feat(images): implement RemoveImage gRPC API with extra protection for used images

* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes #422)

normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.

ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.

Add tests pinning both behaviours.

* update docs that secret references are available for pre-deploy hooks

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>

.editorconfig

@@ -18,3 +18,6 @@ indent_size = 4
 [*.sh]
 indent_style = space
 indent_size = 4
+
+[release-notes-*.md]
+max_line_length = off

.gitignore

@@ -44,3 +44,4 @@ node_modules/
 .devcontainer/
 
 .zed/
+research/

.mockery.yml

@@ -1,4 +1,10 @@
 packages:
+  github.com/docker/docker/client:
+    config:
+      dir: internal/machine/docker
+      pkgname: docker
+    interfaces:
+      APIClient:
   github.com/psviderski/uncloud/internal/machine/caddyconfig:
     interfaces:
       CaddyfileValidator:

AGENTS.md

@@ -196,7 +196,6 @@ uc context use <name>           # Switch context
     - Unit tests alongside source files (`*_test.go`)
     - Integration tests in `test/e2e/`
     - Test fixtures in `test/fixtures/`
-- Use table driven tests whenever possible
 - Use the `testify` library for assertions (e.g., `require.Equal`, `assert.Nil`)
 
 ### Dependencies

HACKING.md

@@ -116,7 +116,7 @@ mise run proto
 Regenerate mocks:
 
 ```shell
-make mocks
+mise run mocks
 ```
 
 ## Uncloud in Docker (UCinD)

Makefile

@@ -21,10 +21,6 @@ corrosion-multiarch-image-push:
 ucind-multiarch-image-push:
 	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: mocks
-mocks:
-	@mockery
-
 .PHONY: test
 test:
 ifeq ($(TEST_NAME),)

README.md

@@ -44,6 +44,8 @@ complexity of Kubernetes.
   [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
   Encrypt.
+* **Cluster storage for TLS certificates**: Native cluster storage for Caddy shares certificates and ACME challenge
+  tokens across machines and coordinates issuance.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
@@ -166,7 +168,9 @@ $ uc machine init --name oracle-vm ubuntu@152.67.101.197
 ✓ uncloudd binary installed: /usr/local/bin/uncloudd
 ⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
 ✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
 ✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
 Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
 ⏳ Starting Uncloud machine daemon (uncloud.service)...
 ✓ Uncloud machine daemon started.
@@ -208,7 +212,9 @@ $ uc machine add --name hetzner-server root@5.223.45.199
 ✓ uncloudd binary installed: /usr/local/bin/uncloudd
 ⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
 ✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
 ✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
 Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
 ⏳ Starting Uncloud machine daemon (uncloud.service)...
 ✓ Uncloud machine daemon started.
@@ -319,9 +325,9 @@ I'm grateful to the following projects that inspired Uncloud's design and implem
 * [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
   user experience that feels like magic.
 * [Talos Linux](https://github.com/siderolabs/talos)
-  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
-  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
-  networking with zero configuration.
+  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for inspiring Uncloud's API routing
+  design with [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for their elegant approach to secure
+  WireGuard-based overlay networking with zero configuration.
 * [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
   [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
   — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the

api/pb/caddy.pb.go

@@ -27,10 +27,12 @@ type GetCaddyConfigResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// The generated Caddyfile content.
+	// The saved Caddyfile content.
 	Caddyfile string `protobuf:"bytes,1,opt,name=caddyfile,proto3" json:"caddyfile,omitempty"`
 	// Timestamp when the config was last modified.
 	ModifiedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=modified_at,json=modifiedAt,proto3" json:"modified_at,omitempty"`
+	// Error from the latest unsuccessful reconciliation attempt.
+	LastReconciliationError string `protobuf:"bytes,3,opt,name=last_reconciliation_error,json=lastReconciliationError,proto3" json:"last_reconciliation_error,omitempty"`
 }
 
 func (x *GetCaddyConfigResponse) Reset() {
@@ -79,6 +81,13 @@ func (x *GetCaddyConfigResponse) GetModifiedAt() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *GetCaddyConfigResponse) GetLastReconciliationError() string {
+	if x != nil {
+		return x.LastReconciliationError
+	}
+	return ""
+}
+
 var File_api_pb_caddy_proto protoreflect.FileDescriptor
 
 var file_api_pb_caddy_proto_rawDesc = []byte{
@@ -87,22 +96,26 @@ var file_api_pb_caddy_proto_rawDesc = []byte{
 	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
 	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x73, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43, 0x61,
-	0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x12,
-	0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x32, 0x49, 0x0a, 0x05,
-	0x43, 0x61, 0x64, 0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x47, 0x65, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69,
-	0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xaf, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43,
+	0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65,
+	0x12, 0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x12, 0x3a, 0x0a,
+	0x19, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x17, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x32, 0x49, 0x0a, 0x05, 0x43, 0x61, 0x64,
+	0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
+	0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

api/pb/caddy.proto

@@ -13,8 +13,10 @@ service Caddy {
 }
 
 message GetCaddyConfigResponse {
-  // The generated Caddyfile content.
+  // The saved Caddyfile content.
   string caddyfile = 1;
   // Timestamp when the config was last modified.
   google.protobuf.Timestamp modified_at = 2;
+  // Error from the latest unsuccessful reconciliation attempt.
+  string last_reconciliation_error = 3;
 }

api/pb/caddy_storage.pb.go

@@ -446,6 +446,120 @@ func (x *StatCaddyStorageResponse) GetIsTerminal() bool {
 	return false
 }
 
+type ListCertificatesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Certificates []*IssuedCertificate `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
+}
+
+func (x *ListCertificatesResponse) Reset() {
+	*x = ListCertificatesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListCertificatesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListCertificatesResponse) ProtoMessage() {}
+
+func (x *ListCertificatesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListCertificatesResponse.ProtoReflect.Descriptor instead.
+func (*ListCertificatesResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *ListCertificatesResponse) GetCertificates() []*IssuedCertificate {
+	if x != nil {
+		return x.Certificates
+	}
+	return nil
+}
+
+type IssuedCertificate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
+	San string `protobuf:"bytes,1,opt,name=san,proto3" json:"san,omitempty"`
+	// The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
+	Chain []byte `protobuf:"bytes,2,opt,name=chain,proto3" json:"chain,omitempty"`
+	// Any extra information associated with the certificate, usually provided by the issuer implementation.
+	// JSON-encoded, may be absent or null.
+	IssuerData []byte `protobuf:"bytes,3,opt,name=issuer_data,json=issuerData,proto3" json:"issuer_data,omitempty"`
+}
+
+func (x *IssuedCertificate) Reset() {
+	*x = IssuedCertificate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IssuedCertificate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IssuedCertificate) ProtoMessage() {}
+
+func (x *IssuedCertificate) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IssuedCertificate.ProtoReflect.Descriptor instead.
+func (*IssuedCertificate) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *IssuedCertificate) GetSan() string {
+	if x != nil {
+		return x.San
+	}
+	return ""
+}
+
+func (x *IssuedCertificate) GetChain() []byte {
+	if x != nil {
+		return x.Chain
+	}
+	return nil
+}
+
+func (x *IssuedCertificate) GetIssuerData() []byte {
+	if x != nil {
+		return x.IssuerData
+	}
+	return nil
+}
+
 var File_api_pb_caddy_storage_proto protoreflect.FileDescriptor
 
 var file_api_pb_caddy_storage_proto_rawDesc = []byte{
@@ -492,32 +606,48 @@ var file_api_pb_caddy_storage_proto_rawDesc = []byte{
 	0x65, 0x64, 0x41, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01,
 	0x28, 0x03, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x74,
 	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69,
-	0x73, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x32, 0xdf, 0x02, 0x0a, 0x0c, 0x43, 0x61,
-	0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x3e, 0x0a, 0x05, 0x53, 0x74,
-	0x6f, 0x72, 0x65, 0x12, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x43,
+	0x73, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x22, 0x56, 0x0a, 0x18, 0x4c, 0x69, 0x73,
+	0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3a, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x73, 0x22, 0x5c, 0x0a, 0x11, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x61, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x61, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x1f,
+	0x0a, 0x0b, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x32,
+	0xaa, 0x03, 0x0a, 0x0c, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x12, 0x3e, 0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x53, 0x74, 0x6f, 0x72, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x12, 0x43, 0x0a, 0x04, 0x4c, 0x6f, 0x61, 0x64, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
+	0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x61,
+	0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12,
+	0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64,
+	0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12,
+	0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53,
+	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x04,
+	0x53, 0x74, 0x61, 0x74, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43,
 	0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x04, 0x4c, 0x6f,
-	0x61, 0x64, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64,
-	0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79,
-	0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x40, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61,
-	0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x12, 0x43, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x04, 0x53, 0x74, 0x61, 0x74, 0x12, 0x1c,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74,
-	0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65,
-	0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64,
+	0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x49, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -532,7 +662,7 @@ func file_api_pb_caddy_storage_proto_rawDescGZIP() []byte {
 	return file_api_pb_caddy_storage_proto_rawDescData
 }
 
-var file_api_pb_caddy_storage_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_api_pb_caddy_storage_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_api_pb_caddy_storage_proto_goTypes = []any{
 	(*StoreCaddyStorageRequest)(nil),  // 0: api.StoreCaddyStorageRequest
 	(*LoadCaddyStorageRequest)(nil),   // 1: api.LoadCaddyStorageRequest
@@ -542,27 +672,32 @@ var file_api_pb_caddy_storage_proto_goTypes = []any{
 	(*ListCaddyStorageResponse)(nil),  // 5: api.ListCaddyStorageResponse
 	(*StatCaddyStorageRequest)(nil),   // 6: api.StatCaddyStorageRequest
 	(*StatCaddyStorageResponse)(nil),  // 7: api.StatCaddyStorageResponse
-	(*timestamppb.Timestamp)(nil),     // 8: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),             // 9: google.protobuf.Empty
+	(*ListCertificatesResponse)(nil),  // 8: api.ListCertificatesResponse
+	(*IssuedCertificate)(nil),         // 9: api.IssuedCertificate
+	(*timestamppb.Timestamp)(nil),     // 10: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),             // 11: google.protobuf.Empty
 }
 var file_api_pb_caddy_storage_proto_depIdxs = []int32{
-	8, // 0: api.LoadCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
-	8, // 1: api.StatCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
-	0, // 2: api.CaddyStorage.Store:input_type -> api.StoreCaddyStorageRequest
-	1, // 3: api.CaddyStorage.Load:input_type -> api.LoadCaddyStorageRequest
-	3, // 4: api.CaddyStorage.Delete:input_type -> api.DeleteCaddyStorageRequest
-	4, // 5: api.CaddyStorage.List:input_type -> api.ListCaddyStorageRequest
-	6, // 6: api.CaddyStorage.Stat:input_type -> api.StatCaddyStorageRequest
-	9, // 7: api.CaddyStorage.Store:output_type -> google.protobuf.Empty
-	2, // 8: api.CaddyStorage.Load:output_type -> api.LoadCaddyStorageResponse
-	9, // 9: api.CaddyStorage.Delete:output_type -> google.protobuf.Empty
-	5, // 10: api.CaddyStorage.List:output_type -> api.ListCaddyStorageResponse
-	7, // 11: api.CaddyStorage.Stat:output_type -> api.StatCaddyStorageResponse
-	7, // [7:12] is the sub-list for method output_type
-	2, // [2:7] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	10, // 0: api.LoadCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
+	10, // 1: api.StatCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
+	9,  // 2: api.ListCertificatesResponse.certificates:type_name -> api.IssuedCertificate
+	0,  // 3: api.CaddyStorage.Store:input_type -> api.StoreCaddyStorageRequest
+	1,  // 4: api.CaddyStorage.Load:input_type -> api.LoadCaddyStorageRequest
+	3,  // 5: api.CaddyStorage.Delete:input_type -> api.DeleteCaddyStorageRequest
+	4,  // 6: api.CaddyStorage.List:input_type -> api.ListCaddyStorageRequest
+	6,  // 7: api.CaddyStorage.Stat:input_type -> api.StatCaddyStorageRequest
+	11, // 8: api.CaddyStorage.ListCertificates:input_type -> google.protobuf.Empty
+	11, // 9: api.CaddyStorage.Store:output_type -> google.protobuf.Empty
+	2,  // 10: api.CaddyStorage.Load:output_type -> api.LoadCaddyStorageResponse
+	11, // 11: api.CaddyStorage.Delete:output_type -> google.protobuf.Empty
+	5,  // 12: api.CaddyStorage.List:output_type -> api.ListCaddyStorageResponse
+	7,  // 13: api.CaddyStorage.Stat:output_type -> api.StatCaddyStorageResponse
+	8,  // 14: api.CaddyStorage.ListCertificates:output_type -> api.ListCertificatesResponse
+	9,  // [9:15] is the sub-list for method output_type
+	3,  // [3:9] is the sub-list for method input_type
+	3,  // [3:3] is the sub-list for extension type_name
+	3,  // [3:3] is the sub-list for extension extendee
+	0,  // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_api_pb_caddy_storage_proto_init() }
@@ -667,6 +802,30 @@ func file_api_pb_caddy_storage_proto_init() {
 				return nil
 			}
 		}
+		file_api_pb_caddy_storage_proto_msgTypes[8].Exporter = func(v any, i int) any {
+			switch v := v.(*ListCertificatesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[9].Exporter = func(v any, i int) any {
+			switch v := v.(*IssuedCertificate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -674,7 +833,7 @@ func file_api_pb_caddy_storage_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_api_pb_caddy_storage_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   8,
+			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

api/pb/caddy_storage.proto

@@ -18,6 +18,10 @@ service CaddyStorage {
   rpc Delete(DeleteCaddyStorageRequest) returns (google.protobuf.Empty);
   rpc List(ListCaddyStorageRequest) returns (ListCaddyStorageResponse);
   rpc Stat(StatCaddyStorageRequest) returns (StatCaddyStorageResponse);
+
+  // ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+  // Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+  rpc ListCertificates(google.protobuf.Empty) returns (ListCertificatesResponse);
 }
 
 message StoreCaddyStorageRequest {
@@ -57,3 +61,17 @@ message StatCaddyStorageResponse {
   int64 size = 3;
   bool is_terminal = 4;
 }
+
+message ListCertificatesResponse {
+  repeated IssuedCertificate certificates = 1;
+}
+
+message IssuedCertificate {
+  // Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
+  string san = 1;
+  // The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
+  bytes chain = 2;
+  // Any extra information associated with the certificate, usually provided by the issuer implementation.
+  // JSON-encoded, may be absent or null.
+  bytes issuer_data = 3;
+}

api/pb/caddy_storage_grpc.pb.go

@@ -25,6 +25,7 @@ const (
 	CaddyStorage_Delete_FullMethodName           = "/api.CaddyStorage/Delete"
 	CaddyStorage_List_FullMethodName             = "/api.CaddyStorage/List"
 	CaddyStorage_Stat_FullMethodName             = "/api.CaddyStorage/Stat"
+	CaddyStorage_ListCertificates_FullMethodName = "/api.CaddyStorage/ListCertificates"
 )
 
 // CaddyStorageClient is the client API for CaddyStorage service.
@@ -42,6 +43,9 @@ type CaddyStorageClient interface {
 	Delete(ctx context.Context, in *DeleteCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	List(ctx context.Context, in *ListCaddyStorageRequest, opts ...grpc.CallOption) (*ListCaddyStorageResponse, error)
 	Stat(ctx context.Context, in *StatCaddyStorageRequest, opts ...grpc.CallOption) (*StatCaddyStorageResponse, error)
+	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+	ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error)
 }
 
 type caddyStorageClient struct {
@@ -102,6 +106,16 @@ func (c *caddyStorageClient) Stat(ctx context.Context, in *StatCaddyStorageReque
 	return out, nil
 }
 
+func (c *caddyStorageClient) ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListCertificatesResponse)
+	err := c.cc.Invoke(ctx, CaddyStorage_ListCertificates_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // CaddyStorageServer is the server API for CaddyStorage service.
 // All implementations must embed UnimplementedCaddyStorageServer
 // for forward compatibility.
@@ -117,6 +131,9 @@ type CaddyStorageServer interface {
 	Delete(context.Context, *DeleteCaddyStorageRequest) (*emptypb.Empty, error)
 	List(context.Context, *ListCaddyStorageRequest) (*ListCaddyStorageResponse, error)
 	Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error)
+	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+	ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error)
 	mustEmbedUnimplementedCaddyStorageServer()
 }
 
@@ -142,6 +159,9 @@ func (UnimplementedCaddyStorageServer) List(context.Context, *ListCaddyStorageRe
 func (UnimplementedCaddyStorageServer) Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Stat not implemented")
 }
+func (UnimplementedCaddyStorageServer) ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListCertificates not implemented")
+}
 func (UnimplementedCaddyStorageServer) mustEmbedUnimplementedCaddyStorageServer() {}
 func (UnimplementedCaddyStorageServer) testEmbeddedByValue()                      {}
 
@@ -253,6 +273,24 @@ func _CaddyStorage_Stat_Handler(srv interface{}, ctx context.Context, dec func(i
 	return interceptor(ctx, in, info, handler)
 }
 
+func _CaddyStorage_ListCertificates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).ListCertificates(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_ListCertificates_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).ListCertificates(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // CaddyStorage_ServiceDesc is the grpc.ServiceDesc for CaddyStorage service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -280,6 +318,10 @@ var CaddyStorage_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Stat",
 			Handler:    _CaddyStorage_Stat_Handler,
 		},
+		{
+			MethodName: "ListCertificates",
+			Handler:    _CaddyStorage_ListCertificates_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "api/pb/caddy_storage.proto",

api/pb/cluster.pb.go

@@ -124,7 +124,7 @@ func (x DNSRecord_RecordType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use DNSRecord_RecordType.Descriptor instead.
 func (DNSRecord_RecordType) EnumDescriptor() ([]byte, []int) {
-	return file_api_pb_cluster_proto_rawDescGZIP(), []int{9, 0}
+	return file_api_pb_cluster_proto_rawDescGZIP(), []int{10, 0}
 }
 
 type AddMachineRequest struct {
@@ -392,6 +392,9 @@ type Domain struct {
 	unknownFields protoimpl.UnknownFields
 
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Whether the domain is reserved in Uncloud DNS. Older daemons (<0.21) omit this field
+	// and only support reserved domains, so clients should treat absence as true.
+	Reserved *bool `protobuf:"varint,2,opt,name=reserved,proto3,oneof" json:"reserved,omitempty"`
 }
 
 func (x *Domain) Reset() {
@@ -433,6 +436,13 @@ func (x *Domain) GetName() string {
 	return ""
 }
 
+func (x *Domain) GetReserved() bool {
+	if x != nil && x.Reserved != nil {
+		return *x.Reserved
+	}
+	return false
+}
+
 type ReserveDomainRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -480,6 +490,54 @@ func (x *ReserveDomainRequest) GetEndpoint() string {
 	return ""
 }
 
+type SetDomainRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// An externally managed domain name. Empty clears a manually set domain.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *SetDomainRequest) Reset() {
+	*x = SetDomainRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_cluster_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetDomainRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetDomainRequest) ProtoMessage() {}
+
+func (x *SetDomainRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_cluster_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetDomainRequest.ProtoReflect.Descriptor instead.
+func (*SetDomainRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_cluster_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *SetDomainRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 type CreateDomainRecordsRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -491,7 +549,7 @@ type CreateDomainRecordsRequest struct {
 func (x *CreateDomainRecordsRequest) Reset() {
 	*x = CreateDomainRecordsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_cluster_proto_msgTypes[7]
+		mi := &file_api_pb_cluster_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -504,7 +562,7 @@ func (x *CreateDomainRecordsRequest) String() string {
 func (*CreateDomainRecordsRequest) ProtoMessage() {}
 
 func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_cluster_proto_msgTypes[7]
+	mi := &file_api_pb_cluster_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -517,7 +575,7 @@ func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsRequest.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_cluster_proto_rawDescGZIP(), []int{7}
+	return file_api_pb_cluster_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *CreateDomainRecordsRequest) GetRecords() []*DNSRecord {
@@ -538,7 +596,7 @@ type CreateDomainRecordsResponse struct {
 func (x *CreateDomainRecordsResponse) Reset() {
 	*x = CreateDomainRecordsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_cluster_proto_msgTypes[8]
+		mi := &file_api_pb_cluster_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -551,7 +609,7 @@ func (x *CreateDomainRecordsResponse) String() string {
 func (*CreateDomainRecordsResponse) ProtoMessage() {}
 
 func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_cluster_proto_msgTypes[8]
+	mi := &file_api_pb_cluster_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -564,7 +622,7 @@ func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsResponse.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_cluster_proto_rawDescGZIP(), []int{8}
+	return file_api_pb_cluster_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *CreateDomainRecordsResponse) GetRecords() []*DNSRecord {
@@ -587,7 +645,7 @@ type DNSRecord struct {
 func (x *DNSRecord) Reset() {
 	*x = DNSRecord{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_cluster_proto_msgTypes[9]
+		mi := &file_api_pb_cluster_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -600,7 +658,7 @@ func (x *DNSRecord) String() string {
 func (*DNSRecord) ProtoMessage() {}
 
 func (x *DNSRecord) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_cluster_proto_msgTypes[9]
+	mi := &file_api_pb_cluster_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -613,7 +671,7 @@ func (x *DNSRecord) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSRecord.ProtoReflect.Descriptor instead.
 func (*DNSRecord) Descriptor() ([]byte, []int) {
-	return file_api_pb_cluster_proto_rawDescGZIP(), []int{9}
+	return file_api_pb_cluster_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *DNSRecord) GetName() string {
@@ -676,63 +734,72 @@ var file_api_pb_cluster_proto_rawDesc = []byte{
 	0x65, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
 	0x73, 0x22, 0x26, 0x0a, 0x14, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x4a, 0x0a, 0x06, 0x44, 0x6f, 0x6d,
 	0x61, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x32, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x22, 0x47, 0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x96, 0x01, 0x0a,
-	0x09, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d,
-	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x2e, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a,
-	0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x2e, 0x0a, 0x0a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x05, 0x0a, 0x01, 0x41, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41,
-	0x41, 0x41, 0x41, 0x10, 0x02, 0x32, 0xca, 0x03, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
-	0x72, 0x12, 0x3d, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64,
-	0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x41, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
-	0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76,
-	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x08, 0x72, 0x65, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x72, 0x65, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x64, 0x22, 0x32, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a,
+	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x26, 0x0a, 0x10, 0x53, 0x65, 0x74,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47, 0x0a, 0x1b, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x2e, 0x0a, 0x0a, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x05, 0x0a, 0x01, 0x41, 0x10,
+	0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02, 0x32, 0x86, 0x04, 0x0a, 0x07,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d,
+	0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x37, 0x0a,
+	0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x3a, 0x0a, 0x09, 0x53, 0x65, 0x74, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x12, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x12, 0x30, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
 	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52,
-	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x30, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12,
-	0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c,
-	0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x44,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x58, 0x0a, 0x13, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x12, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -748,7 +815,7 @@ func file_api_pb_cluster_proto_rawDescGZIP() []byte {
 }
 
 var file_api_pb_cluster_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_api_pb_cluster_proto_goTypes = []any{
 	(MachineMember_MembershipState)(0),  // 0: api.MachineMember.MembershipState
 	(DNSRecord_RecordType)(0),           // 1: api.DNSRecord.RecordType
@@ -759,40 +826,43 @@ var file_api_pb_cluster_proto_goTypes = []any{
 	(*RemoveMachineRequest)(nil),        // 6: api.RemoveMachineRequest
 	(*Domain)(nil),                      // 7: api.Domain
 	(*ReserveDomainRequest)(nil),        // 8: api.ReserveDomainRequest
-	(*CreateDomainRecordsRequest)(nil),  // 9: api.CreateDomainRecordsRequest
-	(*CreateDomainRecordsResponse)(nil), // 10: api.CreateDomainRecordsResponse
-	(*DNSRecord)(nil),                   // 11: api.DNSRecord
-	(*NetworkConfig)(nil),               // 12: api.NetworkConfig
-	(*IP)(nil),                          // 13: api.IP
-	(*MachineInfo)(nil),                 // 14: api.MachineInfo
-	(*emptypb.Empty)(nil),               // 15: google.protobuf.Empty
+	(*SetDomainRequest)(nil),            // 9: api.SetDomainRequest
+	(*CreateDomainRecordsRequest)(nil),  // 10: api.CreateDomainRecordsRequest
+	(*CreateDomainRecordsResponse)(nil), // 11: api.CreateDomainRecordsResponse
+	(*DNSRecord)(nil),                   // 12: api.DNSRecord
+	(*NetworkConfig)(nil),               // 13: api.NetworkConfig
+	(*IP)(nil),                          // 14: api.IP
+	(*MachineInfo)(nil),                 // 15: api.MachineInfo
+	(*emptypb.Empty)(nil),               // 16: google.protobuf.Empty
 }
 var file_api_pb_cluster_proto_depIdxs = []int32{
-	12, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
-	13, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
-	14, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
-	14, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
+	13, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
+	14, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
+	15, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
+	15, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
 	0,  // 4: api.MachineMember.state:type_name -> api.MachineMember.MembershipState
 	4,  // 5: api.ListMachinesResponse.machines:type_name -> api.MachineMember
-	11, // 6: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
-	11, // 7: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
+	12, // 6: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
+	12, // 7: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
 	1,  // 8: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
 	2,  // 9: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
-	15, // 10: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
+	16, // 10: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
 	6,  // 11: api.Cluster.RemoveMachine:input_type -> api.RemoveMachineRequest
 	8,  // 12: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
-	15, // 13: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
-	15, // 14: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
-	9,  // 15: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
-	3,  // 16: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
-	5,  // 17: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
-	15, // 18: api.Cluster.RemoveMachine:output_type -> google.protobuf.Empty
-	7,  // 19: api.Cluster.ReserveDomain:output_type -> api.Domain
-	7,  // 20: api.Cluster.GetDomain:output_type -> api.Domain
-	7,  // 21: api.Cluster.ReleaseDomain:output_type -> api.Domain
-	10, // 22: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
-	16, // [16:23] is the sub-list for method output_type
-	9,  // [9:16] is the sub-list for method input_type
+	9,  // 13: api.Cluster.SetDomain:input_type -> api.SetDomainRequest
+	16, // 14: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
+	16, // 15: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
+	10, // 16: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
+	3,  // 17: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
+	5,  // 18: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
+	16, // 19: api.Cluster.RemoveMachine:output_type -> google.protobuf.Empty
+	7,  // 20: api.Cluster.ReserveDomain:output_type -> api.Domain
+	16, // 21: api.Cluster.SetDomain:output_type -> google.protobuf.Empty
+	7,  // 22: api.Cluster.GetDomain:output_type -> api.Domain
+	7,  // 23: api.Cluster.ReleaseDomain:output_type -> api.Domain
+	11, // 24: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
+	17, // [17:25] is the sub-list for method output_type
+	9,  // [9:17] is the sub-list for method input_type
 	9,  // [9:9] is the sub-list for extension type_name
 	9,  // [9:9] is the sub-list for extension extendee
 	0,  // [0:9] is the sub-list for field type_name
@@ -891,7 +961,7 @@ func file_api_pb_cluster_proto_init() {
 			}
 		}
 		file_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*CreateDomainRecordsRequest); i {
+			switch v := v.(*SetDomainRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -903,7 +973,7 @@ func file_api_pb_cluster_proto_init() {
 			}
 		}
 		file_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
-			switch v := v.(*CreateDomainRecordsResponse); i {
+			switch v := v.(*CreateDomainRecordsRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -915,6 +985,18 @@ func file_api_pb_cluster_proto_init() {
 			}
 		}
 		file_api_pb_cluster_proto_msgTypes[9].Exporter = func(v any, i int) any {
+			switch v := v.(*CreateDomainRecordsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_cluster_proto_msgTypes[10].Exporter = func(v any, i int) any {
 			switch v := v.(*DNSRecord); i {
 			case 0:
 				return &v.state
@@ -927,13 +1009,14 @@ func file_api_pb_cluster_proto_init() {
 			}
 		}
 	}
+	file_api_pb_cluster_proto_msgTypes[5].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_api_pb_cluster_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   10,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

api/pb/cluster.proto

@@ -14,6 +14,7 @@ service Cluster {
   rpc RemoveMachine(RemoveMachineRequest) returns (google.protobuf.Empty);
 
   rpc ReserveDomain(ReserveDomainRequest) returns (Domain);
+  rpc SetDomain(SetDomainRequest) returns (google.protobuf.Empty);
   rpc GetDomain(google.protobuf.Empty) returns (Domain);
   rpc ReleaseDomain(google.protobuf.Empty) returns (Domain);
   rpc CreateDomainRecords(CreateDomainRecordsRequest) returns (CreateDomainRecordsResponse);
@@ -56,12 +57,20 @@ message RemoveMachineRequest {
 
 message Domain {
   string name = 1;
+  // Whether the domain is reserved in Uncloud DNS. Older daemons (<0.21) omit this field
+  // and only support reserved domains, so clients should treat absence as true.
+  optional bool reserved = 2;
 }
 
 message ReserveDomainRequest {
   string endpoint = 1;
 }
 
+message SetDomainRequest {
+  // An externally managed domain name. Empty clears a manually set domain.
+  string name = 1;
+}
+
 message CreateDomainRecordsRequest {
   repeated DNSRecord records = 1;
 }

api/pb/cluster_grpc.pb.go

@@ -24,6 +24,7 @@ const (
 	Cluster_ListMachines_FullMethodName        = "/api.Cluster/ListMachines"
 	Cluster_RemoveMachine_FullMethodName       = "/api.Cluster/RemoveMachine"
 	Cluster_ReserveDomain_FullMethodName       = "/api.Cluster/ReserveDomain"
+	Cluster_SetDomain_FullMethodName           = "/api.Cluster/SetDomain"
 	Cluster_GetDomain_FullMethodName           = "/api.Cluster/GetDomain"
 	Cluster_ReleaseDomain_FullMethodName       = "/api.Cluster/ReleaseDomain"
 	Cluster_CreateDomainRecords_FullMethodName = "/api.Cluster/CreateDomainRecords"
@@ -37,6 +38,7 @@ type ClusterClient interface {
 	ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMachinesResponse, error)
 	RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error)
+	SetDomain(ctx context.Context, in *SetDomainRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	ReleaseDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	CreateDomainRecords(ctx context.Context, in *CreateDomainRecordsRequest, opts ...grpc.CallOption) (*CreateDomainRecordsResponse, error)
@@ -90,6 +92,16 @@ func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequ
 	return out, nil
 }
 
