docs: draft post wireguard overlay

2026-10-06 21:29:02 +00:00 · 2025-07-08 21:08:29 +10:00
588 changed files with 32443 additions and 86472 deletions
@@ -2,7 +2,6 @@
 *

 # Allow files and directories.
-!api/
 !cmd/
 !internal/
 !pkg/
@@ -18,6 +18,3 @@ indent_size = 4
 [*.sh]
 indent_style = space
 indent_size = 4
-
-[release-notes-*.md]
-max_line_length = off
@@ -1,36 +0,0 @@
---
-name: Bug Report
-about: Create a report to help us improve
-title: "[BUG] "
-labels: bug
-assignees: ""
---
-
-**Describe the bug**
-
-<!-- A clear and concise description of what the bug is. -->
-
-**How to reproduce**
-
-<!-- Steps to reproduce the behavior:
-
-1. Run ...
-2. Do ...
-->
-
-**Expected behavior**
-
-<!-- A clear and concise description of what you expected to happen. -->
-
-**Environment:**
-
- Uncloud versions:
-  - Control (client) node (`uc --version`):
-  - Uncloud daemon (from the server) (`uncloudd --version`):
- OS version (`uname -a`):
-  - Client (control node):
-  - Server:
-
-**Additional context**
-
-<!-- Add any other context about the problem here. -->
@@ -1 +0,0 @@
-../AI.md
@@ -18,8 +18,6 @@ on:
      - "test/**"
 permissions:
  contents: read
-env:
-  MISE_VERSION: "2026.3.7"
 jobs:
  test:
    runs-on: ubuntu-latest
@@ -27,12 +25,10 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Install Mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
-          version: ${{ env.MISE_VERSION }}
-      - name: Reset changes in mise.lock after fresh mise install
-        run: git checkout mise.lock
+          go-version: "1.23.2"

      - name: Install dependencies
        run: |
@@ -40,17 +36,9 @@ jobs:
          git diff --exit-code ||
            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)

-      - name: Generate docs
-        run: |
-          make cli-docs
-          git diff --exit-code ||
-            (echo "Documentation is out of date. Please run 'make cli-docs' and commit the changes." && exit 1)
-
      - name: Run tests
-        run: |
-          mise ucind:image
-          make test
-    timeout-minutes: 15
+        run: make test
+    timeout-minutes: 10

  check-protobuf:
    runs-on: ${{ matrix.os }}
@@ -65,18 +53,15 @@ jobs:
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install Mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
        with:
-          version: ${{ env.MISE_VERSION }}
-
-      # TODO: figure out how to properly lock all platforms in the lockfile and remove this hack.
-      # `mise lock` (mise run mise:lock) doesn't generate checksums for some of the tools, e.g. protoc*
-      - name: Reset changes in mise.lock after fresh mise install
-        run: git checkout mise.lock
+          version: "2025.6.5"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

      - name: Generate Protobuf files
        run: |
-          mise run proto
-          # Check if the generated files are up to date.
+          make proto
+          # check if the generated files are up to date
          git diff --exit-code ||
-            (echo "Generated protobuf files are not up to date. Please run 'mise run proto' and commit the changes." && exit 1)
+            (echo "Generated protobuf files are not up to date. Please run 'make proto' and commit the changes." && exit 1)
@@ -1,35 +0,0 @@
-name: Lint
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "**.go"
-      - "go.*"
-permissions:
-  contents: read
-env:
-  MISE_VERSION: "2026.3.7"
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install Mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
-        with:
-          version: ${{ env.MISE_VERSION }}
-      - name: Reset changes in mise.lock after fresh mise install
-        run: git checkout mise.lock
-
-      - name: Lint
-        run: make lint
-
-    timeout-minutes: 10
@@ -1,99 +0,0 @@
-name: Nightly Build
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: write
-
-env:
-  MISE_VERSION: "2026.3.7"
-
-jobs:
-  nightly:
-    # Run on macOS to be able to build the fsevent dependency required by compose on macOS.
-    runs-on: macos-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Install Mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
-        with:
-          version: ${{ env.MISE_VERSION }}
-      - name: Reset changes in mise.lock after fresh mise install
-        run: git checkout mise.lock
-
-      - name: Cache Go build and module cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: |
-            ~/Library/Caches/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/*.go') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-
-            ${{ runner.os }}-go-
-
-      - name: Run GoReleaser snapshot
-        run: goreleaser release --snapshot --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Delete existing nightly release
-        run: gh release delete nightly --yes --cleanup-tag || true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create nightly release
-        run: |
-          COMMIT=$(git rev-parse --short HEAD)
-          DATE=$(date -u '+%Y-%m-%d %H:%M UTC')
-          RELEASE_NOTES=$(cat <<EOF
-          Built from \`main\` at ${COMMIT} on ${DATE}.
-
-          The commands below show how to install the nightly version of uncloud.
-
-          > [!WARNING]
-          > These are nightly development builds and may be unstable.
-
-          **Install uncloud CLI:**
-
-          \`\`\`
-          curl -fsS https://get.uncloud.run/install.sh | VERSION=nightly sh
-          \`\`\`
-
-          **Initialize a cluster or add a machine:**
-
-          \`\`\`
-          uc machine init --version nightly user@host
-          uc machine add  --version nightly user@host
-          \`\`\`
-
-          **Upgrade machine daemon:**
-
-          \`\`\`
-          ARCH=\$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          curl -fsSL -o uncloudd.tar.gz https://github.com/psviderski/uncloud/releases/download/nightly/uncloudd_linux_\${ARCH}.tar.gz
-          tar -xf uncloudd.tar.gz
-          sudo install uncloudd /usr/local/bin/uncloudd
-          rm uncloudd uncloudd.tar.gz
-          sudo systemctl restart uncloud
-          \`\`\`
-
-          EOF
-          )
-
-          gh release create nightly \
-            --title "Nightly Build" \
-            --notes "${RELEASE_NOTES}" \
-            --prerelease \
-            --target ${{ github.sha }} \
-            dist/*.tar.gz dist/checksums.txt
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    timeout-minutes: 30
@@ -7,10 +7,6 @@
 *.dll
 *.so
 *.dylib
-/uncloud
-/uncloud-*
-/uncloudd
-/uncloudd-*

 # OS X
 .DS_Store
@@ -41,7 +37,3 @@ node_modules/

 # VS Code
 .vscode
-.devcontainer/
-
-.zed/
-research/
@@ -1,42 +0,0 @@
-version: "2"
-
-run:
-  concurrency: 4
-  tests: true
-  timeout: 5m
-
-linters:
-  default: none
-  enable:
-    - bodyclose
-    # - dogsled
-    - dupl
-    # - errcheck
-    - gochecknoinits
-    - goconst
-    # - gocritic
-    # - gocyclo
-    # - godot
-    # - gosec
-    # - govet
-    - ineffassign
-    - misspell
-    - nakedret
-    # - prealloc
-    # - revive
-    # - staticcheck
-    - unconvert
-    # - unparam
-    # - unused
-    - whitespace
-  exclusions:
-    rules:
-      - path: ^test/e2e
-        linters:
-          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
-
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-
@@ -11,21 +11,12 @@ before:

 report_sizes: true

-git:
-  # Skip the stale 'nightly' tag so {{.Version}} resolves to the latest semver tag for --snapshot builds.
-  ignore_tags:
-    - nightly
-snapshot:
-  # Semver-compliant nightly version, e.g. "0.19.0-nightly-abc1234" when the latest tag is v0.18.0.
-  version_template: "{{ incminor .Version }}-nightly-{{.ShortCommit}}"
-
 builds:
-  - id: uc
-    main: ./cmd/uc
-    binary: uc
+  - id: uncloud
+    main: ./cmd/uncloud
+    binary: uncloud
    env:
-      # Use CGO to be able to build fsevent required by compose on macOS.
-      - CGO_ENABLED={{ if eq .Os "darwin" }}1{{ else }}0{{ end }}
+      - CGO_ENABLED=0
    goos:
      - darwin
      - linux
@@ -34,12 +25,7 @@ builds:
      - amd64
      - arm64
    ldflags:
-      - -s -w
-        -X github.com/psviderski/uncloud/internal/version.version={{.Version}}
-        -X github.com/psviderski/uncloud/internal/version.commit={{.Commit}}
-        -X github.com/psviderski/uncloud/internal/version.dirty={{.IsGitDirty}}
-        -X github.com/psviderski/uncloud/internal/version.date={{.CommitDate}}
-        -X github.com/psviderski/uncloud/internal/version.builtBy=goreleaser
+      - -s -w -X github.com/psviderski/uncloud/internal/version.version={{ .Version }}

  - id: uncloudd
    main: ./cmd/uncloudd
@@ -52,17 +38,12 @@ builds:
      - amd64
      - arm64
    ldflags:
-      - -s -w
-        -X github.com/psviderski/uncloud/internal/version.version={{.Version}}
-        -X github.com/psviderski/uncloud/internal/version.commit={{.Commit}}
-        -X github.com/psviderski/uncloud/internal/version.dirty={{.IsGitDirty}}
-        -X github.com/psviderski/uncloud/internal/version.date={{.CommitDate}}
-        -X github.com/psviderski/uncloud/internal/version.builtBy=goreleaser
+      - -s -w -X github.com/psviderski/uncloud/internal/version.version={{ .Version }}

