website: update docs social card and favicons

The community repository moved from debian.griffo.io to deb.griffo.io
(Debian trademark policy; old domain redirects permanently). Also use
the keyring + signed-by layout and add the missing sudo and apt update.

scripts/install.sh

@@ -220,7 +220,7 @@ install_uncloud_binaries() {
                 # 0.20.0~nightly-abc < 0.20.0 < 0.21.0~nightly-def.
                 # latest_version is always a clean stable tag from releases/latest, so the substitution is one-sided.
                 local newest
-                newest=$(printf '%s\n%s\n' "${installed_version//-/~}" "${latest_version}" | sort -V | tail -n1)
+                newest=$(printf '%s\n%s\n' "${installed_version//-/\~}" "${latest_version}" | sort -V | tail -n1)
                 if [ "${newest}" = "${latest_version}" ]; then
                     log "⏳ Upgrading uncloudd ${installed_version} → ${latest_version}..."
                     uncloudd_url="${UNCLOUD_GITHUB_URL}/releases/download/v${latest_version}/${uncloudd_archive_name}"

website/Caddyfile

@@ -1,5 +1,10 @@
 {
     admin off
+    servers {
+        # Trust the Uncloud ingress Caddy (cluster network) so the X-Forwarded-For chain it forwards
+        # is preserved and the real client IP is logged in the client_ip field.
+        trusted_proxies static 10.210.0.0/16
+    }
 }
 
 :8000 {

website/docs/1-overview.md

@@ -14,33 +14,41 @@ Uncloud covers all the essentials for operating apps in production without overw
 traditional container orchestrators like Kubernetes or Swarm:
 
 * Initial machine and network setup
+* Building images and pushing them directly to your machines without a registry
 * Zero-downtime rolling deployments
 * Health checks and automatic restarts
-* Automatic HTTPS and reverse proxy configuration
 * Scaling services across multiple machines
 * Cross-machine service communication without exposing ports to the internet
 * DNS-based service discovery
+* Automatic HTTPS and reverse proxy configuration
 * Load balancing
 * Persistent storage
 
 ## Use cases
 
-Some of the common use cases Uncloud is a great fit for:
+Uncloud is a great fit for anything from production workloads to a single-server homelab:
 
-- **Self-hosting and Homelabs**: Run your self-hosted apps on your own hardware. Start with a single machine and add
-  more as your needs grow.
+- **Production web apps and SaaS**: Run your product on VMs from any cloud provider or your own servers with
+  zero-downtime rolling deployments, health checks, and automatic HTTPS. Spread replicas across multiple machines to
+  keep your app available even when a machine goes down.
 - **Outgrowing Docker Compose**: Level up your Docker Compose setup with zero-downtime deployments, replicas across
   multiple machines for improved reliability, cross-machine service communication, automated reverse proxy management,
   and more using the same Compose file.
-- **Small to medium web applications**: Deploy your SaaS product, websites, or personal projects with redundancy across
-  multiple machines for better reliability and your peace of mind.
-- **Hybrid setups (cloud + on-prem)**: Combine cloud VMs with on-premise for cost savings and data sovereignty — all
-  managed through the same interface.
+- **Moving off a cloud PaaS or Kubernetes**: Get a Heroku-like deployment workflow on your own servers, without the high
+  PaaS costs or the complexity of Kubernetes.
+- **Migrating from Docker Swarm**: Swarm has been in maintenance mode for years. Uncloud offers an actively developed
+  alternative that keeps the familiar Compose format and drops the manager quorum. You also get secure WireGuard
+  networking across machines, image push without a registry, and automatic reverse proxy management out of the box.
+- **Hybrid setups (cloud + on-prem)**: Combine cloud VMs with on-premise servers and distribute workloads for cost
+  savings and data sovereignty. For example, keep your database on your own hardware and scale web replicas out to cloud
+  VMs. Manage everything together through the same interface.
 - **Agencies and freelancers**: Host multiple client projects with proper isolation on shared infrastructure, optimising
   costs and resources.
 - **Edge computing**: Deploy applications closer to your users for lower latency and better performance.
-- **Dev/staging environments**: Spin up additional environments for development and testing that mirror production
-  reusing the same Compose configuration.
+- **Self-hosting and homelabs**: Run your self-hosted apps on your own hardware. Start with a single machine and add
+  more as your needs grow.
+- **Dev/staging environments**: Spin up additional environments for development and testing that mirror production,
+  using the same Compose configuration.
 
