fix(e2e-tests): handle asynchronous port publishing for ucind container

.editorconfig

@@ -1,20 +0,0 @@
-# EditorConfig is awesome: https://editorconfig.org
-
-root = true
-
-# Default settings for all files
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-# Settings for Go files
-[*.go]
-indent_style = tab
-indent_size = 4
-
-# Settings for Bash scripts
-[*.sh]
-indent_style = space
-indent_size = 4

.github/FUNDING.yml

@@ -1 +0,0 @@
-github: [psviderski]

.github/workflows/go-tests.yml

@@ -1,69 +0,0 @@
-name: Go Tests
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - ".github/**"
-      - "**.go"
-      - "**.proto"
-      - "go.*"
-      - "Makefile"
-      - "scripts/**"
-      - "test/**"
-permissions:
-  contents: read
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "1.23.2"
-
-      - name: Install dependencies
-        run: |
-          go mod tidy
-          git diff --exit-code ||
-            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)
-
-      - name: Run tests
-        run: |
-          make ucind-image
-          make test
-    timeout-minutes: 10
-
-  check-protobuf:
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        # Run on more platforms so that mise lockfile checksums are checked/generated for all platforms.
-        # See https://github.com/jdx/mise/issues/4276 for details.
-        os: [ubuntu-latest, macos-latest]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install Mise
-        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
-        with:
-          version: "2025.6.5"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Generate Protobuf files
-        run: |
-          make proto
-          # check if the generated files are up to date
-          git diff --exit-code ||
-            (echo "Generated protobuf files are not up to date. Please run 'make proto' and commit the changes." && exit 1)

.github/workflows/lint.yml

@@ -1,39 +0,0 @@
-name: Lint
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "**.go"
-      - "go.*"
-permissions:
-  contents: read
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "1.23.2"
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
-        with:
-          version: v2.2.2
-
-      - name: Format code
-        run: |
-          make format
-          git diff --exit-code ||
-            (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
-
-    timeout-minutes: 10

.gitignore

@@ -30,7 +30,6 @@ go.work.sum
 /data/
 /dist/
 /uc
-/tmp
 
 # Web
 node_modules/

.golangci.yaml

@@ -1,42 +0,0 @@
-version: "2"
-
-run:
-  concurrency: 4
-  tests: true
-  timeout: 5m
-
-linters:
-  default: none
-  enable:
-    - bodyclose
-    # - dogsled
-    - dupl
-    # - errcheck
-    - gochecknoinits
-    - goconst
-    # - gocritic
-    # - gocyclo
-    # - godot
-    # - gosec
-    # - govet
-    - ineffassign
-    - misspell
-    - nakedret
-    # - prealloc
-    # - revive
-    # - staticcheck
-    - unconvert
-    # - unparam
-    # - unused
-    - whitespace
-  exclusions:
-    rules:
-      - path: ^test/e2e
-        linters:
-          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
-
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-

.mise.lock

@@ -1,39 +0,0 @@
-[tools.go]
-version = "1.23.10"
-backend = "core:go"
-
-[tools.go.checksums]
-"go1.23.10.darwin-arm64.tar.gz" = "sha256:25c64bfa8a8fd8e7f62fb54afa4354af8409a4bb2358c2699a1003b733e6fce5"
-"go1.23.10.linux-amd64.tar.gz" = "sha256:535f9f81802499f2a7dbfa70abb8fda3793725fcc29460f719815f6e10b5fd60"
-
-[tools.golangci-lint]
-version = "2.2.2"
-backend = "aqua:golangci/golangci-lint"
-
-[tools.golangci-lint.checksums]
-"golangci-lint-2.2.2-darwin-arm64.tar.gz" = "sha256:d84d94d042c0d495fd1746f3d18948a75de163b17a14e8de3ef840928dd2df74"
-"golangci-lint-2.2.2-linux-amd64.tar.gz" = "sha256:c27fbde948a87d326feacd21df2f61a9c54dbd2e3bfa185c0a1cd6917a6f964f"
-
-[tools.protoc]
-version = "27.3"
-backend = "aqua:protocolbuffers/protobuf/protoc"
-
-[tools.protoc.checksums]
-"protoc-27.3-linux-x86_64.zip" = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
-"protoc-27.3-osx-aarch_64.zip" = "sha256:b22116bd97cdbd7ea25346abe635a9df268515fe5ef5afa93cd9a68fc2513f84"
-
-[tools.protoc-gen-go]
-version = "1.34.2"
-backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"
-
-[tools.protoc-gen-go.checksums]
-"protoc-gen-go.v1.34.2.darwin.arm64.tar.gz" = "sha256:17aca7f948dbb624049030cf841e35895cf34183ba006e721247fdeb95ff2780"
-"protoc-gen-go.v1.34.2.linux.amd64.tar.gz" = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"
-
-[tools.protoc-gen-go-grpc]
-version = "1.5.1"
-backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"
-
-[tools.protoc-gen-go-grpc.checksums]
-"protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz" = "sha256:d6083feb51dcfe59f26793e99ef01ef5eac68b64294ec2546711f614ac5878f3"
-"protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz" = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"

.mise.toml

@@ -1,12 +1,5 @@
-[settings]
-experimental = true
-
 [tools]
 go = "1.23"
-golangci-lint = "2.2.2"
-protoc = "27.3"
-protoc-gen-go = "1.34.2"
-protoc-gen-go-grpc = "1.5.1"
 
 [env]
 _.file = ".env"

Dockerfile

@@ -17,22 +17,13 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
-ARG TARGETARCH
+RUN wget -q -O /tmp/corrosion.tar.gz \
-
+      https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz \
-RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
-      "amd64") echo "x86_64" ;; \
-      "arm64") echo "aarch64" ;; \
-      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
-    esac) \
-    && wget -q -O /tmp/corrosion.tar.gz \
-      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
     && install /tmp/corrosion /usr/local/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
-# Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
+FROM chainguard/wolfi-base:latest AS corrosion
-# e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
-FROM gcr.io/distroless/cc-debian12:latest AS corrosion
 COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
 CMD ["corrosion", "agent"]
 

Makefile

@@ -45,69 +45,18 @@ proto:
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
 		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
 
-.PHONY: proto-mise
-proto-mise:
-	mise exec -- protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
-
 .PHONY: corrosion-image
 corrosion-image:
 	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: corrosion-multiarch-image-push
+.PHONY: corrosion-image-push
-corrosion-multiarch-image-push:
+corrosion-image-push: corrosion-image
-	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
+	docker push "$(CORROSION_IMAGE)"
 
 .PHONY: ucind-image
 ucind-image:
 	docker build -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: ucind-multiarch-image-push
+.PHONY: ucind-image-push
-ucind-multiarch-image-push:
+ucind-image-push: ucind-image
-	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
+	docker push "$(UCIND_IMAGE)"
-
-.PHONY: test
-test:
-ifeq ($(TEST_NAME),)
-	go test -count=1 -v ./...
-else
-	go test -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
-endif
-
-.PHONY: test-e2e
-test-e2e:
-	go test -race -count=1 -v ./test/e2e
-
-.PHONY: test-clean
-test-clean:
-	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
-	if [ -n "$$CONTAINERS" ]; then \
-		echo "Killing containers..."; \
-		docker kill $$CONTAINERS; \
-	fi; \
-	CONTAINERS_STOPPED=$$(docker ps -a --filter "name=ucind-test" -q); \
-	if [ -n "$$CONTAINERS_STOPPED" ]; then \
-		echo "Removing stopped containers..."; \
-		docker rm $$CONTAINERS_STOPPED; \
-	else \
-		echo "Nothing to clean."; \
-	fi
-
-.PHONY: vet
-vet:
-	go vet ./...
-
-.PHONY: format fmt
-format fmt:
-	GOOS=linux golangci-lint fmt
-
-LINT_TARGETS := lint lint-and-fix
-.PHONY: $(LINT_TARGETS) _lint
-$(LINT_TARGETS): _lint
-lint: ARGS=
-lint-and-fix: ARGS=--fix
-_lint:
-# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
-# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
-	GOOS=linux golangci-lint run $(ARGS)
-

README.md

@@ -1,13 +1,11 @@
 <div align="center">
-  <img src="./website/landing/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
+  <img src="./website/images/logo.svg" height="100" alt="Uncloud logo"/>
   <h1>Uncloud</h1>
   <p><strong>Docker simplicity. Multi-machine power.</strong></p>
 
   <p>
-    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
     <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
     <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
-    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
   </p>
 </div>
 
@@ -45,23 +43,9 @@ complexity of Kubernetes.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-### 🚀 Coming soon
-
-* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
-  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
-
 ## 🎬 Quick demo
 
-The screenshot below demonstrates how I use Uncloud to deploy https://uncloud.run website to 2 remote machines from
+Deploy a highly available web app with automatic HTTPS across multiple regions and on-premises in just a couple minutes.
-the [`compose.yaml`](website/compose.yaml) file on my local machine.
-
-It exposes the container port `8000/tcp` as HTTPS on the domain `uncloud.run`, served by the Caddy reverse proxy on the
-remote machines. All managed by Uncloud.
-
-![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)
-
-Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
-on-premises in just a couple minutes.
 
 <a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
 <img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
@@ -97,8 +81,6 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    curl -fsS https://get.uncloud.run/install.sh | sh
    ```
 
-   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
-
 2. Initialise your first machine:
 
    ```bash
@@ -130,15 +112,15 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    uncloud-uninstall
    ```
 
-View the [Documentation](https://uncloud.run/docs) for more information.
+View the [user guide](docs/user_guide.md) for more information.
 
 ## ⚙️ How it works
 
-Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
+Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals.
 
 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 
-![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)
 
 <details>
 <summary>Peek under the hood to see what happens when you run certain commands.</summary>
@@ -286,34 +268,8 @@ and there may be breaking changes between releases.
 We'd love your input! Here's how you can contribute:
 
 * 🐛 Found a bug? [Open an issue](https://github.com/psviderski/uncloud/issues)
-* 💡 Have questions, ideas, or need help?
+* 💡 Have ideas or need help? [Join our Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, 
-    * Start a discussion or join an existing one in
+  roadmap, implementation details, and help each other out.
-      the [Discussions](https://github.com/psviderski/uncloud/discussions).
-    * Join our [Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, roadmap, implementation
-      details, and help each other out.
-
-## 🙏 Inspiration & Acknowledgements
-
-I'm grateful to the following projects that inspired Uncloud's design and implementation:
-
-* [Kamal](https://kamal-deploy.org/) — for proving that even in the declarative era of Kubernetes there is a place for
-  simple deployment tools that use imperative commands without complex orchestration. Kamal powers the multi-billion
-  dollar company [37signals](https://37signals.com/) where it was created, and that's truly inspiring!
-* [Fly.io](https://fly.io/) — for inspiring my vision for what self-hosted infrastructure should feel like, proving that
-  developer experience and powerful infrastructure can coexist beautifully.
-* [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
-  user experience that feels like magic.
-* [Talos Linux](https://github.com/siderolabs/talos)
-  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
-  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
-  networking with zero configuration.
-* [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
-  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
-  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
-  complexity of Kubernetes.
-
-Special thanks to the [Corrosion](https://github.com/superfly/corrosion) project by Fly.io for providing the distributed
-SQLite database used to share Uncloud's cluster state.
 
 ## 📫 Stay updated
 

cmd/ucind/cluster/create.go

@@ -2,9 +2,8 @@ package cluster
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewCreateCommand() *cobra.Command {

cmd/ucind/cluster/remove.go

@@ -2,9 +2,8 @@ package cluster
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewRemoveCommand() *cobra.Command {

cmd/ucind/cluster/root.go

@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		// NewListCommand(),
+		//NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd

cmd/uncloud/build.go

@@ -1,77 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	composecli "github.com/compose-spec/compose-go/v2/cli"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/spf13/cobra"
-)
-
-// NewBuildCommand creates a new command to build services from a Compose file.
-func NewBuildCommand() *cobra.Command {
-	opts := cli.BuildOptions{}
-	cmd := &cobra.Command{
-		Use:   "build [FLAGS] [SERVICE...]",
-		Short: "Build services from a Compose file.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if len(args) > 0 {
-				opts.Services = args
-			}
-
-			return runBuild(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
-		"One or more Compose files to build (default compose.yaml)")
-	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
-		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
-		"Push built images to the registry after building. (default false)")
-	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
-		"Do not use cache when building images. (default false)")
-
-	return cmd
-}
-
-// TODO: deduplicate with a similar functino for deploy options
-// projectOpts returns the project options for the Compose file(s).
-func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
-	projectOpts := []composecli.ProjectOptionsFn{}
-
-	if len(opts.Profiles) > 0 {
-		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
-	}
-
-	return projectOpts
-}
-
-// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
-func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
-	projectOpts := projectOptsFromBuildOpts(opts)
-	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
-	if err != nil {
-		return fmt.Errorf("load compose file(s): %w", err)
-	}
-
-	if len(opts.Services) > 0 {
-		project, err = project.WithSelectedServices(opts.Services)
-		if err != nil {
-			return fmt.Errorf("select services: %w", err)
-		}
-	}
-
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
-
-	if len(servicesToBuild) == 0 {
-		fmt.Println("No services to build.")
-		return nil
-	}
-
-	return cli.BuildServices(ctx, servicesToBuild, opts)
-}

cmd/uncloud/deploy.go

@@ -20,7 +20,6 @@ type deployOptions struct {
 	files    []string
 	profiles []string
 	services []string
-	noBuild  bool
 
 	context string
 }
@@ -48,9 +47,6 @@ func NewDeployCommand() *cobra.Command {
 		"One or more Compose profiles to enable.")
 	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
 		"Name of the cluster context to deploy to (default is the current context)")
-	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
-		"Do not build images before deploying services. (default false)")
-
 	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
 	//  Could be useful to test a new version on a subset of machines before rolling out to all.
 
@@ -85,23 +81,6 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}
 
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
-
-	if len(servicesToBuild) > 0 {
-		if opts.noBuild {
-			fmt.Println("Not building services as requested.")
-		} else {
-			buildOpts := cli.BuildOptions{
-				Push:    true,
-				NoCache: false,
-			}
-
-			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
-				return fmt.Errorf("build services: %w", err)
-			}
-		}
-	}
-
 	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)

cmd/uncloud/machine/add.go

@@ -41,7 +41,7 @@ func NewAddCommand() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("parse remote machine: %w", err)
 			}
-			remoteMachine := &cli.RemoteMachine{
+			remoteMachine := cli.RemoteMachine{
 				User:    user,
 				Host:    host,
 				Port:    port,
@@ -59,12 +59,11 @@ func NewAddCommand() *cobra.Command {
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
-			cli.DefaultSSHKeyPath),
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -78,12 +77,12 @@ func NewAddCommand() *cobra.Command {
 	return cmd
 }
 
-func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, opts addOptions) error {
 	var publicIP *netip.Addr
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -93,7 +92,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 		publicIP = &ip
 	}
 
-	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+	machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
@@ -103,7 +102,6 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 	if err != nil {
 		return err
 	}
-	defer clusterClient.Close()
 	defer machineClient.Close()
 
 	if opts.noCaddy {
@@ -119,11 +117,8 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version. Otherwise, use the latest version.
-	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
-	// issues accessing the Machine API of existing machines in the cluster.
-	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
-	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
+	caddySvc, err := machineClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
 		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
@@ -146,7 +141,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 
 	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
 	//  that may cause a small downtime.
-	d, err := clusterClient.NewCaddyDeployment(caddyImage, api.Placement{})
+	d, err := machineClient.NewCaddyDeployment(caddyImage, api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

cmd/uncloud/machine/constants.go

@@ -1,6 +0,0 @@
-package machine
-
-const (
-	// PublicIPNone is the value used to indicate removal of public IP
-	PublicIPNone = "none"
-)

cmd/uncloud/machine/init.go

@@ -77,12 +77,11 @@ func NewInitCommand() *cobra.Command {
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
-			cli.DefaultSSHKeyPath),
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -106,7 +105,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -115,6 +114,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
+	
 	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,

cmd/uncloud/machine/ls.go

@@ -14,18 +14,18 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	var contextName string
+	var clusterContext string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, contextName)
+			return list(cmd.Context(), uncli, clusterContext)
 		},
 	}
 	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
+		&clusterContext, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
@@ -68,8 +68,7 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 		}
 
 		if _, err = fmt.Fprintf(
-			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
+			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP, strings.Join(endpoints, ", "),
-			strings.Join(endpoints, ", "),
 		); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}

cmd/uncloud/machine/rename.go

@@ -1,47 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-func NewRenameCommand() *cobra.Command {
-	var contextName string
-	cmd := &cobra.Command{
-		Use:   "rename OLD_NAME NEW_NAME",
-		Short: "Rename a machine in the cluster.",
-		Long: `Rename a machine in the cluster.
-
-This command changes the name of an existing machine while preserving all other
-configuration including network settings, public IP, and cluster membership.`,
-		Args: cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rename(cmd.Context(), uncli, contextName, args[0], args[1])
-		},
-	}
-	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-	return cmd
-}
-
-func rename(ctx context.Context, uncli *cli.CLI, contextName, oldName, newName string) error {
-	client, err := uncli.ConnectCluster(ctx, contextName)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	machine, err := client.RenameMachine(ctx, oldName, newName)
-	if err != nil {
-		return fmt.Errorf("rename machine: %w", err)
-	}
-
-	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
-	return nil
-}

cmd/uncloud/machine/rm.go

@@ -1,249 +0,0 @@
-package machine
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"sync"
-
-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/lipgloss/tree"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type removeOptions struct {
-	noReset bool
-	yes     bool
-	context string
-}
-
-func NewRmCommand() *cobra.Command {
-	opts := removeOptions{}
-
-	cmd := &cobra.Command{
-		Use:     "rm MACHINE",
-		Aliases: []string{"remove", "delete"},
-		Short:   "Remove a machine from a cluster and reset it.",
-		Args:    cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return remove(cmd.Context(), uncli, args[0], opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Do not prompt for confirmation before removing the machine.")
-	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
-		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")
-
-	return cmd
-}
-
-func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
-	// TODO: automatically choose a connection to the machine that is not being removed.
-	client, err := uncli.ConnectCluster(ctx, opts.context)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	// Verify the machine exists and list all service containers on it including stopped ones.
-	mctx, machines, err := api.ProxyMachinesContext(ctx, client, []string{nameOrID})
-	if err != nil {
-		return err
-	}
-	if len(machines) == 0 {
-		return fmt.Errorf("machine '%s' not found in the cluster", nameOrID)
-	}
-	m := machines[0].Machine
-
-	// Verify if the machine being removed is the proxy machine we're connected to.
-	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("inspect proxy machine: %w", err)
-	}
-	if proxyMachine.Id == m.Id {
-		allMachines, err := client.ListMachines(ctx, nil)
-		if err != nil {
-			return fmt.Errorf("list machines: %w", err)
-		}
-		if len(allMachines) > 1 {
-			return errors.New("cannot remove the machine you are currently connected to. " +
-				"Please connect to another machine in the cluster and try again. " +
-				"Use --connect flag or update 'connections' for the cluster context in your Uncloud config")
-			// It's ok to remove the proxy machine if it's the last one in the cluster.
-		}
-	}
-
-	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
-	//  from being scheduled on it while the removal is in progress.
-
-	reset := !opts.noReset
-	var containers []api.ServiceContainer
-	reachable := false
-	if reset {
-		// Check if the machine is up and has service containers.
-		listOpts := container.ListOptions{All: true}
-		machineContainers, err := client.Docker.ListServiceContainers(mctx, "", listOpts)
-		if err == nil {
-			reachable = true
-			containers = machineContainers[0].Containers
-			if len(containers) > 0 {
-				plural := ""
-				if len(containers) > 1 {
-					plural = "s"
-				}
-				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
-				fmt.Println(formatContainerTree(containers))
-				fmt.Println()
-				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
-					"and reset it to the uninitialised state.")
-			} else {
-				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
-				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
-			}
-		} else {
-			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
-				m.Name)
-		}
-	} else {
-		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
-	}
-
-	if !opts.yes {
-		confirmed, err := cli.Confirm()
-		if err != nil {
-			return fmt.Errorf("confirm removal: %w", err)
-		}
-		if !confirmed {
-			fmt.Println("Cancelled. Machine was not removed.")
-			return nil
-		}
-	}
-
-	if reset && len(containers) > 0 {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			return removeContainers(ctx, client, containers)
-		}, uncli.ProgressOut(), "Removing containers")
-		if err != nil {
-			return fmt.Errorf("remove containers: %w", err)
-		}
-		fmt.Println()
-	}
-
-	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
-		return fmt.Errorf("remove machine from cluster: %w", err)
-	}
-	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
-
-	if reset && reachable {
-		_, err = client.MachineClient.Reset(mctx, &pb.ResetRequest{})
-		if err != nil {
-			fmt.Printf("WARNING: Failed to reset machine: %v\n", err)
-		} else {
-			fmt.Println("Machine reset initiated and will complete in the background.")
-		}
-	}
-
-	// TODO: remove the connection to the machine from the uncloud config if it exists. We need a way to associate
-	//  the machine with its connection in the config, e.g. by storing the machine name in the connection metadata.
-
-	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
-	//  let the user know that the DNS records should be updated.
-
-	return nil
-}
-
-// formatContainerTree formats a list of containers grouped by service as a tree structure.
-func formatContainerTree(containers []api.ServiceContainer) string {
-	if len(containers) == 0 {
-		return ""
-	}
-
-	// Group containers by service.
-	serviceContainers := make(map[string][]api.ServiceContainer)
-	for _, ctr := range containers {
-		serviceName := ctr.ServiceName()
-		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
-	}
-
-	// Build tree output.
-	var output []string
-	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
-	for _, serviceName := range serviceNames {
-		ctrs := serviceContainers[serviceName]
-		mode := ctrs[0].ServiceMode()
-
-		// Format a tree for the service with its containers.
-		plural := ""
-		if len(ctrs) > 1 {
-			plural = "s"
-		}
-		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
-			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
-
-		// Add containers as children.
-		for _, ctr := range ctrs {
-			state, _ := ctr.HumanState()
-			info := fmt.Sprintf("%s • %s • %s", ctr.Name, ctr.Config.Image, state)
-			t.Child(info)
-		}
-
-		output = append(output, t.String())
-	}
-
-	return strings.Join(output, "\n")
-}
-
-// removeContainers removes the given service containers from the machine.
-func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
-	if len(containers) == 0 {
-		return nil
-	}
-
-	wg := sync.WaitGroup{}
-	errCh := make(chan error)
-
-	for _, ctr := range containers {
-		wg.Add(1)
-		go func(c api.ServiceContainer) {
-			defer wg.Done()
-
-			// Gracefully stop the container before removing it.
-			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
-			}
-
-			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
-				// Remove anonymous volumes created by the container.
-				RemoveVolumes: true,
-			})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
-			}
-		}(ctr)
-	}
-
-	go func() {
-		wg.Wait()
-		close(errCh)
-	}()
-
-	var err error
-	for e := range errCh {
-		err = errors.Join(err, e)
-	}
-
-	return err
-}