+func (c *clusterClient) SetDomain(ctx context.Context, in *SetDomainRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Cluster_SetDomain_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *clusterClient) GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -128,6 +140,7 @@ type ClusterServer interface {
 	ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error)
 	RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error)
 	ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error)
+	SetDomain(context.Context, *SetDomainRequest) (*emptypb.Empty, error)
 	GetDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	ReleaseDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	CreateDomainRecords(context.Context, *CreateDomainRecordsRequest) (*CreateDomainRecordsResponse, error)
@@ -153,6 +166,9 @@ func (UnimplementedClusterServer) RemoveMachine(context.Context, *RemoveMachineR
 func (UnimplementedClusterServer) ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReserveDomain not implemented")
 }
+func (UnimplementedClusterServer) SetDomain(context.Context, *SetDomainRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetDomain not implemented")
+}
 func (UnimplementedClusterServer) GetDomain(context.Context, *emptypb.Empty) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetDomain not implemented")
 }
@@ -255,6 +271,24 @@ func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Cluster_SetDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetDomainRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClusterServer).SetDomain(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Cluster_SetDomain_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClusterServer).SetDomain(ctx, req.(*SetDomainRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Cluster_GetDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
@@ -332,6 +366,10 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ReserveDomain",
 			Handler:    _Cluster_ReserveDomain_Handler,
 		},
+		{
+			MethodName: "SetDomain",
+			Handler:    _Cluster_SetDomain_Handler,
+		},
 		{
 			MethodName: "GetDomain",
 			Handler:    _Cluster_GetDomain_Handler,

api/pb/common.go

@@ -4,8 +4,16 @@ import (
 	"bytes"
 	"fmt"
 	"net/netip"
+
+	"google.golang.org/grpc/status"
 )
 
+// Err returns the upstream error, preserving its gRPC status code.
+// It returns nil for nil metadata or an absent or successful status.
+func (m *Metadata) Err() error {
+	return status.ErrorProto(m.GetStatus())
+}
+
 func NewIP(addr netip.Addr) *IP {
 	// MarshalBinary always returns a nil error.
 	ip, _ := addr.MarshalBinary()

api/pb/common.pb.go

@@ -87,7 +87,8 @@ type Metadata struct {
 	MachineName string `protobuf:"bytes,5,opt,name=machine_name,json=machineName,proto3" json:"machine_name,omitempty"`
 	// Address of the machine the response came from.
 	MachineAddr string `protobuf:"bytes,1,opt,name=machine_addr,json=machineAddr,proto3" json:"machine_addr,omitempty"`
-	// error is set if the request to upstream failed. The rest of the response is undefined.
+	// error is set if the request to upstream failed. The rest of the response apart from this metadata message
+	// is undefined.
 	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
 	// error as a gRPC Status message.
 	Status *status.Status `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`

api/pb/common.proto

@@ -18,7 +18,8 @@ message Metadata {
   // Address of the machine the response came from.
   string machine_addr = 1;
 
-  // error is set if the request to upstream failed. The rest of the response is undefined.
+  // error is set if the request to upstream failed. The rest of the response apart from this metadata message
+  // is undefined.
   string error = 2;
   // error as a gRPC Status message.
   google.rpc.Status status = 3;

api/pb/docker.proto

@@ -24,6 +24,7 @@ service Docker {
   // Docker auth credentials if necessary.
   rpc InspectRemoteImage(InspectRemoteImageRequest) returns (InspectRemoteImageResponse);
   rpc ListImages(ListImagesRequest) returns (ListImagesResponse);
+  rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse);
 
   rpc CreateVolume(CreateVolumeRequest) returns (CreateVolumeResponse);
   rpc ListVolumes(ListVolumesRequest) returns (ListVolumesResponse);
@@ -179,6 +180,40 @@ message ListImagesRequest {
   bytes options = 1;
 }
 
+message RemoveImageRequest {
+  string id = 1;
+  bool force = 2;
+  bool prune_children = 3;
+  repeated ImagePlatform platforms = 4;
+}
+
+// ImagePlatform describes an OCI image platform.
+message ImagePlatform {
+  string architecture = 1;
+  string os = 2;
+  string os_version = 3;
+  repeated string os_features = 4;
+  string variant = 5;
+}
+
+message RemoveImageResponse {
+  // Must contain only one repeated messages field to allow broadcasting RemoveImage requests to multiple machines.
+  repeated MachineImageRemoval messages = 1;
+}
+
+message MachineImageRemoval {
+  Metadata metadata = 1;
+  repeated ImageRemoval results = 2;
+}
+
+// ImageRemoval reports an image deletion or an untagged image reference.
+message ImageRemoval {
+  // The image ID of an image that was deleted.
+  string deleted = 1;
+  // The image reference of an image that was untagged.
+  string untagged = 2;
+}
+
 message ListImagesResponse {
   // Must contain only one repeated messages field to allow broadcasting ListImages requests to multiple machines.
   repeated MachineImages messages = 1;

api/pb/docker_grpc.pb.go

@@ -32,6 +32,7 @@ const (
 	Docker_InspectImage_FullMethodName            = "/api.Docker/InspectImage"
 	Docker_InspectRemoteImage_FullMethodName      = "/api.Docker/InspectRemoteImage"
 	Docker_ListImages_FullMethodName              = "/api.Docker/ListImages"
+	Docker_RemoveImage_FullMethodName             = "/api.Docker/RemoveImage"
 	Docker_CreateVolume_FullMethodName            = "/api.Docker/CreateVolume"
 	Docker_ListVolumes_FullMethodName             = "/api.Docker/ListVolumes"
 	Docker_RemoveVolume_FullMethodName            = "/api.Docker/RemoveVolume"
@@ -59,6 +60,7 @@ type DockerClient interface {
 	// Docker auth credentials if necessary.
 	InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error)
 	ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error)
+	RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error)
 	CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error)
 	ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error)
 	RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -217,6 +219,16 @@ func (c *dockerClient) ListImages(ctx context.Context, in *ListImagesRequest, op
 	return out, nil
 }
 
+func (c *dockerClient) RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RemoveImageResponse)
+	err := c.cc.Invoke(ctx, Docker_RemoveImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *dockerClient) CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateVolumeResponse)
@@ -305,6 +317,7 @@ type DockerServer interface {
 	// Docker auth credentials if necessary.
 	InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error)
 	ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error)
+	RemoveImage(context.Context, *RemoveImageRequest) (*RemoveImageResponse, error)
 	CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error)
 	ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error)
 	RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error)
@@ -358,6 +371,9 @@ func (UnimplementedDockerServer) InspectRemoteImage(context.Context, *InspectRem
 func (UnimplementedDockerServer) ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListImages not implemented")
 }
+func (UnimplementedDockerServer) RemoveImage(context.Context, *RemoveImageRequest) (*RemoveImageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveImage not implemented")
+}
 func (UnimplementedDockerServer) CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateVolume not implemented")
 }
@@ -591,6 +607,24 @@ func _Docker_ListImages_Handler(srv interface{}, ctx context.Context, dec func(i
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Docker_RemoveImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveImage(ctx, req.(*RemoveImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Docker_CreateVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateVolumeRequest)
 	if err := dec(in); err != nil {
@@ -760,6 +794,10 @@ var Docker_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListImages",
 			Handler:    _Docker_ListImages_Handler,
 		},
+		{
+			MethodName: "RemoveImage",
+			Handler:    _Docker_RemoveImage_Handler,
+		},
 		{
 			MethodName: "CreateVolume",
 			Handler:    _Docker_CreateVolume_Handler,

api/pb/machine.proto

@@ -20,7 +20,7 @@ service Machine {
   // InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
   rpc InspectMachine(google.protobuf.Empty) returns (InspectMachineResponse);
   // WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
-  // no known missing or pending transactions through those versions.
+  // no known missing or pending transactions through those versions from active members.
   // Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
   // have been superseded.
   //

api/pb/machine_grpc.pb.go

@@ -48,7 +48,7 @@ type MachineClient interface {
 	// InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
 	InspectMachine(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*InspectMachineResponse, error)
 	// WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
-	// no known missing or pending transactions through those versions.
+	// no known missing or pending transactions through those versions from active members.
 	// Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
 	// have been superseded.
 	//
@@ -224,7 +224,7 @@ type MachineServer interface {
 	// InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
 	InspectMachine(context.Context, *emptypb.Empty) (*InspectMachineResponse, error)
 	// WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
-	// no known missing or pending transactions through those versions.
+	// no known missing or pending transactions through those versions from active members.
 	// Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
 	// have been superseded.
 	//

caddystorage/locker.go

@@ -1,165 +0,0 @@
-package caddystorage
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"slices"
-	"time"
-
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/distlock"
-)
-
-const (
-	lockPrefix              = "caddy_storage:"
-	storeReplicationTimeout = 10 * time.Second
-)
-
-// Lock acquires an automatically renewed distributed lock and waits for the local store to catch up with versions
-// observed on responding machines. Writers using the same lock can then read locally. Unavailable machines may have
-// writes that this wait does not cover, and reads outside a lock remain eventually consistent.
-func (s *Storage) Lock(ctx context.Context, name string) (err error) {
-	if name == "" {
-		return errors.New("lock name is empty")
-	}
-
-	// Count the call first. If Cleanup has already observed zero, Caddy has cancelled s.ctx and the check below rejects
-	// this call before it uses the client.
-	s.lockOps.Add(1)
-	// A failed Lock owns its lifecycle through any lease rollback. A successful Lock transfers that responsibility to
-	// Unlock, which keeps the client open until its release attempt finishes.
-	defer func() {
-		if err != nil {
-			s.lockOps.Add(-1)
-		}
-	}()
-	if s.ctx.Err() != nil {
-		return errors.New("storage is closed")
-	}
-
-	// Stop acquisition retries when Caddy unloads the module (cancels s.ctx), even if the caller's context
-	// is still active.
-	ctx, cancel := context.WithCancelCause(ctx)
-	defer cancel(nil)
-	stopOnCleanup := context.AfterFunc(s.ctx, func() {
-		cancel(context.Cause(s.ctx))
-	})
-	defer stopOnCleanup()
-
-	log := s.log.With("lock", name)
-	started := time.Now()
-	log.Debug("acquiring lock", "ttl", time.Duration(s.LockTTL))
-	lease, err := s.locker.Acquire(ctx, lockPrefix+name)
-	if err != nil {
-		log.Debug("failed to acquire lock", "duration", time.Since(started), "error", err)
-		return fmt.Errorf("acquire lock '%s': %w", name, err)
-	}
-	log.Debug("lock lease acquired", "duration", time.Since(started))
-	// Release the lease if the lock acquisition fails after this point.
-	// Unlock will take care of releasing the lease on success.
-	defer func() {
-		if err == nil {
-			return
-		}
-		if releaseErr := s.releaseLock(ctx, name, lease, "cancelled acquisition"); releaseErr != nil {
-			err = errors.Join(err, releaseErr)
-		}
-	}()
-
-	// Catch up with the latest store versions observed on responding machines to increase the chance of reading
-	// the latest writes on them locally.
-	version, machines, err := s.clusterStoreVersion(ctx, log)
-	if err != nil {
-		return err
-	}
-	waitStarted := time.Now()
-	log.Debug("waiting for local store replication", "machine_names", machines, "store_version", version)
-	waitCtx, cancelWait := context.WithTimeout(ctx, storeReplicationTimeout)
-	err = s.client.WaitForStoreVersion(waitCtx, version)
-	cancelWait()
-	if err != nil {
-		return fmt.Errorf("wait for local store replication: %w", err)
-	}
-	log.Debug("local store replication complete", "duration", time.Since(waitStarted))
-
-	s.locksMu.Lock()
-	defer s.locksMu.Unlock()
-	if s.ctx.Err() != nil {
-		return errors.New("storage is closed")
-	}
-	if lost := context.Cause(lease.Context()); lost != nil {
-		return lost
-	}
-	if _, exists := s.locks[name]; exists {
-		return errors.New("lock is already tracked by this storage instance")
-	}
-	s.locks[name] = lease
-
-	log.Debug("lock acquired", "duration", time.Since(started))
-	return nil
-}
-
-// clusterStoreVersion returns the per-actor maximum store versions from responding machines and their names.
-func (s *Storage) clusterStoreVersion(ctx context.Context, log *slog.Logger) (map[string]uint64, []string, error) {
-	ctx, cancel := context.WithTimeout(ctx, distlock.DefaultMaxNodeCallTimeout)
-	defer cancel()
-	resp, err := s.client.MachineClient.InspectMachine(client.ProxyMachinesContext(ctx, nil), nil)
-	if err != nil {
-		return nil, nil, fmt.Errorf("inspect machines for store versions: %w", err)
-	}
-
-	maxVersion := make(map[string]uint64)
-	machines := make([]string, 0, len(resp.Machines))
-	for _, m := range resp.Machines {
-		if m.Metadata.Error != "" {
-			log.Debug("skipping machine when collecting store versions",
-				"id", m.Metadata.MachineId, "name", m.Metadata.MachineName, "error", m.Metadata.Error)
-			continue
-		}
-		machines = append(machines, m.Metadata.MachineName)
-		for actor, v := range m.StoreVersion {
-			maxVersion[actor] = max(maxVersion[actor], v)
-		}
-	}
-	slices.Sort(machines)
-	return maxVersion, machines, nil
-}
-
-// Unlock releases a previously acquired distributed lock.
-func (s *Storage) Unlock(ctx context.Context, name string) error {
-	s.locksMu.Lock()
-	lease, exists := s.locks[name]
-	if exists {
-		delete(s.locks, name)
-	}
-	s.locksMu.Unlock()
-	if !exists {
-		return fmt.Errorf("lock '%s' is not held by this storage instance", name)
-	}
-	defer s.lockOps.Add(-1)
-
-	// Release stops renewal even on error. Any nodes that cannot be reached will let the lease expire.
-	if err := s.releaseLock(ctx, name, lease, "unlock"); err != nil {
-		return fmt.Errorf("release lock '%s': %w", name, err)
-	}
-
-	return nil
-}
-
-// releaseLock releases the lease with a context that ignores cancellation and logs the release attempt.
-func (s *Storage) releaseLock(ctx context.Context, name string, lease *distlock.Lease, reason string) error {
-	// Unlock and rollback must attempt node cleanup even if the caller or module has already been cancelled.
-	ctx = context.WithoutCancel(ctx)
-
-	log := s.log.With("lock", name, "reason", reason)
-	started := time.Now()
-	log.Debug("releasing lock")
-	if err := lease.Release(ctx); err != nil {
-		log.Debug("failed to release lock", "duration", time.Since(started), "error", err)
-		return err
-	}
-	log.Debug("lock released", "duration", time.Since(started))
-	return nil
-}

caddystorage/module.go

@@ -1,211 +0,0 @@
-// Package caddystorage provides Caddy storage backed by an Uncloud cluster.
-package caddystorage
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
-	"github.com/caddyserver/certmagic"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/client/connector"
-	"github.com/psviderski/uncloud/pkg/distlock"
-)
-
-const (
-	// ModuleID is the Caddy module ID for Uncloud storage.
-	ModuleID = "caddy.storage.uncloud"
-	// DefaultSocketPath is the default path to the Uncloud API socket.
-	DefaultSocketPath = "/run/uncloud/uncloud.sock"
-	// DefaultLockTTL is the default duration of a distributed lock lease.
-	DefaultLockTTL = 20 * time.Second
-	// lockCleanupTimeout bounds how long an unloaded module waits for active lock operations when cleaning up.
-	lockCleanupTimeout = 5 * time.Minute
-)
-
-//nolint:gochecknoinits // Caddy modules must register during package initialisation.
-func init() {
-	caddy.RegisterModule(new(Storage))
-}
-
-// Storage implements a Caddy storage backend that uses an Uncloud cluster to store assets such as TLS certificates.
-type Storage struct {
-	// Socket is the path to the Uncloud API socket.
-	// Defaults to /run/uncloud/uncloud.sock when not set.
-	Socket string `json:"socket,omitempty"`
-	// LockTTL is the duration of a distributed lock after which it expires if not renewed. Locks renew automatically
-	// until unlocked. If an instance crashes or cannot renew, expiry allows another instance to acquire the stale lock.
-	// Longer durations tolerate longer interruptions but delay recovery after a crash. Normal unlocks release the lock
-	// immediately.
-	// Defaults to 20 seconds when not set.
-	LockTTL caddy.Duration `json:"lock_ttl,omitempty"`
-
-	client *client.Client
-	locker *distlock.Locker
-	log    *slog.Logger
-
-	// ctx is the module context from Provision. Caddy cancels it when it unloads the module and calls Cleanup.
-	ctx context.Context
-
-	// locksMu protects locks.
-	locksMu sync.Mutex
-	// locks maps successfully acquired lock names to held leases.
-	locks map[string]*distlock.Lease
-	// lockOps counts Lock calls until they fail or their locks are released.
-	lockOps atomic.Int64
-}
-
-// CaddyModule returns the Caddy module information.
-func (*Storage) CaddyModule() caddy.ModuleInfo {
-	return caddy.ModuleInfo{
-		ID:  ModuleID,
-		New: func() caddy.Module { return new(Storage) },
-	}
-}
-
-// Provision connects the storage to the local Uncloud API and initialises the distributed locker.
-func (s *Storage) Provision(ctx caddy.Context) error {
-	s.ctx = ctx
-	s.log = ctx.Slogger()
-
-	if s.Socket == "" {
-		s.Socket = DefaultSocketPath
-	}
-	if s.LockTTL == 0 {
-		s.LockTTL = caddy.Duration(DefaultLockTTL)
-	}
-	if s.LockTTL < 0 {
-		return errors.New("lock_ttl must be positive")
-	}
-
-	cli, err := client.New(ctx, connector.NewUnixConnector(s.Socket))
-	if err != nil {
-		return fmt.Errorf("connect to Uncloud API: %w", err)
-	}
-
-	locker, err := cli.NewLocker(distlock.Config{
-		LeaseDuration: time.Duration(s.LockTTL),
-	})
-	if err != nil {
-		_ = cli.Close()
-		return fmt.Errorf("create distributed locker: %w", err)
-	}
-
-	s.client = cli
-	s.locker = locker
-	s.locks = make(map[string]*distlock.Lease)
-
-	s.log.Debug("module provisioned", "socket", s.Socket, "lock_ttl", time.Duration(s.LockTTL))
-	return nil
-}
-
-// Cleanup keeps the Uncloud API connection open so acquired lock leases can renew until Caddy releases them. It closes
-// the connection after all lock operations finish or the cleanup timeout expires.
-func (s *Storage) Cleanup() error {
-	if s.client == nil {
-		// Provision failed before opening the storage.
-		return nil
-	}
-
-	started := time.Now()
-	s.log.Debug("cleaning up module", "locks", s.lockOps.Load())
-
-	go func() {
-		timer := time.NewTimer(lockCleanupTimeout)
-		defer timer.Stop()
-		ticker := time.NewTicker(1 * time.Second)
-		defer ticker.Stop()
-
-		timedOut := false
-		for !timedOut && s.lockOps.Load() > 0 {
-			select {
-			case <-ticker.C:
-			case <-timer.C:
-				timedOut = true
-			}
-		}
-		if remaining := s.lockOps.Load(); timedOut && remaining > 0 {
-			s.log.Debug("timed out waiting for active locks to be unlocked",
-				"locks", remaining, "timeout", lockCleanupTimeout)
-		}
-
-		if err := s.client.Close(); err != nil {
-			s.log.Debug("failed to clean up module", "duration", time.Since(started), "error", err)
-			return
-		}
-		s.log.Debug("module cleanup complete", "duration", time.Since(started))
-	}()
-
-	return nil
-}
-
-// CertMagicStorage returns the provisioned CertMagic storage implementation.
-func (s *Storage) CertMagicStorage() (certmagic.Storage, error) {
-	return s, nil
-}
-
-// UnmarshalCaddyfile configures Uncloud storage from the Caddyfile global storage block.
-//
-//	{
-//	    storage uncloud {
-//	        socket /run/uncloud/uncloud.sock
-//	        lock_ttl 20s
-//	    }
-//	}
-func (s *Storage) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
-	d.Next() // Skip the module name 'uncloud'.
-	// Reject inline arguments. NextArg leaves an opening brace for NextBlock.
-	if d.NextArg() {
-		return d.ArgErr()
-	}
-
-	// Read the optional options block, skipping its surrounding braces.
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "socket":
-			// Require a socket path on the same line as 'socket' option.
-			if !d.NextArg() {
-				return d.ArgErr()
-			}
-			s.Socket = d.Val()
-			// Reject extra arguments after the socket path.
-			if d.NextArg() {
-				return d.ArgErr()
-			}
-		case "lock_ttl":
-			if !d.NextArg() {
-				return d.ArgErr()
-			}
-			ttl, err := caddy.ParseDuration(d.Val())
-			if err != nil {
-				return d.Errf("invalid lock_ttl '%s': %v", d.Val(), err)
-			}
-			if ttl <= 0 {
-				return d.Err("lock_ttl must be positive")
-			}
-			if d.NextArg() {
-				return d.ArgErr()
-			}
-			s.LockTTL = caddy.Duration(ttl)
-		default:
-			return d.Errf("unknown uncloud storage option: '%s'", d.Val())
-		}
-	}
-
-	return nil
-}
-
-var (
-	_ caddy.Module           = (*Storage)(nil)
-	_ caddy.Provisioner      = (*Storage)(nil)
-	_ caddy.CleanerUpper     = (*Storage)(nil)
-	_ caddy.StorageConverter = (*Storage)(nil)
-	_ caddyfile.Unmarshaler  = (*Storage)(nil)
-	_ certmagic.Storage      = (*Storage)(nil)
-)

caddystorage/storage.go

@@ -1,83 +0,0 @@
-package caddystorage
-
-import (
-	"context"
-	"fmt"
-	"io/fs"
-
-	"github.com/caddyserver/certmagic"
-	"github.com/psviderski/uncloud/api/pb"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-// Store writes a value to the cluster store.
-func (s *Storage) Store(ctx context.Context, key string, value []byte) error {
-	if _, err := s.client.CaddyStorage.Store(ctx, &pb.StoreCaddyStorageRequest{Key: key, Value: value}); err != nil {
-		return storageError("store", key, err)
-	}
-	return nil
-}
-
-// Load reads a value from the cluster store.
-func (s *Storage) Load(ctx context.Context, key string) ([]byte, error) {
-	resp, err := s.client.CaddyStorage.Load(ctx, &pb.LoadCaddyStorageRequest{Key: key})
-	if err != nil {
-		return nil, storageError("load", key, err)
-	}
-	return resp.Value, nil
-}
-
-// Delete removes a key and its descendants from the cluster store.
-func (s *Storage) Delete(ctx context.Context, key string) error {
-	if _, err := s.client.CaddyStorage.Delete(ctx, &pb.DeleteCaddyStorageRequest{Key: key}); err != nil {
-		return storageError("delete", key, err)
-	}
-	return nil
-}
-
-// Exists reports whether a key exists in the cluster store.
-func (s *Storage) Exists(ctx context.Context, key string) bool {
-	_, err := s.Stat(ctx, key)
-	return err == nil
-}
-
-// List returns keys under prefix from the cluster store.
-func (s *Storage) List(ctx context.Context, prefix string, recursive bool) ([]string, error) {
-	resp, err := s.client.CaddyStorage.List(ctx, &pb.ListCaddyStorageRequest{
-		Prefix:    prefix,
-		Recursive: recursive,
-	})
-	if err != nil {
-		return nil, storageError("list", prefix, err)
-	}
-	return resp.Keys, nil
-}
-
-// Stat returns information about a key in the cluster store.
-func (s *Storage) Stat(ctx context.Context, key string) (certmagic.KeyInfo, error) {
-	resp, err := s.client.CaddyStorage.Stat(ctx, &pb.StatCaddyStorageRequest{Key: key})
-	if err != nil {
-		return certmagic.KeyInfo{}, storageError("stat", key, err)
-	}
-
-	info := certmagic.KeyInfo{
-		Key:        resp.Key,
-		Size:       resp.Size,
-		IsTerminal: resp.IsTerminal,
-	}
-	if resp.UpdatedAt != nil {
-		if err := resp.UpdatedAt.CheckValid(); err != nil {
-			return certmagic.KeyInfo{}, storageError("stat", key, fmt.Errorf("invalid updated_at timestamp: %w", err))
-		}
-		info.Modified = resp.UpdatedAt.AsTime()
-	}
-	return info, nil
-}
-
-func storageError(operation, key string, err error) error {
-	if status.Code(err) == codes.NotFound {
-		err = fs.ErrNotExist
-	}
-	return fmt.Errorf("uncloud storage: %s key %q: %w", operation, key, err)
-}

cmd/uc/caddy/cert/ls.go

@@ -0,0 +1,167 @@
+package cert
+
+import (
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/caddyserver/certmagic"
+	"github.com/docker/go-units"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machine string
+	output  string
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List certificates in cluster storage for Caddy.",
+		Long: `List certificates stored in the Uncloud cluster storage for Caddy.
+
+Caddy must use the Uncloud storage module (https://github.com/unlabs-dev/caddy-uncloud)
+configured with 'storage uncloud' in the global options for its certificates to appear here.
+
+This inventory does not check whether Caddy currently serves or trusts a certificate.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to read certificate storage from. (default is connected machine)")
+	cmd.Flags().StringVarP(&opts.output, "output", "o", "",
+		"Output format: 'json' or empty for a human-readable table.")
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	if opts.output != "" && opts.output != "json" {
+		return fmt.Errorf("unsupported output format '%s' (supported: json)", opts.output)
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	certs, listErr := clusterClient.Caddy.ListCertificates(ctx,
+		client.CaddyListCertificatesOptions{Machine: opts.machine})
+	if len(certs) > 0 || listErr == nil {
+		if err = printCertificates(os.Stdout, certs, opts.output); err != nil {
+			return fmt.Errorf("print Caddy certificates: %w", err)
+		}
+	}
+	if listErr != nil {
+		if len(certs) > 0 {
+			return fmt.Errorf("certificate list is partial: %w", listErr)
+		}
+		return fmt.Errorf("list Caddy certificates: %w", listErr)
+	}
+
+	return nil
+}
+
+func printCertificates(out io.Writer, certs []api.IssuedCertificate, output string) error {
+	type certificate struct {
+		api.IssuedCertificate
+		Fingerprint string
+	}
+
+	items := make([]certificate, 0, len(certs))
+	for _, cert := range certs {
+		fingerprint := cert.Fingerprint()
+		items = append(items, certificate{
+			IssuedCertificate: cert,
+			Fingerprint:       hex.EncodeToString(fingerprint[:]),
+		})
+	}
+	slices.SortFunc(items, func(a, b certificate) int {
+		if cmp := strings.Compare(a.SAN, b.SAN); cmp != 0 {
+			return cmp
+		}
+		if cmp := a.Chain[0].NotAfter.Compare(b.Chain[0].NotAfter); cmp != 0 {
+			return cmp
+		}
+		return strings.Compare(a.Fingerprint, b.Fingerprint)
+	})
+
+	if output == "json" {
+		encoder := json.NewEncoder(out)
+		encoder.SetIndent("", "  ")
+		if err := encoder.Encode(items); err != nil {
+			return fmt.Errorf("marshal certificates: %w", err)
+		}
+		return nil
+	}
+
+	if len(items) == 0 {
+		_, err := fmt.Fprintln(out, "No Caddy certificates found in cluster storage.")
+		return err
+	}
+
+	t := tui.NewTable()
+	t.Headers("ID", "NAME", "ISSUER", "EXPIRES")
+	for _, item := range items {
+		t.Row(
+			item.Fingerprint[:12],
+			item.SAN,
+			formatIssuer(item.IssuerData),
+			formatExpiry(item.Chain[0].NotAfter),
+		)
+	}
+	_, err := lipgloss.Fprintln(out, t)
+	return err
+}
+
+func formatIssuer(data api.CertificateIssuerData) string {
+	if data.ACME == nil {
+		return "unknown"
+	}
+
+	switch data.ACME.CA {
+	case certmagic.LetsEncryptProductionCA:
+		return "Let's Encrypt"
+	case certmagic.LetsEncryptStagingCA:
+		return "Let's Encrypt (staging)"
+	case certmagic.ZeroSSLProductionCA:
+		return "ZeroSSL"
+	case certmagic.GoogleTrustProductionCA:
+		return "Google Trust Services"
+	case certmagic.GoogleTrustStagingCA:
+		return "Google Trust Services (staging)"
+	default:
+		return data.ACME.CA
+	}
+}
+
+func formatExpiry(expires time.Time) string {
+	delta := expires.Sub(time.Now())
+	if delta <= 0 {
+		return fmt.Sprintf("%s (expired %s ago)", expires.UTC().Format(time.DateOnly),
+			strings.ToLower(units.HumanDuration(-delta)))
+	}
+	return fmt.Sprintf("%s (%s)", expires.UTC().Format(time.DateOnly),
+		strings.ToLower(units.HumanDuration(delta)))
+}

cmd/uc/caddy/cert/ls_test.go

@@ -0,0 +1,128 @@
+package cert
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/caddyserver/certmagic"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrintCertificates(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Hour)
+	certs := []api.IssuedCertificate{
+		testIssuedCertificate("z.example.com", "z", now.Add(48*time.Hour), certmagic.LetsEncryptProductionCA),
+		testIssuedCertificate("a.example.com", "old", now.Add(-48*time.Hour), certmagic.LetsEncryptStagingCA),
+		testIssuedCertificate("a.example.com", "new", now.Add(72*time.Hour), "https://ca.example/directory"),
+		testIssuedCertificate("unknown.example.com", "unknown", now.Add(96*time.Hour), ""),
+	}
+
+	var table bytes.Buffer
+	require.NoError(t, printCertificates(&table, certs, ""))
+	output := table.String()
+	assert.Contains(t, output, "ID")
+	assert.Contains(t, output, "NAME")
+	assert.Contains(t, output, "ISSUER")
+	assert.Contains(t, output, "EXPIRES")
+	assert.Contains(t, output, now.Add(-48*time.Hour).Format(time.DateOnly)+" (expired ")
+	assert.Contains(t, output, now.Add(48*time.Hour).Format(time.DateOnly)+" (")
+	assert.Contains(t, output, "Let's Encrypt (staging)")
+	assert.Contains(t, output, "https://ca.example/directory")
+	assert.Less(t, strings.Index(output, now.Add(-48*time.Hour).Format(time.DateOnly)),
+		strings.Index(output, now.Add(72*time.Hour).Format(time.DateOnly)))
+	assert.Less(t, strings.Index(output, "a.example.com"), strings.Index(output, "z.example.com"))
+	assert.Contains(t, output, testFingerprint("old")[:12])
+
+	var encoded bytes.Buffer
+	require.NoError(t, printCertificates(&encoded, certs, "json"))
+	var items []struct {
+		api.IssuedCertificate
+		Fingerprint string
+	}
+	require.NoError(t, json.Unmarshal(encoded.Bytes(), &items))
+	require.Len(t, items, 4)
+	assert.Equal(t, testFingerprint("old"), items[0].Fingerprint)
+	assert.Equal(t, "a.example.com", items[0].SAN)
+	require.Len(t, items[0].Chain, 1)
+	assert.Equal(t, []byte("old"), items[0].Chain[0].Raw)
+	assert.Equal(t, now.Add(-48*time.Hour), items[0].Chain[0].NotAfter)
+	require.NotNil(t, items[0].IssuerData.ACME)
+	assert.Equal(t, certmagic.LetsEncryptStagingCA, items[0].IssuerData.ACME.CA)
+	assert.Equal(t, testFingerprint("new"), items[1].Fingerprint)
+	require.NotNil(t, items[1].IssuerData.ACME)
+	assert.Equal(t, "https://ca.example/directory", items[1].IssuerData.ACME.CA)
+	assert.Nil(t, items[2].IssuerData.ACME)
+	assert.Equal(t, "z.example.com", items[3].SAN)
+}
+
+func TestPrintCertificates_Empty(t *testing.T) {
+	for _, tt := range []struct {
+		output string
+		want   string
+	}{
+		{output: "", want: "No Caddy certificates found in cluster storage.\n"},
+		{output: "json", want: "[]\n"},
+	} {
+		var out bytes.Buffer
+		require.NoError(t, printCertificates(&out, nil, tt.output))
+		assert.Equal(t, tt.want, out.String())
+	}
+}
+
+func TestFormatIssuer(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		ca   string
+		want string
+	}{
+		{name: "production", ca: certmagic.LetsEncryptProductionCA, want: "Let's Encrypt"},
+		{name: "staging", ca: certmagic.LetsEncryptStagingCA, want: "Let's Encrypt (staging)"},
+		{name: "ZeroSSL", ca: certmagic.ZeroSSLProductionCA, want: "ZeroSSL"},
+		{name: "Google Trust Services", ca: certmagic.GoogleTrustProductionCA, want: "Google Trust Services"},
+		{name: "Google Trust Services staging", ca: certmagic.GoogleTrustStagingCA, want: "Google Trust Services (staging)"},
+		{name: "other", ca: "https://ca.example/directory", want: "https://ca.example/directory"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, formatIssuer(api.CertificateIssuerData{
+				ACME: &api.ACMEIssuerData{CA: tt.ca},
+			}))
+		})
+	}
+
+	assert.Equal(t, "unknown", formatIssuer(api.CertificateIssuerData{}))
+}
+
+func TestFormatExpiry_UTC(t *testing.T) {
+	now := time.Now().UTC()
+	brisbane := time.FixedZone("AEST", 10*60*60)
+	expires := time.Date(now.Year(), now.Month(), now.Day()+3, 3, 0, 0, 0, brisbane)
+	assert.True(t, strings.HasPrefix(formatExpiry(expires), expires.UTC().Format(time.DateOnly)+" ("))
+	assert.NotEqual(t, expires.Format(time.DateOnly), expires.UTC().Format(time.DateOnly))
+	expired := now.Add(-2 * time.Hour)
+	assert.True(t, strings.HasPrefix(formatExpiry(expired), expired.UTC().Format(time.DateOnly)+" (expired "))
+	assert.Contains(t, formatExpiry(expired), " ago)")
+}
+
+func testIssuedCertificate(name, raw string, expires time.Time, ca string) api.IssuedCertificate {
+	cert := api.IssuedCertificate{
+		SAN:   name,
+		Chain: []*x509.Certificate{{Raw: []byte(raw), NotAfter: expires}},
+	}
+	if ca != "" {
+		cert.IssuerData.ACME = &api.ACMEIssuerData{CA: ca}
+	}
+	return cert
+}
+
+func testFingerprint(raw string) string {
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}

cmd/uc/caddy/cert/root.go

@@ -0,0 +1,12 @@
+package cert
+
+import "github.com/spf13/cobra"
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "cert",
+		Short: "Inspect certificates in cluster storage for Caddy.",
+	}
+	cmd.AddCommand(NewListCommand())
+	return cmd
+}

cmd/uc/caddy/config.go

@@ -3,17 +3,18 @@ package caddy
 import (
 	"context"
 	"fmt"
-	"os"
 