 ## What makes Uncloud special
 
@@ -69,10 +77,10 @@ Talos [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/).
 
 ### Managed DNS service (optional)
 
-Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.uncld.dev` for your public
-services through free [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service. You can deploy a service and
-instantly access it from anywhere with a proper DNS name and HTTPS without any manual DNS configuration. This makes
-self-hosting much more accessible and simplifies the process of adding your own domain later.
+Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.uncld.dev` for your public services
+through free [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service. You can deploy a service and instantly
+access it from anywhere with a proper DNS name and HTTPS without any manual DNS configuration. This makes self-hosting
+much more accessible and simplifies the process of adding your own domain later.
 
 ### No complex orchestration
 

website/docs/2-getting-started/1-install-cli.md

@@ -99,13 +99,15 @@ Follow the same steps to upgrade to the latest version in the future.
 ## Debian
 
 On a Debian system, you can install Uncloud CLI from an unofficial
-[repository](https://debian.griffo.io/) maintained by
+[repository](https://deb.griffo.io/) maintained by
 [@dariogriffo](https://github.com/dariogriffo):
 
 ```shell
-curl -sS https://debian.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/debian.griffo.io.gpg
-echo "deb https://debian.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/debian.griffo.io.list
-apt install -y uncloud
+sudo install -d -m 0755 /etc/apt/keyrings
+curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
+echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list
+sudo apt update
+sudo apt install -y uncloud
 ```
 
 Alternatively, you can download `.deb` packages directly from the repository

website/docs/2-getting-started/2-deploy-demo-app.md

@@ -1,15 +1,19 @@
 # Deploy demo app
 
-In this guide, we'll deploy [Excalidraw](https://excalidraw.com) — a popular sketching and diagramming tool — to your
+In this guide, we'll deploy [Excalidraw](https://excalidraw.com), a popular sketching and diagramming tool, to your
 Linux server. You'll learn the **basics of Uncloud** and see how simple it is to **run web apps** on your own
 infrastructure with secure internet access.
 
 :::info NOTE
-To give you a chance to play with Uncloud without even leaving your browser or needing your own servers, we're providing interactive tutorials and playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
 
-You can follow [this tutorial](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) which walks you through creating a new cluster with two machines and then deploying a simple web service to it.
+To give you a chance to play with Uncloud without even leaving your browser or needing your own servers, we're providing
+interactive tutorials and playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
 
-You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you can play with an already initialized Uncloud cluster.
+You can follow [this tutorial](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) which walks you
+through creating a new cluster with two machines and then deploying a simple web service to it.
+
+You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you
+can play with an already initialised Uncloud cluster.
 :::
 
 ## Prerequisites
@@ -53,8 +57,7 @@ This command will:
 - Install the Uncloud daemon on your server
 - Create a Docker network for Uncloud-managed containers
 - Deploy [Caddy](https://caddyserver.com/) as your reverse proxy listening on host ports 80 and 443
-- Reserve a free `xxxxxx.uncld.dev` subdomain via the Uncloud managed DNS service and point it to your
-  server's IP
+- Reserve a free `xxxxxx.uncld.dev` subdomain via the Uncloud managed DNS service and point it to your server's IP
 
 All in about a minute!
 
@@ -148,17 +151,17 @@ Cluster initialised with machine 'machine-dc3c' and saved as context 'default' i
 Current cluster context is now 'default'.
 Waiting for the machine to be ready...
 
