fix: check latest Caddy image only if not specified for 'uc caddy deploy'

README.md

@@ -13,7 +13,7 @@ Unlike traditional orchestrators, there's no central control plane and quorum to
 synchronized copy of the cluster state through peer-to-peer communication, keeping cluster operations functional even if
 some machines go offline.
 
-Uncloud aims to be the solution for developers who want the flexibility of self-hosted infrastructure without the
+Uncloud is the solution for developers who want the flexibility of self-hosted infrastructure without the
 operational complexity of Kubernetes.
 
 ## 🎬 Quick demo
@@ -28,13 +28,17 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 
 * **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
   regardless of location or provider.
+* **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
+  need to learn a new bespoke DSL.
+* **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
+  soon.
+* **Service discovery**: Built-in DNS server resolves service names to container IPs.
+* **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
   IPs for direct cross-machine communication.
 * **No control plane**: Fully decentralized design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
-* **Zero-downtime deployments**: Rolling updates with health checks and automatic rollback on failure.
-* **Service discovery**: Built-in DNS server resolves service names to container IPs.
 * **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
   [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
@@ -42,14 +46,6 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-Coming soon:
-
-* Infrastructure as Code using Docker Compose format
-* Project isolation through environments/namespaces
-* Persistent volumes and secrets management
-* Monitoring and log aggregation
-* Database deployment and management
-
 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 
 ![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)
@@ -118,8 +114,10 @@ View the [user guide](docs/user_guide.md) for more information.
 
 ## ⚙️ How it works
 
-Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals. Here, let's peek
+Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals.
-under the hood to see what happens when you run certain commands.
+
+<details>
+<summary>Here, let's peek under the hood to see what happens when you run certain commands.</summary>
 
 **When you initialize a new cluster on a machine:**
 
@@ -254,6 +252,7 @@ Look ma, no control plane or master nodes to maintain! Just a simple overlay net
 sync that lets machines work together. Want to check on things or make changes? Connect to any machine either implicitly
 using the CLI or directly over SSH. They all have the complete cluster state and can control everything. It's like each
 machine is a full backup of your control plane.
+</details>
 
 ## 🏗 Project status
 
@@ -270,7 +269,7 @@ I'd love your input! Here's how you can contribute:
 * [Subscribe](https://uncloud.run/#subscribe) to my newsletter to follow the progress, get early insights into new
   features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.
-* Follow [@psviderski](https://github.com/psviderski) on GitHub.
+* Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
 
 ## ❤️ Contributors
 

cmd/uncloud/caddy/deploy.go

@@ -152,7 +152,8 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 }
 
 func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, progressOut *streams.Out) error {
-	if _, err := clusterClient.GetDomain(ctx); err != nil {
+	domain, err := clusterClient.GetDomain(ctx)
+	if err != nil {
 		if errors.Is(err, api.ErrNotFound) {
 			fmt.Println("Skipping DNS records update as no cluster domain is reserved (see 'uc dns').")
 			return nil
@@ -164,7 +165,7 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 	// TODO: split the method into two: one to get the records and one to update them to ask for update confirmation.
 
 	var records []*pb.DNSRecord
-	err := progress.RunWithTitle(ctx, func(ctx context.Context) error {
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
 		var err error
 		records, err = clusterClient.CreateIngressRecords(ctx, client.CaddyServiceName)
 		return err
@@ -172,18 +173,19 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 	if err != nil {
 		if errors.Is(err, client.ErrNoReachableMachines) {
 			fmt.Println()
-			fmt.Println("DNS records could not be updated as there are no internet-reachable machines running " +
+			fmt.Printf("DNS records for domain '%s' could not be updated as there are no internet-reachable "+
-				"caddy containers.")
+				"machines running caddy containers.\n", domain)
 			fmt.Println()
 			fmt.Println("Possible solutions:")
 			fmt.Println("- Ensure your machines have public IP addresses")
 			fmt.Println("- Use --public-ip flag when adding machines to override the automatically detected IPs")
 			fmt.Println("- Check firewall settings on your machines")
 			fmt.Println("- Configure port forwarding if behind NAT")
-			fmt.Println("- Retry Caddy deployment after resolving connectivity issues with 'uc caddy deploy'")
+			fmt.Println("- Retry Caddy deployment with 'uc caddy deploy' after resolving connectivity issues")
 			fmt.Println()
-			fmt.Println("Your services will not be accessible from the internet until at least one machine " +
+			fmt.Println("Your services won't be accessible from the internet until at least one machine " +
-				"becomes reachable.")
+				"becomes reachable. If you aren't planning to expose any services publicly, you can release " +
+				"the domain by running 'uc dns release'.")
 		}
 		return fmt.Errorf("failed to update DNS records pointing to caddy service: %w", err)
 	}

