fix(e2e-tests): handle asynchronous port publishing for ucind container

.editorconfig

@@ -1,20 +0,0 @@
-# EditorConfig is awesome: https://editorconfig.org
-
-root = true
-
-# Default settings for all files
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-# Settings for Go files
-[*.go]
-indent_style = tab
-indent_size = 4
-
-# Settings for Bash scripts
-[*.sh]
-indent_style = space
-indent_size = 4

.github/FUNDING.yml

@@ -1 +0,0 @@
-github: [psviderski]

.github/copilot-instructions.md

@@ -1 +0,0 @@
-../AI.md

.github/workflows/go-tests.yml

@@ -1,69 +0,0 @@
-name: Go Tests
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - ".github/**"
-      - "**.go"
-      - "**.proto"
-      - "go.*"
-      - "Makefile"
-      - "scripts/**"
-      - "test/**"
-permissions:
-  contents: read
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "1.23.2"
-
-      - name: Install dependencies
-        run: |
-          go mod tidy
-          git diff --exit-code ||
-            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)
-
-      - name: Run tests
-        run: |
-          make ucind-image
-          make test
-    timeout-minutes: 10
-
-  check-protobuf:
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        # Run on more platforms so that mise lockfile checksums are checked/generated for all platforms.
-        # See https://github.com/jdx/mise/issues/4276 for details.
-        os: [ubuntu-latest, macos-latest]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install Mise
-        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
-        with:
-          version: "2025.6.5"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Generate Protobuf files
-        run: |
-          make proto
-          # check if the generated files are up to date
-          git diff --exit-code ||
-            (echo "Generated protobuf files are not up to date. Please run 'make proto' and commit the changes." && exit 1)

.github/workflows/lint.yml

@@ -1,39 +0,0 @@
-name: Lint
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "**.go"
-      - "go.*"
-permissions:
-  contents: read
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "1.23.2"
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
-        with:
-          version: v2.2.2
-
-      - name: Format code
-        run: |
-          make format
-          git diff --exit-code ||
-            (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
-
-    timeout-minutes: 10

.gitignore

@@ -30,7 +30,6 @@ go.work.sum
 /data/
 /dist/
 /uc
-/tmp
 
 # Web
 node_modules/

.golangci.yaml

@@ -1,42 +0,0 @@
-version: "2"
-
-run:
-  concurrency: 4
-  tests: true
-  timeout: 5m
-
-linters:
-  default: none
-  enable:
-    - bodyclose
-    # - dogsled
-    - dupl
-    # - errcheck
-    - gochecknoinits
-    - goconst
-    # - gocritic
-    # - gocyclo
-    # - godot
-    # - gosec
-    # - govet
-    - ineffassign
-    - misspell
-    - nakedret
-    # - prealloc
-    # - revive
-    # - staticcheck
-    - unconvert
-    # - unparam
-    # - unused
-    - whitespace
-  exclusions:
-    rules:
-      - path: ^test/e2e
-        linters:
-          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
-
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-

.mise.lock

@@ -1,39 +0,0 @@
-[tools.go]
-version = "1.23.10"
-backend = "core:go"
-
-[tools.go.checksums]
-"go1.23.10.darwin-arm64.tar.gz" = "sha256:25c64bfa8a8fd8e7f62fb54afa4354af8409a4bb2358c2699a1003b733e6fce5"
-"go1.23.10.linux-amd64.tar.gz" = "sha256:535f9f81802499f2a7dbfa70abb8fda3793725fcc29460f719815f6e10b5fd60"
-
-[tools.golangci-lint]
-version = "2.2.2"
-backend = "aqua:golangci/golangci-lint"
-
-[tools.golangci-lint.checksums]
-"golangci-lint-2.2.2-darwin-arm64.tar.gz" = "sha256:d84d94d042c0d495fd1746f3d18948a75de163b17a14e8de3ef840928dd2df74"
-"golangci-lint-2.2.2-linux-amd64.tar.gz" = "sha256:c27fbde948a87d326feacd21df2f61a9c54dbd2e3bfa185c0a1cd6917a6f964f"
-
-[tools.protoc]
-version = "27.3"
-backend = "aqua:protocolbuffers/protobuf/protoc"
-
-[tools.protoc.checksums]
-"protoc-27.3-linux-x86_64.zip" = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
-"protoc-27.3-osx-aarch_64.zip" = "sha256:b22116bd97cdbd7ea25346abe635a9df268515fe5ef5afa93cd9a68fc2513f84"
-
-[tools.protoc-gen-go]
-version = "1.34.2"
-backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"
-
-[tools.protoc-gen-go.checksums]
-"protoc-gen-go.v1.34.2.darwin.arm64.tar.gz" = "sha256:17aca7f948dbb624049030cf841e35895cf34183ba006e721247fdeb95ff2780"
-"protoc-gen-go.v1.34.2.linux.amd64.tar.gz" = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"
-
-[tools.protoc-gen-go-grpc]
-version = "1.5.1"
-backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"
-
-[tools.protoc-gen-go-grpc.checksums]
-"protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz" = "sha256:d6083feb51dcfe59f26793e99ef01ef5eac68b64294ec2546711f614ac5878f3"
-"protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz" = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"

.mise.toml

@@ -1,12 +1,5 @@
-[settings]
-experimental = true
-
 [tools]
 go = "1.23"
-golangci-lint = "2.2.2"
-protoc = "27.3"
-protoc-gen-go = "1.34.2"
-protoc-gen-go-grpc = "1.5.1"
 
 [env]
 _.file = ".env"

AI.md

@@ -1,244 +0,0 @@
-# AI.md - Uncloud Project Guide
-
-This document provides comprehensive information about the Uncloud project for AI assistants to understand the codebase, architecture, and development practices.
-
-## Project Overview
-
-**Uncloud** is a lightweight clustering and container orchestration tool that enables deployment and management of web applications across cloud VMs and bare metal servers. It creates a secure WireGuard mesh network between Docker hosts and provides automatic service discovery, load balancing, HTTPS ingress, and simple CLI commands for application management.
-
-### Key Characteristics
-
-- **Language**: Go
-- **Architecture**: Decentralized, no control plane
-- **Target**: Self-hosted infrastructure without Kubernetes complexity
-- **License**: View LICENSE file for details
-- **Status**: Active development, not yet ready for production
-
-## Core Features
-
-### 🏗️ Infrastructure
-
-- **Multi-machine deployment**: Combine cloud VMs, dedicated servers, and bare metal
-- **Zero-config networking**: Automatic WireGuard mesh with NAT traversal
-- **Decentralized design**: No central control plane, all machines are equal
-- **Service discovery**: Built-in DNS server resolves service names to container IPs
-
-### 🚀 Application Management
-
-- **Docker Compose compatibility**: Uses familiar Docker Compose format
-- **Zero-downtime deployments**: Rolling updates without service interruption
-- **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
-- **Managed DNS**: Free `*.cluster.uncloud.run` subdomains via Uncloud DNS service
-- **Cross-machine scaling**: Run containers across multiple machines
-
-### 🔧 Developer Experience
-
-- **Docker-like CLI**: Familiar commands (`uc` binary)
-- **Imperative operations**: Direct commands vs. declarative state reconciliation
-- **Remote management**: Control entire infrastructure via SSH to any machine
-- **Minimal overhead**: ~150MB RAM footprint per machine
-
-## Architecture
-
-### Core Components
-
-1. **CLI (`uc`)** - Main user interface for cluster management
-2. **Daemon (`uncloudd`)** - Machine daemon running on each node
-3. **Corrosion** - Distributed SQLite database for cluster state (Fly.io project)
-4. **Caddy** - Reverse proxy for HTTPS termination and routing
-5. **WireGuard** - Secure mesh networking between machines
-
-### Network Architecture
-
-- Each machine gets unique subnet (e.g., `10.210.0.0/24`, `10.210.1.0/24`)
-- Containers get cluster-unique IPs for direct communication
-- Automatic peer discovery and key management
-- NAT traversal for machines behind firewalls
-
-### State Management
-
-- **CRDT-based distributed storage** using Corrosion
-- **Eventually consistent** state across all machines
-- **Gossip protocol** (Serf) for state propagation
-- **No quorum requirements** - partial network splits remain functional
-
-## Project Structure
-
-### Key Directories
-
-- **`cmd/`**: Contains main applications
-
-  - `uncloud/`: CLI tool with subcommands for machine, service, volume management
-  - `uncloudd/`: Daemon that runs on each machine
-  - `ucind/`: Development cluster management for testing
-
-- **`internal/`**: Internal implementation packages
-
-  - `cli/`: Command-line interface logic
-  - `machine/`: Machine lifecycle and state management
-  - `daemon/`: Daemon implementation and gRPC services
-  - `dns/`: Internal DNS server for service discovery
-
-- **`pkg/`**: Public API packages for external use
-
-  - `api/`: Core API types and definitions
-  - `client/`: Client libraries for interacting with Uncloud
-
-- **`experiment/`**: Experimental features and prototypes
-- **`scripts/`**: Installation and utility scripts
-- **`test/`**: Test suites and test infrastructure
-- **`website/`**: Documentation website (Docusaurus)
-- **`misc/`**: Design documents and guides
-
-## Key Technologies
-
-### Core Dependencies
-
-```go
-// Networking and orchestration
-github.com/docker/docker                   // Docker API client
-github.com/docker/compose/v2               // Docker Compose integration
-golang.zx2c4.com/wireguard                 // WireGuard implementation
-github.com/hashicorp/serf                  // Gossip protocol
-
-// State management
-github.com/ipfs/go-ds-crdt                 // CRDT distributed storage
-github.com/dgraph-io/badger/v3             // Embedded database
-
-// Web proxy
-github.com/caddyserver/caddy/v2            // HTTP server and reverse proxy
-
-// CLI and UX
-github.com/spf13/cobra                     // CLI framework
-github.com/charmbracelet/huh               // Interactive forms
-
-// gRPC and networking
-google.golang.org/grpc                     // gRPC framework
-github.com/siderolabs/grpc-proxy           // gRPC proxy for forwarding
-```
-
-## Development Workflow
-
-### Build and Development
-
-```bash
-# Build binaries
-go build -o uncloud ./cmd/uncloud
-go build -o uncloudd ./cmd/uncloudd
-```
-
-### Key Make Targets
-
-- `proto`: Generate protobuf code
-- `ucind-cluster`: Create development cluster
-- `update-dev`: Deploy to development machines
-- `demo-reset`: Reset demo environment
-- `fmt`: Format code
-- `test`: Run all tests
-- `lint`: Lint the code using golangci-lint
-- `lint-and-fix`: Lint the code and fix issues whenever possible
-
-## CLI Commands Structure
-
-The `uc` CLI provides these main command groups:
-
-### Machine Management
-
-```bash
-uc machine init <user@host>     # Initialize new cluster
-uc machine add <user@host>      # Add machine to cluster
-uc machine ls                   # List machines
-uc machine rm <name>            # Remove machine
-```
-
-### Service Management
-
-```bash
-uc run <image>                  # Run container from image
-uc deploy                       # Deploy from compose.yaml
-uc scale <service> <count>      # Scale service replicas
-uc ls                           # List services
-uc rm <service>                 # Remove service
-```
-
-### Context and Connectivity
-
-```bash
-uc context ls                   # List available contexts
-uc context use <name>           # Switch context
-```
-
-### Global Flags
-
-- `--connect`: Connect to remote machine directly, without a config file
-- `--uncloud-config`: Override config file path
-
-## Development Guidelines
-
-### Code Organization
-
-- **Package naming**: Use clear, descriptive names
-- **Error handling**: Wrap errors with context using `fmt.Errorf`
-- **Logging**: Use structured logging with levels
-- **gRPC**: Services defined in `internal/machine/api/pb/`
-
-### Testing
-
-- Unit tests alongside source files (`*_test.go`)
-- Integration tests in `test/e2e/`
-- Test fixtures in `test/fixtures/`
-
-### Dependencies
-
-- Prefer standard library when possible
-- Pin versions in `go.mod`
-- Document rationale for external dependencies
-
-### Configuration
-
-- Support environment variables for key settings
-- Validate configuration early
-- Provide sensible defaults
-
-## Troubleshooting and Debugging
-
-### Common Issues
-
-- **Networking**: Check WireGuard status, iptables rules
-- **DNS**: Verify service discovery resolution
-- **Containers**: Use standard Docker debugging tools
-- **State sync**: Check Corrosion logs for replication issues
-
-### Debugging Tools
-
-- Standard Linux networking tools (`ping`, `traceroute`, `wireshark`)
-- Docker commands (`docker ps`, `docker logs`)
-- SSH access to machines for direct inspection
-- gRPC debugging tools
-
-### Logs and Monitoring
-
-- Systemd services (getting logs via `journalctl -u SERVICE_NAME`)
-  - `uncloud` -- Uncloud daemon
-  - `uncloud-corrosion` -- Corrosion process
-- Machine daemon logs
-- Container logs via Docker
-
-## File Patterns and Conventions
-
-### Important Files to Understand
-
-- `cmd/uncloud/main.go`: CLI entry point and command structure
-- `internal/cli/cli.go`: CLI implementation and configuration
-- `internal/machine/machine.go`: Core machine management
-- `pkg/api/`: Public API definitions
-- `misc/design.md`: Architecture and design philosophy
-- `README.md`: User-facing documentation
-
-### Configuration Files
-
-- `go.mod/go.sum`: Go dependency management
-- `Makefile`: Build and development tasks
-- `Dockerfile`: Container build instructions forUncloud-in-Docker (used for testing)
-
-This document should help AI assistants understand the project structure, make informed suggestions, and contribute effectively to the Uncloud codebase.

CLAUDE.md

@@ -1 +0,0 @@
-./AI.md

Dockerfile

@@ -17,22 +17,13 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
-ARG TARGETARCH
-
-RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
-      "amd64") echo "x86_64" ;; \
-      "arm64") echo "aarch64" ;; \
-      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
-    esac) \
-    && wget -q -O /tmp/corrosion.tar.gz \
-      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
+RUN wget -q -O /tmp/corrosion.tar.gz \
+      https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
     && install /tmp/corrosion /usr/local/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
-# Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
-# e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
-FROM gcr.io/distroless/cc-debian12:latest AS corrosion
+FROM chainguard/wolfi-base:latest AS corrosion
 COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
 CMD ["corrosion", "agent"]
 

Makefile

@@ -45,69 +45,18 @@ proto:
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
 		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
 
-.PHONY: proto-mise
-proto-mise:
-	mise exec -- protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
-
 .PHONY: corrosion-image
 corrosion-image:
 	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: corrosion-multiarch-image-push
-corrosion-multiarch-image-push:
-	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
+.PHONY: corrosion-image-push
+corrosion-image-push: corrosion-image
+	docker push "$(CORROSION_IMAGE)"
 
 .PHONY: ucind-image
 ucind-image:
 	docker build -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: ucind-multiarch-image-push
-ucind-multiarch-image-push:
-	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
-
-.PHONY: test
-test:
-ifeq ($(TEST_NAME),)
-	go test -count=1 -v ./...
-else
-	go test -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
-endif
-
-.PHONY: test-e2e
-test-e2e:
-	go test -race -count=1 -v ./test/e2e
-
-.PHONY: test-clean
-test-clean:
-	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
-	if [ -n "$$CONTAINERS" ]; then \
-		echo "Killing containers..."; \
-		docker kill $$CONTAINERS; \
-	fi; \
-	CONTAINERS_STOPPED=$$(docker ps -a --filter "name=ucind-test" -q); \
-	if [ -n "$$CONTAINERS_STOPPED" ]; then \
-		echo "Removing stopped containers..."; \
-		docker rm $$CONTAINERS_STOPPED; \
-	else \
-		echo "Nothing to clean."; \
-	fi
-
-.PHONY: vet
-vet:
-	go vet ./...
-
-.PHONY: format fmt
-format fmt:
-	GOOS=linux golangci-lint fmt
-
-LINT_TARGETS := lint lint-and-fix
-.PHONY: $(LINT_TARGETS) _lint
-$(LINT_TARGETS): _lint
-lint: ARGS=
-lint-and-fix: ARGS=--fix
-_lint:
-# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
-# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
-	GOOS=linux golangci-lint run $(ARGS)
-
+.PHONY: ucind-image-push
+ucind-image-push: ucind-image
+	docker push "$(UCIND_IMAGE)"

README.md

@@ -1,13 +1,11 @@
 <div align="center">
-  <img src="./website/landing/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
+  <img src="./website/images/logo.svg" height="100" alt="Uncloud logo"/>
   <h1>Uncloud</h1>
   <p><strong>Docker simplicity. Multi-machine power.</strong></p>
 
   <p>
-    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
     <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
     <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
-    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
   </p>
 </div>
 
@@ -45,23 +43,9 @@ complexity of Kubernetes.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-### 🚀 Coming soon
-
-* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
-  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
-
 ## 🎬 Quick demo
 
-The screenshot below demonstrates how I use Uncloud to deploy https://uncloud.run website to 2 remote machines from
-the [`compose.yaml`](website/compose.yaml) file on my local machine.
-
-It exposes the container port `8000/tcp` as HTTPS on the domain `uncloud.run`, served by the Caddy reverse proxy on the
-remote machines. All managed by Uncloud.
-
-![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)
-
-Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
-on-premises in just a couple minutes.
+Deploy a highly available web app with automatic HTTPS across multiple regions and on-premises in just a couple minutes.
 
 <a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
 <img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
@@ -97,8 +81,6 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    curl -fsS https://get.uncloud.run/install.sh | sh
    ```
 
-   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
-
 2. Initialise your first machine:
 
    ```bash
@@ -130,15 +112,15 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    uncloud-uninstall
    ```
 
-View the [Documentation](https://uncloud.run/docs) for more information.
+View the [user guide](docs/user_guide.md) for more information.
 
 ## ⚙️ How it works
 
-Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
+Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals.
 
 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 
-![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)
 
 <details>
 <summary>Peek under the hood to see what happens when you run certain commands.</summary>
@@ -286,34 +268,8 @@ and there may be breaking changes between releases.
 We'd love your input! Here's how you can contribute:
 
 * 🐛 Found a bug? [Open an issue](https://github.com/psviderski/uncloud/issues)
-* 💡 Have questions, ideas, or need help?
-    * Start a discussion or join an existing one in
-      the [Discussions](https://github.com/psviderski/uncloud/discussions).
-    * Join our [Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, roadmap, implementation
-      details, and help each other out.
-
-## 🙏 Inspiration & Acknowledgements
-
-I'm grateful to the following projects that inspired Uncloud's design and implementation:
-
-* [Kamal](https://kamal-deploy.org/) — for proving that even in the declarative era of Kubernetes there is a place for
-  simple deployment tools that use imperative commands without complex orchestration. Kamal powers the multi-billion
-  dollar company [37signals](https://37signals.com/) where it was created, and that's truly inspiring!
-* [Fly.io](https://fly.io/) — for inspiring my vision for what self-hosted infrastructure should feel like, proving that
-  developer experience and powerful infrastructure can coexist beautifully.
-* [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
-  user experience that feels like magic.
-* [Talos Linux](https://github.com/siderolabs/talos)
-  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
-  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
-  networking with zero configuration.
-* [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
-  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
-  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
-  complexity of Kubernetes.
-
-Special thanks to the [Corrosion](https://github.com/superfly/corrosion) project by Fly.io for providing the distributed
-SQLite database used to share Uncloud's cluster state.
+* 💡 Have ideas or need help? [Join our Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, 
+  roadmap, implementation details, and help each other out.
 
 ## 📫 Stay updated
 
@@ -323,15 +279,6 @@ SQLite database used to share Uncloud's cluster state.
   features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.
 