cmd/uncloud/machine/root.go

@@ -6,17 +6,13 @@ import (
 
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "machine",
+		Use:   "machine",
-		Aliases: []string{"m"},
+		Short: "Manage machines in an Uncloud cluster.",
-		Short:   "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
-		NewRenameCommand(),
-		NewRmCommand(),
-		NewUpdateCommand(),
 		NewTokenCommand(),
 	)
 	return cmd

cmd/uncloud/machine/token.go

@@ -2,10 +2,9 @@ package machine
 
 import (
 	"fmt"
-
+	"github.com/spf13/cobra"
 	"github.com/psviderski/uncloud/internal/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/spf13/cobra"
 )
 
 type tokenOptions struct {

cmd/uncloud/machine/update.go

@@ -1,128 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/spf13/cobra"
-)
-
-type updateOptions struct {
-	name     string
-	publicIP string
-	context  string
-}
-
-func NewUpdateCommand() *cobra.Command {
-	opts := updateOptions{}
-	cmd := &cobra.Command{
-		Use:   "update",
-		Short: "Update machine configuration in the cluster.",
-		Long: `Update machine configuration in the cluster.
-
-This command allows setting various machine properties including:
-- Machine name (--name)
-- Public IP address (--public-ip)
-
-At least one flag must be specified to perform an update operation.`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return update(cmd.Context(), uncli, cmd, opts, args[0])
-		},
-	}
-
-	cmd.Flags().StringVar(
-		&opts.name, "name", "",
-		"New name for the machine",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "",
-		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.", PublicIPNone),
-	)
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
-	return cmd
-}
-
-func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
-	// Check if at least one flag was explicitly set
-	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") {
-		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip)")
-	}
-
-	client, err := uncli.ConnectCluster(ctx, opts.context)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	// First, resolve the machine to get its ID
-	machine, err := client.InspectMachine(ctx, machineNameOrID)
-	if err != nil {
-		return fmt.Errorf("find machine: %w", err)
-	}
-
-	// Build the update request
-	req := &pb.UpdateMachineRequest{
-		MachineId: machine.Machine.Id,
-	}
-
-	if opts.name != "" {
-		req.Name = &opts.name
-	}
-
-	// Check if --public-ip flag was explicitly provided
-	if cmd.Flags().Changed("public-ip") {
-		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
-			req.PublicIp = &pb.IP{} // Empty IP to signal removal
-		} else {
-			// Parse and validate the public IP
-			ip, err := netip.ParseAddr(opts.publicIP)
-			if err != nil {
-				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
-			}
-			req.PublicIp = pb.NewIP(ip)
-		}
-	}
-
-	// Perform the update operation
-	updatedMachine, err := client.UpdateMachine(ctx, req)
-	if err != nil {
-		return fmt.Errorf("update machine: %w", err)
-	}
-
-	// Report what was changed
-	changes := make([]string, 0)
-	if opts.name != "" {
-		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
-	}
-	if cmd.Flags().Changed("public-ip") {
-		oldIP := PublicIPNone
-		if machine.Machine.PublicIp != nil {
-			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
-				oldIP = addr.String()
-			}
-		}
-		newIP := PublicIPNone
-		if updatedMachine.PublicIp != nil {
-			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
-				newIP = addr.String()
-			}
-		}
-		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
-	}
-
-	fmt.Printf("Machine %q (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
-	for _, change := range changes {
-		fmt.Printf("  %s\n", change)
-	}
-
-	return nil
-}

cmd/uncloud/main.go

@@ -75,7 +75,6 @@ func main() {
 
 	cmd.AddCommand(
 		NewDeployCommand(),
-		NewBuildCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),

cmd/uncloud/service/inspect.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
+
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 )

cmd/uncloud/service/run.go

@@ -86,10 +86,9 @@ func NewRunCommand() *cobra.Command {
 			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
 			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
-			"  -p 8080/https                  Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname\n"+
+			"  -p 8080/https                  Publish port 8080 as HTTPS via load balancer with default service-name.cluster-domain hostname\n"+
-			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via reverse proxy with custom hostname\n"+
+			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via load balancer with custom hostname\n"+
-			// TODO: add support for publishing L4 tcp/udp ports.
+			"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via load balancer\n"+
-			//"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via reverse proxy\n"+
 			"  -p 53:5353/udp@host            Bind UDP port 5353 to host port 53")
 	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
 		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",

cmd/uncloudd/main.go

@@ -55,4 +55,5 @@ func main() {
 	}()
 
 	cobra.CheckErr(cmd.ExecuteContext(ctx))
+
 }

docs/README.md

@@ -0,0 +1,41 @@
+# Website
+
+This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
+
+### Installation
+
+```
+$ yarn
+```
+
+### Local Development
+
+```
+$ yarn start
+```
+
+This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
+
+### Build
+
+```
+$ yarn build
+```
+
+This command generates static content into the `build` directory and can be served using any static contents hosting service.
+
+### Deployment
+
+Using SSH:
+
+```
+$ USE_SSH=true yarn deploy
+```
+
+Not using SSH:
+
+```
+$ GIT_USER=<Your GitHub username> yarn deploy
+```
+
+If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.

docs/docs/overview.md

@@ -0,0 +1,9 @@
+---
+slug: /
+---
+
+# Overview
+
+Uncloud is lightweight tool for creating a cluster of machines running Docker and deploying web applications across
+them. It is designed to be simple and easy to use, while still providing the essential features to manage and scale
+your apps in production.

docs/docusaurus.config.js

@@ -10,12 +10,12 @@ import {themes as prismThemes} from 'prism-react-renderer';
 
 /** @type {import('@docusaurus/types').Config} */
 const config = {
-  title: 'Uncloud',
+  title: 'Uncloud Docs',
-  tagline: 'Self-host and scale web apps without Kubernetes complexity',
+  tagline: 'Dinosaurs are cool',
   favicon: 'img/favicon.png',
 
   // Set the production url of your site here
-  url: 'https://uncloud.run',
+  url: 'https://docs.uncloud.run',
   // Set the /<baseUrl>/ pathname under which your site is served
   // For GitHub pages deployment, it is often '/<projectName>/'
   baseUrl: '/',
@@ -54,30 +54,27 @@ const config = {
       ({
         docs: {
           // Remove this to remove the "edit this page" links.
-          editUrl: 'https://github.com/psviderski/uncloud/edit/main/website/',
+          editUrl: 'https://github.com/psviderski/uncloud/edit/main/docs/',
           // Serve the docs at the site's root.
-          // routeBasePath: '/',
+          routeBasePath: '/',
           showLastUpdateTime: true,
           sidebarPath: './sidebars.js',
         },
-        blog: {
+        // blog: {
-          blogDescription: 'Blog posts from the Uncloud team and community',
+        //   showReadingTime: true,
-          blogSidebarTitle: 'All posts',
+        //   feedOptions: {
-          blogSidebarCount: 'ALL',
+        //     type: ['rss', 'atom'],
-          showReadingTime: true,
+        //     xslt: true,
-          feedOptions: {
+        //   },
-            type: ['rss', 'atom'],
+        //   // Please change this to your repo.
-            xslt: true,
+        //   // Remove this to remove the "edit this page" links.
-          },
+        //   editUrl:
-          // Please change this to your repo.
+        //     'https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/',
-          // Remove this to remove the "edit this page" links.
+        //   // Useful options to enforce blogging best practices
-          // editUrl:
+        //   onInlineTags: 'warn',
-          //   'https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/',
+        //   onInlineAuthors: 'warn',
-          // Useful options to enforce blogging best practices
+        //   onUntruncatedBlogPosts: 'warn',
-          onInlineTags: 'warn',
+        // },
-          onInlineAuthors: 'warn',
-          onUntruncatedBlogPosts: 'warn',
-        },
         theme: {
           customCss: './src/css/custom.css',
         },
@@ -99,24 +96,12 @@ const config = {
       // Relative to your site's "static" directory. Cannot be SVGs. Can be external URLs too.
       image: 'img/social-card.png',
       navbar: {
-        title: 'Uncloud',
+        title: 'Uncloud Docs',
         logo: {
           alt: 'Uncloud Logo',
           src: 'img/logo.svg',
-          href: 'https://uncloud.run',
         },
         items: [
-          {
-            type: 'doc',
-            docId: 'overview',
-            label: 'Docs',
-            position: 'left',
-          },
-          {
-            to: 'blog',
-            label: 'Blog',
-            position: 'left',
-          },
           {
             type: 'search',
             position: 'right',
@@ -159,8 +144,8 @@ const config = {
         ]
       },
       prism: {
-        theme: prismThemes.palenight,
+        theme: prismThemes.github,
-        //darkTheme: prismThemes.dracula,
+        darkTheme: prismThemes.dracula,
       },
     }),
 };

docs/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "docs",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "docusaurus": "docusaurus",
+    "start": "docusaurus start",
+    "build": "docusaurus build",
+    "swizzle": "docusaurus swizzle",
+    "deploy": "docusaurus deploy",
+    "clear": "docusaurus clear",
+    "serve": "docusaurus serve",
+    "write-translations": "docusaurus write-translations",
+    "write-heading-ids": "docusaurus write-heading-ids"
+  },
+  "dependencies": {
+    "@docusaurus/core": "3.7.0",
+    "@docusaurus/preset-classic": "3.7.0",
+    "@easyops-cn/docusaurus-search-local": "^0.49.2",
+    "@mdx-js/react": "^3.0.0",
+    "clsx": "^2.0.0",
+    "prism-react-renderer": "^2.3.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@docusaurus/module-type-aliases": "3.7.0",
+    "@docusaurus/types": "3.7.0"
+  },
+  "browserslist": {
+    "production": [
+      ">0.5%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 3 chrome version",
+      "last 3 firefox version",
+      "last 5 safari version"
+    ]
+  },
+  "engines": {
+    "node": ">=18.0"
+  }
+}

docs/sidebars.js

@@ -16,7 +16,7 @@
  */
 const sidebars = {
   // By default, Docusaurus generates a sidebar from the docs folder structure
-  sidebar: [{type: 'autogenerated', dirName: '.'}],
+  tutorialSidebar: [{type: 'autogenerated', dirName: '.'}],
 
   // But you can create a sidebar manually
   /*

docs/src/css/custom.css

@@ -11,26 +11,26 @@
   --ifm-font-family-base: 'Inter', sans-serif;
   --ifm-heading-font-family: 'Inter', sans-serif;
 
-  --ifm-color-primary: #006be6;
+  --ifm-color-primary: #2e8555;
-  --ifm-color-primary-dark: #0060cf;
+  --ifm-color-primary-dark: #29784c;
-  --ifm-color-primary-darker: #005bc4;
+  --ifm-color-primary-darker: #277148;
-  --ifm-color-primary-darkest: #004ba1;
+  --ifm-color-primary-darkest: #205d3b;
-  --ifm-color-primary-light: #0076fd;
+  --ifm-color-primary-light: #33925d;
-  --ifm-color-primary-lighter: #0a7cff;
+  --ifm-color-primary-lighter: #359962;
-  --ifm-color-primary-lightest: #2c8eff;
+  --ifm-color-primary-lightest: #3cad6e;
   --ifm-code-font-size: 95%;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.1);
 }
 
 /* For readability concerns, you should choose a lighter palette in dark mode. */
 [data-theme='dark'] {
-  --ifm-color-primary: #3391ee;
+  --ifm-color-primary: #25c2a0;
-  --ifm-color-primary-dark: #1883ec;
+  --ifm-color-primary-dark: #21af90;
-  --ifm-color-primary-darker: #137be3;
+  --ifm-color-primary-darker: #1fa588;
-  --ifm-color-primary-darkest: #1066bb;
+  --ifm-color-primary-darkest: #1a8870;
-  --ifm-color-primary-light: #4e9ff0;
+  --ifm-color-primary-light: #29d5b0;
-  --ifm-color-primary-lighter: #5ba7f1;
+  --ifm-color-primary-lighter: #32d8b4;
-  --ifm-color-primary-lightest: #83bcf5;
+  --ifm-color-primary-lightest: #4fddbf;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.3);
 }
 

docs/user_guide.md

@@ -20,7 +20,7 @@ Uncloud stores its configuration in `~/.config/uncloud/config.yaml`. If you wish
 
 ### Initialisation
 
-Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`. If you want to avoid using uncloud's managed DNS service, add the `--no-dns` flag.
+Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`.
 
 This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].cluster.uncloud.run`.
 
@@ -37,7 +37,6 @@ Uncloud (uncloud.run) DNS can be managed with the `uc dns` subcommand.
 * To reserve a domain name, run `uc dns reserve`
 * To release a domain name, run `uc dns release`.
 * To see the domain name, run `uc dns show`
-* To avoid using the Uncloud managed DNS service, use the `--no-dns` flag on your `uc machine init` command.
 
 ### Running a service
 

experiment/broadcaster.go

@@ -3,11 +3,10 @@ package main
 import (
 	"context"
 	"fmt"
-	"log/slog"
-	"time"
-
 	"github.com/hashicorp/serf/serf"
 	crdt "github.com/ipfs/go-ds-crdt"
+	"log/slog"
+	"time"
 )
 
 // Implements the Broadcaster interface.

experiment/explorer/explorer.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"fmt"
+	"github.com/dgraph-io/badger/v3"
 	"log"
 	"time"
-
-	"github.com/dgraph-io/badger/v3"
 )
 
 func customTimeEncoder(t time.Time) string {

experiment/logger.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"fmt"
+	"github.com/ipfs/go-log/v2"
 	"log/slog"
 	"os"
-
-	"github.com/ipfs/go-log/v2"
 )
 
 // ipfsLogger is an slog logger that implements the IPFS go-log StandardLogger interface.

experiment/networkdb/main.go

@@ -2,13 +2,12 @@ package main
 
 import (
 	"fmt"
+	"github.com/docker/docker/libnetwork/networkdb"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
-
-	"github.com/docker/docker/libnetwork/networkdb"
 )
 
 func main() {

experiment/serf_crdt.go

@@ -4,13 +4,6 @@ import (
 	"context"
 	"flag"
 	"fmt"
-	"log/slog"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
 	"github.com/hashicorp/memberlist"
 	"github.com/hashicorp/serf/cmd/serf/command/agent"
 	"github.com/hashicorp/serf/serf"
@@ -18,6 +11,12 @@ import (
 	badger "github.com/ipfs/go-ds-badger3"
 	crdt "github.com/ipfs/go-ds-crdt"
 	"github.com/lmittmann/tint"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
 )
 
 func createSerfAgentConfig(name, bindAddr, rpcAddr, profile string) *agent.Config {
@@ -50,9 +49,9 @@ func createSerfAgent(config *agent.Config) (*agent.Agent, error) {
 
 	serfConfig.MemberlistConfig.BindAddr = bindIP
 	serfConfig.MemberlistConfig.BindPort = bindPort
-	// serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
+	//serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
-	// serfConfig.MemberlistConfig.AdvertisePort = advertisePort
+	//serfConfig.MemberlistConfig.AdvertisePort = advertisePort
-	// serfConfig.MemberlistConfig.SecretKey = encryptKey
+	//serfConfig.MemberlistConfig.SecretKey = encryptKey
 	serfConfig.NodeName = config.NodeName
 	serfConfig.Tags = config.Tags
 	serfConfig.SnapshotPath = config.SnapshotPath
@@ -130,7 +129,7 @@ func main() {
 	logger := slog.New(tint.NewHandler(os.Stdout, &tint.Options{
 		AddSource: true,
 		Level:     slog.LevelDebug,
-		// Level:      slog.LevelInfo,
+		//Level:      slog.LevelInfo,
 		TimeFormat: time.RFC3339Nano,
 	}))
 	slog.SetDefault(logger)
@@ -165,7 +164,7 @@ func main() {
 
 	opts := crdt.DefaultOptions()
 	opts.Logger = newIPFSLogger(logger)
-	// opts.MultiHeadProcessing = true
+	//opts.MultiHeadProcessing = true
 	// TODO: debug why the heads count may grow on the receiving side if the event backlog is huge and the processing
 	//  is slow.
 	store, err := crdt.New(localStore, ds.NewKey("/"), syncer, broadcaster, opts)
@@ -173,7 +172,7 @@ func main() {
 		panic(err)
 	}
 
-	// ticker := time.NewTicker(10 * time.Millisecond)
+	//ticker := time.NewTicker(10 * time.Millisecond)
 	ticker := time.NewTicker(3 * time.Second)
 	go func() {
 		for {

experiment/syncer.go

@@ -4,19 +4,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
-
 	"github.com/hashicorp/serf/serf"
 	"github.com/ipfs/boxo/datastore/dshelp"
 	dag "github.com/ipfs/boxo/ipld/merkledag"
 	"github.com/ipfs/go-cid"
 	ds "github.com/ipfs/go-datastore"
 	ipld "github.com/ipfs/go-ipld-format"
+	"log/slog"
 )
 
 // Implements the DAGService interface.
 // TODO: implement SessionDAGService to optimize node fetching.
-// TODO: persistentSerfDAG?
+// TOOD: persistentSerfDAG?
 type dagSyncer struct {
 	// Persistent storage for the nodes.
 	store     ds.Datastore
@@ -51,7 +50,8 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 	}
 	slog.Debug("Queried node from peers", "cid", cid, "deadline", query.Deadline())
 
-	for {
+	responded := false
+	for !responded {
 		select {
 		case resp, ok := <-query.ResponseCh():
 			if !ok {
@@ -63,6 +63,7 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 				continue
 			}
 			slog.Debug("Received node from peer", "cid", cid, "peer", resp.From)
+			responded = true
 			query.Close()
 
 			node, err = nodeFromBytes(resp.Payload)

experiment/talos_discovery.go

@@ -6,13 +6,12 @@ import (
 	"crypto/cipher"
 	"encoding/hex"
 	"fmt"
-	"net/netip"
-	"time"
-
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/siderolabs/discovery-api/api/v1alpha1/client/pb"
 	discovery "github.com/siderolabs/discovery-client/pkg/client"
 	"go.uber.org/zap"
+	"net/netip"
+	"time"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (

go.mod

@@ -2,6 +2,8 @@ module github.com/psviderski/uncloud
 
 go 1.23.0
 
+toolchain go1.23.2
+
 require (
 	github.com/BurntSushi/toml v1.4.0
 	github.com/Masterminds/semver v1.5.0
@@ -35,7 +37,6 @@ require (
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lmittmann/tint v1.0.5
 	github.com/miekg/dns v1.1.65
-	github.com/moby/term v0.5.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/siderolabs/discovery-api v0.1.4
@@ -212,8 +213,7 @@ require (
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect

go.sum

@@ -105,8 +105,6 @@ github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
-github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -155,8 +153,6 @@ github.com/charmbracelet/lipgloss v0.13.0 h1:4X3PPeoWEDCMvzDvGmTajSyYPcZM4+y8sCA
 github.com/charmbracelet/lipgloss v0.13.0/go.mod h1:nw4zy0SBX/F/eAO1cWdcvy6qnkDUxr8Lw7dvFrAIbbY=
 github.com/charmbracelet/x/ansi v0.3.2 h1:wsEwgAN+C9U06l9dCVMX0/L3x7ptvY1qmjMwyfE6USY=
 github.com/charmbracelet/x/ansi v0.3.2/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b h1:MnAMdlwSltxJyULnrYbkZpp4k58Co7Tah3ciKhSNo0Q=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a h1:JMdM89Udp/cOl5tC3MuUJXTPE/nAdU1oyt9jRU44qq8=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a/go.mod h1:pBhA0ybfXv6hDjQUZ7hk1lVxBiUbupdw5R31yPUViVQ=
 github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4hwm0x0=

internal/cli/build.go

@@ -1,176 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-
-	composetypes "github.com/compose-spec/compose-go/v2/types"
-	"github.com/distribution/reference"
-	"github.com/docker/cli/cli/config"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/image"
-	dockerclient "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/jsonmessage"
-	"github.com/docker/docker/registry"
-	"github.com/moby/term"
-)
-
-type BuildOptions struct {
-	Files    []string
-	Profiles []string
-	Services []string
-	Push     bool
-	NoCache  bool
-}
-
-// GetServicesThatNeedBuild returns a map of services that require building
-func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
-	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
-	for serviceName, service := range project.Services {
-		if service.Build == nil {
-			continue
-		}
-		servicesToBuild[serviceName] = service
-	}
-	return servicesToBuild
-}
-
-// BuildServices builds the services defined in the provided map.
-func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
-	fmt.Println("Building services...")
-
-	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
-	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
-	if err != nil {
-		return err
-	}
-	defer dockerCli.Close()
-
-	serviceImages := make(map[string]string, len(servicesToBuild))
-
-	// Build the services using the local docker client and compose libraries
-	for _, service := range servicesToBuild {
-		fmt.Printf("Building service: %s\n", service.Name)
-		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
-		if err != nil {
-			return fmt.Errorf("build service %s: %w", service.Name, err)
-		}
-		serviceImages[service.Name] = imageName
-	}
-	fmt.Printf("Service images are built.\n")
-
-	if opts.Push {
-		err = pushServiceImages(ctx, dockerCli, serviceImages)
-	}
-
-	return err
-}
-
-// buildSingleService builds a single service using the Docker client and Compose libraries.
-func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
-	if service.Build == nil {
-		return "", fmt.Errorf("service %s has no build configuration", service.Name)
-	}
-	if service.Image == "" {
-		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet", service.Name)
-	}
-
-	buildContextPath := service.Build.Context
-	imageName := service.Image
-
-	// Create a tar archive of the build context
-	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
-	if err != nil {
-		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
-	}
-
-	buildOptions := types.ImageBuildOptions{
-		// TODO: Support Dockerfiles outside the build context
-		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
-		Dockerfile: service.Build.Dockerfile,
-		Tags:       []string{imageName},
-		Remove:     true, // Remove intermediate containers
-		NoCache:    opts.NoCache,
-	}
-
-	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
-	if err != nil {
-		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
-	}
-	defer buildResponse.Body.Close()
-
-	// Display the build response
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(buildResponse.Body, os.Stdout, fd, isTerminal, nil); err != nil {
-		return "", fmt.Errorf("failed to display build response for service %s: %w", service.Name, err)
-	}
-
-	return imageName, nil
-}
-
-// pushSingleServiceImage pushes a single service image.
-func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
-	ref, err := reference.ParseNormalizedNamed(imageName)
-	if err != nil {
-		return err
-	}
-
-	repoInfo, err := registry.ParseRepositoryInfo(ref)
-	if err != nil {
-		return err
-	}
-
-	registryKey := repoInfo.Index.Name
-	if repoInfo.Index.Official {
-		registryKey = registry.IndexServer
-	}
-
-	// Load the Docker config file with auth details, if available
-	configFile := config.LoadDefaultConfigFile(os.Stderr)
-
-	authConfig, err := configFile.GetAuthConfig(registryKey)
-	if err != nil {
-		return err
-	}
-
-	authJSON, err := json.Marshal(authConfig)
-	if err != nil {
-		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
-	}
-
-	authStr := base64.URLEncoding.EncodeToString(authJSON)
-
-	pushOptions := image.PushOptions{
-		RegistryAuth: authStr,
-	}
-	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
-	if err != nil {
-		return fmt.Errorf("failed to push image %s: %w", imageName, err)
-	}
-	defer pushResponse.Close()
-
-	fmt.Printf("Pushing image %s for service %s...\n", imageName, serviceName)
-
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(pushResponse, os.Stdout, fd, isTerminal, nil); err != nil {
-		return fmt.Errorf("failed to display push response for image %s: %w", imageName, err)
-	}
-
-	fmt.Printf("Image %s pushed successfully.\n", imageName)
-	return nil
-}
-
-// pushServiceImages pushes all built service images to the registry.
-func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
-	fmt.Printf("Pushing images...\n")
-	for serviceName, imageName := range serviceImages {
-		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
-			return fmt.Errorf("push image for service %s: %w", serviceName, err)
-		}
-	}
-	return nil
-}

internal/cli/cli.go

@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"net/netip"
 	"os"
-	"slices"
 
