diff --git a/ansible/playbooks/stacks.yml b/ansible/playbooks/stacks.yml
index 739d0c5..210cb8a 100644
--- a/ansible/playbooks/stacks.yml
+++ b/ansible/playbooks/stacks.yml
@@ -13,3 +13,4 @@
     - {role: overleaf, tags: overleaf}
     - {role: cyberchef, tags: cyberchef}
     - {role: inbucket, tags: inbucket}
+    - {role: kms, tags: kms}
diff --git a/ansible/roles/kms/docker-stack.yml.j2 b/ansible/roles/kms/docker-stack.yml.j2
new file mode 100644
index 0000000..aeb7460
--- /dev/null
+++ b/ansible/roles/kms/docker-stack.yml.j2
@@ -0,0 +1,8 @@
+# vi: ft=yaml
+version: '3.7'
+
+services:
+  kms-server:
+    image: teddysun/kms
+    ports:
+      - 1688:1688
diff --git a/ansible/roles/kms/tasks/main.yml b/ansible/roles/kms/tasks/main.yml
new file mode 100644
index 0000000..09b38f5
--- /dev/null
+++ b/ansible/roles/kms/tasks/main.yml
@@ -0,0 +1,15 @@
+- name: Create working directory
+  file:
+    path: /srv/kms
+    state: directory
+
+- name: Copy Docker stack file
+  template:
+    src: "{{ role_path }}/docker-stack.yml.j2"
+    dest: /srv/kms/docker-stack.yml
+
+- name: Deploy Docker stack
+  docker_stack:
+    name: kms
+    compose:
+      - /srv/kms/docker-stack.yml