internal/machine/dns/server.go

@@ -94,6 +94,11 @@ func NewServer(listenAddr netip.Addr, resolver Resolver, upstreams []netip.AddrP
 	}, nil
 }
 
+// ListenAddr returns the address the DNS server is listening on.
+func (s *Server) ListenAddr() netip.Addr {
+	return s.listenAddr
+}
+
 // Run starts the DNS server listening on both UDP and TCP ports. The server on TCP is not critical so it won't return
 // an error if it fails to start. The server will run until the context is canceled or an error occurs.
 func (s *Server) Run(ctx context.Context) error {

internal/machine/docker/manager.go

@@ -4,19 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
+	"time"
+
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/pkg/api"
-	"log/slog"
-	"time"
 )
 
 const (
 	NetworkName = "uncloud"
-	UserChain   = "DOCKER-USER"
 	// EventsDebounceInterval defines how long to wait before processing the next Docker event. Multiple events
 	// occurring within this window will be processed together as a single event to prevent system overload.
 	EventsDebounceInterval = 100 * time.Millisecond

internal/machine/docker/manager_darwin.go

@@ -8,7 +8,7 @@ import (
 	"net/netip"
 )
 
-// EnsureUncloudNetwork is a stub for darwin.
+// EnsureUncloudNetwork is a stub for Darwin.
-func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix) error {
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
-	return fmt.Errorf("not supported on darwin")
+	return fmt.Errorf("not supported on Darwin")
 }

internal/machine/docker/manager_linux.go

@@ -3,24 +3,28 @@ package docker
 import (
 	"context"
 	"fmt"
+	"log/slog"
+	"net/netip"
+	"strconv"
+
 	dnetwork "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/libnetwork/iptables"
-	"log/slog"
+	"github.com/psviderski/uncloud/internal/machine/dns"
-	"net/netip"
+	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
 // if it doesn't exist. If the network exists but has a different subnet, it removes and recreates the network.
 // It also configures iptables to allow container access from the WireGuard network.
-func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix) error {
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
 	// Ensure the Docker network 'uncloud' is created with the correct subnet.
 	needsCreation := false
 	nw, err := m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
 	if err != nil {
 		if !client.IsErrNotFound(err) {
-			return fmt.Errorf("inspect Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
 		}
 		needsCreation = true
 	} else if nw.IPAM.Config[0].Subnet != subnet.String() {
@@ -31,7 +35,7 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 		)
 		if err = m.client.NetworkRemove(ctx, NetworkName); err != nil {
 			// It can still fail if the network is in use by a container. Leave it to the user to resolve the issue.
-			return fmt.Errorf("remove Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("remove Docker network '%s': %w", NetworkName, err)
 		}
 		needsCreation = true
 	}
@@ -50,12 +54,12 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 				},
 			},
 		); err != nil {
-			return fmt.Errorf("create Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)
 		}
 		slog.Info("Docker network created.", "name", NetworkName, "subnet", subnet.String())
 
 		if nw, err = m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{}); err != nil {
-			return fmt.Errorf("inspect Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
 		}
 	}
 