-## 💖 Sponsors
-
-These companies and projects are helping Uncloud with their generous sponsorship and/or services:
-
-<!-- Sentry -->
-<a href="https://sentry.io/welcome/">
-  <img height="100" alt="Sentry" src="https://github.com/user-attachments/assets/6c1439c0-d20d-40dc-a669-c9aa94651dfa" />
-</a>
-
 ## ❤️ Contributors
 
 Thank you [@cedws](https://github.com/cedws) for being the first contributor to Uncloud! 🎉

cmd/ucind/cluster/create.go

@@ -2,9 +2,8 @@ package cluster
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewCreateCommand() *cobra.Command {

cmd/ucind/cluster/remove.go

@@ -2,9 +2,8 @@ package cluster
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewRemoveCommand() *cobra.Command {

cmd/ucind/cluster/root.go

@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		// NewListCommand(),
+		//NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd

cmd/uncloud/build.go

@@ -1,77 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	composecli "github.com/compose-spec/compose-go/v2/cli"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/spf13/cobra"
-)
-
-// NewBuildCommand creates a new command to build services from a Compose file.
-func NewBuildCommand() *cobra.Command {
-	opts := cli.BuildOptions{}
-	cmd := &cobra.Command{
-		Use:   "build [FLAGS] [SERVICE...]",
-		Short: "Build services from a Compose file.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if len(args) > 0 {
-				opts.Services = args
-			}
-
-			return runBuild(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
-		"One or more Compose files to build (default compose.yaml)")
-	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
-		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
-		"Push built images to the registry after building. (default false)")
-	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
-		"Do not use cache when building images. (default false)")
-
-	return cmd
-}
-
-// TODO: deduplicate with a similar functino for deploy options
-// projectOpts returns the project options for the Compose file(s).
-func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
-	projectOpts := []composecli.ProjectOptionsFn{}
-
-	if len(opts.Profiles) > 0 {
-		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
-	}
-
-	return projectOpts
-}
-
-// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
-func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
-	projectOpts := projectOptsFromBuildOpts(opts)
-	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
-	if err != nil {
-		return fmt.Errorf("load compose file(s): %w", err)
-	}
-
-	if len(opts.Services) > 0 {
-		project, err = project.WithSelectedServices(opts.Services)
-		if err != nil {
-			return fmt.Errorf("select services: %w", err)
-		}
-	}
-
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
-
-	if len(servicesToBuild) == 0 {
-		fmt.Println("No services to build.")
-		return nil
-	}
-
-	return cli.BuildServices(ctx, servicesToBuild, opts)
-}

cmd/uncloud/deploy.go

@@ -20,8 +20,6 @@ type deployOptions struct {
 	files    []string
 	profiles []string
 	services []string
-	noBuild  bool
-	recreate bool
 
 	context string
 }
@@ -49,11 +47,6 @@ func NewDeployCommand() *cobra.Command {
 		"One or more Compose profiles to enable.")
 	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
 		"Name of the cluster context to deploy to (default is the current context)")
-	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
-		"Do not build images before deploying services. (default false)")
-	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
-		"Recreate containers even if their configuration and image haven't changed.")
-
 	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
 	//  Could be useful to test a new version on a subset of machines before rolling out to all.
 
@@ -88,34 +81,13 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}
 
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
-
-	if len(servicesToBuild) > 0 {
-		if opts.noBuild {
-			fmt.Println("Not building services as requested.")
-		} else {
-			buildOpts := cli.BuildOptions{
-				Push:    true,
-				NoCache: false,
-			}
-
-			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
-				return fmt.Errorf("build services: %w", err)
-			}
-		}
-	}
-
 	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer clusterClient.Close()
 
-	var strategy deploy.Strategy
-	if opts.recreate {
-		strategy = &deploy.RollingStrategy{ForceRecreate: true}
-	}
-	composeDeploy, err := compose.NewDeploymentWithStrategy(ctx, clusterClient, project, strategy)
+	composeDeploy, err := compose.NewDeployment(ctx, clusterClient, project)
 	if err != nil {
 		return fmt.Errorf("create compose deployment: %w", err)
 	}

cmd/uncloud/machine/add.go

@@ -41,7 +41,7 @@ func NewAddCommand() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("parse remote machine: %w", err)
 			}
-			remoteMachine := &cli.RemoteMachine{
+			remoteMachine := cli.RemoteMachine{
 				User:    user,
 				Host:    host,
 				Port:    port,
@@ -59,12 +59,11 @@ func NewAddCommand() *cobra.Command {
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
+		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -78,12 +77,12 @@ func NewAddCommand() *cobra.Command {
 	return cmd
 }
 
-func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, opts addOptions) error {
 	var publicIP *netip.Addr
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -93,7 +92,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 		publicIP = &ip
 	}
 
-	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+	machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
@@ -103,7 +102,6 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 	if err != nil {
 		return err
 	}
-	defer clusterClient.Close()
 	defer machineClient.Close()
 
 	if opts.noCaddy {
@@ -119,11 +117,8 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version. Otherwise, use the latest version.
-	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
-	// issues accessing the Machine API of existing machines in the cluster.
-	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
-	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
+	caddySvc, err := machineClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
 		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
@@ -146,7 +141,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 
 	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
 	//  that may cause a small downtime.
-	d, err := clusterClient.NewCaddyDeployment(caddyImage, api.Placement{})
+	d, err := machineClient.NewCaddyDeployment(caddyImage, api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

cmd/uncloud/machine/constants.go

@@ -1,6 +0,0 @@
-package machine
-
-const (
-	// PublicIPNone is the value used to indicate removal of public IP
-	PublicIPNone = "none"
-)

cmd/uncloud/machine/init.go

@@ -77,12 +77,11 @@ func NewInitCommand() *cobra.Command {
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
+		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -106,7 +105,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -115,6 +114,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
+	
 	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,

cmd/uncloud/machine/ls.go

@@ -14,18 +14,18 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	var contextName string
+	var clusterContext string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, contextName)
+			return list(cmd.Context(), uncli, clusterContext)
 		},
 	}
 	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
+		&clusterContext, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
@@ -68,8 +68,7 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 		}
 
 		if _, err = fmt.Fprintf(
-			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
-			strings.Join(endpoints, ", "),
+			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP, strings.Join(endpoints, ", "),
 		); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}

cmd/uncloud/machine/rename.go

@@ -1,47 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-func NewRenameCommand() *cobra.Command {
-	var contextName string
-	cmd := &cobra.Command{
-		Use:   "rename OLD_NAME NEW_NAME",
-		Short: "Rename a machine in the cluster.",
-		Long: `Rename a machine in the cluster.
-
-This command changes the name of an existing machine while preserving all other
-configuration including network settings, public IP, and cluster membership.`,
-		Args: cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rename(cmd.Context(), uncli, contextName, args[0], args[1])
-		},
-	}
-	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-	return cmd
-}
-
-func rename(ctx context.Context, uncli *cli.CLI, contextName, oldName, newName string) error {
-	client, err := uncli.ConnectCluster(ctx, contextName)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	machine, err := client.RenameMachine(ctx, oldName, newName)
-	if err != nil {
-		return fmt.Errorf("rename machine: %w", err)
-	}
-
-	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
-	return nil
-}

cmd/uncloud/machine/rm.go

@@ -1,249 +0,0 @@
-package machine
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"sync"
-
-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/lipgloss/tree"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type removeOptions struct {
-	noReset bool
-	yes     bool
-	context string
-}
-
-func NewRmCommand() *cobra.Command {
-	opts := removeOptions{}
-
-	cmd := &cobra.Command{
-		Use:     "rm MACHINE",
-		Aliases: []string{"remove", "delete"},
-		Short:   "Remove a machine from a cluster and reset it.",
-		Args:    cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return remove(cmd.Context(), uncli, args[0], opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Do not prompt for confirmation before removing the machine.")
-	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
-		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")
-
-	return cmd
-}
-
-func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
-	// TODO: automatically choose a connection to the machine that is not being removed.
-	client, err := uncli.ConnectCluster(ctx, opts.context)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	// Verify the machine exists and list all service containers on it including stopped ones.
-	mctx, machines, err := api.ProxyMachinesContext(ctx, client, []string{nameOrID})
-	if err != nil {
-		return err
-	}
-	if len(machines) == 0 {
-		return fmt.Errorf("machine '%s' not found in the cluster", nameOrID)
-	}
-	m := machines[0].Machine
-
-	// Verify if the machine being removed is the proxy machine we're connected to.
-	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("inspect proxy machine: %w", err)
-	}
-	if proxyMachine.Id == m.Id {
-		allMachines, err := client.ListMachines(ctx, nil)
-		if err != nil {
-			return fmt.Errorf("list machines: %w", err)
-		}
-		if len(allMachines) > 1 {
-			return errors.New("cannot remove the machine you are currently connected to. " +
-				"Please connect to another machine in the cluster and try again. " +
-				"Use --connect flag or update 'connections' for the cluster context in your Uncloud config")
-			// It's ok to remove the proxy machine if it's the last one in the cluster.
-		}
-	}
-
-	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
-	//  from being scheduled on it while the removal is in progress.
-
-	reset := !opts.noReset
-	var containers []api.ServiceContainer
-	reachable := false
-	if reset {
-		// Check if the machine is up and has service containers.
-		listOpts := container.ListOptions{All: true}
-		machineContainers, err := client.Docker.ListServiceContainers(mctx, "", listOpts)
-		if err == nil {
-			reachable = true
-			containers = machineContainers[0].Containers
-			if len(containers) > 0 {
-				plural := ""
-				if len(containers) > 1 {
-					plural = "s"
-				}
-				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
-				fmt.Println(formatContainerTree(containers))
-				fmt.Println()
-				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
-					"and reset it to the uninitialised state.")
-			} else {
-				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
-				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
-			}
-		} else {
-			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
-				m.Name)
-		}
-	} else {
-		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
-	}
-
-	if !opts.yes {
-		confirmed, err := cli.Confirm()
-		if err != nil {
-			return fmt.Errorf("confirm removal: %w", err)
-		}
-		if !confirmed {
-			fmt.Println("Cancelled. Machine was not removed.")
-			return nil
-		}
-	}
-
-	if reset && len(containers) > 0 {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			return removeContainers(ctx, client, containers)
-		}, uncli.ProgressOut(), "Removing containers")
-		if err != nil {
-			return fmt.Errorf("remove containers: %w", err)
-		}
-		fmt.Println()
-	}
-
-	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
-		return fmt.Errorf("remove machine from cluster: %w", err)
-	}
-	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
-
-	if reset && reachable {
-		_, err = client.MachineClient.Reset(mctx, &pb.ResetRequest{})
-		if err != nil {
-			fmt.Printf("WARNING: Failed to reset machine: %v\n", err)
-		} else {
-			fmt.Println("Machine reset initiated and will complete in the background.")
-		}
-	}
-
-	// TODO: remove the connection to the machine from the uncloud config if it exists. We need a way to associate
-	//  the machine with its connection in the config, e.g. by storing the machine name in the connection metadata.
-
-	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
-	//  let the user know that the DNS records should be updated.
-
-	return nil
-}
-
-// formatContainerTree formats a list of containers grouped by service as a tree structure.
-func formatContainerTree(containers []api.ServiceContainer) string {
-	if len(containers) == 0 {
-		return ""
-	}
-
-	// Group containers by service.
-	serviceContainers := make(map[string][]api.ServiceContainer)
-	for _, ctr := range containers {
-		serviceName := ctr.ServiceName()
-		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
-	}
-
-	// Build tree output.
-	var output []string
-	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
-	for _, serviceName := range serviceNames {
-		ctrs := serviceContainers[serviceName]
-		mode := ctrs[0].ServiceMode()
-
-		// Format a tree for the service with its containers.
-		plural := ""
-		if len(ctrs) > 1 {
-			plural = "s"
-		}
-		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
-			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
-
-		// Add containers as children.
-		for _, ctr := range ctrs {
-			state, _ := ctr.HumanState()
-			info := fmt.Sprintf("%s • %s • %s", ctr.Name, ctr.Config.Image, state)
-			t.Child(info)
-		}
-
-		output = append(output, t.String())
-	}
-
-	return strings.Join(output, "\n")
-}
-
-// removeContainers removes the given service containers from the machine.
-func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
-	if len(containers) == 0 {
-		return nil
-	}
-
-	wg := sync.WaitGroup{}
-	errCh := make(chan error)
-
-	for _, ctr := range containers {
-		wg.Add(1)
-		go func(c api.ServiceContainer) {
-			defer wg.Done()
-
-			// Gracefully stop the container before removing it.
-			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
-			}
-
-			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
-				// Remove anonymous volumes created by the container.
-				RemoveVolumes: true,
-			})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
-			}
-		}(ctr)
-	}
-
-	go func() {
-		wg.Wait()
-		close(errCh)
-	}()
-
-	var err error
-	for e := range errCh {
-		err = errors.Join(err, e)
-	}
-
-	return err
-}

cmd/uncloud/machine/root.go

@@ -7,16 +7,12 @@ import (
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "machine",
-		Aliases: []string{"m"},
 		Short: "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
-		NewRenameCommand(),
-		NewRmCommand(),
-		NewUpdateCommand(),
 		NewTokenCommand(),
 	)
 	return cmd

cmd/uncloud/machine/token.go

@@ -2,10 +2,9 @@ package machine
 
 import (
 	"fmt"
-
+	"github.com/spf13/cobra"
 	"github.com/psviderski/uncloud/internal/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/spf13/cobra"
 )
 
 type tokenOptions struct {

cmd/uncloud/machine/update.go

@@ -1,128 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/spf13/cobra"
-)
-
-type updateOptions struct {
-	name     string
-	publicIP string
-	context  string
-}
-
-func NewUpdateCommand() *cobra.Command {
-	opts := updateOptions{}
-	cmd := &cobra.Command{
-		Use:   "update",
-		Short: "Update machine configuration in the cluster.",
-		Long: `Update machine configuration in the cluster.
-
-This command allows setting various machine properties including:
-- Machine name (--name)
-- Public IP address (--public-ip)
-
-At least one flag must be specified to perform an update operation.`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return update(cmd.Context(), uncli, cmd, opts, args[0])
-		},
-	}
-
-	cmd.Flags().StringVar(
-		&opts.name, "name", "",
-		"New name for the machine",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "",
-		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.", PublicIPNone),
-	)
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
-	return cmd
-}
-
-func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
-	// Check if at least one flag was explicitly set
-	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") {
-		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip)")
-	}
-
-	client, err := uncli.ConnectCluster(ctx, opts.context)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	// First, resolve the machine to get its ID
-	machine, err := client.InspectMachine(ctx, machineNameOrID)
-	if err != nil {
-		return fmt.Errorf("find machine: %w", err)
-	}
-
-	// Build the update request
-	req := &pb.UpdateMachineRequest{
-		MachineId: machine.Machine.Id,
-	}
-
-	if opts.name != "" {
-		req.Name = &opts.name
-	}
-
-	// Check if --public-ip flag was explicitly provided
-	if cmd.Flags().Changed("public-ip") {
-		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
-			req.PublicIp = &pb.IP{} // Empty IP to signal removal
-		} else {
-			// Parse and validate the public IP
-			ip, err := netip.ParseAddr(opts.publicIP)
-			if err != nil {
-				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
-			}
-			req.PublicIp = pb.NewIP(ip)
-		}
-	}
-
-	// Perform the update operation
-	updatedMachine, err := client.UpdateMachine(ctx, req)
-	if err != nil {
-		return fmt.Errorf("update machine: %w", err)
-	}
-
-	// Report what was changed
-	changes := make([]string, 0)
-	if opts.name != "" {
-		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
-	}
-	if cmd.Flags().Changed("public-ip") {
-		oldIP := PublicIPNone
-		if machine.Machine.PublicIp != nil {
-			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
-				oldIP = addr.String()
-			}
-		}
-		newIP := PublicIPNone
-		if updatedMachine.PublicIp != nil {
-			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
-				newIP = addr.String()
-			}
-		}
-		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
-	}
-
-	fmt.Printf("Machine %q (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
-	for _, change := range changes {
-		fmt.Printf("  %s\n", change)
-	}
-
-	return nil
-}

cmd/uncloud/main.go

@@ -75,7 +75,6 @@ func main() {
 
 	cmd.AddCommand(
 		NewDeployCommand(),
-		NewBuildCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),

cmd/uncloud/service/inspect.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
+
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 )

cmd/uncloud/service/run.go

@@ -86,10 +86,9 @@ func NewRunCommand() *cobra.Command {
 			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
 			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
-			"  -p 8080/https                  Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname\n"+
-			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via reverse proxy with custom hostname\n"+
-			// TODO: add support for publishing L4 tcp/udp ports.
-			//"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via reverse proxy\n"+
+			"  -p 8080/https                  Publish port 8080 as HTTPS via load balancer with default service-name.cluster-domain hostname\n"+
+			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via load balancer with custom hostname\n"+
+			"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via load balancer\n"+
 			"  -p 53:5353/udp@host            Bind UDP port 5353 to host port 53")
 	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
 		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",

cmd/uncloudd/main.go

@@ -55,4 +55,5 @@ func main() {
 	}()
 
 	cobra.CheckErr(cmd.ExecuteContext(ctx))
+
 }

docs/README.md

@@ -0,0 +1,41 @@
+# Website
+
+This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
+
+### Installation
+
+```
+$ yarn
+```
+
+### Local Development
+
+```
+$ yarn start
+```
+
+This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
+
+### Build
+
+```
+$ yarn build
+```
+
+This command generates static content into the `build` directory and can be served using any static contents hosting service.
+
+### Deployment
+
+Using SSH:
+
+```
+$ USE_SSH=true yarn deploy
+```
+
+Not using SSH:
+
+```
+$ GIT_USER=<Your GitHub username> yarn deploy
+```
+
+If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.

docs/docs/overview.md

@@ -0,0 +1,9 @@
+---
+slug: /
+---
+
+# Overview
+
+Uncloud is lightweight tool for creating a cluster of machines running Docker and deploying web applications across
+them. It is designed to be simple and easy to use, while still providing the essential features to manage and scale
+your apps in production.

docs/docusaurus.config.js

@@ -10,12 +10,12 @@ import {themes as prismThemes} from 'prism-react-renderer';
 
 /** @type {import('@docusaurus/types').Config} */
 const config = {
-  title: 'Uncloud',
-  tagline: 'Self-host and scale web apps without Kubernetes complexity',
+  title: 'Uncloud Docs',
+  tagline: 'Dinosaurs are cool',
   favicon: 'img/favicon.png',
 
   // Set the production url of your site here
-  url: 'https://uncloud.run',
+  url: 'https://docs.uncloud.run',
   // Set the /<baseUrl>/ pathname under which your site is served
   // For GitHub pages deployment, it is often '/<projectName>/'
   baseUrl: '/',
@@ -54,30 +54,27 @@ const config = {
       ({
         docs: {
           // Remove this to remove the "edit this page" links.
-          editUrl: 'https://github.com/psviderski/uncloud/edit/main/website/',
+          editUrl: 'https://github.com/psviderski/uncloud/edit/main/docs/',
           // Serve the docs at the site's root.
-          // routeBasePath: '/',
+          routeBasePath: '/',
           showLastUpdateTime: true,
           sidebarPath: './sidebars.js',
         },
-        blog: {
-          blogDescription: 'Blog posts from the Uncloud team and community',
-          blogSidebarTitle: 'All posts',
-          blogSidebarCount: 'ALL',
-          showReadingTime: true,
-          feedOptions: {
-            type: ['rss', 'atom'],
-            xslt: true,
-          },
-          // Please change this to your repo.
-          // Remove this to remove the "edit this page" links.
+        // blog: {
+        //   showReadingTime: true,
+        //   feedOptions: {
+        //     type: ['rss', 'atom'],
+        //     xslt: true,
+        //   },
+        //   // Please change this to your repo.
+        //   // Remove this to remove the "edit this page" links.
         //   editUrl:
         //     'https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/',
-          // Useful options to enforce blogging best practices
-          onInlineTags: 'warn',
-          onInlineAuthors: 'warn',
-          onUntruncatedBlogPosts: 'warn',
-        },
+        //   // Useful options to enforce blogging best practices
+        //   onInlineTags: 'warn',
+        //   onInlineAuthors: 'warn',
+        //   onUntruncatedBlogPosts: 'warn',
+        // },
         theme: {
           customCss: './src/css/custom.css',
         },
@@ -99,24 +96,12 @@ const config = {
       // Relative to your site's "static" directory. Cannot be SVGs. Can be external URLs too.
       image: 'img/social-card.png',
       navbar: {
-        title: 'Uncloud',
+        title: 'Uncloud Docs',
         logo: {
           alt: 'Uncloud Logo',
           src: 'img/logo.svg',
-          href: 'https://uncloud.run',
         },
         items: [
-          {
-            type: 'doc',
-            docId: 'overview',
-            label: 'Docs',
-            position: 'left',
-          },
-          {
-            to: 'blog',
-            label: 'Blog',
-            position: 'left',
-          },
           {
             type: 'search',
             position: 'right',
@@ -159,8 +144,8 @@ const config = {
         ]
       },
       prism: {
-        theme: prismThemes.palenight,
-        //darkTheme: prismThemes.dracula,
+        theme: prismThemes.github,
+        darkTheme: prismThemes.dracula,
       },
     }),
 };

docs/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "docs",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "docusaurus": "docusaurus",
+    "start": "docusaurus start",
+    "build": "docusaurus build",
+    "swizzle": "docusaurus swizzle",
+    "deploy": "docusaurus deploy",
+    "clear": "docusaurus clear",
+    "serve": "docusaurus serve",
+    "write-translations": "docusaurus write-translations",
+    "write-heading-ids": "docusaurus write-heading-ids"
+  },
+  "dependencies": {
+    "@docusaurus/core": "3.7.0",
+    "@docusaurus/preset-classic": "3.7.0",
+    "@easyops-cn/docusaurus-search-local": "^0.49.2",
+    "@mdx-js/react": "^3.0.0",
+    "clsx": "^2.0.0",
+    "prism-react-renderer": "^2.3.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@docusaurus/module-type-aliases": "3.7.0",
+    "@docusaurus/types": "3.7.0"
+  },
+  "browserslist": {
+    "production": [
+      ">0.5%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 3 chrome version",
+      "last 3 firefox version",
+      "last 5 safari version"
+    ]
+  },
+  "engines": {
+    "node": ">=18.0"
+  }
+}

docs/sidebars.js

@@ -16,7 +16,7 @@
  */
 const sidebars = {
   // By default, Docusaurus generates a sidebar from the docs folder structure
-  sidebar: [{type: 'autogenerated', dirName: '.'}],
+  tutorialSidebar: [{type: 'autogenerated', dirName: '.'}],
 
   // But you can create a sidebar manually
   /*

docs/src/css/custom.css

@@ -11,26 +11,26 @@
   --ifm-font-family-base: 'Inter', sans-serif;
   --ifm-heading-font-family: 'Inter', sans-serif;
 
-  --ifm-color-primary: #006be6;
-  --ifm-color-primary-dark: #0060cf;
-  --ifm-color-primary-darker: #005bc4;
-  --ifm-color-primary-darkest: #004ba1;
-  --ifm-color-primary-light: #0076fd;
-  --ifm-color-primary-lighter: #0a7cff;
-  --ifm-color-primary-lightest: #2c8eff;
+  --ifm-color-primary: #2e8555;
+  --ifm-color-primary-dark: #29784c;
+  --ifm-color-primary-darker: #277148;
+  --ifm-color-primary-darkest: #205d3b;
+  --ifm-color-primary-light: #33925d;
+  --ifm-color-primary-lighter: #359962;
+  --ifm-color-primary-lightest: #3cad6e;
   --ifm-code-font-size: 95%;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.1);
 }
 
 /* For readability concerns, you should choose a lighter palette in dark mode. */
 [data-theme='dark'] {
-  --ifm-color-primary: #3391ee;
-  --ifm-color-primary-dark: #1883ec;
-  --ifm-color-primary-darker: #137be3;
-  --ifm-color-primary-darkest: #1066bb;
-  --ifm-color-primary-light: #4e9ff0;
-  --ifm-color-primary-lighter: #5ba7f1;
-  --ifm-color-primary-lightest: #83bcf5;
+  --ifm-color-primary: #25c2a0;
+  --ifm-color-primary-dark: #21af90;
+  --ifm-color-primary-darker: #1fa588;
+  --ifm-color-primary-darkest: #1a8870;
+  --ifm-color-primary-light: #29d5b0;
+  --ifm-color-primary-lighter: #32d8b4;
+  --ifm-color-primary-lightest: #4fddbf;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.3);
 }
 

docs/user_guide.md

@@ -20,7 +20,7 @@ Uncloud stores its configuration in `~/.config/uncloud/config.yaml`. If you wish
 
 ### Initialisation
 
-Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`. If you want to avoid using uncloud's managed DNS service, add the `--no-dns` flag.
+Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`.
 
