diff --git a/roles/ingress/defaults/main.yml b/roles/ingress/defaults/main.yml
index 785636c..99e9dce 100644
--- a/roles/ingress/defaults/main.yml
+++ b/roles/ingress/defaults/main.yml
@@ -45,6 +45,10 @@ ingress_tls_prefer_server_ciphers: "off"
 #           location = /.well-known/caldav  { return 301 /remote.php/dav/; }
 #           location ^~ /.well-known        { return 301 /index.php$uri; }
 #           try_files $uri $uri/ =404;
+#     handles:
+#       - handle: "^~ /.well-known/foo"
+#         contents: |
+#           respond `bar`
 #   - name: redirect.example.com
 #     directives:
 #       # NOTE: Do NOT suffix with a semicolon; that gets added for you
diff --git a/roles/ingress/templates/vhosts.conf.j2 b/roles/ingress/templates/vhosts.conf.j2
index 9a084a4..d9d9da5 100644
--- a/roles/ingress/templates/vhosts.conf.j2
+++ b/roles/ingress/templates/vhosts.conf.j2
@@ -52,6 +52,15 @@ server {
 		{{ location.contents }}
 	}
 {% endfor %}
+{% endif %}
+
+{% if server.handles is defined %}
+	# Extra manually-defined handlers
+{% for handle in server.handles %}
+	handle {{ handle.handle }} {
+		{{ handle.contents }}
+	}
+{% endfor %}
 {% endif %}
 
 	resolver {{ ingress_resolver }};