+	"github.com/charmbracelet/huh"
 	"github.com/docker/cli/cli/streams"
 	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/fs"
@@ -22,12 +22,7 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const (
+const defaultContextName = "default"
-	// DefaultSSHKeyPath is the fallback location for the SSH private key when provisioning remote machines.
-	// Used when no key is explicitly provided and SSH agent authentication fails.
-	DefaultSSHKeyPath  = "~/.ssh/id_ed25519"
-	defaultContextName = "default"
-)
 
 type CLI struct {
 	Config *config.Config
@@ -178,7 +173,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("cluster context '%s' already exists", contextName)
 	}
 
-	machineClient, err := provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, *opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -195,7 +190,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
+		if err = cli.promptResetMachine(); err != nil {
 			return nil, err
 		}
 	}
@@ -254,32 +249,26 @@ type AddMachineOptions struct {
 	Context       string
 	MachineName   string
 	PublicIP      *netip.Addr
-	RemoteMachine *RemoteMachine
+	RemoteMachine RemoteMachine
 	Version       string
 }
 
-// AddMachine provisions a remote machine and adds it to the cluster. It returns a cluster client and a machine client.
+// AddMachine provisions a remote machine and adds it to the cluster. It returns a client to interact with the machine
-// The cluster client is connected to the existing machine in the cluster. It was used to add the new machine to the
+// which should be closed after use by the caller.
-// cluster. The machine client is connected to the new machine and can be used to interact with it.
+func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, error) {
-// Both client should be closed after use by the caller.
-func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
 	contextName := opts.Context
 	if contextName == "" {
 		contextName = cli.Config.CurrentContext
 	}
 	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
-		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
+		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
-	defer func() {
+	defer c.Close()
-		if err != nil {
-			c.Close()
-		}
-	}()
 
-	machineClient, err := provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 	defer func() {
 		if err != nil {
@@ -290,22 +279,11 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// Check if the machine is already initialised as a cluster member and prompt the user to reset it first.
 	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, nil, fmt.Errorf("inspect machine: %w", err)
+		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		// Check if the machine is already a member of this cluster.
+		if err = cli.promptResetMachine(); err != nil {
-		machines, err := c.ListMachines(ctx, nil)
+			return nil, err
-		if err != nil {
-			return nil, nil, fmt.Errorf("list cluster machines: %w", err)
-		}
-		if slices.ContainsFunc(machines, func(m *pb.MachineMember) bool {
-			return m.Machine.Id == minfo.Id
-		}) {
-			return nil, nil, fmt.Errorf("machine is already a member of this cluster (%s)", minfo.Name)
-		}
-
-		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
-			return nil, nil, err
 		}
 	}
 
@@ -314,19 +292,19 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
 	if err != nil {
 		if status.Convert(err).Code() != codes.Unimplemented {
-			return nil, nil, fmt.Errorf("check machine prerequisites: %w", err)
+			return nil, fmt.Errorf("check machine prerequisites: %w", err)
 		}
 	} else if !checkResp.Satisfied {
-		return nil, nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
+		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
 	}
 
 	tokenResp, err := machineClient.Token(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, nil, fmt.Errorf("get remote machine token: %w", err)
+		return nil, fmt.Errorf("get remote machine token: %w", err)
 	}
 	token, err := machine.ParseToken(tokenResp.Token)
 	if err != nil {
-		return nil, nil, fmt.Errorf("parse remote machine token: %w", err)
+		return nil, fmt.Errorf("parse remote machine token: %w", err)
 	}
 
 	// Register the machine in the cluster using its public key and endpoints from the token.
@@ -352,13 +330,13 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 
 	addResp, err := c.AddMachine(ctx, addReq)
 	if err != nil {
-		return nil, nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
+		return nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}
 
-	// Get the most up-to-date list of other machines in the cluster to include them in the join request.
+	// List other machines in the cluster to include them in the join request.
 	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
-		return nil, nil, fmt.Errorf("list cluster machines: %w", err)
+		return nil, fmt.Errorf("list cluster machines: %w", err)
 	}
 	otherMachines := make([]*pb.MachineInfo, 0, len(machines)-1)
 	for _, m := range machines {
@@ -373,7 +351,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		OtherMachines: otherMachines,
 	}
 	if _, err = machineClient.JoinCluster(ctx, joinReq); err != nil {
-		return nil, nil, fmt.Errorf("join cluster: %w", err)
+		return nil, fmt.Errorf("join cluster: %w", err)
 	}
 
 	// TODO: fix empty context name when using the current context (contextName == "").
@@ -389,29 +367,20 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
-		return nil, nil, fmt.Errorf("save config: %w", err)
+		return nil, fmt.Errorf("save config: %w", err)
 	}
 
-	return c, machineClient, nil
+	return machineClient, nil
 }
 
 // provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns
 // a machine API client to interact with the machine. The client should be closed after use by the caller.
 // The version parameter specifies the version of the Uncloud daemon to install. If empty, the latest version is used.
-// The remoteMachine.SSHKeyPath could be updated to the default SSH key path if it is not set and the SSH agent
+func (cli *CLI) provisionRemoteMachine(
-// authentication fails.
+	ctx context.Context, remoteMachine RemoteMachine, version string,
-func provisionRemoteMachine(
-	ctx context.Context, remoteMachine *RemoteMachine, version string,
 ) (*client.Client, error) {
 	// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
-	// If the SSH connection using SSH agent fails and no key path is provided, try to use the default SSH key.
-	if err != nil && remoteMachine.KeyPath == "" {
-		remoteMachine.KeyPath = DefaultSSHKeyPath
-		sshClient, err = sshexec.Connect(
-			remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath,
-		)
-	}
 	if err != nil {
 		return nil, fmt.Errorf(
 			"SSH login to remote machine %s: %w",
@@ -445,6 +414,31 @@ func provisionRemoteMachine(
 	return machineClient, nil
 }
 
+func (cli *CLI) promptResetMachine() error {
+	var confirm bool
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(
+					"The remote machine is already initialised as a cluster member. Do you want to reset it first?",
+				).
+				Affirmative("Yes!").
+				Negative("No").
+				Value(&confirm),
+		),
+	).WithAccessible(true)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("prompt user to confirm: %w", err)
+	}
+
+	if !confirm {
+		return fmt.Errorf("remote machine is already initialised as a cluster member")
+	}
+	// TODO: implement resetting the remote machine.
+	return fmt.Errorf("resetting the remote machine is not implemented yet. " +
+		"Please manually run 'uncloud-uninstall' on the remote machine to fully uninstall Uncloud from it")
+}
+
 // ProgressOut returns an output stream for progress writer.
 func (cli *CLI) ProgressOut() *streams.Out {
 	return streams.NewOut(os.Stdout)

internal/cli/config/config.go

@@ -53,11 +53,11 @@ func (c *Config) Read() error {
 
 func (c *Config) Save() error {
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0o700); err != nil {
+	if err := os.MkdirAll(dir, 0700); err != nil {
 		return fmt.Errorf("create config directory '%s': %w", dir, err)
 	}
 
-	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return fmt.Errorf("write config file '%s': %w", c.path, err)
 	}

internal/cli/machine.go

@@ -5,20 +5,12 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"time"
 
-	"github.com/cenkalti/backoff/v4"
-	"github.com/charmbracelet/huh"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/sshexec"
-	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const (
+// TODO: support pinning the script version to the CLI version.
-	// TODO: support pinning the script version to the CLI version.
+const installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
-	installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
-	rootUser         = "root"
-)
 
 type RemoteMachine struct {
 	User    string
@@ -32,7 +24,7 @@ func installCmd(user string, version string) string {
 	var env []string
 
 	// Add the SSH user (non-root) to the uncloud group to allow access to the Uncloud daemon unix socket.
-	if user != rootUser {
+	if user != "root" {
 		sudoPrefix = "sudo"
 		env = append(env, "UNCLOUD_GROUP_ADD_USER="+sshexec.Quote(user))
 	}
@@ -54,26 +46,6 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 		return fmt.Errorf("run whoami: %w", err)
 	}
 
-	if user != rootUser {
-		// 'sudo -n' is not used because it fails with 'sudo: a password is required' when the user has no password
-		// in /etc/shadow even though it may have valid sudo access.
-		out, err := exec.Run(ctx, "sudo true")
-		if err != nil {
-			if strings.Contains(out, "password is required") {
-				return fmt.Errorf(
-					"user '%[1]s' requires a password for sudo, but Uncloud needs passwordless sudo or root access "+
-						"to install and configure the uncloudd daemon on the remote machine.\n\n"+
-						"Possible solutions:\n"+
-						"1. Use root user or a user with passwordless sudo instead.\n"+
-						"2. Configure passwordless sudo for the user '%[1]s' by running on the remote machine:\n"+
-						"   echo '%[1]s ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/%[1]s",
-					user)
-			}
-			return fmt.Errorf("sudo command failed for user '%s': %w. "+
-				"Please ensure the user has sudo privileges or use root user instead", user, err)
-		}
-	}
-
 	cmd := installCmd(user, version)
 
 	fmt.Println("Downloading Uncloud install script:", installScriptURL)
@@ -84,56 +56,3 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 	}
 	return nil
 }
-
-func promptResetMachine(ctx context.Context, machineClient pb.MachineClient) error {
-	var confirm bool
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewConfirm().
-				Title(
-					"The remote machine is already initialised as a cluster member. Do you want to reset it first?\n" +
-						"This will:\n" +
-						"- Remove all service containers from the machine\n" +
-						"- Reset the machine to the uninitialised state",
-				).
-				Affirmative("Yes!").
-				Negative("No").
-				Value(&confirm),
-		),
-	).WithAccessible(true)
-	if err := form.Run(); err != nil {
-		return fmt.Errorf("prompt user to confirm: %w", err)
-	}
-
-	if !confirm {
-		return fmt.Errorf("remote machine is already initialised as a cluster member")
-	}
-
-	if _, err := machineClient.Reset(ctx, &pb.ResetRequest{}); err != nil {
-		return fmt.Errorf("reset remote machine: %w. You can also manually run 'uncloud-uninstall' "+
-			"on the remote machine to fully uninstall Uncloud from it", err)
-	}
-	fmt.Println("Resetting the remote machine...")
-	if err := waitMachineReady(ctx, machineClient, 1*time.Minute); err != nil {
-		return fmt.Errorf("wait for machine to be ready after reset: %w", err)
-	}
-
-	return nil
-}
-
-// waitMachineReady waits for the machine to be ready to serve requests.
-func waitMachineReady(ctx context.Context, machineClient pb.MachineClient, timeout time.Duration) error {
-	boff := backoff.WithContext(backoff.NewExponentialBackOff(
-		backoff.WithMaxInterval(1*time.Second),
-		backoff.WithMaxElapsedTime(timeout),
-	), ctx)
-
-	inspect := func() error {
-		_, err := machineClient.Inspect(ctx, &emptypb.Empty{})
-		if err != nil {
-			return fmt.Errorf("inspect machine: %w", err)
-		}
-		return nil
-	}
-	return backoff.Retry(inspect, boff)
-}

internal/corrosion/client.go

@@ -5,15 +5,14 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"github.com/cenkalti/backoff/v4"
+	"golang.org/x/net/http2"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"golang.org/x/net/http2"
 )
 
 const (

internal/corrosion/subscribe.go

@@ -6,12 +6,11 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/cenkalti/backoff/v4"
 	"io"
 	"log/slog"
 	"net/http"
 	"strconv"
-
-	"github.com/cenkalti/backoff/v4"
 )
 
 type ChangeType string

internal/daemon/daemon.go

@@ -3,9 +3,8 @@ package daemon
 import (
 	"context"
 	"fmt"
-	"log/slog"
-
 	systemd "github.com/coreos/go-systemd/daemon"
+	"log/slog"
 	"github.com/psviderski/uncloud/internal/machine"
 )
 

internal/daemon/token.go

@@ -3,11 +3,10 @@ package daemon
 import (
 	"errors"
 	"fmt"
-	"net/netip"
-	"os"
-
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/network"
+	"net/netip"
+	"os"
 )
 
 // MachineToken returns the local machine's token that can be used for adding the machine to a cluster.

internal/docker/client.go

@@ -4,11 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
-	"time"
-
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/client"
+	"log/slog"
+	"time"
 )
 
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.

internal/machine/api/pb/cluster.pb.go

@@ -124,7 +124,7 @@ func (x DNSRecord_RecordType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use DNSRecord_RecordType.Descriptor instead.
 func (DNSRecord_RecordType) EnumDescriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11, 0}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8, 0}
 }
 
 type AddMachineRequest struct {
@@ -339,173 +339,6 @@ func (x *ListMachinesResponse) GetMachines() []*MachineMember {
 	return nil
 }
 
-type UpdateMachineRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Machine to update
-	MachineId string `protobuf:"bytes,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
-	// Updated machine information
-	Name      *string   `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
-	PublicIp  *IP       `protobuf:"bytes,3,opt,name=public_ip,json=publicIp,proto3,oneof" json:"public_ip,omitempty"`
-	Endpoints []*IPPort `protobuf:"bytes,4,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
-}
-
-func (x *UpdateMachineRequest) Reset() {
-	*x = UpdateMachineRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UpdateMachineRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateMachineRequest) ProtoMessage() {}
-
-func (x *UpdateMachineRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateMachineRequest.ProtoReflect.Descriptor instead.
-func (*UpdateMachineRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *UpdateMachineRequest) GetMachineId() string {
-	if x != nil {
-		return x.MachineId
-	}
-	return ""
-}
-
-func (x *UpdateMachineRequest) GetName() string {
-	if x != nil && x.Name != nil {
-		return *x.Name
-	}
-	return ""
-}
-
-func (x *UpdateMachineRequest) GetPublicIp() *IP {
-	if x != nil {
-		return x.PublicIp
-	}
-	return nil
-}
-
-func (x *UpdateMachineRequest) GetEndpoints() []*IPPort {
-	if x != nil {
-		return x.Endpoints
-	}
-	return nil
-}
-
-type UpdateMachineResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Machine *MachineInfo `protobuf:"bytes,1,opt,name=machine,proto3" json:"machine,omitempty"`
-}
-
-func (x *UpdateMachineResponse) Reset() {
-	*x = UpdateMachineResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UpdateMachineResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateMachineResponse) ProtoMessage() {}
-
-func (x *UpdateMachineResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateMachineResponse.ProtoReflect.Descriptor instead.
-func (*UpdateMachineResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *UpdateMachineResponse) GetMachine() *MachineInfo {
-	if x != nil {
-		return x.Machine
-	}
-	return nil
-}
-
-type RemoveMachineRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-}
-
-func (x *RemoveMachineRequest) Reset() {
-	*x = RemoveMachineRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RemoveMachineRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RemoveMachineRequest) ProtoMessage() {}
-
-func (x *RemoveMachineRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RemoveMachineRequest.ProtoReflect.Descriptor instead.
-func (*RemoveMachineRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *RemoveMachineRequest) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
 type Domain struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -517,7 +350,7 @@ type Domain struct {
 func (x *Domain) Reset() {
 	*x = Domain{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -530,7 +363,7 @@ func (x *Domain) String() string {
 func (*Domain) ProtoMessage() {}
 
 func (x *Domain) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -543,7 +376,7 @@ func (x *Domain) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Domain.ProtoReflect.Descriptor instead.
 func (*Domain) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *Domain) GetName() string {
@@ -564,7 +397,7 @@ type ReserveDomainRequest struct {
 func (x *ReserveDomainRequest) Reset() {
 	*x = ReserveDomainRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -577,7 +410,7 @@ func (x *ReserveDomainRequest) String() string {
 func (*ReserveDomainRequest) ProtoMessage() {}
 
 func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -590,7 +423,7 @@ func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReserveDomainRequest.ProtoReflect.Descriptor instead.
 func (*ReserveDomainRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ReserveDomainRequest) GetEndpoint() string {
@@ -611,7 +444,7 @@ type CreateDomainRecordsRequest struct {
 func (x *CreateDomainRecordsRequest) Reset() {
 	*x = CreateDomainRecordsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -624,7 +457,7 @@ func (x *CreateDomainRecordsRequest) String() string {
 func (*CreateDomainRecordsRequest) ProtoMessage() {}
 
 func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -637,7 +470,7 @@ func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsRequest.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{9}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CreateDomainRecordsRequest) GetRecords() []*DNSRecord {
@@ -658,7 +491,7 @@ type CreateDomainRecordsResponse struct {
 func (x *CreateDomainRecordsResponse) Reset() {
 	*x = CreateDomainRecordsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -671,7 +504,7 @@ func (x *CreateDomainRecordsResponse) String() string {
 func (*CreateDomainRecordsResponse) ProtoMessage() {}
 
 func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -684,7 +517,7 @@ func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsResponse.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{10}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *CreateDomainRecordsResponse) GetRecords() []*DNSRecord {
@@ -707,7 +540,7 @@ type DNSRecord struct {
 func (x *DNSRecord) Reset() {
 	*x = DNSRecord{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -720,7 +553,7 @@ func (x *DNSRecord) String() string {
 func (*DNSRecord) ProtoMessage() {}
 
 func (x *DNSRecord) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -733,7 +566,7 @@ func (x *DNSRecord) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSRecord.ProtoReflect.Descriptor instead.
 func (*DNSRecord) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *DNSRecord) GetName() string {
@@ -797,87 +630,59 @@ var file_internal_machine_api_pb_cluster_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63,
 	0x68, 0x69, 0x6e, 0x65, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x73, 0x22, 0xbb, 0x01, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d,
+	0x69, 0x6e, 0x65, 0x73, 0x22, 0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
-	0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x6d, 0x65, 0x22, 0x32, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
-	0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x04,
+	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e,
-	0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x29, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71,
-	0x50, 0x48, 0x01, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x88, 0x01, 0x01,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
-	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52,
-	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47,
-	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f,
+	0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
-	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a,
-	0x69, 0x70, 0x22, 0x43, 0x0a, 0x15, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e,
-	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x07, 0x6d,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61,
+	0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52,
-	0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x22, 0x26, 0x0a, 0x14, 0x52, 0x65, 0x6d, 0x6f, 0x76,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22,
+	0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79,
-	0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x32, 0x0a,
+	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
-	0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
+	0x22, 0x2e, 0x0a, 0x0a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x0a, 0x0b, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x05, 0x0a, 0x01, 0x41, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02,
-	0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x32, 0x86, 0x03, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a,
-	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69,
-	0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68,
-	0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47, 0x0a, 0x1b, 0x43, 0x72, 0x65,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c,
-	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x2e, 0x0a, 0x0a, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x55, 0x4e, 0x53,
-	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x05, 0x0a, 0x01, 0x41, 0x10,
-	0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02, 0x32, 0x92, 0x04, 0x0a, 0x07,
-	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x0d, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30,
-	0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37,
-	0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e,
+	0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f,
-	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c,
-	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
-	0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
-	0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
+	0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
-	0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
-	0x33,
+	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
+	0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -893,7 +698,7 @@ func file_internal_machine_api_pb_cluster_proto_rawDescGZIP() []byte {
 }
 