-Reserved cluster domain: 7za6s7.uncld.dev
-[+] Deploying service caddy 7/2
- ✔ Container caddy-d7uk on machine-dc3c     Started                                            6.1s
-   ✔ Image caddy:2.10.0 on machine-dc3c       Pulled                                           3.7s
+Reserved cluster domain: sh8hsb.uncld.dev
+[+] Deploying service caddy 2/2
+ ✔ Container caddy-d7uk on machine-dc3c     Running                                           11.1s
+   ✔ Image caddy:2.11.4 on machine-dc3c     Pulled                                             3.7s
 
 Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
 [+] Verifying internet access to caddy service 1/1
  ✔ Machine machine-dc3c (157.180.72.195)  Reachable                                            0.7s
 
 DNS records updated to use only the internet-reachable machines running caddy service:
-  *.7za6s7.uncld.dev  A → 157.180.72.195
+  *.sh8hsb.uncld.dev  A → 157.180.72.195
 ```
 
 </details>
@@ -177,11 +180,11 @@ You'll see the progress of the deployment and the public URL where you can acces
 
 ```
 [+] Running service excalidraw (replicated mode) 2/2
- ✔ Container excalidraw-azpc on machine-dc3c  Started                       8.9s
+ ✔ Container excalidraw-azpc on machine-dc3c  Healthy                      37.1s
    ✔ Image excalidraw/excalidraw on machine-dc3c  Pulled                    4.7s
 
 excalidraw endpoints:
- • https://excalidraw.7za6s7.uncld.dev → :80
+ • https://excalidraw.sh8hsb.uncld.dev → :80
 ```
 
 ## Verify your deployment
@@ -193,12 +196,12 @@ uc inspect excalidraw
 ```
 
 ```
-ID:    4d2de1600b6ada221a03896cd388836c
+Service ID: 4d2de1600b6ada221a03896cd388836c
 Name:       excalidraw
 Mode:       replicated
 
-CONTAINER ID   IMAGE                   CREATED              STATUS                        MACHINE
-fde7ac7f11ad   excalidraw/excalidraw   About a minute ago   Up About a minute (healthy)   machine-dc3c
+CONTAINER ID   IMAGE                          CREATED              STATUS                        IP ADDRESS   MACHINE
+fde7ac7f11ad   excalidraw/excalidraw:latest   About a minute ago   Up About a minute (healthy)   10.210.0.3   machine-dc3c
 ```
 
 In this example, the service has one container running on the machine `machine-dc3c` (our server). The container is up
@@ -211,9 +214,9 @@ uc ls
 ```
 
 ```
-NAME         MODE         REPLICAS   ENDPOINTS
-caddy        global       1
-excalidraw   replicated   1          https://excalidraw.7za6s7.uncld.dev → :80
+NAME         MODE         REPLICAS   IMAGE                          ENDPOINTS
+caddy        global       1          caddy:2.11.4
+excalidraw   replicated   1          excalidraw/excalidraw:latest   https://excalidraw.sh8hsb.uncld.dev → :80
 ```
 
 You can see `caddy` service listed here. That's your reverse proxy, running as a regular Uncloud service.
@@ -223,7 +226,7 @@ You can see `caddy` service listed here. That's your reverse proxy, running as a
 Open your browser and navigate to the URL shown in the endpoints. It may take a moment for Caddy to obtain a TLS
 certificate from Let's Encrypt. If it doesn't load immediately, wait a few seconds and try again.
 
-![Excalidraw running on Uncloud](./img/excalidraw-browser.png)
+![Excalidraw running on Uncloud](https://media.uncloud.run/docs/excalidraw-browser.webp)
 
 You now have:
 
@@ -231,6 +234,25 @@ You now have:
 - A **public URL** with **automatic HTTPS** you can share with your team and friends
 - **Full control over your data** — no analytics or tracking
 
+## View service logs
+
+Want to see what's happening inside your service? Use the `uc logs` command to view logs from the service container:
+
+```shell
+uc logs excalidraw
+```
+
+```
+Jul 14 10:53:05.910 machine-dc3c excalidraw/fde7a ::1 - - [14/Jul/2026:00:53:05 +0000] "GET / HTTP/1.1" 200 6843 "-" "Wget" "-"
+Jul 14 10:53:31.456 machine-dc3c excalidraw/fde7a 10.210.0.2 - - [14/Jul/2026:00:53:31 +0000] "GET /sw.js HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0"
+```
+
+Add the `-f` flag to stream new logs in real-time. Press `Ctrl+C` to stop:
+
+```shell
+uc logs excalidraw -f
+```
+
 ## Convert to Docker Compose format
 
 Uncloud supports the [Compose file format](https://docs.docker.com/reference/compose-file/) for defining services. This
@@ -249,9 +271,9 @@ services:
 
 :::info note
 
-The `x-ports` key is an Uncloud-specific extension to the Compose file format. It allows you to specify ports that
-should be published as HTTP(S) endpoints. Uncloud automatically configures the reverse proxy (Caddy) to route traffic to
-these ports.
+The [`x-ports`](../8-compose-file-reference/2-extensions.md#x-ports) key is an Uncloud-specific extension to the Compose
+file format. It allows you to specify ports that should be published as HTTP(S) endpoints. Uncloud automatically
+configures the reverse proxy (Caddy) to route traffic to these ports.
 
 :::
 
@@ -270,25 +292,27 @@ We've successfully converted our deployment created with `uc run` to a Compose f
 
 ## Use your own domain
 
-Want to use your own domain, for example, `excalidraw.example.com` instead of `excalidraw.7za6s7.uncld.dev`?
+Want to use your own domain, for example, `excalidraw.example.com` instead of `excalidraw.sh8hsb.uncld.dev`?
 
 Add a CNAME record `excalidraw.example.com` in your DNS provider (Cloudflare, Namecheap, etc.) pointing to
-`excalidraw.7za6s7.uncld.dev`. Alternatively, you can add an A record pointing to your server's IP.
+`excalidraw.sh8hsb.uncld.dev`. Alternatively, you can add an A record pointing to your server's IP.
 
 :::info note
 
 These instructions set up your own domain **in addition to** the Uncloud managed DNS name
-`excalidraw.7za6s7.uncld.dev`.
+`excalidraw.sh8hsb.uncld.dev`.
 
 If you want to avoid the managed service altogether, add `--no-dns` to your `uc machine init` command, and point an A
-DNS record to your server(s)'s IP(s).
+DNS record to your servers' IPs.
 
 :::
 
 Then update the published port `80/https` in `compose.yaml` to use your domain:
 