 This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].cluster.uncloud.run`.
 
@@ -37,7 +37,6 @@ Uncloud (uncloud.run) DNS can be managed with the `uc dns` subcommand.
 * To reserve a domain name, run `uc dns reserve`
 * To release a domain name, run `uc dns release`.
 * To see the domain name, run `uc dns show`
-* To avoid using the Uncloud managed DNS service, use the `--no-dns` flag on your `uc machine init` command.
 
 ### Running a service
 

experiment/broadcaster.go

@@ -3,11 +3,10 @@ package main
 import (
 	"context"
 	"fmt"
-	"log/slog"
-	"time"
-
 	"github.com/hashicorp/serf/serf"
 	crdt "github.com/ipfs/go-ds-crdt"
+	"log/slog"
+	"time"
 )
 
 // Implements the Broadcaster interface.

experiment/explorer/explorer.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"fmt"
+	"github.com/dgraph-io/badger/v3"
 	"log"
 	"time"
-
-	"github.com/dgraph-io/badger/v3"
 )
 
 func customTimeEncoder(t time.Time) string {

experiment/logger.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"fmt"
+	"github.com/ipfs/go-log/v2"
 	"log/slog"
 	"os"
-
-	"github.com/ipfs/go-log/v2"
 )
 
 // ipfsLogger is an slog logger that implements the IPFS go-log StandardLogger interface.

experiment/networkdb/main.go

@@ -2,13 +2,12 @@ package main
 
 import (
 	"fmt"
+	"github.com/docker/docker/libnetwork/networkdb"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
-
-	"github.com/docker/docker/libnetwork/networkdb"
 )
 
 func main() {

experiment/serf_crdt.go

@@ -4,13 +4,6 @@ import (
 	"context"
 	"flag"
 	"fmt"
-	"log/slog"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
 	"github.com/hashicorp/memberlist"
 	"github.com/hashicorp/serf/cmd/serf/command/agent"
 	"github.com/hashicorp/serf/serf"
@@ -18,6 +11,12 @@ import (
 	badger "github.com/ipfs/go-ds-badger3"
 	crdt "github.com/ipfs/go-ds-crdt"
 	"github.com/lmittmann/tint"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
 )
 
 func createSerfAgentConfig(name, bindAddr, rpcAddr, profile string) *agent.Config {
@@ -50,9 +49,9 @@ func createSerfAgent(config *agent.Config) (*agent.Agent, error) {
 
 	serfConfig.MemberlistConfig.BindAddr = bindIP
 	serfConfig.MemberlistConfig.BindPort = bindPort
-	// serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
-	// serfConfig.MemberlistConfig.AdvertisePort = advertisePort
-	// serfConfig.MemberlistConfig.SecretKey = encryptKey
+	//serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
+	//serfConfig.MemberlistConfig.AdvertisePort = advertisePort
+	//serfConfig.MemberlistConfig.SecretKey = encryptKey
 	serfConfig.NodeName = config.NodeName
 	serfConfig.Tags = config.Tags
 	serfConfig.SnapshotPath = config.SnapshotPath
@@ -130,7 +129,7 @@ func main() {
 	logger := slog.New(tint.NewHandler(os.Stdout, &tint.Options{
 		AddSource: true,
 		Level:     slog.LevelDebug,
-		// Level:      slog.LevelInfo,
+		//Level:      slog.LevelInfo,
 		TimeFormat: time.RFC3339Nano,
 	}))
 	slog.SetDefault(logger)
@@ -165,7 +164,7 @@ func main() {
 
 	opts := crdt.DefaultOptions()
 	opts.Logger = newIPFSLogger(logger)
-	// opts.MultiHeadProcessing = true
+	//opts.MultiHeadProcessing = true
 	// TODO: debug why the heads count may grow on the receiving side if the event backlog is huge and the processing
 	//  is slow.
 	store, err := crdt.New(localStore, ds.NewKey("/"), syncer, broadcaster, opts)
@@ -173,7 +172,7 @@ func main() {
 		panic(err)
 	}
 
-	// ticker := time.NewTicker(10 * time.Millisecond)
+	//ticker := time.NewTicker(10 * time.Millisecond)
 	ticker := time.NewTicker(3 * time.Second)
 	go func() {
 		for {

experiment/syncer.go

@@ -4,19 +4,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
-
 	"github.com/hashicorp/serf/serf"
 	"github.com/ipfs/boxo/datastore/dshelp"
 	dag "github.com/ipfs/boxo/ipld/merkledag"
 	"github.com/ipfs/go-cid"
 	ds "github.com/ipfs/go-datastore"
 	ipld "github.com/ipfs/go-ipld-format"
+	"log/slog"
 )
 
 // Implements the DAGService interface.
 // TODO: implement SessionDAGService to optimize node fetching.
-// TODO: persistentSerfDAG?
+// TOOD: persistentSerfDAG?
 type dagSyncer struct {
 	// Persistent storage for the nodes.
 	store     ds.Datastore
@@ -51,7 +50,8 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 	}
 	slog.Debug("Queried node from peers", "cid", cid, "deadline", query.Deadline())
 
-	for {
+	responded := false
+	for !responded {
 		select {
 		case resp, ok := <-query.ResponseCh():
 			if !ok {
@@ -63,6 +63,7 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 				continue
 			}
 			slog.Debug("Received node from peer", "cid", cid, "peer", resp.From)
+			responded = true
 			query.Close()
 
 			node, err = nodeFromBytes(resp.Payload)

experiment/talos_discovery.go

@@ -6,13 +6,12 @@ import (
 	"crypto/cipher"
 	"encoding/hex"
 	"fmt"
-	"net/netip"
-	"time"
-
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/siderolabs/discovery-api/api/v1alpha1/client/pb"
 	discovery "github.com/siderolabs/discovery-client/pkg/client"
 	"go.uber.org/zap"
+	"net/netip"
+	"time"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (

go.mod

@@ -2,6 +2,8 @@ module github.com/psviderski/uncloud
 
 go 1.23.0
 
+toolchain go1.23.2
+
 require (
 	github.com/BurntSushi/toml v1.4.0
 	github.com/Masterminds/semver v1.5.0
@@ -35,8 +37,6 @@ require (
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lmittmann/tint v1.0.5
 	github.com/miekg/dns v1.1.65
-	github.com/mitchellh/mapstructure v1.5.0
-	github.com/moby/term v0.5.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/siderolabs/discovery-api v0.1.4
@@ -205,6 +205,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/buildkit v0.17.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
@@ -212,8 +213,7 @@ require (
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect

go.sum

@@ -105,8 +105,6 @@ github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
-github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -155,8 +153,6 @@ github.com/charmbracelet/lipgloss v0.13.0 h1:4X3PPeoWEDCMvzDvGmTajSyYPcZM4+y8sCA
 github.com/charmbracelet/lipgloss v0.13.0/go.mod h1:nw4zy0SBX/F/eAO1cWdcvy6qnkDUxr8Lw7dvFrAIbbY=
 github.com/charmbracelet/x/ansi v0.3.2 h1:wsEwgAN+C9U06l9dCVMX0/L3x7ptvY1qmjMwyfE6USY=
 github.com/charmbracelet/x/ansi v0.3.2/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b h1:MnAMdlwSltxJyULnrYbkZpp4k58Co7Tah3ciKhSNo0Q=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a h1:JMdM89Udp/cOl5tC3MuUJXTPE/nAdU1oyt9jRU44qq8=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a/go.mod h1:pBhA0ybfXv6hDjQUZ7hk1lVxBiUbupdw5R31yPUViVQ=
 github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4hwm0x0=

internal/cli/build.go

@@ -1,176 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-
-	composetypes "github.com/compose-spec/compose-go/v2/types"
-	"github.com/distribution/reference"
-	"github.com/docker/cli/cli/config"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/image"
-	dockerclient "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/jsonmessage"
-	"github.com/docker/docker/registry"
-	"github.com/moby/term"
-)
-
-type BuildOptions struct {
-	Files    []string
-	Profiles []string
-	Services []string
-	Push     bool
-	NoCache  bool
-}
-
-// GetServicesThatNeedBuild returns a map of services that require building
-func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
-	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
-	for serviceName, service := range project.Services {
-		if service.Build == nil {
-			continue
-		}
-		servicesToBuild[serviceName] = service
-	}
-	return servicesToBuild
-}
-
-// BuildServices builds the services defined in the provided map.
-func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
-	fmt.Println("Building services...")
-
-	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
-	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
-	if err != nil {
-		return err
-	}
-	defer dockerCli.Close()
-
-	serviceImages := make(map[string]string, len(servicesToBuild))
-
-	// Build the services using the local docker client and compose libraries
-	for _, service := range servicesToBuild {
-		fmt.Printf("Building service: %s\n", service.Name)
-		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
-		if err != nil {
-			return fmt.Errorf("build service %s: %w", service.Name, err)
-		}
-		serviceImages[service.Name] = imageName
-	}
-	fmt.Printf("Service images are built.\n")
-
-	if opts.Push {
-		err = pushServiceImages(ctx, dockerCli, serviceImages)
-	}
-
-	return err
-}
-
-// buildSingleService builds a single service using the Docker client and Compose libraries.
-func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
-	if service.Build == nil {
-		return "", fmt.Errorf("service %s has no build configuration", service.Name)
-	}
-	if service.Image == "" {
-		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet", service.Name)
-	}
-
-	buildContextPath := service.Build.Context
-	imageName := service.Image
-
-	// Create a tar archive of the build context
-	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
-	if err != nil {
-		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
-	}
-
-	buildOptions := types.ImageBuildOptions{
-		// TODO: Support Dockerfiles outside the build context
-		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
-		Dockerfile: service.Build.Dockerfile,
-		Tags:       []string{imageName},
-		Remove:     true, // Remove intermediate containers
-		NoCache:    opts.NoCache,
-	}
-
-	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
-	if err != nil {
-		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
-	}
-	defer buildResponse.Body.Close()
-
-	// Display the build response
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(buildResponse.Body, os.Stdout, fd, isTerminal, nil); err != nil {
-		return "", fmt.Errorf("failed to display build response for service %s: %w", service.Name, err)
-	}
-
-	return imageName, nil
-}
-
-// pushSingleServiceImage pushes a single service image.
-func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
-	ref, err := reference.ParseNormalizedNamed(imageName)
-	if err != nil {
-		return err
-	}
-
-	repoInfo, err := registry.ParseRepositoryInfo(ref)
-	if err != nil {
-		return err
-	}
-
-	registryKey := repoInfo.Index.Name
-	if repoInfo.Index.Official {
-		registryKey = registry.IndexServer
-	}
-
-	// Load the Docker config file with auth details, if available
-	configFile := config.LoadDefaultConfigFile(os.Stderr)
-
-	authConfig, err := configFile.GetAuthConfig(registryKey)
-	if err != nil {
-		return err
-	}
-
-	authJSON, err := json.Marshal(authConfig)
-	if err != nil {
-		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
-	}
-
-	authStr := base64.URLEncoding.EncodeToString(authJSON)
-
-	pushOptions := image.PushOptions{
-		RegistryAuth: authStr,
-	}
-	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
-	if err != nil {
-		return fmt.Errorf("failed to push image %s: %w", imageName, err)
-	}
-	defer pushResponse.Close()
-
-	fmt.Printf("Pushing image %s for service %s...\n", imageName, serviceName)
-
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(pushResponse, os.Stdout, fd, isTerminal, nil); err != nil {
-		return fmt.Errorf("failed to display push response for image %s: %w", imageName, err)
-	}
-
-	fmt.Printf("Image %s pushed successfully.\n", imageName)
-	return nil
-}
-
-// pushServiceImages pushes all built service images to the registry.
-func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
-	fmt.Printf("Pushing images...\n")
-	for serviceName, imageName := range serviceImages {
-		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
-			return fmt.Errorf("push image for service %s: %w", serviceName, err)
-		}
-	}
-	return nil
-}

internal/cli/cli.go

@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"net/netip"
 	"os"
-	"slices"
 
+	"github.com/charmbracelet/huh"
 	"github.com/docker/cli/cli/streams"
 	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/fs"
@@ -22,12 +22,7 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const (
-	// DefaultSSHKeyPath is the fallback location for the SSH private key when provisioning remote machines.
-	// Used when no key is explicitly provided and SSH agent authentication fails.
-	DefaultSSHKeyPath  = "~/.ssh/id_ed25519"
-	defaultContextName = "default"
-)
+const defaultContextName = "default"
 
 type CLI struct {
 	Config *config.Config
@@ -178,7 +173,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("cluster context '%s' already exists", contextName)
 	}
 
-	machineClient, err := provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, *opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -195,7 +190,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
+		if err = cli.promptResetMachine(); err != nil {
 			return nil, err
 		}
 	}
@@ -254,32 +249,26 @@ type AddMachineOptions struct {
 	Context       string
 	MachineName   string
 	PublicIP      *netip.Addr
-	RemoteMachine *RemoteMachine
+	RemoteMachine RemoteMachine
 	Version       string
 }
 
-// AddMachine provisions a remote machine and adds it to the cluster. It returns a cluster client and a machine client.
-// The cluster client is connected to the existing machine in the cluster. It was used to add the new machine to the
-// cluster. The machine client is connected to the new machine and can be used to interact with it.
-// Both client should be closed after use by the caller.
-func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
+// AddMachine provisions a remote machine and adds it to the cluster. It returns a client to interact with the machine
+// which should be closed after use by the caller.
+func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, error) {
 	contextName := opts.Context
 	if contextName == "" {
 		contextName = cli.Config.CurrentContext
 	}
 	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
-		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
+		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
-	defer func() {
-		if err != nil {
-			c.Close()
-		}
-	}()
+	defer c.Close()
 
-	machineClient, err := provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 	defer func() {
 		if err != nil {
@@ -290,22 +279,11 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// Check if the machine is already initialised as a cluster member and prompt the user to reset it first.
 	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, nil, fmt.Errorf("inspect machine: %w", err)
+		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		// Check if the machine is already a member of this cluster.
-		machines, err := c.ListMachines(ctx, nil)
-		if err != nil {
-			return nil, nil, fmt.Errorf("list cluster machines: %w", err)
-		}
-		if slices.ContainsFunc(machines, func(m *pb.MachineMember) bool {
-			return m.Machine.Id == minfo.Id
-		}) {
-			return nil, nil, fmt.Errorf("machine is already a member of this cluster (%s)", minfo.Name)
-		}
-
-		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
-			return nil, nil, err
+		if err = cli.promptResetMachine(); err != nil {
+			return nil, err
 		}
 	}
 
@@ -314,19 +292,19 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
 	if err != nil {
 		if status.Convert(err).Code() != codes.Unimplemented {
-			return nil, nil, fmt.Errorf("check machine prerequisites: %w", err)
+			return nil, fmt.Errorf("check machine prerequisites: %w", err)
 		}
 	} else if !checkResp.Satisfied {
-		return nil, nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
+		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
 	}
 
 	tokenResp, err := machineClient.Token(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, nil, fmt.Errorf("get remote machine token: %w", err)
+		return nil, fmt.Errorf("get remote machine token: %w", err)
 	}
 	token, err := machine.ParseToken(tokenResp.Token)
 	if err != nil {
-		return nil, nil, fmt.Errorf("parse remote machine token: %w", err)
+		return nil, fmt.Errorf("parse remote machine token: %w", err)
 	}
 
 	// Register the machine in the cluster using its public key and endpoints from the token.
@@ -352,13 +330,13 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 
 	addResp, err := c.AddMachine(ctx, addReq)
 	if err != nil {
-		return nil, nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
+		return nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}
 
-	// Get the most up-to-date list of other machines in the cluster to include them in the join request.
+	// List other machines in the cluster to include them in the join request.
 	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
-		return nil, nil, fmt.Errorf("list cluster machines: %w", err)
+		return nil, fmt.Errorf("list cluster machines: %w", err)
 	}
 	otherMachines := make([]*pb.MachineInfo, 0, len(machines)-1)
 	for _, m := range machines {
@@ -373,7 +351,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		OtherMachines: otherMachines,
 	}
 	if _, err = machineClient.JoinCluster(ctx, joinReq); err != nil {
-		return nil, nil, fmt.Errorf("join cluster: %w", err)
+		return nil, fmt.Errorf("join cluster: %w", err)
 	}
 
 	// TODO: fix empty context name when using the current context (contextName == "").
@@ -389,29 +367,20 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
-		return nil, nil, fmt.Errorf("save config: %w", err)
+		return nil, fmt.Errorf("save config: %w", err)
 	}
 
-	return c, machineClient, nil
+	return machineClient, nil
 }
 
 // provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns
 // a machine API client to interact with the machine. The client should be closed after use by the caller.
 // The version parameter specifies the version of the Uncloud daemon to install. If empty, the latest version is used.
-// The remoteMachine.SSHKeyPath could be updated to the default SSH key path if it is not set and the SSH agent
-// authentication fails.
-func provisionRemoteMachine(
-	ctx context.Context, remoteMachine *RemoteMachine, version string,
+func (cli *CLI) provisionRemoteMachine(
+	ctx context.Context, remoteMachine RemoteMachine, version string,
 ) (*client.Client, error) {
 	// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
-	// If the SSH connection using SSH agent fails and no key path is provided, try to use the default SSH key.
-	if err != nil && remoteMachine.KeyPath == "" {
-		remoteMachine.KeyPath = DefaultSSHKeyPath
-		sshClient, err = sshexec.Connect(
-			remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath,
-		)
-	}
 	if err != nil {
 		return nil, fmt.Errorf(
 			"SSH login to remote machine %s: %w",
@@ -445,6 +414,31 @@ func provisionRemoteMachine(
 	return machineClient, nil
 }
 
+func (cli *CLI) promptResetMachine() error {
+	var confirm bool
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(
+					"The remote machine is already initialised as a cluster member. Do you want to reset it first?",
+				).
+				Affirmative("Yes!").
+				Negative("No").
+				Value(&confirm),
+		),
+	).WithAccessible(true)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("prompt user to confirm: %w", err)
+	}
+
+	if !confirm {
+		return fmt.Errorf("remote machine is already initialised as a cluster member")
+	}
+	// TODO: implement resetting the remote machine.
+	return fmt.Errorf("resetting the remote machine is not implemented yet. " +
+		"Please manually run 'uncloud-uninstall' on the remote machine to fully uninstall Uncloud from it")
+}
+
 // ProgressOut returns an output stream for progress writer.
 func (cli *CLI) ProgressOut() *streams.Out {
 	return streams.NewOut(os.Stdout)

internal/cli/config/config.go

@@ -53,11 +53,11 @@ func (c *Config) Read() error {
 
 func (c *Config) Save() error {
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0o700); err != nil {
+	if err := os.MkdirAll(dir, 0700); err != nil {
 		return fmt.Errorf("create config directory '%s': %w", dir, err)
 	}
 
