/null
+++ b/zim/demo-library/demo.library.kiwix.org.certificate.yaml
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: demo-library-kiwix-org
+  namespace: zim
+spec:
+  secretName: demo-library-kiwix-org-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  commonName: demo.library.kiwix.org
+  dnsNames:
+  - demo.library.kiwix.org
diff --git a/zim/demo-library/demos.yaml b/zim/demo-library/demos.yaml
new file mode 100644
index 0000000..fbf79a8
--- /dev/null
+++ b/zim/demo-library/demos.yaml
@@ -0,0 +1,18 @@
+demos:
+- name: benoit
+  zims:
+    - ted/ted_mul_all_2024-07.zim
+    - other/litterature-audiobooks-poetry_fr
+    - videos/ubongo_fr_all_2024-07.zim
+  expired_on: 2024-08-31
+- name: marc 
+  zims:
+    - videos/deus-ex-silicium_fr_all
+    - .hidden/bard/stackoverflow.com_en_bard_2021-11.zim
+    - .hidden/dev/devhints.io_en_all_2024-08.zim
+  expired_on: 2024-08-31
+- name: bob 
+  zims:
+    - .hidden/dev/devhints.io_en_all_2024-08.zim
+    - .hidden/bard/stackoverflow.com_en_bard_2021-11.zim
+  expired_on: 2024-07-31
\ No newline at end of file
diff --git a/zim/demo-library/favicon.ico b/zim/demo-library/favicon.ico
new file mode 100644
index 0000000..2b9ec45
Binary files /dev/null and b/zim/demo-library/favicon.ico differ
diff --git a/zim/demo-library/kiwixserve.yaml b/zim/demo-library/kiwixserve.yaml
new file mode 100644
index 0000000..b3db4f7
--- /dev/null
+++ b/zim/demo-library/kiwixserve.yaml
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: zim
+  labels:
+    app: demo-library-kiwixserve-app
+  name: demo-library-kiwixserve-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: demo-library-kiwixserve-app
+  template:
+    metadata:
+      labels:
+        app: demo-library-kiwixserve-app
+    spec:
+      containers:
+      # /!\ manually purge kiwix-serve cache on kiwix-serve version upgrade
+      # curl -X PURGE -H "X-Purge-Type: kiwix-serve" http://demo-library-webcache-service
+      - image: ghcr.io/kiwix/kiwix-tools:3.7.0-2
+        imagePullPolicy: IfNotPresent
+        name: kiwix-tools
+        args: ["kiwix-serve", "--library", "--monitorLibrary", "--threads", "16", "--searchLimit", "5", "--nodatealias", "/data/demo/demo_library.xml"]
+        ports:
+        - containerPort: 80
+        livenessProbe:
+          httpGet:
+            path: /catalog/search?count=1
+            port: 80
+            httpHeaders:
+              - name: Host
+                value: localhost
+          initialDelaySeconds: 20
+          periodSeconds: 5
+        volumeMounts:
+        - mountPath: "/data/zim"
+          subPath: zim
+          name: download-volume
+          readOnly: true
+        - name: hidden-volume
+          mountPath: "/data/hidden-zim"
+          readOnly: true
+        - mountPath: "/data/demo/demo_library.xml"
+          subPath: demo/demo_library.xml
+          name: library-volume
+          readOnly: true
+        resources:
+          requests:
+            memory: "2Gi"
+            cpu: "500m"
+      volumes:
+      - name: download-volume
+        persistentVolumeClaim:
+          claimName: kiwix-download-pvc
+      - name: hidden-volume
+        persistentVolumeClaim:
+          claimName: hidden-zim-pvc
+      - name: library-volume
+        persistentVolumeClaim:
+          claimName: kiwix-library-pvc
+      nodeSelector:
+        k8s.kiwix.org/role: "storage"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: zim
+  name: demo-library-kiwixserve-service
+  labels:
