diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index b43befa30..8d1d6a336 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -51,3 +51,8 @@
   include profiles::base
   include profiles::repo::rpm
 }
+
+node /^website\d+\.[a-z]+\.theforeman\.org$/ {
+  include profiles::base
+  include profiles::website
+}
diff --git a/puppet/modules/profiles/manifests/website.pp b/puppet/modules/profiles/manifests/website.pp
new file mode 100644
index 000000000..785e3d841
--- /dev/null
+++ b/puppet/modules/profiles/manifests/website.pp
@@ -0,0 +1,25 @@
+# @summary A profile for the machines hosting the website and downloads
+#
+# @param stable
+#   Latest release that users expect
+#
+# @param https
+#   Whether to enable HTTPS. This is typically wanted but can only be enabled
+#   in a 2 pass setup. First Apache needs to run for Letsencrypt to function.
+#   Then Letsencrypt can be enabled. Also useful to turn off in test setups.
+class profiles::website (
+  String[1] $stable,
+  Boolean $https = true,
+) {
+  class { 'web':
+    https => $https,
+  }
+  contain web
+
+  contain web::vhost::downloads
+
+  class { 'web::vhost::web':
+    stable => $stable,
+  }
+  contain web::vhost::web
+}
diff --git a/puppet/spec/classes/profiles_website_spec.rb b/puppet/spec/classes/profiles_website_spec.rb
new file mode 100644
index 000000000..0e7439255
--- /dev/null
+++ b/puppet/spec/classes/profiles_website_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe 'profiles::website' do
+  on_supported_os.each do |os, os_facts|
+    context "on #{os}" do
+      let(:facts) { os_facts }
+
+      it { is_expected.to compile.with_all_deps }
+
+      context 'without https' do
+        let(:params) { { https: false } }
+
+        it { is_expected.to compile.with_all_deps }
+      end
+    end
+  end
+end