diff --git a/ansible/host_vars/ams-api.ooni.nu/.travis.vault b/ansible/host_vars/ams-api.ooni.nu/.travis.vault
new file mode 100644
index 00000000..b5f10682
--- /dev/null
+++ b/ansible/host_vars/ams-api.ooni.nu/.travis.vault
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+66653334346330376530353461653332313431346436386639633730316162653632643731393835
+3864313434333838373737333963316561646636356163610a636433626539323939393937623335
+32376439373039653861663835323061633861653838326633343365656331636435343934333066
+6463616362646631390a653933333662313230636462626263343966363032613731613437376536
+62393833643935646532366137343565313031653137396337343539393538616438343261616461
+3335393836306165653732353065333666636461343661333233
diff --git a/ansible/templates/metadb-snapshot.sh b/ansible/templates/metadb-snapshot.sh
new file mode 100644
index 00000000..917aeb70
--- /dev/null
+++ b/ansible/templates/metadb-snapshot.sh
@@ -0,0 +1,17 @@
+sudo docker run --net=host --rm -ti --user 2100:2100 \
+        -v /srv/pl-psql:/srv/pl-psql:rw \
+        -v /srv/pl-psql_ssl:/srv/pl-psql_ssl:ro \
+        -v /etc/passwd:/etc/passwd:ro \
+        -v /etc/groups:/etc/groups:ro \
+        --env PGDATA=/srv/pl-psql \
+        --env PGDATABASE=metadb \
+        --env PGUSER=shovel \
+        --env PGPASSWORD="{{ shovel_postgres_password }}" \
+        --env PGHOST="37.218.240.56" \
+        --env AWS_DEFAULT_REGION=us-east-1 \
+        --env AWS_ACCESS_KEY_ID="{{ metadb_wal_s3_key_id }}" \
+        --env AWS_SECRET_ACCESS_KEY="{{ metadb_wal_s3_access_key }}" \
+        --env PUSHGATEWAY_CERT="/srv/pl-psql_ssl/pusher/{{ inventory_hostname }}.cert" \
+        --env PUSHGATEWAY_KEY="/srv/pl-psql_ssl/pusher/{{ inventory_hostname }}.key" \
+        openobservatory/sysadmin-postgres-metadb:20190419-572779cb \
+        metadb_s3_tarz
diff --git a/ansible/update-wal-snapshot.yml b/ansible/update-wal-snapshot.yml
new file mode 100644
index 00000000..70c3245d
--- /dev/null
+++ b/ansible/update-wal-snapshot.yml
@@ -0,0 +1,9 @@
+# This task is to copy the script to copy the script for running a metadb snapshot update into /srv/
+# You shall then ssh into hkgmetadb.infra.ooni.io and trigger the script via sh
+# /srv/metadb-snapshot.sh inside of a screen/tmux session
+- hosts: hkgmetadb.infra.ooni.io
+  tasks:
+    - name: write /srv/metadb-snapshot.sh
+      template:
+        src: metadb-snapshot.sh
+        dest: /srv/metadb-snapshot.sh