+    app: demo-library-kiwixserve-app
+spec:
+  selector:
+    app: demo-library-kiwixserve-app
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+    name: http
diff --git a/zim/demo-library/staticserver.yaml b/zim/demo-library/staticserver.yaml
new file mode 100644
index 0000000..ba5df33
--- /dev/null
+++ b/zim/demo-library/staticserver.yaml
@@ -0,0 +1,91 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: demo-library-staticserver-configs
+  namespace: zim
+data:
+  Caddyfile: |
+    {
+        auto_https off
+    }
+    :80 {
+        redir / /home/
+
+        handle_path /home/* {
+          root * /var/www/html
+          file_server
+        }
+
+        root * /var/www/html
+        file_server
+
+        handle_errors {
+            rewrite * /dead.html
+            file_server
+        }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: zim
+  labels:
+    app: demo-library-staticserver-app
+  name: demo-library-staticserver-deployment
+spec:
+  selector:
+    matchLabels:
+      app: demo-library-staticserver-app
+  template:
+    metadata:
+      labels:
+        app: demo-library-staticserver-app
+    spec:
+      containers:
+      - image: caddy:2.8.4-alpine
+        imagePullPolicy: IfNotPresent
+        name: caddy          
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - mountPath: "/etc/caddy/Caddyfile"
+          subPath: Caddyfile
+          name: configs
+          readOnly: true
+        - mountPath: "/var/www/html"
+          subPath: demo
+          name: library-volume
+          readOnly: true
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "200m"
+          limits:
+            memory: "256Mi"
+            cpu: "200m"
+      volumes:
+      - name: library-volume
+        persistentVolumeClaim:
+          claimName: kiwix-library-pvc
+      - name: configs
+        configMap:
+          name: demo-library-staticserver-configs
+          defaultMode: 0755
+      nodeSelector:
+        k8s.kiwix.org/role: "storage"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: zim
+  name: demo-library-staticserver-service
+  labels:
+    app: demo-library-staticserver-app
+spec:
+  selector:
+    app: demo-library-staticserver-app
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+    name: http
\ No newline at end of file
diff --git a/zim/demo-library/webcache.yaml b/zim/demo-library/webcache.yaml
new file mode 100644
index 0000000..3bbc77f
--- /dev/null
+++ b/zim/demo-library/webcache.yaml
@@ -0,0 +1,255 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: demo-library-webcache-configs
+  namespace: zim
+data:
+  # not really secret, not exposing port outside
+  secret.txt: |
+    varnishadmin
+  entrypoint.sh: |
+    #!/bin/sh
+    extra_opts=""
+    if [ -z "$VARNISHSIZE" ]; then
+      # WARN: uses at least double that amount
+      VARNISHSIZE=384M
+    fi
+
+    if [ ! -z "$VARNISH_SECRET_PATH" ]; then
+      extra_opts="${extra_opts} -S $VARNISH_SECRET_PATH"
+    fi
+
+    if [ ! -z "$VARNISH_ADMIN_IP" ]; then
+      extra_opts="${extra_opts} -T $VARNISH_ADMIN_IP:6082"
+    fi
+
+    if [ -z "$VARNISH_LOG" ]; then
+      VARNISH_LOG="/dev/stdout"
+    fi
+
+    function varnishncsa_after_varnishd {
+      echo "Awaiting varnishd startup "
+      while :
+      do
+        if [ -f /var/run/varnishd.pid ] ; then
+          echo ""
+          break
+        fi
+        echo -n "."
+        sleep 1
+      done
+      echo "Varnishd running at PID=$(cat /var/run/varnishd.pid)."