 ```yaml title="compose.yaml"
-...
+services:
+  excalidraw:
+    image: excalidraw/excalidraw
     x-ports:
       - excalidraw.example.com:80/https
 ```
@@ -300,25 +324,32 @@ uc deploy
 ```
 
 ```
-Deployment plan:
-- Deploy service [name=excalidraw]
-  - machine-dc3c: Run container [image=excalidraw/excalidraw]
-  - machine-dc3c: Remove container [name=excalidraw-azpc]
+Deployment plan
 
-Do you want to continue?
+context: default
 
-Choose [y/N]: y
-Chose: Yes!
+~ update service excalidraw
+  │   image: excalidraw/excalidraw:latest
+  │
+  ╰── +/- replace container excalidraw/fde7ac7f11ad on machine-dc3c
 
-[+] Deploying services 2/2
- ✔ Container excalidraw-0z12 on machine-dc3c  Started                       3.5s
- ✔ Container excalidraw-azpc on machine-dc3c  Removed                       3.4s
+──────────────────────────────────────────
+1 replace (start-first) · across 1 machine
+
+Proceed with deployment to default? [y/N] y
+
+[+] Deploying to default 2/2
+ ✔ Container excalidraw-0z12 on machine-dc3c          Healthy              30.6s
+ ✔ Container excalidraw/fde7ac7f11ad on machine-dc3c  Removed               0.4s
 ```
 
-Notice how Uncloud performed a **zero-downtime deployment** — it started the new container with the updated
-configuration before removing the old one. Your service stayed available throughout the update.
+Uncloud prints a deployment plan and asks for confirmation before making any changes. The plan says it will replace the
+running container with a new one using the
+[`start-first` order](../4-guides/1-deployments/4-rolling-deployments.md#update-order). This means Uncloud starts the
+new container with the updated configuration, waits for it to become healthy, and only then removes the old one. Your
+service stays available throughout the update. That's a **zero-downtime deployment**.
 
-Give it a moment for Caddy to obtain a TLS certificate, then visit https://excalidraw.example.com.
+Give it a moment for Caddy to obtain a TLS certificate, then visit https://excalidraw.example.com (use your own domain).
 