+	"charm.land/lipgloss/v2"
 	"github.com/alecthomas/chroma/v2/quick"
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
 )
 
 type configOptions struct {
 	machine string
-	noColor bool
 }
 
 func NewConfigCommand() *cobra.Command {
@@ -31,8 +32,6 @@ func NewConfigCommand() *cobra.Command {
 
 	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
 		"Name or ID of the machine to get the configuration from. (default is connected machine)")
-	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
-		"Disable syntax highlighting for the output.")
 
 	completion.MachinesFlag(cmd)
 
@@ -46,24 +45,20 @@ func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
 	}
 	defer clusterClient.Close()
 
-	if opts.machine != "" {
-		// If a specific machine is requested, use it to get the Caddy configuration.
-		ctx = clusterClient.ProxySingleMachineContext(ctx, opts.machine)
-	}
-
-	config, err := clusterClient.Caddy.GetConfig(ctx, nil)
+	config, err := clusterClient.Caddy.Config(ctx, client.CaddyConfigOptions{Machine: opts.machine})
 	if err != nil {
 		return fmt.Errorf("get Caddy config: %w", err)
 	}
 
 	// Print the Caddyfile with syntax highlighting.
-	if opts.noColor {
-		fmt.Print(config.Caddyfile)
-	} else {
-		if err = quick.Highlight(os.Stdout, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
+	if err = quick.Highlight(lipgloss.Writer, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
 		// If highlighting fails, fall back to plain output.
-			fmt.Print(config.Caddyfile)
+		lipgloss.Print(config.Caddyfile)
 	}
+
+	if config.LastReconciliationError != "" {
+		tui.PrintWarning(fmt.Sprintf("last Caddy config load failed: %s\nShowing the last saved Caddyfile.",
+			config.LastReconciliationError))
 	}
 
 	return nil

cmd/uc/caddy/deploy.go

@@ -110,7 +110,9 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	placement := api.Placement{
 		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
 	}
-	d, err := clusterClient.NewCaddyDeployment(opts.image, caddyfile, placement)
+	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{
+		Image: opts.image, Config: caddyfile, Placement: placement,
+	})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}
@@ -202,6 +204,10 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 		}
 		return fmt.Errorf("get cluster domain: %w", err)
 	}
+	if !domain.Reserved {
+		fmt.Printf("Skipping DNS records update as cluster domain '%s' is managed externally.\n", domain.Name)
+		return nil
+	}
 
 	fmt.Println("Updating cluster domain records in Uncloud DNS to point to machines running caddy service...")
 	// TODO: split the method into two: one to get the records and one to update them to ask for update confirmation.
@@ -216,7 +222,7 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 		if errors.Is(err, client.ErrNoReachableMachines) {
 			fmt.Println()
 			fmt.Printf("DNS records for domain '%s' could not be updated as there are no internet-reachable "+
-				"machines running caddy containers.\n", domain)
+				"machines running caddy containers.\n", domain.Name)
 			fmt.Println()
 			fmt.Println("Possible solutions:")
 			fmt.Println("- Ensure your machines have public IP addresses")

cmd/uc/caddy/root.go

@@ -1,6 +1,7 @@
 package caddy
 
 import (
+	"github.com/psviderski/uncloud/cmd/uc/caddy/cert"
 	"github.com/spf13/cobra"
 )
 
@@ -10,6 +11,7 @@ func NewRootCommand() *cobra.Command {
 		Short: "Manage Caddy reverse proxy service.",
 	}
 	cmd.AddCommand(
+		cert.NewRootCommand(),
 		NewConfigCommand(),
 		NewDeployCommand(),
 		NewLogsCommand(),

cmd/uc/deploy.go

@@ -18,7 +18,7 @@ import (
 	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/psviderski/uncloud/pkg/client/compose"
 	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/psviderski/uncloud/pkg/client/deploy/operation"
+	"github.com/psviderski/uncloud/pkg/client/operation"
 	"github.com/spf13/cobra"
 )
 
@@ -305,7 +305,7 @@ const defaultFailedContainerLogsTail = 10
 // UNCLOUD_FAILED_CONTAINER_LOGS_TAIL environment variable override when set and valid.
 func failedContainerLogsTail() int {
 	if v := os.Getenv("UNCLOUD_FAILED_CONTAINER_LOGS_TAIL"); v != "" {
-		if tail, err := logs.Tail(v); err == nil && (tail == -1 || tail > 0) {
+		if tail, err := logs.ParseTail(v); err == nil && (tail == -1 || tail > 0) {
 			return tail
 		}
 	}

cmd/uc/dns/release.go

@@ -37,6 +37,7 @@ func release(ctx context.Context, uncli *cli.CLI) error {
 		if status.Convert(err).Code() == codes.NotFound {
 			return errors.New("no domain reserved")
 		}
+		return fmt.Errorf("release cluster domain: %w", err)
 	}
 
 	fmt.Printf("Released cluster domain: %s\n", domain.Name)

cmd/uc/dns/reserve.go

@@ -49,7 +49,8 @@ func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
 	domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.endpoint})
 	if err != nil {
 		if status.Convert(err).Code() == codes.AlreadyExists {
-			return errors.New("domain already reserved")
+			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' " +
+				"or release a reservation with 'uc dns release' first")
 		}
 		return err
 	}

cmd/uc/dns/root.go

@@ -7,16 +7,19 @@ import (
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "dns",
-		Short: "Manage cluster domain in Uncloud DNS.",
-		Long: "Manage cluster domain in Uncloud DNS.\n" +
+		Short: "Manage the cluster domain.",
+		Long: "Manage the cluster domain.\n" +
 			"DNS commands allow you to reserve or release a unique 'xxxxxx.uncld.dev' domain for your " +
 			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
-			"traffic to the services in the cluster.",
+			"traffic to the services in the cluster.\n\n" +
+			"EXPERIMENTAL: Use 'uc dns set' to configure an externally managed domain instead. " +
+			"Uncloud does not manage DNS records for manually set domains.",
 	}
 	cmd.AddCommand(
 		NewReleaseCommand(),
 		NewReserveCommand(),
 		NewShowCommand(),
+		NewSetCommand(),
 	)
 	return cmd
 }

cmd/uc/dns/set.go

@@ -0,0 +1,72 @@
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/miekg/dns"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/grpcversion"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+func NewSetCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "set DOMAIN_NAME",
+		Args:  cobra.ExactArgs(1),
+		Short: "Set or unset an externally managed cluster domain (EXPERIMENTAL).",
+		Long: "EXPERIMENTAL: Set the cluster domain used to generate ingress hostnames for services.\n" +
+			"Configure wildcard DNS records for this domain with your DNS provider. " +
+			"Uncloud will not create, verify, update, or delete external DNS records.\n" +
+			"Pass an empty string to unset a manually set domain. " +
+			"Use 'uc dns release' to release a domain reserved in Uncloud DNS. " +
+			"Setting or unsetting the domain does not change existing service hostnames.",
+		Example: "  uc dns set apps.example.com\n  uc dns set \"\"",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return set(cmd.Context(), uncli, args[0])
+		},
+	}
+
+	return cmd
+}
+
+func set(ctx context.Context, uncli *cli.CLI, name string) error {
+	if name != "" {
+		if labels, ok := dns.IsDomainName(name); !ok || labels < 2 {
+			return fmt.Errorf("invalid cluster domain %q: must be a valid domain name with at least two labels", name)
+		}
+	}
+	tui.PrintWarning("Setting an externally managed cluster domain is experimental.")
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	ctx = metadata.AppendToOutgoingContext(ctx, grpcversion.MetadataKeyMinServerVersion, "0.21.0")
+	_, err = clusterClient.SetDomain(ctx, &pb.SetDomainRequest{Name: name})
+	if err != nil {
+		if status.Convert(err).Code() == codes.AlreadyExists {
+			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' or " +
+				"release a reservation with 'uc dns release' first")
+		}
+		return fmt.Errorf("set cluster domain: %w", err)
+	}
+
+	if name == "" {
+		fmt.Println("Unset cluster domain. External DNS records have not been changed.")
+		return nil
+	}
+	fmt.Printf("Set cluster domain: %s\n", name)
+	fmt.Println("DNS is managed externally. " +
+		"Configure wildcard DNS records pointing to machines running the Caddy service.")
+	return nil
+}

cmd/uc/dns/show.go

@@ -33,11 +33,11 @@ func show(ctx context.Context, uncli *cli.CLI) error {
 	domain, err := clusterClient.GetDomain(ctx)
 	if err != nil {
 		if errors.Is(err, api.ErrNotFound) {
-			return errors.New("no domain reserved")
+			return errors.New("no cluster domain configured")
 		}
 		return err
 	}
 
-	fmt.Println(domain)
+	fmt.Println(domain.Name)
 	return nil
 }

cmd/uc/image/ls.go

@@ -13,6 +13,7 @@ import (
 	"github.com/charmbracelet/colorprofile"
 	"github.com/containerd/platforms"
 	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
 
 	"github.com/psviderski/uncloud/internal/cli"
@@ -102,7 +103,7 @@ func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
 	var rows []imageRow
 
 	for _, machineImages := range clusterImages {
-		if err := machineImages.Error(); err != nil {
+		if err := machineImages.Metadata.Err(); err != nil {
 			tui.PrintWarning(fmt.Sprintf("failed to list images on machine '%s': %s",
 				machineImages.Metadata.MachineName, err))
 			continue
@@ -116,49 +117,7 @@ func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
 			store = "containerd"
 		}
 
-		// Process each image for this machine.
-		for _, img := range machineImages.Images {
-			// Show the first 12 chars without 'sha256:' as the image ID like Docker does.
-			id := strings.TrimPrefix(img.ID, "sha256:")[:12]
-
-			name := "<none>"
-			if len(img.RepoTags) > 0 && img.RepoTags[0] != "<none>:<none>" {
-				name = img.RepoTags[0]
-			}
-
-			imgPlatforms, _ := imagePlatforms(img)
-			formattedPlatforms := formatPlatforms(imgPlatforms)
-
-			created := ""
-			createdAt := time.Unix(img.Created, 0)
-			if !createdAt.IsZero() {
-				created = units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
-			}
-
-			size := units.HumanSizeWithPrecision(float64(img.Size), 3)
-
-			// Check if the image is in use by any containers. Only supported by Docker API >=1.51
-			inUse := "-"
-			if img.Containers != -1 { // -1 means the info is not available.
-				if img.Containers > 0 {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
-				} else {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
-				}
-			}
-
-			rows = append(rows, imageRow{
-				id:           id,
-				name:         name,
-				platforms:    formattedPlatforms,
-				createdHuman: created,
-				createdUnix:  img.Created,
-				size:         size,
-				inUse:        inUse,
-				store:        store,
-				machine:      machineName,
-			})
-		}
+		rows = append(rows, imageRows(machineImages.Images, machineName, store)...)
 	}
 
 	if len(rows) == 0 {
@@ -184,13 +143,55 @@ func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
 	return nil
 }
 
+// imageRows keeps every stored name visible and retains digest-only and unnamed images.
+func imageRows(images []image.Summary, machineName, store string) []imageRow {
+	var rows []imageRow
+	for _, img := range images {
+		// RepoTags includes stored digest names on containerd. RepoDigests can include derived names.
+		imageNames := img.RepoTags
+		if len(imageNames) == 0 {
+			imageNames = []string{"<untagged>"}
+		}
+
+		imgPlatforms, _ := imagePlatforms(img)
+		created := ""
+		if img.Created > 0 {
+			created = units.HumanDuration(time.Since(time.Unix(img.Created, 0))) + " ago"
+		}
+		// Check if the image is in use by any containers. Only supported by Docker API >=1.51
+		inUse := "-"
+		if img.Containers >= 0 { // -1 means the info is not available.
+			inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
+			if img.Containers > 0 {
+				inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
+			}
+		}
+
+		for _, name := range imageNames {
+			rows = append(rows, imageRow{
+				id:           stringid.TruncateID(img.ID),
+				name:         name,
+				platforms:    formatPlatforms(imgPlatforms),
+				createdHuman: created,
+				createdUnix:  img.Created,
+				size:         units.HumanSizeWithPrecision(float64(img.Size), 3),
+				inUse:        inUse,
+				store:        store,
+				machine:      machineName,
+			})
+		}
+	}
+
+	return rows
+}
+
 // imagePlatforms returns a list of platforms supported by the image and a boolean indicating if it's multi-platform.
 func imagePlatforms(img image.Summary) ([]string, bool) {
 	var formattedPlatforms []string
 	multiPlatform := false
 
 	for _, m := range img.Manifests {
-		if m.Kind != image.ManifestKindImage || !m.Available {
+		if m.Kind != image.ManifestKindImage || !m.Available || m.ImageData == nil {
 			continue
 		}
 

cmd/uc/machine/add.go

@@ -192,7 +192,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version.
 	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
-	// issues accessing the Machine API of existing machines in the cluster.
+	// issues accessing the API of existing machines in the cluster.
 	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
 	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
@@ -219,7 +219,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 
 	fmt.Println()
 	fmt.Println("Preparing Caddy deployment...")
-	d, err := clusterClient.NewCaddyDeployment(caddyImage, "", api.Placement{})
+	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{Image: caddyImage})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

cmd/uc/machine/init.go

@@ -16,7 +16,7 @@ import (
 	"github.com/psviderski/uncloud/internal/cli/tui"
 	"github.com/psviderski/uncloud/internal/machine/cluster"
 	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
 )
 
@@ -221,17 +221,17 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		initOpts.WireguardEndpoints = endpoints
 	}
 
-	client, err := uncli.InitCluster(ctx, initOpts)
+	clusterClient, err := uncli.InitCluster(ctx, initOpts)
 	if err != nil {
 		return err
 	}
-	defer client.Close()
+	defer clusterClient.Close()
 
 	// Since the cluster API needs a few moments to become ready after cluster initialisation,
 	// we keep the user informed during this wait. We wait here even if no Caddy or DNS is requested
 	// as the cluster needs to be ready so that commands such as 'uc machine ls' work immediately after init.
 	err = tui.RunSpinner(ctx, "Waiting for the cluster to be ready...", func(ctx context.Context) error {
-		return client.WaitClusterReady(ctx, 1*time.Minute)
+		return clusterClient.WaitClusterReady(ctx, 1*time.Minute)
 	})
 	if err != nil {
 		return fmt.Errorf("wait for cluster to be ready: %w", err)
@@ -245,7 +245,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	fmt.Println()
 
 	if !opts.noDNS {
-		domain, err := client.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
+		domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
 		if err != nil {
 			return fmt.Errorf("reserve cluster domain in Uncloud DNS: %w", err)
 		}
@@ -253,7 +253,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	}
 
 	if !opts.noCaddy {
-		d, err := client.NewCaddyDeployment("", "", api.Placement{})
+		d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{})
 		if err != nil {
 			return fmt.Errorf("create caddy deployment: %w", err)
 		}
@@ -269,7 +269,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 
 		fmt.Println()
-		return caddy.UpdateDomainRecords(ctx, client, uncli.ProgressOut())
+		return caddy.UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
 	}
 
 	return nil

cmd/uc/machine/logs.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+	"time"
 
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/cli/completion"
@@ -64,6 +65,15 @@ If no services are specified, streams logs from the uncloud service.`,
 }
 
 func runLogs(ctx context.Context, uncli *cli.CLI, services []string, opts logs.Options) error {
+	since, until, err := logs.TimeRange(opts.Since, opts.Until, time.Now())
+	if err != nil {
+		return err
+	}
+	tail, err := opts.TailLines()
+	if err != nil {
+		return err
+	}
+
 	if len(services) == 0 {
 		services = []string{api.SystemServiceUncloud}
 	}
@@ -74,11 +84,6 @@ func runLogs(ctx context.Context, uncli *cli.CLI, services []string, opts logs.O
 		}
 	}
 
-	tail, err := logs.Tail(opts.Tail)
-	if err != nil {
-		return err
-	}
-
 	c, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
@@ -88,8 +93,8 @@ func runLogs(ctx context.Context, uncli *cli.CLI, services []string, opts logs.O
 	logsOpts := api.ServiceLogsOptions{
 		Follow:   opts.Follow,
 		Tail:     tail,
-		Since:    opts.Since,
-		Until:    opts.Until,
+		Since:    since,
+		Until:    until,
 		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
 	}
 

cmd/uc/machine/logs_test.go

@@ -0,0 +1,25 @@
+package machine
+
+import (
+	"context"
+	"testing"
+
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunLogsInvalidTimeFilters(t *testing.T) {
+	t.Parallel()
+
+	// Invalid filters must fail before connecting to the cluster.
+	for _, flag := range []string{"since", "until"} {
+		opts := logs.Options{}
+		if flag == "since" {
+			opts.Since = "invalid"
+		} else {
+			opts.Until = "invalid"
+		}
+		err := runLogs(context.Background(), nil, nil, opts)
+		require.ErrorContains(t, err, "invalid --"+flag+" value")
+	}
+}

cmd/uc/machine/rtt.go

@@ -54,8 +54,8 @@ func rtt(ctx context.Context, uncli *cli.CLI) error {
 			tui.PrintWarning("metadata is missing in response from unknown server")
 			continue
 		}
-		if m.Metadata.Error != "" {
-			tui.PrintWarning(fmt.Sprintf("failed to inspect machine '%s': %s", m.Metadata.MachineName, m.Metadata.Error))
+		if err := m.Metadata.Err(); err != nil {
+			tui.PrintWarning(fmt.Sprintf("failed to inspect machine '%s': %s", m.Metadata.MachineName, err))
 			continue
 		}
 		if m.Machine == nil {

cmd/uc/main.go

@@ -88,10 +88,11 @@ func main() {
 
 			configPath := fs.ExpandHomeDir(opts.configPath)
 
+			// Make uc connect via the local Unix socket when running on a cluster machine.
 			if opts.connect == "" {
-				if !fs.Exists(configPath) && fs.Exists(machine.DefaultUncloudSockPath) {
+				if !fs.Exists(configPath) && fs.Exists(machine.DefaultClusterAPISockPath) {
 					conn = &config.MachineConnection{
-						Unix: machine.DefaultUncloudSockPath,
+						Unix: machine.DefaultClusterAPISockPath,
 					}
 				}
 			}

cmd/uc/ps.go

@@ -207,9 +207,9 @@ func collectContainers(ctx context.Context, cli *client.Client) ([]containerInfo
 
 		machineName := msc.Metadata.MachineName
 
-		if msc.Metadata.Error != "" {
+		if err := msc.Metadata.Err(); err != nil {
 			tui.PrintWarning(fmt.Sprintf("failed to list service containers on machine %s: %s",
-				machineName, msc.Metadata.Error))
+				machineName, err))
 			continue
 		}
 

cmd/uc/service/logs.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	mapset "github.com/deckarep/golang-set/v2"
 	"github.com/psviderski/uncloud/internal/cli"
@@ -78,6 +79,15 @@ If no services are specified, streams logs from all services defined in the Comp
 }
 
 func RunLogs(ctx context.Context, uncli *cli.CLI, args []string, opts logs.Options) error {
+	since, until, err := logs.TimeRange(opts.Since, opts.Until, time.Now())
+	if err != nil {
+		return err
+	}
+	tail, err := opts.TailLines()
+	if err != nil {
+		return err
+	}
+
 	serviceArgs, err := logs.ParseServiceArgs(args)
 	if err != nil {
 		return err
@@ -106,12 +116,6 @@ func RunLogs(ctx context.Context, uncli *cli.CLI, args []string, opts logs.Optio
 		}
 	}
 
-	// Parse tail option.
-	tail, err := logs.Tail(opts.Tail)
-	if err != nil {
-		return err
-	}
-
 	c, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
@@ -121,8 +125,8 @@ func RunLogs(ctx context.Context, uncli *cli.CLI, args []string, opts logs.Optio
 	baseOpts := api.ServiceLogsOptions{
 		Follow:   opts.Follow,
 		Tail:     tail,
-		Since:    opts.Since,
-		Until:    opts.Until,
+		Since:    since,
+		Until:    until,
 		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
 	}
 

cmd/uc/service/logs_test.go

@@ -0,0 +1,25 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunLogsInvalidTimeFilters(t *testing.T) {
+	t.Parallel()
+
+	// Invalid filters must fail before loading Compose files or connecting to the cluster.
+	for _, flag := range []string{"since", "until"} {
+		opts := logs.Options{}
+		if flag == "since" {
+			opts.Since = "invalid"
+		} else {
+			opts.Until = "invalid"
+		}
+		err := RunLogs(context.Background(), nil, nil, opts)
+		require.ErrorContains(t, err, "invalid --"+flag+" value")
+	}
+}

cmd/uc/service/run.go

@@ -122,6 +122,7 @@ func NewRunCommand(groupID string) *cobra.Command {
 		"Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where\n"+
 			"the volume is located. Can be specified multiple times.\n"+
 			"Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]\n"+
+			"Host and container paths support runtime templates such as {{.Container.Name}}.\n"+
 			"Examples:\n"+
 			"  -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container\n"+
 			"  -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container\n"+

cmd/uncloudd/dialstdio.go

@@ -23,7 +23,7 @@ func newDialStdioCommand() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().StringVar(&socketPath, "socket", machine.DefaultUncloudSockPath,
+	cmd.Flags().StringVar(&socketPath, "socket", machine.DefaultClusterAPISockPath,
 		"Path to the Uncloud API socket")
 
 	return cmd

experiment/go.mod

@@ -1,6 +1,6 @@
 module github.com/psviderski/uncloud/experiment
 
-go 1.26
+go 1.26.0
 
 require (
 	github.com/dgraph-io/badger/v3 v3.2103.5
@@ -18,17 +18,22 @@ require (
 	github.com/psviderski/uncloud v0.0.0
 	github.com/siderolabs/discovery-api v0.1.4
 	github.com/siderolabs/discovery-client v0.1.9
-	go.uber.org/zap v1.27.0
+	go.uber.org/zap v1.28.0
+	golang.org/x/net v0.59.0
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
+	google.golang.org/grpc v1.81.0
 )
 
 require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
+	github.com/caarlos0/go-version v0.2.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -74,18 +79,18 @@ require (
 	github.com/ishidawataru/sctp v0.0.0-20230406120618-7ff4192f6ff2 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/libp2p/go-buffer-pool v0.1.0 // indirect
 	github.com/libp2p/go-libp2p v0.35.4 // indirect
 	github.com/libp2p/go-libp2p-pubsub v0.11.0 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
-	github.com/miekg/dns v1.1.65 // indirect
+	github.com/miekg/dns v1.1.73 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -108,32 +113,32 @@ require (
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/siderolabs/gen v0.4.8 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/vishvananda/netlink v1.3.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
-	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
+	golang.org/x/tools v0.50.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
+	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 )
 

experiment/go.sum

@@ -5,6 +5,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
@@ -38,6 +40,8 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
 github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/caarlos0/go-version v0.2.2 h1:5r+nlrg4H2wOVwWjqRqRRIRbZ7ytRmjC9xoMIP0a5kQ=
+github.com/caarlos0/go-version v0.2.2/go.mod h1:X+rI5VAtJDpcjCjeEIXpxGa5+rTcgur1FK66wS0/944=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -298,8 +302,10 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
 github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
@@ -345,6 +351,7 @@ github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVc
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
@@ -364,6 +371,7 @@ github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKju
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
 github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
+github.com/miekg/dns v1.1.73/go.mod h1:RW2Obtfd5NZHvOFe3zYG0W8koWOQtAzyHaLo8vASBuQ=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
 github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b h1:z78hV3sbSMAUoyUMM0I83AUIT6Hu17AWfgjzIbtrYFc=
@@ -525,6 +533,7 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
 github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
 github.com/smartystreets/goconvey v1.7.2 h1:9RBaZCeXEQ3UselpuwUQHltGVXvdwm6cv1hgR6gDIPg=
@@ -577,16 +586,20 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
 go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
 go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
 go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
 go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
 go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
 go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
 go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
 go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
@@ -603,6 +616,7 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -618,6 +632,7 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
 golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
@@ -631,6 +646,7 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -650,6 +666,7 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
 golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -662,6 +679,7 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -696,6 +714,7 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -707,6 +726,10 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
 golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -721,10 +744,13 @@ golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
 golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
@@ -737,6 +763,7 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -745,6 +772,7 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
 google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -756,6 +784,7 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
 google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -776,6 +805,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 h1:TbRPT0HtzFP3Cno1zZo7yPzEEnfu8EjLfl6IU9VfqkQ=
+gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259/go.mod h1:AVgIgHMwK63XvmAzWG9vLQ41YnVHN0du0tEC46fI7yY=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=

experiment/wg/connector.go

@@ -1,4 +1,4 @@
-package connector
+package wg
 
 import (
 	"context"
@@ -7,33 +7,42 @@ import (
 	"net/netip"
 	"strconv"
 
-	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/grpcversion"
 	"github.com/psviderski/uncloud/internal/machine/constants"
 	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/internal/machine/network/tunnel"
-	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/internal/secret"
 	"golang.org/x/net/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
 
+// Machine describes a remote machine that the experimental connector can reach.
+type Machine struct {
+	Host      string
+	PublicKey secret.Secret
+}
+
+type User interface {
+	ManagementIP() netip.Addr
+	PrivateKey() secret.Secret
+}
+
 // WireGuardConnector establishes a connection to the cluster API through a WireGuard tunnel
 // to one of the cluster machines.
 type WireGuardConnector struct {
-	user     *client.User
-	machines []config.MachineConnection
-	tun      *tunnel.Tunnel
+	user     User
+	machines []Machine
+	tun      *Tunnel
 }
 
-func NewWireGuardConnector(user *client.User, machines []config.MachineConnection) *WireGuardConnector {
+func NewWireGuardConnector(user User, machines []Machine) *WireGuardConnector {
 	return &WireGuardConnector{
 		user:     user,
 		machines: machines,
 	}
 }
 