 archives:
-  - id: uc
+  - id: uncloud
    builds:
-      - uc
+      - uncloud
    formats:
      # gz is not compatible with homebrew releases, so we use tar.gz
      - tar.gz
@@ -103,9 +84,10 @@ brews:
    description: "Uncloud CLI"
    homepage: "https://uncloud.run"
    ids:
-      - uc
+      - uncloud
    install: |
-      bin.install "uc"
+      bin.install "uncloud"
+      bin.install_symlink "uncloud" => "uc"
    skip_upload: false
    repository:
      owner: psviderski
@@ -0,0 +1,31 @@
+[tools.go]
+version = "1.23.10"
+backend = "core:go"
+
+[tools.go.checksums]
+"go1.23.10.darwin-arm64.tar.gz" = "sha256:25c64bfa8a8fd8e7f62fb54afa4354af8409a4bb2358c2699a1003b733e6fce5"
+"go1.23.10.linux-amd64.tar.gz" = "sha256:535f9f81802499f2a7dbfa70abb8fda3793725fcc29460f719815f6e10b5fd60"
+
+[tools.protoc]
+version = "27.3"
+backend = "aqua:protocolbuffers/protobuf/protoc"
+
+[tools.protoc.checksums]
+"protoc-27.3-linux-x86_64.zip" = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
+"protoc-27.3-osx-aarch_64.zip" = "sha256:b22116bd97cdbd7ea25346abe635a9df268515fe5ef5afa93cd9a68fc2513f84"
+
+[tools.protoc-gen-go]
+version = "1.34.2"
+backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"
+
+[tools.protoc-gen-go.checksums]
+"protoc-gen-go.v1.34.2.darwin.arm64.tar.gz" = "sha256:17aca7f948dbb624049030cf841e35895cf34183ba006e721247fdeb95ff2780"
+"protoc-gen-go.v1.34.2.linux.amd64.tar.gz" = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"
+
+[tools.protoc-gen-go-grpc]
+version = "1.5.1"
+backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"
+
+[tools.protoc-gen-go-grpc.checksums]
+"protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz" = "sha256:d6083feb51dcfe59f26793e99ef01ef5eac68b64294ec2546711f614ac5878f3"
+"protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz" = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"
@@ -0,0 +1,11 @@
+[settings]
+experimental = true
+
+[tools]
+go = "1.23"
+protoc = "27.3"
+protoc-gen-go = "1.34.2"
+protoc-gen-go-grpc = "1.5.1"
+
+[env]
+_.file = ".env"
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-#MISE description="Build and install uncloud binaries on dev machines, restart daemon if running"
-#MISE depends=["build:uncloudd-amd64", "build:uncloudd-arm64"]
-#MISE raw=true
-#USAGE arg "<hosts>" var=#true var_min=1 help="Hosts in [user@]host[/arch] format, arch defaults to amd64"
-
-for arg in ${usage_hosts}; do
-  if [[ "$arg" == */* ]]; then
-    host="${arg%/*}"
-    arch="${arg##*/}"
-  else
-    host="$arg"
-    arch="amd64"
-  fi
-
-  binary="uncloudd-linux-${arch}"
-  echo "==> Installing uncloudd on ${host} (${arch})..."
-  scp "$binary" "${host}:/tmp/"
-  ssh "$host" "sudo install /tmp/${binary} /usr/local/bin/uncloudd && rm /tmp/${binary} && sudo systemctl try-restart uncloud"
-done
-
-rm -f uncloudd-linux-amd64 uncloudd-linux-arm64
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-#MISE description="Stop uncloud daemon and wipe state on dev machines"
-#USAGE arg "<hosts>" var=#true var_min=1 help="Hosts in [user@]host format"
-
-for host in ${usage_hosts}; do
-  # Strip optional /arch suffix since reset doesn't need it.
-  host="${host%/*}"
-  echo "==> Resetting ${host}..."
-  ssh "$host" "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
-done
-
-echo "==> Done"
@@ -1,4 +0,0 @@
-packages:
-  github.com/psviderski/uncloud/internal/machine/caddyconfig:
-    interfaces:
-      CaddyfileValidator:
@@ -1,265 +0,0 @@
-# AGENTS.md - Uncloud Project Guide
-
-This document provides comprehensive information about the Uncloud project for AI assistants to understand the codebase,
-architecture, and development practices.
-
-## Project Overview
-
-**Uncloud** is a lightweight clustering and container orchestration tool that enables deployment and management of web
-applications across cloud VMs and bare metal servers. It creates a secure WireGuard mesh network between Docker hosts
-and provides automatic service discovery, load balancing, HTTPS ingress, and simple CLI commands for application
-management.
-
-### Key Characteristics
-
- **Language**: Go
- **Architecture**: Decentralized, no control plane
- **Target**: Self-hosted infrastructure without Kubernetes complexity
- **License**: View LICENSE file for details
- **Status**: Active development, not yet ready for production
-
-## Core Features
-
-### 🏗️ Infrastructure
-
- **Multi-machine deployment**: Combine cloud VMs, dedicated servers, and bare metal
- **Zero-config networking**: Automatic WireGuard mesh with NAT traversal
- **Decentralized design**: No central control plane, all machines are equal
- **Service discovery**: Built-in DNS server resolves service names to container IPs
-
-### 🚀 Application Management
-
- **Docker Compose compatibility**: Uses familiar Docker Compose format
- **Zero-downtime deployments**: Rolling updates without service interruption
- **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
- **Managed DNS**: Free `*.xxxxxx.uncld.dev` subdomains via Uncloud DNS service
- **Cross-machine scaling**: Run containers across multiple machines
-
-### 🔧 Developer Experience
-
- **Docker-like CLI**: Familiar commands (`uc` binary)
- **Imperative operations**: Direct commands vs. declarative state reconciliation
- **Remote management**: Control entire infrastructure via SSH to any machine
- **Minimal overhead**: ~150MB RAM footprint per machine
-
-## Architecture
-
-### Core Components
-
-1. **CLI (`uc`)** - Main user interface for cluster management
-2. **Daemon (`uncloudd`)** - Machine daemon running on each node
-3. **Corrosion** - Distributed SQLite database for cluster state (Fly.io project)
-4. **Caddy** - Reverse proxy for HTTPS termination and routing
-5. **WireGuard** - Secure mesh networking between machines
-
-### Network Architecture
-
- Each machine gets unique subnet (e.g., `10.210.0.0/24`, `10.210.1.0/24`)
- Containers get cluster-unique IPs for direct communication
- Automatic peer discovery and key management
- NAT traversal for machines behind firewalls
-
-### State Management
-
- **CRDT-based distributed storage** using Corrosion
- **Eventually consistent** state across all machines
- **Gossip protocol** (Serf) for state propagation
- **No quorum requirements** - partial network splits remain functional
-
-## Project Structure
-
-### Key Directories
-
- **`cmd/`**: Contains main applications
-
-    - `uc/`: CLI tool with subcommands for machine, service, volume management
-    - `uncloudd/`: Daemon that runs on each machine
-    - `ucind/`: Development cluster management for testing
-
- **`internal/`**: Internal implementation packages
-
-    - `cli/`: Command-line interface logic
-    - `machine/`: Machine lifecycle and state management
-    - `daemon/`: Daemon implementation and gRPC services
-    - `dns/`: Internal DNS server for service discovery
-
- **`pkg/`**: Public API packages for external use
-
-    - `api/`: Core API types and definitions
-    - `client/`: Client libraries for interacting with Uncloud
-
- **`experiment/`**: Experimental features and prototypes
- **`scripts/`**: Installation and utility scripts
- **`test/`**: Test suites and test infrastructure
- **`website/`**: Documentation website (Docusaurus)
-
-    - `landing/`: Landing page
-    - `docs/`: User documentation
-
- **`misc/`**: Design documents and guides
-
-## Key Technologies
-
-### Core Dependencies
-
-```go
-// Networking and orchestration
-github.com/docker/docker // Docker API client
-github.com/docker/compose/v2 // Docker Compose integration
-golang.zx2c4.com/wireguard // WireGuard implementation
-github.com/hashicorp/serf // Gossip protocol
-
-// State management
-github.com/ipfs/go-ds-crdt // CRDT distributed storage
-github.com/dgraph-io/badger/v3 // Embedded database
-
-// Web proxy
-github.com/caddyserver/caddy/v2 // HTTP server and reverse proxy
-
-// CLI and UX
-github.com/spf13/cobra // CLI framework
-github.com/charmbracelet/huh // Interactive forms
-
-// gRPC and networking
-google.golang.org/grpc                     // gRPC framework
-github.com/siderolabs/grpc-proxy // gRPC proxy for forwarding
-```
-
-## Development Workflow
-
-### Build and Development
-
-```bash
-# Build binaries
-go build -o uc ./cmd/uc
-go build -o uncloudd ./cmd/uncloudd
-```
-
-### Key Make Targets
-
- `proto`: Generate protobuf code
- `ucind-cluster`: Create development cluster
- `update-dev`: Deploy to development machines
- `demo-reset`: Reset demo environment
- `fmt`: Format code
- `test`: Run all tests
- `lint`: Lint the code using golangci-lint
- `lint-and-fix`: Lint the code and fix issues whenever possible
-
-## CLI Commands Structure
-
-The `uc` CLI provides these main command groups:
-
-### Machine Management
-
-```bash
-uc machine init <user@host>     # Initialize new cluster
-uc machine add <user@host>      # Add machine to cluster
-uc machine ls                   # List machines
-uc machine rm <name>            # Remove machine
-```
-
-### Service Management
-
-```bash
-uc run <image>                  # Run container from image
-uc deploy                       # Deploy from compose.yaml
-uc scale <service> <count>      # Scale service replicas
-uc ls                           # List services
-uc rm <service>                 # Remove service
-```
-
-### Context and Connectivity
-
-```bash
-uc context ls                   # List available contexts
-uc context use <name>           # Switch context
-```
-
-### Global Flags
-
- `--connect`: Connect to remote machine directly, without a config file
- `--uncloud-config`: Override config file path
-
-## Development Guidelines
-
-### Code Organization
-
- **Package naming**: Use clear, descriptive names
- **Error handling**: Wrap errors with context using `fmt.Errorf`
- **Logging**: Use structured logging with levels
- **gRPC**: Services defined in `api/pb/`
-
-### Testing
-
- Test files and locations
-    - Unit tests alongside source files (`*_test.go`)
-    - Integration tests in `test/e2e/`
-    - Test fixtures in `test/fixtures/`
- Use the `testify` library for assertions (e.g., `require.Equal`, `assert.Nil`)
-
-### Dependencies
-
- Prefer standard library when possible
- Pin versions in `go.mod`
- Document rationale for external dependencies
-
-### Configuration
-
- Support environment variables for key settings
- Validate configuration early
- Provide sensible defaults
-
-## Troubleshooting and Debugging
-
-### Common Issues
-
- **Networking**: Check WireGuard status, iptables rules
- **DNS**: Verify service discovery resolution
- **Containers**: Use standard Docker debugging tools
- **State sync**: Check Corrosion logs for replication issues
-
-### Debugging Tools
-
- Standard Linux networking tools (`ping`, `traceroute`, `wireshark`)
- Docker commands (`docker ps`, `docker logs`)
- SSH access to machines for direct inspection
- gRPC debugging tools
-
-### Logs and Monitoring
-
- Systemd services (getting logs via `journalctl -u SERVICE_NAME`)
-    - `uncloud` -- Uncloud daemon
-    - `uncloud-corrosion` -- Corrosion process
- Machine daemon logs
- Container logs via Docker
-
-## File Patterns and Conventions
-
-### Important Files to Understand
-
- `cmd/uc/main.go`: CLI entry point and command structure
- `internal/cli/cli.go`: CLI implementation and configuration
- `internal/machine/machine.go`: Core machine management
- `pkg/api/`: Public API definitions
- `misc/design.md`: Architecture and design philosophy
- `README.md`: Repository README
-
-### Configuration Files
-
- `go.mod/go.sum`: Go dependency management
- `Makefile`: Build and development tasks
- `Dockerfile`: Container build instructions forUncloud-in-Docker (used for testing)
-
-This document should help AI assistants understand the project structure, make informed suggestions, and contribute
-effectively to the Uncloud codebase.
-
-## Documentation
-
-Instructions when generating documentation:
-
- Use conversational language – write as if you were speaking to a friend.
- Keep sentences simple, optimize for clarity and understanding.
- Do not use em dashes (—) or semicolons (;) in sentences. Instead, break complex sentences into simpler ones.
- Place the subject before the action whenever possible. Example: prefer "The function loads data" over "Data is loaded
-  by the function."
@@ -1 +0,0 @@
-./AGENTS.md
@@ -1,6 +1,6 @@
-ARG ALPINE_VERSION=3.23.3
+ARG ALPINE_VERSION=3.20.3