 ## Clean up
 
@@ -361,20 +392,7 @@ The following actions will be performed:
 - Remove Uncloud WireGuard interface
 Do you want to proceed with uninstallation? [y/N] y
 ⏳ Stopping systemd services...
-Removed "/etc/systemd/system/multi-user.target.wants/uncloud.service".
-The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
-Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
-template units). This means they are not meant to be enabled or disabled using systemctl.
-
-Possible reasons for having these kinds of units are:
-• A unit may be statically enabled by being symlinked from another unit's
-  .wants/, .requires/, or .upholds/ directory.
-• A unit's purpose may be to act as a helper for some other unit which has
-  a requirement dependency on it.
-• A unit may be started when needed via activation (socket, path, timer,
-  D-Bus, udev, scripted systemctl call, ...).
-• In case of template units, the unit is meant to be enabled with some
-  instance name specified.
+Removed /etc/systemd/system/multi-user.target.wants/uncloud.service.
 ✓ Systemd services stopped.
 ⏳ Removing systemd service files...
 removed '/etc/systemd/system/uncloud.service'
@@ -386,44 +404,61 @@ removed '/usr/local/bin/uncloudd'
 uncloud-corrosion
 ✓ uncloud-corrosion container removed.
 ⏳ Removing data and run directories...
-removed '/var/lib/uncloud/machine.db-wal'
-removed '/var/lib/uncloud/caddy/caddy/autosave.json'
-removed directory '/var/lib/uncloud/caddy/caddy'
-removed '/var/lib/uncloud/caddy/caddy.json'
-removed directory '/var/lib/uncloud/caddy'
-removed '/var/lib/uncloud/machine.json'
 removed '/var/lib/uncloud/machine.db-shm'
-removed '/var/lib/uncloud/corrosion/admin.sock'
-removed '/var/lib/uncloud/corrosion/config.toml'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite-wal'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite-shm'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite'
-removed directory '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8'
-removed '/var/lib/uncloud/corrosion/subscriptions/5e04cbb20a2743c382cfbd4949922351/sub.sqlite'
-removed directory '/var/lib/uncloud/corrosion/subscriptions/5e04cbb20a2743c382cfbd4949922351'
-removed directory '/var/lib/uncloud/corrosion/subscriptions'
-removed '/var/lib/uncloud/corrosion/schema.sql'
-removed '/var/lib/uncloud/corrosion/store.db'
-removed directory '/var/lib/uncloud/corrosion'
 removed '/var/lib/uncloud/machine.db'
+removed '/var/lib/uncloud/corrosion/store.db'
+removed '/var/lib/uncloud/corrosion/subscriptions/754e24df40f8476389cf6dbfa7b542c8/sub.sqlite'
+removed directory '/var/lib/uncloud/corrosion/subscriptions/754e24df40f8476389cf6dbfa7b542c8'
+removed '/var/lib/uncloud/corrosion/subscriptions/125e6ada8eec4f3cad192e1890db55c2/sub.sqlite'
+removed directory '/var/lib/uncloud/corrosion/subscriptions/125e6ada8eec4f3cad192e1890db55c2'
+removed directory '/var/lib/uncloud/corrosion/subscriptions'
+removed '/var/lib/uncloud/corrosion/config.toml'
+removed '/var/lib/uncloud/corrosion/schema.sql'
+removed directory '/var/lib/uncloud/corrosion'
+removed '/var/lib/uncloud/machine.json'
+removed '/var/lib/uncloud/caddy/caddy.json'
+removed '/var/lib/uncloud/caddy/caddy/autosave.json'
+removed '/var/lib/uncloud/caddy/caddy/last_clean.json'
+removed directory '/var/lib/uncloud/caddy/caddy/locks'
+removed '/var/lib/uncloud/caddy/caddy/instance.uuid'
+removed '/var/lib/uncloud/caddy/caddy/acme/acme-staging-v02.api.letsencrypt.org-directory/users/default/default.json'
+removed '/var/lib/uncloud/caddy/caddy/acme/acme-staging-v02.api.letsencrypt.org-directory/users/default/default.key'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-staging-v02.api.letsencrypt.org-directory/users/default'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-staging-v02.api.letsencrypt.org-directory/users'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-staging-v02.api.letsencrypt.org-directory'
+removed '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory/users/default/default.json'
+removed '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory/users/default/default.key'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory/users/default'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory/users'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory/challenge_tokens'
+removed directory '/var/lib/uncloud/caddy/caddy/acme/acme-v02.api.letsencrypt.org-directory'
+removed directory '/var/lib/uncloud/caddy/caddy/acme'
+removed '/var/lib/uncloud/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/excalidraw.sh8hsb.uncld.dev/excalidraw.sh8hsb.uncld.dev.key'
+removed '/var/lib/uncloud/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/excalidraw.sh8hsb.uncld.dev/excalidraw.sh8hsb.uncld.dev.crt'
+removed '/var/lib/uncloud/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/excalidraw.sh8hsb.uncld.dev/excalidraw.sh8hsb.uncld.dev.json'
+removed directory '/var/lib/uncloud/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/excalidraw.sh8hsb.uncld.dev'
+removed directory '/var/lib/uncloud/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory'
+removed directory '/var/lib/uncloud/caddy/caddy/certificates'
+removed directory '/var/lib/uncloud/caddy/caddy'
+removed '/var/lib/uncloud/caddy/Caddyfile'
+removed directory '/var/lib/uncloud/caddy'
+removed '/var/lib/uncloud/machine.db-wal'
 removed directory '/var/lib/uncloud'
+removed '/run/uncloud/caddy/admin.sock'
+removed directory '/run/uncloud/caddy'
+removed '/run/uncloud/corrosion/admin.sock'
+removed directory '/run/uncloud/corrosion'
 removed directory '/run/uncloud'
 ✓ Data and run directories removed.
 ⏳ Removing Linux user and group...
 ✓ Linux user 'uncloud' removed.
 Linux group 'uncloud' does not exist or was already removed.
 ⏳ Looking for Docker containers and network created by Uncloud...
-Found 4 Uncloud managed containers.
+Found 1 Uncloud managed containers.
 ⏳ Stopping Uncloud managed containers...
-20613f6046d0
-1f1a65b78e93
-4300bde4a2b0
-053fdd57ec56
+b2eb9968e468
 ⏳ Removing Uncloud managed containers...
-20613f6046d0
-1f1a65b78e93
-4300bde4a2b0
-053fdd57ec56
+b2eb9968e468
 ✓ Uncloud managed containers stopped and removed.
 ⏳ Removing Docker network uncloud...
 uncloud