-// TODO: handle context cancelation.
+// TODO: handle context cancellation.
 func (c *WireGuardConnector) Connect(ctx context.Context) (*grpc.ClientConn, error) {
 	if len(c.machines) == 0 {
 		return nil, fmt.Errorf("no machines to connect to")
@@ -49,25 +58,24 @@ func (c *WireGuardConnector) Connect(ctx context.Context) (*grpc.ClientConn, err
 	if err != nil {
 		return nil, fmt.Errorf("parse IP address %q: %w", endpointIPs[0].String(), err)
 	}
-	endpoint := netip.AddrPortFrom(endpointAddr, tunnel.DefaultEndpointPort)
+	endpoint := netip.AddrPortFrom(endpointAddr, DefaultEndpointPort)
 	machineManagementIP := network.ManagementIP(machine.PublicKey)
-	machineAPIAddr := net.JoinHostPort(machineManagementIP.String(), strconv.Itoa(constants.MachineAPIPort))
+	machineAPIAddr := net.JoinHostPort(machineManagementIP.String(), strconv.Itoa(constants.UncloudAPIPort))
 
-	tunCfg := &tunnel.Config{
+	tunCfg := &Config{
 		LocalAddress:    c.user.ManagementIP(),
 		LocalPrivateKey: c.user.PrivateKey(),
 		RemotePublicKey: machine.PublicKey,
 		RemoteNetwork:   netip.PrefixFrom(machineManagementIP, 128),
 		Endpoint:        endpoint,
 	}
-	if c.tun, err = tunnel.Connect(tunCfg); err != nil {
+	if c.tun, err = Connect(tunCfg); err != nil {
 		return nil, fmt.Errorf("establish WireGuard tunnel to %q: %w", endpoint, err)
 	}
 
 	conn, err := grpc.NewClient(
 		machineAPIAddr,
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithDefaultServiceConfig(defaultServiceConfig),
 		grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
 			return c.tun.DialContext(ctx, "tcp", addr)
 		}),

experiment/wg/tunnel.go

@@ -1,4 +1,4 @@
-package tunnel
+package wg
 
 import (
 	"context"
@@ -15,7 +15,7 @@ import (
 
 const (
 	DefaultEndpointPort = 51820
-	// DefaultKeepaliveInterval is sensible interval that works with a wide variety of firewalls.
+	// DefaultKeepaliveInterval is a sensible interval that works with a wide variety of firewalls.
 	DefaultKeepaliveInterval = 25 * time.Second
 )
 

go.mod

@@ -1,19 +1,19 @@
 module github.com/psviderski/uncloud
 
-go 1.26
+go 1.26.0
 
 require (
 	charm.land/bubbles/v2 v2.0.0
-	charm.land/bubbletea/v2 v2.0.2
+	charm.land/bubbletea/v2 v2.0.10
 	charm.land/huh/v2 v2.0.1
 	charm.land/lipgloss/v2 v2.0.1
-	github.com/BurntSushi/toml v1.5.0
+	github.com/BurntSushi/toml v1.6.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/squirrel v1.5.4
-	github.com/alecthomas/chroma/v2 v2.20.0
+	github.com/alecthomas/chroma/v2 v2.24.1
 	github.com/caarlos0/go-version v0.2.2
-	github.com/caddyserver/caddy/v2 v2.8.4
-	github.com/caddyserver/certmagic v0.21.4
+	github.com/caddyserver/caddy/v2 v2.11.4
+	github.com/caddyserver/certmagic v0.25.4
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/charmbracelet/colorprofile v0.4.3
 	github.com/charmbracelet/x/ansi v0.11.7
@@ -34,77 +34,69 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/mattn/go-shellwords v1.0.12
-	github.com/miekg/dns v1.1.65
+	github.com/mholt/acmez/v3 v3.1.6
+	github.com/miekg/dns v1.1.73
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/moby/term v0.5.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/prometheus/client_golang v1.22.0
+	github.com/prometheus/client_golang v1.24.1
 	github.com/psviderski/unregistry v0.4.1
 	github.com/siderolabs/grpc-proxy v0.5.1
-	github.com/spf13/cobra v1.10.1
+	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/vishvananda/netlink v1.3.1
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.41.0
-	golang.org/x/net v0.43.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.45.0
-	golang.org/x/term v0.34.0
-	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
+	golang.org/x/crypto v0.57.0
+	golang.org/x/net v0.59.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
+	golang.org/x/term v0.46.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a
-	google.golang.org/grpc v1.74.2
-	google.golang.org/protobuf v1.36.9
-	modernc.org/sqlite v1.36.3
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4
+	google.golang.org/grpc v1.81.0
+	google.golang.org/protobuf v1.36.12
+	modernc.org/sqlite v1.49.1
 	tags.cncf.io/container-device-interface v1.0.1
 )
 
 require (
-	cloud.google.com/go/kms v1.19.0 // indirect
-	cloud.google.com/go/longrunning v0.6.0 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/AlecAivazis/survey/v2 v2.3.7 // indirect
-	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e // indirect
-	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.13.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
-	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
-	github.com/aws/smithy-go v1.20.3 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.17 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/buger/goterm v1.0.4 // indirect
-	github.com/caddyserver/zerossl v0.1.3 // indirect
+	github.com/caddyserver/zerossl v0.1.5 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
-	github.com/cespare/xxhash v1.1.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260525132238-948f4557a654 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260703014108-f5a850f9c2b7 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
-	github.com/chzyer/readline v1.5.1 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/containerd/cgroups/v3 v3.0.5 // indirect
@@ -121,13 +113,9 @@ require (
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dgraph-io/badger v1.6.2 // indirect
-	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
-	github.com/dgraph-io/ristretto v0.1.1 // indirect
-	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/distribution/v3 v3.0.0 // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/docker/buildx v0.29.1 // indirect
 	github.com/docker/cli-docs-tool v0.10.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
@@ -141,84 +129,59 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsevents v0.2.0 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-kit/kit v0.13.0 // indirect
-	github.com/go-kit/log v0.2.1 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-sql-driver/mysql v1.8.1 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
-	github.com/golang/glog v1.2.5 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/btree v1.1.2 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru/arc/v2 v2.0.7 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
 	github.com/ishidawataru/sctp v0.0.0-20230406120618-7ff4192f6ff2 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.3 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
-	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.3 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
-	github.com/libdns/libdns v0.2.2 // indirect
+	github.com/libdns/libdns v1.1.1 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/manifoldco/promptui v0.9.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/mholt/acmez/v2 v2.0.3 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
-	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/miekg/pkcs11 v1.1.2 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
-	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/buildkit v0.25.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.1.0 // indirect
@@ -239,45 +202,36 @@ require (
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
 	github.com/opencontainers/selinux v1.12.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/quic-go/quic-go v0.48.2 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/otlptranslator v1.0.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.62.0 // indirect
 	github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
 	github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
 	github.com/redis/go-redis/v9 v9.7.3 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rs/xid v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
 	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
-	github.com/slackhq/nebula v1.6.1 // indirect
-	github.com/smallstep/certificates v0.26.1 // indirect
-	github.com/smallstep/nosql v0.6.1 // indirect
-	github.com/smallstep/pkcs7 v0.1.1 // indirect
-	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
-	github.com/smallstep/truststore v0.13.0 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
-	github.com/stoewer/go-strcase v1.2.0 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 // indirect
+	github.com/spf13/afero v1.14.0 // indirect
+	github.com/spf13/viper v1.12.0 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 // indirect
 	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
@@ -285,7 +239,6 @@ require (
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
-	github.com/urfave/cli v1.22.17 // indirect
 	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -293,70 +246,58 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zclconf/go-cty v1.17.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 // indirect
-	go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 // indirect
+	go.opentelemetry.io/contrib/exporters/autoexport v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.54.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.32.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 // indirect
-	go.opentelemetry.io/otel/log v0.8.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.8.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	go.step.sm/cli-utils v0.9.0 // indirect
-	go.step.sm/crypto v0.45.0 // indirect
-	go.step.sm/linkedca v0.20.1 // indirect
-	go.uber.org/automaxprocs v1.5.3 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/log v0.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.uber.org/mock v0.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
-	go.uber.org/zap/exp v0.2.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 // indirect
-	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
-	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	go.uber.org/zap v1.28.0 // indirect
+	go.uber.org/zap/exp v0.3.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
+	golang.org/x/tools v0.50.0 // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
-	howett.net/plist v1.0.0 // indirect
 	k8s.io/api v0.32.3 // indirect
 	k8s.io/apimachinery v0.32.3 // indirect
 	k8s.io/client-go v0.32.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
 	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	modernc.org/libc v1.61.13 // indirect
+	modernc.org/libc v1.72.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.8.2 // indirect
+	modernc.org/memory v1.11.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
-
-replace charm.land/bubbletea/v2 => github.com/unlabs-dev/bubbletea/v2 v2.0.8-uncloud.1

internal/cli/cli.go

@@ -458,7 +458,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (_ *clie
 	}
 
 	// Snapshot the cluster store version so the new machine can catch up before participating.
-	var storeVersion map[string]uint64
+	var storeVersion api.StoreVersion
 	inspectResp, err = c.MachineClient.InspectMachine(ctx, &emptypb.Empty{})
 	if err != nil {
 		// TODO(lhf): remove Unimplemented check when v0.17.0 is released.
@@ -603,7 +603,7 @@ func provisionOrConnectRemoteMachine(
 		if remoteMachine.User != rootUser {
 			// provisionMachine has just added the user to the uncloud group. Any SSH ControlMaster left over from
 			// a previous uc invocation (e.g. a failed uc command against the uninitialised machine) still holds
-			// the old user groups and would deny access to /run/uncloud/uncloud.sock. Close the current session
+			// the old user groups and would deny access to /run/uncloud/api/uncloud.sock. Close the current session
 			// if it exists so the next session picks up the new groups.
 			conn.CloseControlMaster(ctx)
 		}

internal/cli/config/connection.go

@@ -7,8 +7,6 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
-
-	"github.com/psviderski/uncloud/internal/secret"
 )
 
 type MachineConnection struct {
@@ -24,8 +22,6 @@ type MachineConnection struct {
 	TCP *netip.AddrPort `yaml:"tcp,omitempty"`
 	// Unix is the path to the machine's API unix socket.
 	Unix      string `yaml:"unix,omitempty"`
-	Host      string        `yaml:"host,omitempty"`
-	PublicKey secret.Secret `yaml:"public_key,omitempty"`
 	MachineID string `yaml:"machine_id,omitempty"`
 }
 

internal/cli/config/connection_test.go

@@ -70,9 +70,9 @@ func TestMachineConnection_String(t *testing.T) {
 		{
 			name: "unix connection",
 			conn: MachineConnection{
-				Unix: "/run/uncloud/uncloud.sock",
+				Unix: "/run/uncloud/api/uncloud.sock",
 			},
-			want: "unix:///run/uncloud/uncloud.sock",
+			want: "unix:///run/uncloud/api/uncloud.sock",
 		},
 		{
 			name: "no connection",

internal/cli/connect.go

@@ -45,7 +45,17 @@ func connectClusterWithProgress(ctx context.Context, conn config.MachineConnecti
 	}
 
 	// Run the connection TUI model. Render to stderr so stdout stays clean for command output.
-	p := tea.NewProgram(newConnectModel(ctx, conn), tea.WithOutput(os.Stderr))
+	p := tea.NewProgram(newConnectModel(ctx, conn),
+		tea.WithOutput(os.Stderr),
+		tea.WithInput(nil),
+		// Ctrl+C handling
+		tea.WithFilter(func(_ tea.Model, msg tea.Msg) tea.Msg {
+			if _, ok := msg.(tea.InterruptMsg); ok {
+				return connectResultMsg{err: errors.New("connection cancelled")}
+			}
+			return msg
+		}),
+	)
 	model, err := p.Run()
 	if err != nil {
 		return nil, fmt.Errorf("run connection TUI: %w", err)
@@ -190,13 +200,6 @@ func (m connectModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		var cmd tea.Cmd
 		m.spinner, cmd = m.spinner.Update(msg)
 		return m, cmd
-
-	case tea.KeyPressMsg:
-		if msg.String() == "ctrl+c" {
-			m.result.err = fmt.Errorf("connection cancelled")
-			m.done = true
-			return m, tea.Quit
-		}
 	}
 
 	return m, nil

internal/cli/logs/duration.go

@@ -0,0 +1,66 @@
+package logs
+
+import (
+	"fmt"
+	"math/big"
+	"strings"
+	"time"
+)
+
+// Duration is an extended standard time.Duration that also supports days as a unit.
+type Duration = time.Duration
+
+// ParseDuration parses a Go duration with the additional unit d, meaning exactly 24 hours.
+// Days can be fractional or combined with other units, such as "1.5d" or "2d3h".
+func ParseDuration(value string) (Duration, error) {
+	if !strings.Contains(value, "d") {
+		return time.ParseDuration(value)
+	}
+
+	rest := value
+	var normalised strings.Builder
+	if len(rest) > 0 && (rest[0] == '-' || rest[0] == '+') {
+		normalised.WriteByte(rest[0])
+		rest = rest[1:]
+	}
+	for len(rest) > 0 {
+		// Each component is a decimal number followed by a unit. Only the leading sign is allowed.
+		numberEnd := 0
+		for numberEnd < len(rest) && (isDigit(rest[numberEnd]) || rest[numberEnd] == '.') {
+			numberEnd++
+		}
+		unitEnd := numberEnd
+		for unitEnd < len(rest) && !isDigit(rest[unitEnd]) && rest[unitEnd] != '.' {
+			unitEnd++
+		}
+		if numberEnd == 0 || unitEnd == numberEnd {
+			return 0, fmt.Errorf("time: invalid duration '%s'", value)
+		}
+		number, unit := rest[:numberEnd], rest[numberEnd:unitEnd]
+		if unit == "d" {
+			// Use exact decimal arithmetic to avoid float rounding and retain nanosecond precision.
+			days, ok := new(big.Rat).SetString(number)
+			if !ok {
+				return 0, fmt.Errorf("time: invalid duration '%s'", value)
+			}
+			days.Mul(days, new(big.Rat).SetInt64(int64(24*time.Hour)))
+			nanoseconds := new(big.Int).Quo(days.Num(), days.Denom())
+			normalised.WriteString(nanoseconds.String())
+			normalised.WriteString("ns")
+		} else {
+			normalised.WriteString(rest[:unitEnd])
+		}
+		rest = rest[unitEnd:]
+	}
+
+	// The standard parser validates the remaining units and checks the total for overflow.
+	duration, err := time.ParseDuration(normalised.String())
+	if err != nil {
+		return 0, fmt.Errorf("time: invalid duration '%s': %w", value, err)
+	}
+	return duration, nil
+}
+
+func isDigit(c byte) bool {
+	return c >= '0' && c <= '9'
+}

internal/cli/logs/duration_test.go

@@ -0,0 +1,62 @@
+package logs
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseDuration(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range []struct {
+		input string
+		want  time.Duration
+	}{
+		{"0", 0},
+		{"2m30s", 150 * time.Second},
+		{"1µs", time.Microsecond},
+		{"1μs", time.Microsecond},
+		{"2d", 48 * time.Hour},
+		{"010d", 240 * time.Hour},
+		{"08d", 192 * time.Hour},
+		{"2d3h", 51 * time.Hour},
+		{"3h2d", 51 * time.Hour},
+		{"1d1d", 48 * time.Hour},
+		{"1.5d", 36 * time.Hour},
+		{".5d", 12 * time.Hour},
+		{"1.d", 24 * time.Hour},
+		{"-2d3h", -51 * time.Hour},
+		{"+2d", 48 * time.Hour},
+		{"0d", 0},
+		{"0d1ns", time.Nanosecond},
+		{"0.000000000001d", 86 * time.Nanosecond},
+		{"-0.000000000001d", -86 * time.Nanosecond},
+		{"106751d23h47m16.854775807s", time.Duration(math.MaxInt64)},
+		{"-106751d23h47m16.854775808s", time.Duration(math.MinInt64)},
+	} {
+		t.Run(tt.input, func(t *testing.T) {
+			actual, err := ParseDuration(tt.input)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, actual)
+		})
+	}
+}
+
+func TestParseDuration_Invalid(t *testing.T) {
+	t.Parallel()
+
+	for _, input := range []string{
+		"", "d", "2d3", "1..2d", ".d", "1d-2h", "1d+2h", "1d 2h", "1day", "2D", "1w",
+		"1e2d", "1d2w", "106752d", "-106752d", "106751d23h47m16.854775808s",
+		"-106751d23h47m16.854775809s", "999999999999999999999999999d",
+	} {
+		t.Run(input, func(t *testing.T) {
+			_, err := ParseDuration(input)
+			require.Error(t, err)
+		})
+	}
+}

internal/cli/logs/formatter.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"charm.land/lipgloss/v2"
+	"github.com/charmbracelet/colorprofile"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/psviderski/uncloud/internal/cli/tui"
 	"github.com/psviderski/uncloud/pkg/api"
@@ -24,6 +25,10 @@ type Formatter struct {
 	maxServiceWidth int
 
 	utc bool
+
+	// Cache each stream's terminal profile to avoid detection on every log entry.
+	stdout *colorprofile.Writer
+	stderr *colorprofile.Writer
 }
 
 func NewFormatter(machineNames, serviceNames []string, utc bool) *Formatter {
@@ -50,6 +55,8 @@ func NewFormatter(machineNames, serviceNames []string, utc bool) *Formatter {
 		maxMachineWidth: maxMachineWidth,
 		maxServiceWidth: maxServiceWidth,
 		utc:             utc,
+		stdout:          colorprofile.NewWriter(os.Stdout, os.Environ()),
+		stderr:          colorprofile.NewWriter(os.Stderr, os.Environ()),
 	}
 }
 
@@ -138,9 +145,9 @@ func (f *Formatter) PrintEntry(entry api.ServiceLogEntry) {
 
 	// Print to appropriate stream.
 	if entry.Stream == api.LogStreamStderr {
-		fmt.Fprint(os.Stderr, output.String())
+		fmt.Fprint(f.stderr, output.String())
 	} else {
-		fmt.Print(output.String())
+		fmt.Fprint(f.stdout, output.String())
 	}
 }
 
@@ -148,8 +155,7 @@ func (f *Formatter) PrintEntry(entry api.ServiceLogEntry) {
 func (f *Formatter) printError(entry api.ServiceLogEntry) {
 	if entry.Metadata.ServiceName == "" {
 		msg := fmt.Sprintf("ERROR: %v", entry.Err)
-		style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.BrightRed)
-		fmt.Fprintln(os.Stderr, style.Render(msg))
+		fmt.Fprintln(f.stderr, tui.BoldRed.Render(msg))
 		return
 	}
 
@@ -171,8 +177,7 @@ func (f *Formatter) printError(entry api.ServiceLogEntry) {
 		msg += fmt.Sprintf(": %v", entry.Err)
 	}
 
-	style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.BrightYellow)
-	fmt.Fprintln(os.Stderr, style.Render(msg))
+	fmt.Fprintln(f.stderr, tui.BoldYellow.Render(msg))
 }
 
 // palette is available colors for machine/service differentiation.

internal/cli/logs/logs.go

@@ -19,6 +19,18 @@ type Options struct {
 	Machines []string
 }
 
+// TailLines resolves the default tail limit after parsing flags. An empty opts.Tail means the user
+// did not specify a limit, so --since can select all matching logs without overriding an explicit --tail.
+func (opts Options) TailLines() (int, error) {
+	if opts.Tail == "" {
+		if opts.Since != "" {
+			return -1, nil
+		}
+		return 100, nil
+	}
+	return ParseTail(opts.Tail)
+}
+
 func Flags(options *Options) *pflag.FlagSet {
 	set := &pflag.FlagSet{}
 
@@ -29,14 +41,17 @@ func Flags(options *Options) *pflag.FlagSet {
 	set.StringVar(&options.Since, "since", "",
 		"Show logs generated on or after the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
 			"Examples:\n"+
-			"  --since 2m30s                      Relative duration (2 minutes 30 seconds ago)\n"+
-			"  --since 1h                         Relative duration (1 hour ago)\n"+
-			"  --since 2025-11-24                 RFC 3339 date only (midnight using local timezone)\n"+
-			"  --since 2024-05-14T22:50:00        RFC 3339 date/time using local timezone\n"+
+			"  --since 1h45m                      Relative duration (1 hour 45 minutes ago)\n"+
+			"                                     Supported units: d (day = 24h), h (hour), m (minute),\n"+
+			"                                                      s (second), ms (millisecond),\n"+
+			"                                                      us/µs (microsecond), ns (nanosecond)\n"+
+			"  --since 2025-11-24                 RFC 3339 date only (midnight using client local timezone)\n"+
+			"  --since 2024-05-14T22:50:00        RFC 3339 date/time using client local timezone\n"+
 			"  --since 2024-01-31T10:30:00Z       RFC 3339 date/time in UTC\n"+
 			"  --since 1763953966                 Unix timestamp (seconds since January 1, 1970)")
-	set.StringVarP(&options.Tail, "tail", "n", "100",
-		"Show the most recent logs and limit the number of lines shown per replica. Use 'all' to show all logs.")
+	set.StringVarP(&options.Tail, "tail", "n", "",
+		"Show the most recent logs and limit the number of lines shown per replica. Use 'all' to show all logs.\n"+
+			"Defaults to 100, or 'all' when --since is set.")
 	set.StringVar(&options.Until, "until", "",
 		"Show logs generated before the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
 			"See --since for examples.")
@@ -46,7 +61,7 @@ func Flags(options *Options) *pflag.FlagSet {
 	return set
 }
 
-func Tail(tail string) (int, error) {
+func ParseTail(tail string) (int, error) {
 	if tail == "all" {
 		return -1, nil
 	}

internal/cli/logs/logs_test.go

@@ -7,6 +7,42 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestOptionsTailLines(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		args []string
+		want int
+	}{
+		{"default", nil, 100},
+		{"follow", []string{"-f"}, 100},
+		{"since", []string{"--since", "1h"}, -1},
+		{"since and follow", []string{"--since", "1h", "-f"}, -1},
+		{"until only", []string{"--until", "1h"}, 100},
+		{"time range", []string{"--since", "3h", "--until", "1h"}, -1},
+		{"explicit default with since", []string{"--since", "1h", "--tail", "100"}, 100},
+		{"explicit limit with since", []string{"--since", "1h", "-n", "20"}, 20},
+		{"explicit limit before since", []string{"-n", "20", "--since", "1h"}, 20},
+		{"explicit all", []string{"--tail", "all"}, -1},
+		{"explicit zero with since", []string{"--since", "1h", "-n", "0", "-f"}, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var options Options
+			require.NoError(t, Flags(&options).Parse(tt.args))
+			tail, err := options.TailLines()
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, tail)
+		})
+	}
+
+	var options Options
+	require.NoError(t, Flags(&options).Parse([]string{"--since", "1h", "--tail", "invalid"}))
+	_, err := options.TailLines()
+	require.ErrorContains(t, err, "invalid --tail value")
+}
+
 func TestParseServiceArgs(t *testing.T) {
 	t.Parallel()
 

internal/cli/logs/time.go

@@ -0,0 +1,72 @@
+package logs
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// TimeRange resolves log filters that could be RFC 3339, timestamp, or relative duration to UTC timestamps.
+// Dates without a timezone use now's location. Relative durations are computed from now.
+func TimeRange(since, until string, now time.Time) (string, string, error) {
+	var err error
+	since, err = timestamp(since, now)
+	if err != nil {
+		return "", "", fmt.Errorf("invalid --since value: %w", err)
+	}
+	until, err = timestamp(until, now)
+	if err != nil {
+		return "", "", fmt.Errorf("invalid --until value: %w", err)
+	}
+
+	return since, until, nil
+}
+
+func timestamp(value string, now time.Time) (string, error) {
+	if value == "" {
+		return "", nil
+	}
+	// A bare zero is the Unix epoch, matching Docker's log filters.
+	if duration, err := ParseDuration(value); value != "0" && err == nil {
+		return now.Add(-duration).UTC().Format(time.RFC3339Nano), nil
+	}
+
+	// Keep Docker's supported date layouts, but use the location's offset at the requested date.
+	for _, layout := range []string{
+		time.RFC3339Nano,
+		"2006-01-02T15:04Z07:00",
+		"2006-01-02T15Z07:00",
+		"2006-01-02Z07:00",
+		"2006-01-02T15:04:05.999999999",
+		"2006-01-02T15:04",
+		"2006-01-02T15",
+		"2006-01-02",
+	} {
+		if t, err := time.ParseInLocation(layout, value, now.Location()); err == nil {
+			return t.UTC().Format(time.RFC3339Nano), nil
+		}
+	}
+
+	seconds, fraction, hasFraction := strings.Cut(value, ".")
+	sec, err := strconv.ParseInt(seconds, 10, 64)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse '%s' as a time or duration", value)
+	}
+
+	var nsec int64
+	if hasFraction {
+		if len(fraction) == 0 || len(fraction) > 9 || strings.ContainsAny(fraction, "+-") {
+			return "", fmt.Errorf("invalid Unix timestamp fraction in '%s'", value)
+		}
+		nsec, err = strconv.ParseInt(fraction+strings.Repeat("0", 9-len(fraction)), 10, 64)
+		if err != nil {
+			return "", fmt.Errorf("invalid Unix timestamp fraction in '%s': %w", value, err)
+		}
+	}
+	t := time.Unix(sec, nsec).UTC()
+	if t.Year() < 0 || t.Year() > 9999 {
+		return "", fmt.Errorf("Unix timestamp '%s' is outside the RFC 3339 date range", value)
+	}
+	return t.Format(time.RFC3339Nano), nil
+}

internal/cli/logs/time_test.go

@@ -0,0 +1,87 @@
+package logs
+
+import (
+	"testing"
+	"time"
+
+	timetypes "github.com/docker/docker/api/types/time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTimeRange(t *testing.T) {
+	t.Parallel()
+
+	location, err := time.LoadLocation("Australia/Sydney")
+	require.NoError(t, err)
+	// October is daylight-saving time, but July timestamps must use the winter offset.
+	// Daylight saving starts on 4 October. Day durations must still mean 24 elapsed hours.
+	now := time.Date(2026, 10, 5, 12, 0, 0, 123456789, location)
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"", ""},
+		{"2026-07-01", "2026-06-30T14:00:00Z"},
+		{"2026-07-01T10", "2026-07-01T00:00:00Z"},
+		{"2026-07-01T10:30", "2026-07-01T00:30:00Z"},
+		{"2026-07-01T10:30:45.123456789", "2026-07-01T00:30:45.123456789Z"},
+		{"2026-01-01T10:00:00", "2025-12-31T23:00:00Z"},
+		{"2026-07-01T10:30:45Z", "2026-07-01T10:30:45Z"},
+		{"2026-07-01T10:30:45+02:00", "2026-07-01T08:30:45Z"},
+		{"2026-07-01T10:30:45-04:00", "2026-07-01T14:30:45Z"},
+		{"2026-07-01T10+02:00", "2026-07-01T08:00:00Z"},
+		{"2026-07-01T10:30+02:00", "2026-07-01T08:30:00Z"},
+		{"2026-07-01+02:00", "2026-06-30T22:00:00Z"},
+		{"1763953966", "2025-11-24T03:12:46Z"},
+		{"1763953966.000000001", "2025-11-24T03:12:46.000000001Z"},
+		{"0", "1970-01-01T00:00:00Z"},
+		{"2m30s", "2026-10-05T00:57:30.123456789Z"},
+		{"1d", "2026-10-04T01:00:00.123456789Z"},
+		{"2d", "2026-10-03T01:00:00.123456789Z"},
+		{"2d3h", "2026-10-02T22:00:00.123456789Z"},
+		{"1.5d", "2026-10-03T13:00:00.123456789Z"},
+		{"-2d", "2026-10-07T01:00:00.123456789Z"},
+		{"-1h", "2026-10-05T02:00:00.123456789Z"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			since, until, err := TimeRange(tt.input, tt.input, now)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, since)
+			assert.Equal(t, tt.want, until)
+
+			if since != "" {
+				// The server-side Docker SDK must preserve the cutoff even in another timezone.
+				actual, err := timetypes.GetTimestamp(since, now.In(time.UTC))
+				require.NoError(t, err)
+				expected, err := time.Parse(time.RFC3339Nano, tt.want)
+				require.NoError(t, err)
+				sec, nsec, err := timetypes.ParseTimestamps(actual, 0)
+				require.NoError(t, err)
+				assert.True(t, expected.Equal(time.Unix(sec, nsec)))
+			}
+		})
+	}
+
+	since, until, err := TimeRange("3h", "1h30m", now)
+	require.NoError(t, err)
+	assert.Equal(t, "2026-10-04T22:00:00.123456789Z", since)
+	assert.Equal(t, "2026-10-04T23:30:00.123456789Z", until)
+}
+
+func TestTimeRange_Invalid(t *testing.T) {
+	t.Parallel()
+
+	for _, input := range []string{
+		"invalid", "2026-02-30", "2026-01-01T25:00:00", "1763953966.xyz",
+		"1763953966.1234567890", "253402300800",
+	} {
+		t.Run(input, func(t *testing.T) {
+			_, _, err := TimeRange(input, "", time.Now())
+			require.ErrorContains(t, err, "invalid --since value")
+			_, _, err = TimeRange("", input, time.Now())
+			require.ErrorContains(t, err, "invalid --until value")
+		})
+	}
+}

internal/cli/tui/print.go

@@ -3,9 +3,11 @@ package tui
 import (
 	"fmt"
 	"os"
+
+	"charm.land/lipgloss/v2"
 )
 
 func PrintWarning(msg string) {
 	styledMsg := BoldYellow.Render(fmt.Sprintf("WARNING: %s", msg))
-	fmt.Fprintln(os.Stderr, styledMsg)
+	lipgloss.Fprintln(os.Stderr, styledMsg)
 }

internal/cli/tui/spinner.go

@@ -31,6 +31,8 @@ func RunSpinner(ctx context.Context, title string, action func(ctx context.Conte
 			}
 		})).
 		WithOutput(os.Stderr).
+		// A spinner reads no keys, saying so makes Bubble Tea skip unnecessary terminal capability queries.
+		WithInput(nil).
 		Context(ctx).
 		ActionWithErr(action).
 		Run()

internal/corrosion/admin.go

@@ -13,6 +13,8 @@ import (
 	"time"
 )
 
+const adminCommandTimeout = 5 * time.Second
+
 // AdminClient is a client for the Corrosion admin API.
 type AdminClient struct {
 	sockPath string
@@ -32,10 +34,15 @@ type Response struct {
 // The channel will be closed after sending the last or error response. The caller must read from the channel until
 // it is closed.
 func (c *AdminClient) SendCommand(cmd []byte) (<-chan Response, error) {
-	conn, err := net.Dial("unix", c.sockPath)
+	// TODO: Accept contexts in admin methods so callers can cancel requests and set their deadlines.
+	conn, err := net.DialTimeout("unix", c.sockPath, adminCommandTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("connect to admin socket: %w", err)
 	}
+	if err = conn.SetDeadline(time.Now().Add(adminCommandTimeout)); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("set admin connection deadline: %w", err)
+	}
 
 	if _, err = conn.Write(encodeFrame(cmd)); err != nil {
 		conn.Close()

internal/daemon/daemon.go

@@ -2,24 +2,50 @@ package daemon
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 
+	"github.com/coreos/go-systemd/activation"
 	systemd "github.com/coreos/go-systemd/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
 )
 