 var file_internal_machine_api_pb_cluster_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(MachineMember_MembershipState)(0),  // 0: api.MachineMember.MembershipState
 	(DNSRecord_RecordType)(0),           // 1: api.DNSRecord.RecordType
@@ -901,54 +706,43 @@ var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(*AddMachineResponse)(nil),          // 3: api.AddMachineResponse
 	(*MachineMember)(nil),               // 4: api.MachineMember
 	(*ListMachinesResponse)(nil),        // 5: api.ListMachinesResponse
-	(*UpdateMachineRequest)(nil),        // 6: api.UpdateMachineRequest
+	(*Domain)(nil),                      // 6: api.Domain
-	(*UpdateMachineResponse)(nil),       // 7: api.UpdateMachineResponse
+	(*ReserveDomainRequest)(nil),        // 7: api.ReserveDomainRequest
-	(*RemoveMachineRequest)(nil),        // 8: api.RemoveMachineRequest
+	(*CreateDomainRecordsRequest)(nil),  // 8: api.CreateDomainRecordsRequest
-	(*Domain)(nil),                      // 9: api.Domain
+	(*CreateDomainRecordsResponse)(nil), // 9: api.CreateDomainRecordsResponse
-	(*ReserveDomainRequest)(nil),        // 10: api.ReserveDomainRequest
+	(*DNSRecord)(nil),                   // 10: api.DNSRecord
-	(*CreateDomainRecordsRequest)(nil),  // 11: api.CreateDomainRecordsRequest
+	(*NetworkConfig)(nil),               // 11: api.NetworkConfig
-	(*CreateDomainRecordsResponse)(nil), // 12: api.CreateDomainRecordsResponse
+	(*IP)(nil),                          // 12: api.IP
-	(*DNSRecord)(nil),                   // 13: api.DNSRecord
+	(*MachineInfo)(nil),                 // 13: api.MachineInfo
-	(*NetworkConfig)(nil),               // 14: api.NetworkConfig
+	(*emptypb.Empty)(nil),               // 14: google.protobuf.Empty
-	(*IP)(nil),                          // 15: api.IP
-	(*MachineInfo)(nil),                 // 16: api.MachineInfo
-	(*IPPort)(nil),                      // 17: api.IPPort
-	(*emptypb.Empty)(nil),               // 18: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_cluster_proto_depIdxs = []int32{
-	14, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
+	11, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
-	15, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
+	12, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
-	16, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
+	13, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
-	16, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
+	13, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
 	0,  // 4: api.MachineMember.state:type_name -> api.MachineMember.MembershipState
 	4,  // 5: api.ListMachinesResponse.machines:type_name -> api.MachineMember
-	15, // 6: api.UpdateMachineRequest.public_ip:type_name -> api.IP
+	10, // 6: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
-	17, // 7: api.UpdateMachineRequest.endpoints:type_name -> api.IPPort
+	10, // 7: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
-	16, // 8: api.UpdateMachineResponse.machine:type_name -> api.MachineInfo
+	1,  // 8: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
-	13, // 9: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
+	2,  // 9: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
-	13, // 10: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
+	14, // 10: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
-	1,  // 11: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
+	7,  // 11: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
-	2,  // 12: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
+	14, // 12: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
-	18, // 13: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
+	14, // 13: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
-	6,  // 14: api.Cluster.UpdateMachine:input_type -> api.UpdateMachineRequest
+	8,  // 14: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
-	8,  // 15: api.Cluster.RemoveMachine:input_type -> api.RemoveMachineRequest
+	3,  // 15: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
-	10, // 16: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
+	5,  // 16: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
-	18, // 17: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
+	6,  // 17: api.Cluster.ReserveDomain:output_type -> api.Domain
-	18, // 18: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
+	6,  // 18: api.Cluster.GetDomain:output_type -> api.Domain
-	11, // 19: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
+	6,  // 19: api.Cluster.ReleaseDomain:output_type -> api.Domain
-	3,  // 20: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
+	9,  // 20: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
-	5,  // 21: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
+	15, // [15:21] is the sub-list for method output_type
-	7,  // 22: api.Cluster.UpdateMachine:output_type -> api.UpdateMachineResponse
+	9,  // [9:15] is the sub-list for method input_type
-	18, // 23: api.Cluster.RemoveMachine:output_type -> google.protobuf.Empty
+	9,  // [9:9] is the sub-list for extension type_name
-	9,  // 24: api.Cluster.ReserveDomain:output_type -> api.Domain
+	9,  // [9:9] is the sub-list for extension extendee
-	9,  // 25: api.Cluster.GetDomain:output_type -> api.Domain
+	0,  // [0:9] is the sub-list for field type_name
-	9,  // 26: api.Cluster.ReleaseDomain:output_type -> api.Domain
-	12, // 27: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
-	20, // [20:28] is the sub-list for method output_type
-	12, // [12:20] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_internal_machine_api_pb_cluster_proto_init() }
@@ -1008,42 +802,6 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*UpdateMachineRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*UpdateMachineResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*RemoveMachineRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
 			switch v := v.(*Domain); i {
 			case 0:
 				return &v.state
@@ -1055,7 +813,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[5].Exporter = func(v any, i int) any {
 			switch v := v.(*ReserveDomainRequest); i {
 			case 0:
 				return &v.state
@@ -1067,7 +825,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[9].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[6].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateDomainRecordsRequest); i {
 			case 0:
 				return &v.state
@@ -1079,7 +837,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[10].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateDomainRecordsResponse); i {
 			case 0:
 				return &v.state
@@ -1091,7 +849,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[11].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*DNSRecord); i {
 			case 0:
 				return &v.state
@@ -1104,14 +862,13 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 	}
-	file_internal_machine_api_pb_cluster_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_cluster_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   12,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/cluster.proto

@@ -11,8 +11,6 @@ import "internal/machine/api/pb/machine.proto";
 service Cluster {
   rpc AddMachine(AddMachineRequest) returns (AddMachineResponse);
   rpc ListMachines(google.protobuf.Empty) returns (ListMachinesResponse);
-  rpc UpdateMachine(UpdateMachineRequest) returns (UpdateMachineResponse);
-  rpc RemoveMachine(RemoveMachineRequest) returns (google.protobuf.Empty);
 
   rpc ReserveDomain(ReserveDomainRequest) returns (Domain);
   rpc GetDomain(google.protobuf.Empty) returns (Domain);
@@ -51,24 +49,6 @@ message ListMachinesResponse {
   repeated MachineMember machines = 1;
 }
 
-message UpdateMachineRequest {
-  // Machine to update
-  string machine_id = 1;
-
-  // Updated machine information
-  optional string name = 2;
-  optional IP public_ip = 3;
-  repeated IPPort endpoints = 4;
-}
-
-message UpdateMachineResponse {
-  MachineInfo machine = 1;
-}
-
-message RemoveMachineRequest {
-  string id = 1;
-}
-
 message Domain {
   string name = 1;
 }

internal/machine/api/pb/cluster_grpc.pb.go

@@ -22,8 +22,6 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	Cluster_AddMachine_FullMethodName          = "/api.Cluster/AddMachine"
 	Cluster_ListMachines_FullMethodName        = "/api.Cluster/ListMachines"
-	Cluster_UpdateMachine_FullMethodName       = "/api.Cluster/UpdateMachine"
-	Cluster_RemoveMachine_FullMethodName       = "/api.Cluster/RemoveMachine"
 	Cluster_ReserveDomain_FullMethodName       = "/api.Cluster/ReserveDomain"
 	Cluster_GetDomain_FullMethodName           = "/api.Cluster/GetDomain"
 	Cluster_ReleaseDomain_FullMethodName       = "/api.Cluster/ReleaseDomain"
@@ -36,8 +34,6 @@ const (
 type ClusterClient interface {
 	AddMachine(ctx context.Context, in *AddMachineRequest, opts ...grpc.CallOption) (*AddMachineResponse, error)
 	ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMachinesResponse, error)
-	UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error)
-	RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error)
 	GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	ReleaseDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
@@ -72,26 +68,6 @@ func (c *clusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opt
 	return out, nil
 }
 
-func (c *clusterClient) UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(UpdateMachineResponse)
-	err := c.cc.Invoke(ctx, Cluster_UpdateMachine_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *clusterClient) RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Cluster_RemoveMachine_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -138,8 +114,6 @@ func (c *clusterClient) CreateDomainRecords(ctx context.Context, in *CreateDomai
 type ClusterServer interface {
 	AddMachine(context.Context, *AddMachineRequest) (*AddMachineResponse, error)
 	ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error)
-	UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error)
-	RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error)
 	ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error)
 	GetDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	ReleaseDomain(context.Context, *emptypb.Empty) (*Domain, error)
@@ -160,12 +134,6 @@ func (UnimplementedClusterServer) AddMachine(context.Context, *AddMachineRequest
 func (UnimplementedClusterServer) ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListMachines not implemented")
 }
-func (UnimplementedClusterServer) UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdateMachine not implemented")
-}
-func (UnimplementedClusterServer) RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RemoveMachine not implemented")
-}
 func (UnimplementedClusterServer) ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReserveDomain not implemented")
 }
@@ -235,42 +203,6 @@ func _Cluster_ListMachines_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Cluster_UpdateMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UpdateMachineRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ClusterServer).UpdateMachine(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Cluster_UpdateMachine_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ClusterServer).UpdateMachine(ctx, req.(*UpdateMachineRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Cluster_RemoveMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RemoveMachineRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ClusterServer).RemoveMachine(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Cluster_RemoveMachine_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ClusterServer).RemoveMachine(ctx, req.(*RemoveMachineRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ReserveDomainRequest)
 	if err := dec(in); err != nil {
@@ -358,14 +290,6 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListMachines",
 			Handler:    _Cluster_ListMachines_Handler,
 		},
-		{
-			MethodName: "UpdateMachine",
-			Handler:    _Cluster_UpdateMachine_Handler,
-		},
-		{
-			MethodName: "RemoveMachine",
-			Handler:    _Cluster_RemoveMachine_Handler,
-		},
 		{
 			MethodName: "ReserveDomain",
 			Handler:    _Cluster_ReserveDomain_Handler,

internal/machine/api/pb/machine.pb.go

@@ -21,6 +21,63 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type CheckPrerequisitesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Overall status of the checks.
+	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
+	// Error message if not satisfied (empty if all checks pass).
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *CheckPrerequisitesResponse) Reset() {
+	*x = CheckPrerequisitesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPrerequisitesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPrerequisitesResponse) ProtoMessage() {}
+
+func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
+func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
+	if x != nil {
+		return x.Satisfied
+	}
+	return false
+}
+
+func (x *CheckPrerequisitesResponse) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
 type MachineInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -35,7 +92,7 @@ type MachineInfo struct {
 func (x *MachineInfo) Reset() {
 	*x = MachineInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -48,7 +105,7 @@ func (x *MachineInfo) String() string {
 func (*MachineInfo) ProtoMessage() {}
 
 func (x *MachineInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -61,7 +118,7 @@ func (x *MachineInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineInfo.ProtoReflect.Descriptor instead.
 func (*MachineInfo) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *MachineInfo) GetId() string {
@@ -106,7 +163,7 @@ type NetworkConfig struct {
 func (x *NetworkConfig) Reset() {
 	*x = NetworkConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -119,7 +176,7 @@ func (x *NetworkConfig) String() string {
 func (*NetworkConfig) ProtoMessage() {}
 
 func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -132,7 +189,7 @@ func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
 func (*NetworkConfig) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *NetworkConfig) GetSubnet() *IPPrefix {
@@ -163,63 +220,6 @@ func (x *NetworkConfig) GetPublicKey() []byte {
 	return nil
 }
 
-type CheckPrerequisitesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Overall status of the checks.
-	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
-	// Error message if not satisfied (empty if all checks pass).
-	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
-}
-
-func (x *CheckPrerequisitesResponse) Reset() {
-	*x = CheckPrerequisitesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CheckPrerequisitesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CheckPrerequisitesResponse) ProtoMessage() {}
-
-func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
-func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
-	if x != nil {
-		return x.Satisfied
-	}
-	return false
-}
-
-func (x *CheckPrerequisitesResponse) GetError() string {
-	if x != nil {
-		return x.Error
-	}
-	return ""
-}
-
 type InitClusterRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -466,44 +466,6 @@ func (x *TokenResponse) GetToken() string {
 	return ""
 }
 
-type ResetRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *ResetRequest) Reset() {
-	*x = ResetRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ResetRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ResetRequest) ProtoMessage() {}
-
-func (x *ResetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ResetRequest.ProtoReflect.Descriptor instead.
-func (*ResetRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
-}
-
 type Service struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -518,7 +480,7 @@ type Service struct {
 func (x *Service) Reset() {
 	*x = Service{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -531,7 +493,7 @@ func (x *Service) String() string {
 func (*Service) ProtoMessage() {}
 
 func (x *Service) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -544,7 +506,7 @@ func (x *Service) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service.ProtoReflect.Descriptor instead.
 func (*Service) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *Service) GetId() string {
@@ -586,7 +548,7 @@ type InspectServiceRequest struct {
 func (x *InspectServiceRequest) Reset() {
 	*x = InspectServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -599,7 +561,7 @@ func (x *InspectServiceRequest) String() string {
 func (*InspectServiceRequest) ProtoMessage() {}
 
 func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -612,7 +574,7 @@ func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceRequest.ProtoReflect.Descriptor instead.
 func (*InspectServiceRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *InspectServiceRequest) GetId() string {
@@ -633,7 +595,7 @@ type InspectServiceResponse struct {
 func (x *InspectServiceResponse) Reset() {
 	*x = InspectServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -646,7 +608,7 @@ func (x *InspectServiceResponse) String() string {
 func (*InspectServiceResponse) ProtoMessage() {}
 
 func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -659,7 +621,7 @@ func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceResponse.ProtoReflect.Descriptor instead.
 func (*InspectServiceResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{10}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *InspectServiceResponse) GetService() *Service {
@@ -682,7 +644,7 @@ type Service_Container struct {
 func (x *Service_Container) Reset() {
 	*x = Service_Container{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -695,7 +657,7 @@ func (x *Service_Container) String() string {
 func (*Service_Container) ProtoMessage() {}
 
 func (x *Service_Container) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -708,7 +670,7 @@ func (x *Service_Container) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service_Container.ProtoReflect.Descriptor instead.
 func (*Service_Container) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8, 0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7, 0}
 }
 
 func (x *Service_Container) GetMachineId() string {
@@ -735,31 +697,31 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24, 0x69, 0x6e, 0x74, 0x65, 0x72,
 	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
 	0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12,
+	0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
-	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03,
+	0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f,
-	0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x72, 0x22, 0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66,
-	0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x04,
+	0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x08, 0x70,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73, 0x75, 0x62,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74,
-	0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
-	0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74,
+	0x6f, 0x72, 0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70,
-	0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x69,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52,
-	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50,
+	0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65,
-	0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70, 0x12, 0x29,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73,
-	0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70,
-	0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x09,
+	0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e,
-	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62,
+	0x65, 0x74, 0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70,
+	0x5f, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63,
+	0x49, 0x50, 0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70,
-	0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65,
+	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66,
+	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
-	0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73,
+	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
-	0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
+	0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
 	0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d, 0x65,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
@@ -786,8 +748,7 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x22, 0x25,
 	0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x0e, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x52, 0x65,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
 	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20,
@@ -806,7 +767,7 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
 	0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x0c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0xc3, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0x8f, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x12, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65,
 	0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
@@ -826,19 +787,16 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x49, 0x6e, 0x73, 0x70,
 	0x65, 0x63, 0x74, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x32, 0x0a,
+	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x49, 0x0a,
-	0x05, 0x52, 0x65, 0x73, 0x65, 0x74, 0x12, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
+	0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
-	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
-	0x79, 0x12, 0x49, 0x0a, 0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x69, 0x63, 0x65, 0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
-	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
-	0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
+	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35,
+	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61,
-	0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -853,54 +811,51 @@ func file_internal_machine_api_pb_machine_proto_rawDescGZIP() []byte {
 	return file_internal_machine_api_pb_machine_proto_rawDescData
 }
 
-var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_internal_machine_api_pb_machine_proto_goTypes = []any{
-	(*MachineInfo)(nil),                // 0: api.MachineInfo
+	(*CheckPrerequisitesResponse)(nil), // 0: api.CheckPrerequisitesResponse
-	(*NetworkConfig)(nil),              // 1: api.NetworkConfig
+	(*MachineInfo)(nil),                // 1: api.MachineInfo
-	(*CheckPrerequisitesResponse)(nil), // 2: api.CheckPrerequisitesResponse
+	(*NetworkConfig)(nil),              // 2: api.NetworkConfig
 	(*InitClusterRequest)(nil),         // 3: api.InitClusterRequest
 	(*InitClusterResponse)(nil),        // 4: api.InitClusterResponse
 	(*JoinClusterRequest)(nil),         // 5: api.JoinClusterRequest
 	(*TokenResponse)(nil),              // 6: api.TokenResponse
-	(*ResetRequest)(nil),               // 7: api.ResetRequest
+	(*Service)(nil),                    // 7: api.Service
-	(*Service)(nil),                    // 8: api.Service
+	(*InspectServiceRequest)(nil),      // 8: api.InspectServiceRequest
-	(*InspectServiceRequest)(nil),      // 9: api.InspectServiceRequest
+	(*InspectServiceResponse)(nil),     // 9: api.InspectServiceResponse
-	(*InspectServiceResponse)(nil),     // 10: api.InspectServiceResponse
+	(*Service_Container)(nil),          // 10: api.Service.Container
-	(*Service_Container)(nil),          // 11: api.Service.Container
+	(*IP)(nil),                         // 11: api.IP
-	(*IP)(nil),                         // 12: api.IP
+	(*IPPrefix)(nil),                   // 12: api.IPPrefix
-	(*IPPrefix)(nil),                   // 13: api.IPPrefix
+	(*IPPort)(nil),                     // 13: api.IPPort
-	(*IPPort)(nil),                     // 14: api.IPPort
+	(*emptypb.Empty)(nil),              // 14: google.protobuf.Empty
-	(*emptypb.Empty)(nil),              // 15: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_machine_proto_depIdxs = []int32{
-	1,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
+	2,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
-	12, // 1: api.MachineInfo.public_ip:type_name -> api.IP
+	11, // 1: api.MachineInfo.public_ip:type_name -> api.IP
-	13, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
+	12, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
-	12, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
+	11, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
-	14, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
+	13, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
-	13, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
+	12, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
-	12, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
+	11, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
-	0,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
+	1,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
-	0,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
+	1,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
-	0,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
+	1,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
-	11, // 10: api.Service.containers:type_name -> api.Service.Container
+	10, // 10: api.Service.containers:type_name -> api.Service.Container
-	8,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
+	7,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
-	15, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
+	14, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
 	3,  // 13: api.Machine.InitCluster:input_type -> api.InitClusterRequest
 	5,  // 14: api.Machine.JoinCluster:input_type -> api.JoinClusterRequest
-	15, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
+	14, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
-	15, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
+	14, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
-	7,  // 17: api.Machine.Reset:input_type -> api.ResetRequest
+	8,  // 17: api.Machine.InspectService:input_type -> api.InspectServiceRequest
-	9,  // 18: api.Machine.InspectService:input_type -> api.InspectServiceRequest
+	0,  // 18: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
-	2,  // 19: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
+	4,  // 19: api.Machine.InitCluster:output_type -> api.InitClusterResponse
-	4,  // 20: api.Machine.InitCluster:output_type -> api.InitClusterResponse
+	14, // 20: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
-	15, // 21: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
+	6,  // 21: api.Machine.Token:output_type -> api.TokenResponse
-	6,  // 22: api.Machine.Token:output_type -> api.TokenResponse
+	1,  // 22: api.Machine.Inspect:output_type -> api.MachineInfo
-	0,  // 23: api.Machine.Inspect:output_type -> api.MachineInfo
+	9,  // 23: api.Machine.InspectService:output_type -> api.InspectServiceResponse
-	15, // 24: api.Machine.Reset:output_type -> google.protobuf.Empty
+	18, // [18:24] is the sub-list for method output_type
-	10, // 25: api.Machine.InspectService:output_type -> api.InspectServiceResponse
+	12, // [12:18] is the sub-list for method input_type
-	19, // [19:26] is the sub-list for method output_type
-	12, // [12:19] is the sub-list for method input_type
 	12, // [12:12] is the sub-list for extension type_name
 	12, // [12:12] is the sub-list for extension extendee
 	0,  // [0:12] is the sub-list for field type_name
@@ -914,7 +869,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 	file_internal_machine_api_pb_common_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_internal_machine_api_pb_machine_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*MachineInfo); i {
+			switch v := v.(*CheckPrerequisitesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -926,7 +881,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*NetworkConfig); i {
+			switch v := v.(*MachineInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -938,7 +893,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*CheckPrerequisitesResponse); i {
+			switch v := v.(*NetworkConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -998,18 +953,6 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*ResetRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*Service); i {
 			case 0:
 				return &v.state
@@ -1021,7 +964,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*InspectServiceRequest); i {
 			case 0:
 				return &v.state
@@ -1033,7 +976,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
 			switch v := v.(*InspectServiceResponse); i {
 			case 0:
 				return &v.state
@@ -1045,7 +988,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[11].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
 			switch v := v.(*Service_Container); i {
 			case 0:
 				return &v.state
@@ -1068,7 +1011,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_machine_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   12,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/machine.proto

@@ -14,9 +14,6 @@ service Machine {
   rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
   rpc Token(google.protobuf.Empty) returns (TokenResponse);
   rpc Inspect(google.protobuf.Empty) returns (MachineInfo);
-  // Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-  rpc Reset(ResetRequest) returns (google.protobuf.Empty);
-
   rpc InspectService(InspectServiceRequest) returns (InspectServiceResponse);
 }
 