-	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return fmt.Errorf("write config file '%s': %w", c.path, err)
 	}

internal/cli/machine.go

@@ -5,20 +5,12 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"time"
 
-	"github.com/cenkalti/backoff/v4"
-	"github.com/charmbracelet/huh"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/sshexec"
-	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const (
-	// TODO: support pinning the script version to the CLI version.
-	installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
-	rootUser         = "root"
-)
+// TODO: support pinning the script version to the CLI version.
+const installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
 
 type RemoteMachine struct {
 	User    string
@@ -32,7 +24,7 @@ func installCmd(user string, version string) string {
 	var env []string
 
 	// Add the SSH user (non-root) to the uncloud group to allow access to the Uncloud daemon unix socket.
-	if user != rootUser {
+	if user != "root" {
 		sudoPrefix = "sudo"
 		env = append(env, "UNCLOUD_GROUP_ADD_USER="+sshexec.Quote(user))
 	}
@@ -54,26 +46,6 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 		return fmt.Errorf("run whoami: %w", err)
 	}
 
-	if user != rootUser {
-		// 'sudo -n' is not used because it fails with 'sudo: a password is required' when the user has no password
-		// in /etc/shadow even though it may have valid sudo access.
-		out, err := exec.Run(ctx, "sudo true")
-		if err != nil {
-			if strings.Contains(out, "password is required") {
-				return fmt.Errorf(
-					"user '%[1]s' requires a password for sudo, but Uncloud needs passwordless sudo or root access "+
-						"to install and configure the uncloudd daemon on the remote machine.\n\n"+
-						"Possible solutions:\n"+
-						"1. Use root user or a user with passwordless sudo instead.\n"+
-						"2. Configure passwordless sudo for the user '%[1]s' by running on the remote machine:\n"+
-						"   echo '%[1]s ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/%[1]s",
-					user)
-			}
-			return fmt.Errorf("sudo command failed for user '%s': %w. "+
-				"Please ensure the user has sudo privileges or use root user instead", user, err)
-		}
-	}
-
 	cmd := installCmd(user, version)
 
 	fmt.Println("Downloading Uncloud install script:", installScriptURL)
@@ -84,56 +56,3 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 	}
 	return nil
 }
-
-func promptResetMachine(ctx context.Context, machineClient pb.MachineClient) error {
-	var confirm bool
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewConfirm().
-				Title(
-					"The remote machine is already initialised as a cluster member. Do you want to reset it first?\n" +
-						"This will:\n" +
-						"- Remove all service containers from the machine\n" +
-						"- Reset the machine to the uninitialised state",
-				).
-				Affirmative("Yes!").
-				Negative("No").
-				Value(&confirm),
-		),
-	).WithAccessible(true)
-	if err := form.Run(); err != nil {
-		return fmt.Errorf("prompt user to confirm: %w", err)
-	}
-
-	if !confirm {
-		return fmt.Errorf("remote machine is already initialised as a cluster member")
-	}
-
-	if _, err := machineClient.Reset(ctx, &pb.ResetRequest{}); err != nil {
-		return fmt.Errorf("reset remote machine: %w. You can also manually run 'uncloud-uninstall' "+
-			"on the remote machine to fully uninstall Uncloud from it", err)
-	}
-	fmt.Println("Resetting the remote machine...")
-	if err := waitMachineReady(ctx, machineClient, 1*time.Minute); err != nil {
-		return fmt.Errorf("wait for machine to be ready after reset: %w", err)
-	}
-
-	return nil
-}
-
-// waitMachineReady waits for the machine to be ready to serve requests.
-func waitMachineReady(ctx context.Context, machineClient pb.MachineClient, timeout time.Duration) error {
-	boff := backoff.WithContext(backoff.NewExponentialBackOff(
-		backoff.WithMaxInterval(1*time.Second),
-		backoff.WithMaxElapsedTime(timeout),
-	), ctx)
-
-	inspect := func() error {
-		_, err := machineClient.Inspect(ctx, &emptypb.Empty{})
-		if err != nil {
-			return fmt.Errorf("inspect machine: %w", err)
-		}
-		return nil
-	}
-	return backoff.Retry(inspect, boff)
-}

internal/corrosion/client.go

@@ -5,15 +5,14 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"github.com/cenkalti/backoff/v4"
+	"golang.org/x/net/http2"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"golang.org/x/net/http2"
 )
 
 const (

internal/corrosion/subscribe.go

@@ -6,12 +6,11 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/cenkalti/backoff/v4"
 	"io"
 	"log/slog"
 	"net/http"
 	"strconv"
-
-	"github.com/cenkalti/backoff/v4"
 )
 
 type ChangeType string

internal/daemon/daemon.go

@@ -3,9 +3,8 @@ package daemon
 import (
 	"context"
 	"fmt"
-	"log/slog"
-
 	systemd "github.com/coreos/go-systemd/daemon"
+	"log/slog"
 	"github.com/psviderski/uncloud/internal/machine"
 )
 

internal/daemon/token.go

@@ -3,11 +3,10 @@ package daemon
 import (
 	"errors"
 	"fmt"
-	"net/netip"
-	"os"
-
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/network"
+	"net/netip"
+	"os"
 )
 
 // MachineToken returns the local machine's token that can be used for adding the machine to a cluster.

internal/docker/client.go

@@ -4,11 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
-	"time"
-
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/client"
+	"log/slog"
+	"time"
 )
 
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.

internal/machine/api/pb/cluster.pb.go

@@ -124,7 +124,7 @@ func (x DNSRecord_RecordType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use DNSRecord_RecordType.Descriptor instead.
 func (DNSRecord_RecordType) EnumDescriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11, 0}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8, 0}
 }
 
 type AddMachineRequest struct {
@@ -339,173 +339,6 @@ func (x *ListMachinesResponse) GetMachines() []*MachineMember {
 	return nil
 }
 
-type UpdateMachineRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Machine to update
-	MachineId string `protobuf:"bytes,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
-	// Updated machine information
-	Name      *string   `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
-	PublicIp  *IP       `protobuf:"bytes,3,opt,name=public_ip,json=publicIp,proto3,oneof" json:"public_ip,omitempty"`
-	Endpoints []*IPPort `protobuf:"bytes,4,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
-}
-
-func (x *UpdateMachineRequest) Reset() {
-	*x = UpdateMachineRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UpdateMachineRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateMachineRequest) ProtoMessage() {}
-
-func (x *UpdateMachineRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateMachineRequest.ProtoReflect.Descriptor instead.
-func (*UpdateMachineRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *UpdateMachineRequest) GetMachineId() string {
-	if x != nil {
-		return x.MachineId
-	}
-	return ""
-}
-
-func (x *UpdateMachineRequest) GetName() string {
-	if x != nil && x.Name != nil {
-		return *x.Name
-	}
-	return ""
-}
-
-func (x *UpdateMachineRequest) GetPublicIp() *IP {
-	if x != nil {
-		return x.PublicIp
-	}
-	return nil
-}
-
-func (x *UpdateMachineRequest) GetEndpoints() []*IPPort {
-	if x != nil {
-		return x.Endpoints
-	}
-	return nil
-}
-
-type UpdateMachineResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Machine *MachineInfo `protobuf:"bytes,1,opt,name=machine,proto3" json:"machine,omitempty"`
-}
-
-func (x *UpdateMachineResponse) Reset() {
-	*x = UpdateMachineResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UpdateMachineResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateMachineResponse) ProtoMessage() {}
-
-func (x *UpdateMachineResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateMachineResponse.ProtoReflect.Descriptor instead.
-func (*UpdateMachineResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *UpdateMachineResponse) GetMachine() *MachineInfo {
-	if x != nil {
-		return x.Machine
-	}
-	return nil
-}
-
-type RemoveMachineRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-}
-
-func (x *RemoveMachineRequest) Reset() {
-	*x = RemoveMachineRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RemoveMachineRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RemoveMachineRequest) ProtoMessage() {}
-
-func (x *RemoveMachineRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RemoveMachineRequest.ProtoReflect.Descriptor instead.
-func (*RemoveMachineRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *RemoveMachineRequest) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
 type Domain struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -517,7 +350,7 @@ type Domain struct {
 func (x *Domain) Reset() {
 	*x = Domain{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -530,7 +363,7 @@ func (x *Domain) String() string {
 func (*Domain) ProtoMessage() {}
 
 func (x *Domain) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -543,7 +376,7 @@ func (x *Domain) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Domain.ProtoReflect.Descriptor instead.
 func (*Domain) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *Domain) GetName() string {
@@ -564,7 +397,7 @@ type ReserveDomainRequest struct {
 func (x *ReserveDomainRequest) Reset() {
 	*x = ReserveDomainRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -577,7 +410,7 @@ func (x *ReserveDomainRequest) String() string {
 func (*ReserveDomainRequest) ProtoMessage() {}
 
 func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -590,7 +423,7 @@ func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReserveDomainRequest.ProtoReflect.Descriptor instead.
 func (*ReserveDomainRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ReserveDomainRequest) GetEndpoint() string {
@@ -611,7 +444,7 @@ type CreateDomainRecordsRequest struct {
 func (x *CreateDomainRecordsRequest) Reset() {
 	*x = CreateDomainRecordsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -624,7 +457,7 @@ func (x *CreateDomainRecordsRequest) String() string {
 func (*CreateDomainRecordsRequest) ProtoMessage() {}
 
 func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -637,7 +470,7 @@ func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsRequest.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{9}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CreateDomainRecordsRequest) GetRecords() []*DNSRecord {
@@ -658,7 +491,7 @@ type CreateDomainRecordsResponse struct {
 func (x *CreateDomainRecordsResponse) Reset() {
 	*x = CreateDomainRecordsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -671,7 +504,7 @@ func (x *CreateDomainRecordsResponse) String() string {
 func (*CreateDomainRecordsResponse) ProtoMessage() {}
 
 func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -684,7 +517,7 @@ func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsResponse.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{10}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *CreateDomainRecordsResponse) GetRecords() []*DNSRecord {
@@ -707,7 +540,7 @@ type DNSRecord struct {
 func (x *DNSRecord) Reset() {
 	*x = DNSRecord{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -720,7 +553,7 @@ func (x *DNSRecord) String() string {
 func (*DNSRecord) ProtoMessage() {}
 
 func (x *DNSRecord) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -733,7 +566,7 @@ func (x *DNSRecord) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSRecord.ProtoReflect.Descriptor instead.
 func (*DNSRecord) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *DNSRecord) GetName() string {
@@ -797,87 +630,59 @@ var file_internal_machine_api_pb_cluster_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63,
 	0x68, 0x69, 0x6e, 0x65, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x73, 0x22, 0xbb, 0x01, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a,
-	0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x29, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
-	0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49,
-	0x50, 0x48, 0x01, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x88, 0x01, 0x01,
-	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
-	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
-	0x69, 0x70, 0x22, 0x43, 0x0a, 0x15, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x07, 0x6d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x22, 0x26, 0x0a, 0x14, 0x52, 0x65, 0x6d, 0x6f, 0x76,
-	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22,
-	0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x32, 0x0a,
-	0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47, 0x0a, 0x1b, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x2e, 0x0a, 0x0a, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x55, 0x4e, 0x53,
-	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x05, 0x0a, 0x01, 0x41, 0x10,
-	0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02, 0x32, 0x92, 0x04, 0x0a, 0x07,
-	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x0d, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30,
-	0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f,
+	0x69, 0x6e, 0x65, 0x73, 0x22, 0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x22, 0x32, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47,
+	0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
+	0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a,
+	0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07,
+	0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e,
+	0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
+	0x22, 0x2e, 0x0a, 0x0a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f,
+	0x0a, 0x0b, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x05, 0x0a, 0x01, 0x41, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02,
+	0x32, 0x86, 0x03, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a,
+	0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c,
+	0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70,
-	0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37,
+	0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
+	0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c,
+	0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
+	0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
+	0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -893,7 +698,7 @@ func file_internal_machine_api_pb_cluster_proto_rawDescGZIP() []byte {
 }
 
 var file_internal_machine_api_pb_cluster_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(MachineMember_MembershipState)(0),  // 0: api.MachineMember.MembershipState
 	(DNSRecord_RecordType)(0),           // 1: api.DNSRecord.RecordType
@@ -901,54 +706,43 @@ var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(*AddMachineResponse)(nil),          // 3: api.AddMachineResponse
 	(*MachineMember)(nil),               // 4: api.MachineMember
 	(*ListMachinesResponse)(nil),        // 5: api.ListMachinesResponse
-	(*UpdateMachineRequest)(nil),        // 6: api.UpdateMachineRequest
-	(*UpdateMachineResponse)(nil),       // 7: api.UpdateMachineResponse
-	(*RemoveMachineRequest)(nil),        // 8: api.RemoveMachineRequest
-	(*Domain)(nil),                      // 9: api.Domain
-	(*ReserveDomainRequest)(nil),        // 10: api.ReserveDomainRequest
-	(*CreateDomainRecordsRequest)(nil),  // 11: api.CreateDomainRecordsRequest
-	(*CreateDomainRecordsResponse)(nil), // 12: api.CreateDomainRecordsResponse
-	(*DNSRecord)(nil),                   // 13: api.DNSRecord
-	(*NetworkConfig)(nil),               // 14: api.NetworkConfig
-	(*IP)(nil),                          // 15: api.IP
-	(*MachineInfo)(nil),                 // 16: api.MachineInfo
-	(*IPPort)(nil),                      // 17: api.IPPort
-	(*emptypb.Empty)(nil),               // 18: google.protobuf.Empty
+	(*Domain)(nil),                      // 6: api.Domain
+	(*ReserveDomainRequest)(nil),        // 7: api.ReserveDomainRequest
+	(*CreateDomainRecordsRequest)(nil),  // 8: api.CreateDomainRecordsRequest
+	(*CreateDomainRecordsResponse)(nil), // 9: api.CreateDomainRecordsResponse
+	(*DNSRecord)(nil),                   // 10: api.DNSRecord
+	(*NetworkConfig)(nil),               // 11: api.NetworkConfig
+	(*IP)(nil),                          // 12: api.IP
+	(*MachineInfo)(nil),                 // 13: api.MachineInfo
+	(*emptypb.Empty)(nil),               // 14: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_cluster_proto_depIdxs = []int32{
-	14, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
-	15, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
-	16, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
-	16, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
+	11, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
+	12, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
+	13, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
+	13, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
 	0,  // 4: api.MachineMember.state:type_name -> api.MachineMember.MembershipState
 	4,  // 5: api.ListMachinesResponse.machines:type_name -> api.MachineMember
-	15, // 6: api.UpdateMachineRequest.public_ip:type_name -> api.IP
-	17, // 7: api.UpdateMachineRequest.endpoints:type_name -> api.IPPort
-	16, // 8: api.UpdateMachineResponse.machine:type_name -> api.MachineInfo
-	13, // 9: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
-	13, // 10: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
-	1,  // 11: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
-	2,  // 12: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
-	18, // 13: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
-	6,  // 14: api.Cluster.UpdateMachine:input_type -> api.UpdateMachineRequest
-	8,  // 15: api.Cluster.RemoveMachine:input_type -> api.RemoveMachineRequest
-	10, // 16: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
-	18, // 17: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
-	18, // 18: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
-	11, // 19: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
-	3,  // 20: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
-	5,  // 21: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
-	7,  // 22: api.Cluster.UpdateMachine:output_type -> api.UpdateMachineResponse
-	18, // 23: api.Cluster.RemoveMachine:output_type -> google.protobuf.Empty
-	9,  // 24: api.Cluster.ReserveDomain:output_type -> api.Domain
-	9,  // 25: api.Cluster.GetDomain:output_type -> api.Domain
-	9,  // 26: api.Cluster.ReleaseDomain:output_type -> api.Domain
-	12, // 27: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
-	20, // [20:28] is the sub-list for method output_type
-	12, // [12:20] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	10, // 6: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
+	10, // 7: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
+	1,  // 8: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
+	2,  // 9: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
+	14, // 10: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
+	7,  // 11: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
+	14, // 12: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
+	14, // 13: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
+	8,  // 14: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
+	3,  // 15: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
+	5,  // 16: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
+	6,  // 17: api.Cluster.ReserveDomain:output_type -> api.Domain
+	6,  // 18: api.Cluster.GetDomain:output_type -> api.Domain
+	6,  // 19: api.Cluster.ReleaseDomain:output_type -> api.Domain
+	9,  // 20: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
+	15, // [15:21] is the sub-list for method output_type
+	9,  // [9:15] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_internal_machine_api_pb_cluster_proto_init() }
@@ -1008,42 +802,6 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*UpdateMachineRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*UpdateMachineResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*RemoveMachineRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
 			switch v := v.(*Domain); i {
 			case 0:
 				return &v.state
@@ -1055,7 +813,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[5].Exporter = func(v any, i int) any {
 			switch v := v.(*ReserveDomainRequest); i {
 			case 0:
 				return &v.state
@@ -1067,7 +825,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[9].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[6].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateDomainRecordsRequest); i {
 			case 0:
 				return &v.state
@@ -1079,7 +837,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[10].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateDomainRecordsResponse); i {
 			case 0:
 				return &v.state
@@ -1091,7 +849,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_cluster_proto_msgTypes[11].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*DNSRecord); i {
 			case 0:
 				return &v.state
@@ -1104,14 +862,13 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 	}
-	file_internal_machine_api_pb_cluster_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_cluster_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   12,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/cluster.proto

@@ -11,8 +11,6 @@ import "internal/machine/api/pb/machine.proto";
 service Cluster {
   rpc AddMachine(AddMachineRequest) returns (AddMachineResponse);
   rpc ListMachines(google.protobuf.Empty) returns (ListMachinesResponse);
-  rpc UpdateMachine(UpdateMachineRequest) returns (UpdateMachineResponse);
-  rpc RemoveMachine(RemoveMachineRequest) returns (google.protobuf.Empty);
 
   rpc ReserveDomain(ReserveDomainRequest) returns (Domain);
   rpc GetDomain(google.protobuf.Empty) returns (Domain);
@@ -51,24 +49,6 @@ message ListMachinesResponse {
   repeated MachineMember machines = 1;
 }
 
-message UpdateMachineRequest {
-  // Machine to update
-  string machine_id = 1;
-
-  // Updated machine information
-  optional string name = 2;
-  optional IP public_ip = 3;
-  repeated IPPort endpoints = 4;
-}
-
-message UpdateMachineResponse {
-  MachineInfo machine = 1;
-}
-
-message RemoveMachineRequest {
-  string id = 1;
-}
-
 message Domain {
   string name = 1;
 }

internal/machine/api/pb/cluster_grpc.pb.go

@@ -22,8 +22,6 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	Cluster_AddMachine_FullMethodName          = "/api.Cluster/AddMachine"
 	Cluster_ListMachines_FullMethodName        = "/api.Cluster/ListMachines"
-	Cluster_UpdateMachine_FullMethodName       = "/api.Cluster/UpdateMachine"
-	Cluster_RemoveMachine_FullMethodName       = "/api.Cluster/RemoveMachine"
 	Cluster_ReserveDomain_FullMethodName       = "/api.Cluster/ReserveDomain"
 	Cluster_GetDomain_FullMethodName           = "/api.Cluster/GetDomain"
 	Cluster_ReleaseDomain_FullMethodName       = "/api.Cluster/ReleaseDomain"
@@ -36,8 +34,6 @@ const (
 type ClusterClient interface {
 	AddMachine(ctx context.Context, in *AddMachineRequest, opts ...grpc.CallOption) (*AddMachineResponse, error)
 	ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMachinesResponse, error)
-	UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error)
-	RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error)
 	GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	ReleaseDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
@@ -72,26 +68,6 @@ func (c *clusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opt
 	return out, nil
 }
 