+const systemdSocketUnit = "uncloud.socket"
+
 type Daemon struct {
 	machine *machine.Machine
 }
 
 func New(dataDir string) (*Daemon, error) {
+	listeners, err := activation.ListenersWithNames()
+	if err != nil {
+		return nil, fmt.Errorf("get systemd-activated sockets: %w", err)
+	}
+
+	listener, err := selectActivatedListener(listeners)
+	if err != nil {
+		return nil, err
+	}
+	if listener != nil {
+		slog.Info("Using systemd-activated API socket.", "addr", listener.Addr().String())
+	}
+
 	config := &machine.Config{
 		DataDir:            dataDir,
+		ClusterAPISockPath: machine.DefaultClusterAPISockPath,
+		ClusterAPIListener: listener,
 	}
 	mach, err := machine.NewMachine(config)
 	if err != nil {
-		return nil, fmt.Errorf("init machine: %w", err)
+		initErr := fmt.Errorf("init machine: %w", err)
+		if listener != nil {
+			if closeErr := listener.Close(); closeErr != nil {
+				initErr = errors.Join(initErr, fmt.Errorf("close systemd-activated socket: %w", closeErr))
+			}
+		}
+		return nil, initErr
 	}
 
 	return &Daemon{
@@ -27,6 +53,40 @@ func New(dataDir string) (*Daemon, error) {
 	}, nil
 }
 
+// selectActivatedListener returns the systemd activated listener. If systemd supplied multiple listeners,
+// it returns the one associated with systemdSocketUnit.
+func selectActivatedListener(listeners map[string][]net.Listener) (net.Listener, error) {
+	var activated []net.Listener
+	for _, named := range listeners {
+		activated = append(activated, named...)
+	}
+
+	if len(activated) == 0 {
+		return nil, nil
+	}
+	if len(activated) == 1 {
+		return activated[0], nil
+	}
+
+	named, ok := listeners[systemdSocketUnit]
+	if !ok || len(named) != 1 {
+		return nil, fmt.Errorf("expected one systemd-activated socket named '%s', received %d",
+			systemdSocketUnit, len(named))
+	}
+
+	// Close all other unused listeners.
+	for name, unused := range listeners {
+		if name == systemdSocketUnit {
+			continue
+		}
+		for _, l := range unused {
+			_ = l.Close()
+		}
+	}
+
+	return named[0], nil
+}
+
 func (d *Daemon) Run(ctx context.Context) error {
 	slog.Info("Starting machine.")
 

internal/daemon/daemon_test.go

@@ -0,0 +1,71 @@
+package daemon
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSelectActivatedListener(t *testing.T) {
+	t.Run("no activated listeners", func(t *testing.T) {
+		listener, err := selectActivatedListener(nil)
+		require.NoError(t, err)
+		assert.Nil(t, listener)
+	})
+
+	t.Run("only listener regardless of name", func(t *testing.T) {
+		activated := testListener(t)
+
+		listener, err := selectActivatedListener(map[string][]net.Listener{"another.socket": {activated}})
+		require.NoError(t, err)
+		assert.Same(t, activated, listener)
+	})
+
+	t.Run("named listener when multiple", func(t *testing.T) {
+		activated := testListener(t)
+		extra := testListener(t)
+
+		listener, err := selectActivatedListener(map[string][]net.Listener{
+			systemdSocketUnit: {activated},
+			"another.socket":  {extra},
+		})
+		require.NoError(t, err)
+		assert.Same(t, activated, listener)
+		assert.Error(t, extra.Close())
+	})
+
+	t.Run("multiple listeners without expected name", func(t *testing.T) {
+		first := testListener(t)
+		second := testListener(t)
+
+		listener, err := selectActivatedListener(map[string][]net.Listener{
+			"first.socket":  {first},
+			"second.socket": {second},
+		})
+		require.ErrorContains(t, err, "expected one systemd-activated socket")
+		assert.Nil(t, listener)
+	})
+
+	t.Run("multiple listeners under expected name", func(t *testing.T) {
+		first := testListener(t)
+		second := testListener(t)
+
+		listener, err := selectActivatedListener(map[string][]net.Listener{
+			systemdSocketUnit: {first, second},
+		})
+		require.ErrorContains(t, err, "expected one systemd-activated socket")
+		assert.Nil(t, listener)
+	})
+}
+
+func testListener(t *testing.T) net.Listener {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	return listener
+}

internal/journal/journal.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os/exec"
+	"time"
 
 	"github.com/psviderski/uncloud/pkg/api"
 )
@@ -31,11 +32,11 @@ func logs(ctx context.Context, unit string, opts api.ServiceLogsOptions) (io.Rea
 
 	if opts.Since != "" {
 		args = append(args, "-S")
-		args = append(args, opts.Since)
+		args = append(args, journalTimestamp(opts.Since))
 	}
 	if opts.Until != "" {
 		args = append(args, "-U")
-		args = append(args, opts.Until)
+		args = append(args, journalTimestamp(opts.Until))
 	}
 
 	cmd := commandContext(ctx, journalctl, args...)
@@ -51,6 +52,18 @@ func logs(ctx context.Context, unit string, opts api.ServiceLogsOptions) (io.Rea
 	return p, cmd.Wait, nil
 }
 
+// journalTimestamp formats normalised client timestamps for journalctl versions that do not
+// accept RFC 3339 timezone suffixes. Support for timestamps containing T and Z was added in
+// systemd 255 (6 December 2023). Debian 12 ships systemd 252, so it still needs this conversion.
+// Journald timestamps have microsecond precision.
+func journalTimestamp(value string) string {
+	if t, err := time.Parse(time.RFC3339Nano, value); err == nil {
+		return t.UTC().Format("2006-01-02 15:04:05.999999") + " UTC"
+	}
+	// Preserve raw filters from older clients and SDK callers.
+	return value
+}
+
 // follow synchronously follows the io.Reader, writing each new journal entry to channel.
 // It stops when the reader is exhausted or the context is cancelled.
 func follow(ctx context.Context, reader io.Reader, outCh chan api.LogEntry) {

internal/journal/logs_test.go

@@ -115,6 +115,9 @@ func TestEntry(t *testing.T) {
 }
 
 func TestLogs(t *testing.T) {
+	originalCommandContext := commandContext
+	t.Cleanup(func() { commandContext = originalCommandContext })
+
 	commandContext = func(ctx context.Context, _ string, _ ...string) *exec.Cmd {
 		return exec.CommandContext(ctx, "/usr/bin/tail", "testdata/logs")
 	}
@@ -150,3 +153,38 @@ func TestLogs(t *testing.T) {
 	// Still six because heartbeats are not written here and Tail is ignored as the command is overridden.
 	assert.Equal(t, 6, i)
 }
+
+func TestLogs_TimeFilters(t *testing.T) {
+	originalCommandContext := commandContext
+	t.Cleanup(func() { commandContext = originalCommandContext })
+
+	var args []string
+	commandContext = func(ctx context.Context, command string, commandArgs ...string) *exec.Cmd {
+		assert.Equal(t, "journalctl", command)
+		args = commandArgs
+		return exec.CommandContext(ctx, "/usr/bin/tail", "testdata/logs")
+	}
+
+	ch, err := Logs(context.Background(), "uncloud", api.ServiceLogsOptions{
+		Since: "2026-07-01T10:30:45.123456789+10:00",
+		Until: "2026-07-01T01:30:45Z",
+	})
+	require.NoError(t, err)
+	for range ch {
+	}
+	assert.Equal(t, []string{
+		"-u", "uncloud", "--no-hostname", "-n", "0", "-o", "short-unix",
+		"-S", "2026-07-01 00:30:45.123456 UTC",
+		"-U", "2026-07-01 01:30:45 UTC",
+	}, args)
+
+	// Older clients and SDK callers can still pass journalctl's native filters.
+	ch, err = Logs(context.Background(), "uncloud", api.ServiceLogsOptions{Since: "1h ago", Until: "today"})
+	require.NoError(t, err)
+	for range ch {
+	}
+	assert.Equal(t, []string{
+		"-u", "uncloud", "--no-hostname", "-n", "0", "-o", "short-unix",
+		"-S", "1h ago", "-U", "today",
+	}, args)
+}

internal/machine/caddyconfig/caddyfile.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"cmp"
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"maps"
@@ -57,14 +58,12 @@ https://{{$hostname}} {
 	log
 }{{end}}
 `
-	caddyfileUnavailabeFooter = `# NOTE: User-defined configs for services were skipped because Caddy is not running on this machine
-#       (not accessible via the shared admin socket /run/uncloud/caddy/admin.sock) or the latest
-#       generated config is invalid. Please check the service 'caddy' is running (uc inspect caddy)
-#       and its logs for more details (uc logs caddy).
-`
+	bootstrapMarker       = "# Uncloud bootstrap for Caddy container "
+	legacyBootstrapMarker = "# NOTE: User-defined configs for services were skipped because Caddy is not running"
 )
 
 // CaddyfileGenerator generates a Caddyfile configuration for the Caddy reverse proxy.
+// It combines generated routes from published ports with user-defined Caddyfile snippets from service specs (x-caddy).
 type CaddyfileGenerator struct {
 	// machineID is the unique identifier of the machine where the controller is running.
 	machineID string
@@ -74,11 +73,18 @@ type CaddyfileGenerator struct {
 	log         *slog.Logger
 }
 
-// CaddyfileValidator is an interface for validating Caddyfile configurations.
+// CaddyfileValidator checks a candidate Caddyfile without loading it. Validate returns InvalidCaddyfileError only
+// when the candidate is known to be invalid. Other errors mean the check could not be completed. A successful check
+// does not guarantee that the configuration will load.
 type CaddyfileValidator interface {
 	Validate(ctx context.Context, caddyfile string) error
 }
 
+// InvalidCaddyfileError means validation completed and the candidate Caddyfile was rejected.
+type InvalidCaddyfileError struct{ Message string }
+
+func (e *InvalidCaddyfileError) Error() string { return e.Message }
+
 func NewCaddyfileGenerator(
 	machineID, machineName string, validator CaddyfileValidator, log *slog.Logger,
 ) *CaddyfileGenerator {
@@ -93,35 +99,41 @@ func NewCaddyfileGenerator(
 	}
 }
 
-// Generate creates a Caddyfile configuration based on the provided service containers.
-// The Caddyfile is generated from the service ports of the healthy containers.
-// If a 'caddy' service container is running on this machine and defines a custom Caddy config (x-caddy) in its service
-// spec, it will be validated and prepended to the generated Caddyfile. Custom Caddy configs (x-caddy) defined in other
-// service specs are validated and appended to the generated Caddyfile. Invalid configs are logged and skipped to ensure
-// the generated Caddyfile remains valid.
+// Generate creates a Caddyfile for the local Caddy container from the supplied healthy application containers.
+// Application service ports provide the generated sites. The Caddy container's custom Caddy config (x-caddy), if
+// defined, provides the global block even when that container is unhealthy. When application custom Caddy configs
+// are included, the newest container for each service provides its config.
 //
-// The final Caddyfile structure includes:
+// The resulting Caddyfile has this structure:
 //
-//	[caddy x-caddy (global config)]
-//	[generated Caddyfile from all service ports]
-//	[service-a x-caddy]
+//	[caddy custom Caddy config (global)]
+//	[generated sites from application service ports]
+//	[service-a custom Caddy config]
 //	...
-//	[service-z x-caddy]
+//	[service-z custom Caddy config]
 //
-// If includeCustom is false, custom Caddy configs (x-caddy) are not included in the generated Caddyfile.
+// Bootstrap mode keeps the global custom Caddy config and generated sites, but omits application custom Caddy configs.
+// It skips validation because Caddy may not be running yet. In this case, Caddy validates the config when it starts.
+// Global template errors still stop generation. In full mode, invalid globals stop generation, while invalid
+// application custom Caddy configs are logged and skipped.
 func (g *CaddyfileGenerator) Generate(
-	ctx context.Context, records []store.ContainerRecord, includeCustom bool,
+	ctx context.Context,
+	caddyCtr api.ServiceContainer,
+	records []store.ContainerRecord,
+	bootstrap bool,
 ) (string, error) {
+	records = slices.Clone(records)
 	// Sort records by local machine first, then by service name and creation time. Placing containers on the local
 	// machine first lets user-defined Caddy configs pair this ordering with the "first" lb_policy to always send
 	// traffic to the same-host replica (skipping the cross-machine hop) and only fall back to remote upstreams when
 	// the local one is unhealthy.
-	// The service name and creation time tiebreakers keep the generated Caddyfile stable across regenerations.
+	// The service name, creation time, and container ID tiebreakers keep the file stable across regenerations.
 	slices.SortStableFunc(records, func(a, b store.ContainerRecord) int {
 		return cmp.Or(
 			g.localMachineRank(a.MachineID)-g.localMachineRank(b.MachineID),
 			strings.Compare(a.Container.ServiceName(), b.Container.ServiceName()),
 			a.Container.CreatedTime().Compare(b.Container.CreatedTime()),
+			strings.Compare(a.Container.ID, b.Container.ID),
 		)
 	})
 
@@ -136,26 +148,11 @@ func (g *CaddyfileGenerator) Generate(
 	}
 
 	caddyfileHeader := fmt.Sprintf(caddyfileHeaderFmt, g.machineName, time.Now().UTC().Format(time.RFC3339))
-	if !includeCustom {
-		return fmt.Sprintf("%s\n%s\n%s", caddyfileHeader, caddyfile, caddyfileUnavailabeFooter), nil
-	}
-
 	upstreams := serviceUpstreams(containers)
 	// Track validation errors for reporting.
 	var configErrors []string
 
-	// Find the 'caddy' service container on this machine. Use the most recent one if multiple exist.
-	var caddyCtr *api.ServiceContainer
-	for _, cr := range records {
-		if cr.MachineID == g.machineID && cr.Container.ServiceName() == CaddyServiceName &&
-			(caddyCtr == nil || cr.Container.CreatedTime().Compare(caddyCtr.CreatedTime()) > 0) {
-			caddyCtr = &cr.Container
-		}
-	}
-
-	// If the caddy container is running on this machine and has a custom Caddy config (global),
-	// prepend it to the generated Caddyfile and validate it.
-	if caddyCtr != nil && caddyCtr.ServiceSpec.CaddyConfig() != "" {
+	if caddyCtr.ServiceSpec.CaddyConfig() != "" {
 		// Render the custom global Caddy config as a Go template with the upstreams.
 		tmplCtx := templateContext{
 			Name:      caddyCtr.ServiceName(),
@@ -163,23 +160,23 @@ func (g *CaddyfileGenerator) Generate(
 		}
 		renderedConfig, err := renderCaddyfile(tmplCtx, caddyCtr.ServiceSpec.CaddyConfig())
 		if err != nil {
-			g.log.Error("Failed to render template directives in user-defined global Caddy config, skipping it.",
-				"service", caddyCtr.ServiceName(), "container", caddyCtr.ID, "err", err)
-			configErrors = append(configErrors,
-				fmt.Sprintf("service '%s': failed to render template: %v", caddyCtr.ServiceName(), err))
-		} else {
+			return "", fmt.Errorf(
+				"render template directives in user-defined global Caddy config from Caddy container %s: %w",
+				caddyCtr.ShortID(), err)
+		}
 		caddyfileCandidate := fmt.Sprintf("# User-defined global config from service '%s'.\n%s\n\n%s",
 			caddyCtr.ServiceName(), renderedConfig, caddyfile)
-
+		if !bootstrap && g.validator != nil {
 			if err = g.validator.Validate(ctx, caddyfileCandidate); err != nil {
-				g.log.Error("User-defined global Caddy config is invalid, skipping it.",
-					"service", caddyCtr.ServiceName(), "container", caddyCtr.ID, "err", err)
-				configErrors = append(configErrors,
-					fmt.Sprintf("service '%s': validation failed: %v", caddyCtr.ServiceName(), err))
-			} else {
+				return "", fmt.Errorf("validate user-defined global Caddy config from Caddy container %s: %w",
+					caddyCtr.ShortID(), err)
+			}
+		}
 		caddyfile = caddyfileCandidate
 	}
-		}
+
+	if bootstrap {
+		return caddyfileHeader + bootstrapMarker + caddyCtr.ID + "\n\n" + caddyfile, nil
 	}
 
 	// There could be multiple service containers for the same service with different custom Caddy configs, for example,
@@ -200,7 +197,7 @@ func (g *CaddyfileGenerator) Generate(
 	// Append a custom Caddy config for each service to the Caddyfile and validate it. If the config for a service
 	// is invalid, skip it but continue processing other services to ensure the Caddyfile remains valid.
 	for _, serviceName := range sortedServiceNames {
-		// Skip the caddy container as we already processed it.
+		// Skip the caddy container as we already processed it as the global config.
 		if serviceName == CaddyServiceName {
 			continue
 		}
@@ -226,16 +223,22 @@ func (g *CaddyfileGenerator) Generate(
 
 		caddyfileCandidate := fmt.Sprintf("%s\n# User-defined config for service '%s'.\n%s\n",
 			caddyfile, serviceName, renderedConfig)
+		if g.validator != nil {
 			if err = g.validator.Validate(ctx, caddyfileCandidate); err != nil {
+				if _, ok := errors.AsType[*InvalidCaddyfileError](err); !ok {
+					return "", fmt.Errorf("validate Caddy config for service '%s': %w", serviceName, err)
+				}
 				g.log.Error("User-defined Caddy config for service is invalid, skipping it.",
 					"service", serviceName, "err", err)
-			configErrors = append(configErrors, fmt.Sprintf("service '%s': validation failed: %v", serviceName, err))
-		} else {
+				configErrors = append(configErrors,
+					fmt.Sprintf("service '%s': validation failed: %v", serviceName, err))
+				continue
+			}
+		}
 		caddyfile = caddyfileCandidate
 	}
-	}
 
-	// Append error summary as comment if there were any invalid configs.
+	// Keep skipped-snippet errors in the saved file so an operator can see why routes are missing after a restart.
 	if len(configErrors) > 0 {
 		var errorsComment strings.Builder
 		errorsComment.WriteString("# Skipped invalid user-defined configs:\n")
@@ -249,8 +252,7 @@ func (g *CaddyfileGenerator) Generate(
 	return caddyfileHeader + "\n" + caddyfile, nil
 }
 
-// localMachineRank returns 0 if the given machineID matches the local machine and 1 otherwise.
-// Useful for sorting containers running locally first.
+// localMachineRank is a sorting function for containers that puts running on the local machine first.
 func (g *CaddyfileGenerator) localMachineRank(machineID string) int {
 	if g.machineID == machineID {
 		return 0

internal/machine/caddyconfig/caddyfile_test.go

@@ -208,10 +208,11 @@ http://app.example.com {
 	ctx := context.Background()
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Validator is not expected to be called in these tests.
-			generator := NewCaddyfileGenerator("test-machine-id", "test-machine", nil, nil)
+			validator := NewMockCaddyfileValidator(t)
+			generator := NewCaddyfileGenerator("test-machine-id", "test-machine", validator, nil)
 
-			config, err := generator.Generate(ctx, tt.containers, true)
+			caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.1", "", "", time.Now()).Container
+			config, err := generator.Generate(ctx, caddyCtr, tt.containers, false)
 
 			if tt.wantErr {
 				assert.Error(t, err)
@@ -332,7 +333,7 @@ bad.template.com {
 `,
 		},
 		{
-			name: "caddy service with invalid global config is skipped",
+			name: "caddy service with invalid global config aborts",
 			containers: []store.ContainerRecord{
 				newContainerRecordWithCaddyConfig(
 					"caddy",
@@ -345,10 +346,7 @@ localhost {
 					time.Now(),
 				),
 			},
-			want: testCaddyfileHeader + `
-# Skipped invalid user-defined configs:
-# - service 'caddy': validation failed: invalid config detected
-`,
+			wantErr: true,
 		},
 		{
 			name: "caddy service on different machine is ignored",
@@ -786,7 +784,7 @@ web-v2.example.com {
 `,
 		},
 		{
-			name: "multiple errors: invalid global, template error, and validation error",
+			name: "invalid global aborts before application configs",
 			containers: []store.ContainerRecord{
 				newContainerRecordWithCaddyConfig(
 					"caddy",
@@ -827,17 +825,7 @@ invalid.example.com {
 					time.Now(),
 				),
 			},
-			want: testCaddyfileHeader + `
-# User-defined config for service 'valid'.
-valid.example.com {
-	respond "Valid config"
-}
-
-# Skipped invalid user-defined configs:
-# - service 'caddy': validation failed: invalid config detected
-# - service 'broken-template': failed to render template: parse config as Go template: template: Caddyfile:2: unterminated quoted string
-# - service 'invalid': validation failed: invalid config detected
-`,
+			wantErr: true,
 		},
 	}
 
@@ -846,7 +834,7 @@ valid.example.com {
 	validator.EXPECT().Validate(mock.Anything, mock.Anything).RunAndReturn(
 		func(ctx context.Context, caddyfile string) error {
 			if strings.Contains(caddyfile, "# test:invalid") {
-				return errors.New("invalid config detected")
+				return &InvalidCaddyfileError{Message: "invalid config detected"}
 			}
 			return nil
 		})
@@ -855,7 +843,8 @@ valid.example.com {
 		t.Run(tt.name, func(t *testing.T) {
 			generator := NewCaddyfileGenerator("test-machine-id", "test-machine", validator, nil)
 
-			config, err := generator.Generate(ctx, tt.containers, true)
+			caddyCtr := caddyContainerFromTestContainers(tt.containers)
+			config, err := generator.Generate(ctx, caddyCtr, tt.containers, false)
 
 			if tt.wantErr {
 				assert.Error(t, err)
@@ -868,6 +857,167 @@ valid.example.com {
 	}
 }
 
+func TestCaddyfileGeneratorBootstrap(t *testing.T) {
+	// Bootstrap keeps the local Caddy container's globals and generated routes, but omits application custom configs.
+	tests := []struct {
+		name       string
+		containers []store.ContainerRecord
+		want       string
+	}{
+		{
+			name: "global config retained and application custom configs skipped",
+			containers: []store.ContainerRecord{
+				newContainerRecordWithCaddyConfig(
+					"caddy",
+					"10.210.0.1",
+					`# Global config
+{
+	global directive
+}`,
+					"test-machine-id",
+					time.Now(),
+				),
+				newContainerRecordWithCaddyConfig(
+					"web",
+					"10.210.0.2",
+					`web.example.com {
+	reverse_proxy web:3000
+}`,
+					"test-machine-id",
+					time.Now(),
+				),
+				newContainerRecordWithPorts(
+					"api",
+					"10.210.0.3",
+					[]string{"api.example.com:8080/http"},
+					"test-machine-id",
+				),
+			},
+			want: strings.Replace(testCaddyfileHeader, "\n\n# Health check endpoint", `
+# Uncloud bootstrap for Caddy container caddy-10.210.0.1
+
+# User-defined global config from service 'caddy'.
+# Global config
+{
+	global directive
+}
+
+# Health check endpoint`, 1) + `
+# Sites generated from service ports.
+
+http://api.example.com {
+	reverse_proxy 10.210.0.3:8080 {
+		import common_proxy
+	}
+	log
+}
+`,
+		},
+		{
+			name: "no containers with x-caddy configs",
+			containers: []store.ContainerRecord{
+				newContainerRecordWithPorts(
+					"api",
+					"10.210.0.3",
+					[]string{"api.example.com:8080/http"},
+					"test-machine-id",
+				),
+			},
+			want: strings.Replace(testCaddyfileHeader, "\n\n# Health check endpoint", `
+# Uncloud bootstrap for Caddy container caddy-10.210.0.1
+
+# Health check endpoint`, 1) + `
+# Sites generated from service ports.
+
+http://api.example.com {
+	reverse_proxy 10.210.0.3:8080 {
+		import common_proxy
+	}
+	log
+}
+`,
+		},
+	}
+
+	ctx := context.Background()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			validator := NewMockCaddyfileValidator(t)
+			generator := NewCaddyfileGenerator("test-machine-id", "test-machine", validator, nil)
+
+			caddyContainer := caddyContainerFromTestContainers(tt.containers)
+			config, err := generator.Generate(ctx, caddyContainer, tt.containers, true)
+			require.NoError(t, err)
+
+			assert.Equal(t, tt.want, normaliseGeneratedTimestamp(config), "Generated Caddyfile doesn't match")
+		})
+	}
+}
+
+func TestCaddyfileGenerator_ValidatorTransportErrorAbortsGeneration(t *testing.T) {
+	validator := NewMockCaddyfileValidator(t)
+	validator.EXPECT().Validate(mock.Anything, mock.Anything).Return(errors.New("socket disappeared"))
+
+	generator := NewCaddyfileGenerator("test-machine-id", "test-machine", validator, nil)
+	app := newContainerRecordWithCaddyConfig(
+		"web",
+		"10.210.0.2",
+		"web.example.com { respond ok }",
+		"test-machine-id",
+		time.Now(),
+	)
+
+	_, err := generator.Generate(context.Background(), caddyContainerFromTestContainers(nil),
+		[]store.ContainerRecord{app}, false)
+	require.ErrorContains(t, err, "socket disappeared")
+}
+
+func newContainer(ip string, ports ...string) api.ServiceContainer {
+	portsLabel := strings.Join(ports, ",")
+	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
+		ContainerJSONBase: &container.ContainerJSONBase{
+			State: &container.State{
+				Running: true,
+			},
+		},
+		NetworkSettings: &container.NetworkSettings{
+			Networks: map[string]*network.EndpointSettings{
+				docker.NetworkName: {
+					IPAddress: ip,
+				},
+			},
+		},
+		Config: &container.Config{
+			Labels: map[string]string{
+				api.LabelServicePorts: portsLabel,
+			},
+		},
+	}}}
+}
+
+func newContainerWithoutNetwork(ports ...string) api.ServiceContainer {
+	portsLabel := strings.Join(ports, ",")
+	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
+		ContainerJSONBase: &container.ContainerJSONBase{
+			State: &container.State{
+				Running: true,
+			},
+		},
+		NetworkSettings: &container.NetworkSettings{
+			Networks: map[string]*network.EndpointSettings{
+				"other-network": {
+					IPAddress: "172.17.0.2",
+				},
+			},
+		},
+		Config: &container.Config{
+			Labels: map[string]string{
+				api.LabelServicePorts: portsLabel,
+			},
+		},
+	}}}
+}
+
 func newContainerRecord(ctr api.ServiceContainer, machineID string) store.ContainerRecord {
 	return store.ContainerRecord{
 		Container: ctr,
@@ -911,100 +1061,6 @@ func newContainerRecordWithCaddyConfig(serviceName, ip, caddyConfig, machineID s
 	}
 }
 
-func TestCaddyfileGeneratorWithoutCustomConfigs(t *testing.T) {
-	// Test that when includeCustom is false (Caddy not available), x-caddy configs are skipped.
-	tests := []struct {
-		name       string
-		containers []store.ContainerRecord
-		want       string
-	}{
-		{
-			name: "x-caddy configs are skipped",
-			containers: []store.ContainerRecord{
-				newContainerRecordWithCaddyConfig(
-					"caddy",
-					"10.210.0.1",
-					`# Global config
-{
-	global directive
-}`,
-					"test-machine-id",
-					time.Now(),
-				),
-				newContainerRecordWithCaddyConfig(
-					"web",
-					"10.210.0.2",
-					`web.example.com {
-	reverse_proxy web:3000
-}`,
-					"test-machine-id",
-					time.Now(),
-				),
-				newContainerRecordWithPorts(
-					"api",
-					"10.210.0.3",
-					[]string{"api.example.com:8080/http"},
-					"test-machine-id",
-				),
-			},
-			want: testCaddyfileHeader + `
-# Sites generated from service ports.
-
-http://api.example.com {
-	reverse_proxy 10.210.0.3:8080 {
-		import common_proxy
-	}
-	log
-}
-
-# NOTE: User-defined configs for services were skipped because Caddy is not running on this machine
-#       (not accessible via the shared admin socket /run/uncloud/caddy/admin.sock) or the latest
-#       generated config is invalid. Please check the service 'caddy' is running (uc inspect caddy)
-#       and its logs for more details (uc logs caddy).
-`,
-		},
-		{
-			name: "no containers with x-caddy configs",
-			containers: []store.ContainerRecord{
-				newContainerRecordWithPorts(
-					"api",
-					"10.210.0.3",
-					[]string{"api.example.com:8080/http"},
-					"test-machine-id",
-				),
-			},
-			want: testCaddyfileHeader + `
-# Sites generated from service ports.
-
-http://api.example.com {
-	reverse_proxy 10.210.0.3:8080 {
-		import common_proxy
-	}
-	log
-}
-
-# NOTE: User-defined configs for services were skipped because Caddy is not running on this machine
-#       (not accessible via the shared admin socket /run/uncloud/caddy/admin.sock) or the latest
-#       generated config is invalid. Please check the service 'caddy' is running (uc inspect caddy)
-#       and its logs for more details (uc logs caddy).
-`,
-		},
-	}
-
-	ctx := context.Background()
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Validator is not expected to be called in these tests.
-			generator := NewCaddyfileGenerator("test-machine-id", "test-machine", nil, nil)
-
-			config, err := generator.Generate(ctx, tt.containers, false)
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.want, normaliseGeneratedTimestamp(config), "Generated Caddyfile doesn't match")
-		})
-	}
-}
-
 func newContainerRecordWithPorts(serviceName, ip string, ports []string, machineID string) store.ContainerRecord {
 	portsLabel := strings.Join(ports, ",")
 	return store.ContainerRecord{
@@ -1037,3 +1093,18 @@ func newContainerRecordWithPorts(serviceName, ip string, ports []string, machine
 		MachineID: machineID,
 	}
 }
+
+// caddyContainerFromTestContainers returns the local Caddy container from the provided test containers,
+// or creates a default one if not found.
+func caddyContainerFromTestContainers(records []store.ContainerRecord) api.ServiceContainer {
+	if caddyCtr := selectLocalCaddyContainer(records, "test-machine-id"); caddyCtr != nil {
+		return *caddyCtr
+	}
+	return newContainerRecordWithCaddyConfig(
+		"caddy",
+		"10.210.0.1",
+		"",
+		"test-machine-id",
+		time.Now(),
+	).Container
+}

internal/machine/caddyconfig/client.go

@@ -3,7 +3,6 @@ package caddyconfig
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -26,15 +25,15 @@ func NewCaddyAdminClient(socketPath string) *CaddyAdminClient {
 		client: &http.Client{
 			Timeout: 5 * time.Second,
 			Transport: &http.Transport{
-				DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
-					return net.Dial("unix", socketPath)
+				DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+					return (&net.Dialer{}).DialContext(ctx, "unix", socketPath)
 				},
 			},
 		},
 	}
 }
 