-FROM golang:1.26.1-alpine AS uncloudd
+FROM golang:1.23.2-alpine AS uncloudd

 ARG TARGETOS
 ARG TARGETARCH
@@ -13,12 +13,11 @@ COPY go.mod go.sum ./
 RUN go mod download && go mod verify

 COPY . .
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd ./cmd/uncloudd
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main.go


 FROM alpine:${ALPINE_VERSION} AS corrosion-download
 ARG TARGETARCH
-ARG CORROSION_VERSION

 RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
      "amd64") echo "x86_64" ;; \
@@ -26,31 +25,27 @@ RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
    esac) \
    && wget -q -O /tmp/corrosion.tar.gz \
-      "https://github.com/psviderski/corrosion/releases/download/v${CORROSION_VERSION}/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
+      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
    && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
-    && install /tmp/corrosion /usr/bin/corrosion \
+    && install /tmp/corrosion /usr/local/bin/corrosion \
    && rm /tmp/corrosion.tar.gz /tmp/corrosion

 # Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
 # e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
-FROM gcr.io/distroless/cc-debian13:latest AS corrosion
-COPY --from=corrosion-download /usr/bin/corrosion /usr/bin/corrosion
+FROM gcr.io/distroless/cc-debian12:latest AS corrosion
+COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
 CMD ["corrosion", "agent"]


 FROM alpine:${ALPINE_VERSION} AS corrosion-image-tarball
-ARG CORROSION_VERSION
-ARG CORROSION_IMAGE="ghcr.io/unlabs-dev/corrosion:${CORROSION_VERSION}"
-ARG TARGETOS
-ARG TARGETARCH
+ARG CORROSION_IMAGE="ghcr.io/psviderski/corrosion:latest"

 RUN apk --no-cache add crane
-RUN crane pull --platform ${TARGETOS}/${TARGETARCH} "${CORROSION_IMAGE}" /corrosion.tar
+RUN crane pull "${CORROSION_IMAGE}" /corrosion.tar
+

 # Uncloud-in-Docker (ucind) image for running Uncloud test clusters using Docker.
-FROM docker:29.4.0-dind AS ucind
-ARG CORROSION_VERSION
-
+FROM docker:27.3.1-dind AS ucind
 # Create system group and user 'uncloud'.
 RUN addgroup -S uncloud && adduser -SHD -h /nonexistent -G uncloud -g "" uncloud
 RUN apk --no-cache add \
@@ -58,7 +53,7 @@ RUN apk --no-cache add \
    wireguard-tools

 COPY --from=corrosion-image-tarball /corrosion.tar /images/corrosion.tar
-COPY scripts/docker/entrypoint.sh /usr/local/bin/
+COPY scripts/docker/dind scripts/docker/entrypoint.sh /usr/local/bin/
 COPY --from=uncloudd /build/uncloudd /usr/local/bin/

 ENTRYPOINT ["entrypoint.sh"]
@@ -1,155 +0,0 @@
-# Developing Uncloud
-
-A short guide on setting up your local development environment.
-
-## Prerequisites
-
- [mise](https://mise.jdx.dev/) (development environment setup tool)
- [Docker](https://docs.docker.com/get-docker/) with BuildKit (for running end-to-end tests). Make sure the
-  [`docker buildx`](https://docs.docker.com/build/concepts/overview/) plugin is installed.
-
-## Setup
-
-Uncloud uses `mise` to install and manage development tools and dependencies. It makes it easy to create reproducible
-development environments on developer machines and CI.
-
-Follow the [Installing Mise](https://mise.jdx.dev/installing-mise.html) guide to get it set up on your machine.
-
-Mark the project as trusted and install all required tools (Go, `protoc`, `golangci-lint`, etc.) by running from the
-project root:
-
-```shell
-mise trust
-mise install
-```
-
-This reads [`mise.toml`](mise.toml) and installs the exact versions of tools specified there. They will be available in
-your `PATH` when you are in the project directory, so you can run `go` or `golangci-lint` directly. The tools won't be
-available outside the project, so they don't interfere with system packages.
-
-## Building
-
-Build the CLI:
-
-```shell
-go build -o uc ./cmd/uc
-```
-
-Or build and run the CLI with a single command:
-
-```shell
-go run ./cmd/uc --help
-```
-
-The Uncloud daemon (`uncloudd`) only supports Linux, so you need to cross-compile it if you're developing on macOS or
-Windows:
-
-```shell
-GOOS=linux GOARCH=amd64 go build -o uncloudd ./cmd/uncloudd
-```
-
-## Testing
-
-Run all tests (unit and e2e):
-
-```shell
-make test
-```
-
-### End-to-end tests
-
-E2e tests run inside Docker using the [Uncloud-in-Docker](#uncloud-in-docker-ucind) image. Build it first:
-
-```shell
-mise ucind:image
-```
-
-⚠️ NOTE: You need to rebuild the `ucind` image every time you make changes to the daemon code if you want to test them
-in e2e tests.
-
-Then run the tests:
-
-```shell
-make test-e2e
-```
-
-If tests leave leftover containers, clean them up with:
-
-```shell
-make test-clean
-```
-
-### Manual testing on dev machines
-
-After making changes to the daemon code, you may want to test them in your dev cluster. Build and install `uncloudd` on
-one or multiple dev machines over SSH with:
-
-```shell
-mise run dev:install user@host1 user@host2/arm64
-```
-
-It will also restart the `uncloud.service` daemon on those machines to pick up the new version. The host format is
-`[user@]host[/arch]`. The architecture of a machine defaults to `amd64` if not specified.
-
-To stop the daemon and wipe all Uncloud data on the dev machines, run:
-
-```shell
-mise run dev:reset user@host1 user@host2
-```
-
-## Linting and formatting
-
-Lint and format the code:
-
-```shell
-make lint-and-fix
-```
-
-## Code generation
-
-Update the generated Go code for the gRPC API after modifying files in [`api/pb`](./api/pb):
-
-```shell
-mise run proto
-```
-
-Regenerate mocks:
-
-```shell
-make mocks
-```
-
-## Uncloud in Docker (UCinD)
-
-The [`ucind`](./cmd/ucind) CLI lets you run Uncloud clusters locally using Docker containers instead of real machines.
-Each cluster machine runs as a Docker container connected to a shared Docker network.
-
-Cluster machines use the `ghcr.io/psviderski/ucind:latest` Docker image by default. It may not always have the latest
-changes to the `uncloudd` daemon code as it's not automatically rebuilt on CI yet.
-
-You can rebuild it locally to pick up the latest changes, including your work in progress, and test them in a UCinD
-cluster:
-
-```shell
-mise ucind:image
-```
-
-Create a cluster with 3 machines:
-
-```shell
-mise ucind cluster create -m 3
-```
-
-This also sets the new cluster as the active context, so you can interact with it using the `uc` CLI right away.
-
-Remove the cluster when you're done:
-
-```shell
-mise ucind cluster rm
-```
-
-Sometimes crashed tests or interrupted runs can leave orphaned containers and networks behind. Clean them all up with:
-
-```shell
-mise ucind:cleanup
-```
@@ -1,50 +1,83 @@
-# TODO: Makefile is deprecated, add new targets as mise tasks in mise.toml instead.
-
-CORROSION_VERSION ?= 2026.6.15
-CORROSION_IMAGE = ghcr.io/unlabs-dev/corrosion:$(CORROSION_VERSION)
+CORROSION_IMAGE ?= ghcr.io/psviderski/corrosion:latest
 UCIND_IMAGE ?= ghcr.io/psviderski/ucind:latest
+DOCS_IMAGE ?= ghcr.io/psviderski/uncloud-docs:latest
+
+update-dev:
+	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
+		scp uncloudd-linux-amd64 spy@192.168.40.243:~/ && \
+		ssh spy@192.168.40.243 sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd
+		scp uncloudd-linux-amd64 spy@192.168.40.176:~/ && \
+		ssh spy@192.168.40.176 sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && \
+		rm uncloudd-linux-amd64
+#	GOOS=linux GOARCH=arm64 go build -o uncloudd-linux-arm64 ./cmd/uncloudd && \
+#		scp uncloudd-linux-arm64 ubuntu@152.67.101.197:~/ && \
+#		ssh ubuntu@152.67.101.197 sudo install ./uncloudd-linux-arm64 /usr/local/bin/uncloudd && \
+#		rm uncloudd-linux-arm64
+
+update-restart-dev:
+	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
+		scp uncloudd-linux-amd64 spy@192.168.40.243:~/ && \
+		ssh spy@192.168.40.243 "sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
+		scp uncloudd-linux-amd64 spy@192.168.40.176:~/ && \
+		ssh spy@192.168.40.176 "sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
+		rm uncloudd-linux-amd64
+#	GOOS=linux GOARCH=arm64 go build -o uncloudd-linux-arm64 ./cmd/uncloudd && \
+#		scp uncloudd-linux-arm64 ubuntu@152.67.101.197:~/ && \
+#		ssh ubuntu@152.67.101.197 "sudo install ./uncloudd-linux-arm64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
+#		rm uncloudd-linux-arm64
+
+reset-dev:
+	ssh spy@192.168.40.243 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
+	ssh spy@192.168.40.176 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
+	ssh ubuntu@152.67.101.197 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
+
+demo-reset:
+	rm -fv ~/.config/uncloud/config.yaml
+	ssh ubuntu@152.67.101.197 "AUTO_CONFIRM=true sudo -E uncloud-uninstall && docker rmi caddy:2.9.1"
+	ssh root@5.223.45.199 "AUTO_CONFIRM=true sudo -E uncloud-uninstall"
+	ssh spy@192.168.40.243 "AUTO_CONFIRM=true sudo -E uncloud-uninstall"

 .PHONY: ucind-cluster
 ucind-cluster:
-	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m $(if $(MACHINES_COUNT),$(MACHINES_COUNT),3)
+	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m 3
+
+.PHONY: proto
+proto:
+	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
+		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto

 .PHONY: corrosion-image
 corrosion-image:
-	docker build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) -t "$(CORROSION_IMAGE)" --target corrosion .
+	docker build -t "$(CORROSION_IMAGE)" --target corrosion .

 .PHONY: corrosion-multiarch-image-push
 corrosion-multiarch-image-push:
-	docker buildx build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) --push --platform linux/amd64,linux/arm64 \
-		-t "$(CORROSION_IMAGE)" --target corrosion .
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
+
+.PHONY: ucind-image
+ucind-image:
+	docker build -t "$(UCIND_IMAGE)" --target ucind .

 .PHONY: ucind-multiarch-image-push
 ucind-multiarch-image-push:
 	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .

-.PHONY: mocks
-mocks:
-	@mockery
-
 .PHONY: test
 test:
 ifeq ($(TEST_NAME),)
-	go test -shuffle=on -count=1 -v ./...
+	go test -count=1 -v ./...
 else
-	go test -shuffle=on -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
+	go test -count=1 -v -run ^$(TEST_NAME)$$ ./...
 endif

-.PHONY: test-e2e
-test-e2e:
-	go test -shuffle=on -race -count=1 -v ./test/e2e
-
 .PHONY: test-clean
 test-clean:
-	@CONTAINERS=$$(docker ps --filter "label=ucind.managed" -q); \
+	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
 	if [ -n "$$CONTAINERS" ]; then \
 		echo "Killing containers..."; \
 		docker kill $$CONTAINERS; \
 	fi; \
-	CONTAINERS_STOPPED=$$(docker ps -a --filter "label=ucind.managed" -q); \
+	CONTAINERS_STOPPED=$$(docker ps -a --filter "name=ucind-test" -q); \
 	if [ -n "$$CONTAINERS_STOPPED" ]; then \
 		echo "Removing stopped containers..."; \
 		docker rm $$CONTAINERS_STOPPED; \
@@ -56,20 +89,6 @@ test-clean:
 vet:
 	go vet ./...