-func (c *clusterClient) UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(UpdateMachineResponse)
-	err := c.cc.Invoke(ctx, Cluster_UpdateMachine_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *clusterClient) RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Cluster_RemoveMachine_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -138,8 +114,6 @@ func (c *clusterClient) CreateDomainRecords(ctx context.Context, in *CreateDomai
 type ClusterServer interface {
 	AddMachine(context.Context, *AddMachineRequest) (*AddMachineResponse, error)
 	ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error)
-	UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error)
-	RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error)
 	ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error)
 	GetDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	ReleaseDomain(context.Context, *emptypb.Empty) (*Domain, error)
@@ -160,12 +134,6 @@ func (UnimplementedClusterServer) AddMachine(context.Context, *AddMachineRequest
 func (UnimplementedClusterServer) ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListMachines not implemented")
 }
-func (UnimplementedClusterServer) UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdateMachine not implemented")
-}
-func (UnimplementedClusterServer) RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RemoveMachine not implemented")
-}
 func (UnimplementedClusterServer) ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReserveDomain not implemented")
 }
@@ -235,42 +203,6 @@ func _Cluster_ListMachines_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Cluster_UpdateMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UpdateMachineRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ClusterServer).UpdateMachine(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Cluster_UpdateMachine_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ClusterServer).UpdateMachine(ctx, req.(*UpdateMachineRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Cluster_RemoveMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RemoveMachineRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ClusterServer).RemoveMachine(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Cluster_RemoveMachine_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ClusterServer).RemoveMachine(ctx, req.(*RemoveMachineRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ReserveDomainRequest)
 	if err := dec(in); err != nil {
@@ -358,14 +290,6 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListMachines",
 			Handler:    _Cluster_ListMachines_Handler,
 		},
-		{
-			MethodName: "UpdateMachine",
-			Handler:    _Cluster_UpdateMachine_Handler,
-		},
-		{
-			MethodName: "RemoveMachine",
-			Handler:    _Cluster_RemoveMachine_Handler,
-		},
 		{
 			MethodName: "ReserveDomain",
 			Handler:    _Cluster_ReserveDomain_Handler,

internal/machine/api/pb/machine.pb.go

@@ -21,6 +21,63 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type CheckPrerequisitesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Overall status of the checks.
+	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
+	// Error message if not satisfied (empty if all checks pass).
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *CheckPrerequisitesResponse) Reset() {
+	*x = CheckPrerequisitesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPrerequisitesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPrerequisitesResponse) ProtoMessage() {}
+
+func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
+func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
+	if x != nil {
+		return x.Satisfied
+	}
+	return false
+}
+
+func (x *CheckPrerequisitesResponse) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
 type MachineInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -35,7 +92,7 @@ type MachineInfo struct {
 func (x *MachineInfo) Reset() {
 	*x = MachineInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -48,7 +105,7 @@ func (x *MachineInfo) String() string {
 func (*MachineInfo) ProtoMessage() {}
 
 func (x *MachineInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -61,7 +118,7 @@ func (x *MachineInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineInfo.ProtoReflect.Descriptor instead.
 func (*MachineInfo) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *MachineInfo) GetId() string {
@@ -106,7 +163,7 @@ type NetworkConfig struct {
 func (x *NetworkConfig) Reset() {
 	*x = NetworkConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -119,7 +176,7 @@ func (x *NetworkConfig) String() string {
 func (*NetworkConfig) ProtoMessage() {}
 
 func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -132,7 +189,7 @@ func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
 func (*NetworkConfig) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *NetworkConfig) GetSubnet() *IPPrefix {
@@ -163,63 +220,6 @@ func (x *NetworkConfig) GetPublicKey() []byte {
 	return nil
 }
 
-type CheckPrerequisitesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Overall status of the checks.
-	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
-	// Error message if not satisfied (empty if all checks pass).
-	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
-}
-
-func (x *CheckPrerequisitesResponse) Reset() {
-	*x = CheckPrerequisitesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CheckPrerequisitesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CheckPrerequisitesResponse) ProtoMessage() {}
-
-func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
-func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
-	if x != nil {
-		return x.Satisfied
-	}
-	return false
-}
-
-func (x *CheckPrerequisitesResponse) GetError() string {
-	if x != nil {
-		return x.Error
-	}
-	return ""
-}
-
 type InitClusterRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -466,44 +466,6 @@ func (x *TokenResponse) GetToken() string {
 	return ""
 }
 
-type ResetRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *ResetRequest) Reset() {
-	*x = ResetRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ResetRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ResetRequest) ProtoMessage() {}
-
-func (x *ResetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ResetRequest.ProtoReflect.Descriptor instead.
-func (*ResetRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
-}
-
 type Service struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -518,7 +480,7 @@ type Service struct {
 func (x *Service) Reset() {
 	*x = Service{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -531,7 +493,7 @@ func (x *Service) String() string {
 func (*Service) ProtoMessage() {}
 
 func (x *Service) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -544,7 +506,7 @@ func (x *Service) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service.ProtoReflect.Descriptor instead.
 func (*Service) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *Service) GetId() string {
@@ -586,7 +548,7 @@ type InspectServiceRequest struct {
 func (x *InspectServiceRequest) Reset() {
 	*x = InspectServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -599,7 +561,7 @@ func (x *InspectServiceRequest) String() string {
 func (*InspectServiceRequest) ProtoMessage() {}
 
 func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -612,7 +574,7 @@ func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceRequest.ProtoReflect.Descriptor instead.
 func (*InspectServiceRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *InspectServiceRequest) GetId() string {
@@ -633,7 +595,7 @@ type InspectServiceResponse struct {
 func (x *InspectServiceResponse) Reset() {
 	*x = InspectServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -646,7 +608,7 @@ func (x *InspectServiceResponse) String() string {
 func (*InspectServiceResponse) ProtoMessage() {}
 
 func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -659,7 +621,7 @@ func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceResponse.ProtoReflect.Descriptor instead.
 func (*InspectServiceResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{10}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *InspectServiceResponse) GetService() *Service {
@@ -682,7 +644,7 @@ type Service_Container struct {
 func (x *Service_Container) Reset() {
 	*x = Service_Container{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -695,7 +657,7 @@ func (x *Service_Container) String() string {
 func (*Service_Container) ProtoMessage() {}
 
 func (x *Service_Container) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -708,7 +670,7 @@ func (x *Service_Container) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service_Container.ProtoReflect.Descriptor instead.
 func (*Service_Container) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8, 0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7, 0}
 }
 
 func (x *Service_Container) GetMachineId() string {
@@ -735,31 +697,31 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24, 0x69, 0x6e, 0x74, 0x65, 0x72,
 	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
 	0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x08, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73, 0x75, 0x62,
-	0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74,
-	0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x69,
-	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50,
-	0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70, 0x12, 0x29,
-	0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x09,
-	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63,
-	0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66,
-	0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73,
-	0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
+	0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69,
+	0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a,
+	0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x22, 0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52,
+	0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73,
+	0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e,
+	0x65, 0x74, 0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x5f, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x49, 0x50, 0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70,
+	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
+	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
 	0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d, 0x65,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
@@ -786,8 +748,7 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x22, 0x25,
 	0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x0e, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
 	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20,
@@ -806,7 +767,7 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
 	0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x0c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0xc3, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0x8f, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x12, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65,
 	0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
@@ -826,19 +787,16 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x49, 0x6e, 0x73, 0x70,
 	0x65, 0x63, 0x74, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x32, 0x0a,
-	0x05, 0x52, 0x65, 0x73, 0x65, 0x74, 0x12, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
-	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x12, 0x49, 0x0a, 0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
-	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61,
-	0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x49, 0x0a,
+	0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
+	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -853,54 +811,51 @@ func file_internal_machine_api_pb_machine_proto_rawDescGZIP() []byte {
 	return file_internal_machine_api_pb_machine_proto_rawDescData
 }
 
-var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_internal_machine_api_pb_machine_proto_goTypes = []any{
-	(*MachineInfo)(nil),                // 0: api.MachineInfo
-	(*NetworkConfig)(nil),              // 1: api.NetworkConfig
-	(*CheckPrerequisitesResponse)(nil), // 2: api.CheckPrerequisitesResponse
+	(*CheckPrerequisitesResponse)(nil), // 0: api.CheckPrerequisitesResponse
+	(*MachineInfo)(nil),                // 1: api.MachineInfo
+	(*NetworkConfig)(nil),              // 2: api.NetworkConfig
 	(*InitClusterRequest)(nil),         // 3: api.InitClusterRequest
 	(*InitClusterResponse)(nil),        // 4: api.InitClusterResponse
 	(*JoinClusterRequest)(nil),         // 5: api.JoinClusterRequest
 	(*TokenResponse)(nil),              // 6: api.TokenResponse
-	(*ResetRequest)(nil),               // 7: api.ResetRequest
-	(*Service)(nil),                    // 8: api.Service
-	(*InspectServiceRequest)(nil),      // 9: api.InspectServiceRequest
-	(*InspectServiceResponse)(nil),     // 10: api.InspectServiceResponse
-	(*Service_Container)(nil),          // 11: api.Service.Container
-	(*IP)(nil),                         // 12: api.IP
-	(*IPPrefix)(nil),                   // 13: api.IPPrefix
-	(*IPPort)(nil),                     // 14: api.IPPort
-	(*emptypb.Empty)(nil),              // 15: google.protobuf.Empty
+	(*Service)(nil),                    // 7: api.Service
+	(*InspectServiceRequest)(nil),      // 8: api.InspectServiceRequest
+	(*InspectServiceResponse)(nil),     // 9: api.InspectServiceResponse
+	(*Service_Container)(nil),          // 10: api.Service.Container
+	(*IP)(nil),                         // 11: api.IP
+	(*IPPrefix)(nil),                   // 12: api.IPPrefix
+	(*IPPort)(nil),                     // 13: api.IPPort
+	(*emptypb.Empty)(nil),              // 14: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_machine_proto_depIdxs = []int32{
-	1,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
-	12, // 1: api.MachineInfo.public_ip:type_name -> api.IP
-	13, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
-	12, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
-	14, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
-	13, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
-	12, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
-	0,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
-	0,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
-	0,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
-	11, // 10: api.Service.containers:type_name -> api.Service.Container
-	8,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
-	15, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
+	2,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
+	11, // 1: api.MachineInfo.public_ip:type_name -> api.IP
+	12, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
+	11, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
+	13, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
+	12, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
+	11, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
+	1,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
+	1,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
+	1,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
+	10, // 10: api.Service.containers:type_name -> api.Service.Container
+	7,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
+	14, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
 	3,  // 13: api.Machine.InitCluster:input_type -> api.InitClusterRequest
 	5,  // 14: api.Machine.JoinCluster:input_type -> api.JoinClusterRequest
-	15, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
-	15, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
-	7,  // 17: api.Machine.Reset:input_type -> api.ResetRequest
-	9,  // 18: api.Machine.InspectService:input_type -> api.InspectServiceRequest
-	2,  // 19: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
-	4,  // 20: api.Machine.InitCluster:output_type -> api.InitClusterResponse
-	15, // 21: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
-	6,  // 22: api.Machine.Token:output_type -> api.TokenResponse
-	0,  // 23: api.Machine.Inspect:output_type -> api.MachineInfo
-	15, // 24: api.Machine.Reset:output_type -> google.protobuf.Empty
-	10, // 25: api.Machine.InspectService:output_type -> api.InspectServiceResponse
-	19, // [19:26] is the sub-list for method output_type
-	12, // [12:19] is the sub-list for method input_type
+	14, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
+	14, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
+	8,  // 17: api.Machine.InspectService:input_type -> api.InspectServiceRequest
+	0,  // 18: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
+	4,  // 19: api.Machine.InitCluster:output_type -> api.InitClusterResponse
+	14, // 20: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
+	6,  // 21: api.Machine.Token:output_type -> api.TokenResponse
+	1,  // 22: api.Machine.Inspect:output_type -> api.MachineInfo
+	9,  // 23: api.Machine.InspectService:output_type -> api.InspectServiceResponse
+	18, // [18:24] is the sub-list for method output_type
+	12, // [12:18] is the sub-list for method input_type
 	12, // [12:12] is the sub-list for extension type_name
 	12, // [12:12] is the sub-list for extension extendee
 	0,  // [0:12] is the sub-list for field type_name
@@ -914,7 +869,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 	file_internal_machine_api_pb_common_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_internal_machine_api_pb_machine_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*MachineInfo); i {
+			switch v := v.(*CheckPrerequisitesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -926,7 +881,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*NetworkConfig); i {
+			switch v := v.(*MachineInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -938,7 +893,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*CheckPrerequisitesResponse); i {
+			switch v := v.(*NetworkConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -998,18 +953,6 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*ResetRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*Service); i {
 			case 0:
 				return &v.state
@@ -1021,7 +964,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*InspectServiceRequest); i {
 			case 0:
 				return &v.state
@@ -1033,7 +976,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
 			switch v := v.(*InspectServiceResponse); i {
 			case 0:
 				return &v.state
@@ -1045,7 +988,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[11].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
 			switch v := v.(*Service_Container); i {
 			case 0:
 				return &v.state
@@ -1068,7 +1011,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_machine_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   12,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/machine.proto

@@ -14,9 +14,6 @@ service Machine {
   rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
   rpc Token(google.protobuf.Empty) returns (TokenResponse);
   rpc Inspect(google.protobuf.Empty) returns (MachineInfo);
-  // Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-  rpc Reset(ResetRequest) returns (google.protobuf.Empty);
-
   rpc InspectService(InspectServiceRequest) returns (InspectServiceResponse);
 }
 
@@ -64,9 +61,6 @@ message TokenResponse {
   string token = 1;
 }
 
-message ResetRequest {
-}
-
 message Service {
   string id = 1;
   string name = 2;

internal/machine/api/pb/machine_grpc.pb.go

@@ -25,7 +25,6 @@ const (
 	Machine_JoinCluster_FullMethodName        = "/api.Machine/JoinCluster"
 	Machine_Token_FullMethodName              = "/api.Machine/Token"
 	Machine_Inspect_FullMethodName            = "/api.Machine/Inspect"
-	Machine_Reset_FullMethodName              = "/api.Machine/Reset"
 	Machine_InspectService_FullMethodName     = "/api.Machine/InspectService"
 )
 
@@ -33,14 +32,11 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type MachineClient interface {
-	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error)
 	InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error)
 	JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error)
 	Inspect(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*MachineInfo, error)
-	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-	Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error)
 }
 
@@ -102,16 +98,6 @@ func (c *machineClient) Inspect(ctx context.Context, in *emptypb.Empty, opts ...
 	return out, nil
 }
 
-func (c *machineClient) Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Machine_Reset_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InspectServiceResponse)
@@ -126,14 +112,11 @@ func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRe
 // All implementations must embed UnimplementedMachineServer
 // for forward compatibility.
 type MachineServer interface {
-	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error)
 	InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error)
 	JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error)
 	Token(context.Context, *emptypb.Empty) (*TokenResponse, error)
 	Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error)
-	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-	Reset(context.Context, *ResetRequest) (*emptypb.Empty, error)
 	InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error)
 	mustEmbedUnimplementedMachineServer()
 }
@@ -160,9 +143,6 @@ func (UnimplementedMachineServer) Token(context.Context, *emptypb.Empty) (*Token
 func (UnimplementedMachineServer) Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Inspect not implemented")
 }
-func (UnimplementedMachineServer) Reset(context.Context, *ResetRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Reset not implemented")
-}
 func (UnimplementedMachineServer) InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InspectService not implemented")
 }
@@ -277,24 +257,6 @@ func _Machine_Inspect_Handler(srv interface{}, ctx context.Context, dec func(int
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Machine_Reset_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ResetRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MachineServer).Reset(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Machine_Reset_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MachineServer).Reset(ctx, req.(*ResetRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Machine_InspectService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InspectServiceRequest)
 	if err := dec(in); err != nil {
@@ -340,10 +302,6 @@ var Machine_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Inspect",
 			Handler:    _Machine_Inspect_Handler,
 		},
-		{
-			MethodName: "Reset",
-			Handler:    _Machine_Reset_Handler,
-		},
 		{
 			MethodName: "InspectService",
 			Handler:    _Machine_InspectService_Handler,

internal/machine/api/proxy/backend.go

@@ -2,11 +2,10 @@ package proxy
 
 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 )
 
 // One2ManyResponder converts upstream responses into messages from upstreams, so that multiple

internal/machine/api/proxy/director.go

@@ -2,12 +2,11 @@ package proxy
 
 import (
 	"context"
-	"sync"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+	"sync"
 )
 
 // Director manages routing of gRPC requests between local and remote backends.

internal/machine/api/proxy/local.go

@@ -2,12 +2,11 @@ package proxy
 
 import (
 	"context"
-	"sync"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
+	"sync"
 )
 
 // LocalBackend is a proxy.One2ManyResponder implementation that proxies to a local gRPC server listening on a Unix socket.

internal/machine/api/proxy/remote.go

@@ -3,15 +3,14 @@ package proxy
 import (
 	"context"
 	"fmt"
-	"net/netip"
-	"sync"
-	"time"
-
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
+	"net/netip"
+	"sync"
+	"time"
 )
 
 // RemoteBackend is a proxy.One2ManyResponder implementation that proxies to a remote gRPC server, injecting machine metadata

internal/machine/caddyconfig/caddyfile.go

@@ -1,17 +0,0 @@
-package caddyconfig
-
-import (
-	"fmt"
-
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-func GenerateCaddyfile(containers []api.ServiceContainer, verifyResponse string) (string, error) {
-	return fmt.Sprintf(`http:// {
-	handle %s {
-		respond "%s" 200
-	}
-	log
-}
-`, VerifyPath, verifyResponse), nil
-}

internal/machine/caddyconfig/controller.go

@@ -1,149 +0,0 @@
-package caddyconfig
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"os"
-	"path/filepath"
-
-	"github.com/psviderski/uncloud/internal/fs"
-	"github.com/psviderski/uncloud/internal/machine/store"
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-const (
-	CaddyGroup = "uncloud"
-	VerifyPath = "/.uncloud-verify"
-)
-
-// Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
-// proxy. The generated configuration allows Caddy to route external traffic to service containers across the internal
-// network.
-type Controller struct {
-	store          *store.Store
-	configDir      string
-	verifyResponse string
-	log            *slog.Logger
-}
-
-func NewController(store *store.Store, configDir string, verifyResponse string) (*Controller, error) {
-	if err := os.MkdirAll(configDir, 0o750); err != nil {
-		return nil, fmt.Errorf("create directory for Caddy configuration '%s': %w", configDir, err)
-	}
-	if err := fs.Chown(configDir, "", CaddyGroup); err != nil {
-		return nil, fmt.Errorf("change owner of directory for Caddy configuration '%s': %w", configDir, err)
-	}
-
-	return &Controller{
-		store:          store,
-		configDir:      configDir,
-		verifyResponse: verifyResponse,
-		log:            slog.With("component", "caddy-controller"),
-	}, nil
-}
-
-func (c *Controller) Run(ctx context.Context) error {
-	containerRecords, changes, err := c.store.SubscribeContainers(ctx)
-	if err != nil {
-		return fmt.Errorf("subscribe to container changes: %w", err)
-	}
-	c.log.Info("Subscribed to container changes in the cluster to generate Caddy configuration.")
-
-	containers, err := c.filterAvailableContainers(containerRecords)
-	if err != nil {
-		return fmt.Errorf("filter available containers: %w", err)
-	}
-
-	if err = c.generateCaddyfile(containers); err != nil {
-		return fmt.Errorf("generate Caddyfile configuration: %w", err)
-	}
-	if err = c.generateJSONConfig(containers); err != nil {
-		return fmt.Errorf("generate Caddy JSON configuration: %w", err)
-	}
-
-	for {
-		select {
-		case _, ok := <-changes:
-			if !ok {
-				return fmt.Errorf("containers subscription failed")
-			}
-			c.log.Info("Cluster containers changed, updating Caddy configuration.")
-
-			containerRecords, err = c.store.ListContainers(ctx, store.ListOptions{})
-			if err != nil {
-				c.log.Info("Failed to list containers.", "err", err)
-				continue
-			}
-			containers, err = c.filterAvailableContainers(containerRecords)
-			if err != nil {
-				c.log.Info("Failed to filter available containers.", "err", err)
-				continue
-			}
-
-			if err = c.generateCaddyfile(containers); err != nil {
-				c.log.Info("Failed to generate Caddyfile configuration.", "err", err)
-			}
-			if err = c.generateJSONConfig(containers); err != nil {
-				c.log.Info("Failed to generate Caddy JSON configuration.", "err", err)
-			}
-
-			c.log.Info("Updated Caddy configuration.", "dir", c.configDir)
-		case <-ctx.Done():
-			return nil
-		}
-	}
-}
-
-// filterAvailableContainers filters out containers from this machine that are likely unavailable. The availability
-// is determined by the cluster membership state of the machine that the container is running on.
-// TODO: implement machine membership check using Corrossion Admin client.
-func (c *Controller) filterAvailableContainers(
-	containerRecords []store.ContainerRecord,
-) ([]api.ServiceContainer, error) {
-	containers := make([]api.ServiceContainer, len(containerRecords))
-	for i, cr := range containerRecords {
-		containers[i] = cr.Container
-	}
-	return containers, nil
-}
-
-func (c *Controller) generateCaddyfile(containers []api.ServiceContainer) error {
-	caddyfile, err := GenerateCaddyfile(containers, c.verifyResponse)
-	if err != nil {
-		return fmt.Errorf("generate Caddyfile: %w", err)
-	}
-	caddyfilePath := filepath.Join(c.configDir, "Caddyfile")
-
-	if err = os.WriteFile(caddyfilePath, []byte(caddyfile), 0o640); err != nil {
-		return fmt.Errorf("write Caddyfile to file '%s': %w", caddyfilePath, err)
-	}
-	if err = fs.Chown(caddyfilePath, "", CaddyGroup); err != nil {
-		return fmt.Errorf("change owner of Caddyfile '%s': %w", caddyfilePath, err)
-	}
-
-	return nil
-}
-
-func (c *Controller) generateJSONConfig(containers []api.ServiceContainer) error {
-	config, err := GenerateJSONConfig(containers, c.verifyResponse)
-	if err != nil {
-		return err
-	}
-
-	configBytes, err := json.MarshalIndent(config, "", "    ")
-	if err != nil {
-		return fmt.Errorf("marshal Caddy configuration: %w", err)
-	}
-	configPath := filepath.Join(c.configDir, "caddy.json")
-
-	if err = os.WriteFile(configPath, configBytes, 0o640); err != nil {
-		return fmt.Errorf("write Caddy configuration to file '%s': %w", configPath, err)
-	}
-	if err = fs.Chown(configPath, "", CaddyGroup); err != nil {
-		return fmt.Errorf("change owner of Caddy configuration file '%s': %w", configPath, err)
-	}
-
-	return nil
-}

internal/machine/caddyfile/config.go

@@ -1,4 +1,4 @@
-package caddyconfig
+package caddyfile
 
 import (
 	"encoding/json"
@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"slices"
 	"strconv"
-	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -19,7 +18,7 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 )
 