@@ -64,9 +61,6 @@ message TokenResponse {
   string token = 1;
 }
 
-message ResetRequest {
-}
-
 message Service {
   string id = 1;
   string name = 2;

internal/machine/api/pb/machine_grpc.pb.go

@@ -25,7 +25,6 @@ const (
 	Machine_JoinCluster_FullMethodName        = "/api.Machine/JoinCluster"
 	Machine_Token_FullMethodName              = "/api.Machine/Token"
 	Machine_Inspect_FullMethodName            = "/api.Machine/Inspect"
-	Machine_Reset_FullMethodName              = "/api.Machine/Reset"
 	Machine_InspectService_FullMethodName     = "/api.Machine/InspectService"
 )
 
@@ -33,14 +32,11 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type MachineClient interface {
-	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error)
 	InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error)
 	JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error)
 	Inspect(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*MachineInfo, error)
-	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-	Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error)
 }
 
@@ -102,16 +98,6 @@ func (c *machineClient) Inspect(ctx context.Context, in *emptypb.Empty, opts ...
 	return out, nil
 }
 
-func (c *machineClient) Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Machine_Reset_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InspectServiceResponse)
@@ -126,14 +112,11 @@ func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRe
 // All implementations must embed UnimplementedMachineServer
 // for forward compatibility.
 type MachineServer interface {
-	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error)
 	InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error)
 	JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error)
 	Token(context.Context, *emptypb.Empty) (*TokenResponse, error)
 	Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error)
-	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-	Reset(context.Context, *ResetRequest) (*emptypb.Empty, error)
 	InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error)
 	mustEmbedUnimplementedMachineServer()
 }
@@ -160,9 +143,6 @@ func (UnimplementedMachineServer) Token(context.Context, *emptypb.Empty) (*Token
 func (UnimplementedMachineServer) Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Inspect not implemented")
 }
-func (UnimplementedMachineServer) Reset(context.Context, *ResetRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Reset not implemented")
-}
 func (UnimplementedMachineServer) InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InspectService not implemented")
 }
@@ -277,24 +257,6 @@ func _Machine_Inspect_Handler(srv interface{}, ctx context.Context, dec func(int
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Machine_Reset_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ResetRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MachineServer).Reset(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Machine_Reset_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MachineServer).Reset(ctx, req.(*ResetRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Machine_InspectService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InspectServiceRequest)
 	if err := dec(in); err != nil {
@@ -340,10 +302,6 @@ var Machine_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Inspect",
 			Handler:    _Machine_Inspect_Handler,
 		},
-		{
-			MethodName: "Reset",
-			Handler:    _Machine_Reset_Handler,
-		},
 		{
 			MethodName: "InspectService",
 			Handler:    _Machine_InspectService_Handler,

internal/machine/api/proxy/backend.go

@@ -2,11 +2,10 @@ package proxy
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 )
 
 // One2ManyResponder converts upstream responses into messages from upstreams, so that multiple

internal/machine/api/proxy/director.go

@@ -2,12 +2,11 @@ package proxy
 
 import (
 	"context"
-	"sync"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+	"sync"
 )
 
 // Director manages routing of gRPC requests between local and remote backends.

internal/machine/api/proxy/local.go

@@ -2,12 +2,11 @@ package proxy
 
 import (
 	"context"
-	"sync"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
+	"sync"
 )
 
 // LocalBackend is a proxy.One2ManyResponder implementation that proxies to a local gRPC server listening on a Unix socket.

internal/machine/api/proxy/remote.go

@@ -3,15 +3,14 @@ package proxy
 import (
 	"context"
 	"fmt"
-	"net/netip"
-	"sync"
-	"time"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
+	"net/netip"
+	"sync"
+	"time"
 )
 
 // RemoteBackend is a proxy.One2ManyResponder implementation that proxies to a remote gRPC server, injecting machine metadata

internal/machine/caddyfile/config.go

@@ -1,4 +1,4 @@
-package caddyconfig
+package caddyfile
 
 import (
 	"encoding/json"
@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"slices"
 	"strconv"
-	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -65,8 +64,6 @@ func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*
 	servers := make(map[string]*caddyhttp.Server)
 	servers["http"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPPort)},
-		// All http requests to this server are logged to the default logger.
-		Logs: &caddyhttp.ServerLogConfig{},
 		Routes: append(
 			hostUpstreamsToRoutes(httpHostUpstreams, &warnings),
 			// Add a route to respond with a static verification response at the /.uncloud-verify path.
@@ -75,8 +72,6 @@ func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*
 	}
 	servers["https"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPSPort)},
-		// All https requests to this server are logged to the default logger.
-		Logs:   &caddyhttp.ServerLogConfig{},
 		Routes: hostUpstreamsToRoutes(httpsHostUpstreams, &warnings),
 	}
 
@@ -117,16 +112,6 @@ func hostUpstreamsToRoutes(hostUpstreams map[string][]string, warnings *[]caddyc
 			}
 		}
 		handler := &reverseproxy.Handler{
-			HealthChecks: &reverseproxy.HealthChecks{
-				// Enable passive health checks to automatically detect unhealthy upstreams.
-				Passive: &reverseproxy.PassiveHealthChecks{
-					FailDuration: caddy.Duration(30 * time.Second),
-				},
-			},
-			LoadBalancing: &reverseproxy.LoadBalancing{
-				// Retry failed requests to skip over temporarily unavailable upstreams.
-				Retries: 3,
-			},
 			Upstreams: upstreamPool,
 		}
 

internal/machine/caddyfile/config_test.go

@@ -1,4 +1,4 @@
-package caddyconfig
+package caddyfile
 
 import (
 	"strings"
@@ -25,12 +25,10 @@ func TestGenerateConfig(t *testing.T) {
 						"handler": "static_response",
 						"status_code": 200
 					}]
-				}],
+				}]
-				"logs": {}
 			},
 			"https": {
-				"listen": [":443"],
+				"listen": [":443"]
-				"logs": {}
 			}
 		}
 	}`
@@ -62,14 +60,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -81,12 +71,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"],
+                        "listen": [":443"]
-						"logs": {}
                     }
                 }
             }`,
@@ -107,14 +95,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
                                         {"dial": "10.210.0.2:8080"},
                                         {"dial": "10.210.0.3:8080"}
@@ -129,12 +109,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"],
+                        "listen": [":443"]
-						"logs": {}
                     }
                 }
             }`,
@@ -158,8 +136,7 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -168,19 +145,10 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8000"}]
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     }
                 }
             }`,
@@ -212,14 +180,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8080"},
 										{"dial": "10.210.0.3:8080"},
@@ -231,14 +191,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["web.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8000"},
 										{"dial": "10.210.0.4:8000"},
@@ -254,8 +206,7 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -264,14 +215,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.3:8888"},
 										{"dial": "10.210.0.4:8888"},
@@ -279,8 +222,7 @@ func TestGenerateConfig(t *testing.T) {
 									]
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     }
                 }
             }`,
@@ -344,14 +286,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -363,12 +297,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
+                        ]
-						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"],
+                        "listen": [":443"]
-						"logs": {}
                     }
                 }
             }`,

internal/machine/caddyfile/controller.go

@@ -1,4 +1,4 @@
-package caddyconfig
+package caddyfile
 
 import (
 	"context"
@@ -19,7 +19,7 @@ const (
 )
 
 // Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
-// proxy. The generated configuration allows Caddy to route external traffic to service containers across the internal
+// proxy. The generated Caddyfile allows Caddy to route external traffic to service containers across the internal
 // network.
 type Controller struct {
 	store          *store.Store
@@ -29,7 +29,7 @@ type Controller struct {
 
 func NewController(store *store.Store, path string, verifyResponse string) (*Controller, error) {
 	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o750); err != nil {
+	if err := os.MkdirAll(dir, 0750); err != nil {
 		return nil, fmt.Errorf("create parent directory for Caddy configuration '%s': %w", dir, err)
 	}
 	if err := fs.Chown(dir, "", CaddyGroup); err != nil {
@@ -114,7 +114,7 @@ func (c *Controller) generateConfig(containers []api.ServiceContainer) error {
 		return fmt.Errorf("marshal Caddy configuration: %w", err)
 	}
 
-	if err = os.WriteFile(c.path, configBytes, 0o640); err != nil {
+	if err = os.WriteFile(c.path, configBytes, 0640); err != nil {
 		return fmt.Errorf("write Caddy configuration to file '%s': %w", c.path, err)
 	}
 	if err = fs.Chown(c.path, "", CaddyGroup); err != nil {

internal/machine/cluster/cluster.go

@@ -5,18 +5,17 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 	"log/slog"
 	"net/netip"
 	"time"
-
 	"github.com/psviderski/uncloud/internal/corrosion"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/internal/secret"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 type Cluster struct {
@@ -198,89 +197,6 @@ func (c *Cluster) AddMachine(ctx context.Context, req *pb.AddMachineRequest) (*p
 	return resp, nil
 }
 
-// UpdateMachine updates machine configuration in the cluster.
-func (c *Cluster) UpdateMachine(ctx context.Context, req *pb.UpdateMachineRequest) (*pb.UpdateMachineResponse, error) {
-	if err := c.checkInitialised(ctx); err != nil {
-		return nil, err
-	}
-
-	if req.MachineId == "" {
-		return nil, status.Error(codes.InvalidArgument, "machine_id not set")
-	}
-
-	// Get the current machine info
-	currentMachine, err := c.store.GetMachine(ctx, req.MachineId)
-	if err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.MachineId)
-		}
-		return nil, status.Errorf(codes.Internal, "failed to get machine: %v", err)
-	}
-
-	// Create a copy of the current machine for updating
-	updatedMachine := &pb.MachineInfo{
-		Id:       currentMachine.Id,
-		Name:     currentMachine.Name,
-		Network:  currentMachine.Network,
-		PublicIp: currentMachine.PublicIp,
-	}
-
-	// Apply updates from the request
-	if req.Name != nil {
-		// Check for empty name
-		if *req.Name == "" {
-			return nil, status.Error(codes.InvalidArgument, "machine name cannot be empty")
-		}
-		// Check for duplicate names (excluding the current machine)
-		if *req.Name != currentMachine.Name {
-			machines, err := c.store.ListMachines(ctx)
-			if err != nil {
-				return nil, status.Errorf(codes.Internal, "list machines: %v", err)
-			}
-			for _, m := range machines {
-				if m.Id != req.MachineId && m.Name == *req.Name {
-					return nil, status.Errorf(codes.AlreadyExists, "machine with name %q already exists", *req.Name)
-				}
-			}
-		}
-		updatedMachine.Name = *req.Name
-	}
-	if req.PublicIp != nil {
-		// Check if this is an empty IP (used to signal removal)
-		if len(req.PublicIp.Ip) == 0 {
-			// User wants to remove public IP
-			updatedMachine.PublicIp = nil
-		} else {
-			// Validate and set the new IP
-			ip, err := req.PublicIp.ToAddr()
-			if err != nil {
-				return nil, status.Errorf(codes.InvalidArgument, "invalid public IP: %v", err)
-			}
-			if !ip.IsValid() {
-				return nil, status.Error(codes.InvalidArgument, "invalid public IP")
-			}
-			updatedMachine.PublicIp = req.PublicIp
-		}
-	}
-	if req.Endpoints != nil {
-		updatedMachine.Network.Endpoints = req.Endpoints
-	}
-
-	// Update the machine in the store
-	if err = c.store.UpdateMachine(ctx, updatedMachine); err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.MachineId)
-		}
-		return nil, status.Errorf(codes.Internal, "update machine: %v", err)
-	}
-
-	slog.Info("Machine configuration updated in the cluster.",
-		"id", updatedMachine.Id, "name", updatedMachine.Name)
-
-	resp := &pb.UpdateMachineResponse{Machine: updatedMachine}
-	return resp, nil
-}
-
 // ListMachines lists all machines in the cluster including their membership states.
 func (c *Cluster) ListMachines(ctx context.Context, _ *emptypb.Empty) (*pb.ListMachinesResponse, error) {
 	if err := c.checkInitialised(ctx); err != nil {
@@ -326,24 +242,3 @@ func (c *Cluster) ListMachines(ctx context.Context, _ *emptypb.Empty) (*pb.ListM
 
 	return &pb.ListMachinesResponse{Machines: members}, nil
 }
-
-// RemoveMachine removes a machine from the cluster.
-func (c *Cluster) RemoveMachine(ctx context.Context, req *pb.RemoveMachineRequest) (*emptypb.Empty, error) {
-	if err := c.checkInitialised(ctx); err != nil {
-		return nil, err
-	}
-
-	if req.Id == "" {
-		return nil, status.Error(codes.InvalidArgument, "machine ID not set")
-	}
-
-	if err := c.store.DeleteMachine(ctx, req.Id); err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.Id)
-		}
-		return nil, status.Errorf(codes.Internal, "delete machine from store: %v", err)
-	}
-	slog.Info("Machine removed from the cluster.", "id", req.Id)
-
-	return &emptypb.Empty{}, nil
-}

internal/machine/cluster/dns.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-
 	"github.com/psviderski/uncloud/internal/dns"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/store"

internal/machine/cluster/ipam.go

@@ -3,9 +3,8 @@ package cluster
 import (
 	"errors"
 	"fmt"
-	"net/netip"
-
 	"go4.org/netipx"
+	"net/netip"
 )
 
 const DefaultSubnetBits = 24

internal/machine/cluster/machine.go

@@ -2,7 +2,6 @@ package cluster
 
 import (
 	"fmt"
-
 	"github.com/psviderski/uncloud/internal/secret"
 )
 

internal/machine/constants/constants.go

@@ -1,6 +0,0 @@
-package constants
-
-const (
-	// MachineAPIPort is the port for the Machine API service on the management WireGuard network.
-	MachineAPIPort = 51000
-)

internal/machine/corroservice/config.go

@@ -3,11 +3,10 @@ package corroservice
 import (
 	"bytes"
 	"fmt"
+	"github.com/BurntSushi/toml"
 	"net/netip"
 	"os"
 	"path/filepath"
-
-	"github.com/BurntSushi/toml"
 	"github.com/psviderski/uncloud/internal/fs"
 )
 
@@ -51,7 +50,7 @@ func (c *Config) Write(path, owner string) error {
 	if err := encoder.Encode(c); err != nil {
 		return fmt.Errorf("encode config: %w", err)
 	}
-	if err := os.WriteFile(path, data.Bytes(), 0o600); err != nil {
+	if err := os.WriteFile(path, data.Bytes(), 0600); err != nil {
 		return err
 	}
 	if err := fs.Chown(path, owner, owner); err != nil {
@@ -63,10 +62,10 @@ func (c *Config) Write(path, owner string) error {
 func MkDataDir(dir, owner string) error {
 	parent, _ := filepath.Split(dir)
 	// Use 0711 for parent directories to allow `owner` to access its nested data directory.
-	if err := os.MkdirAll(parent, 0o711); err != nil {
+	if err := os.MkdirAll(parent, 0711); err != nil {
 		return fmt.Errorf("create directory %q: %w", parent, err)
 	}
-	if err := os.Mkdir(dir, 0o700); err != nil {
+	if err := os.Mkdir(dir, 0700); err != nil {
 		if !os.IsExist(err) {
 			return fmt.Errorf("create directory %q: %w", dir, err)
 		}

internal/machine/corroservice/docker.go

@@ -3,16 +3,15 @@ package corroservice
 import (
 	"context"
 	"fmt"
-	"io"
-	"log/slog"
-	"path/filepath"
-	"time"
-
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"time"
 )
 
 const (
@@ -27,47 +26,29 @@ type DockerService struct {
 	User    string
 }
 
+func NewDockerService(cli *client.Client, image, name, dataDir string) *DockerService {
+	return &DockerService{
+		Client:  cli,
+		Image:   image,
+		Name:    name,
+		DataDir: dataDir,
+	}
+}
+
 func (s *DockerService) Start(ctx context.Context) error {
 	_, err := s.Client.ContainerInspect(ctx, s.Name)
 	if err != nil {
-		if !client.IsErrNotFound(err) {
+		if client.IsErrNotFound(err) {
-			return fmt.Errorf("inspect container %q: %w", s.Name, err)
+			return s.startNewContainer(ctx)
-		}
-		if err = s.startNewContainer(ctx); err != nil {
-			return err
-		}
-	} else {
-		// Container already exists.
-		// TODO: recreate only if the container configuration has to be changed.
-		if err = s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{Force: true}); err != nil {
-			return fmt.Errorf("remove container %q: %w", s.Name, err)
-		}
-		if err = s.startNewContainer(ctx); err != nil {
-			return err
 		}
+		return fmt.Errorf("inspect container %q: %w", s.Name, err)
 	}
-
+	// TODO: recreate only if the container configuration has to be changed.
-	slog.Debug("Waiting for corrosion service to be ready.")
+	if err = s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{Force: true}); err != nil {
-	if err = WaitReady(ctx, s.DataDir); err != nil {
-		return err
-	}
-	slog.Debug("Corrosion service is ready.")
-
-	return nil
-}
-
-func (s *DockerService) Stop(ctx context.Context) error {
-	if err := s.Client.ContainerStop(ctx, s.Name, container.StopOptions{}); err != nil {
-		return fmt.Errorf("stop container %q: %w", s.Name, err)
-	}
-	slog.Debug("Corrosion Docker container stopped.", "name", s.Name)
-
-	if err := s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{}); err != nil {
 		return fmt.Errorf("remove container %q: %w", s.Name, err)
 	}
-	slog.Debug("Corrosion Docker container removed.", "name", s.Name)
 
-	return nil
+	return s.startNewContainer(ctx)
 }
 
 func (s *DockerService) Restart(ctx context.Context) error {

internal/machine/corroservice/service.go

@@ -1,62 +1,9 @@
 package corroservice
 
-import (
+import "context"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/BurntSushi/toml"
-	"github.com/cenkalti/backoff/v4"
-	"github.com/psviderski/uncloud/internal/corrosion"
-)
 
 type Service interface {
 	Start(ctx context.Context) error
-	Stop(ctx context.Context) error
 	Restart(ctx context.Context) error
 	Running() bool
 }
-
-// WaitReady waits for the Corrosion service to be ready with the uncloud schema applied.
-func WaitReady(ctx context.Context, dataDir string) error {
-	// Read the config file to get the API address.
-	configPath := filepath.Join(dataDir, "config.toml")
-	configData, err := os.ReadFile(configPath)
-	if err != nil {
-		return fmt.Errorf("read config file: %w", err)
-	}
-
-	var config Config
-	if err = toml.Unmarshal(configData, &config); err != nil {
-		return fmt.Errorf("unmarshal config: %w", err)
-	}
-
-	corro, err := corrosion.NewAPIClient(config.API.Addr)
-	if err != nil {
-		return fmt.Errorf("create corrosion API client: %w", err)
-	}
-
-	// Corrosion starts serving the API before applying the schema. Query the cluster table with exponential backoff
-	// to check if the uncloud schema has been applied.
-	checkReady := func() error {
-		rows, err := corro.QueryContext(ctx, "SELECT 1 FROM cluster LIMIT 1")
-		if err != nil {
-			return fmt.Errorf("query cluster table: %w", err)
-		}
-		defer rows.Close()
-
-		return nil
-	}
-
-	b := backoff.NewExponentialBackOff(
-		backoff.WithInitialInterval(50*time.Millisecond),
-		backoff.WithMaxInterval(1*time.Second),
-		backoff.WithMaxElapsedTime(15*time.Second),
-	)
-	if err = backoff.Retry(checkReady, backoff.WithContext(b, ctx)); err != nil {
-		return fmt.Errorf("corrosion service did not become ready: %w", err)
-	}
-	return nil
-}

internal/machine/corroservice/subprocess.go

@@ -0,0 +1,157 @@
+package corroservice
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"log/slog"
+	"os/exec"
+	"path/filepath"
+	"sync"
+	"syscall"
+	"time"
+)
+
+const (
+	DefaultCommand = "corrosion"
+	DefaultDataDir = "/var/lib/uncloud/corrosion"
+)
+
+// SubprocessService implements the Service interface by running the service as a subprocess.
+type SubprocessService struct {
+	Command string
+	DataDir string
+
+	cmd         *exec.Cmd
+	running     bool
+	mu          sync.Mutex
+	cancelWatch context.CancelFunc
+}
+
+func DefaultSubprocessService() *SubprocessService {
+	return &SubprocessService{
+		Command: DefaultCommand,
+		DataDir: DefaultDataDir,
+	}
+}
+
+// TODO: maybe stop the process if this ctx is cancelled.
+func (s *SubprocessService) Start(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.running {
+		return nil
+	}
+	return s.startProcess(ctx)
+}
+
+func (s *SubprocessService) Restart(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.running {
+		if err := s.stopProcess(); err != nil {
+			return fmt.Errorf("stop process: %w", err)
+		}
+	}
+	return s.startProcess(ctx)
+}
+
+func (s *SubprocessService) Running() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.running
+}
+
+func (s *SubprocessService) startProcess(ctx context.Context) error {
+	s.cmd = exec.Command(s.Command, "agent", "-c", filepath.Join(s.DataDir, "config.toml"))
+
+	// Redirect stdout and stderr to the logger.
+	stdout, err := s.cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("create stdout pipe: %w", err)
+	}
+	stderr, err := s.cmd.StderrPipe()
+	if err != nil {
+		return fmt.Errorf("create stderr pipe: %w", err)
+	}
+
+	go func() {
+		scanner := bufio.NewScanner(stdout)
+		for scanner.Scan() {
+			slog.Info("[corrosion]: " + scanner.Text())
+		}
+		// TODO: remove
+		slog.Info("######## corrosion redirect go routine end ########")
+	}()
+
+	go func() {
+		scanner := bufio.NewScanner(stderr)
+		for scanner.Scan() {
+			slog.Error("[corrosion]: " + scanner.Text())
+		}
+	}()
+
+	if err = s.cmd.Start(); err != nil {
+		return fmt.Errorf("start process: %w", err)
+	}
+	s.running = true
+
+	// Watch for process exit to update running status.
+	go func() {
+		if err := s.cmd.Wait(); err != nil {
+			slog.Error("corrosion process exited with error.", "code", s.cmd.ProcessState.ExitCode(), "err", err)
+		}
+
+		s.mu.Lock()
+		s.running = false
+		s.mu.Unlock()
+	}()
+
+	// TODO: figure out the waiting process
+	// Wait for initialization
+	//timer := time.NewTimer(2 * time.Second)
+	//defer timer.Stop()
+
+	//select {
+	////case <-timer.C:
+	////	s.running = true
+	////	return nil
+	//case <-watchCtx.Done():
+	//	return fmt.Errorf("process failed to start")
+	//case <-ctx.Done():
+	//	s.stopProcess()
+	//	return ctx.Err()
+	//}
+	return nil
+}
+
+func (s *SubprocessService) stopProcess() error {
+	if s.cmd == nil || s.cmd.Process == nil {
+		return nil
+	}
+
+	if err := s.cmd.Process.Signal(syscall.SIGTERM); err != nil {
+		return fmt.Errorf("send SIGTERM: %w", err)
+	}
+
+	// Wait up to 5 seconds for graceful shutdown before killing the process.
+	done := make(chan error, 1)
+	go func() {
+		done <- s.cmd.Wait()
+	}()
+
+	select {
+	case <-time.After(5 * time.Second):
+		if err := s.cmd.Process.Kill(); err != nil {
+			return fmt.Errorf("kill process: %w", err)
+		}
+	case err := <-done:
+		if err != nil {
+			return fmt.Errorf("process exited with error: %w", err)
+		}
+	}
+
+	return nil
+}

internal/machine/corroservice/systemd.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"os/exec"
+	"time"
 )
 
 const DefaultSystemdUnit = "uncloud-corrosion.service"
@@ -26,15 +27,6 @@ func (s *SystemdService) Start(ctx context.Context) error {
 	return s.startOrRestart(ctx, "start")
 }
 