-.PHONY: format fmt
-format fmt:
-	GOOS=linux golangci-lint fmt
-
-LINT_TARGETS := lint lint-and-fix
-.PHONY: $(LINT_TARGETS) _lint
-$(LINT_TARGETS): _lint
-lint: ARGS=
-lint-and-fix: ARGS=--fix
-_lint:
-# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
-# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
-	GOOS=linux golangci-lint run $(ARGS)
-
-.PHONY: cli-docs
-cli-docs:
-	go run ./cmd/uc docs
+.PHONY: docs-image-push
+docs-image:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(DOCS_IMAGE)" ./docs
@@ -1,10 +1,10 @@
 <div align="center">
-  <img src="./website/landing/images/logo-title.svg#gh-light-mode-only" alt="Uncloud logo"/>
-  <img src="./website/landing/images/logo-title-dark.svg#gh-dark-mode-only" alt="Uncloud logo"/>
-  <p><strong>▸ Deploy and scale containerised apps across servers without Swarm or Kubernetes overhead ◂</strong></p>
+  <img src="./website/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
+  <h1>Uncloud</h1>
+  <p><strong>Docker simplicity. Multi-machine power.</strong></p>

  <p>
-    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
+    <a href="https://docs.uncloud.run"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
    <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
    <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
@@ -25,14 +25,12 @@ complexity of Kubernetes.

 ## ✨ Features

-* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment,
+* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
  regardless of location or provider.
 * **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
  need to learn a new bespoke DSL.
 * **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
  soon.
-* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Build and push your Docker images directly to
-  your machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
 * **Service discovery**: Built-in DNS server resolves service names to container IPs.
 * **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
@@ -40,38 +38,35 @@ complexity of Kubernetes.
 * **No control plane**: Fully decentralised design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
  model and troubleshooting.
-* **Managed DNS**: Automatic DNS records `*.xxxxxx.uncld.dev` for services with public access via managed
+* **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
  [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
  Encrypt.
-* **Cluster storage for TLS certificates**: Native cluster storage for Caddy shares certificates and ACME challenge
-  tokens across machines and coordinates issuance.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.

+### 🚀 Coming soon
+
+* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
+  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
+
 ## 🎬 Quick demo

-The screenshot below demonstrates how we use Uncloud to deploy https://uncloud.run website to 2 remote machines from
-the [`compose.yaml`](website/compose.yaml) file on the local machine.
+The screenshot below demonstrates how I use Uncloud to deploy the [Uncloud Documentation](https://docs.uncloud.run)
+website to 2 remote machines (why not?) from the [`compose.yaml`](docs/compose.yaml) file on my local machine.

-It exposes the container port `8000/tcp` as HTTPS on `uncloud.run` domain, served by the Caddy reverse proxy on the
-remote machines. All managed by Uncloud.
+It exposes the container port `8000/tcp` as HTTPS on the domain `docs.uncloud.run`, served by the Caddy reverse proxy on
+the remote machines. All managed by Uncloud.

-![Uncloud compose deployment demo](.github/images/website-deploy.jpg)
+![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)

 Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
 on-premises in just a couple minutes.

 <a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
-<img src="https://embed-ssl.wistia.com/deliveries/4fb71ea442905b81b1ad4e25fc02132e.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
+<img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
 </a>

-<br>
-<br>
-
-> **📚 Want more examples?** Check out the [**uncloud-recipes**](https://github.com/psviderski/uncloud-recipes)
-> repository for community recipes and templates for deploying popular services on Uncloud.
-
 ## 💫 Why Uncloud?

 Modern cloud platforms like Heroku and Render offer amazing developer experiences but at a premium price. Traditional
@@ -101,11 +96,8 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
   # or using curl (macOS/Linux)
   curl -fsS https://get.uncloud.run/install.sh | sh
   ```
-
-   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
-
-   There's also a [nightly rolling release](https://github.com/psviderski/uncloud/releases/tag/nightly) available if you
-   want to try the latest features and fixes before they're included in an official release.
+   
+   See [Installation](https://docs.uncloud.run/getting-started/install-cli) for more options.

 2. Initialise your first machine:

@@ -138,15 +130,15 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
   uncloud-uninstall
   ```

-View the [Documentation](https://uncloud.run/docs) for more information.
+View the [Documentation](https://docs.uncloud.run) for more information.

 ## ⚙️ How it works

-Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
+Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals.

 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:

-![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)

 <details>
 <summary>Peek under the hood to see what happens when you run certain commands.</summary>
@@ -156,6 +148,7 @@ Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 ```bash
 $ uc machine init --name oracle-vm ubuntu@152.67.101.197

+Downloading Uncloud install script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh
 ⏳ Running Uncloud install script...
 ✓ Docker is already installed.
 ⏳ Installing Docker...
@@ -168,10 +161,11 @@ $ uc machine init --name oracle-vm ubuntu@152.67.101.197
 ✓ uncloudd binary installed: /usr/local/bin/uncloudd
 ⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
 ✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
-✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
 ✓ Systemd unit file created: /etc/systemd/system/uncloud.service
-Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
 Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Downloading uncloud-corrosion binary: https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz
+✓ uncloud-corrosion binary installed: /usr/local/bin/uncloud-corrosion
+✓ Systemd unit file created: /etc/systemd/system/uncloud-corrosion.service
 ⏳ Starting Uncloud machine daemon (uncloud.service)...
 ✓ Uncloud machine daemon started.
 ✓ Uncloud installed on the machine successfully! 🎉
@@ -190,20 +184,21 @@ DNS records updated to use only the internet-reachable machines running caddy se
  *.xuw3xd.cluster.uncloud.run  A → 152.67.101.197
 ```

-1. The CLI SSHs into the machine and installs Docker and the `uncloudd` machine daemon, managed by systemd.
+1. The CLI SSHs into the machine and installs Docker, the `uncloudd` machine daemon and
+   [corrosion](https://github.com/superfly/corrosion) service, managed by systemd.
 2. Generates a unique WireGuard key pair, allocates a dedicated subnet `10.210.0.0/24` for the machine and its
   containers, and configures `uncloudd` accordingly. All subsequent communication happens with `uncloudd`
   through its gRPC API over SSH.
-3. Configures and starts [corrosion](https://github.com/superfly/corrosion), a CRDT-based distributed SQLite database to
-   share cluster state between machines, as a Docker container managed by `uncloudd`.
+3. Configures and starts `corrosion`, a CRDT-based distributed SQLite database to share cluster state between machines.
 4. Creates a Docker bridge network connected to the WireGuard interface.
-5. This machine becomes an entry point for the newly created cluster. Its address is stored as a connection info in the
-   cluster config at `~/.config/uncloud/config.yaml` on your local machine.
+5. This machine becomes an entry point for the newly created cluster which is stored in the cluster config under
+   `~/.config/uncloud` on your local machine.

 **When you add another machine:**

 ```bash
 $ uc machine add --name hetzner-server root@5.223.45.199
+Downloading Uncloud install script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh
 ⏳ Running Uncloud install script...
 ✓ Docker is already installed.
 ✓ Linux user and group 'uncloud' created.
@@ -212,10 +207,11 @@ $ uc machine add --name hetzner-server root@5.223.45.199
 ✓ uncloudd binary installed: /usr/local/bin/uncloudd
 ⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
 ✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
-✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
 ✓ Systemd unit file created: /etc/systemd/system/uncloud.service
-Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
 Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Downloading uncloud-corrosion binary: https://github.com/psviderski/corrosion/releases/latest/download/corrosion-x86_64-unknown-linux-gnu.tar.gz
+✓ uncloud-corrosion binary installed: /usr/local/bin/uncloud-corrosion
+✓ Systemd unit file created: /etc/systemd/system/uncloud-corrosion.service
 ⏳ Starting Uncloud machine daemon (uncloud.service)...
 ✓ Uncloud machine daemon started.
 ✓ Uncloud installed on the machine successfully! 🎉
@@ -244,10 +240,9 @@ hetzner-server   Up      10.210.1.1/24   5.223.45.199     5.223.45.199:51820, [2
 3. Registers the second machine in the cluster state and exchanges WireGuard keys with the first machine.
 4. Both machines establish a WireGuard tunnel between each other, allowing Docker containers connected to the bridge
   network to communicate directly across machines.
-5. Configures and starts the `uncloud-corrosion` container on the second machine to sync the cluster state.
+5. Configures and starts `corrosion` on the second machine to sync the cluster state.
 6. The second machine is added as an alternative entry point in the cluster config.
-7. If one of the machines goes offline, the other machine can still be used by `uc` to connect and run cluster
-   operations.
+7. If one of the machines goes offline, the other machine can still serve cluster operations.

 If one more machine is added, the process repeats with a new subnet. The new machine needs to establish a WireGuard
 connection with only one of the existing machines. Other machines will learn about it through the shared cluster state
@@ -283,26 +278,10 @@ using the CLI or directly over SSH. They all have the complete cluster state and
 machine is a full backup of your control plane.
 </details>

-## 🧪 Interactive tutorials
-
-To give you a chance to play with Uncloud without even leaving your browser, we're providing interactive tutorials and
-playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
-
-Available tutorials:
-
-1. [Setting up a new Uncloud cluster](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) - the tutorial
-   walks you through creating a new cluster with two machines and then deploying a simple web service to it.
-2. [Deploying a Django web application](https://labs.iximiuz.com/tutorials/uncloud-deploy-django-app-7a378bc3) - deploy
-   a Django web app from source code to a remote Linux server using Uncloud.
-
-You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you
-can play with an already initialized Uncloud cluster.
-
 ## 🏗 Project status

-Uncloud is under active development and pre-1.0, so expect occasional breaking changes between releases. The core build,
-push, and deploy workflows are stable, and much of the runtime relies on battle-tested projects: Docker, Caddy,
-WireGuard, and Corrosion.
+Uncloud is currently in active development and is **not ready for production use**. Features may change significantly
+and there may be breaking changes between releases.

 We'd love your input! Here's how you can contribute:

@@ -325,9 +304,9 @@ I'm grateful to the following projects that inspired Uncloud's design and implem
 * [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
  user experience that feels like magic.
 * [Talos Linux](https://github.com/siderolabs/talos)
-  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for inspiring Uncloud's API routing
-  design with [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for their elegant approach to secure
-  WireGuard-based overlay networking with zero configuration.
+  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
+  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
+  networking with zero configuration.
 * [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
@@ -340,24 +319,13 @@ SQLite database used to share Uncloud's cluster state.