-func GenerateJSONConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
+func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
 	// Maps hostnames to lists of upstreams (container IP:port pairs).
 	httpHostUpstreams := make(map[string][]string)
 	httpsHostUpstreams := make(map[string][]string)
@@ -65,8 +64,6 @@ func GenerateJSONConfig(containers []api.ServiceContainer, verifyResponse string
 	servers := make(map[string]*caddyhttp.Server)
 	servers["http"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPPort)},
-		// All http requests to this server are logged to the default logger.
-		Logs: &caddyhttp.ServerLogConfig{},
 		Routes: append(
 			hostUpstreamsToRoutes(httpHostUpstreams, &warnings),
 			// Add a route to respond with a static verification response at the /.uncloud-verify path.
@@ -75,8 +72,6 @@ func GenerateJSONConfig(containers []api.ServiceContainer, verifyResponse string
 	}
 	servers["https"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPSPort)},
-		// All https requests to this server are logged to the default logger.
-		Logs:   &caddyhttp.ServerLogConfig{},
 		Routes: hostUpstreamsToRoutes(httpsHostUpstreams, &warnings),
 	}
 
@@ -117,16 +112,6 @@ func hostUpstreamsToRoutes(hostUpstreams map[string][]string, warnings *[]caddyc
 			}
 		}
 		handler := &reverseproxy.Handler{
-			HealthChecks: &reverseproxy.HealthChecks{
-				// Enable passive health checks to automatically detect unhealthy upstreams.
-				Passive: &reverseproxy.PassiveHealthChecks{
-					FailDuration: caddy.Duration(30 * time.Second),
-				},
-			},
-			LoadBalancing: &reverseproxy.LoadBalancing{
-				// Retry failed requests to skip over temporarily unavailable upstreams.
-				Retries: 3,
-			},
 			Upstreams: upstreamPool,
 		}
 

internal/machine/caddyfile/config_test.go

@@ -1,4 +1,4 @@
-package caddyconfig
+package caddyfile
 
 import (
 	"strings"
@@ -25,12 +25,10 @@ func TestGenerateConfig(t *testing.T) {
 						"handler": "static_response",
 						"status_code": 200
 					}]
-				}],
-				"logs": {}
+				}]
 			},
 			"https": {
-				"listen": [":443"],
-				"logs": {}
+				"listen": [":443"]
 			}
 		}
 	}`
@@ -62,14 +60,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -81,12 +71,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     },
                     "https": {
-                        "listen": [":443"],
-						"logs": {}
+                        "listen": [":443"]
                     }
                 }
             }`,
@@ -107,14 +95,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
                                         {"dial": "10.210.0.2:8080"},
                                         {"dial": "10.210.0.3:8080"}
@@ -129,12 +109,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     },
                     "https": {
-                        "listen": [":443"],
-						"logs": {}
+                        "listen": [":443"]
                     }
                 }
             }`,
@@ -158,8 +136,7 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     },
                     "https": {
                         "listen": [":443"],
@@ -168,19 +145,10 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8000"}]
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     }
                 }
             }`,
@@ -212,14 +180,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8080"},
 										{"dial": "10.210.0.3:8080"},
@@ -231,14 +191,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["web.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8000"},
 										{"dial": "10.210.0.4:8000"},
@@ -254,8 +206,7 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     },
                     "https": {
                         "listen": [":443"],
@@ -264,14 +215,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.3:8888"},
 										{"dial": "10.210.0.4:8888"},
@@ -279,8 +222,7 @@ func TestGenerateConfig(t *testing.T) {
 									]
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     }
                 }
             }`,
@@ -344,14 +286,6 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
-									"health_checks": {
-                                        "passive": {
-                                            "fail_duration": 30000000000
-                                        }
-                                    },
-                                    "load_balancing": {
-                                        "retries": 3
-                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -363,12 +297,10 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ],
-						"logs": {}
+                        ]
                     },
                     "https": {
-                        "listen": [":443"],
-						"logs": {}
+                        "listen": [":443"]
                     }
                 }
             }`,
@@ -378,7 +310,7 @@ func TestGenerateConfig(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			config, err := GenerateJSONConfig(tt.containers, "verification-response-body")
+			config, err := GenerateConfig(tt.containers, "verification-response-body")
 
 			if tt.wantErr {
 				assert.Error(t, err)

internal/machine/caddyfile/controller.go

@@ -0,0 +1,125 @@
+package caddyfile
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
+)
+
+const (
+	CaddyGroup = "uncloud"
+	VerifyPath = "/.uncloud-verify"
+)
+
+// Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
+// proxy. The generated Caddyfile allows Caddy to route external traffic to service containers across the internal
+// network.
+type Controller struct {
+	store          *store.Store
+	path           string
+	verifyResponse string
+}
+
+func NewController(store *store.Store, path string, verifyResponse string) (*Controller, error) {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0750); err != nil {
+		return nil, fmt.Errorf("create parent directory for Caddy configuration '%s': %w", dir, err)
+	}
+	if err := fs.Chown(dir, "", CaddyGroup); err != nil {
+		return nil, fmt.Errorf("change owner of parent directory for Caddy configuration '%s': %w", dir, err)
+	}
+
+	return &Controller{
+		store:          store,
+		path:           path,
+		verifyResponse: verifyResponse,
+	}, nil
+}
+
+func (c *Controller) Run(ctx context.Context) error {
+	containerRecords, changes, err := c.store.SubscribeContainers(ctx)
+	if err != nil {
+		return fmt.Errorf("subscribe to container changes: %w", err)
+	}
+	slog.Info("Subscribed to container changes in the cluster to generate Caddy configuration.")
+
+	containers, err := c.filterAvailableContainers(containerRecords)
+	if err != nil {
+		return fmt.Errorf("filter available containers: %w", err)
+	}
+	if err = c.generateConfig(containers); err != nil {
+		return fmt.Errorf("generate Caddy configuration: %w", err)
+	}
+
+	for {
+		select {
+		case _, ok := <-changes:
+			if !ok {
+				return fmt.Errorf("containers subscription failed")
+			}
+			slog.Debug("Cluster containers changed, updating Caddy configuration.")
+
+			containerRecords, err = c.store.ListContainers(ctx, store.ListOptions{})
+			if err != nil {
+				slog.Error("Failed to list containers.", "err", err)
+				continue
+			}
+			containers, err = c.filterAvailableContainers(containerRecords)
+			if err != nil {
+				slog.Error("Failed to filter available containers.", "err", err)
+				continue
+			}
+			if err = c.generateConfig(containers); err != nil {
+				slog.Error("Failed to generate Caddy configuration.", "err", err)
+			}
+
+			slog.Debug("Updated Caddy configuration.", "path", c.path)
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+// filterAvailableContainers filters out containers from this machine that are likely unavailable. The availability
+// is determined by the cluster membership state of the machine that the container is running on.
+// TODO: implement machine membership check using Corrossion Admin client.
+func (c *Controller) filterAvailableContainers(
+	containerRecords []store.ContainerRecord,
+) ([]api.ServiceContainer, error) {
+	containers := make([]api.ServiceContainer, len(containerRecords))
+	for i, cr := range containerRecords {
+		containers[i] = api.ServiceContainer{
+			Container: cr.Container,
+			// TODO: restore ServiceSpec from the container record once it's saved in the store.
+		}
+	}
+	return containers, nil
+}
+
+func (c *Controller) generateConfig(containers []api.ServiceContainer) error {
+	config, err := GenerateConfig(containers, c.verifyResponse)
+	if err != nil {
+		return err
+	}
+
+	configBytes, err := json.MarshalIndent(config, "", "    ")
+	if err != nil {
+		return fmt.Errorf("marshal Caddy configuration: %w", err)
+	}
+
+	if err = os.WriteFile(c.path, configBytes, 0640); err != nil {
+		return fmt.Errorf("write Caddy configuration to file '%s': %w", c.path, err)
+	}
+	if err = fs.Chown(c.path, "", CaddyGroup); err != nil {
+		return fmt.Errorf("change owner of Caddy configuration file '%s': %w", c.path, err)
+	}
+
+	return nil
+}

internal/machine/cluster/cluster.go

@@ -5,18 +5,17 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 	"log/slog"
 	"net/netip"
 	"time"
-
 	"github.com/psviderski/uncloud/internal/corrosion"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/internal/secret"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 type Cluster struct {
@@ -198,89 +197,6 @@ func (c *Cluster) AddMachine(ctx context.Context, req *pb.AddMachineRequest) (*p
 	return resp, nil
 }
 
-// UpdateMachine updates machine configuration in the cluster.
-func (c *Cluster) UpdateMachine(ctx context.Context, req *pb.UpdateMachineRequest) (*pb.UpdateMachineResponse, error) {
-	if err := c.checkInitialised(ctx); err != nil {
-		return nil, err
-	}
-
-	if req.MachineId == "" {
-		return nil, status.Error(codes.InvalidArgument, "machine_id not set")
-	}
-
-	// Get the current machine info
-	currentMachine, err := c.store.GetMachine(ctx, req.MachineId)
-	if err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.MachineId)
-		}
-		return nil, status.Errorf(codes.Internal, "failed to get machine: %v", err)
-	}
-
-	// Create a copy of the current machine for updating
-	updatedMachine := &pb.MachineInfo{
-		Id:       currentMachine.Id,
-		Name:     currentMachine.Name,
-		Network:  currentMachine.Network,
-		PublicIp: currentMachine.PublicIp,
-	}
-
-	// Apply updates from the request
-	if req.Name != nil {
-		// Check for empty name
-		if *req.Name == "" {
-			return nil, status.Error(codes.InvalidArgument, "machine name cannot be empty")
-		}
-		// Check for duplicate names (excluding the current machine)
-		if *req.Name != currentMachine.Name {
-			machines, err := c.store.ListMachines(ctx)
-			if err != nil {
-				return nil, status.Errorf(codes.Internal, "list machines: %v", err)
-			}
-			for _, m := range machines {
-				if m.Id != req.MachineId && m.Name == *req.Name {
-					return nil, status.Errorf(codes.AlreadyExists, "machine with name %q already exists", *req.Name)
-				}
-			}
-		}
-		updatedMachine.Name = *req.Name
-	}
-	if req.PublicIp != nil {
-		// Check if this is an empty IP (used to signal removal)
-		if len(req.PublicIp.Ip) == 0 {
-			// User wants to remove public IP
-			updatedMachine.PublicIp = nil
-		} else {
-			// Validate and set the new IP
-			ip, err := req.PublicIp.ToAddr()
-			if err != nil {
-				return nil, status.Errorf(codes.InvalidArgument, "invalid public IP: %v", err)
-			}
-			if !ip.IsValid() {
-				return nil, status.Error(codes.InvalidArgument, "invalid public IP")
-			}
-			updatedMachine.PublicIp = req.PublicIp
-		}
-	}
-	if req.Endpoints != nil {
-		updatedMachine.Network.Endpoints = req.Endpoints
-	}
-
-	// Update the machine in the store
-	if err = c.store.UpdateMachine(ctx, updatedMachine); err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.MachineId)
-		}
-		return nil, status.Errorf(codes.Internal, "update machine: %v", err)
-	}
-
-	slog.Info("Machine configuration updated in the cluster.",
-		"id", updatedMachine.Id, "name", updatedMachine.Name)
-
-	resp := &pb.UpdateMachineResponse{Machine: updatedMachine}
-	return resp, nil
-}
-
 // ListMachines lists all machines in the cluster including their membership states.
 func (c *Cluster) ListMachines(ctx context.Context, _ *emptypb.Empty) (*pb.ListMachinesResponse, error) {
 	if err := c.checkInitialised(ctx); err != nil {
@@ -326,24 +242,3 @@ func (c *Cluster) ListMachines(ctx context.Context, _ *emptypb.Empty) (*pb.ListM
 
 	return &pb.ListMachinesResponse{Machines: members}, nil
 }
-
-// RemoveMachine removes a machine from the cluster.
-func (c *Cluster) RemoveMachine(ctx context.Context, req *pb.RemoveMachineRequest) (*emptypb.Empty, error) {
-	if err := c.checkInitialised(ctx); err != nil {
-		return nil, err
-	}
-
-	if req.Id == "" {
-		return nil, status.Error(codes.InvalidArgument, "machine ID not set")
-	}
-
-	if err := c.store.DeleteMachine(ctx, req.Id); err != nil {
-		if errors.Is(err, store.ErrMachineNotFound) {
-			return nil, status.Errorf(codes.NotFound, "machine not found: %s", req.Id)
-		}
-		return nil, status.Errorf(codes.Internal, "delete machine from store: %v", err)
-	}
-	slog.Info("Machine removed from the cluster.", "id", req.Id)
-
-	return &emptypb.Empty{}, nil
-}

internal/machine/cluster/dns.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-
 	"github.com/psviderski/uncloud/internal/dns"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/store"

internal/machine/cluster/ipam.go

@@ -3,9 +3,8 @@ package cluster
 import (
 	"errors"
 	"fmt"
-	"net/netip"
-
 	"go4.org/netipx"
+	"net/netip"
 )
 
 const DefaultSubnetBits = 24

internal/machine/cluster/machine.go

@@ -2,7 +2,6 @@ package cluster
 
 import (
 	"fmt"
-
 	"github.com/psviderski/uncloud/internal/secret"
 )
 

internal/machine/constants/constants.go

@@ -1,6 +0,0 @@
-package constants
-
-const (
-	// MachineAPIPort is the port for the Machine API service on the management WireGuard network.
-	MachineAPIPort = 51000
-)

internal/machine/corroservice/config.go

@@ -3,11 +3,10 @@ package corroservice
 import (
 	"bytes"
 	"fmt"
+	"github.com/BurntSushi/toml"
 	"net/netip"
 	"os"
 	"path/filepath"
-
-	"github.com/BurntSushi/toml"
 	"github.com/psviderski/uncloud/internal/fs"
 )
 
@@ -51,7 +50,7 @@ func (c *Config) Write(path, owner string) error {
 	if err := encoder.Encode(c); err != nil {
 		return fmt.Errorf("encode config: %w", err)
 	}
-	if err := os.WriteFile(path, data.Bytes(), 0o600); err != nil {
+	if err := os.WriteFile(path, data.Bytes(), 0600); err != nil {
 		return err
 	}
 	if err := fs.Chown(path, owner, owner); err != nil {
@@ -63,10 +62,10 @@ func (c *Config) Write(path, owner string) error {
 func MkDataDir(dir, owner string) error {
 	parent, _ := filepath.Split(dir)
 	// Use 0711 for parent directories to allow `owner` to access its nested data directory.
-	if err := os.MkdirAll(parent, 0o711); err != nil {
+	if err := os.MkdirAll(parent, 0711); err != nil {
 		return fmt.Errorf("create directory %q: %w", parent, err)
 	}
-	if err := os.Mkdir(dir, 0o700); err != nil {
+	if err := os.Mkdir(dir, 0700); err != nil {
 		if !os.IsExist(err) {
 			return fmt.Errorf("create directory %q: %w", dir, err)
 		}

internal/machine/corroservice/docker.go

@@ -3,16 +3,15 @@ package corroservice
 import (
 	"context"
 	"fmt"
-	"io"
-	"log/slog"
-	"path/filepath"
-	"time"
-
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"time"
 )
 
 const (
@@ -27,47 +26,29 @@ type DockerService struct {
 	User    string
 }
 
+func NewDockerService(cli *client.Client, image, name, dataDir string) *DockerService {
+	return &DockerService{
+		Client:  cli,
+		Image:   image,
+		Name:    name,
+		DataDir: dataDir,
+	}
+}
+
 func (s *DockerService) Start(ctx context.Context) error {
 	_, err := s.Client.ContainerInspect(ctx, s.Name)
 	if err != nil {
-		if !client.IsErrNotFound(err) {
+		if client.IsErrNotFound(err) {
+			return s.startNewContainer(ctx)
+		}
 		return fmt.Errorf("inspect container %q: %w", s.Name, err)
 	}
-		if err = s.startNewContainer(ctx); err != nil {
-			return err
-		}
-	} else {
-		// Container already exists.
 	// TODO: recreate only if the container configuration has to be changed.
 	if err = s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{Force: true}); err != nil {
 		return fmt.Errorf("remove container %q: %w", s.Name, err)
 	}
-		if err = s.startNewContainer(ctx); err != nil {
-			return err
-		}
-	}
 
-	slog.Debug("Waiting for corrosion service to be ready.")
-	if err = WaitReady(ctx, s.DataDir); err != nil {
-		return err
-	}
-	slog.Debug("Corrosion service is ready.")
-
-	return nil
-}
-
-func (s *DockerService) Stop(ctx context.Context) error {
-	if err := s.Client.ContainerStop(ctx, s.Name, container.StopOptions{}); err != nil {
-		return fmt.Errorf("stop container %q: %w", s.Name, err)
-	}
-	slog.Debug("Corrosion Docker container stopped.", "name", s.Name)
-
-	if err := s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{}); err != nil {
-		return fmt.Errorf("remove container %q: %w", s.Name, err)
-	}
-	slog.Debug("Corrosion Docker container removed.", "name", s.Name)
-
-	return nil
+	return s.startNewContainer(ctx)
 }
 
 func (s *DockerService) Restart(ctx context.Context) error {

internal/machine/corroservice/service.go

@@ -1,62 +1,9 @@
 package corroservice
 
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/BurntSushi/toml"
-	"github.com/cenkalti/backoff/v4"
-	"github.com/psviderski/uncloud/internal/corrosion"
-)
+import "context"
 
 type Service interface {
 	Start(ctx context.Context) error
-	Stop(ctx context.Context) error
 	Restart(ctx context.Context) error
 	Running() bool
 }
-
-// WaitReady waits for the Corrosion service to be ready with the uncloud schema applied.
-func WaitReady(ctx context.Context, dataDir string) error {
-	// Read the config file to get the API address.
-	configPath := filepath.Join(dataDir, "config.toml")
-	configData, err := os.ReadFile(configPath)
-	if err != nil {
-		return fmt.Errorf("read config file: %w", err)
-	}
-
-	var config Config
-	if err = toml.Unmarshal(configData, &config); err != nil {
-		return fmt.Errorf("unmarshal config: %w", err)
-	}
-
-	corro, err := corrosion.NewAPIClient(config.API.Addr)
-	if err != nil {
-		return fmt.Errorf("create corrosion API client: %w", err)
-	}
-
-	// Corrosion starts serving the API before applying the schema. Query the cluster table with exponential backoff
-	// to check if the uncloud schema has been applied.
-	checkReady := func() error {
-		rows, err := corro.QueryContext(ctx, "SELECT 1 FROM cluster LIMIT 1")
-		if err != nil {
-			return fmt.Errorf("query cluster table: %w", err)
-		}
-		defer rows.Close()
-
-		return nil
-	}
-
-	b := backoff.NewExponentialBackOff(
-		backoff.WithInitialInterval(50*time.Millisecond),
-		backoff.WithMaxInterval(1*time.Second),
-		backoff.WithMaxElapsedTime(15*time.Second),
-	)
-	if err = backoff.Retry(checkReady, backoff.WithContext(b, ctx)); err != nil {
-		return fmt.Errorf("corrosion service did not become ready: %w", err)
-	}
-	return nil
-}