-// IsAvailable checks if the local Caddy instance is listening on the admin socket.
+// IsAvailable checks whether a Caddy process accepts connections at the admin socket.
 func (c *CaddyAdminClient) IsAvailable() bool {
 	conn, err := net.DialTimeout("unix", c.socketPath, 1*time.Second)
 	// A stale socket file left over from a crashed Caddy container returns ECONNREFUSED so this is correctly handled
@@ -80,15 +79,16 @@ func (c *CaddyAdminClient) Adapt(ctx context.Context, caddyfile string) (string,
 	// If the response is a 400 Bad Request, try to parse the error message from it.
 	if resp.StatusCode == http.StatusBadRequest {
 		var apiError caddy.APIError
-		if err = json.Unmarshal(body, &apiError); err == nil {
-			return "", errors.New(apiError.Message)
+		if err = json.Unmarshal(body, &apiError); err == nil && apiError.Message != "" {
+			return "", &InvalidCaddyfileError{Message: apiError.Message}
 		}
+		return "", &InvalidCaddyfileError{Message: string(body)}
 	}
 
-	return "", errors.New(string(body))
+	return "", fmt.Errorf("adapt request failed: HTTP %d: %s", resp.StatusCode, string(body))
 }
 
-// Load loads a Caddyfile configuration into the Caddy instance running on the machine.
+// Load loads a Caddyfile configuration into the Caddy instance.
 // Due to a Caddy bug (https://github.com/caddyserver/caddy/issues/7246), we first adapt the Caddyfile to JSON
 // and then load the JSON config to get proper error handling.
 func (c *CaddyAdminClient) Load(ctx context.Context, caddyfile string) error {
@@ -96,7 +96,11 @@ func (c *CaddyAdminClient) Load(ctx context.Context, caddyfile string) error {
 	if err != nil {
 		return fmt.Errorf("adapt Caddyfile to JSON config: %w", err)
 	}
+	return c.LoadJSON(ctx, jsonConfig)
+}
 
+// LoadJSON loads a JSON configuration into the Caddy instance.
+func (c *CaddyAdminClient) LoadJSON(ctx context.Context, jsonConfig string) error {
 	req, err := http.NewRequestWithContext(ctx, "POST", "http://localhost/load", strings.NewReader(jsonConfig))
 	if err != nil {
 		return fmt.Errorf("create load request: %w", err)

internal/machine/caddyconfig/client_test.go

@@ -0,0 +1,54 @@
+package caddyconfig
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func testAdminServer(t *testing.T, handler http.HandlerFunc) string {
+	t.Helper()
+	// macOS limits Unix socket paths to 104 bytes. t.TempDir can exceed that.
+	dir, err := os.MkdirTemp("/tmp", "uc-caddy-")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = os.RemoveAll(dir)
+	})
+
+	socketPath := filepath.Join(dir, "admin.sock")
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+	server := httptest.NewUnstartedServer(handler)
+	_ = server.Listener.Close()
+	server.Listener = listener
+	server.Start()
+	t.Cleanup(server.Close)
+
+	return socketPath
+}
+
+func TestCaddyAdminClient_Validate(t *testing.T) {
+	var status atomic.Int64
+	status.Store(http.StatusBadRequest)
+	socket := testAdminServer(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(int(status.Load()))
+		_, _ = w.Write([]byte(`{"message":"invalid config"}`))
+	})
+	client := NewCaddyAdminClient(socket)
+	err := client.Validate(context.Background(), "invalid")
+	var invalid *InvalidCaddyfileError
+	assert.ErrorAs(t, err, &invalid)
+
+	status.Store(http.StatusInternalServerError)
+	err = client.Validate(context.Background(), "invalid")
+	assert.Error(t, err)
+	assert.NotErrorAs(t, err, &invalid)
+}

internal/machine/caddyconfig/controller.go

@@ -2,7 +2,7 @@ package caddyconfig
 
 import (
 	"context"
-	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net/netip"
@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"time"
 
 	"github.com/psviderski/uncloud/internal/fs"
 	"github.com/psviderski/uncloud/internal/machine/store"
@@ -20,27 +21,40 @@ const (
 	CaddyServiceName = "caddy"
 	CaddyGroup       = "uncloud"
 	VerifyPath       = "/.uncloud-verify"
+	// periodicReconciliationInterval is the interval at which the controller reconciles the Caddyfile
+	// even if no container changes are observed.
+	periodicReconciliationInterval = 30 * time.Second
 )
 
-// Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
-// proxy. The generated configuration allows Caddy to route external traffic to service containers across the internal
-// network.
+// Controller keeps the local Caddy reverse proxy in sync with container state from the cluster store. It writes a
+// Caddyfile that routes external traffic to healthy service containers across the internal network.
+//
+// Current Caddy deployments share one Caddyfile and one admin socket per machine. The controller must preserve a
+// saved full Caddyfile when Caddy is unavailable because that file may be needed to restart or roll back a container.
+// It writes a reduced bootstrap config only when no full file exists, including when an older offline file must be
+// replaced. The shared layout cannot give overlapping Caddy revisions separate configurations.
 type Controller struct {
 	machineID     string
 	caddyfilePath string
+	service       *Service
 	generator     *CaddyfileGenerator
 	client        *CaddyAdminClient
 	store         *store.Store
 	log           *slog.Logger
-	// lastFingerprint caches the fingerprint of the containers used to generate the latest successfully loaded
-	// Caddyfile. nil means it hasn't been loaded yet or the last load failed.
+	// Tests use their own group so they can exercise real file publication without the daemon's uncloud group.
+	fileGroup string
+	// lastFingerprint records the healthy application-container inputs used for the last full Caddyfile that was
+	// successfully loaded into Caddy and saved to disk. It excludes the Caddy container, whose identity, start time,
+	// and global config are tracked separately below.
 	lastFingerprint []containerFingerprint
-	// lastCaddyfile caches the last generated Caddyfile.
-	lastCaddyfile string
+	lastCaddyCtrID  string
+	lastStartedAt   string
+	lastGlobal      string
+	lastSavedBody   string
 }
 
-// containerFingerprint is the subset of container data that the Caddyfile generator depends on.
-// Comparing fingerprints lets the controller skip no-op regenerations.
+// containerFingerprint contains container identity and routing inputs that can change the generated Caddyfile.
+// It excludes incidental Docker state so unrelated container updates do not cause a Caddy reload.
 type containerFingerprint struct {
 	ID          string
 	IP          netip.Addr
@@ -56,7 +70,8 @@ func (f containerFingerprint) Equal(other containerFingerprint) bool {
 		f.CaddyConfig == other.CaddyConfig
 }
 
-func NewController(machineID, configDir, adminSock string, store *store.Store) (*Controller, error) {
+func NewController(machineID string, service *Service, adminSock string, store *store.Store) (*Controller, error) {
+	configDir := service.configDir
 	if err := os.MkdirAll(configDir, 0o750); err != nil {
 		return nil, fmt.Errorf("create directory for Caddy configuration '%s': %w", configDir, err)
 	}
@@ -67,16 +82,21 @@ func NewController(machineID, configDir, adminSock string, store *store.Store) (
 	log := slog.With("component", "caddy-controller")
 	client := NewCaddyAdminClient(adminSock)
 
-	// generator is initialised by Run() once the machine name is resolved from the store.
+	// The generator is initialised by Run() after resolving the machine name from the store.
 	return &Controller{
 		machineID:     machineID,
 		caddyfilePath: filepath.Join(configDir, "Caddyfile"),
+		service:       service,
 		client:        client,
 		store:         store,
 		log:           log,
+		fileGroup:     CaddyGroup,
 	}, nil
 }
 
+// Run reconciles on container changes and every periodicReconciliationInterval. Failed work is retried every second,
+// but repeated retry failures are logged only during the periodic check.
+// The periodic check also covers missed events and outstanding failures after the daemon restarts.
 func (c *Controller) Run(ctx context.Context) error {
 	// Default the machine name to the machine ID so the Caddyfile header still carries a stable identifier if
 	// the store lookup fails.
@@ -95,13 +115,34 @@ func (c *Controller) Run(ctx context.Context) error {
 	}
 	c.log.Info("Subscribed to container changes in the cluster to generate Caddy configuration.")
 
-	containers = filterHealthyContainers(containers)
-	c.generateAndLoadCaddyfile(ctx, containers)
+	var retryC <-chan time.Time
+	periodic := time.NewTicker(periodicReconciliationInterval)
+	defer periodic.Stop()
 
-	// TODO: left for backward compatibility, remove later.
-	if err = c.generateJSONConfig(containers); err != nil {
-		c.log.Error("Failed to generate Caddy JSON configuration to disk.", "err", err)
+	handleResult := func(err error, logFailure bool) {
+		c.service.setReconciliationResult(err)
+		if err == nil {
+			retryC = nil
+			return
 		}
+		if logFailure {
+			c.log.Error("Failed to reconcile Caddy configuration, will retry.", "err", err)
+		}
+		retryC = time.After(time.Second)
+	}
+
+	reconcile := func(logFailure bool) {
+		ctrs, err := c.store.ListContainers(ctx, store.ListOptions{})
+		if err != nil {
+			err = fmt.Errorf("list containers: %w", err)
+		} else {
+			err = c.generateAndLoadCaddyfile(ctx, ctrs)
+		}
+		handleResult(err, logFailure)
+	}
+
+	// The subscription supplies an initial snapshot, so the first attempt need not wait for a change event.
+	handleResult(c.generateAndLoadCaddyfile(ctx, containers), true)
 
 	for {
 		select {
@@ -111,25 +152,18 @@ func (c *Controller) Run(ctx context.Context) error {
 			}
 			c.log.Debug("Cluster containers changed, regenerating Caddy configuration.")
 
-			containers, err = c.store.ListContainers(ctx, store.ListOptions{})
-			if err != nil {
-				c.log.Error("Failed to list containers.", "err", err)
-				continue
-			}
-			containers = filterHealthyContainers(containers)
-			c.generateAndLoadCaddyfile(ctx, containers)
-
-			// TODO: left for backward compatibility, remove later.
-			if err = c.generateJSONConfig(containers); err != nil {
-				c.log.Error("Failed to generate Caddy JSON configuration to disk.", "err", err)
-			}
+			reconcile(true)
+		case <-periodic.C:
+			reconcile(true)
+		case <-retryC:
+			reconcile(false)
 		case <-ctx.Done():
 			return nil
 		}
 	}
 }
 
-// filterHealthyContainers filters out unhealthy and hook containers.
+// filterHealthyContainers filters out unhealthy, hook, and caddy containers.
 // TODO: Filters out containers from this machine that are likely unavailable. The availability can be determined
 // by the cluster membership state of the machine that the container is running on. Implement machine membership
 // check using Corrossion Admin client.
@@ -139,6 +173,9 @@ func filterHealthyContainers(containers []store.ContainerRecord) []store.Contain
 		if cr.Container.IsHook() {
 			continue
 		}
+		if cr.Container.ServiceName() == CaddyServiceName {
+			continue
+		}
 		if cr.Container.Healthy() {
 			healthy = append(healthy, cr)
 		}
@@ -146,65 +183,96 @@ func filterHealthyContainers(containers []store.ContainerRecord) []store.Contain
 	return healthy
 }
 
-// generateAndLoadCaddyfile regenerates the Caddyfile from the given containers and loads it into the local Caddy
-// if available.
-func (c *Controller) generateAndLoadCaddyfile(ctx context.Context, containers []store.ContainerRecord) {
-	// Check if Caddy is available before attempting to generate and load config.
-	caddyAvailable := c.client.IsAvailable()
-
-	// Skip regeneration when Caddy is available and the containers since the last successful load haven't changed.
-	// When Caddy is unavailable we still regenerate to keep the Caddyfile on disk updated.
-	fingerprint := fingerprintContainers(containers)
-	if caddyAvailable && slices.EqualFunc(fingerprint, c.lastFingerprint, containerFingerprint.Equal) {
-		c.log.Debug("Caddy configuration is unchanged.", "path", c.caddyfilePath)
-		return
+// generateAndLoadCaddyfile reconciles the shared Caddyfile for the selected local Caddy container. A full candidate
+// reaches disk only after Caddy accepts it. Without an admin endpoint, the controller keeps a saved full file intact
+// and writes a bootstrap config only when the file is absent or already a bootstrap.
+func (c *Controller) generateAndLoadCaddyfile(ctx context.Context, containers []store.ContainerRecord) error {
+	caddyCtr := selectLocalCaddyContainer(containers, c.machineID)
+	if caddyCtr == nil {
+		// Caddy is not running locally which means there is no reliable source for the global config, skipping.
+		return nil
 	}
 
-	caddyfile, err := c.generator.Generate(ctx, containers, caddyAvailable)
+	saved, readErr := os.ReadFile(c.caddyfilePath)
+	if readErr != nil && !errors.Is(readErr, os.ErrNotExist) {
+		return fmt.Errorf("read saved Caddyfile: %w", readErr)
+	}
+	haveSaved := readErr == nil
+
+	healthyCtrs := filterHealthyContainers(containers)
+	fingerprint := fingerprintContainers(healthyCtrs)
+
+	if !caddyCtr.State.Running || !c.client.IsAvailable() {
+		if haveSaved && !isBootstrapCaddyfile(string(saved)) {
+			// Caddy may need this file to restart or roll back. A hosts-only replacement could drop
+			// storage or other global settings while the admin API is unavailable.
+			if caddyCtr.State.Running {
+				return fmt.Errorf("caddy admin socket unavailable, preserving saved Caddyfile")
+			}
+			return nil
+		}
+
+		bootstrap, err := c.generator.Generate(ctx, *caddyCtr, healthyCtrs, true)
 		if err != nil {
-		c.log.Error("Failed to generate Caddyfile configuration.", "err", err)
-		return
+			return fmt.Errorf("generate Caddy bootstrap config: %w", err)
+		}
+		if err = c.writeCaddyfileIfChanged(bootstrap); err != nil {
+			return fmt.Errorf("save Caddy bootstrap config: %w", err)
+		}
+		if caddyCtr.State.Running {
+			return fmt.Errorf("caddy admin socket unavailable, bootstrap config saved")
+		}
+		return nil
 	}
 
-	if !caddyAvailable {
-		// Caddy is not running so the generated Caddyfile should not include user-defined configs thus must be valid.
-		// It's safe to write the config to disk so that when Caddy is deployed on this machine, it can pick it up.
-		if err = c.writeCaddyfileIfChanged(caddyfile); err != nil {
-			c.log.Error("Failed to write Caddyfile to disk.", "err", err)
-			return
-		}
-		c.log.Debug("Caddy is not running on this machine, skipping configuration load.", "path", c.caddyfilePath)
-		return
+	if haveSaved &&
+		caddyfileBody(string(saved)) == c.lastSavedBody &&
+		!isBootstrapCaddyfile(string(saved)) &&
+		c.lastCaddyCtrID == caddyCtr.ID &&
+		c.lastStartedAt == caddyCtr.State.StartedAt &&
+		c.lastGlobal == caddyCtr.ServiceSpec.CaddyConfig() &&
+		slices.EqualFunc(fingerprint, c.lastFingerprint, containerFingerprint.Equal) {
+		// No changes to the inputs that affect the generated Caddyfile, so no reload is needed.
+		return nil
 	}
 
-	// Caddy is available, try to load the config which may fail if the config is invalid. Generally, a config can
-	// pass the adaptation/validation step but still fail to load, for example, if it references resources that are
-	// not available.
+	caddyfile, err := c.generator.Generate(ctx, *caddyCtr, healthyCtrs, false)
+	if err != nil {
+		return fmt.Errorf("generate Caddyfile: %w", err)
+	}
+	// Try to load the config which may fail if the config is invalid. Generally, a config can pass
+	// the adaptation/validation step but still fail to load, for example, if it references resources
+	// that are not available.
 	if err = c.client.Load(ctx, caddyfile); err != nil {
-		c.log.Error("Failed to load new Caddy configuration into local Caddy instance.",
-			"err", err, "path", c.caddyfilePath)
-		// Mark the cache stale so the next container change retries the load even if the container set is unchanged.
-		c.lastFingerprint = nil
-		// Don't write invalid config to disk.
-		return
+		return fmt.Errorf("load Caddyfile: %w", err)
+	}
+	if err = c.writeCaddyfileIfChanged(caddyfile); err != nil {
+		return fmt.Errorf("save loaded Caddyfile: %w", err)
 	}
 	c.lastFingerprint = fingerprint
-
-	// Config loaded successfully, now write it to disk.
-	if err = c.writeCaddyfileIfChanged(caddyfile); err != nil {
-		c.log.Error("Failed to write Caddyfile to disk after successful load.", "err", err)
-		// Config is already loaded in Caddy, so this is not critical. The next regeneration retries the disk write.
-		return
-	}
-
+	c.lastCaddyCtrID = caddyCtr.ID
+	c.lastStartedAt = caddyCtr.State.StartedAt
+	c.lastGlobal = caddyCtr.ServiceSpec.CaddyConfig()
+	c.lastSavedBody = caddyfileBody(caddyfile)
 	c.log.Info("New Caddy configuration loaded into local Caddy instance.", "path", c.caddyfilePath)
+
+	return nil
+}
+
+// isBootstrapCaddyfile distinguishes a reduced startup file from a full file that must survive Caddy outage.
+// It also recognizes the older daemon's offline file. That file omitted every x-caddy block, including globals,
+// so treating it as a protected full file would preserve the configuration-loss bug:
+// https://github.com/psviderski/uncloud/issues/412
+func isBootstrapCaddyfile(caddyfile string) bool {
+	return strings.Contains(caddyfile, bootstrapMarker) || strings.Contains(caddyfile, legacyBootstrapMarker)
 }
 
 // fingerprintContainers returns a fingerprint of containers that the Caddyfile generator depends on.
 func fingerprintContainers(containers []store.ContainerRecord) []containerFingerprint {
 	fingerprints := make([]containerFingerprint, len(containers))
 	for i, cr := range containers {
-		// Ignore ports parsing error as not much we can do about it. The generator just logs them and continues.
+		// Ignore ports parsing error as not much we can do about it. The generator just logs them and skips
+		// the container.
 		ports, _ := cr.Container.ServicePorts()
 		fingerprints[i] = containerFingerprint{
 			ID:          cr.Container.ID,
@@ -220,21 +288,71 @@ func fingerprintContainers(containers []store.ContainerRecord) []containerFinger
 	return fingerprints
 }
 
-// writeCaddyfileIfChanged writes the Caddyfile content to disk with proper permissions only if its body differs
-// from the last successfully written content. The first line of the Caddyfile carries a generation timestamp that
-// changes on every regeneration, so it's excluded from the comparison to avoid redundant writes.
+// selectLocalCaddyContainer chooses which local Caddy container supplies global Caddy config. A running container
+// takes precedence over a newer stopped replacement, even if the running container is unhealthy. If two revisions
+// run at once, the shared admin socket does not identify its owner, so this choice remains best effort.
+func selectLocalCaddyContainer(records []store.ContainerRecord, machineID string) *api.ServiceContainer {
+	var selected *api.ServiceContainer
+	for _, cr := range records {
+		ctr := cr.Container
+		if cr.MachineID != machineID || ctr.ServiceName() != CaddyServiceName || ctr.IsHook() {
+			continue
+		}
+		if selected == nil {
+			selected = &ctr
+			continue
+		}
+		if ctr.State.Running != selected.State.Running {
+			if ctr.State.Running {
+				selected = &ctr
+			}
+			continue
+		}
+		if ctr.CreatedTime().Compare(selected.CreatedTime()) > 0 {
+			selected = &ctr
+		}
+	}
+
+	return selected
+}
+
+// writeCaddyfileIfChanged atomically replaces the saved Caddyfile only if its body differs from the new content.
 func (c *Controller) writeCaddyfileIfChanged(caddyfile string) error {
-	if caddyfileBody(caddyfile) == caddyfileBody(c.lastCaddyfile) {
+	saved, err := os.ReadFile(c.caddyfilePath)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("read Caddyfile '%s': %w", c.caddyfilePath, err)
+	}
+	if err == nil && caddyfileBody(caddyfile) == caddyfileBody(string(saved)) {
 		return nil
 	}
 
-	if err := os.WriteFile(c.caddyfilePath, []byte(caddyfile), 0o640); err != nil {
-		return fmt.Errorf("write Caddyfile to file '%s': %w", c.caddyfilePath, err)
+	dir := filepath.Dir(c.caddyfilePath)
+	tmp, err := os.CreateTemp(dir, ".Caddyfile-*")
+	if err != nil {
+		return fmt.Errorf("create temporary Caddyfile: %w", err)
 	}
-	if err := fs.Chown(c.caddyfilePath, "", CaddyGroup); err != nil {
-		return fmt.Errorf("change owner of Caddyfile '%s': %w", c.caddyfilePath, err)
+	defer os.Remove(tmp.Name())
+	defer tmp.Close()
+
+	if err = tmp.Chmod(0o640); err != nil {
+		return fmt.Errorf("set temporary Caddyfile permissions: %w", err)
+	}
+	if err = fs.Chown(tmp.Name(), "", c.fileGroup); err != nil {
+		return fmt.Errorf("change owner of temporary Caddyfile: %w", err)
+	}
+
+	if _, err = tmp.WriteString(caddyfile); err != nil {
+		return fmt.Errorf("write temporary Caddyfile: %w", err)
+	}
+	if err = tmp.Sync(); err != nil {
+		return fmt.Errorf("sync temporary Caddyfile: %w", err)
+	}
+	if err = tmp.Close(); err != nil {
+		return fmt.Errorf("close temporary Caddyfile: %w", err)
+	}
+	if err = os.Rename(tmp.Name(), c.caddyfilePath); err != nil {
+		return fmt.Errorf("replace Caddyfile '%s': %w", c.caddyfilePath, err)
 	}
-	c.lastCaddyfile = caddyfile
 
 	return nil
 }
@@ -247,30 +365,3 @@ func caddyfileBody(caddyfile string) string {
 	}
 	return caddyfile
 }
-
-func (c *Controller) generateJSONConfig(containers []store.ContainerRecord) error {
-	serviceContainers := make([]api.ServiceContainer, len(containers))
-	for i, cr := range containers {
-		serviceContainers[i] = cr.Container
-	}
-
-	config, err := GenerateJSONConfig(serviceContainers, c.machineID)
-	if err != nil {
-		return err
-	}
-
-	configBytes, err := json.MarshalIndent(config, "", "    ")
-	if err != nil {
-		return fmt.Errorf("marshal Caddy configuration: %w", err)
-	}
-	configPath := filepath.Join(filepath.Dir(c.caddyfilePath), "caddy.json")
-
-	if err = os.WriteFile(configPath, configBytes, 0o640); err != nil {
-		return fmt.Errorf("write Caddy configuration to file '%s': %w", configPath, err)
-	}
-	if err = fs.Chown(configPath, "", CaddyGroup); err != nil {
-		return fmt.Errorf("change owner of Caddy configuration file '%s': %w", configPath, err)
-	}
-
-	return nil
-}