 * Join our [Discord server](https://discord.gg/eR35KQJhPu) for real-time discussions, support, and updates.
 * Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
-* Subscribe to [our newsletter](https://uncloud.run/#subscribe) to follow the journey of building Uncloud: progress
-  updates, user stories, and the occasional deep dive.
+* Subscribe to [my newsletter](https://uncloud.run/#subscribe) to follow the progress, get early insights into new
+  features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.

-## 💖 Sponsors
-
-These companies and projects are helping Uncloud with their generous sponsorship and/or services:
-
-<!-- Sentry -->
-<a href="https://sentry.io/welcome/">
-  <img height="100" alt="Sentry" src="https://github.com/user-attachments/assets/6c1439c0-d20d-40dc-a669-c9aa94651dfa" />
-</a>
-
 ## ❤️ Contributors

-<a href="https://trendshift.io/repositories/14069">
-    <img alt="Trendshift" src="https://trendshift.io/api/badge/repositories/14069" />
-</a>
+Thank you [@cedws](https://github.com/cedws) for being the first contributor to Uncloud! 🎉

 <a href="https://github.com/psviderski/uncloud/graphs/contributors">
  <img src="https://contrib.rocks/image?repo=psviderski/uncloud" />
@@ -1,187 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.34.2
-// 	protoc        v5.27.3
-// source: api/pb/caddy.proto
-
-package pb
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type GetCaddyConfigResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// The saved Caddyfile content.
-	Caddyfile string `protobuf:"bytes,1,opt,name=caddyfile,proto3" json:"caddyfile,omitempty"`
-	// Timestamp when the config was last modified.
-	ModifiedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=modified_at,json=modifiedAt,proto3" json:"modified_at,omitempty"`
-	// Error from the latest unsuccessful reconciliation attempt.
-	LastReconciliationError string `protobuf:"bytes,3,opt,name=last_reconciliation_error,json=lastReconciliationError,proto3" json:"last_reconciliation_error,omitempty"`
-}
-
-func (x *GetCaddyConfigResponse) Reset() {
-	*x = GetCaddyConfigResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetCaddyConfigResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetCaddyConfigResponse) ProtoMessage() {}
-
-func (x *GetCaddyConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetCaddyConfigResponse.ProtoReflect.Descriptor instead.
-func (*GetCaddyConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *GetCaddyConfigResponse) GetCaddyfile() string {
-	if x != nil {
-		return x.Caddyfile
-	}
-	return ""
-}
-
-func (x *GetCaddyConfigResponse) GetModifiedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.ModifiedAt
-	}
-	return nil
-}
-
-func (x *GetCaddyConfigResponse) GetLastReconciliationError() string {
-	if x != nil {
-		return x.LastReconciliationError
-	}
-	return ""
-}
-
-var File_api_pb_caddy_proto protoreflect.FileDescriptor
-
-var file_api_pb_caddy_proto_rawDesc = []byte{
-	0x0a, 0x12, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xaf, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43,
-	0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65,
-	0x12, 0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x12, 0x3a, 0x0a,
-	0x19, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x17, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x32, 0x49, 0x0a, 0x05, 0x43, 0x61, 0x64,
-	0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
-	0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e,
-	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_api_pb_caddy_proto_rawDescOnce sync.Once
-	file_api_pb_caddy_proto_rawDescData = file_api_pb_caddy_proto_rawDesc
-)
-
-func file_api_pb_caddy_proto_rawDescGZIP() []byte {
-	file_api_pb_caddy_proto_rawDescOnce.Do(func() {
-		file_api_pb_caddy_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_caddy_proto_rawDescData)
-	})
-	return file_api_pb_caddy_proto_rawDescData
-}
-
-var file_api_pb_caddy_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_api_pb_caddy_proto_goTypes = []any{
-	(*GetCaddyConfigResponse)(nil), // 0: api.GetCaddyConfigResponse
-	(*timestamppb.Timestamp)(nil),  // 1: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),          // 2: google.protobuf.Empty
-}
-var file_api_pb_caddy_proto_depIdxs = []int32{
-	1, // 0: api.GetCaddyConfigResponse.modified_at:type_name -> google.protobuf.Timestamp
-	2, // 1: api.Caddy.GetConfig:input_type -> google.protobuf.Empty
-	0, // 2: api.Caddy.GetConfig:output_type -> api.GetCaddyConfigResponse
-	2, // [2:3] is the sub-list for method output_type
-	1, // [1:2] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
-}
-
-func init() { file_api_pb_caddy_proto_init() }
-func file_api_pb_caddy_proto_init() {
-	if File_api_pb_caddy_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_api_pb_caddy_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*GetCaddyConfigResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_api_pb_caddy_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   1,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_api_pb_caddy_proto_goTypes,
-		DependencyIndexes: file_api_pb_caddy_proto_depIdxs,
-		MessageInfos:      file_api_pb_caddy_proto_msgTypes,
-	}.Build()
-	File_api_pb_caddy_proto = out.File
-	file_api_pb_caddy_proto_rawDesc = nil
-	file_api_pb_caddy_proto_goTypes = nil
-	file_api_pb_caddy_proto_depIdxs = nil
-}
@@ -1,22 +0,0 @@
-syntax = "proto3";
-
-package api;
-
-option go_package = "github.com/psviderski/uncloud/api/pb";
-
-import "google/protobuf/empty.proto";
-import "google/protobuf/timestamp.proto";
-
-service Caddy {
-  // GetConfig retrieves the current Caddy configuration from the machine.
-  rpc GetConfig(google.protobuf.Empty) returns (GetCaddyConfigResponse);
-}
-
-message GetCaddyConfigResponse {
-  // The saved Caddyfile content.
-  string caddyfile = 1;
-  // Timestamp when the config was last modified.
-  google.protobuf.Timestamp modified_at = 2;
-  // Error from the latest unsuccessful reconciliation attempt.
-  string last_reconciliation_error = 3;
-}
@@ -1,124 +0,0 @@
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.27.3
-// source: api/pb/caddy.proto
-
-package pb
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	Caddy_GetConfig_FullMethodName = "/api.Caddy/GetConfig"
-)
-
-// CaddyClient is the client API for Caddy service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-type CaddyClient interface {
-	// GetConfig retrieves the current Caddy configuration from the machine.
-	GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error)
-}
-
-type caddyClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewCaddyClient(cc grpc.ClientConnInterface) CaddyClient {
-	return &caddyClient{cc}
-}
-
-func (c *caddyClient) GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(GetCaddyConfigResponse)
-	err := c.cc.Invoke(ctx, Caddy_GetConfig_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// CaddyServer is the server API for Caddy service.
-// All implementations must embed UnimplementedCaddyServer
-// for forward compatibility.
-type CaddyServer interface {
-	// GetConfig retrieves the current Caddy configuration from the machine.
-	GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error)
-	mustEmbedUnimplementedCaddyServer()
-}
-
-// UnimplementedCaddyServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedCaddyServer struct{}
-
-func (UnimplementedCaddyServer) GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetConfig not implemented")
-}
-func (UnimplementedCaddyServer) mustEmbedUnimplementedCaddyServer() {}
-func (UnimplementedCaddyServer) testEmbeddedByValue()               {}
-
-// UnsafeCaddyServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to CaddyServer will
-// result in compilation errors.
-type UnsafeCaddyServer interface {
-	mustEmbedUnimplementedCaddyServer()
-}
-
-func RegisterCaddyServer(s grpc.ServiceRegistrar, srv CaddyServer) {
-	// If the following call pancis, it indicates UnimplementedCaddyServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&Caddy_ServiceDesc, srv)
-}
-
-func _Caddy_GetConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyServer).GetConfig(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Caddy_GetConfig_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyServer).GetConfig(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// Caddy_ServiceDesc is the grpc.ServiceDesc for Caddy service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var Caddy_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "api.Caddy",
-	HandlerType: (*CaddyServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "GetConfig",
-			Handler:    _Caddy_GetConfig_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "api/pb/caddy.proto",
-}
@@ -1,848 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.34.2
-// 	protoc        v5.27.3
-// source: api/pb/caddy_storage.proto
-
-package pb
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type StoreCaddyStorageRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-}
-
-func (x *StoreCaddyStorageRequest) Reset() {
-	*x = StoreCaddyStorageRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StoreCaddyStorageRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StoreCaddyStorageRequest) ProtoMessage() {}
-
-func (x *StoreCaddyStorageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StoreCaddyStorageRequest.ProtoReflect.Descriptor instead.
-func (*StoreCaddyStorageRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *StoreCaddyStorageRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *StoreCaddyStorageRequest) GetValue() []byte {
-	if x != nil {
-		return x.Value
-	}
-	return nil
-}
-
-type LoadCaddyStorageRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-}
-
-func (x *LoadCaddyStorageRequest) Reset() {
-	*x = LoadCaddyStorageRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LoadCaddyStorageRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LoadCaddyStorageRequest) ProtoMessage() {}
-
-func (x *LoadCaddyStorageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LoadCaddyStorageRequest.ProtoReflect.Descriptor instead.
-func (*LoadCaddyStorageRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *LoadCaddyStorageRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-type LoadCaddyStorageResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Value     []byte                 `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
-	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
-}
-
-func (x *LoadCaddyStorageResponse) Reset() {
-	*x = LoadCaddyStorageResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LoadCaddyStorageResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LoadCaddyStorageResponse) ProtoMessage() {}
-
-func (x *LoadCaddyStorageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LoadCaddyStorageResponse.ProtoReflect.Descriptor instead.
-func (*LoadCaddyStorageResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *LoadCaddyStorageResponse) GetValue() []byte {
-	if x != nil {
-		return x.Value
-	}
-	return nil
-}
-
-func (x *LoadCaddyStorageResponse) GetUpdatedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.UpdatedAt
-	}
-	return nil
-}
-
-type DeleteCaddyStorageRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-}
-
-func (x *DeleteCaddyStorageRequest) Reset() {
-	*x = DeleteCaddyStorageRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DeleteCaddyStorageRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteCaddyStorageRequest) ProtoMessage() {}
-
-func (x *DeleteCaddyStorageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteCaddyStorageRequest.ProtoReflect.Descriptor instead.
-func (*DeleteCaddyStorageRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *DeleteCaddyStorageRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-type ListCaddyStorageRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Prefix    string `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"`
-	Recursive bool   `protobuf:"varint,2,opt,name=recursive,proto3" json:"recursive,omitempty"`
-}
-
-func (x *ListCaddyStorageRequest) Reset() {
-	*x = ListCaddyStorageRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListCaddyStorageRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListCaddyStorageRequest) ProtoMessage() {}
-
-func (x *ListCaddyStorageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListCaddyStorageRequest.ProtoReflect.Descriptor instead.
-func (*ListCaddyStorageRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *ListCaddyStorageRequest) GetPrefix() string {
-	if x != nil {
-		return x.Prefix
-	}
-	return ""
-}
-
-func (x *ListCaddyStorageRequest) GetRecursive() bool {
-	if x != nil {
-		return x.Recursive
-	}
-	return false
-}
-
-type ListCaddyStorageResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Keys []string `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
-}
-
-func (x *ListCaddyStorageResponse) Reset() {
-	*x = ListCaddyStorageResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListCaddyStorageResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListCaddyStorageResponse) ProtoMessage() {}
-
-func (x *ListCaddyStorageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListCaddyStorageResponse.ProtoReflect.Descriptor instead.
