diff --git a/bundles/webfs/files/webfsd.conf b/bundles/webfs/files/webfsd.conf
new file mode 100644
index 0000000..fbb846a
--- /dev/null
+++ b/bundles/webfs/files/webfsd.conf
@@ -0,0 +1,16 @@
+web_root="${webroot}"
+web_host="${node.hostname}"
+web_ip=""
+web_port="${port}"
+web_virtual="false"
+web_timeout=""
+web_conn=""
+web_index=""
+web_dircache=""
+web_accesslog=""
+web_logbuffering="true"
+web_syslog="true"
+web_user="${user}"
+web_group="${group}"
+web_cgipath=""
+web_extras=""
diff --git a/bundles/webfs/items.py b/bundles/webfs/items.py
new file mode 100644
index 0000000..93eae2d
--- /dev/null
+++ b/bundles/webfs/items.py
@@ -0,0 +1,17 @@
+files = {
+    '/etc/webfsd.conf': {
+        'content_type': 'mako',
+        'context': node.metadata['webfs'],
+        'triggers': {
+            'svc_systemd:webfs:restart',
+        },
+    },
+}
+
+svc_systemd = {
+    'webfs': {
+        'needs': {
+            'pkg_apt:webfs',
+        },
+    },
+}
diff --git a/bundles/webfs/metadata.py b/bundles/webfs/metadata.py
new file mode 100644
index 0000000..dc2bb72
--- /dev/null
+++ b/bundles/webfs/metadata.py
@@ -0,0 +1,28 @@
+from bundlewrap.metadata import atomic
+
+defaults = {
+    'apt': {
+        'packages': {
+            'webfs': {},
+        },
+    },
+    'webfs': {
+        'webroot': '/var/www',
+        'port': 8000,
+        'user': 'www-data',
+        'group': 'www-data',
+    },
+}
+
+
+@metadata_reactor.provides(
+    'iptables/port_rules',
+)
+def iptables(metadata):
+    return {
+        'iptables': {
+            'port_rules': {
+                str(metadata.get('webfs/port')): atomic(metadata.get('webfs/restrict-to', {'*'})),
+            },
+        },
+    }