-func (s *SystemdService) Stop(_ context.Context) error {
-	if _, err := exec.Command("systemctl", "stop", s.Unit).Output(); err != nil {
-		return fmt.Errorf("systemctl stop %s: %w", s.Unit, err)
-	}
-	slog.Info("Corrosion systemd service stopped.", "unit", s.Unit)
-
-	return nil
-}
-
 func (s *SystemdService) Restart(ctx context.Context) error {
 	return s.startOrRestart(ctx, "restart")
 }
@@ -43,15 +35,20 @@ func (s *SystemdService) startOrRestart(ctx context.Context, cmd string) error {
 	if _, err := exec.Command("systemctl", cmd, s.Unit).Output(); err != nil {
 		return fmt.Errorf("systemctl %s %s: %w", cmd, s.Unit, err)
 	}
-	slog.Debug(fmt.Sprintf("Corrosion systemd service %sed.", cmd), "unit", s.Unit)
+	slog.Info(fmt.Sprintf("Corrosion systemd service %sed.", cmd), "unit", s.Unit)
 
-	slog.Debug("Waiting for corrosion service to be ready.")
+	// Optimistically wait for the corrosion service to start and initialise the database schema before proceeding.
-	if err := WaitReady(ctx, s.DataDir); err != nil {
+	timer := time.NewTimer(2 * time.Second)
-		return err
+	defer timer.Stop()
+
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		return nil
 	}
-	slog.Debug("Corrosion service is ready.")
-	s.running = true
 
+	// TODO: run a goroutine to check the status of the service and log any errors in the uncloud log.
+	s.running = true
 	return nil
 }
 

internal/machine/db.go

@@ -14,13 +14,13 @@ const DBFileName = "machine.db"
 func NewDB(path string) (*sqlx.DB, error) {
 	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
 	if _, err := os.Stat(path); os.IsNotExist(err) {
-		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
 		if err != nil {
 			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
 		}
 		file.Close()
 	} else {
-		if err = os.Chmod(path, 0o600); err != nil {
+		if err = os.Chmod(path, 0600); err != nil {
 			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
 		}
 	}

internal/machine/docker/manager.go

@@ -155,7 +155,6 @@ func (m *Manager) syncContainersToStore(ctx context.Context) error {
 		Filters: filters.NewArgs(
 			filters.Arg("label", api.LabelServiceID),
 			filters.Arg("label", api.LabelServiceName),
-			filters.Arg("label", api.LabelManaged),
 		),
 	})
 	if err != nil {

internal/machine/docker/manager_darwin.go

@@ -12,8 +12,3 @@ import (
 func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
 	return fmt.Errorf("not supported on Darwin")
 }
-
-// Cleanup is a stub for Darwin.
-func (m *Manager) Cleanup() error {
-	return fmt.Errorf("not supported on Darwin")
-}

internal/machine/docker/manager_linux.go

@@ -2,21 +2,17 @@ package docker
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log/slog"
 	"net/netip"
 	"strconv"
 
-	dockercontainer "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
 	dnetwork "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/libnetwork/iptables"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/pkg/api"
 )
 
 // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
@@ -56,14 +52,6 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix,
 						},
 					},
 				},
-				Labels: map[string]string{
-					api.LabelManaged: "",
-				},
-				Options: map[string]string{
-					// Starting with Docker 28.2.0 (https://github.com/moby/moby/pull/49832), we have to explicitly
-					// allow direct routing from the WireGuard interface to the bridge network.
-					"com.docker.network.bridge.trusted_host_interfaces": network.WireGuardInterfaceName,
-				},
 			},
 		); err != nil {
 			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)
@@ -84,7 +72,7 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix,
 	// https://github.com/moby/moby/blob/v27.2.1/libnetwork/drivers/bridge/bridge_linux.go#L664
 	bridgeName := "br-" + nw.ID[:12]
 
-	if err = configureIptables(bridgeName, subnet, dnsServer); err != nil {
+	if err = configureIptables(bridgeName, dnsServer); err != nil {
 		return fmt.Errorf("configure iptables for Docker network '%s': %w", NetworkName, err)
 	}
 
@@ -92,15 +80,11 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix,
 }
 
 // configureIptables configures iptables rules for the uncloud Docker network.
-func configureIptables(bridgeName string, subnet netip.Prefix, dnsServer netip.Addr) error {
+func configureIptables(bridgeName string, dnsServer netip.Addr) error {
 	ipt := iptables.GetIptable(iptables.IPv4)
 	// Allow traffic from other machines and their containers through the WG mesh to the Uncloud containers
 	// on the machine.
-	wgRule := []string{
+	wgRule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
-		"--in-interface", network.WireGuardInterfaceName,
-		"--out-interface", bridgeName,
-		"-j", "ACCEPT",
-	}
 	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Insert, wgRule); err != nil {
 		return fmt.Errorf("insert iptables rule: %w", err)
 	}
@@ -119,116 +103,5 @@ func configureIptables(bridgeName string, subnet netip.Prefix, dnsServer netip.A
 		}
 	}
 
-	// Skip masquerading for the container traffic going from the uncloud Docker network through the WG mesh.
-	// https://uncloud.run/blog/connect-docker-containers-across-hosts-wireguard#step-3-configure-ip-routing
-	skipMasqueradeRule := []string{
-		"--src", subnet.String(),
-		"--out-interface", network.WireGuardInterfaceName,
-		"-j", "RETURN",
-	}
-	// Delete and reinsert the rule to ensure it's at the top of the POSTROUTING chain before the MASQUERADE rule
-	// added by Docker: POSTROUTING -s 10.210.X.0/24 ! -o br-XXX -j MASQUERADE
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Delete, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Insert, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("insert iptables rule: %w", err)
-	}
-
 	return nil
 }
-
-// cleanupIptables deletes the iptables rules for the uncloud Docker network.
-func cleanupIptables(bridgeName string, subnet netip.Prefix) error {
-	ipt := iptables.GetIptable(iptables.IPv4)
-	// Delete the rule allowing traffic from the WireGuard network to the Docker bridge.
-	wgRule := []string{
-		"--in-interface", network.WireGuardInterfaceName,
-		"--out-interface", bridgeName,
-		"-j", "ACCEPT",
-	}
-	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Delete, wgRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-
-	// Delete the rule that skips masquerading for the container traffic going from the uncloud Docker network
-	// through the WG mesh.
-	skipMasqueradeRule := []string{
-		"--src", subnet.String(),
-		"--out-interface", network.WireGuardInterfaceName,
-		"-j", "RETURN",
-	}
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Delete, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-
-	// Rules in uncloud-owned chains will be automatically cleaned up by the machine cleanup.
-
-	return nil
-}
-
-// Cleanup removes all uncloud-managed containers and the uncloud Docker network.
-func (m *Manager) Cleanup() error {
-	ctx := context.Background()
-	var errs []error
-
-	// Remove uncloud-managed Docker containers.
-	containers, err := m.client.ContainerList(ctx, dockercontainer.ListOptions{
-		All: true, // Include stopped containers.
-		Filters: filters.NewArgs(
-			filters.Arg("label", api.LabelManaged),
-		),
-	})
-	if err != nil {
-		errs = append(errs, fmt.Errorf("list uncloud-managed Docker containers: %w", err))
-	} else if len(containers) > 0 {
-		slog.Info("Removing uncloud-managed Docker containers.", "count", len(containers))
-		removed := 0
-
-		for _, ctr := range containers {
-			err = m.client.ContainerStop(ctx, ctr.ID, dockercontainer.StopOptions{})
-			if err != nil && !client.IsErrNotFound(err) {
-				errs = append(errs, fmt.Errorf("stop container '%s': %w", ctr.ID, err))
-			}
-
-			err = m.client.ContainerRemove(ctx, ctr.ID, dockercontainer.RemoveOptions{
-				// Remove anonymous volumes created by the container.
-				RemoveVolumes: true,
-			})
-			if err == nil {
-				removed++
-			} else if !client.IsErrNotFound(err) {
-				errs = append(errs, fmt.Errorf("remove container '%s': %w", ctr.ID, err))
-			}
-		}
-		slog.Info("Removed uncloud-managed Docker containers.", "count", removed)
-	}
-
-	// Remove the uncloud Docker network and related iptables rules.
-	nw, err := m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
-	if err == nil {
-		bridgeName := "br-" + nw.ID[:12]
-		var subnet netip.Prefix
-		if len(nw.IPAM.Config) > 0 {
-			subnet, _ = netip.ParsePrefix(nw.IPAM.Config[0].Subnet)
-		}
-
-		if subnet.IsValid() {
-			if err = cleanupIptables(bridgeName, subnet); err != nil {
-				errs = append(errs, fmt.Errorf("cleanup iptables for Docker network '%s': %w", NetworkName, err))
-			} else {
-				slog.Info("Cleaned up iptables rules for Docker network.", "name", NetworkName, "bridge", bridgeName)
-			}
-		}
-
-		if err = m.client.NetworkRemove(ctx, NetworkName); err == nil {
-			slog.Info("Docker network removed.", "name", NetworkName)
-		} else if !client.IsErrNotFound(err) {
-			errs = append(errs, fmt.Errorf("remove Docker network '%s': %w", NetworkName, err))
-		}
-	} else if !client.IsErrNotFound(err) {
-		errs = append(errs, fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err))
-	}
-
-	return errors.Join(errs...)
-}

internal/machine/docker/server.go

@@ -50,42 +50,15 @@ type Server struct {
 	// internalDNSIP is a function that returns the IP address of the internal DNS server. It may return an empty
 	// address if the address is unknown (e.g. when the machine is not initialised yet).
 	internalDNSIP func() netip.Addr
-	// networkReady is a function that returns true if the Docker network is ready for containers.
-	networkReady func() bool
-	// waitForNetworkReady is a function that waits for the Docker network to be ready for containers.
-	waitForNetworkReady func(ctx context.Context) error
-}
-
-// ServerOption configures the Docker server.
-type ServerOption func(*Server)
-
-// WithNetworkReady sets the network readiness check function.
-func WithNetworkReady(networkReady func() bool) ServerOption {
-	return func(s *Server) {
-		s.networkReady = networkReady
-	}
-}
-
-// WithWaitForNetworkReady sets the network readiness wait function.
-func WithWaitForNetworkReady(waitForNetworkReady func(ctx context.Context) error) ServerOption {
-	return func(s *Server) {
-		s.waitForNetworkReady = waitForNetworkReady
-	}
 }
 
 // NewServer creates a new Docker gRPC server with the provided Docker client.
-func NewServer(cli *client.Client, db *sqlx.DB, internalDNSIP func() netip.Addr, opts ...ServerOption) *Server {
+func NewServer(cli *client.Client, db *sqlx.DB, internalDNSIP func() netip.Addr) *Server {
-	s := &Server{
+	return &Server{
 		client:        cli,
 		db:            db,
 		internalDNSIP: internalDNSIP,
 	}
-
-	for _, opt := range opts {
-		opt(s)
-	}
-
-	return s
 }
 
 // CreateContainer creates a new container based on the given configuration.
@@ -145,15 +118,6 @@ func (s *Server) InspectContainer(ctx context.Context, req *pb.InspectContainerR
 
 // StartContainer starts a container with the given ID and options.
 func (s *Server) StartContainer(ctx context.Context, req *pb.StartContainerRequest) (*emptypb.Empty, error) {
-	// Wait for Docker network to be ready before starting the container
-	if s.waitForNetworkReady != nil {
-		if err := s.waitForNetworkReady(ctx); err != nil {
-			return nil, status.Errorf(codes.Unavailable, "Docker network not ready: %v", err)
-		}
-	} else if s.networkReady != nil && !s.networkReady() {
-		return nil, status.Errorf(codes.Unavailable, "Docker network not ready")
-	}
-
 	var opts container.StartOptions
 	if len(req.Options) > 0 {
 		if err := json.Unmarshal(req.Options, &opts); err != nil {
@@ -381,12 +345,6 @@ func (s *Server) CreateVolume(ctx context.Context, req *pb.CreateVolumeRequest)
 		return nil, status.Errorf(codes.InvalidArgument, "unmarshal options: %v", err)
 	}
 
-	// Always add the managed label to the volume to indicate that it is managed by Uncloud.
-	if opts.Labels == nil {
-		opts.Labels = make(map[string]string)
-	}
-	opts.Labels[api.LabelManaged] = ""
-
 	vol, err := s.client.VolumeCreate(ctx, opts)
 	if err != nil {
 		return nil, status.Error(codes.Internal, err.Error())

internal/machine/firewall/iptables_darwin.go

@@ -6,8 +6,3 @@ import "fmt"
 func ConfigureIptablesChains() error {
 	return fmt.Errorf("not supported on Darwin")
 }
-
-// CleanupIptablesChains is a stub for Darwin.
-func CleanupIptablesChains() error {
-	return fmt.Errorf("not supported on Darwin")
-}

internal/machine/firewall/iptables_linux.go

@@ -2,13 +2,10 @@ package firewall
 
 import (
 	"fmt"
-	"log/slog"
 	"strconv"
 	"strings"
 
 	"github.com/docker/docker/libnetwork/iptables"
-	"github.com/psviderski/uncloud/internal/machine/constants"
-	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
@@ -19,145 +16,59 @@ const (
 
 // ConfigureIptablesChains sets up custom iptables chains and initial firewall rules for Uncloud networking.
 func ConfigureIptablesChains() error {
-	if err := createIptablesChains(); err != nil {
+	// Ensure iptables UNCLOUD-INPUT chain with a RETURN rule exists. All existing rules are flushed.
-		return err
+	ipt := iptables.GetIptable(iptables.IPv4)
+	if _, err := ipt.NewChain(UncloudInputChain, iptables.Filter); err != nil {
+		return fmt.Errorf("create iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-F", UncloudInputChain); err != nil {
+		return fmt.Errorf("flush iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.AddReturnRule(UncloudInputChain); err != nil {
+		return fmt.Errorf("add the RETURN rule for iptables chain '%s': %w", UncloudInputChain, err)
 	}
 
-	ipt4 := iptables.GetIptable(iptables.IPv4)
+	// Ensure the main iptables INPUT chain has a jump rule to the UNCLOUD-INPUT chain before any DROP/REJECT rules.
-	ipt6 := iptables.GetIptable(iptables.IPv6)
+	jumpRule := []string{"-m", "comment", "--comment", "Uncloud-managed", "-j", UncloudInputChain}
+	if !ipt.Exists(iptables.Filter, "INPUT", jumpRule...) {
+		// Look for the first DROP/REJECT rule in the INPUT chain.
+		out, err := ipt.Raw("-t", string(iptables.Filter), "-L", "INPUT", "--line-numbers")
+		if err != nil {
+			return fmt.Errorf("get iptables rules for chain '%s': %w", UncloudInputChain, err)
+		}
+
+		firstRejectRuleNum := 0
+		for _, line := range strings.Split(string(out), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) < 2 {
+				continue
+			}
+			if fields[1] == "DROP" || fields[1] == "REJECT" {
+				if ruleNum, err := strconv.Atoi(fields[0]); err == nil {
+					firstRejectRuleNum = ruleNum
+					break
+				}
+			}
+		}
+
+		var addJumpRule []string
+		if firstRejectRuleNum > 0 {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-I", "INPUT", strconv.Itoa(firstRejectRuleNum)},
+				jumpRule...)
+		} else {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-A", "INPUT"}, jumpRule...)
+		}
+		if err = ipt.RawCombinedOutput(addJumpRule...); err != nil {
+			return fmt.Errorf("add iptables rule '%s': %w", strings.Join(addJumpRule, " "), err)
+		}
+	}
 
 	// Allow WireGuard traffic to the machine.
 	acceptWireGuardRule := []string{"-p", "udp", "--dport", strconv.Itoa(network.WireGuardPort), "-j", "ACCEPT"}
-	err := ipt4.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, acceptWireGuardRule)
+	err := ipt.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, acceptWireGuardRule)
 	if err != nil {
 		return fmt.Errorf("insert iptables rule '%s': %w", strings.Join(acceptWireGuardRule, " "), err)
 	}
 
-	// Allow cluster machines to access Machine API via the management IPv6 WireGuard network.
-	acceptMachineAPIRule := []string{
-		"-i", network.WireGuardInterfaceName,
-		"-s", "fdcc::/16",
-		"-p", "tcp",
-		"--dport", strconv.Itoa(constants.MachineAPIPort),
-		"-j", "ACCEPT",
-	}
-	// Allow Corrosion gossip traffic from cluster machines via the management IPv6 WireGuard network.
-	acceptCorrosionGossipRule := []string{
-		"-i", network.WireGuardInterfaceName,
-		"-s", "fdcc::/16",
-		"-p", "udp",
-		"--dport", strconv.Itoa(corroservice.DefaultGossipPort),
-		"-j", "ACCEPT",
-	}
-	for _, rule := range [][]string{acceptMachineAPIRule, acceptCorrosionGossipRule} {
-		if err = ipt6.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, rule); err != nil {
-			return fmt.Errorf("insert ip6tables rule '%s': %w", strings.Join(rule, " "), err)
-		}
-	}
-
-	return nil
-}
-
-// createIptablesChains ensures UNCLOUD-INPUT iptables and ip6tables chains exist and
-// there are jump rules from the main INPUT chains.
-func createIptablesChains() error {
-	ipt4 := iptables.GetIptable(iptables.IPv4)
-	ipt6 := iptables.GetIptable(iptables.IPv6)
-
-	for i, ipt := range []*iptables.IPTable{ipt4, ipt6} {
-		iptBin := "iptables"
-		if i == 1 {
-			iptBin = "ip6tables"
-		}
-
-		// Ensure UNCLOUD-INPUT chain exists. All existing rules are flushed.
-		if _, err := ipt.NewChain(UncloudInputChain, iptables.Filter); err != nil {
-			return fmt.Errorf("create %s chain '%s': %w", iptBin, UncloudInputChain, err)
-		}
-		if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-F", UncloudInputChain); err != nil {
-			return fmt.Errorf("flush %s chain '%s': %w", iptBin, UncloudInputChain, err)
-		}
-
-		// Ensure the main INPUT chain has a jump rule to the UNCLOUD-INPUT chain before any DROP/REJECT rules.
-		jumpRule := []string{"-m", "comment", "--comment", "Uncloud-managed", "-j", UncloudInputChain}
-		if !ipt.Exists(iptables.Filter, "INPUT", jumpRule...) {
-			// Look for the first DROP/REJECT rule in the INPUT chain.
-			out, err := ipt.Raw("-t", string(iptables.Filter), "-L", "INPUT", "--line-numbers")
-			if err != nil {
-				return fmt.Errorf("get %s rules for chain '%s': %w", iptBin, UncloudInputChain, err)
-			}
-
-			firstRejectRuleNum := 0
-			for _, line := range strings.Split(string(out), "\n") {
-				fields := strings.Fields(line)
-				if len(fields) < 2 {
-					continue
-				}
-				if fields[1] == "DROP" || fields[1] == "REJECT" {
-					if ruleNum, err := strconv.Atoi(fields[0]); err == nil {
-						firstRejectRuleNum = ruleNum
-						break
-					}
-				}
-			}
-
-			var addJumpRule []string
-			if firstRejectRuleNum > 0 {
-				addJumpRule = append([]string{
-					"-t", string(iptables.Filter),
-					"-I", "INPUT",
-					strconv.Itoa(firstRejectRuleNum),
-				}, jumpRule...)
-			} else {
-				addJumpRule = append([]string{
-					"-t", string(iptables.Filter),
-					"-A", "INPUT",
-				}, jumpRule...)
-			}
-			if err = ipt.RawCombinedOutput(addJumpRule...); err != nil {
-				return fmt.Errorf("add %s rule '%s': %w", iptBin, strings.Join(addJumpRule, " "), err)
-			}
-		}
-	}
-
-	return nil
-}
-
-// CleanupIptablesChains removes the custom iptables chains and rules created by ConfigureIptablesChains.
-func CleanupIptablesChains() error {
-	ipt4 := iptables.GetIptable(iptables.IPv4)
-	ipt6 := iptables.GetIptable(iptables.IPv6)
-
-	for i, ipt := range []*iptables.IPTable{ipt4, ipt6} {
-		iptBin := "iptables"
-		if i == 1 {
-			iptBin = "ip6tables"
-		}
-
-		// First, remove the jump rule from INPUT chain to UNCLOUD-INPUT.
-		jumpRule := []string{"-m", "comment", "--comment", "Uncloud-managed", "-j", UncloudInputChain}
-		if err := ipt.ProgramRule(iptables.Filter, "INPUT", iptables.Delete, jumpRule); err != nil {
-			return fmt.Errorf("delete %s jump rule from INPUT: %w", iptBin, err)
-		}
-
-		// Flush all rules from UNCLOUD-INPUT chain as it must be empty before deletion.
-		if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-F", UncloudInputChain); err != nil {
-			// Chain might not exist which is fine.
-			if !strings.Contains(err.Error(), "No chain") {
-				return fmt.Errorf("flush %s chain '%s': %w", iptBin, UncloudInputChain, err)
-			}
-		}
-
-		// Delete the UNCLOUD-INPUT chain.
-		if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-X", UncloudInputChain); err != nil {
-			// Chain might not exist which is fine.
-			if !strings.Contains(err.Error(), "No chain") {
-				return fmt.Errorf("delete %s chain '%s': %w", iptBin, UncloudInputChain, err)
-			}
-		} else {
-			slog.Info(fmt.Sprintf("Deleted %s chain.", iptBin), "chain", UncloudInputChain)
-		}
-	}
-
 	return nil
 }

internal/machine/machine.go

@@ -13,7 +13,6 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
-	"sync"
 