-func (*ListCaddyStorageResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *ListCaddyStorageResponse) GetKeys() []string {
-	if x != nil {
-		return x.Keys
-	}
-	return nil
-}
-
-type StatCaddyStorageRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-}
-
-func (x *StatCaddyStorageRequest) Reset() {
-	*x = StatCaddyStorageRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StatCaddyStorageRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StatCaddyStorageRequest) ProtoMessage() {}
-
-func (x *StatCaddyStorageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StatCaddyStorageRequest.ProtoReflect.Descriptor instead.
-func (*StatCaddyStorageRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *StatCaddyStorageRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-type StatCaddyStorageResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key        string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	UpdatedAt  *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
-	Size       int64                  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
-	IsTerminal bool                   `protobuf:"varint,4,opt,name=is_terminal,json=isTerminal,proto3" json:"is_terminal,omitempty"`
-}
-
-func (x *StatCaddyStorageResponse) Reset() {
-	*x = StatCaddyStorageResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StatCaddyStorageResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StatCaddyStorageResponse) ProtoMessage() {}
-
-func (x *StatCaddyStorageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StatCaddyStorageResponse.ProtoReflect.Descriptor instead.
-func (*StatCaddyStorageResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *StatCaddyStorageResponse) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *StatCaddyStorageResponse) GetUpdatedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.UpdatedAt
-	}
-	return nil
-}
-
-func (x *StatCaddyStorageResponse) GetSize() int64 {
-	if x != nil {
-		return x.Size
-	}
-	return 0
-}
-
-func (x *StatCaddyStorageResponse) GetIsTerminal() bool {
-	if x != nil {
-		return x.IsTerminal
-	}
-	return false
-}
-
-type ListCertificatesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Certificates []*IssuedCertificate `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
-}
-
-func (x *ListCertificatesResponse) Reset() {
-	*x = ListCertificatesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListCertificatesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListCertificatesResponse) ProtoMessage() {}
-
-func (x *ListCertificatesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListCertificatesResponse.ProtoReflect.Descriptor instead.
-func (*ListCertificatesResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *ListCertificatesResponse) GetCertificates() []*IssuedCertificate {
-	if x != nil {
-		return x.Certificates
-	}
-	return nil
-}
-
-type IssuedCertificate struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
-	San string `protobuf:"bytes,1,opt,name=san,proto3" json:"san,omitempty"`
-	// The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
-	Chain []byte `protobuf:"bytes,2,opt,name=chain,proto3" json:"chain,omitempty"`
-	// Any extra information associated with the certificate, usually provided by the issuer implementation.
-	// JSON-encoded, may be absent or null.
-	IssuerData []byte `protobuf:"bytes,3,opt,name=issuer_data,json=issuerData,proto3" json:"issuer_data,omitempty"`
-}
-
-func (x *IssuedCertificate) Reset() {
-	*x = IssuedCertificate{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *IssuedCertificate) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*IssuedCertificate) ProtoMessage() {}
-
-func (x *IssuedCertificate) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use IssuedCertificate.ProtoReflect.Descriptor instead.
-func (*IssuedCertificate) Descriptor() ([]byte, []int) {
-	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{9}
-}
-
-func (x *IssuedCertificate) GetSan() string {
-	if x != nil {
-		return x.San
-	}
-	return ""
-}
-
-func (x *IssuedCertificate) GetChain() []byte {
-	if x != nil {
-		return x.Chain
-	}
-	return nil
-}
-
-func (x *IssuedCertificate) GetIssuerData() []byte {
-	if x != nil {
-		return x.IssuerData
-	}
-	return nil
-}
-
-var File_api_pb_caddy_storage_proto protoreflect.FileDescriptor
-
-var file_api_pb_caddy_storage_proto_rawDesc = []byte{
-	0x0a, 0x1a, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x5f, 0x73,
-	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70,
-	0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
-	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x42, 0x0a, 0x18, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
-	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x22, 0x2b, 0x0a, 0x17, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79,
-	0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x22, 0x6b, 0x0a, 0x18, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
-	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22, 0x2d, 0x0a,
-	0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x4f, 0x0a, 0x17,
-	0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69,
-	0x78, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12,
-	0x1c, 0x0a, 0x09, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x09, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x22, 0x2e, 0x0a,
-	0x18, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x65, 0x79,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0x2b, 0x0a,
-	0x17, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x9c, 0x01, 0x0a, 0x18, 0x53,
-	0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x64, 0x41, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x74,
-	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69,
-	0x73, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x22, 0x56, 0x0a, 0x18, 0x4c, 0x69, 0x73,
-	0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3a, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x73, 0x22, 0x5c, 0x0a, 0x11, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x61, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x61, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x1f,
-	0x0a, 0x0b, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x32,
-	0xaa, 0x03, 0x0a, 0x0c, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x12, 0x3e, 0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x53, 0x74, 0x6f, 0x72, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x12, 0x43, 0x0a, 0x04, 0x4c, 0x6f, 0x61, 0x64, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x61,
-	0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12,
-	0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64,
-	0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12,
-	0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53,
-	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
-	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x04,
-	0x53, 0x74, 0x61, 0x74, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43,
-	0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64,
-	0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x49, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70,
-	0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_api_pb_caddy_storage_proto_rawDescOnce sync.Once
-	file_api_pb_caddy_storage_proto_rawDescData = file_api_pb_caddy_storage_proto_rawDesc
-)
-
-func file_api_pb_caddy_storage_proto_rawDescGZIP() []byte {
-	file_api_pb_caddy_storage_proto_rawDescOnce.Do(func() {
-		file_api_pb_caddy_storage_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_caddy_storage_proto_rawDescData)
-	})
-	return file_api_pb_caddy_storage_proto_rawDescData
-}
-
-var file_api_pb_caddy_storage_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
-var file_api_pb_caddy_storage_proto_goTypes = []any{
-	(*StoreCaddyStorageRequest)(nil),  // 0: api.StoreCaddyStorageRequest
-	(*LoadCaddyStorageRequest)(nil),   // 1: api.LoadCaddyStorageRequest
-	(*LoadCaddyStorageResponse)(nil),  // 2: api.LoadCaddyStorageResponse
-	(*DeleteCaddyStorageRequest)(nil), // 3: api.DeleteCaddyStorageRequest
-	(*ListCaddyStorageRequest)(nil),   // 4: api.ListCaddyStorageRequest
-	(*ListCaddyStorageResponse)(nil),  // 5: api.ListCaddyStorageResponse
-	(*StatCaddyStorageRequest)(nil),   // 6: api.StatCaddyStorageRequest
-	(*StatCaddyStorageResponse)(nil),  // 7: api.StatCaddyStorageResponse
-	(*ListCertificatesResponse)(nil),  // 8: api.ListCertificatesResponse
-	(*IssuedCertificate)(nil),         // 9: api.IssuedCertificate
-	(*timestamppb.Timestamp)(nil),     // 10: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),             // 11: google.protobuf.Empty
-}
-var file_api_pb_caddy_storage_proto_depIdxs = []int32{
-	10, // 0: api.LoadCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
-	10, // 1: api.StatCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
-	9,  // 2: api.ListCertificatesResponse.certificates:type_name -> api.IssuedCertificate
-	0,  // 3: api.CaddyStorage.Store:input_type -> api.StoreCaddyStorageRequest
-	1,  // 4: api.CaddyStorage.Load:input_type -> api.LoadCaddyStorageRequest
-	3,  // 5: api.CaddyStorage.Delete:input_type -> api.DeleteCaddyStorageRequest
-	4,  // 6: api.CaddyStorage.List:input_type -> api.ListCaddyStorageRequest
-	6,  // 7: api.CaddyStorage.Stat:input_type -> api.StatCaddyStorageRequest
-	11, // 8: api.CaddyStorage.ListCertificates:input_type -> google.protobuf.Empty
-	11, // 9: api.CaddyStorage.Store:output_type -> google.protobuf.Empty
-	2,  // 10: api.CaddyStorage.Load:output_type -> api.LoadCaddyStorageResponse
-	11, // 11: api.CaddyStorage.Delete:output_type -> google.protobuf.Empty
-	5,  // 12: api.CaddyStorage.List:output_type -> api.ListCaddyStorageResponse
-	7,  // 13: api.CaddyStorage.Stat:output_type -> api.StatCaddyStorageResponse
-	8,  // 14: api.CaddyStorage.ListCertificates:output_type -> api.ListCertificatesResponse
-	9,  // [9:15] is the sub-list for method output_type
-	3,  // [3:9] is the sub-list for method input_type
-	3,  // [3:3] is the sub-list for extension type_name
-	3,  // [3:3] is the sub-list for extension extendee
-	0,  // [0:3] is the sub-list for field type_name
-}
-
-func init() { file_api_pb_caddy_storage_proto_init() }
-func file_api_pb_caddy_storage_proto_init() {
-	if File_api_pb_caddy_storage_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_api_pb_caddy_storage_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*StoreCaddyStorageRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*LoadCaddyStorageRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*LoadCaddyStorageResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*DeleteCaddyStorageRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*ListCaddyStorageRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*ListCaddyStorageResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*StatCaddyStorageRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*StatCaddyStorageResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[8].Exporter = func(v any, i int) any {
-			switch v := v.(*ListCertificatesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_caddy_storage_proto_msgTypes[9].Exporter = func(v any, i int) any {
-			switch v := v.(*IssuedCertificate); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_api_pb_caddy_storage_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   10,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_api_pb_caddy_storage_proto_goTypes,
-		DependencyIndexes: file_api_pb_caddy_storage_proto_depIdxs,
-		MessageInfos:      file_api_pb_caddy_storage_proto_msgTypes,
-	}.Build()
-	File_api_pb_caddy_storage_proto = out.File
-	file_api_pb_caddy_storage_proto_rawDesc = nil
-	file_api_pb_caddy_storage_proto_goTypes = nil
-	file_api_pb_caddy_storage_proto_depIdxs = nil
-}
@@ -1,77 +0,0 @@
-syntax = "proto3";
-
-package api;
-
-option go_package = "github.com/psviderski/uncloud/api/pb";
-
-import "google/protobuf/empty.proto";
-import "google/protobuf/timestamp.proto";
-
-// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
-// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
-// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
-// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
-// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
-service CaddyStorage {
-  rpc Store(StoreCaddyStorageRequest) returns (google.protobuf.Empty);
-  rpc Load(LoadCaddyStorageRequest) returns (LoadCaddyStorageResponse);
-  rpc Delete(DeleteCaddyStorageRequest) returns (google.protobuf.Empty);
-  rpc List(ListCaddyStorageRequest) returns (ListCaddyStorageResponse);
-  rpc Stat(StatCaddyStorageRequest) returns (StatCaddyStorageResponse);
-
-  // ListCertificates lists certificates issued by Caddy and stored in the cluster store.
-  // Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
-  rpc ListCertificates(google.protobuf.Empty) returns (ListCertificatesResponse);
-}
-
-message StoreCaddyStorageRequest {
-  string key = 1;
-  bytes value = 2;
-}
-
-message LoadCaddyStorageRequest {
-  string key = 1;
-}
-
-message LoadCaddyStorageResponse {
-  bytes value = 1;
-  google.protobuf.Timestamp updated_at = 2;
-}
-
-message DeleteCaddyStorageRequest {
-  string key = 1;
-}
-