website/docs/3-concepts/1-clusters/1-connecting.md

@@ -1,6 +1,6 @@
 # Connecting to a cluster
 
-`uc` only needs to reach one machine to work with the entire cluster. That machine acts as an **entry point** and
+`uc` only needs to reach **one machine** to work with the entire cluster. That machine acts as an **entry point** and
 forwards requests to other machines as needed.
 
 `uc` stores **cluster contexts** and **connection details** in a [configuration file](../../7-cli-config-reference.md)
@@ -46,6 +46,27 @@ When you run a `uc` command, it determines which cluster to connect to using thi
 Once the context is resolved, `uc` tries each connection in the context's `connections` list in order until one
 succeeds.
 
+## User permissions on the machine
+
+When `uc` connects to a machine over SSH, it communicates with the Uncloud daemon through the Unix socket
+`/run/uncloud/uncloud.sock` on that machine. The daemon restricts access to the socket to the `root` user and members
+of the `uncloud` Linux group. This means your SSH user must be either `root` or a member of the `uncloud` group.
+
+In most cases you don't need to set this up manually. When you initialise or add a machine with a non-root user,
+`uc machine init` and `uc machine add` automatically add that user to the `uncloud` group during installation.
+
+If you want to connect with a different non-root user later, add them to the group on the machine:
+
+```shell
+sudo usermod -aG uncloud <username>
+```
+
+The group change only applies to new SSH sessions. If `uc` still fails with a permission denied error after adding the
+user, close any long-running SSH connections to the machine (for example, SSH ControlMaster sessions) and try again.
+
+The same requirement applies when running `uc` locally on a cluster machine with a `unix://` connection. The local user
+must be `root` or a member of the `uncloud` group.
+
 ## Global flags and environment variables
 