 	"github.com/docker/docker/client"
 	"github.com/docker/go-connections/sockets"
@@ -22,9 +21,8 @@ import (
 	"github.com/psviderski/uncloud/internal/fs"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	apiproxy "github.com/psviderski/uncloud/internal/machine/api/proxy"
-	"github.com/psviderski/uncloud/internal/machine/caddyconfig"
+	"github.com/psviderski/uncloud/internal/machine/caddyfile"
 	"github.com/psviderski/uncloud/internal/machine/cluster"
-	"github.com/psviderski/uncloud/internal/machine/constants"
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	machinedocker "github.com/psviderski/uncloud/internal/machine/docker"
@@ -151,14 +149,7 @@ type Machine struct {
 	started chan struct{}
 	// initialised is signalled when the machine is configured as a member of a cluster.
 	initialised chan struct{}
-	// networkReady is signalled when the Docker network is configured and ready for containers.
-	networkReady chan struct{}
-	// resetting is true when the machine is being reset.
-	resetting bool
-	// stop cancels the Run method context to stop the machine gracefully.
-	stop func()
 
-	clusterCtrl *clusterController
 	// store is the cluster store backed by a distributed Corrosion database.
 	store   *store.Store
 	cluster *cluster.Cluster
@@ -172,9 +163,6 @@ type Machine struct {
 	// It proxies requests to the local or remote machine API servers depending on the request targets
 	// and aggregates responses.
 	localProxyServer *grpc.Server
-
-	// mu protects the Machine from concurrent reads and writes.
-	mu sync.RWMutex
 }
 
 func NewMachine(config *Config) (*Machine, error) {
@@ -234,7 +222,7 @@ func NewMachine(config *Config) (*Machine, error) {
 	}
 
 	// Init a local gRPC proxy server that proxies requests to the local or remote machine API servers.
-	proxyDirector := apiproxy.NewDirector(config.MachineSockPath, constants.MachineAPIPort)
+	proxyDirector := apiproxy.NewDirector(config.MachineSockPath, APIPort)
 	localProxyServer := grpc.NewServer(
 		grpc.ForceServerCodecV2(proxy.Codec()),
 		grpc.UnknownServiceHandler(
@@ -247,7 +235,6 @@ func NewMachine(config *Config) (*Machine, error) {
 		state:            state,
 		started:          make(chan struct{}),
 		initialised:      make(chan struct{}, 1),
-		networkReady:     make(chan struct{}),
 		store:            corroStore,
 		cluster:          c,
 		localProxyServer: localProxyServer,
@@ -258,9 +245,7 @@ func NewMachine(config *Config) (*Machine, error) {
 	internalDNSIP := func() netip.Addr {
 		return m.IP()
 	}
-	m.docker = machinedocker.NewServer(dockerCli, db, internalDNSIP,
+	m.docker = machinedocker.NewServer(dockerCli, db, internalDNSIP)
-		machinedocker.WithNetworkReady(m.IsNetworkReady),
-		machinedocker.WithWaitForNetworkReady(m.WaitForNetworkReady))
 	m.localMachineServer = newGRPCServer(m, c, m.docker)
 
 	if m.Initialised() {
@@ -302,9 +287,6 @@ func (m *Machine) IP() netip.Addr {
 }
 
 func (m *Machine) Run(ctx context.Context) error {
-	// Create a cancellable context for the Run method to allow stopping the machine gracefully.
-	ctx, m.stop = context.WithCancel(ctx)
-
 	// Docker dependency is essential for the machine to function. Block until it's ready.
 	if err := docker.WaitDaemonReady(ctx, m.config.DockerClient); err != nil {
 		return fmt.Errorf("wait for Docker daemon: %w", err)
@@ -312,7 +294,7 @@ func (m *Machine) Run(ctx context.Context) error {
 
 	// Configure and start the corrosion service on the loopback if the machine is not initialised as a cluster
 	// member. This provides the store required for the machine to initialise a new cluster on it. Once the machine
-	// is initialised, the corrosion service is managed by the clusterController.
+	// is initialised, the corrosion service is managed by the networkController.
 	if !m.Initialised() {
 		if err := m.configureCorrosion(); err != nil {
 			return fmt.Errorf("configure corrosion service: %w", err)
@@ -322,7 +304,6 @@ func (m *Machine) Run(ctx context.Context) error {
 		if err := m.config.CorrosionService.Start(ctx); err != nil {
 			return fmt.Errorf("start corrosion service: %w", err)
 		}
-		slog.Info("Corrosion service started.")
 	}
 
 	// Use an errgroup to coordinate error handling and graceful shutdown of multiple machine components.
@@ -333,129 +314,147 @@ func (m *Machine) Run(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("listen machine API unix socket %q: %w", m.config.MachineSockPath, err)
 	}
-	errGroup.Go(func() error {
+	errGroup.Go(
-		slog.Info("Starting local machine API server.", "path", m.config.MachineSockPath)
+		func() error {
-		if err := m.localMachineServer.Serve(machineListener); err != nil {
+			slog.Info("Starting local machine API server.", "path", m.config.MachineSockPath)
-			return fmt.Errorf("local machine API server failed: %w", err)
+			if err := m.localMachineServer.Serve(machineListener); err != nil {
-		}
+				return fmt.Errorf("local machine API server failed: %w", err)
-		return nil
+			}
-	})
+			return nil
+		},
+	)
 
 	// Start the local API proxy server.
 	proxyListener, err := listenUnixSocket(m.config.UncloudSockPath)
 	if err != nil {
 		return fmt.Errorf("listen API proxy unix socket %q: %w", m.config.UncloudSockPath, err)
 	}
-	errGroup.Go(func() error {
+	errGroup.Go(
-		slog.Info("Starting local API proxy server.", "path", m.config.UncloudSockPath)
+		func() error {
-		if err := m.localProxyServer.Serve(proxyListener); err != nil {
+			slog.Info("Starting local API proxy server.", "path", m.config.UncloudSockPath)
-			return fmt.Errorf("local API proxy server failed: %w", err)
+			if err := m.localProxyServer.Serve(proxyListener); err != nil {
-		}
+				return fmt.Errorf("local API proxy server failed: %w", err)
-		return nil
+			}
-	})
+			return nil
+		},
+	)
 	// Signal that the machine is ready.
 	close(m.started)
 
-	// Wait for the machine to be initialised as a member of a cluster and run the cluster controller.
+	// Control loop for managing components that depend on the machine being initialised as a cluster member.
-	errGroup.Go(func() error {
+	errGroup.Go(
-		if !m.Initialised() {
+		func() error {
-			slog.Info(
+			if !m.Initialised() {
-				"Waiting for the machine to be initialised as a member of a cluster to start the cluster controller.",
+				slog.Info(
-			)
+					"Waiting for the machine to be initialised as a member of a cluster " +
-		}
+						"to start the network controller.",
-
+				)
-		select {
-		case <-m.initialised:
-			m.cluster.UpdateMachineID(m.state.ID)
-
-			// Ensure the corrosion config is up to date, including a new gossip address if the machine
-			// has just joined a cluster.
-			if err := m.configureCorrosion(); err != nil {
-				return fmt.Errorf("configure corrosion service: %w", err)
-			}
-			slog.Info("Configured corrosion service.", "dir", m.config.CorrosionDir)
-
-			slog.Info("Starting cluster controller.")
-			// Update the proxy director's local address to the machine's management IP address, allowing
-			// the proxy to identify which requests should be proxied to the local machine API server.
-			m.proxyDirector.UpdateLocalAddress(m.state.Network.ManagementIP.String())
-			proxyServer := grpc.NewServer(
-				grpc.ForceServerCodecV2(proxy.Codec()),
-				grpc.UnknownServiceHandler(
-					proxy.TransparentHandler(m.proxyDirector.Director),
-				),
-			)
-
-			// Create a new caddyconfig controller for managing the Caddy reverse proxy configuration.
-			// It will also serve the current machine ID at /.uncloud-verify to verify Caddy reachability.
-			caddyconfigCtrl, err := caddyconfig.NewController(m.store, m.config.CaddyConfigPath, m.state.ID)
-			if err != nil {
-				return fmt.Errorf("create caddyconfig controller: %w", err)
 			}
 
-			dnsResolver := dns.NewClusterResolver(m.store)
+			var ctrl *networkController
-			dnsServer, err := dns.NewServer(m.IP(), dnsResolver, m.config.DNSUpstreams)
+			// Error channel for communicating the termination of the network controller.
-			if err != nil {
+			errCh := make(chan error)
-				return fmt.Errorf("create embedded DNS server: %w", err)
+
+			for {
+				select {
+				// Wait for the machine to be initialised as a member of a cluster to start the network controller.
+				// It can be reset when leaving the cluster and then re-initialised again with a new configuration.
+				case <-m.initialised:
+					var err error
+
+					m.cluster.UpdateMachineID(m.state.ID)
+
+					// Ensure the corrosion config is up to date, including a new gossip address if the machine
+					// has just joined a cluster.
+					if err = m.configureCorrosion(); err != nil {
+						return fmt.Errorf("configure corrosion service: %w", err)
+					}
+					slog.Info("Configured corrosion service.", "dir", m.config.CorrosionDir)
+
+					slog.Info("Starting network controller.")
+					// Update the proxy director's local address to the machine's management IP address, allowing
+					// the proxy to identify which requests should be proxied to the local machine API server.
+					m.proxyDirector.UpdateLocalAddress(m.state.Network.ManagementIP.String())
+					proxyServer := grpc.NewServer(
+						grpc.ForceServerCodecV2(proxy.Codec()),
+						grpc.UnknownServiceHandler(
+							proxy.TransparentHandler(m.proxyDirector.Director),
+						),
+					)
+
+					// Create a new Caddyfile controller for managing the Caddy reverse proxy configuration.
+					// It will also serve the current machine ID at /.uncloud-verify to verify Caddy reachability.
+					caddyfileCtrl, err := caddyfile.NewController(m.store, m.config.CaddyConfigPath, m.state.ID)
+					if err != nil {
+						return fmt.Errorf("create Caddyfile controller: %w", err)
+					}
+
+					dnsResolver := dns.NewClusterResolver(m.store)
+					dnsServer, err := dns.NewServer(m.IP(), dnsResolver, m.config.DNSUpstreams)
+					if err != nil {
+						return fmt.Errorf("create embedded DNS server: %w", err)
+					}
+
+					ctrl, err = newNetworkController(
+						m.state,
+						m.store,
+						proxyServer,
+						m.config.CorrosionService,
+						m.config.DockerClient,
+						caddyfileCtrl,
+						dnsServer,
+						dnsResolver,
+					)
+					if err != nil {
+						return fmt.Errorf("initialise network controller: %w", err)
+					}
+
+					go func() {
+						if err = ctrl.Run(ctx); err != nil {
+							errCh <- fmt.Errorf("run network controller: %w", err)
+						} else {
+							slog.Info("Network controller stopped.")
+							errCh <- nil
+						}
+					}()
+				case err := <-errCh:
+					if err != nil {
+						return err
+					}
+					ctrl = nil
+				case <-ctx.Done():
+					// Wait for the network controller to stop before returning.
+					if ctrl != nil {
+						if err := <-errCh; err != nil {
+							return err
+						}
+					}
+					return nil
+				}
 			}
-
+		},
-			m.mu.Lock()
+	)
-			m.clusterCtrl, err = newClusterController(
-				m.state,
-				m.store,
-				proxyServer,
-				m.config.CorrosionService,
-				m.config.DockerClient,
-				m.networkReady,
-				caddyconfigCtrl,
-				dnsServer,
-				dnsResolver,
-			)
-			m.mu.Unlock()
-			if err != nil {
-				return fmt.Errorf("initialise cluster controller: %w", err)
-			}
-
-			if err = m.clusterCtrl.Run(ctx); err != nil {
-				return fmt.Errorf("run cluster controller: %w", err)
-			}
-			slog.Info("Cluster controller stopped.")
-
-		case <-ctx.Done():
-			// The context was cancelled before the machine was initialised.
-		}
-
-		return nil
-	})
 
 	// Shutdown goroutine.
-	errGroup.Go(func() error {
+	errGroup.Go(
-		var err error
+		func() error {
+			<-ctx.Done()
+			slog.Info("Stopping local machine API server.")
+			// TODO: implement timeout for graceful shutdown.
+			m.localMachineServer.GracefulStop()
+			slog.Info("Local machine API server stopped.")
 
-		<-ctx.Done()
+			slog.Info("Stopping local API proxy server.")
-		slog.Info("Stopping local machine API server.")
+			// TODO: implement timeout for graceful shutdown.
-		// TODO: implement timeout for graceful shutdown.
+			m.localProxyServer.GracefulStop()
-		m.localMachineServer.GracefulStop()
+			// Close the proxy director to close all backend connections.
-		slog.Info("Local machine API server stopped.")
+			m.proxyDirector.Close()
+			slog.Info("Local API proxy server stopped.")
 
-		slog.Info("Stopping local API proxy server.")
+			m.config.DockerClient.Close()
-		// TODO: implement timeout for graceful shutdown.
+			return nil
-		m.localProxyServer.GracefulStop()
+		},
-		// Close the proxy director to close all backend connections.
+	)
-		m.proxyDirector.Close()
-		slog.Info("Local API proxy server stopped.")
-
-		// Clean up the machine data and resources if the machine shutdown was initiated by a reset.
-		if m.resetting {
-			slog.Info("Cleaning up machine data and resources.")
-			if err = m.cleanup(); err != nil {
-				slog.Error("Failed to clean up machine data and resources.", "err", err)
-			}
-		}
-
-		m.config.DockerClient.Close()
-		return err
-	})
 
 	return errGroup.Wait()
 }
@@ -484,7 +483,7 @@ func listenUnixSocket(path string) (net.Listener, error) {
 
 	// Ensure the parent directory exists and has the correct group permissions.
 	parent, _ := filepath.Split(path)
-	if err = os.MkdirAll(parent, 0o750); err != nil {
+	if err = os.MkdirAll(parent, 0750); err != nil {
 		return nil, fmt.Errorf("create directory %q: %w", parent, err)
 	}
 	if err = os.Chown(parent, -1, gid); err != nil {
@@ -538,36 +537,13 @@ func (m *Machine) configureCorrosion() error {
 		return fmt.Errorf("write corrosion config: %w", err)
 	}
 
-	if err := os.WriteFile(schemaPath, []byte(store.Schema), 0o644); err != nil {
+	if err := os.WriteFile(schemaPath, []byte(store.Schema), 0644); err != nil {
 		return fmt.Errorf("write corrosion schema: %w", err)
 	}
 
 	return nil
 }
 
-// cleanup removes the machine resources and persistent state.
-func (m *Machine) cleanup() error {
-	var errs []error
-
-	m.mu.RLock()
-	clusterCtrl := m.clusterCtrl
-	m.mu.RUnlock()
-	if clusterCtrl != nil {
-		if err := clusterCtrl.Cleanup(); err != nil {
-			errs = append(errs, fmt.Errorf("cleanup cluster resources: %w", err))
-		}
-	}
-
-	if err := os.RemoveAll(m.config.DataDir); err != nil {
-		errs = append(errs,
-			fmt.Errorf("remove data directory with persistent machine state '%s': %w", m.config.DataDir, err))
-	} else {
-		slog.Info("Removed data directory storing persistent machine state.", "path", m.config.DataDir)
-	}
-
-	return errors.Join(errs...)
-}
-
 // CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 func (m *Machine) CheckPrerequisites(ctx context.Context, _ *emptypb.Empty) (*pb.CheckPrerequisitesResponse, error) {
 	// Check DNS port (UDP) availability.
@@ -800,64 +776,6 @@ func (m *Machine) Inspect(_ context.Context, _ *emptypb.Empty) (*pb.MachineInfo,
 	}, nil
 }
 
-// IsNetworkReady returns true if the Docker network is ready for containers.
-func (m *Machine) IsNetworkReady() bool {
-	if !m.Initialised() {
-		// If machine is not initialized, there's no network to check
-		return false
-	}
-
-	// Check if network is ready by checking if the networkReady channel has been closed
-	select {
-	case <-m.networkReady:
-		return true
-	default:
-		return false
-	}
-}
-
-// WaitForNetworkReady waits for the Docker network to be ready for containers.
-// It returns nil when the network is ready or an error if the context is cancelled.
-func (m *Machine) WaitForNetworkReady(ctx context.Context) error {
-	if !m.Initialised() {
-		// If machine is not initialized, there's no network to wait for
-		return nil
-	}
-
-	// Wait for network to be ready or context to be cancelled
-	select {
-	case <-m.networkReady:
-		return nil
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-// Reset restores the machine to a clean state, scheduling a graceful shutdown and removing all cluster-related
-// configuration and resource. The uncloud daemon will restart the machine if managed by systemd.
-func (m *Machine) Reset(ctx context.Context, _ *pb.ResetRequest) (*emptypb.Empty, error) {
-	if !m.Initialised() {
-		return nil, nil
-	}
-
-	// Check if the machine is already being reset to avoid concurrent resets.
-	m.mu.Lock()
-	if m.resetting {
-		m.mu.Unlock()
-		return nil, status.Error(codes.FailedPrecondition, "machine is already being reset")
-	}
-	m.resetting = true
-	m.mu.Unlock()
-
-	slog.Info("Resetting machine to a clean state.")
-	// Trigger the machine shutdown. The resetting boolean informs the machine to clean up its resources on shutdown.
-	// We can't clean up the resources synchronously here because this is an RPC call that depends on the running
-	// gRPC server and network.
-	m.stop()
-
-	return &emptypb.Empty{}, nil
-}
-
 // InspectService returns detailed information about a service and its containers stored in the cluster store.
 func (m *Machine) InspectService(
 	ctx context.Context, req *pb.InspectServiceRequest,

internal/machine/network.go

@@ -14,8 +14,7 @@ import (
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/caddyconfig"
+	"github.com/psviderski/uncloud/internal/machine/caddyfile"
-	"github.com/psviderski/uncloud/internal/machine/constants"
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/docker"
@@ -26,10 +25,11 @@ import (
 	"google.golang.org/grpc"
 )
 
-// clusterController is the main controller for the machine that is a cluster member. It manages components such as
+const (
-// the WireGuard network, API server listening the WireGuard network, Corrosion service, Docker network and containers,
+	APIPort = 51000
-// and others.
+)
-type clusterController struct {
+
+type networkController struct {
 	state *State
 	store *store.Store
 
@@ -39,30 +39,25 @@ type clusterController struct {
 	server        *grpc.Server
 	corroService  corroservice.Service
 	dockerCli     *client.Client
-	dockerManager *docker.Manager
+	caddyfileCtrl *caddyfile.Controller
-	// dockerReady is signalled when Docker is configured and ready for containers.
-	dockerReady     chan<- struct{}
-	caddyconfigCtrl *caddyconfig.Controller
 
 	// dnsServer is the embedded internal DNS server for the cluster listening on the machine IP.
 	dnsServer   *dns.Server
 	dnsResolver *dns.ClusterResolver
-
-	// stopped is a channel that is closed when the controller is stopped.
-	stopped chan struct{}
 }
 
-func newClusterController(
+func newNetworkController(
 	state *State,
 	store *store.Store,
 	server *grpc.Server,
 	corroService corroservice.Service,
 	dockerCli *client.Client,
-	dockerReady chan<- struct{},
+	caddyfileCtrl *caddyfile.Controller,
-	caddyfileCtrl *caddyconfig.Controller,
 	dnsServer *dns.Server,
 	dnsResolver *dns.ClusterResolver,
-) (*clusterController, error) {
+) (
+	*networkController, error,
+) {
 	slog.Info("Starting WireGuard network.")
 	wgnet, err := network.NewWireGuardNetwork()
 	if err != nil {
@@ -70,7 +65,7 @@ func newClusterController(
 	}
 	endpointChanges := wgnet.WatchEndpoints()
 
-	return &clusterController{
+	return &networkController{
 		state:           state,
 		store:           store,
 		wgnet:           wgnet,
@@ -78,90 +73,80 @@ func newClusterController(
 		server:          server,
 		corroService:    corroService,
 		dockerCli:       dockerCli,
-		dockerManager:   docker.NewManager(dockerCli, state.ID, store),
+		caddyfileCtrl:   caddyfileCtrl,
-		dockerReady:     dockerReady,
-		caddyconfigCtrl: caddyfileCtrl,
 		dnsServer:       dnsServer,
 		dnsResolver:     dnsResolver,
-		stopped:         make(chan struct{}),
 	}, nil
 }
 
-func (cc *clusterController) Run(ctx context.Context) error {
+func (nc *networkController) Run(ctx context.Context) error {
-	defer close(cc.stopped)
-
 	if err := firewall.ConfigureIptablesChains(); err != nil {
 		return fmt.Errorf("configure iptables chains: %w", err)
 	}
 
-	if err := cc.ensureDockerNetwork(ctx); err != nil {
+	if err := nc.wgnet.Configure(*nc.state.Network); err != nil {
-		return err
-	}
-	slog.Info("Docker network configured.")
-
-	if err := cc.wgnet.Configure(*cc.state.Network); err != nil {
 		return fmt.Errorf("configure WireGuard network: %w", err)
 	}
 	slog.Info("WireGuard network configured.")
 