internal/machine/caddyconfig/controller_test.go

@@ -1,14 +1,488 @@
 package caddyconfig
 
 import (
+	"context"
+	"io"
+	"log/slog"
+	"net/http"
 	"net/netip"
+	"os"
+	"os/user"
+	"path/filepath"
 	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
+func testController(t *testing.T, socketPath string) *Controller {
+	t.Helper()
+	group, err := user.LookupGroupId(strconv.Itoa(os.Getegid()))
+	require.NoError(t, err)
+	path := filepath.Join(t.TempDir(), "Caddyfile")
+	client := NewCaddyAdminClient(socketPath)
+	return &Controller{
+		machineID:     "test-machine-id",
+		caddyfilePath: path,
+		generator:     NewCaddyfileGenerator("test-machine-id", "test-machine", client, nil),
+		client:        client,
+		log:           slog.Default(),
+		fileGroup:     group.Name,
+	}
+}
+
+type testCaddyAdmin struct {
+	mu                    sync.Mutex
+	adaptRequests         []string
+	loadCount             int
+	rejectAdaptContaining string
+	rejectLoad            bool
+}
+
+func (a *testCaddyAdmin) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/adapt":
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		a.mu.Lock()
+		a.adaptRequests = append(a.adaptRequests, string(body))
+		reject := a.rejectAdaptContaining != "" && strings.Contains(string(body), a.rejectAdaptContaining)
+		a.mu.Unlock()
+		if reject {
+			http.Error(w, "invalid Caddyfile", http.StatusBadRequest)
+			return
+		}
+		_, _ = io.WriteString(w, `{"result":{}}`)
+	case "/load":
+		a.mu.Lock()
+		a.loadCount++
+		reject := a.rejectLoad
+		a.mu.Unlock()
+		if reject {
+			http.Error(w, "load rejected", http.StatusBadRequest)
+		}
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func (a *testCaddyAdmin) snapshot() ([]string, int) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return append([]string(nil), a.adaptRequests...), a.loadCount
+}
+
+func (a *testCaddyAdmin) setRejectLoad(reject bool) {
+	a.mu.Lock()
+	a.rejectLoad = reject
+	a.mu.Unlock()
+}
+
+func TestController_GenerateAndLoadCaddyfile(t *testing.T) {
+	t.Run("keeps the saved file when there is no local Caddy container", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		saved := "# previous full Caddyfile\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		remote := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{ remote }",
+			"other-machine", time.Now())
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{remote}))
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+	})
+
+	t.Run("does not publish a bootstrap with an invalid global template", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{{upstreams",
+			"test-machine-id", time.Now())
+
+		require.ErrorContains(t, controller.generateAndLoadCaddyfile(context.Background(),
+			[]store.ContainerRecord{caddyCtr}), "render template")
+		_, err := os.Stat(controller.caddyfilePath)
+		assert.ErrorIs(t, err, os.ErrNotExist)
+	})
+
+	t.Run("bootstraps unhealthy Caddy with its globals and healthy routes", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		caddyCtr.Container.State.Health = &container.Health{Status: "unhealthy"}
+		newerStopped := newContainerRecordWithCaddyConfig("caddy", "10.210.0.6", "{\n\tstorage replacement\n}",
+			"test-machine-id", time.Now().Add(time.Minute))
+		newerStopped.Container.State.Running = false
+		app := newContainerRecordWithPorts("web", "10.210.0.3", []string{"app.example.com:8080/http"},
+			"test-machine-id")
+		app.Container.ServiceSpec.Caddy = &api.CaddySpec{Config: "custom.example.com { respond app }"}
+		unhealthy := newContainerRecordWithPorts("unhealthy", "10.210.0.4",
+			[]string{"unhealthy.example.com:8080/http"}, "test-machine-id")
+		unhealthy.Container.State.Health = &container.Health{Status: "unhealthy"}
+		hook := newContainerRecordWithPorts("hook", "10.210.0.5",
+			[]string{"hook.example.com:8080/http"}, "test-machine-id")
+		hook.Container.Config.Labels[api.LabelHook] = "pre-deploy"
+
+		err := controller.generateAndLoadCaddyfile(context.Background(),
+			[]store.ContainerRecord{newerStopped, caddyCtr, app, unhealthy, hook})
+		require.ErrorContains(t, err, "admin socket unavailable")
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), bootstrapMarker+caddyCtr.Container.ID)
+		assert.Contains(t, string(saved), "storage uncloud")
+		assert.NotContains(t, string(saved), "storage replacement")
+		assert.Contains(t, string(saved), "app.example.com")
+		assert.NotContains(t, string(saved), "custom.example.com")
+		assert.NotContains(t, string(saved), "unhealthy.example.com")
+		assert.NotContains(t, string(saved), "hook.example.com")
+	})
+
+	t.Run("replaces a legacy offline file with a bootstrap containing globals", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		legacy := "# generated by older daemon\nhttp:// { respond ok }\n" + legacyBootstrapMarker + "\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(legacy), 0o640))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+
+		err := controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{caddyCtr})
+		require.ErrorContains(t, err, "admin socket unavailable")
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), "storage uncloud")
+		assert.Contains(t, string(saved), bootstrapMarker+caddyCtr.Container.ID)
+		assert.NotContains(t, string(saved), legacyBootstrapMarker)
+	})
+
+	t.Run("saves a bootstrap for a stopped Caddy container with no file", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		caddyCtr.Container.State.Running = false
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{caddyCtr}))
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), bootstrapMarker+caddyCtr.Container.ID)
+		assert.Contains(t, string(saved), "storage uncloud")
+	})
+
+	for _, tc := range []struct {
+		name    string
+		running bool
+	}{
+		{name: "preserves a full file when the admin socket is unavailable", running: true},
+		{name: "preserves a stopped container's full file", running: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+			saved := "{\n\tstorage uncloud\n}\n\nold.example.com { respond old }\n"
+			require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+			caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage new\n}",
+				"test-machine-id", time.Now())
+			caddyCtr.Container.State.Running = tc.running
+			app := newContainerRecordWithPorts("web", "10.210.0.3", []string{"new.example.com:8080/http"},
+				"test-machine-id")
+
+			err := controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{caddyCtr, app})
+			if tc.running {
+				require.ErrorContains(t, err, "admin socket unavailable")
+			} else {
+				require.NoError(t, err)
+			}
+			got, err := os.ReadFile(controller.caddyfilePath)
+			require.NoError(t, err)
+			assert.Equal(t, saved, string(got))
+		})
+	}
+
+	t.Run("loads a full file and reloads after Caddy restarts", func(t *testing.T) {
+		admin := &testCaddyAdmin{}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		caddyCtr.Container.State.Health = &container.Health{Status: "unhealthy"}
+		app := newContainerRecordWithCaddyConfig("web", "10.210.0.3", "app.example.com { respond app }",
+			"test-machine-id", time.Now())
+		records := []store.ContainerRecord{caddyCtr, app}
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), "storage uncloud")
+		assert.Contains(t, string(saved), "app.example.com")
+		assert.NotContains(t, string(saved), bootstrapMarker)
+		adapted, loads := admin.snapshot()
+		require.NotEmpty(t, adapted)
+		assert.Contains(t, adapted[0], "storage uncloud")
+		assert.Equal(t, 1, loads)
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		_, loads = admin.snapshot()
+		assert.Equal(t, 1, loads, "unchanged inputs should not reload Caddy")
+
+		records[0].Container.State.StartedAt = time.Now().UTC().Format(time.RFC3339Nano)
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		_, loads = admin.snapshot()
+		assert.Equal(t, 2, loads, "a restarted Caddy process needs the full configuration")
+	})
+
+	t.Run("reloads when an application route changes", func(t *testing.T) {
+		admin := &testCaddyAdmin{}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		app := newContainerRecordWithPorts("web", "10.210.0.3", []string{"app.example.com:8080/http"},
+			"test-machine-id")
+		records := []store.ContainerRecord{caddyCtr, app}
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		_, loads := admin.snapshot()
+		assert.Equal(t, 1, loads)
+
+		records[1] = newContainerRecordWithPorts("web", "10.210.0.4",
+			[]string{"app.example.com:8080/http"}, "test-machine-id")
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), "10.210.0.4:8080")
+		assert.NotContains(t, string(saved), "10.210.0.3:8080")
+		_, loads = admin.snapshot()
+		assert.Equal(t, 2, loads)
+	})
+
+	t.Run("rejects invalid globals without loading or replacing the saved file", func(t *testing.T) {
+		admin := &testCaddyAdmin{rejectAdaptContaining: "storage rejected"}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		saved := "{\n\tstorage uncloud\n}\n\nold.example.com { respond old }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage rejected\n}",
+			"test-machine-id", time.Now())
+
+		err := controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{caddyCtr})
+		require.ErrorContains(t, err, "validate user-defined global Caddy config")
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		_, loads := admin.snapshot()
+		assert.Zero(t, loads)
+	})
+
+	t.Run("skips invalid application custom config", func(t *testing.T) {
+		admin := &testCaddyAdmin{rejectAdaptContaining: "invalid.example.com"}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		invalid := newContainerRecordWithCaddyConfig("invalid", "10.210.0.3",
+			"invalid.example.com { respond bad }", "test-machine-id", time.Now())
+		valid := newContainerRecordWithCaddyConfig("valid", "10.210.0.4",
+			"valid.example.com { respond good }", "test-machine-id", time.Now())
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(),
+			[]store.ContainerRecord{caddyCtr, invalid, valid}))
+		saved, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(saved), "storage uncloud")
+		assert.Contains(t, string(saved), "valid.example.com")
+		assert.NotContains(t, string(saved), "invalid.example.com")
+		assert.Contains(t, string(saved), "Skipped invalid user-defined configs")
+		_, loads := admin.snapshot()
+		assert.Equal(t, 1, loads)
+	})
+
+	t.Run("keeps the saved file when application validation cannot complete", func(t *testing.T) {
+		var loads atomic.Int64
+		socket := testAdminServer(t, func(w http.ResponseWriter, r *http.Request) {
+			switch r.URL.Path {
+			case "/adapt":
+				http.Error(w, "adapter unavailable", http.StatusInternalServerError)
+			case "/load":
+				loads.Add(1)
+			default:
+				http.NotFound(w, r)
+			}
+		})
+		controller := testController(t, socket)
+		saved := "old.example.com { respond old }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "",
+			"test-machine-id", time.Now())
+		app := newContainerRecordWithCaddyConfig("web", "10.210.0.3", "new.example.com { respond new }",
+			"test-machine-id", time.Now())
+
+		err := controller.generateAndLoadCaddyfile(context.Background(), []store.ContainerRecord{caddyCtr, app})
+		require.ErrorContains(t, err, "validate Caddy config for service")
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		assert.Zero(t, loads.Load())
+	})
+
+	t.Run("retries a rejected load without changing inputs", func(t *testing.T) {
+		admin := &testCaddyAdmin{rejectLoad: true}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		saved := "{\n\tstorage old\n}\n\nold.example.com { respond old }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		records := []store.ContainerRecord{caddyCtr}
+
+		require.ErrorContains(t, controller.generateAndLoadCaddyfile(context.Background(), records), "load Caddyfile")
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		admin.setRejectLoad(false)
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		got, err = os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(got), "storage uncloud")
+		_, loads := admin.snapshot()
+		assert.Equal(t, 2, loads)
+	})
+
+	t.Run("retries saving after a successful load", func(t *testing.T) {
+		admin := &testCaddyAdmin{}
+		controller := testController(t, testAdminServer(t, admin.ServeHTTP))
+		group := controller.fileGroup
+		controller.fileGroup = "uncloud-test-group-that-does-not-exist"
+		saved := "{\n\tstorage old\n}\n\nold.example.com { respond old }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		records := []store.ContainerRecord{caddyCtr}
+
+		require.ErrorContains(t, controller.generateAndLoadCaddyfile(context.Background(), records), "save loaded Caddyfile")
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		controller.fileGroup = group
+
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		got, err = os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(got), "storage uncloud")
+		_, loads := admin.snapshot()
+		assert.Equal(t, 2, loads)
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		_, loads = admin.snapshot()
+		assert.Equal(t, 2, loads, "a loaded and saved revision should not reload")
+	})
+
+	t.Run("loads a saved bootstrap when the admin socket becomes available", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		caddyCtr := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{\n\tstorage uncloud\n}",
+			"test-machine-id", time.Now())
+		records := []store.ContainerRecord{caddyCtr}
+		require.Error(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		bootstrap, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Contains(t, string(bootstrap), bootstrapMarker)
+
+		admin := &testCaddyAdmin{}
+		socket := testAdminServer(t, admin.ServeHTTP)
+		controller.client = NewCaddyAdminClient(socket)
+		controller.generator = NewCaddyfileGenerator("test-machine-id", "test-machine", controller.client, nil)
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		full, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.NotContains(t, string(full), bootstrapMarker)
+		_, loads := admin.snapshot()
+		assert.Equal(t, 1, loads)
+
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, bootstrap, 0o640))
+		require.NoError(t, controller.generateAndLoadCaddyfile(context.Background(), records))
+		_, loads = admin.snapshot()
+		assert.Equal(t, 2, loads, "a saved bootstrap is not an applied full configuration")
+	})
+}
+
+func TestController_WriteCaddyfileIfChanged(t *testing.T) {
+	t.Run("publishes a complete file with the configured group", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		caddyfile := "# Generated now\n{\n\tstorage uncloud\n}\n"
+
+		require.NoError(t, controller.writeCaddyfileIfChanged(caddyfile))
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, caddyfile, string(got))
+		info, err := os.Stat(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, os.FileMode(0o640), info.Mode().Perm())
+	})
+
+	t.Run("does not replace a file when only the timestamp changes", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		saved := "# Generated yesterday\nsite.example.com { respond ok }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+		before, err := os.Stat(controller.caddyfilePath)
+		require.NoError(t, err)
+
+		require.NoError(t, controller.writeCaddyfileIfChanged(
+			"# Generated today\nsite.example.com { respond ok }\n"))
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		after, err := os.Stat(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.True(t, os.SameFile(before, after), "an unchanged body should not replace the file")
+	})
+
+	t.Run("preserves the previous file when publication fails", func(t *testing.T) {
+		controller := testController(t, filepath.Join(t.TempDir(), "missing.sock"))
+		controller.fileGroup = "uncloud-test-group-that-does-not-exist"
+		saved := "# previous\nsite.example.com { respond old }\n"
+		require.NoError(t, os.WriteFile(controller.caddyfilePath, []byte(saved), 0o640))
+
+		err := controller.writeCaddyfileIfChanged("# next\nsite.example.com { respond new }\n")
+		require.ErrorContains(t, err, "change owner of temporary Caddyfile")
+		got, err := os.ReadFile(controller.caddyfilePath)
+		require.NoError(t, err)
+		assert.Equal(t, saved, string(got))
+		tmpFiles, err := filepath.Glob(filepath.Join(filepath.Dir(controller.caddyfilePath), ".Caddyfile-*"))
+		require.NoError(t, err)
+		assert.Empty(t, tmpFiles)
+	})
+}
+
+func TestSelectLocalCaddyContainer(t *testing.T) {
+	t.Run("prefers a running unhealthy container over a newer stopped one", func(t *testing.T) {
+		older := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{ older }",
+			"test-machine-id", time.Now().Add(-time.Hour))
+		older.Container.State.Health = &container.Health{Status: "unhealthy"}
+		newer := newContainerRecordWithCaddyConfig("caddy", "10.210.0.3", "{ newer }",
+			"test-machine-id", time.Now())
+		newer.Container.State.Running = false
+
+		selected := selectLocalCaddyContainer([]store.ContainerRecord{newer, older}, "test-machine-id")
+		require.NotNil(t, selected)
+		assert.Equal(t, older.Container.ID, selected.ID)
+	})
+
+	t.Run("ignores remote and hook containers", func(t *testing.T) {
+		local := newContainerRecordWithCaddyConfig("caddy", "10.210.0.2", "{ local }",
+			"test-machine-id", time.Now().Add(-time.Hour))
+		remote := newContainerRecordWithCaddyConfig("caddy", "10.210.0.3", "{ remote }",
+			"other-machine", time.Now())
+		hook := newContainerRecordWithCaddyConfig("caddy", "10.210.0.4", "{ hook }",
+			"test-machine-id", time.Now())
+		hook.Container.Config.Labels[api.LabelHook] = "pre-deploy"
+
+		selected := selectLocalCaddyContainer([]store.ContainerRecord{remote, hook, local}, "test-machine-id")
+		require.NotNil(t, selected)
+		assert.Equal(t, local.Container.ID, selected.ID)
+	})
+}
+
 // TestContainerFingerprint_EqualCoversAllFields is a guard: when a field is added to containerFingerprint,
 // Equal must also compare it. A mutation of any single field should flip equality to false. If this test fails
 // after adding a field, update Equal to include it.

internal/machine/caddyconfig/jsonconfig.go

@@ -1,141 +0,0 @@
-package caddyconfig
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"net/http"
-	"slices"
-	"strconv"
-	"time"
-
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddyconfig"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy"
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-func GenerateJSONConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
-	httpHostUpstreams, httpsHostUpstreams := httpUpstreamsFromPorts(containers)
-
-	var warnings []caddyconfig.Warning
-	servers := make(map[string]*caddyhttp.Server)
-	servers["http"] = &caddyhttp.Server{
-		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPPort)},
-		// All http requests to this server are logged to the default logger.
-		Logs: &caddyhttp.ServerLogConfig{},
-		Routes: append(
-			hostUpstreamsToRoutes(httpHostUpstreams, &warnings),
-			// Add a route to respond with a static verification response at the /.uncloud-verify path.
-			verificationRoute(verifyResponse, &warnings),
-		),
-	}
-	servers["https"] = &caddyhttp.Server{
-		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPSPort)},
-		// All https requests to this server are logged to the default logger.
-		Logs:   &caddyhttp.ServerLogConfig{},
-		Routes: hostUpstreamsToRoutes(httpsHostUpstreams, &warnings),
-	}
-
-	httpApp := caddyhttp.App{
-		Servers: servers,
-	}
-	config := &caddy.Config{
-		AppsRaw: caddy.ModuleMap{
-			"http": caddyconfig.JSON(httpApp, &warnings),
-		},
-	}
-
-	var err error
-	if len(warnings) > 0 {
-		// warnings only contains errors from JSON marshaling, which are highly unlikely with correct code.
-		for _, w := range warnings {
-			err = errors.Join(err, errors.New(w.Message))
-		}
-		return nil, fmt.Errorf("marshal Caddy configuration: %w", err)
-	}
-
-	return config, nil
-}
-
-// hostUpstreamsToRoutes converts a map of hostnames to upstreams to a list of Caddy routes.
-func hostUpstreamsToRoutes(hostUpstreams map[string][]string, warnings *[]caddyconfig.Warning) []caddyhttp.Route {
-	// Sort hostnames for deterministic output.
-	hostnames := slices.Collect(maps.Keys(hostUpstreams))
-	slices.Sort(hostnames)
-
-	routes := make([]caddyhttp.Route, 0, len(hostUpstreams))
-	for _, hostname := range hostnames {
-		upstreams := hostUpstreams[hostname]
-		upstreamPool := make([]*reverseproxy.Upstream, len(upstreams))
-		for i, upstream := range upstreams {
-			upstreamPool[i] = &reverseproxy.Upstream{
-				Dial: upstream,
-			}
-		}
-		handler := &reverseproxy.Handler{
-			HealthChecks: &reverseproxy.HealthChecks{
-				// Enable passive health checks to automatically detect unhealthy upstreams.
-				Passive: &reverseproxy.PassiveHealthChecks{
-					FailDuration: caddy.Duration(30 * time.Second),
-				},
-			},
-			LoadBalancing: &reverseproxy.LoadBalancing{
-				// Retry failed requests to skip over temporarily unavailable upstreams.
-				Retries: 3,
-			},
-			Upstreams: upstreamPool,
-		}
-
-		routes = append(routes, caddyhttp.Route{
-			MatcherSetsRaw: caddyhttp.RawMatcherSets{
-				{
-					"host": caddyconfig.JSON(caddyhttp.MatchHost{hostname}, warnings),
-				},
-			},
-			HandlersRaw: []json.RawMessage{
-				caddyconfig.JSONModuleObject(handler, "handler", "reverse_proxy", warnings),
-			},
-		})
-	}
-	return routes
-}
-
-// verificationRoute returns a Caddy route that responds with the given static response at the /.uncloud-verify path.
-func verificationRoute(response string, warnings *[]caddyconfig.Warning) caddyhttp.Route {
-	// Return the following route:
-	// {
-	//   "match": [
-	//     {
-	//       "path": [
-	//         "/.uncloud-verify"
-	//       ]
-	//     }
-	//   ],
-	//   "handle": [
-	//     {
-	//       "handler": "static_response",
-	//       "body": "<response>",
-	//       "status_code": 200
-	//     }
-	//   ]
-	// }
-
-	staticResponse := caddyhttp.StaticResponse{
-		StatusCode: caddyhttp.WeakString(strconv.Itoa(http.StatusOK)),
-		Body:       response,
-	}
-
-	return caddyhttp.Route{
-		MatcherSetsRaw: caddyhttp.RawMatcherSets{
-			{
-				"path": caddyconfig.JSON(caddyhttp.MatchPath{VerifyPath}, warnings),
-			},
-		},
-		HandlersRaw: []json.RawMessage{
-			caddyconfig.JSONModuleObject(staticResponse, "handler", "static_response", warnings),
-		},
-	}
-}

internal/machine/caddyconfig/jsonconfig_test.go

@@ -1,378 +0,0 @@
-package caddyconfig
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/network"
-	"github.com/psviderski/uncloud/internal/machine/docker"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGenerateJSONConfig(t *testing.T) {
-	configWithoutServices := `{
-		"servers": {
-			"http": {
-				"listen": [":80"],
-				"routes": [{
-					"match": [{"path": ["/.uncloud-verify"]}],
-					"handle": [{
-						"body": "verification-response-body",
-						"handler": "static_response",
-						"status_code": 200
-					}]
-				}],
-				"logs": {}
-			},
-			"https": {
-				"listen": [":443"],
-				"logs": {}
-			}
-		}
-	}`
-
-	tests := []struct {
-		name       string
-		containers []api.ServiceContainer
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "empty containers",
-			containers: []api.ServiceContainer{},
-			want:       configWithoutServices,
-			wantErr:    false,
-		},
-
-		{
-			name: "HTTP container",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "app.example.com:8080/http"),
-			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["app.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [{"dial": "10.210.0.2:8080"}]
-                                }]
-                            },
-                            {
-                                "match": [{"path": ["/.uncloud-verify"]}],
-                                "handle": [{
-                                    "body": "verification-response-body",
-                                    "handler": "static_response",
-                                    "status_code": 200
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    },
-                    "https": {
-                        "listen": [":443"],
-						"logs": {}
-                    }
-                }
-            }`,
-			wantErr: false,
-		},
-		{
-			name: "load balancing multiple containers",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "app.example.com:8080/http"),
-				newContainer("10.210.0.3", "app.example.com:8080/http"),
-			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["app.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [
-                                        {"dial": "10.210.0.2:8080"},
-                                        {"dial": "10.210.0.3:8080"}
-                                    ]
-                                }]
-                            },
-                            {
-                                "match": [{"path": ["/.uncloud-verify"]}],
-                                "handle": [{
-                                    "body": "verification-response-body",
-                                    "handler": "static_response",
-                                    "status_code": 200
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    },
-                    "https": {
-                        "listen": [":443"],
-						"logs": {}
-                    }
-                }
-            }`,
-			wantErr: false,
-		},
-		{
-			name: "HTTPS container",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "secure.example.com:8000/https"),
-			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [
-                            {
-                                "match": [{"path": ["/.uncloud-verify"]}],
-                                "handle": [{
-                                    "body": "verification-response-body",
-                                    "handler": "static_response",
-                                    "status_code": 200
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    },
-                    "https": {
-                        "listen": [":443"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["secure.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [{"dial": "10.210.0.2:8000"}]
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    }
-                }
-            }`,
-			wantErr: false,
-		},
-		{
-			name: "mixed HTTP and HTTPS",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2",
-					"app.example.com:8080/http",
-					"web.example.com:8000/http"),
-				newContainer("10.210.0.3",
-					"app.example.com:8080/http",
-					"secure.example.com:8888/https"),
-				newContainer("10.210.0.4",
-					"web.example.com:8000/http",
-					"secure.example.com:8888/https"),
-				newContainer("10.210.0.5",
-					"app.example.com:8080/http",
-					"web.example.com:8000/http",
-					"secure.example.com:8888/https"),
-			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["app.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [
-										{"dial": "10.210.0.2:8080"},
-										{"dial": "10.210.0.3:8080"},
-										{"dial": "10.210.0.5:8080"}
-									]
-                                }]
-                            },
-							{
-                                "match": [{"host": ["web.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [
-										{"dial": "10.210.0.2:8000"},
-										{"dial": "10.210.0.4:8000"},
-										{"dial": "10.210.0.5:8000"}
-									]
-                                }]
-                            },
-                            {
-                                "match": [{"path": ["/.uncloud-verify"]}],
-                                "handle": [{
-                                    "body": "verification-response-body",
-                                    "handler": "static_response",
-                                    "status_code": 200
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    },
-                    "https": {
-                        "listen": [":443"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["secure.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
-                                    "upstreams": [
-										{"dial": "10.210.0.3:8888"},
-										{"dial": "10.210.0.4:8888"},
-										{"dial": "10.210.0.5:8888"}
-									]
-                                }]
-                            }
-                        ],
-						"logs": {}
-                    }
-                }
-            }`,
-			wantErr: false,
-		},
-		{
-			name: "container without uncloud network ignored",
-			containers: []api.ServiceContainer{
-				newContainerWithoutNetwork("ignored.example.com:8080/http"),
-			},
-			want:    configWithoutServices,
-			wantErr: false,
-		},
-		{
-			name: "container with invalid port ignored",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "invalid-port"),
-			},
-			want:    configWithoutServices,
-			wantErr: false,
-		},
-		{
-			name: "containers with unsupported protocols and host mode ignored",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "5000/tcp"),
-				newContainer("10.210.0.3", "5000/udp"),
-				newContainer("10.210.0.4", "80:8080/tcp@host"),
-			},
-			want:    configWithoutServices,
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			config, err := GenerateJSONConfig(tt.containers, "verification-response-body")
-
-			if tt.wantErr {
-				assert.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-
-			require.Len(t, config.AppsRaw, 1, "Expected one http app")
-			require.Contains(t, config.AppsRaw, "http", "Expected http app")
-
-			assert.JSONEq(t, tt.want, string(config.AppsRaw["http"]), "Generated Caddy app config doesn't match")
-		})
-	}
-}
-
-func newContainer(ip string, ports ...string) api.ServiceContainer {
-	portsLabel := strings.Join(ports, ",")
-	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
-		ContainerJSONBase: &container.ContainerJSONBase{
-			State: &container.State{
-				Running: true,
-			},
-		},
-		NetworkSettings: &container.NetworkSettings{
-			Networks: map[string]*network.EndpointSettings{
-				docker.NetworkName: {
-					IPAddress: ip,
-				},
-			},
-		},
-		Config: &container.Config{
-			Labels: map[string]string{
-				api.LabelServicePorts: portsLabel,
-			},
-		},
-	}}}
-}
-
-func newContainerWithoutNetwork(ports ...string) api.ServiceContainer {
-	portsLabel := strings.Join(ports, ",")
-	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
-		ContainerJSONBase: &container.ContainerJSONBase{
-			State: &container.State{
-				Running: true,
-			},
-		},
-		NetworkSettings: &container.NetworkSettings{
-			Networks: map[string]*network.EndpointSettings{
-				"other-network": {
-					IPAddress: "172.17.0.2",
-				},
-			},
-		},
-		Config: &container.Config{
-			Labels: map[string]string{
-				api.LabelServicePorts: portsLabel,
-			},
-		},
-	}}}
-}

internal/machine/caddyconfig/mocks_test.go

@@ -16,10 +16,19 @@ func NewMockCaddyfileValidator(t interface {
 	mock.TestingT
 	Cleanup(func())
 }) *MockCaddyfileValidator {
+	if helper, ok := t.(interface{ Helper() }); ok {
+		helper.Helper()
+	}
+
 	mock := &MockCaddyfileValidator{}
 	mock.Mock.Test(t)
 
-	t.Cleanup(func() { mock.AssertExpectations(t) })
+	t.Cleanup(func() {
+		if helper, ok := t.(interface{ Helper() }); ok {
+			helper.Helper()
+		}
+		mock.AssertExpectations(t)
+	})
 
 	return mock
 }

internal/machine/caddyconfig/server.go

@@ -2,6 +2,7 @@ package caddyconfig
 
 import (
 	"context"
+	"errors"
 	"os"
 
 	"google.golang.org/grpc/codes"
@@ -22,18 +23,26 @@ func NewServer(service *Service) *Server {
 	return &Server{service: service}
 }
 
-// GetConfig retrieves the current Caddy configuration from the machine.
+// GetConfig retrieves the saved Caddy configuration and the latest reconciliation error from the machine.
 func (s *Server) GetConfig(ctx context.Context, _ *emptypb.Empty) (*pb.GetCaddyConfigResponse, error) {
 	caddyfile, modifiedAt, err := s.service.Caddyfile()
 	if err != nil {
-		if os.IsNotExist(err) {
+		if errors.Is(err, os.ErrNotExist) {
+			if lastErr := s.service.LastReconciliationError(); lastErr != nil {
+				return nil, status.Errorf(codes.NotFound, "%v; last Caddy config load failed: %v", err, lastErr)
+			}
 			return nil, status.Error(codes.NotFound, err.Error())
 		}
 		return nil, status.Error(codes.Internal, err.Error())
 	}
 
+	recErr := ""
+	if lastErr := s.service.LastReconciliationError(); lastErr != nil {
+		recErr = lastErr.Error()
+	}
 	return &pb.GetCaddyConfigResponse{
 		Caddyfile:               caddyfile,
 		ModifiedAt:              timestamppb.New(modifiedAt),
+		LastReconciliationError: recErr,
 	}, nil
 }

internal/machine/caddyconfig/server_test.go

@@ -0,0 +1,62 @@
+package caddyconfig
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+func TestServer_GetConfig(t *testing.T) {
+	t.Run("returns saved Caddyfile and reconciliation error", func(t *testing.T) {
+		dir := t.TempDir()
+		caddyfile := "example.com { respond ok }\n"
+		path := filepath.Join(dir, "Caddyfile")
+		require.NoError(t, os.WriteFile(path, []byte(caddyfile), 0o640))
+		info, err := os.Stat(path)
+		require.NoError(t, err)
+
+		service := NewService(dir)
+		service.setReconciliationResult(errors.New("module not registered: caddy.storage.uncloud"))
+		config, err := NewServer(service).GetConfig(context.Background(), &emptypb.Empty{})
+
+		require.NoError(t, err)
+		assert.Equal(t, caddyfile, config.GetCaddyfile())
+		assert.True(t, info.ModTime().Equal(config.GetModifiedAt().AsTime()))
+		assert.Equal(t, "module not registered: caddy.storage.uncloud", config.GetLastReconciliationError())
+
+		service.setReconciliationResult(nil)
+		config, err = NewServer(service).GetConfig(context.Background(), &emptypb.Empty{})
+		require.NoError(t, err)
+		assert.Empty(t, config.GetLastReconciliationError())
+	})
+
+	t.Run("returns NotFound with reconciliation error when Caddyfile is absent", func(t *testing.T) {
+		service := NewService(t.TempDir())
+		service.setReconciliationResult(errors.New("module not registered: caddy.storage.uncloud"))
+
+		config, err := NewServer(service).GetConfig(context.Background(), &emptypb.Empty{})
+
+		assert.Nil(t, config)
+		assert.Equal(t, codes.NotFound, status.Code(err))
+		assert.ErrorContains(t, err, "Caddyfile")
+		assert.ErrorContains(t, err, "last Caddy config load failed: module not registered: caddy.storage.uncloud")
+	})
+
+	t.Run("returns NotFound without reconciliation error when Caddyfile is absent", func(t *testing.T) {
+		service := NewService(t.TempDir())
+
+		config, err := NewServer(service).GetConfig(context.Background(), &emptypb.Empty{})
+
+		assert.Nil(t, config)
+		assert.Equal(t, codes.NotFound, status.Code(err))
+		assert.NotContains(t, err.Error(), "last Caddy config load failed")
+	})
+}

internal/machine/caddyconfig/service.go

@@ -4,12 +4,15 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 	"time"
 )
 
 // Service provides methods to interact with the Caddy configuration on the machine.
 type Service struct {
 	configDir               string
+	mu                      sync.RWMutex
+	lastReconciliationError error
 }
 
 // NewService creates a new Service instance with the specified Caddy configuration directory.
@@ -17,7 +20,8 @@ func NewService(configDir string) *Service {
 	return &Service{configDir: configDir}
 }
 
-// Caddyfile retrieves the current Caddy configuration (Caddyfile) from the machine's config directory.
+// Caddyfile retrieves the saved Caddyfile from the machine's config directory. The saved file may differ from the
+// running configuration if Caddy accepted a load but the subsequent write failed.
 func (s *Service) Caddyfile() (string, time.Time, error) {
 	path := filepath.Join(s.configDir, "Caddyfile")
 	content, err := os.ReadFile(path)
@@ -33,3 +37,17 @@ func (s *Service) Caddyfile() (string, time.Time, error) {
 
 	return string(content), fileInfo.ModTime(), nil
 }
+
+// LastReconciliationError reports the most recent unsuccessful controller attempt, if any. A successful attempt
+// clears it. An empty value does not prove that Caddy has loaded the saved Caddyfile.
+func (s *Service) LastReconciliationError() error {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.lastReconciliationError
+}
+
+func (s *Service) setReconciliationResult(err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastReconciliationError = err
+}

internal/machine/caddyconfig/service_test.go

@@ -0,0 +1,42 @@
+package caddyconfig
+
+import (
+	"errors"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestService_LastReconciliationError(t *testing.T) {
+	service := NewService(t.TempDir())
+	assert.NoError(t, service.LastReconciliationError())
+
+	service.setReconciliationResult(errors.New("global Caddy config rejected"))
+	assert.EqualError(t, service.LastReconciliationError(), "global Caddy config rejected")
+
+	service.setReconciliationResult(nil)
+	assert.NoError(t, service.LastReconciliationError())
+}
+
+func TestService_LastReconciliationErrorConcurrent(t *testing.T) {
+	service := NewService(t.TempDir())
+	var wg sync.WaitGroup
+	for range 10 {
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			for range 100 {
+				service.setReconciliationResult(errors.New("retry"))
+				service.setReconciliationResult(nil)
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			for range 100 {
+				_ = service.LastReconciliationError()
+			}
+		}()
+	}
+	wg.Wait()
+}

internal/machine/caddystorage/certificate.go

@@ -0,0 +1,79 @@
+package caddystorage
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/caddyserver/certmagic"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+// ListCertificates lists issued certificates from this machine's Caddy storage replica.
+// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+func (s *Server) ListCertificates(ctx context.Context, _ *emptypb.Empty) (*pb.ListCertificatesResponse, error) {
+	records, err := s.store.List(ctx, "certificates/", store.KeyspaceListOptions{KeysOnly: true})
+	if err != nil {
+		if ctx.Err() != nil {
+			return nil, status.FromContextError(ctx.Err()).Err()
+		}
+		return nil, status.Errorf(codes.Internal, "list Caddy certificates: %v", err)
+	}
+
+	resp := &pb.ListCertificatesResponse{}
+	for _, record := range records {
+		if err = ctx.Err(); err != nil {
+			return nil, status.FromContextError(err).Err()
+		}
+		if !isCertificateKey(record.Key) {
+			continue
+		}
+		cert, err := s.loadIssuedCertificate(ctx, record.Key)
+		if err != nil {
+			slog.Warn("Failed to load issued certificate from Caddy storage.", "key", record.Key, "err", err)
+			continue
+		}
+		resp.Certificates = append(resp.Certificates, cert)
+	}
+
+	return resp, nil
+}
+
+// isCertificateKey recognizes CertMagic's certificates/<issuer>/<name>/<name>.crt layout.
+func isCertificateKey(key string) bool {
+	parts := strings.Split(key, "/")
+	return len(parts) == 4 && parts[0] == "certificates" && parts[3] == parts[2]+".crt"
+}
+
+func (s *Server) loadIssuedCertificate(ctx context.Context, key string) (*pb.IssuedCertificate, error) {
+	chain, err := s.store.Get(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+
+	metaKey := strings.TrimSuffix(key, ".crt") + ".json"
+	meta, err := s.store.Get(ctx, metaKey)
+	if err != nil {
+		return nil, err
+	}
+
+	var resource certmagic.CertificateResource
+	if err = json.Unmarshal(meta.Value, &resource); err != nil {
+		return nil, err
+	}
+	if len(resource.SANs) == 0 || strings.TrimSpace(resource.SANs[0]) == "" {
+		return nil, fmt.Errorf("certificate metadata has no SAN")
+	}
+
+	return &pb.IssuedCertificate{
+		San:        resource.SANs[0],
+		Chain:      chain.Value,
+		IssuerData: resource.IssuerData,
+	}, nil
+}