 These flags are available on every `uc` command. They can also be set with an environment variable. The flag takes

website/docs/3-concepts/2-ingress/2-publishing-services.md

@@ -17,7 +17,7 @@ uc run -p app.example.com:8000/https app:latest
 
 ```
 [+] Running service app-mwng (replicated mode) 1/1
- ✔ Container app-mwng-6lub on machine-fnr9  Started
+ ✔ Container app-mwng-6lub on machine-fnr9  Running
 
 app-mwng endpoints:
  • https://app.example.com → :8000

website/docusaurus.config.js

@@ -12,7 +12,19 @@ import {themes as prismThemes} from 'prism-react-renderer';
 const config = {
   title: 'Uncloud',
   tagline: 'Self-host and scale web apps without Kubernetes complexity',
-  favicon: 'img/favicon.png',
+  // Use the SVG logo as the primary favicon with a PNG fallback to match the landing pages.
+  favicon: 'img/logo.svg',
+  headTags: [
+    {
+      tagName: 'link',
+      attributes: {
+        rel: 'alternate icon',
+        type: 'image/png',
+        href: '/img/favicon.png',
+        sizes: '96x96',
+      },
+    },
+  ],
 
   // Set the production url of your site here
   url: 'https://uncloud.run',

website/landing/hub.html

@@ -689,7 +689,7 @@
                                     </svg>
                                 </summary>
                                 <p class="text-zinc-500 leading-relaxed pb-5">
-                                    No. <a class="underline hover:text-zinc-900" href="/">Uncloud</a> is open source
+                                    No, <a class="underline hover:text-zinc-900" href="/">Uncloud</a> is open source
                                     and fully functional on its own without Hub. You can use the CLI to manage your
                                     clusters and deploy your apps across servers from Compose files. You keep full
                                     control over your servers. Hub adds a web UI and an observability stack on top so
@@ -708,9 +708,12 @@
                                     </svg>
                                 </summary>
                                 <p class="text-zinc-500 leading-relaxed pb-5">
-                                    No, and no point pretending otherwise. Uncloud, the orchestrator, is Apache 2.0. Hub
-                                    is a managed service built on top, and it's how we plan to fund Uncloud's full-time
-                                    development.
+                                    Not at the moment. Hub is a managed service built on top of Uncloud, and it's how
+                                    we plan to fund Uncloud's full-time development. Our principle is that everything
+                                    Uncloud needs on your servers is open source, starting with Uncloud itself under
+                                    Apache 2.0. Your cluster never depends on closed code to keep running. If enough
+                                    people want to run Hub on their own infrastructure, a paid self-hosted license is
+                                    on the table.
                                 </p>
                             </details>
 

website/landing/index.html

@@ -738,10 +738,6 @@ prod-3  201.45.91.123:51820  1m56s ago  11ms   5.12MB    9.34MB
                                 <a class="text-sm font-medium text-violet-700 hover:text-violet-900 transition"
                                    href="/hub#early-access">Get early access &rarr;</a>
                             </div>
-                            <p class="mt-5 text-sm text-zinc-500">
-                                Hub is how we plan to fund Uncloud's full-time development.<br>
-                                Uncloud itself stays Apache 2.0 and works fully without Hub.
-                            </p>
                         </div>
 
                         <div class="lg:col-start-1 lg:row-start-1 rounded-xl overflow-hidden border border-zinc-200 shadow-2xl shadow-zinc-950/10">
@@ -825,6 +821,49 @@ prod-3  201.45.91.123:51820  1m56s ago  11ms   5.12MB    9.34MB
                                     There are no agents to install and no pipelines to migrate.
                                 </p>
                             </details>
+
+                            <details class="group">
+                                <summary
+                                        class="flex items-center justify-between gap-4 py-5 cursor-pointer list-none [&::-webkit-details-marker]:hidden font-inter-tight font-semibold text-zinc-900">
+                                    <span>Do I need Hub to use Uncloud?</span>
+                                    <svg class="w-5 h-5 shrink-0 text-zinc-400 transition-transform duration-200 group-open:rotate-45"
+                                         fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"