@@ -67,10 +71,36 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 	// Bridge name doesn't seem to be documented but this is the source code where it is generated:
 	// https://github.com/moby/moby/blob/v27.2.1/libnetwork/drivers/bridge/bridge_linux.go#L664
 	bridgeName := "br-" + nw.ID[:12]
+
+	if err = configureIptables(bridgeName, dnsServer); err != nil {
+		return fmt.Errorf("configure iptables for Docker network '%s': %w", NetworkName, err)
+	}
+
+	return nil
+}
+
+// configureIptables configures iptables rules for the uncloud Docker network.
+func configureIptables(bridgeName string, dnsServer netip.Addr) error {
 	ipt := iptables.GetIptable(iptables.IPv4)
-	rule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
+	// Allow traffic from other machines and their containers through the WG mesh to the Uncloud containers
-	if err = ipt.ProgramRule(iptables.Filter, UserChain, iptables.Insert, rule); err != nil {
+	// on the machine.
+	wgRule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
+	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Insert, wgRule); err != nil {
 		return fmt.Errorf("insert iptables rule: %w", err)
+	}
+
+	// Allow DNS queries from Uncloud containers to the embedded DNS server.
+	for _, proto := range []string{"udp", "tcp"} {
+		dnsRule := []string{
+			"--in-interface", bridgeName,
+			"--dst", dnsServer.String(),
+			"--protocol", proto,
+			"--dport", strconv.Itoa(dns.Port),
+			"-j", "ACCEPT",
+		}
+		if err := ipt.ProgramRule(iptables.Filter, firewall.UncloudInputChain, iptables.Insert, dnsRule); err != nil {
+			return fmt.Errorf("insert iptables rule: %w", err)
+		}
 	}
 
 	return nil

internal/machine/firewall/iptables_darwin.go

@@ -0,0 +1,8 @@
+package firewall
+
+import "fmt"
+
+// ConfigureIptablesChains is a stub for Darwin.
+func ConfigureIptablesChains() error {
+	return fmt.Errorf("not supported on Darwin")
+}

internal/machine/firewall/iptables_linux.go

@@ -0,0 +1,74 @@
+package firewall
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/libnetwork/iptables"
+	"github.com/psviderski/uncloud/internal/machine/network"
+)
+
+const (
+	DockerUserChain   = "DOCKER-USER"
+	UncloudInputChain = "UNCLOUD-INPUT"
+)
+
+// ConfigureIptablesChains sets up custom iptables chains and initial firewall rules for Uncloud networking.
+func ConfigureIptablesChains() error {
+	// Ensure iptables UNCLOUD-INPUT chain with a RETURN rule exists. All existing rules are flushed.
+	ipt := iptables.GetIptable(iptables.IPv4)
+	if _, err := ipt.NewChain(UncloudInputChain, iptables.Filter); err != nil {
+		return fmt.Errorf("create iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-F", UncloudInputChain); err != nil {
+		return fmt.Errorf("flush iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.AddReturnRule(UncloudInputChain); err != nil {
+		return fmt.Errorf("add the RETURN rule for iptables chain '%s': %w", UncloudInputChain, err)
+	}
+
+	// Ensure the main iptables INPUT chain has a jump rule to the UNCLOUD-INPUT chain before any DROP/REJECT rules.
+	jumpRule := []string{"-m", "comment", "--comment", "Uncloud-managed", "-j", UncloudInputChain}
+	if !ipt.Exists(iptables.Filter, "INPUT", jumpRule...) {
+		// Look for the first DROP/REJECT rule in the INPUT chain.
+		out, err := ipt.Raw("-t", string(iptables.Filter), "-L", "INPUT", "--line-numbers")
+		if err != nil {
+			return fmt.Errorf("get iptables rules for chain '%s': %w", UncloudInputChain, err)
+		}
+
+		firstRejectRuleNum := 0
+		for _, line := range strings.Split(string(out), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) < 2 {
+				continue
+			}
+			if fields[1] == "DROP" || fields[1] == "REJECT" {
+				if ruleNum, err := strconv.Atoi(fields[0]); err == nil {
+					firstRejectRuleNum = ruleNum
+					break
+				}
+			}
+		}
+
+		var addJumpRule []string
+		if firstRejectRuleNum > 0 {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-I", "INPUT", strconv.Itoa(firstRejectRuleNum)},
+				jumpRule...)
+		} else {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-A", "INPUT"}, jumpRule...)
+		}
+		if err = ipt.RawCombinedOutput(addJumpRule...); err != nil {
+			return fmt.Errorf("add iptables rule '%s': %w", strings.Join(addJumpRule, " "), err)
+		}
+	}
+
+	// Allow WireGuard traffic to the machine.
+	acceptWireGuardRule := []string{"-p", "udp", "--dport", strconv.Itoa(network.WireGuardPort), "-j", "ACCEPT"}
+	err := ipt.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, acceptWireGuardRule)
+	if err != nil {
+		return fmt.Errorf("insert iptables rule '%s': %w", strings.Join(acceptWireGuardRule, " "), err)
+	}
+
+	return nil
+}