internal/machine/corroservice/subprocess.go

@@ -0,0 +1,157 @@
+package corroservice
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"log/slog"
+	"os/exec"
+	"path/filepath"
+	"sync"
+	"syscall"
+	"time"
+)
+
+const (
+	DefaultCommand = "corrosion"
+	DefaultDataDir = "/var/lib/uncloud/corrosion"
+)
+
+// SubprocessService implements the Service interface by running the service as a subprocess.
+type SubprocessService struct {
+	Command string
+	DataDir string
+
+	cmd         *exec.Cmd
+	running     bool
+	mu          sync.Mutex
+	cancelWatch context.CancelFunc
+}
+
+func DefaultSubprocessService() *SubprocessService {
+	return &SubprocessService{
+		Command: DefaultCommand,
+		DataDir: DefaultDataDir,
+	}
+}
+
+// TODO: maybe stop the process if this ctx is cancelled.
+func (s *SubprocessService) Start(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.running {
+		return nil
+	}
+	return s.startProcess(ctx)
+}
+
+func (s *SubprocessService) Restart(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.running {
+		if err := s.stopProcess(); err != nil {
+			return fmt.Errorf("stop process: %w", err)
+		}
+	}
+	return s.startProcess(ctx)
+}
+
+func (s *SubprocessService) Running() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.running
+}
+
+func (s *SubprocessService) startProcess(ctx context.Context) error {
+	s.cmd = exec.Command(s.Command, "agent", "-c", filepath.Join(s.DataDir, "config.toml"))
+
+	// Redirect stdout and stderr to the logger.
+	stdout, err := s.cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("create stdout pipe: %w", err)
+	}
+	stderr, err := s.cmd.StderrPipe()
+	if err != nil {
+		return fmt.Errorf("create stderr pipe: %w", err)
+	}
+
+	go func() {
+		scanner := bufio.NewScanner(stdout)
+		for scanner.Scan() {
+			slog.Info("[corrosion]: " + scanner.Text())
+		}
+		// TODO: remove
+		slog.Info("######## corrosion redirect go routine end ########")
+	}()
+
+	go func() {
+		scanner := bufio.NewScanner(stderr)
+		for scanner.Scan() {
+			slog.Error("[corrosion]: " + scanner.Text())
+		}
+	}()
+
+	if err = s.cmd.Start(); err != nil {
+		return fmt.Errorf("start process: %w", err)
+	}
+	s.running = true
+
+	// Watch for process exit to update running status.
+	go func() {
+		if err := s.cmd.Wait(); err != nil {
+			slog.Error("corrosion process exited with error.", "code", s.cmd.ProcessState.ExitCode(), "err", err)
+		}
+
+		s.mu.Lock()
+		s.running = false
+		s.mu.Unlock()
+	}()
+
+	// TODO: figure out the waiting process
+	// Wait for initialization
+	//timer := time.NewTimer(2 * time.Second)
+	//defer timer.Stop()
+
+	//select {
+	////case <-timer.C:
+	////	s.running = true
+	////	return nil
+	//case <-watchCtx.Done():
+	//	return fmt.Errorf("process failed to start")
+	//case <-ctx.Done():
+	//	s.stopProcess()
+	//	return ctx.Err()
+	//}
+	return nil
+}
+
+func (s *SubprocessService) stopProcess() error {
+	if s.cmd == nil || s.cmd.Process == nil {
+		return nil
+	}
+
+	if err := s.cmd.Process.Signal(syscall.SIGTERM); err != nil {
+		return fmt.Errorf("send SIGTERM: %w", err)
+	}
+
+	// Wait up to 5 seconds for graceful shutdown before killing the process.
+	done := make(chan error, 1)
+	go func() {
+		done <- s.cmd.Wait()
+	}()
+
+	select {
+	case <-time.After(5 * time.Second):
+		if err := s.cmd.Process.Kill(); err != nil {
+			return fmt.Errorf("kill process: %w", err)
+		}
+	case err := <-done:
+		if err != nil {
+			return fmt.Errorf("process exited with error: %w", err)
+		}
+	}
+
+	return nil
+}

internal/machine/corroservice/systemd.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"os/exec"
+	"time"
 )
 
 const DefaultSystemdUnit = "uncloud-corrosion.service"
@@ -26,15 +27,6 @@ func (s *SystemdService) Start(ctx context.Context) error {
 	return s.startOrRestart(ctx, "start")
 }
 
-func (s *SystemdService) Stop(_ context.Context) error {
-	if _, err := exec.Command("systemctl", "stop", s.Unit).Output(); err != nil {
-		return fmt.Errorf("systemctl stop %s: %w", s.Unit, err)
-	}
-	slog.Info("Corrosion systemd service stopped.", "unit", s.Unit)
-
-	return nil
-}
-
 func (s *SystemdService) Restart(ctx context.Context) error {
 	return s.startOrRestart(ctx, "restart")
 }
@@ -43,15 +35,20 @@ func (s *SystemdService) startOrRestart(ctx context.Context, cmd string) error {
 	if _, err := exec.Command("systemctl", cmd, s.Unit).Output(); err != nil {
 		return fmt.Errorf("systemctl %s %s: %w", cmd, s.Unit, err)
 	}
-	slog.Debug(fmt.Sprintf("Corrosion systemd service %sed.", cmd), "unit", s.Unit)
+	slog.Info(fmt.Sprintf("Corrosion systemd service %sed.", cmd), "unit", s.Unit)
 
-	slog.Debug("Waiting for corrosion service to be ready.")
-	if err := WaitReady(ctx, s.DataDir); err != nil {
-		return err
+	// Optimistically wait for the corrosion service to start and initialise the database schema before proceeding.
+	timer := time.NewTimer(2 * time.Second)
+	defer timer.Stop()
+
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		return nil
 	}
-	slog.Debug("Corrosion service is ready.")
-	s.running = true
 
+	// TODO: run a goroutine to check the status of the service and log any errors in the uncloud log.
+	s.running = true
 	return nil
 }
 

internal/machine/db.go

@@ -14,13 +14,13 @@ const DBFileName = "machine.db"
 func NewDB(path string) (*sqlx.DB, error) {
 	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
 	if _, err := os.Stat(path); os.IsNotExist(err) {
-		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
 		if err != nil {
 			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
 		}
 		file.Close()
 	} else {
-		if err = os.Chmod(path, 0o600); err != nil {
+		if err = os.Chmod(path, 0600); err != nil {
 			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
 		}
 	}

internal/machine/dns/resolver.go

@@ -5,10 +5,12 @@ import (
 	"fmt"
 	"log/slog"
 	"net/netip"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 // ClusterResolver implements Resolver by tracking containers in the cluster and resolving service names
@@ -82,13 +84,17 @@ func (r *ClusterResolver) updateServiceIPs(containers []store.ContainerRecord) {
 			continue
 		}
 
-		ctr := record.Container
+		ctr := api.ServiceContainer{Container: record.Container}
 		if ctr.ServiceID() == "" || ctr.ServiceName() == "" {
 			// Container is not part of a service, skip it.
 			continue
 		}
 
-		newServiceIPs[ctr.ServiceName()] = append(newServiceIPs[ctr.ServiceName()], ip)
+		// TODO: remove normalisation after implementing service name validation:
+		//.https://github.com/psviderski/uncloud/issues/53
+		serviceName := strings.ToLower(ctr.ServiceName())
+
+		newServiceIPs[serviceName] = append(newServiceIPs[serviceName], ip)
 		// Also add the service ID as a valid lookup.
 		newServiceIPs[ctr.ServiceID()] = append(newServiceIPs[ctr.ServiceID()], ip)
 		containersCount++

internal/machine/docker/client.go

@@ -196,27 +196,13 @@ func (c *Client) RemoveContainer(ctx context.Context, id string, opts container.
 	return err
 }
 
-// PullOptions defines the options for pulling an image from a remote registry.
-// This is a copy of image.PullOptions from the Docker API without the PrivilegeFunc field that is non-serialisable.
-type PullOptions struct {
-	All bool
-	// RegistryAuth is the base64 encoded credentials for the registry.
-	RegistryAuth string
-	Platform     string
-}
-
 type PullImageMessage struct {
 	Message jsonmessage.JSONMessage
 	Err     error
 }
 
-func (c *Client) PullImage(ctx context.Context, image string, opts PullOptions) (<-chan PullImageMessage, error) {
-	optsBytes, err := json.Marshal(opts)
-	if err != nil {
-		return nil, fmt.Errorf("marshal options: %w", err)
-	}
-
-	stream, err := c.grpcClient.PullImage(ctx, &pb.PullImageRequest{Image: image, Options: optsBytes})
+func (c *Client) PullImage(ctx context.Context, image string) (<-chan PullImageMessage, error) {
+	stream, err := c.grpcClient.PullImage(ctx, &pb.PullImageRequest{Image: image})
 	if err != nil {
 		return nil, err
 	}

internal/machine/docker/controller_darwin.go

@@ -1,19 +0,0 @@
-//go:build darwin
-
-package docker
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-)
-
-// EnsureUncloudNetwork is a stub for Darwin.
-func (c *Controller) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
-	return fmt.Errorf("not supported on Darwin")
-}
-
-// Cleanup is a stub for Darwin.
-func (c *Controller) Cleanup() error {
-	return fmt.Errorf("not supported on Darwin")
-}

internal/machine/docker/controller_linux.go

@@ -1,234 +0,0 @@
-package docker
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net/netip"
-	"strconv"
-
-	dockercontainer "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	dnetwork "github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/client"
-	"github.com/docker/docker/libnetwork/iptables"
-	"github.com/psviderski/uncloud/internal/machine/dns"
-	"github.com/psviderski/uncloud/internal/machine/firewall"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-// EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
-// if it doesn't exist. If the network exists but has a different subnet, it removes and recreates the network.
-// It also configures iptables to allow container access from the WireGuard network.
-func (c *Controller) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
-	// Ensure the Docker network 'uncloud' is created with the correct subnet.
-	needsCreation := false
-	nw, err := c.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
-	if err != nil {
-		if !client.IsErrNotFound(err) {
-			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
-		}
-		needsCreation = true
-	} else if nw.IPAM.Config[0].Subnet != subnet.String() {
-		// Remove the Docker network if the subnet is different.
-		// It could be a leftover from a previous incomplete cleanup.
-		slog.Info(
-			"Removing Docker network with old subnet.", "name", NetworkName, "subnet", nw.IPAM.Config[0].Subnet,
-		)
-		if err = c.client.NetworkRemove(ctx, NetworkName); err != nil {
-			// It can still fail if the network is in use by a container. Leave it to the user to resolve the issue.
-			return fmt.Errorf("remove Docker network '%s': %w", NetworkName, err)
-		}
-		needsCreation = true
-	}
-
-	if needsCreation {
-		if _, err = c.client.NetworkCreate(
-			ctx, NetworkName, dnetwork.CreateOptions{
-				Driver: "bridge",
-				Scope:  "local",
-				IPAM: &dnetwork.IPAM{
-					Config: []dnetwork.IPAMConfig{
-						{
-							Subnet: subnet.String(),
-						},
-					},
-				},
-				Labels: map[string]string{
-					api.LabelManaged: "",
-				},
-				Options: map[string]string{
-					// Starting with Docker 28.2.0 (https://github.com/moby/moby/pull/49832), we have to explicitly
-					// allow direct routing from the WireGuard interface to the bridge network.
-					"com.docker.network.bridge.trusted_host_interfaces": network.WireGuardInterfaceName,
-				},
-			},
-		); err != nil {
-			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)
-		}
-		slog.Info("Docker network created.", "name", NetworkName, "subnet", subnet.String())
-
-		if nw, err = c.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{}); err != nil {
-			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
-		}
-	}
-
-	// Configure iptables to allow WireGuard network to access containers. The Docker daemon should have already
-	// created the DOCKER-USER chain at this point.
-	// TODO: check if this works when firewalld used instead of raw iptables. The Docker daemon has a different
-	//  code path for firewalld.
-
-	// Bridge name doesn't seem to be documented but this is the source code where it is generated:
-	// https://github.com/moby/moby/blob/v27.2.1/libnetwork/drivers/bridge/bridge_linux.go#L664
-	bridgeName := "br-" + nw.ID[:12]
-
-	if err = configureIptables(bridgeName, subnet, dnsServer); err != nil {
-		return fmt.Errorf("configure iptables for Docker network '%s': %w", NetworkName, err)
-	}
-
-	return nil
-}
-
-// configureIptables configures iptables rules for the uncloud Docker network.
-func configureIptables(bridgeName string, subnet netip.Prefix, dnsServer netip.Addr) error {
-	ipt := iptables.GetIptable(iptables.IPv4)
-	// Allow traffic from other machines and their containers through the WG mesh to the Uncloud containers
-	// on the machine.
-	wgRule := []string{
-		"--in-interface", network.WireGuardInterfaceName,
-		"--out-interface", bridgeName,
-		"-j", "ACCEPT",
-	}
-	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Insert, wgRule); err != nil {
-		return fmt.Errorf("insert iptables rule: %w", err)
-	}
-
-	// Allow DNS queries from Uncloud containers to the embedded DNS server.
-	for _, proto := range []string{"udp", "tcp"} {
-		dnsRule := []string{
-			"--in-interface", bridgeName,
-			"--dst", dnsServer.String(),
-			"--protocol", proto,
-			"--dport", strconv.Itoa(dns.Port),
-			"-j", "ACCEPT",
-		}
-		if err := ipt.ProgramRule(iptables.Filter, firewall.UncloudInputChain, iptables.Insert, dnsRule); err != nil {
-			return fmt.Errorf("insert iptables rule: %w", err)
-		}
-	}
-
-	// Skip masquerading for the container traffic going from the uncloud Docker network through the WG mesh.
-	// https://uncloud.run/blog/connect-docker-containers-across-hosts-wireguard#step-3-configure-ip-routing
-	skipMasqueradeRule := []string{
-		"--src", subnet.String(),
-		"--out-interface", network.WireGuardInterfaceName,
-		"-j", "RETURN",
-	}
-	// Delete and reinsert the rule to ensure it's at the top of the POSTROUTING chain before the MASQUERADE rule
-	// added by Docker: POSTROUTING -s 10.210.X.0/24 ! -o br-XXX -j MASQUERADE
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Delete, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Insert, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("insert iptables rule: %w", err)
-	}
-
-	return nil
-}
-
-// cleanupIptables deletes the iptables rules for the uncloud Docker network.
-func cleanupIptables(bridgeName string, subnet netip.Prefix) error {
-	ipt := iptables.GetIptable(iptables.IPv4)
-	// Delete the rule allowing traffic from the WireGuard network to the Docker bridge.
-	wgRule := []string{
-		"--in-interface", network.WireGuardInterfaceName,
-		"--out-interface", bridgeName,
-		"-j", "ACCEPT",
-	}
-	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Delete, wgRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-
-	// Delete the rule that skips masquerading for the container traffic going from the uncloud Docker network
-	// through the WG mesh.
-	skipMasqueradeRule := []string{
-		"--src", subnet.String(),
-		"--out-interface", network.WireGuardInterfaceName,
-		"-j", "RETURN",
-	}
-	if err := ipt.ProgramRule(iptables.Nat, "POSTROUTING", iptables.Delete, skipMasqueradeRule); err != nil {
-		return fmt.Errorf("delete iptables rule: %w", err)
-	}
-
-	// Rules in uncloud-owned chains will be automatically cleaned up by the machine cleanup.
-
-	return nil
-}
-
-// Cleanup removes all uncloud-managed containers and the uncloud Docker network.
-func (c *Controller) Cleanup() error {
-	ctx := context.Background()
-	var errs []error
-
-	// Remove uncloud-managed Docker containers.
-	containers, err := c.client.ContainerList(ctx, dockercontainer.ListOptions{
-		All: true, // Include stopped containers.
-		Filters: filters.NewArgs(
-			filters.Arg("label", api.LabelManaged),
-		),
-	})
-	if err != nil {
-		errs = append(errs, fmt.Errorf("list uncloud-managed Docker containers: %w", err))
-	} else if len(containers) > 0 {
-		slog.Info("Removing uncloud-managed Docker containers.", "count", len(containers))
-		removed := 0
-
-		for _, ctr := range containers {
-			err = c.client.ContainerStop(ctx, ctr.ID, dockercontainer.StopOptions{})
-			if err != nil && !client.IsErrNotFound(err) {
-				errs = append(errs, fmt.Errorf("stop container '%s': %w", ctr.ID, err))
-			}
-
-			err = c.client.ContainerRemove(ctx, ctr.ID, dockercontainer.RemoveOptions{
-				// Remove anonymous volumes created by the container.
-				RemoveVolumes: true,
-			})
-			if err == nil {
-				removed++
-			} else if !client.IsErrNotFound(err) {
-				errs = append(errs, fmt.Errorf("remove container '%s': %w", ctr.ID, err))
-			}
-		}
-		slog.Info("Removed uncloud-managed Docker containers.", "count", removed)
-	}
-
-	// Remove the uncloud Docker network and related iptables rules.
-	nw, err := c.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
-	if err == nil {
-		bridgeName := "br-" + nw.ID[:12]
-		var subnet netip.Prefix
-		if len(nw.IPAM.Config) > 0 {
-			subnet, _ = netip.ParsePrefix(nw.IPAM.Config[0].Subnet)
-		}
-
-		if subnet.IsValid() {
-			if err = cleanupIptables(bridgeName, subnet); err != nil {
-				errs = append(errs, fmt.Errorf("cleanup iptables for Docker network '%s': %w", NetworkName, err))
-			} else {
-				slog.Info("Cleaned up iptables rules for Docker network.", "name", NetworkName, "bridge", bridgeName)
-			}
-		}
-
-		if err = c.client.NetworkRemove(ctx, NetworkName); err == nil {
-			slog.Info("Docker network removed.", "name", NetworkName)
-		} else if !client.IsErrNotFound(err) {
-			errs = append(errs, fmt.Errorf("remove Docker network '%s': %w", NetworkName, err))
-		}
-	} else if !client.IsErrNotFound(err) {
-		errs = append(errs, fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err))
-	}
-
-	return errors.Join(errs...)
-}

internal/machine/docker/manager.go

@@ -7,11 +7,12 @@ import (
 	"log/slog"
 	"time"
 
-	"github.com/docker/docker/api/types/container"
+	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 const (
@@ -23,26 +24,23 @@ const (
 	SyncInterval = 30 * time.Second
 )
 
-// Controller monitors Docker events and synchronises service containers with the cluster store.
-type Controller struct {
+type Manager struct {
+	client *client.Client
 	// machineID is the ID of the machine where the managed Docker daemon is running.
 	machineID string
-	client    *client.Client
-	service   *Service
 	store     *store.Store
 }
 
-func NewController(machineID string, service *Service, store *store.Store) *Controller {
-	return &Controller{
+func NewManager(client *client.Client, machineID string, store *store.Store) *Manager {
+	return &Manager{
+		client:    client,
 		machineID: machineID,
-		client:    service.Client,
-		service:   service,
 		store:     store,
 	}
 }
 
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.
-func (c *Controller) WaitDaemonReady(ctx context.Context) error {
+func (m *Manager) WaitDaemonReady(ctx context.Context) error {
 	ticker := time.NewTicker(1 * time.Second)
 	defer ticker.Stop()
 
@@ -52,7 +50,7 @@ func (c *Controller) WaitDaemonReady(ctx context.Context) error {
 		case <-ctx.Done():
 			return ctx.Err()
 		case <-ticker.C:
-			_, err := c.client.Ping(ctx)
+			_, err := m.client.Ping(ctx)
 			if err == nil {
 				ready = true
 				break
@@ -69,7 +67,7 @@ func (c *Controller) WaitDaemonReady(ctx context.Context) error {
 	return nil
 }
 
-func (c *Controller) WatchAndSyncContainers(ctx context.Context) error {
+func (m *Manager) WatchAndSyncContainers(ctx context.Context) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	// Filter only local container events.
@@ -81,9 +79,9 @@ func (c *Controller) WatchAndSyncContainers(ctx context.Context) error {
 	}
 
 	// Subscribe to Docker events before running the initial sync to avoid missing any events.
-	eventCh, errCh := c.service.Client.Events(ctx, opts)
+	eventCh, errCh := m.client.Events(ctx, opts)
 	slog.Debug("Syncing containers to cluster store before processing Docker events.")
-	if err := c.syncContainersToStore(ctx); err != nil {
+	if err := m.syncContainersToStore(ctx); err != nil {
 		// The deferred cancel will stop the event subscription.
 		return fmt.Errorf("sync containers to cluster store: %w", err)
 	}
@@ -128,13 +126,13 @@ func (c *Controller) WatchAndSyncContainers(ctx context.Context) error {
 				"container_name", e.Actor.Attributes["name"],
 				"action", e.Action)
 
-			if err := c.syncContainersToStore(ctx); err != nil {
+			if err := m.syncContainersToStore(ctx); err != nil {
 				return fmt.Errorf("sync containers to cluster store: %w", err)
 			}
 		case <-ticker.C:
 			slog.Debug("Syncing containers to cluster store triggered by a regular interval.",
 				"interval", SyncInterval)
-			if err := c.syncContainersToStore(ctx); err != nil {
+			if err := m.syncContainersToStore(ctx); err != nil {
 				return fmt.Errorf("sync containers to cluster store: %w", err)
 			}
 		case err := <-errCh:
@@ -146,16 +144,32 @@ func (c *Controller) WatchAndSyncContainers(ctx context.Context) error {
 	}
 }
 
-func (c *Controller) syncContainersToStore(ctx context.Context) error {
-	storeContainers, err := c.store.ListContainers(ctx, store.ListOptions{MachineIDs: []string{c.machineID}})
+func (m *Manager) syncContainersToStore(ctx context.Context) error {
+	storeContainers, err := m.store.ListContainers(ctx, store.ListOptions{MachineIDs: []string{m.machineID}})
 	if err != nil {
 		return fmt.Errorf("list containers from store: %w", err)
 	}
 