+                                         aria-hidden="true">
+                                        <path stroke-linecap="round" stroke-linejoin="round" d="M12 5v14m-7-7h14"/>
+                                    </svg>
+                                </summary>
+                                <p class="text-zinc-500 leading-relaxed pb-5">
+                                    No, Uncloud is open source and fully functional on its own without Hub. You can use
+                                    the CLI to manage your clusters and deploy your apps across servers from Compose
+                                    files. You keep full control over your servers. Hub adds a web UI and an
+                                    observability stack on top so you don't have to build and manage one yourself.
+                                </p>
+                            </details>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        <!-- Newsletter subscription -->
+        <section class="relative bg-white">
+            <div class="py-12 md:py-20">
+                <div class="max-w-6xl mx-auto px-4 sm:px-6">
+                    <div class="max-w-2xl mx-auto text-center">
+                        <h2 class="font-inter-tight text-3xl md:text-4xl font-bold text-zinc-900 mb-4">
+                            Follow the development journey
+                        </h2>
+                        <p class="text-lg text-zinc-500">
+                            Subscribe to get early insights into new features.
+                            See <a class="font-medium text-zinc-600 underline decoration-zinc-300 underline-offset-2 hover:text-zinc-900 hover:decoration-zinc-400 transition-colors"
+                                   href="https://psviderski.substack.com/" target="_blank" rel="noopener">previous
+                            newsletters</a>.
+                        </p>
+                        <div class="mt-6 md:mt-8 flex justify-center">
+                            <iframe src="https://psviderski.substack.com/embed?transparent=true" width="480"
+                                    height="160" title="Subscribe to the Uncloud newsletter" class="w-full max-w-[480px]"
+                                    style="border:none; background:transparent;" frameborder="0"
+                                    scrolling="no"></iframe>
                         </div>
                     </div>
                 </div>
@@ -869,21 +908,6 @@ prod-3  201.45.91.123:51820  1m56s ago  11ms   5.12MB    9.34MB
                         </div>
                     </div>
 
-                    <!-- Newsletter subscription -->
-                    <div class="mt-12 md:mt-16">
-                        <p class="text-zinc-400 mb-4">
-                            Subscribe to follow the development journey and get early insights into new features.<br>
-                            See <a href="https://psviderski.substack.com/" target="_blank" rel="noopener"
-                                   class="text-zinc-200 underline decoration-zinc-500 underline-offset-2 hover:text-zinc-100 hover:decoration-zinc-300 transition-colors">previous
-                            newsletters</a>.
-                        </p>
-                        <div class="flex justify-center">
-                            <iframe src="https://psviderski.substack.com/embed?transparent=true" width="480"
-                                    height="150" title="Subscribe to the Uncloud newsletter"
-                                    style="border:none; background:transparent;" frameborder="0"
-                                    scrolling="no"></iframe>
-                        </div>
-                    </div>
                 </div>
             </div>
         </section>

website/landing/style.css

@@ -1348,6 +1348,10 @@ input[type="search"]::-webkit-search-results-decoration {
   display: inline-flex;
 }
 
+.table{
+  display: table;
+}
+
 .grid{
   display: grid;
 }
@@ -1468,6 +1472,10 @@ input[type="search"]::-webkit-search-results-decoration {
   max-width: 72rem;
 }
 
+.max-w-\[480px\]{
+  max-width: 480px;
+}
+
 .max-w-lg{
   max-width: 32rem;
 }
@@ -2376,10 +2384,6 @@ input[type="search"]::-webkit-search-results-decoration {
   text-decoration-color: #a1a1aa;
 }
 
-.decoration-zinc-500{
-  text-decoration-color: #71717a;
-}
-
 .underline-offset-2{
   text-underline-offset: 2px;
 }
@@ -2735,10 +2739,6 @@ html {
   text-decoration-color: #f4f4f5;
 }
 
-.hover\:decoration-zinc-300:hover{
-  text-decoration-color: #d4d4d8;
-}
-
 .hover\:decoration-zinc-400:hover{
   text-decoration-color: #a1a1aa;
 }
@@ -2963,8 +2963,8 @@ html {
     margin-top: 3.5rem;
   }
 
-  .md\:mt-16{
-    margin-top: 4rem;
+  .md\:mt-8{
+    margin-top: 2rem;
   }
 
   .md\:block{