+
+      echo "Starting varnishncsa to record logs to $VARNISH_LOG"
+      varnishncsa -D -P /var/run/varnishncsa.pid -c -a -F '%{Host}i %{X-Forwarded-For}i - %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i"' -q 'ReqURL ~ "^/catalog/"' -w $VARNISH_LOG
+    }
+
+    varnishncsa_after_varnishd &
+
+    echo "Starting varnish with ${extra_opts}"
+
+    exec varnishd -P /var/run/varnishd.pid -F -a http=:80,HTTP -p feature=+http2 -f /etc/varnish/default.vcl -s default,$VARNISHSIZE $extra_opts
+  varnish.vcl: |
+    vcl 4.1;
+
+    import std;
+    import dynamic;
+
+    # ACL for manual purge requests
+    acl purge {
+      "localhost";
+      "100.64.0.0"/16; // k8s cluster
+    }
+
+    # kiwix-server to serve ZIMs
+    backend kiwixserve {
+        .host = "demo-library-kiwixserve-service";
+        .port = "80";
+    }
+
+    # minimal server for static HTML home pages
+    backend staticserver {
+        .host = "demo-library-staticserver-service";
+        .port = "80";
+    }
+
+    sub vcl_recv {
+
+      if (req.method == "PURGE") {
+        if (!client.ip ~ purge) {
+          return(synth(403, "Not allowed."));
+        }
+
+        # Purge all
+        # curl -X PURGE -H "X-Purge-Type: all" localhost
+        if (req.http.X-Purge-Type == "all") {
+          if (
+            std.ban("req.url ~ ^.*")
+          ) {
+            return(synth(200, "Purged all endpoints"));
+          }
+        }
+
+        return(synth(400, "Missing or invalid X-Purge-Type"));
+      }
+
+      if (req.url ~ "^/home/") {
+          # Case where the path is /home/
+          set req.backend_hint = staticserver;
+      } else if (req.url ~ "^/?$" || req.url ~ "^/?\?.*$") {
+          # Case where the path is / or empty including query strings
+          set req.backend_hint = staticserver;
+      } else {
+          # Default behavior, forward to kiwixserve
+          set req.backend_hint = kiwixserve;
+      }
+      
+      # remove potential cookie from request (there should be none)
+      unset req.http.cookie;
+
+      # set standard proxied ip header for getting original remote address
+      # set req.http.X-Forwarded-For = client.ip;
+      set req.http.X-Forwarded-For = req.http.x-real-ip;
+
+      # let's cache everything except /random.
+      # all endpoints listed above
+      if (req.url !~ "^/random") {
+          return(hash);
+      }
+
+      # default to not caching (to save space)
+      return (pass);
+    }
+
+    sub vcl_backend_response {
+
+      # make sure to not cache backend errors
+      if (beresp.status >= 500 && bereq.is_bgfetch) {
+          return (abandon);
+      }
+
+      # set ttl to 1d for everything that's returned by backends
+      set beresp.ttl = 1d;
+      # set beresp.grace = 24h;
+      # set beresp.keep = 8m;
+
+      # important for it to go to cache
+      unset bereq.http.cookie;
+      return (deliver);
+
+    }
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: zim
+  labels:
+    app: demo-library-webcache-app
+  name: demo-library-webcache-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: demo-library-webcache-app
+  template:
+    metadata:
+      labels:
+        app: demo-library-webcache-app
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+      - image: docker.io/library/varnish:7.3-alpine
+        command: ["entrypoint"]
+        imagePullPolicy: IfNotPresent
+        name: varnish
+        env:
+        - name: VARNISHSIZE
+          value: "8G"
+        - name: VARNISH_SECRET_PATH
+          value: /etc/varnish/secret
+        - name: VARNISH_ADMIN_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: VARNISH_LOG
+          value: "/data/logs/access.log"
+        ports:
+        - containerPort: 80
+        - containerPort: 6082
+        volumeMounts:
+        - name: configs
+          mountPath: "/usr/sbin/entrypoint"
+          subPath: entrypoint.sh
+          readOnly: true
+        - name: configs
+          mountPath: "/etc/varnish/secret"
+          subPath: secret.txt
+          readOnly: true
+        - name: configs
+          mountPath: "/etc/varnish/default.vcl"
+          subPath: varnish.vcl
+          readOnly: true
+        resources:
+          requests:
+            memory: "16Gi"
+            cpu: "200m"
+      volumes:
+      - name: configs
+        configMap:
+          name: demo-library-webcache-configs
+          defaultMode: 0755
+      nodeSelector:
+        k8s.kiwix.org/role: "storage"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: zim
+  name: demo-library-webcache-service
+  labels:
+    app: demo-library-webcache-app
+spec:
+  selector:
+    app: demo-library-webcache-app
+  ports:
+  - name: http
+    protocol: TCP
+    port: 80
+    targetPort: 80
+  - name: varnishadm
+    protocol: TCP
+    port: 6082
+    targetPort: 6082
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: demo-library-webcache-ingress
+  namespace: zim
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/server-snippet: |
+        location /robots.txt {
+          add_header Content-Type "text/plain";
+          return 200 "User-agent: *\nDisallow: /";
+        }
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - demo.library.kiwix.org
+      secretName: demo-library-kiwix-org-tls
+  rules:
+  - host: demo.library.kiwix.org
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: demo-library-webcache-service
+            port:
+              name: http