-	if cc.corroService.Running() {
+	if nc.corroService.Running() {
 		// Corrosion service was running before the WireGuard network was configured so we need to restart it.
 		slog.Info("Restarting corrosion service to apply new configuration with WireGuard network.")
-		if err := cc.corroService.Restart(ctx); err != nil {
+		if err := nc.corroService.Restart(ctx); err != nil {
 			return fmt.Errorf("restart corrosion service: %w", err)
 		}
-		slog.Info("Corrosion service restarted.")
 	} else {
 		slog.Info("Starting corrosion service.")
-		if err := cc.corroService.Start(ctx); err != nil {
+		if err := nc.corroService.Start(ctx); err != nil {
 			return fmt.Errorf("start corrosion service: %w", err)
 		}
-		slog.Info("Corrosion service started.")
 	}
+	// TODO: Figure out if we need to manually stop the corrosion service when the context is done or just
+	//  rely on systemd to handle service dependencies on its own.
 
 	errGroup, ctx := errgroup.WithContext(ctx)
 
 	// Start the network API server. Assume the management IP can't be changed when the network is running.
-	apiAddr := net.JoinHostPort(cc.state.Network.ManagementIP.String(), strconv.Itoa(constants.MachineAPIPort))
+	apiAddr := net.JoinHostPort(nc.state.Network.ManagementIP.String(), strconv.Itoa(APIPort))
 	listener, err := net.Listen("tcp", apiAddr)
 	if err != nil {
 		return fmt.Errorf("listen API port: %w", err)
 	}
-	errGroup.Go(func() error {
+	errGroup.Go(
-		slog.Info("Starting network API server.", "addr", apiAddr)
+		func() error {
-		if err := cc.server.Serve(listener); err != nil {
+			slog.Info("Starting network API server.", "addr", apiAddr)
-			return fmt.Errorf("network API server failed: %w", err)
+			if err := nc.server.Serve(listener); err != nil {
-		}
+				return fmt.Errorf("network API server failed: %w", err)
-		return nil
+			}
-	})
+			return nil
+		},
+	)
 
 	errGroup.Go(func() error {
 		slog.Info("Starting embedded DNS resolver.")
-		if err := cc.dnsResolver.Run(ctx); err != nil {
+		if err := nc.dnsResolver.Run(ctx); err != nil {
 			return fmt.Errorf("embedded DNS resolver failed: %w", err)
 		}
 		return nil
 	})
 
-	// The Docker network must be created before starting the DNS server because it listens on the machine IP.
 	errGroup.Go(func() error {
 		slog.Info("Starting embedded DNS server.")
-		if err := cc.dnsServer.Run(ctx); err != nil {
+		if err := nc.dnsServer.Run(ctx); err != nil {
 			return fmt.Errorf("embedded DNS server failed: %w", err)
 		}
 		return nil
 	})
 
-	// Synchronise Docker containers to the cluster store.
+	// Setup Docker network and synchronise containers to the cluster store.
 	errGroup.Go(func() error {
-		slog.Info("Watching Docker containers and syncing them to cluster store.")
+		return nc.prepareAndWatchDocker(ctx)
-		return cc.syncDockerContainers(ctx)
 	})
 
 	// Handle machine changes in the cluster. Handling machine and endpoint changes should be done
 	// in separate goroutines to avoid a deadlock when reconfiguring the network.
 	errGroup.Go(func() error {
-		if err := cc.handleMachineChanges(ctx); err != nil {
+		if err := nc.handleMachineChanges(ctx); err != nil {
 			return fmt.Errorf("handle new machines: %w", err)
 		}
 		return nil
@@ -171,24 +156,24 @@ func (cc *clusterController) Run(ctx context.Context) error {
 	errGroup.Go(func() error {
 		for {
 			select {
-			case e, ok := <-cc.endpointChanges:
+			case e, ok := <-nc.endpointChanges:
 				if !ok {
 					// The channel was closed, stop watching for changes.
-					cc.endpointChanges = nil
+					nc.endpointChanges = nil
 					return nil
 				}
 
-				cc.state.mu.Lock()
+				nc.state.mu.Lock()
-				for i := range cc.state.Network.Peers {
+				for i := range nc.state.Network.Peers {
-					if cc.state.Network.Peers[i].PublicKey.Equal(e.PublicKey) {
+					if nc.state.Network.Peers[i].PublicKey.Equal(e.PublicKey) {
-						cc.state.Network.Peers[i].Endpoint = &e.Endpoint
+						nc.state.Network.Peers[i].Endpoint = &e.Endpoint
 						break
 					}
 				}
-				if err := cc.state.Save(); err != nil {
+				if err := nc.state.Save(); err != nil {
 					slog.Error("Failed to save machine state.", "err", err)
 				}
-				cc.state.mu.Unlock()
+				nc.state.mu.Unlock()
 
 				slog.Debug("Preserved endpoint change in the machine state.",
 					"public_key", e.PublicKey, "endpoint", e.Endpoint)
@@ -199,65 +184,48 @@ func (cc *clusterController) Run(ctx context.Context) error {
 	})
 
 	errGroup.Go(func() error {
-		if err := cc.wgnet.Run(ctx); err != nil {
+		if err := nc.wgnet.Run(ctx); err != nil {
 			return fmt.Errorf("WireGuard network failed: %w", err)
 		}
 		return nil
 	})
 
 	errGroup.Go(func() error {
-		slog.Info("Starting caddyconfig controller.")
+		slog.Info("Starting Caddyfile controller.")
-		if err := cc.caddyconfigCtrl.Run(ctx); err != nil {
+		if err := nc.caddyfileCtrl.Run(ctx); err != nil {
-			return fmt.Errorf("caddyconfig controller failed: %w", err)
+			//goland:noinspection GoErrorStringFormat
+			return fmt.Errorf("Caddyfile controller failed: %w", err)
 		}
 		return nil
 	})
 
 	// Wait for the context to be done and stop the network API server.
-	<-ctx.Done()
+	errGroup.Go(func() error {
-	slog.Info("Stopping network API server.")
+		<-ctx.Done()
-	// TODO: implement timeout for graceful shutdown.
+		slog.Info("Stopping network API server.")
-	cc.server.GracefulStop()
+		// TODO: implement timeout for graceful shutdown.
-	slog.Info("Network API server stopped.")
+		nc.server.GracefulStop()
+		slog.Info("Network API server stopped.")
+		return nil
+	})
 
-	// Wait for all controllers to finish.
+	return errGroup.Wait()
-	err = errGroup.Wait()
-
-	// It's safe to stop the Corrosion service after the controllers depending on it and API server are stopped.
-	// Use a new context with a timeout as the current context is already canceled.
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	if corroErr := cc.corroService.Stop(ctx); corroErr != nil {
-		err = errors.Join(err, fmt.Errorf("stop corrosion service: %w", corroErr))
-	} else {
-		slog.Info("Corrosion service stopped.")
-	}
-
-	return err
 }
 
-// ensureDockerNetwork ensures that the Docker network is configured and ready for containers.
+// prepareAndWatchDocker configures the Docker network and watches local Docker containers to sync them
-func (cc *clusterController) ensureDockerNetwork(ctx context.Context) error {
+// to the cluster store.
-	if err := cc.dockerManager.WaitDaemonReady(ctx); err != nil {
+func (nc *networkController) prepareAndWatchDocker(ctx context.Context) error {
+	manager := docker.NewManager(nc.dockerCli, nc.state.ID, nc.store)
+	if err := manager.WaitDaemonReady(ctx); err != nil {
 		return fmt.Errorf("wait for Docker daemon: %w", err)
 	}
 
-	if err := cc.dockerManager.EnsureUncloudNetwork(
+	if err := manager.EnsureUncloudNetwork(ctx, nc.state.Network.Subnet, nc.dnsServer.ListenAddr()); err != nil {
-		ctx,
-		cc.state.Network.Subnet,
-		cc.dnsServer.ListenAddr(),
-	); err != nil {
 		return fmt.Errorf("ensure Docker network: %w", err)
 	}
+	slog.Info("Docker network configured.")
 
-	// Signal that Docker is ready for containers.
+	slog.Info("Watching Docker containers and syncing them to cluster store.")
-	close(cc.dockerReady)
-
-	return nil
-}
-
-// syncDockerContainers watches local Docker containers and syncs them to the cluster store.
-func (cc *clusterController) syncDockerContainers(ctx context.Context) error {
 	// Retry to watch and sync containers until the context is done.
 	boff := backoff.WithContext(backoff.NewExponentialBackOff(
 		backoff.WithInitialInterval(100*time.Millisecond),
@@ -265,7 +233,7 @@ func (cc *clusterController) syncDockerContainers(ctx context.Context) error {
 		backoff.WithMaxElapsedTime(0),
 	), ctx)
 	watchAndSync := func() error {
-		if wErr := cc.dockerManager.WatchAndSyncContainers(ctx); wErr != nil {
+		if wErr := manager.WatchAndSyncContainers(ctx); wErr != nil {
 			slog.Error("Failed to watch and sync containers to cluster store, retrying.", "err", wErr)
 			return wErr
 		}
@@ -283,7 +251,7 @@ func (cc *clusterController) syncDockerContainers(ctx context.Context) error {
 
 // handleMachineChanges subscribes to machine changes in the cluster and reconfigures the network peers accordingly
 // when changes occur.
-func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
+func (nc *networkController) handleMachineChanges(ctx context.Context) error {
 	for {
 		// Retry to subscribe to machine changes indefinitely until the context is done.
 		boff := backoff.WithContext(backoff.NewExponentialBackOff(
@@ -298,7 +266,7 @@ func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
 			err      error
 		)
 		subscribe := func() error {
-			if machines, changes, err = cc.store.SubscribeMachines(ctx); err != nil {
+			if machines, changes, err = nc.store.SubscribeMachines(ctx); err != nil {
 				slog.Info("Failed to subscribe to machine changes, retrying.", "err", err)
 			}
 			return err
@@ -316,7 +284,7 @@ func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
 		// completes. Skip configuration now and apply it when the store changes are received.
 		if len(machines) > 0 {
 			slog.Info("Reconfiguring network peers with the current machines.", "machines", len(machines))
-			if err = cc.configurePeers(machines); err != nil {
+			if err = nc.configurePeers(machines); err != nil {
 				slog.Error("Failed to configure peers.", "err", err)
 			}
 		}
@@ -328,11 +296,11 @@ func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
 			//  be reworked as well.
 			case <-changes:
 				slog.Info("Cluster machines changed, reconfiguring network peers.")
-				if machines, err = cc.store.ListMachines(ctx); err != nil {
+				if machines, err = nc.store.ListMachines(ctx); err != nil {
 					slog.Error("Failed to list machines.", "err", err)
 					continue
 				}
-				if err = cc.configurePeers(machines); err != nil {
+				if err = nc.configurePeers(machines); err != nil {
 					slog.Error("Failed to configure peers.", "err", err)
 				}
 			case <-ctx.Done():
@@ -342,23 +310,23 @@ func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
 	}
 }
 
-func (cc *clusterController) configurePeers(machines []*pb.MachineInfo) error {
+func (nc *networkController) configurePeers(machines []*pb.MachineInfo) error {
 	if len(machines) == 0 {
 		return fmt.Errorf("no machines to configure peers")
 	}
 
-	cc.state.mu.RLock()
+	nc.state.mu.RLock()
-	currentPeerEndpoints := make(map[string]*netip.AddrPort, len(cc.state.Network.Peers))
+	currentPeerEndpoints := make(map[string]*netip.AddrPort, len(nc.state.Network.Peers))
-	for _, p := range cc.state.Network.Peers {
+	for _, p := range nc.state.Network.Peers {
 		currentPeerEndpoints[p.PublicKey.String()] = p.Endpoint
 	}
-	cc.state.mu.RUnlock()
+	nc.state.mu.RUnlock()
 
 	// Construct the list of peers from the machine configurations ensuring that the current endpoint is preserved.
 	peers := make([]network.PeerConfig, 0, len(machines)-1)
 	for _, m := range machines {
 		// Skip the current machine.
-		if m.Id == cc.state.ID {
+		if m.Id == nc.state.ID {
 			continue
 		}
 		if err := m.Network.Validate(); err != nil {
@@ -391,37 +359,20 @@ func (cc *clusterController) configurePeers(machines []*pb.MachineInfo) error {
 	}
 
 	// Preserve the new list of peers in the machine state.
-	cc.state.mu.Lock()
+	nc.state.mu.Lock()
-	cc.state.Network.Peers = peers
+	nc.state.Network.Peers = peers
-	err := cc.state.Save()
+	err := nc.state.Save()
-	cc.state.mu.Unlock()
+	nc.state.mu.Unlock()
 	if err != nil {
 		return fmt.Errorf("save machine state: %w", err)
 	}
 
-	cc.state.mu.RLock()
+	nc.state.mu.RLock()
-	defer cc.state.mu.RUnlock()
+	defer nc.state.mu.RUnlock()
-	if err = cc.wgnet.Configure(*cc.state.Network); err != nil {
+	if err = nc.wgnet.Configure(*nc.state.Network); err != nil {
 		return fmt.Errorf("configure network peers: %w", err)
 	}
 	return nil
 }
 
-// Cleanup cleans up the cluster resources such as the WireGuard network, iptables rules, Docker network and containers.
+// TODO: method to shutdown network when leaving a cluster. Regular context cancellation shouldn't bring it down.
-func (cc *clusterController) Cleanup() error {
-	// Wait for the controller to stop before cleaning up.
-	<-cc.stopped
-
-	var errs []error
-	if err := cc.dockerManager.Cleanup(); err != nil {
-		errs = append(errs, fmt.Errorf("cleanup Docker resources: %w", err))
-	}
-	if err := cc.wgnet.Cleanup(); err != nil {
-		errs = append(errs, fmt.Errorf("cleanup WireGuard network: %w", err))
-	}
-	if err := firewall.CleanupIptablesChains(); err != nil {
-		errs = append(errs, fmt.Errorf("cleanup iptables chains: %w", err))
-	}
-
-	return errors.Join(errs...)
-}

internal/machine/network/ip.go

@@ -14,7 +14,7 @@ func MachineIP(subnet netip.Prefix) netip.Addr {
 }
 
 // ManagementIP returns the IPv6 address of a peer derived from the first 14 bytes of its public key.
-// This address always starts with fdcc: and is intended for cluster management traffic.
+// This address is intended for cluster management traffic.
 func ManagementIP(publicKey secret.Secret) netip.Addr {
 	bytes := [16]byte{0xfd, 0xcc}
 	copy(bytes[2:], publicKey[:14])

internal/machine/network/peer.go

@@ -1,12 +1,11 @@
 package network
 
 import (
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"log/slog"
 	"net/netip"
 	"slices"
 	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 const (

internal/machine/network/tunnel/tunnel.go

@@ -3,14 +3,13 @@ package tunnel
 import (
 	"context"
 	"fmt"
-	"net"
-	"net/netip"
-	"time"
-
-	"github.com/psviderski/uncloud/internal/secret"
 	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun/netstack"
+	"net"
+	"net/netip"
+	"time"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (

internal/machine/network/wireguard.go

@@ -2,11 +2,10 @@ package network
 
 import (
 	"fmt"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"net/netip"
 	"time"
-
 	"github.com/psviderski/uncloud/internal/secret"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 const (

internal/machine/network/wireguard_darwin.go

@@ -24,7 +24,3 @@ func (n *WireGuardNetwork) Run(ctx context.Context) error {
 func (n *WireGuardNetwork) WatchEndpoints() <-chan EndpointChangeEvent {
 	return nil
 }
-
-func (n *WireGuardNetwork) Cleanup() error {
-	return errors.New("not implemented on darwin")
-}

internal/machine/network/wireguard_linux.go

@@ -6,19 +6,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/vishvananda/netlink"
+	"go4.org/netipx"
+	"golang.org/x/sys/unix"
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
 	"sync"
 	"time"
-
 	"github.com/psviderski/uncloud/internal/secret"
-	"github.com/vishvananda/netlink"
-	"go4.org/netipx"
-	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 type WireGuardNetwork struct {
@@ -27,8 +26,6 @@ type WireGuardNetwork struct {
 	peers map[string]*peer
 	// watchers is a list of channels that are notified when the endpoints of the peers change.
 	watchers []chan EndpointChangeEvent
-	// running indicates whether the network control loop (Run) is currently running.
-	running bool
 	// mu synchronises concurrent network configuration changes.
 	mu sync.Mutex
 }
@@ -81,15 +78,19 @@ func (n *WireGuardNetwork) Configure(config Config) error {
 	}
 	slog.Info("Configured WireGuard interface.", "name", n.link.Attrs().Name)
 
+	machinePrefix := netip.PrefixFrom(MachineIP(config.Subnet), config.Subnet.Bits())
 	managementPrefix, err := addrToSingleIPPrefix(config.ManagementIP)
 	if err != nil {
 		return fmt.Errorf("parse management IP: %w", err)
 	}
-	addrs := []netip.Prefix{managementPrefix}
+	addrs := []netip.Prefix{managementPrefix, machinePrefix}
 	if err = n.updateAddresses(addrs); err != nil {
 		return err
 	}
-	slog.Info("Updated addresses of the WireGuard interface.", "name", n.link.Attrs().Name, "addrs", addrs)
+	slog.Info(
+		"Updated addresses of the WireGuard interface.",
+		"name", n.link.Attrs().Name, "addrs", addrs,
+	)
 
 	// Bring the WireGuard interface up if it's not already up.
 	if n.link.Attrs().Flags&unix.IFF_UP != unix.IFF_UP {
@@ -98,7 +99,7 @@ func (n *WireGuardNetwork) Configure(config Config) error {
 		}
 		slog.Info("Brought WireGuard interface up.", "name", n.link.Attrs().Name)
 	}
-	if err = n.updatePeerRoutes(MachineIP(config.Subnet)); err != nil {
+	if err = n.updatePeerRoutes(); err != nil {
 		return err
 	}
 	slog.Info(
@@ -128,7 +129,7 @@ func (n *WireGuardNetwork) configureDevice(config Config) error {
 		// rotations and connection disruptions.
 		n.peers = make(map[string]*peer, len(config.Peers))
 		wgPeers := make(map[string]*wgtypes.Peer, len(dev.Peers))
-		for i := range dev.Peers {
+		for i, _ := range dev.Peers {
 			wgPeers[secret.Secret(dev.Peers[i].PublicKey[:]).String()] = &dev.Peers[i]
 		}
 		for _, pc := range config.Peers {
@@ -201,7 +202,7 @@ func (n *WireGuardNetwork) updateAddresses(addrs []netip.Prefix) error {
 
 // updatePeerRoutes adds routes to the peers via the WireGuard interface and removes old routes to peers
 // that are no longer in the configuration.
-func (n *WireGuardNetwork) updatePeerRoutes(machineIP netip.Addr) error {
+func (n *WireGuardNetwork) updatePeerRoutes() error {
 	// Build a set of compacted IP ranges for all peers.
 	var ipsetBuilder netipx.IPSetBuilder
 	for _, p := range n.peers {
@@ -221,18 +222,11 @@ func (n *WireGuardNetwork) updatePeerRoutes(machineIP netip.Addr) error {
 	// Add routes to the computed IP ranges via the WireGuard link.
 	for _, prefix := range ipset.Prefixes() {
 		dst := prefixToIPNet(prefix)
-		var src net.IP
-		// Use the machine IP as the source address for IPv4 routes to other peers.
-		if prefix.Addr().Is4() {
-			src = machineIP.AsSlice()
-		}
-
 		if err = netlink.RouteAdd(
 			&netlink.Route{
 				LinkIndex: n.link.Attrs().Index,
 				Scope:     netlink.SCOPE_LINK,
 				Dst:       &dst,
-				Src:       src,
 			},
 		); err != nil {
 			if !errors.Is(err, unix.EEXIST) {
@@ -278,14 +272,6 @@ func (n *WireGuardNetwork) Run(ctx context.Context) error {
 	}
 	defer wg.Close()
 
-	n.mu.Lock()
-	if n.running {
-		n.mu.Unlock()
-		return errors.New("network is already running")
-	}
-	n.running = true
-	n.mu.Unlock()
-
 	ticker := time.NewTicker(1 * time.Second)
 	for {
 		select {
@@ -304,11 +290,6 @@ func (n *WireGuardNetwork) Run(ctx context.Context) error {
 			for _, ch := range n.watchers {
 				close(ch)
 			}
-
-			n.mu.Lock()
-			n.running = false
-			n.mu.Unlock()
-
 			return nil
 		}
 	}
@@ -446,23 +427,3 @@ func (n *WireGuardNetwork) notifyWatchers(ctx context.Context, events []Endpoint
 	}
 	return nil
 }
-
-// Cleanup deletes the WireGuard link. The network must not be running when this method is called.
-func (n *WireGuardNetwork) Cleanup() error {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-
-	if n.running {
-		return errors.New("network is still running, stop it before cleanup")
-	}
-
-	// Delete the WireGuard link.
-	name := n.link.Attrs().Name
-	if err := netlink.LinkDel(n.link); err != nil {
-		return fmt.Errorf("delete WireGuard link %q: %w", name, err)
-	}
-	n.link = nil
-	slog.Info("Deleted WireGuard interface.", "name", name)
-
-	return nil
-}

internal/machine/state.go

@@ -6,7 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
-
 	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
@@ -72,7 +71,7 @@ func (c *State) Save() error {
 		return fmt.Errorf("state path not set")
 	}
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0o711); err != nil {
+	if err := os.MkdirAll(dir, 0711); err != nil {
 		return fmt.Errorf("create state directory %q: %w", dir, err)
 	}
 
@@ -80,5 +79,5 @@ func (c *State) Save() error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(c.path, data, 0o600)
+	return os.WriteFile(c.path, data, 0600)
 }