internal/machine/caddystorage/certificate_test.go

@@ -0,0 +1,233 @@
+package caddystorage
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"math/big"
+	"net"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/caddyserver/certmagic"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+func TestServerListCertificates(t *testing.T) {
+	for _, sans := range [][]string{
+		{"app.example.com"}, {"*.example.com"}, {"192.0.2.1"}, {"www.example.com", "example.com"},
+	} {
+		t.Run(sans[0], func(t *testing.T) {
+			bundle, _, _ := certificateFixture(t, &x509.Certificate{
+				DNSNames:    []string{"example.com", "www.example.com"},
+				IPAddresses: []net.IP{net.ParseIP("192.0.2.1")},
+				NotAfter:    time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC),
+			})
+			key := certmagic.StorageKeys.SiteCert("local", sans[0])
+			storage := newCertificateStorage(t)
+			raw := json.RawMessage(`{"unknown_issuer_field":true}`)
+			storage.add(t, key, bundle, sans, raw)
+			storage.keys = append(storage.keys, "certificates", "certificates/local", "certificates/local/app.crt",
+				"certificates/local/app/wrong.crt", "certificates/local/app/app.crt/extra.crt",
+				"pki/authorities/local/root.crt", "ocsp/certificate")
+
+			resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+			require.NoError(t, err)
+			require.Len(t, resp.Certificates, 1)
+			cert := resp.Certificates[0]
+			assert.Equal(t, sans[0], cert.San)
+			assert.Equal(t, bundle, cert.Chain, "PEM must be returned unchanged")
+			assert.Equal(t, []byte(raw), cert.IssuerData)
+			assert.Equal(t, []string{key, strings.TrimSuffix(key, ".crt") + ".json"}, storage.loads)
+		})
+	}
+}
+
+func TestServerListCertificates_PreservesIssuerData(t *testing.T) {
+	bundle, _, _ := certificateFixture(t, &x509.Certificate{})
+	for _, raw := range []string{
+		"", "null", `{"url":"https://ca/cert/1","ca":"https://ca/directory"}`,
+		`{"url":"https://ca/cert/1","ca":"https://ca/directory","renewal_info":{"_selectedTime":"invalid"}}`,
+		`"provider-record"`, "[1,2,3]",
+	} {
+		t.Run(raw, func(t *testing.T) {
+			storage := newCertificateStorage(t)
+			storage.add(t, "certificates/custom/app/app.crt", bundle, []string{"app"}, json.RawMessage(raw))
+
+			resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+			require.NoError(t, err)
+			require.Len(t, resp.Certificates, 1)
+			assert.Equal(t, raw, string(resp.Certificates[0].IssuerData))
+		})
+	}
+}
+
+func TestServerListCertificates_OrderingAndDuplicates(t *testing.T) {
+	bundle, _, _ := certificateFixture(t, &x509.Certificate{})
+	storage := newCertificateStorage(t)
+	storage.add(t, certmagic.StorageKeys.SiteCert("z-issuer", "a.example.com"), bundle, []string{"a.example.com"}, nil)
+	storage.add(t, certmagic.StorageKeys.SiteCert("a-issuer", "z.example.com"), bundle, []string{"z.example.com"}, nil)
+	storage.add(t, certmagic.StorageKeys.SiteCert("b-issuer", "z.example.com"), bundle, []string{"z.example.com"}, nil)
+
+	resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+	require.NoError(t, err)
+	require.Len(t, resp.Certificates, 3)
+	certs := resp.Certificates
+	assert.Equal(t, []string{"z.example.com", "z.example.com", "a.example.com"},
+		[]string{certs[0].San, certs[1].San, certs[2].San})
+	for _, cert := range certs {
+		assert.Equal(t, bundle, cert.Chain)
+	}
+}
+
+func TestServerListCertificates_SkipsUnreadableEntries(t *testing.T) {
+	bundle, _, _ := certificateFixture(t, &x509.Certificate{})
+	const badKey = "certificates/local/bad/bad.crt"
+	const metaKey = "certificates/local/bad/bad.json"
+	for _, tt := range []struct {
+		name   string
+		change func(*certificateStorageStub)
+	}{
+		{"missing chain", func(s *certificateStorageStub) { delete(s.values, badKey) }},
+		{"chain read failure", func(s *certificateStorageStub) { s.loadErrors[badKey] = errors.New("offline") }},
+		{"missing metadata", func(s *certificateStorageStub) { delete(s.values, metaKey) }},
+		{"metadata read failure", func(s *certificateStorageStub) { s.loadErrors[metaKey] = errors.New("offline") }},
+		{"invalid JSON", func(s *certificateStorageStub) { s.values[metaKey] = []byte("{") }},
+		{"missing SAN", func(s *certificateStorageStub) { s.values[metaKey] = []byte(`{}`) }},
+		{"empty first SAN", func(s *certificateStorageStub) { s.values[metaKey] = []byte(`{"sans":["","app"]}`) }},
+		{"blank first SAN", func(s *certificateStorageStub) { s.values[metaKey] = []byte(`{"sans":[" "]}`) }},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			storage := newCertificateStorage(t)
+			storage.add(t, badKey, bundle, []string{"bad"}, nil)
+			storage.add(t, "certificates/local/good/good.crt", bundle, []string{"good"}, nil)
+			tt.change(storage)
+
+			resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+			require.NoError(t, err)
+			require.Len(t, resp.Certificates, 1)
+			assert.Equal(t, "good", resp.Certificates[0].San)
+		})
+	}
+
+	t.Run("all entries unreadable", func(t *testing.T) {
+		storage := newCertificateStorage(t)
+		storage.keys = []string{badKey}
+		resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+		require.NoError(t, err)
+		assert.Empty(t, resp.Certificates)
+	})
+}
+
+func TestServerListCertificates_ListErrors(t *testing.T) {
+	for _, fail := range []bool{false, true} {
+		storage := newCertificateStorage(t)
+		if fail {
+			storage.listError = errors.New("offline")
+		}
+
+		resp, err := NewServer(storage).ListCertificates(t.Context(), &emptypb.Empty{})
+		assert.Empty(t, storage.loads)
+		if fail {
+			assert.Nil(t, resp)
+			assert.Equal(t, codes.Internal, status.Code(err))
+		} else {
+			require.NoError(t, err)
+			assert.Empty(t, resp.Certificates)
+		}
+	}
+}
+
+// Only reads are implemented. Unexpected writes panic through the nil embedded Keyspace.
+type certificateStorageStub struct {
+	*store.Keyspace
+	t          *testing.T
+	keys       []string
+	values     map[string][]byte
+	loads      []string
+	listCalls  int
+	listError  error
+	loadErrors map[string]error
+	onLoad     func(string)
+}
+
+func newCertificateStorage(t *testing.T) *certificateStorageStub {
+	return &certificateStorageStub{t: t, values: make(map[string][]byte), loadErrors: make(map[string]error)}
+}
+
+func (s *certificateStorageStub) add(t *testing.T, key string, bundle []byte, sans []string, issuerData json.RawMessage) {
+	t.Helper()
+	metaKey := strings.TrimSuffix(key, ".crt") + ".json"
+	keyKey := strings.TrimSuffix(key, ".crt") + ".key"
+	meta, err := json.Marshal(certmagic.CertificateResource{SANs: sans, IssuerData: issuerData})
+	require.NoError(t, err)
+	s.keys = append(s.keys, key, metaKey, keyKey)
+	s.values[key], s.values[metaKey], s.values[keyKey] = bundle, meta, []byte("must not read private keys")
+}
+
+func (s *certificateStorageStub) List(ctx context.Context, prefix string, opts store.KeyspaceListOptions) ([]store.Record, error) {
+	s.listCalls++
+	assert.Equal(s.t, "certificates/", prefix)
+	assert.True(s.t, opts.KeysOnly, "listing must not fetch private key values")
+	var records []store.Record
+	for _, key := range slices.Sorted(slices.Values(s.keys)) {
+		records = append(records, store.Record{Key: key})
+	}
+	return records, s.listError
+}
+
+func (s *certificateStorageStub) Get(ctx context.Context, key string) (store.Record, error) {
+	require.False(s.t, strings.HasSuffix(key, ".key"), "private keys must never be loaded")
+	s.loads = append(s.loads, key)
+	if s.onLoad != nil {
+		s.onLoad(key)
+	}
+	if err := s.loadErrors[key]; err != nil {
+		return store.Record{}, err
+	}
+	value, ok := s.values[key]
+	if !ok {
+		return store.Record{}, store.ErrKeyNotFound
+	}
+	return store.Record{Key: key, Value: value}, nil
+}
+
+func certificateFixture(t *testing.T, template *x509.Certificate) ([]byte, *x509.Certificate, *x509.Certificate) {
+	t.Helper()
+	publicKey, key, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	root := &x509.Certificate{
+		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "Test CA"}, IsCA: true,
+		BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
+		NotBefore: time.Date(1990, 1, 1, 0, 0, 0, 0, time.UTC),
+		NotAfter:  time.Date(2040, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+	rootDER, err := x509.CreateCertificate(rand.Reader, root, root, publicKey, key)
+	require.NoError(t, err)
+	root, err = x509.ParseCertificate(rootDER)
+	require.NoError(t, err)
+	template.SerialNumber = big.NewInt(2)
+	template.NotBefore = root.NotBefore
+	if template.NotAfter.IsZero() {
+		template.NotAfter = root.NotAfter
+	}
+	leafDER, err := x509.CreateCertificate(rand.Reader, template, root, publicKey, key)
+	require.NoError(t, err)
+	leaf, err := x509.ParseCertificate(leafDER)
+	require.NoError(t, err)
+	bundle := append(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: leafDER}),
+		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: rootDER})...)
+	return bundle, leaf, root
+}

internal/machine/caddystorage/server.go

@@ -25,10 +25,17 @@ const Namespace = "caddy_storage"
 // Server implements the machine-local CaddyStorage gRPC service.
 type Server struct {
 	pb.UnimplementedCaddyStorageServer
-	store *store.Keyspace
+	store keyspace
 }
 
-func NewServer(store *store.Keyspace) *Server {
+type keyspace interface {
+	Get(context.Context, string) (store.Record, error)
+	Put(context.Context, string, []byte) error
+	Delete(context.Context, string, store.KeyspaceDeleteOptions) error
+	List(context.Context, string, store.KeyspaceListOptions) ([]store.Record, error)
+}
+
+func NewServer(store keyspace) *Server {
 	return &Server{store: store}
 }
 

internal/machine/cluster.go

@@ -176,7 +176,7 @@ func (cc *clusterController) Run(ctx context.Context) error {
 	// Start the network API server before waiting for the store sync so the machine is reachable on the mesh
 	// during the sync and can serve requests that don't depend on the store.
 	// Assume the management IP can't be changed when the network is running.
-	apiAddr := net.JoinHostPort(cc.state.Network.ManagementIP.String(), strconv.Itoa(constants.MachineAPIPort))
+	apiAddr := net.JoinHostPort(cc.state.Network.ManagementIP.String(), strconv.Itoa(constants.UncloudAPIPort))
 	listener, err := net.Listen("tcp", apiAddr)
 	if err != nil {
 		return fmt.Errorf("listen API port: %w", err)

internal/machine/cluster/cluster.go

@@ -14,6 +14,7 @@ import (
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
@@ -87,6 +88,11 @@ func (c *Cluster) AddMachine(ctx context.Context, req *pb.AddMachineRequest) (*p
 func (c *Cluster) AddMachineWithoutReadyCheck(
 	ctx context.Context, req *pb.AddMachineRequest,
 ) (*pb.AddMachineResponse, error) {
+	if req.Name != "" {
+		if err := api.ValidateMachineName(req.Name); err != nil {
+			return nil, status.Error(codes.InvalidArgument, err.Error())
+		}
+	}
 	if req.Network == nil {
 		return nil, status.Error(codes.InvalidArgument, "network not set")
 	}

internal/machine/cluster/cluster_test.go

@@ -0,0 +1,28 @@
+package cluster
+
+import (
+	"context"
+	"testing"
+
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestAddMachine_InvalidName(t *testing.T) {
+	t.Parallel()
+
+	ready := make(chan struct{})
+	close(ready)
+	// Invalid names must be rejected before any store access.
+	c := NewCluster(nil, nil, nil, ready)
+	for _, name := range []string{"VPS1", "worker.example", "rr", "nearest", "c337f00600de51ef4375c9a9a267dba5"} {
+		t.Run("add", func(t *testing.T) {
+			resp, err := c.AddMachine(context.Background(), &pb.AddMachineRequest{Name: name})
+			require.Nil(t, resp)
+			require.Equal(t, codes.InvalidArgument, status.Code(err))
+			require.ErrorContains(t, err, "invalid machine name")
+		})
+	}
+}

internal/machine/cluster/dns.go

@@ -4,20 +4,24 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 
+	"github.com/miekg/dns"
 	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/dns"
+	undns "github.com/psviderski/uncloud/internal/dns"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-// uncloudDNSKey is the key used to store the details of the reserved domain in the store.
+// uncloudDNSKey stores the cluster domain and, when reserved, its Uncloud DNS credentials.
 const uncloudDNSKey = "uncloud_dns"
 
 type uncloudDNSDomain struct {
 	// Endpoint is the API endpoint of the Uncloud DNS service where the domain is reserved.
+	// An empty endpoint means the domain is managed externally.
 	Endpoint string
 	Name     string
 	// TODO: encrypt the token in the store.
@@ -34,14 +38,14 @@ func (c *Cluster) ReserveDomain(ctx context.Context, req *pb.ReserveDomainReques
 	}
 
 	if _, err := c.storedDomain(ctx); err == nil {
-		return nil, status.Errorf(codes.AlreadyExists, "domain already reserved")
+		return nil, status.Error(codes.AlreadyExists, "cluster domain already configured")
 	} else {
 		if s := status.Convert(err); s.Code() != codes.NotFound {
 			return nil, err
 		}
 	}
 
-	dnsClient := dns.NewClient()
+	dnsClient := undns.NewClient()
 	name, token, err := dnsClient.ReserveDomain(req.Endpoint)
 	if err != nil {
 		return nil, status.Error(codes.Internal, err.Error())
@@ -60,7 +64,7 @@ func (c *Cluster) ReserveDomain(ctx context.Context, req *pb.ReserveDomainReques
 		return nil, status.Errorf(codes.Internal, "store reserved domain: %v", err)
 	}
 
-	return &pb.Domain{Name: name}, nil
+	return &pb.Domain{Name: name, Reserved: proto.Bool(true)}, nil
 }
 
 func (c *Cluster) GetDomain(ctx context.Context, _ *emptypb.Empty) (*pb.Domain, error) {
@@ -73,7 +77,7 @@ func (c *Cluster) GetDomain(ctx context.Context, _ *emptypb.Empty) (*pb.Domain,
 		return nil, err
 	}
 
-	return &pb.Domain{Name: domain.Name}, nil
+	return &pb.Domain{Name: domain.Name, Reserved: proto.Bool(domain.Endpoint != "")}, nil
 }
 
 func (c *Cluster) storedDomain(ctx context.Context) (uncloudDNSDomain, error) {
@@ -103,13 +107,63 @@ func (c *Cluster) ReleaseDomain(ctx context.Context, _ *emptypb.Empty) (*pb.Doma
 	if err != nil {
 		return nil, err
 	}
+	if domain.Endpoint == "" {
+		return nil, status.Error(codes.FailedPrecondition,
+			"cluster domain is set manually, use 'uc dns set \"\"' to unset it")
+	}
 
 	if err = c.store.Delete(ctx, uncloudDNSKey); err != nil {
 		return nil, status.Errorf(codes.Internal, "delete domain from store: %v", err)
 	}
 	// TODO: implement and call Uncloud DNS endpoint to release/delete the domain.
 
-	return &pb.Domain{Name: domain.Name}, nil
+	return &pb.Domain{Name: domain.Name, Reserved: proto.Bool(true)}, nil
+}
+
+func (c *Cluster) SetDomain(ctx context.Context, req *pb.SetDomainRequest) (*emptypb.Empty, error) {
+	if err := c.checkReady(); err != nil {
+		return nil, err
+	}
+
+	name := req.GetName()
+	if name != "" {
+		if labels, ok := dns.IsDomainName(name); !ok || labels < 2 {
+			return nil, status.Errorf(codes.InvalidArgument,
+				"invalid cluster domain '%s': must be a valid domain name with at least two labels", name)
+		}
+	}
+	name = strings.ToLower(strings.TrimSuffix(name, "."))
+
+	existing, err := c.storedDomain(ctx)
+	if err != nil && status.Code(err) != codes.NotFound {
+		return nil, err
+	}
+	if name == "" {
+		if err == nil {
+			if existing.Endpoint != "" {
+				return nil, status.Error(codes.FailedPrecondition,
+					"cluster domain is reserved in Uncloud DNS, use 'uc dns release' to release it")
+			}
+			if err := c.store.Delete(ctx, uncloudDNSKey); err != nil {
+				return nil, status.Errorf(codes.Internal, "unset cluster domain: %v", err)
+			}
+		}
+		return &emptypb.Empty{}, nil
+	}
+	if err == nil {
+		return nil, status.Error(codes.AlreadyExists, "cluster domain already configured")
+	}
+
+	domain := uncloudDNSDomain{Name: name}
+	domainJSON, err := json.Marshal(domain)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal set domain for store: %v", err)
+	}
+	if err = c.store.Put(ctx, uncloudDNSKey, domainJSON); err != nil {
+		return nil, status.Errorf(codes.Internal, "store set domain: %v", err)
+	}
+
+	return &emptypb.Empty{}, nil
 }
 
 func (c *Cluster) CreateDomainRecords(
@@ -124,12 +178,16 @@ func (c *Cluster) CreateDomainRecords(
 		return nil, err
 	}
 
-	dnsClient := dns.NewClient()
-	recordsReq := make([]dns.RecordRequest, len(req.Records))
+	if domain.Endpoint == "" {
+		return nil, status.Error(codes.FailedPrecondition, "cluster domain is not reserved in Uncloud DNS")
+	}
+
+	dnsClient := undns.NewClient()
+	recordsReq := make([]undns.RecordRequest, len(req.Records))
 	for i, r := range req.Records {
-		recordsReq[i] = dns.RecordRequest{
+		recordsReq[i] = undns.RecordRequest{
 			Name:   r.Name,
-			Type:   dns.RecordType(r.Type.String()),
+			Type:   undns.RecordType(r.Type.String()),
 			Values: r.Values,
 		}
 	}
@@ -149,9 +207,9 @@ func (c *Cluster) CreateDomainRecords(
 		}
 
 		switch r.Type {
-		case dns.RecordTypeA:
+		case undns.RecordTypeA:
 			resp.Records[i].Type = pb.DNSRecord_A
-		case dns.RecordTypeAAAA:
+		case undns.RecordTypeAAAA:
 			resp.Records[i].Type = pb.DNSRecord_AAAA
 		}
 	}

internal/machine/cluster/machine.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 // NewMachineID generates a new unique machine ID.
@@ -27,7 +28,7 @@ func NewRandomMachineName() (string, error) {
 // a numeric suffix ("-1", "-2", etc.) if needed.
 func DefaultMachineName(hostname string, existing []string) (string, error) {
 	name := machineNameFromHostname(hostname)
-	if name == "" {
+	if api.ValidateMachineName(name) != nil {
 		var err error
 		if name, err = NewRandomMachineName(); err != nil {
 			return "", err
@@ -38,7 +39,9 @@ func DefaultMachineName(hostname string, existing []string) (string, error) {
 		return name, nil
 	}
 	for i := 1; ; i++ {
-		candidate := fmt.Sprintf("%s-%d", name, i)
+		suffix := fmt.Sprintf("-%d", i)
+		base := strings.TrimRight(name[:min(len(name), 63-len(suffix))], "-")
+		candidate := base + suffix
 		if !slices.Contains(existing, candidate) {
 			return candidate, nil
 		}
@@ -55,12 +58,13 @@ func machineNameFromHostname(hostname string) string {
 	var b strings.Builder
 	for _, r := range label {
 		switch {
-		case r >= 'a' && r <= 'z', r >= '0' && r <= '9', r == '-', r == '_':
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9', r == '-':
 			b.WriteRune(r)
 		default:
 			b.WriteRune('-')
 		}
 	}
 	// Trim leading and trailing hyphens that may result from the sanitisation above.
-	return strings.Trim(b.String(), "-")
+	name := strings.Trim(b.String(), "-")
+	return strings.TrimRight(name[:min(len(name), 63)], "-")
 }

internal/machine/cluster/machine_test.go

@@ -1,8 +1,10 @@
 package cluster
 
 import (
+	"strings"
 	"testing"
 
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -18,9 +20,11 @@ func TestMachineNameFromHostname(t *testing.T) {
 		{"simple", "web", "web"},
 		{"fqdn uses first label", "web-1.example.com", "web-1"},
 		{"uppercase lowercased", "Web-Server", "web-server"},
-		{"invalid chars replaced", "host_name@1", "host_name-1"},
-		{"trim surrounding hyphens", "-_host_-", "_host_"},
+		{"invalid chars replaced", "host_name@1", "host-name-1"},
+		{"trim surrounding hyphens", "-_host_-", "host"},
 		{"whitespace trimmed", "  myhost  ", "myhost"},
+		{"long hostname truncated", strings.Repeat("a", 64), strings.Repeat("a", 63)},
+		{"truncation trims trailing hyphen", strings.Repeat("a", 62) + "-b", strings.Repeat("a", 62)},
 		{"empty", "", ""},
 		{"only invalid chars", "@#", ""},
 		{"dot only", ".example.com", ""},
@@ -37,10 +41,12 @@ func TestDefaultMachineName(t *testing.T) {
 	t.Parallel()
 
 	t.Run("falls back to random", func(t *testing.T) {
-		// An empty or fully invalid hostname falls back to a random "machine-xxxx" name.
-		got, err := DefaultMachineName("***", nil)
+		for _, hostname := range []string{"***", "rr", "nearest", strings.Repeat("a", 32)} {
+			got, err := DefaultMachineName(hostname, nil)
 			require.NoError(t, err)
-		assert.Regexp(t, `^machine-[a-zA-Z0-9]{4}$`, got)
+			assert.Regexp(t, `^machine-[a-z0-9]{4}$`, got)
+			require.NoError(t, api.ValidateMachineName(got))
+		}
 	})
 
 	tests := []struct {
@@ -49,10 +55,45 @@ func TestDefaultMachineName(t *testing.T) {
 		existing []string
 		want     string
 	}{
-		{"from hostname", "web-1.example.com", nil, "web-1"},
-		{"dedup against existing", "web", []string{"web"}, "web-1"},
-		{"dedup multiple", "web", []string{"web", "web-1"}, "web-2"},
-		{"sanitized", "My_Host", nil, "my_host"},
+		{
+			name:     "from hostname",
+			hostname: "web-1.example.com",
+			want:     "web-1",
+		},
+		{
+			name:     "dedup against existing",
+			hostname: "web",
+			existing: []string{"web"},
+			want:     "web-1",
+		},
+		{
+			name:     "dedup multiple",
+			hostname: "web",
+			existing: []string{"web", "web-1"},
+			want:     "web-2",
+		},
+		{
+			name:     "sanitized",
+			hostname: "My_Host",
+			want:     "my-host",
+		},
+		{
+			name:     "long hostname",
+			hostname: strings.Repeat("a", 64),
+			want:     strings.Repeat("a", 63),
+		},
+		{
+			name:     "dedup maximum length",
+			hostname: strings.Repeat("a", 63),
+			existing: []string{strings.Repeat("a", 63)},
+			want:     strings.Repeat("a", 61) + "-1",
+		},
+		{
+			name:     "dedup trims trailing hyphen",
+			hostname: strings.Repeat("a", 60) + "-bb",
+			existing: []string{strings.Repeat("a", 60) + "-bb"},
+			want:     strings.Repeat("a", 60) + "-1",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -60,6 +101,7 @@ func TestDefaultMachineName(t *testing.T) {
 			got, err := DefaultMachineName(tt.hostname, tt.existing)
 			require.NoError(t, err)
 			assert.Equal(t, tt.want, got)
+			require.NoError(t, api.ValidateMachineName(got))
 		})
 	}
 }

internal/machine/constants/constants.go

@@ -1,8 +1,9 @@
 package constants
 
 const (
-	// MachineAPIPort is the port for the Machine API service on the management WireGuard network.
-	MachineAPIPort = 51000
-	// UnregistryPort is the port for the embedded container registry listening on the machine IP.
+	// UncloudAPIPort is the TCP port on which each machine serves the Uncloud API over the management WireGuard
+	// network.
+	UncloudAPIPort = 51000
+	// UnregistryPort is the TCP port for the embedded container registry listening on the machine IP.
 	UnregistryPort = 51500
 )

internal/machine/dns/resolver.go

@@ -10,6 +10,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 )
 
@@ -19,7 +21,9 @@ type ClusterResolver struct {
 	store *store.Store
 	// serviceIPs maps service names to container IPs.
 	serviceIPs map[string][]netip.Addr
-	// mu protects the serviceIPs map.
+	// machineIPs maps machine IDs and names to their IP.
+	machineIPs map[string]netip.Addr
+	// mu protects the serviceIPs and machineIPs map.
 	mu sync.RWMutex
 	// lastUpdate tracks when records were last updated.
 	lastUpdate time.Time
@@ -46,6 +50,13 @@ func (r *ClusterResolver) Run(ctx context.Context) error {
 	// TODO: implement machine membership check using Corrossion Admin client to filter available containers.
 	r.updateServiceIPs(containers)
 
+	machines, mchanges, err := r.store.SubscribeMachines(ctx)
+	if err != nil {
+		return fmt.Errorf("subscribe to machine changes: %w", err)
+	}
+	r.log.Info("Subscribed to machine changes in the clsuter to keep machine DNS records updated.")
+	r.updateMachineIPs(machines)
+
 	for {
 		select {
 		case _, ok := <-changes:
@@ -59,9 +70,22 @@ func (r *ClusterResolver) Run(ctx context.Context) error {
 				r.log.Error("Failed to list containers.", "err", err)
 				continue
 			}
-
 			// TODO: implement machine membership check using Corrossion Admin client to filter available containers.
 			r.updateServiceIPs(containers)
+
+		case _, ok := <-mchanges:
+			if !ok {
+				return fmt.Errorf("machine subscription failed")
+			}
+			r.log.Debug("Cluster machines changed, updating DNS records.")
+
+			machines, err := r.store.ListMachines(ctx)
+			if err != nil {
+				r.log.Error("Failed to list machines.", "err", err)
+				continue
+			}
+			r.updateMachineIPs(machines)
+
 		case <-ctx.Done():
 			return nil
 		}
@@ -121,19 +145,49 @@ func (r *ClusterResolver) updateServiceIPs(containers []store.ContainerRecord) {
 	r.log.Info("DNS records updated.", "services", len(newServiceIPs)/3, "containers", containersCount)
 }
 
-// Resolve returns IP addresses of the service containers.
-func (r *ClusterResolver) Resolve(serviceName string) []netip.Addr {
+func (r *ClusterResolver) updateMachineIPs(machines []*pb.MachineInfo) {
+	newMachineIPs := make(map[string]netip.Addr, len(machines))
+
+	for _, machine := range machines {
+		subnet, err := machine.Network.Subnet.ToPrefix()
+		if err != nil {
+			continue
+		}
+		addr := network.MachineIP(subnet)
+		newMachineIPs[machine.Name+".m"] = addr
+		newMachineIPs[machine.Id+".m"] = addr
+	}
+	r.mu.Lock()
+	r.machineIPs = newMachineIPs
+	r.mu.Unlock()
+
+	r.log.Info("DNS records updated.", "machines", len(machines))
+}
+
+// Resolve returns IP addresses of the service containers or machines.
+func (r *ClusterResolver) Resolve(name string) []netip.Addr {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 
-	ips, ok := r.serviceIPs[serviceName]
-	if !ok || len(ips) == 0 {
-		return nil
+	// Return a copy of the IPs slice to prevent modification of the original.
+	ips, ok := r.serviceIPs[name]
+	if ok && len(ips) > 0 {
+		return slices.Clone(ips)
 	}
 
-	// Return a copy of the IPs slice to prevent modification of the original.
-	ipsCopy := make([]netip.Addr, len(ips))
-	copy(ipsCopy, ips)
+	ip, ok := r.machineIPs[name]
+	if ok {
+		return slices.Clone([]netip.Addr{ip})
+	}
 
-	return ipsCopy
+	if name == "m" { // all machines subdomain
+		// collect all unique IP address
+		uniq := map[string]netip.Addr{}
+		for _, addr := range r.machineIPs {
+			uniq[addr.String()] = addr
+		}
+		return slices.Clone(slices.Collect(maps.Values(uniq)))
+	}
+
+	return nil
 }

internal/machine/dns/resolver_test.go

@@ -1,11 +1,13 @@
 package dns
 
 import (
+	"net/netip"
 	"reflect"
 	"testing"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/psviderski/uncloud/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
@@ -75,3 +77,32 @@ func newRecord(serviceID, serviceName, ip, machineID string) store.ContainerReco
 		MachineID: machineID,
 	}
 }
+
+func TestClusterResolver_UpdateMachineIPs(t *testing.T) {
+	t.Parallel()
+
+	machines := []*pb.MachineInfo{
+		newMachineRecord("x0y0z0", "mach-1", "10.210.0.0/24"),
+		newMachineRecord("x1y1z1", "mach-2", "10.210.1.0/24"),
+		newMachineRecord("x2y2z2", "mach-3", "10.210.2.0/24"),
+	}
+
+	r := NewClusterResolver(nil)
+	r.updateMachineIPs(machines)
+
+	assert.NotEmpty(t, r.Resolve("mach-1.m"))
+	assert.NotEmpty(t, r.Resolve("mach-3.m"))
+	assert.NotEmpty(t, r.Resolve("x0y0z0.m"))
+
+	assert.Equal(t, 3, len(r.Resolve("m")))
+}
+
+func newMachineRecord(machineID, machineName, prefix string) *pb.MachineInfo {
+	return &pb.MachineInfo{
+		Id:   machineID,
+		Name: machineName,
+		Network: &pb.NetworkConfig{
+			Subnet: pb.NewIPPrefix(netip.MustParsePrefix(prefix)),
+		},
+	}
+}

internal/machine/dns/server.go

@@ -293,13 +293,13 @@ func (s *Server) forwardRequest(req *dns.Msg, proto string) (*dns.Msg, error) {
 // handleAQuery processes an A query for the internal domain and returns A records for the requested name.
 // The internal domain suffix is already stripped from the name. An empty list is returned if no records are found.
 func (s *Server) handleAQuery(name string) []dns.RR {
-	serviceName, mode := extractModeFromDomain(trimInternalDomain(name))
-	ips := s.resolver.Resolve(serviceName)
+	unname, mode := extractModeFromDomain(trimInternalDomain(name))
+	ips := s.resolver.Resolve(unname)
 	if len(ips) == 0 {
-		s.log.Debug("Failed to resolve service name.", "service", serviceName)
+		s.log.Debug("Failed to resolve internal name.", "name", name)
 		return nil
 	}
-	s.log.Debug("Resolved service name.", "service", serviceName, "ips", ips)
+	s.log.Debug("Resolved service internal name.", "name", name, "ips", ips)
 
 	if len(ips) > 1 {
 		// Shuffle the IPs to approximate round-robin.