-message ListCaddyStorageRequest {
-  string prefix = 1;
-  bool recursive = 2;
-}
-
-message ListCaddyStorageResponse {
-  repeated string keys = 1;
-}
-
-message StatCaddyStorageRequest {
-  string key = 1;
-}
-
-message StatCaddyStorageResponse {
-  string key = 1;
-  google.protobuf.Timestamp updated_at = 2;
-  int64 size = 3;
-  bool is_terminal = 4;
-}
-
-message ListCertificatesResponse {
-  repeated IssuedCertificate certificates = 1;
-}
-
-message IssuedCertificate {
-  // Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
-  string san = 1;
-  // The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
-  bytes chain = 2;
-  // Any extra information associated with the certificate, usually provided by the issuer implementation.
-  // JSON-encoded, may be absent or null.
-  bytes issuer_data = 3;
-}
@@ -1,328 +0,0 @@
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.27.3
-// source: api/pb/caddy_storage.proto
-
-package pb
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	CaddyStorage_Store_FullMethodName            = "/api.CaddyStorage/Store"
-	CaddyStorage_Load_FullMethodName             = "/api.CaddyStorage/Load"
-	CaddyStorage_Delete_FullMethodName           = "/api.CaddyStorage/Delete"
-	CaddyStorage_List_FullMethodName             = "/api.CaddyStorage/List"
-	CaddyStorage_Stat_FullMethodName             = "/api.CaddyStorage/Stat"
-	CaddyStorage_ListCertificates_FullMethodName = "/api.CaddyStorage/ListCertificates"
-)
-
-// CaddyStorageClient is the client API for CaddyStorage service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
-// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
-// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
-// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
-// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
-type CaddyStorageClient interface {
-	Store(ctx context.Context, in *StoreCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	Load(ctx context.Context, in *LoadCaddyStorageRequest, opts ...grpc.CallOption) (*LoadCaddyStorageResponse, error)
-	Delete(ctx context.Context, in *DeleteCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	List(ctx context.Context, in *ListCaddyStorageRequest, opts ...grpc.CallOption) (*ListCaddyStorageResponse, error)
-	Stat(ctx context.Context, in *StatCaddyStorageRequest, opts ...grpc.CallOption) (*StatCaddyStorageResponse, error)
-	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
-	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
-	ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error)
-}
-
-type caddyStorageClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewCaddyStorageClient(cc grpc.ClientConnInterface) CaddyStorageClient {
-	return &caddyStorageClient{cc}
-}
-
-func (c *caddyStorageClient) Store(ctx context.Context, in *StoreCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, CaddyStorage_Store_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *caddyStorageClient) Load(ctx context.Context, in *LoadCaddyStorageRequest, opts ...grpc.CallOption) (*LoadCaddyStorageResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(LoadCaddyStorageResponse)
-	err := c.cc.Invoke(ctx, CaddyStorage_Load_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *caddyStorageClient) Delete(ctx context.Context, in *DeleteCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, CaddyStorage_Delete_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *caddyStorageClient) List(ctx context.Context, in *ListCaddyStorageRequest, opts ...grpc.CallOption) (*ListCaddyStorageResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListCaddyStorageResponse)
-	err := c.cc.Invoke(ctx, CaddyStorage_List_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *caddyStorageClient) Stat(ctx context.Context, in *StatCaddyStorageRequest, opts ...grpc.CallOption) (*StatCaddyStorageResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(StatCaddyStorageResponse)
-	err := c.cc.Invoke(ctx, CaddyStorage_Stat_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *caddyStorageClient) ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListCertificatesResponse)
-	err := c.cc.Invoke(ctx, CaddyStorage_ListCertificates_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// CaddyStorageServer is the server API for CaddyStorage service.
-// All implementations must embed UnimplementedCaddyStorageServer
-// for forward compatibility.
-//
-// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
-// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
-// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
-// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
-// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
-type CaddyStorageServer interface {
-	Store(context.Context, *StoreCaddyStorageRequest) (*emptypb.Empty, error)
-	Load(context.Context, *LoadCaddyStorageRequest) (*LoadCaddyStorageResponse, error)
-	Delete(context.Context, *DeleteCaddyStorageRequest) (*emptypb.Empty, error)
-	List(context.Context, *ListCaddyStorageRequest) (*ListCaddyStorageResponse, error)
-	Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error)
-	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
-	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
-	ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error)
-	mustEmbedUnimplementedCaddyStorageServer()
-}
-
-// UnimplementedCaddyStorageServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedCaddyStorageServer struct{}
-
-func (UnimplementedCaddyStorageServer) Store(context.Context, *StoreCaddyStorageRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Store not implemented")
-}
-func (UnimplementedCaddyStorageServer) Load(context.Context, *LoadCaddyStorageRequest) (*LoadCaddyStorageResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Load not implemented")
-}
-func (UnimplementedCaddyStorageServer) Delete(context.Context, *DeleteCaddyStorageRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
-}
-func (UnimplementedCaddyStorageServer) List(context.Context, *ListCaddyStorageRequest) (*ListCaddyStorageResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
-}
-func (UnimplementedCaddyStorageServer) Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Stat not implemented")
-}
-func (UnimplementedCaddyStorageServer) ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListCertificates not implemented")
-}
-func (UnimplementedCaddyStorageServer) mustEmbedUnimplementedCaddyStorageServer() {}
-func (UnimplementedCaddyStorageServer) testEmbeddedByValue()                      {}
-
-// UnsafeCaddyStorageServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to CaddyStorageServer will
-// result in compilation errors.
-type UnsafeCaddyStorageServer interface {
-	mustEmbedUnimplementedCaddyStorageServer()
-}
-
-func RegisterCaddyStorageServer(s grpc.ServiceRegistrar, srv CaddyStorageServer) {
-	// If the following call pancis, it indicates UnimplementedCaddyStorageServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&CaddyStorage_ServiceDesc, srv)
-}
-
-func _CaddyStorage_Store_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(StoreCaddyStorageRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).Store(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_Store_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).Store(ctx, req.(*StoreCaddyStorageRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _CaddyStorage_Load_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoadCaddyStorageRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).Load(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_Load_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).Load(ctx, req.(*LoadCaddyStorageRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _CaddyStorage_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteCaddyStorageRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).Delete(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_Delete_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).Delete(ctx, req.(*DeleteCaddyStorageRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _CaddyStorage_List_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListCaddyStorageRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).List(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_List_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).List(ctx, req.(*ListCaddyStorageRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _CaddyStorage_Stat_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(StatCaddyStorageRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).Stat(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_Stat_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).Stat(ctx, req.(*StatCaddyStorageRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _CaddyStorage_ListCertificates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(CaddyStorageServer).ListCertificates(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: CaddyStorage_ListCertificates_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(CaddyStorageServer).ListCertificates(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// CaddyStorage_ServiceDesc is the grpc.ServiceDesc for CaddyStorage service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var CaddyStorage_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "api.CaddyStorage",
-	HandlerType: (*CaddyStorageServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Store",
-			Handler:    _CaddyStorage_Store_Handler,
-		},
-		{
-			MethodName: "Load",
-			Handler:    _CaddyStorage_Load_Handler,
-		},
-		{
-			MethodName: "Delete",
-			Handler:    _CaddyStorage_Delete_Handler,
-		},
-		{
-			MethodName: "List",
-			Handler:    _CaddyStorage_List_Handler,
-		},
-		{
-			MethodName: "Stat",
-			Handler:    _CaddyStorage_Stat_Handler,
-		},
-		{
-			MethodName: "ListCertificates",
-			Handler:    _CaddyStorage_ListCertificates_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "api/pb/caddy_storage.proto",
-}
@@ -1,786 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.34.2
-// 	protoc        v5.27.3
-// source: api/pb/common.proto
-
-package pb
-
-import (
-	status "google.golang.org/genproto/googleapis/rpc/status"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type LogEntry_StreamType int32
-
-const (
-	LogEntry_UNKNOWN   LogEntry_StreamType = 0
-	LogEntry_STDOUT    LogEntry_StreamType = 1
-	LogEntry_STDERR    LogEntry_StreamType = 2
-	LogEntry_HEARTBEAT LogEntry_StreamType = 3
-)
-
-// Enum value maps for LogEntry_StreamType.
-var (
-	LogEntry_StreamType_name = map[int32]string{
-		0: "UNKNOWN",
-		1: "STDOUT",
-		2: "STDERR",
-		3: "HEARTBEAT",
-	}
-	LogEntry_StreamType_value = map[string]int32{
-		"UNKNOWN":   0,
-		"STDOUT":    1,
-		"STDERR":    2,
-		"HEARTBEAT": 3,
-	}
-)
-
-func (x LogEntry_StreamType) Enum() *LogEntry_StreamType {
-	p := new(LogEntry_StreamType)
-	*p = x
-	return p
-}
-
-func (x LogEntry_StreamType) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (LogEntry_StreamType) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_pb_common_proto_enumTypes[0].Descriptor()
-}
-
-func (LogEntry_StreamType) Type() protoreflect.EnumType {
-	return &file_api_pb_common_proto_enumTypes[0]
-}
-
-func (x LogEntry_StreamType) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use LogEntry_StreamType.Descriptor instead.
-func (LogEntry_StreamType) EnumDescriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{7, 0}
-}
-
-// Common metadata message nested in all reply message types, injected by the gRPC proxy to provide information
-// about the machine that responded to the request.
-type Metadata struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// ID of the machine the response came from.
-	MachineId string `protobuf:"bytes,4,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
-	// Name of the machine the response came from.
-	MachineName string `protobuf:"bytes,5,opt,name=machine_name,json=machineName,proto3" json:"machine_name,omitempty"`
-	// Address of the machine the response came from.
-	MachineAddr string `protobuf:"bytes,1,opt,name=machine_addr,json=machineAddr,proto3" json:"machine_addr,omitempty"`
-	// error is set if the request to upstream failed. The rest of the response is undefined.
-	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
-	// error as a gRPC Status message.
-	Status *status.Status `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
-}
-
-func (x *Metadata) Reset() {
-	*x = Metadata{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Metadata) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Metadata) ProtoMessage() {}
-
-func (x *Metadata) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
-func (*Metadata) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *Metadata) GetMachineId() string {
-	if x != nil {
-		return x.MachineId
-	}
-	return ""
-}
-
-func (x *Metadata) GetMachineName() string {
-	if x != nil {
-		return x.MachineName
-	}
-	return ""
-}
-
-func (x *Metadata) GetMachineAddr() string {
-	if x != nil {
-		return x.MachineAddr
-	}
-	return ""
-}
-
-func (x *Metadata) GetError() string {
-	if x != nil {
-		return x.Error
-	}
-	return ""
-}
-
-func (x *Metadata) GetStatus() *status.Status {
-	if x != nil {
-		return x.Status
-	}
-	return nil
-}
-