-	containers, err := c.service.ListServiceContainers(ctx, "", container.ListOptions{})
+	// List only Uncloud service containers identified by their labels.
+	containerSummaries, err := m.client.ContainerList(ctx, dockercontainer.ListOptions{
+		Filters: filters.NewArgs(
+			filters.Arg("label", api.LabelServiceID),
+			filters.Arg("label", api.LabelServiceName),
+		),
+	})
 	if err != nil {
 		// TODO: mark all containers as outdated in the store.
-		return fmt.Errorf("list service containers: %w", err)
+		return fmt.Errorf("list Docker containers: %w", err)
+	}
+
+	// Inspect each container to get the full container details.
+	containers := make([]api.Container, len(containerSummaries))
+	for i, cs := range containerSummaries {
+		ctr, err := m.client.ContainerInspect(ctx, cs.ID)
+		if err != nil {
+			return fmt.Errorf("inspect container '%s': %w", cs.ID, err)
+		}
+		containers[i] = api.Container{ContainerJSON: ctr}
 	}
 
 	// Delete containers from the store that are no longer present in the Docker daemon.
@@ -175,15 +189,15 @@ func (c *Controller) syncContainersToStore(ctx context.Context) error {
 
 	var storeErr error
 	if len(deleteIDs) > 0 {
-		if err = c.store.DeleteContainers(ctx, store.DeleteOptions{IDs: deleteIDs}); err != nil {
+		if err = m.store.DeleteContainers(ctx, store.DeleteOptions{IDs: deleteIDs}); err != nil {
 			storeErr = fmt.Errorf("delete containers from store: %w", err)
 		}
 	}
 
 	// Create or update the current Docker containers in the store.
-	for _, ctr := range containers {
-		if err = c.store.CreateOrUpdateContainer(ctx, ctr, c.machineID); err != nil {
-			storeErr = errors.Join(storeErr, fmt.Errorf("create or update container '%s': %w", ctr.ID, err))
+	for _, c := range containers {
+		if err = m.store.CreateOrUpdateContainer(ctx, c, m.machineID); err != nil {
+			storeErr = errors.Join(storeErr, fmt.Errorf("create or update container %q: %w", c.ID, err))
 		}
 	}
 	return storeErr

internal/machine/docker/manager_darwin.go

@@ -0,0 +1,14 @@
+//go:build darwin
+
+package docker
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+)
+
+// EnsureUncloudNetwork is a stub for Darwin.
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
+	return fmt.Errorf("not supported on Darwin")
+}

internal/machine/docker/manager_linux.go

@@ -0,0 +1,107 @@
+package docker
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/netip"
+	"strconv"
+
+	dnetwork "github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/libnetwork/iptables"
+	"github.com/psviderski/uncloud/internal/machine/dns"
+	"github.com/psviderski/uncloud/internal/machine/firewall"
+	"github.com/psviderski/uncloud/internal/machine/network"
+)
+
+// EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
+// if it doesn't exist. If the network exists but has a different subnet, it removes and recreates the network.
+// It also configures iptables to allow container access from the WireGuard network.
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
+	// Ensure the Docker network 'uncloud' is created with the correct subnet.
+	needsCreation := false
+	nw, err := m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
+	if err != nil {
+		if !client.IsErrNotFound(err) {
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
+		}
+		needsCreation = true
+	} else if nw.IPAM.Config[0].Subnet != subnet.String() {
+		// Remove the Docker network if the subnet is different.
+		// It could be a leftover from a previous incomplete cleanup.
+		slog.Info(
+			"Removing Docker network with old subnet.", "name", NetworkName, "subnet", nw.IPAM.Config[0].Subnet,
+		)
+		if err = m.client.NetworkRemove(ctx, NetworkName); err != nil {
+			// It can still fail if the network is in use by a container. Leave it to the user to resolve the issue.
+			return fmt.Errorf("remove Docker network '%s': %w", NetworkName, err)
+		}
+		needsCreation = true
+	}
+
+	if needsCreation {
+		if _, err = m.client.NetworkCreate(
+			ctx, NetworkName, dnetwork.CreateOptions{
+				Driver: "bridge",
+				Scope:  "local",
+				IPAM: &dnetwork.IPAM{
+					Config: []dnetwork.IPAMConfig{
+						{
+							Subnet: subnet.String(),
+						},
+					},
+				},
+			},
+		); err != nil {
+			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)
+		}
+		slog.Info("Docker network created.", "name", NetworkName, "subnet", subnet.String())
+
+		if nw, err = m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{}); err != nil {
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
+		}
+	}
+
+	// Configure iptables to allow WireGuard network to access containers. The Docker daemon should have already
+	// created the DOCKER-USER chain at this point.
+	// TODO: check if this works when firewalld used instead of raw iptables. The Docker daemon has a different
+	//  code path for firewalld.
+
+	// Bridge name doesn't seem to be documented but this is the source code where it is generated:
+	// https://github.com/moby/moby/blob/v27.2.1/libnetwork/drivers/bridge/bridge_linux.go#L664
+	bridgeName := "br-" + nw.ID[:12]
+
+	if err = configureIptables(bridgeName, dnsServer); err != nil {
+		return fmt.Errorf("configure iptables for Docker network '%s': %w", NetworkName, err)
+	}
+
+	return nil
+}
+
+// configureIptables configures iptables rules for the uncloud Docker network.
+func configureIptables(bridgeName string, dnsServer netip.Addr) error {
+	ipt := iptables.GetIptable(iptables.IPv4)
+	// Allow traffic from other machines and their containers through the WG mesh to the Uncloud containers
+	// on the machine.
+	wgRule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
+	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Insert, wgRule); err != nil {
+		return fmt.Errorf("insert iptables rule: %w", err)
+	}
+
+	// Allow DNS queries from Uncloud containers to the embedded DNS server.
+	for _, proto := range []string{"udp", "tcp"} {
+		dnsRule := []string{
+			"--in-interface", bridgeName,
+			"--dst", dnsServer.String(),
+			"--protocol", proto,
+			"--dport", strconv.Itoa(dns.Port),
+			"-j", "ACCEPT",
+		}
+		if err := ipt.ProgramRule(iptables.Filter, firewall.UncloudInputChain, iptables.Insert, dnsRule); err != nil {
+			return fmt.Errorf("insert iptables rule: %w", err)
+		}
+	}
+
+	return nil
+}

internal/machine/docker/server.go

@@ -2,21 +2,19 @@ package docker
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/netip"
-	"os"
 	"regexp"
 	"slices"
 	"strconv"
 	"strings"
 
 	"github.com/distribution/reference"
-	dockercommand "github.com/docker/cli/cli/command"
-	dockerconfig "github.com/docker/cli/cli/config"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
@@ -48,48 +46,19 @@ var fullDockerIDRegex = regexp.MustCompile(`^[a-f0-9]{64}$`)
 type Server struct {
 	pb.UnimplementedDockerServer
 	client *client.Client
-	service *Service
 	db     *sqlx.DB
 	// internalDNSIP is a function that returns the IP address of the internal DNS server. It may return an empty
 	// address if the address is unknown (e.g. when the machine is not initialised yet).
 	internalDNSIP func() netip.Addr
-	// networkReady is a function that returns true if the Docker network is ready for containers.
-	networkReady func() bool
-	// waitForNetworkReady is a function that waits for the Docker network to be ready for containers.
-	waitForNetworkReady func(ctx context.Context) error
 }
 
-// ServerOption configures the Docker server.
-type ServerOption func(*Server)
-
-// WithNetworkReady sets the network readiness check function.
-func WithNetworkReady(networkReady func() bool) ServerOption {
-	return func(s *Server) {
-		s.networkReady = networkReady
-	}
-}
-
-// WithWaitForNetworkReady sets the network readiness wait function.
-func WithWaitForNetworkReady(waitForNetworkReady func(ctx context.Context) error) ServerOption {
-	return func(s *Server) {
-		s.waitForNetworkReady = waitForNetworkReady
-	}
-}
-
-// NewServer creates a new Docker gRPC server with the provided Docker service.
-func NewServer(service *Service, db *sqlx.DB, internalDNSIP func() netip.Addr, opts ...ServerOption) *Server {
-	s := &Server{
-		client:        service.Client,
-		service:       service,
+// NewServer creates a new Docker gRPC server with the provided Docker client.
+func NewServer(cli *client.Client, db *sqlx.DB, internalDNSIP func() netip.Addr) *Server {
+	return &Server{
+		client:        cli,
 		db:            db,
 		internalDNSIP: internalDNSIP,
 	}
-
-	for _, opt := range opts {
-		opt(s)
-	}
-
-	return s
 }
 
 // CreateContainer creates a new container based on the given configuration.
@@ -149,15 +118,6 @@ func (s *Server) InspectContainer(ctx context.Context, req *pb.InspectContainerR
 
 // StartContainer starts a container with the given ID and options.
 func (s *Server) StartContainer(ctx context.Context, req *pb.StartContainerRequest) (*emptypb.Empty, error) {
-	// Wait for Docker network to be ready before starting the container
-	if s.waitForNetworkReady != nil {
-		if err := s.waitForNetworkReady(ctx); err != nil {
-			return nil, status.Errorf(codes.Unavailable, "Docker network not ready: %v", err)
-		}
-	} else if s.networkReady != nil && !s.networkReady() {
-		return nil, status.Errorf(codes.Unavailable, "Docker network not ready")
-	}
-
 	var opts container.StartOptions
 	if len(req.Options) > 0 {
 		if err := json.Unmarshal(req.Options, &opts); err != nil {
@@ -269,6 +229,7 @@ func (s *Server) RemoveContainer(ctx context.Context, req *pb.RemoveContainerReq
 func (s *Server) PullImage(req *pb.PullImageRequest, stream grpc.ServerStreamingServer[pb.JSONMessage]) error {
 	ctx := stream.Context()
 
+	// TODO: replace with another JSON serializable type (PullOptions.PrivilegeFunc is not serializable).
 	var opts image.PullOptions
 	if len(req.Options) > 0 {
 		if err := json.Unmarshal(req.Options, &opts); err != nil {
@@ -276,14 +237,6 @@ func (s *Server) PullImage(req *pb.PullImageRequest, stream grpc.ServerStreaming
 		}
 	}
 
-	if opts.RegistryAuth == "" {
-		// Try to retrieve the authentication token for the image from the default local Docker config file.
-		dockerConfig := dockerconfig.LoadDefaultConfigFile(os.Stderr)
-		if encodedAuth, err := dockercommand.RetrieveAuthTokenFromImage(dockerConfig, req.Image); err == nil {
-			opts.RegistryAuth = encodedAuth
-		}
-	}
-
 	respBody, err := s.client.ImagePull(ctx, req.Image, opts)
 	if err != nil {
 		return status.Errorf(codes.Internal, err.Error())
@@ -392,12 +345,6 @@ func (s *Server) CreateVolume(ctx context.Context, req *pb.CreateVolumeRequest)
 		return nil, status.Errorf(codes.InvalidArgument, "unmarshal options: %v", err)
 	}
 
-	// Always add the managed label to the volume to indicate that it is managed by Uncloud.
-	if opts.Labels == nil {
-		opts.Labels = make(map[string]string)
-	}
-	opts.Labels[api.LabelManaged] = ""
-
 	vol, err := s.client.VolumeCreate(ctx, opts)
 	if err != nil {
 		return nil, status.Error(codes.Internal, err.Error())
@@ -466,7 +413,6 @@ func (s *Server) RemoveVolume(ctx context.Context, req *pb.RemoveVolumeRequest)
 }
 
 // CreateServiceContainer creates a new container for the service with the given specifications.
-// TODO: move the main logic to the Docker service and remove db dependency from the server.
 func (s *Server) CreateServiceContainer(
 	ctx context.Context, req *pb.CreateServiceContainerRequest,
 ) (*pb.CreateContainerResponse, error) {
@@ -558,10 +504,10 @@ func (s *Server) CreateServiceContainer(
 			Memory:            spec.Container.Resources.Memory,
 			MemoryReservation: spec.Container.Resources.MemoryReservation,
 		},
-		// Restart service containers if they exit or a machine restarts unless they are explicitly stopped.
+		// Always restart service containers if they exit or a machine restarts.
 		// For one-off containers and batch jobs we plan to use a different service type/mode.
 		RestartPolicy: container.RestartPolicy{
-			Name: container.RestartPolicyUnlessStopped,
+			Name: container.RestartPolicyAlways,
 		},
 	}
 
@@ -721,7 +667,7 @@ func (s *Server) verifyDockerVolumesExist(ctx context.Context, mounts []mount.Mo
 func (s *Server) InspectServiceContainer(
 	ctx context.Context, req *pb.InspectContainerRequest,
 ) (*pb.ServiceContainer, error) {
-	serviceCtr, err := s.service.InspectServiceContainer(ctx, req.Id)
+	ctr, err := s.client.ContainerInspect(ctx, req.Id)
 	if err != nil {
 		if client.IsErrNotFound(err) {
 			return nil, status.Errorf(codes.NotFound, err.Error())
@@ -729,14 +675,19 @@ func (s *Server) InspectServiceContainer(
 		return nil, status.Errorf(codes.Internal, err.Error())
 	}
 
-	ctrBytes, err := json.Marshal(serviceCtr.Container)
+	ctrBytes, err := json.Marshal(ctr)
 	if err != nil {
-		return nil, status.Errorf(codes.Internal, "marshal container: %v", err)
+		return nil, status.Errorf(codes.Internal, "marshal response: %v", err)
 	}
 
-	specBytes, err := json.Marshal(serviceCtr.ServiceSpec)
+	var specBytes []byte
+	err = s.db.QueryRowContext(ctx, `SELECT service_spec FROM containers WHERE id = $1`, ctr.ID).Scan(&specBytes)
 	if err != nil {
-		return nil, status.Errorf(codes.Internal, "marshal service spec: %v", err)
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, status.Errorf(codes.NotFound, "service spec not found for container: '%s'", ctr.ID)
+		}
+		return nil, status.Errorf(codes.Internal, "get service spec for container '%s' from machine database: %v",
+			ctr.ID, err)
 	}
 
 	return &pb.ServiceContainer{
@@ -768,28 +719,54 @@ func (s *Server) ListServiceContainers(
 				return nil, status.Errorf(codes.InvalidArgument, "unmarshal filters: %v", err)
 			}
 			opts.Filters = args
+		} else {
+			opts.Filters = filters.NewArgs()
 		}
 	}
+	// Only uncloud-managed containers that belong to some service.
+	opts.Filters.Add("label", api.LabelServiceID)
+	opts.Filters.Add("label", api.LabelManaged)
 
-	containers, err := s.service.ListServiceContainers(ctx, req.ServiceId, opts)
+	containerSummaries, err := s.client.ContainerList(ctx, opts)
 	if err != nil {
 		return nil, status.Error(codes.Internal, err.Error())
 	}
 
-	// Convert to protobuf format.
-	pbContainers := make([]*pb.ServiceContainer, 0, len(containers))
-	for _, ctr := range containers {
-		ctrBytes, err := json.Marshal(ctr.Container)
+	containers := make([]*pb.ServiceContainer, 0, len(containerSummaries))
+	for _, cs := range containerSummaries {
+		if req.ServiceId != "" &&
+			cs.Labels[api.LabelServiceID] != req.ServiceId && cs.Labels[api.LabelServiceName] != req.ServiceId {
+			continue
+		}
+
+		ctr, err := s.client.ContainerInspect(ctx, cs.ID)
+		if err != nil {
+			if client.IsErrNotFound(err) {
+				// The listed container may have been removed while we were inspecting other containers.
+				continue
+			}
+			return nil, status.Errorf(codes.Internal, "inspect container %s: %v", cs.ID, err)
+		}
+		ctrBytes, err := json.Marshal(ctr)
 		if err != nil {
 			return nil, status.Errorf(codes.Internal, "marshal container: %v", err)
 		}
 
-		specBytes, err := json.Marshal(ctr.ServiceSpec)
+		var specBytes []byte
+		err = s.db.QueryRowContext(ctx, `SELECT service_spec FROM containers WHERE id = $1`, ctr.ID).Scan(&specBytes)
 		if err != nil {
-			return nil, status.Errorf(codes.Internal, "marshal service spec: %v", err)
+			if errors.Is(err, sql.ErrNoRows) {
+				// If this happens, there is a bug in the code, or someone manually removed the container from the DB,
+				// or created a managed container out of band.
+				slog.Error("Service container not found in machine database.", "id", ctr.ID)
+				// Just ignore such a container to not fail the list operation as it's not easily recoverable.
+				continue
+			}
+			return nil, status.Errorf(codes.Internal, "get service spec for container '%s' from machine database: %v",
+				ctr.ID, err)
 		}
 
-		pbContainers = append(pbContainers, &pb.ServiceContainer{
+		containers = append(containers, &pb.ServiceContainer{
 			Container:   ctrBytes,
 			ServiceSpec: specBytes,
 		})
@@ -798,7 +775,7 @@ func (s *Server) ListServiceContainers(
 	return &pb.ListServiceContainersResponse{
 		Messages: []*pb.MachineServiceContainers{
 			{
-				Containers: pbContainers,
+				Containers: containers,
 			},
 		},
 	}, nil

internal/machine/docker/service.go

@@ -1,103 +0,0 @@
-package docker
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log/slog"
-
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/client"
-	"github.com/jmoiron/sqlx"
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-// Service provides higher-level Docker operations that extends Docker API with Uncloud-specific data
-// from the machine database.
-type Service struct {
-	Client *client.Client
-	db     *sqlx.DB
-}
-
-// NewService creates a new Docker service instance.
-func NewService(client *client.Client, db *sqlx.DB) *Service {
-	return &Service{
-		Client: client,
-		db:     db,
-	}
-}
-
-// InspectServiceContainer inspects a Docker container and retrieves its associated ServiceSpec
-// from the machine database, returning a complete ServiceContainer.
-func (s *Service) InspectServiceContainer(ctx context.Context, nameOrID string) (api.ServiceContainer, error) {
-	var serviceCtr api.ServiceContainer
-
-	ctr, err := s.Client.ContainerInspect(ctx, nameOrID)
-	if err != nil {
-		return serviceCtr, err
-	}
-	if _, ok := ctr.Config.Labels[api.LabelManaged]; !ok {
-		return serviceCtr, fmt.Errorf("container '%s' is not managed by Uncloud", nameOrID)
-	}
-
-	serviceCtr.Container = api.Container{ContainerJSON: ctr}
-
-	// Retrieve ServiceSpec from the machine database.
-	var specBytes []byte
-	err = s.db.QueryRowContext(ctx, `SELECT service_spec FROM containers WHERE id = $1`, ctr.ID).Scan(&specBytes)
-	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
-			// If this happens, there is a bug in the code, or someone manually removed the container from the DB,
-			// or created a managed container out of band or by previous uncloud installation.
-			return serviceCtr, fmt.Errorf("service spec not found for container '%s' in machine DB", ctr.ID)
-		}
-		return serviceCtr, fmt.Errorf("get service spec for container '%s' from machine DB: %w", ctr.ID, err)
-	}
-
-	if err = json.Unmarshal(specBytes, &serviceCtr.ServiceSpec); err != nil {
-		return serviceCtr, fmt.Errorf("unmarshal service spec for container '%s': %w", ctr.ID, err)
-	}
-
-	return serviceCtr, nil
-}
-
-// ListServiceContainers lists Docker containers that belong to the service with the given name or ID.
-// If serviceIDOrName is empty, all service containers are returned. The opts parameter allows additional filtering.
-func (s *Service) ListServiceContainers(
-	ctx context.Context, serviceNameOrID string, opts container.ListOptions,
-) ([]api.ServiceContainer, error) {
-	if opts.Filters.Len() == 0 {
-		opts.Filters = filters.NewArgs()
-	}
-	// Add labels to existing filters to list only Uncloud-managed service containers.
-	opts.Filters.Add("label", api.LabelServiceID)
-	opts.Filters.Add("label", api.LabelManaged)
-
-	containerSummaries, err := s.Client.ContainerList(ctx, opts)
-	if err != nil {
-		return nil, err
-	}
-
-	var containers []api.ServiceContainer
-	for _, cs := range containerSummaries {
-		// Filter by service name or ID if provided.
-		if serviceNameOrID != "" &&
-			cs.Labels[api.LabelServiceID] != serviceNameOrID &&
-			cs.Labels[api.LabelServiceName] != serviceNameOrID {
-			continue
-		}
-
-		ctr, err := s.InspectServiceContainer(ctx, cs.ID)
-		if err != nil {
-			// Log error but continue with other containers.
-			slog.Error("Failed to inspect service container.", "service", serviceNameOrID, "id", cs.ID, "err", err)
-			continue
-		}
-		containers = append(containers, ctr)
-	}
-
-	return containers, nil
-}

internal/machine/firewall/iptables_darwin.go

@@ -6,8 +6,3 @@ import "fmt"
 func ConfigureIptablesChains() error {
 	return fmt.Errorf("not supported on Darwin")
 }
-
-// CleanupIptablesChains is a stub for Darwin.
-func CleanupIptablesChains() error {
-	return fmt.Errorf("not supported on Darwin")
-}