internal/machine/network.go

@@ -18,6 +18,7 @@ import (
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"golang.org/x/sync/errgroup"
@@ -79,6 +80,10 @@ func newNetworkController(
 }
 
 func (nc *networkController) Run(ctx context.Context) error {
+	if err := firewall.ConfigureIptablesChains(); err != nil {
+		return fmt.Errorf("configure iptables chains: %w", err)
+	}
+
 	if err := nc.wgnet.Configure(*nc.state.Network); err != nil {
 		return fmt.Errorf("configure WireGuard network: %w", err)
 	}
@@ -215,7 +220,7 @@ func (nc *networkController) prepareAndWatchDocker(ctx context.Context) error {
 		return fmt.Errorf("wait for Docker daemon: %w", err)
 	}
 
-	if err := manager.EnsureUncloudNetwork(ctx, nc.state.Network.Subnet); err != nil {
+	if err := manager.EnsureUncloudNetwork(ctx, nc.state.Network.Subnet, nc.dnsServer.ListenAddr()); err != nil {
 		return fmt.Errorf("ensure Docker network: %w", err)
 	}
 	slog.Info("Docker network configured.")

pkg/api/service.go

@@ -31,6 +31,7 @@ const (
 )
 
 var serviceIDRegexp = regexp.MustCompile("^[0-9a-f]{32}$")
+var dnsLabelRegexp = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)
 
 func ValidateServiceID(id string) bool {
 	return serviceIDRegexp.MatchString(id)
@@ -104,7 +105,14 @@ func (s *ServiceSpec) Validate() error {
 		return fmt.Errorf("invalid mode: %q", s.Mode)
 	}
 	
-	// TODO: validate the service name is a valid DNS label.
+	if s.Name != "" {
+		if len(s.Name) > 63 {
+			return fmt.Errorf("service name too long (max 63 characters): %q", s.Name)
+		}
+		if !dnsLabelRegexp.MatchString(s.Name) {
+			return fmt.Errorf("invalid service name: %q. must be 1-63 characters, lowercase letters, numbers, and dashes only; must start and end with a letter or number", s.Name)
+		}
+	}
 
 	for _, p := range s.Ports {
 		if (p.Mode == "" || p.Mode == PortModeIngress) &&
@@ -138,6 +146,7 @@ func (s *ServiceSpec) Validate() error {
 	return nil
 }
 
+
 func (s *ServiceSpec) Clone() ServiceSpec {
 	spec := *s
 

pkg/client/caddy.go

@@ -24,12 +24,12 @@ var caddyImageTagRegex = regexp.MustCompile(`^2\.\d+\.\d+$`)
 // The service is deployed in global mode to all machines in the cluster. If the image is not provided, the latest
 // version of the official Caddy Docker image is used.
 func (cli *Client) NewCaddyDeployment(image string, placement api.Placement) (*deploy.Deployment, error) {
+	if image == "" {
 		latest, err := LatestCaddyImage()
 		if err != nil {
 			return nil, fmt.Errorf("look up latest Caddy image: %w", err)
 		}
 
-	if image == "" {
 		image = reference.FamiliarString(latest)
 	}