-// A helper message for marshalling the metadata field and injecting it into the response by the gRPC proxy.
-type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-}
-
-func (x *Empty) Reset() {
-	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Empty) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Empty) ProtoMessage() {}
-
-func (x *Empty) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Empty.ProtoReflect.Descriptor instead.
-func (*Empty) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *Empty) GetMetadata() *Metadata {
-	if x != nil {
-		return x.Metadata
-	}
-	return nil
-}
-
-// EmptyResponse is a response message to be returned by the gRPC proxy when a request to the upstream failed.
-// The nested Empty.Metadata message should contain an error.
-type EmptyResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Messages []*Empty `protobuf:"bytes,1,rep,name=messages,proto3" json:"messages,omitempty"`
-}
-
-func (x *EmptyResponse) Reset() {
-	*x = EmptyResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *EmptyResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*EmptyResponse) ProtoMessage() {}
-
-func (x *EmptyResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use EmptyResponse.ProtoReflect.Descriptor instead.
-func (*EmptyResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *EmptyResponse) GetMessages() []*Empty {
-	if x != nil {
-		return x.Messages
-	}
-	return nil
-}
-
-type IP struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
-}
-
-func (x *IP) Reset() {
-	*x = IP{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *IP) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*IP) ProtoMessage() {}
-
-func (x *IP) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use IP.ProtoReflect.Descriptor instead.
-func (*IP) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *IP) GetIp() []byte {
-	if x != nil {
-		return x.Ip
-	}
-	return nil
-}
-
-type IPPort struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Ip   *IP    `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
-	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
-}
-
-func (x *IPPort) Reset() {
-	*x = IPPort{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *IPPort) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*IPPort) ProtoMessage() {}
-
-func (x *IPPort) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use IPPort.ProtoReflect.Descriptor instead.
-func (*IPPort) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *IPPort) GetIp() *IP {
-	if x != nil {
-		return x.Ip
-	}
-	return nil
-}
-
-func (x *IPPort) GetPort() uint32 {
-	if x != nil {
-		return x.Port
-	}
-	return 0
-}
-
-type IPPrefix struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Ip   *IP    `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
-	Bits uint32 `protobuf:"varint,2,opt,name=bits,proto3" json:"bits,omitempty"`
-}
-
-func (x *IPPrefix) Reset() {
-	*x = IPPrefix{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *IPPrefix) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*IPPrefix) ProtoMessage() {}
-
-func (x *IPPrefix) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use IPPrefix.ProtoReflect.Descriptor instead.
-func (*IPPrefix) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *IPPrefix) GetIp() *IP {
-	if x != nil {
-		return x.Ip
-	}
-	return nil
-}
-
-func (x *IPPrefix) GetBits() uint32 {
-	if x != nil {
-		return x.Bits
-	}
-	return 0
-}
-
-type LogsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	// Options for logs retrieval.
-	Follow bool   `protobuf:"varint,2,opt,name=follow,proto3" json:"follow,omitempty"`
-	Tail   int32  `protobuf:"varint,3,opt,name=tail,proto3" json:"tail,omitempty"`  // -1 means all
-	Since  string `protobuf:"bytes,4,opt,name=since,proto3" json:"since,omitempty"` // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
-	Until  string `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"` // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
-}
-
-func (x *LogsRequest) Reset() {
-	*x = LogsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LogsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LogsRequest) ProtoMessage() {}
-
-func (x *LogsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LogsRequest.ProtoReflect.Descriptor instead.
-func (*LogsRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *LogsRequest) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
-func (x *LogsRequest) GetFollow() bool {
-	if x != nil {
-		return x.Follow
-	}
-	return false
-}
-
-func (x *LogsRequest) GetTail() int32 {
-	if x != nil {
-		return x.Tail
-	}
-	return 0
-}
-
-func (x *LogsRequest) GetSince() string {
-	if x != nil {
-		return x.Since
-	}
-	return ""
-}
-
-func (x *LogsRequest) GetUntil() string {
-	if x != nil {
-		return x.Until
-	}
-	return ""
-}
-
-type LogEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Stream    LogEntry_StreamType    `protobuf:"varint,1,opt,name=stream,proto3,enum=api.LogEntry_StreamType" json:"stream,omitempty"`
-	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
-	// Log line content. Empty for heartbeat entries.
-	Message []byte `protobuf:"bytes,3,opt,name=message,proto3" json:"message,omitempty"`
-}
-
-func (x *LogEntry) Reset() {
-	*x = LogEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_common_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LogEntry) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LogEntry) ProtoMessage() {}
-
-func (x *LogEntry) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_common_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LogEntry.ProtoReflect.Descriptor instead.
-func (*LogEntry) Descriptor() ([]byte, []int) {
-	return file_api_pb_common_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *LogEntry) GetStream() LogEntry_StreamType {
-	if x != nil {
-		return x.Stream
-	}
-	return LogEntry_UNKNOWN
-}
-
-func (x *LogEntry) GetTimestamp() *timestamppb.Timestamp {
-	if x != nil {
-		return x.Timestamp
-	}
-	return nil
-}
-
-func (x *LogEntry) GetMessage() []byte {
-	if x != nil {
-		return x.Message
-	}
-	return nil
-}
-
-var File_api_pb_common_proto protoreflect.FileDescriptor
-
-var file_api_pb_common_proto_rawDesc = []byte{
-	0x0a, 0x13, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x17, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb1, 0x01, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64,
-	0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
-	0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x61,
-	0x64, 0x64, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x2a, 0x0a, 0x06,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x32, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x12, 0x29, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x37, 0x0a, 0x0d,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a,
-	0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x0a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x73,
-	0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0x14, 0x0a, 0x02, 0x49, 0x50, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x22, 0x35, 0x0a, 0x06, 0x49,
-	0x50, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x17, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12,
-	0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f,
-	0x72, 0x74, 0x22, 0x37, 0x0a, 0x08, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x17,
-	0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x49, 0x50, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x62, 0x69, 0x74, 0x73, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x62, 0x69, 0x74, 0x73, 0x22, 0x75, 0x0a, 0x0b, 0x4c,
-	0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x66, 0x6f,
-	0x6c, 0x6c, 0x6f, 0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x66, 0x6f, 0x6c, 0x6c,
-	0x6f, 0x77, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x04, 0x74, 0x61, 0x69, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05,
-	0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x75, 0x6e, 0x74,
-	0x69, 0x6c, 0x22, 0xd2, 0x01, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x30, 0x0a, 0x06, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53,
-	0x74, 0x72, 0x65, 0x61, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x52, 0x06, 0x73, 0x74, 0x72, 0x65, 0x61,
-	0x6d, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x18, 0x0a, 0x07, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x40, 0x0a, 0x0a, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00,
-	0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x44, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06,
-	0x53, 0x54, 0x44, 0x45, 0x52, 0x52, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x45, 0x41, 0x52,
-	0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x03, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69,
-	0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_api_pb_common_proto_rawDescOnce sync.Once
-	file_api_pb_common_proto_rawDescData = file_api_pb_common_proto_rawDesc
-)
-
-func file_api_pb_common_proto_rawDescGZIP() []byte {
-	file_api_pb_common_proto_rawDescOnce.Do(func() {
-		file_api_pb_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_common_proto_rawDescData)
-	})
-	return file_api_pb_common_proto_rawDescData
-}
-
-var file_api_pb_common_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_api_pb_common_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_api_pb_common_proto_goTypes = []any{
-	(LogEntry_StreamType)(0),      // 0: api.LogEntry.StreamType
-	(*Metadata)(nil),              // 1: api.Metadata
-	(*Empty)(nil),                 // 2: api.Empty
-	(*EmptyResponse)(nil),         // 3: api.EmptyResponse
-	(*IP)(nil),                    // 4: api.IP
-	(*IPPort)(nil),                // 5: api.IPPort
-	(*IPPrefix)(nil),              // 6: api.IPPrefix
-	(*LogsRequest)(nil),           // 7: api.LogsRequest
-	(*LogEntry)(nil),              // 8: api.LogEntry
-	(*status.Status)(nil),         // 9: google.rpc.Status
-	(*timestamppb.Timestamp)(nil), // 10: google.protobuf.Timestamp
-}
-var file_api_pb_common_proto_depIdxs = []int32{
-	9,  // 0: api.Metadata.status:type_name -> google.rpc.Status
-	1,  // 1: api.Empty.metadata:type_name -> api.Metadata
-	2,  // 2: api.EmptyResponse.messages:type_name -> api.Empty
-	4,  // 3: api.IPPort.ip:type_name -> api.IP
-	4,  // 4: api.IPPrefix.ip:type_name -> api.IP
-	0,  // 5: api.LogEntry.stream:type_name -> api.LogEntry.StreamType
-	10, // 6: api.LogEntry.timestamp:type_name -> google.protobuf.Timestamp
-	7,  // [7:7] is the sub-list for method output_type
-	7,  // [7:7] is the sub-list for method input_type
-	7,  // [7:7] is the sub-list for extension type_name
-	7,  // [7:7] is the sub-list for extension extendee
-	0,  // [0:7] is the sub-list for field type_name
-}
-
-func init() { file_api_pb_common_proto_init() }
-func file_api_pb_common_proto_init() {
-	if File_api_pb_common_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_api_pb_common_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*Metadata); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*EmptyResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*IP); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*IPPort); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*IPPrefix); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*LogsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_common_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*LogEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_api_pb_common_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   8,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_api_pb_common_proto_goTypes,
-		DependencyIndexes: file_api_pb_common_proto_depIdxs,
-		EnumInfos:         file_api_pb_common_proto_enumTypes,
-		MessageInfos:      file_api_pb_common_proto_msgTypes,
-	}.Build()
-	File_api_pb_common_proto = out.File
-	file_api_pb_common_proto_rawDesc = nil
-	file_api_pb_common_proto_goTypes = nil
-	file_api_pb_common_proto_depIdxs = nil
-}
@@ -1,206 +0,0 @@
-syntax = "proto3";
-
-package api;
-
-option go_package = "github.com/psviderski/uncloud/api/pb";
-
-import "google/protobuf/duration.proto";
-import "google/protobuf/empty.proto";
-import "google/protobuf/timestamp.proto";
-import "api/pb/common.proto";
-
-service Machine {
-  // CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
-  rpc CheckPrerequisites(google.protobuf.Empty) returns (CheckPrerequisitesResponse);
-  rpc InitCluster(InitClusterRequest) returns (InitClusterResponse);
-  rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
-  rpc Token(google.protobuf.Empty) returns (TokenResponse);
-  // Deprecated: use InspectMachine instead.
-  rpc Inspect(google.protobuf.Empty) returns (MachineInfo);
-  // InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
-  rpc InspectMachine(google.protobuf.Empty) returns (InspectMachineResponse);
-  // WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
-  // no known missing or pending transactions through those versions from active members.
-  // Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
-  // have been superseded.
-  //
-  // Waiting normally makes the captured data available on this machine. However, another write may replace some of that
-  // data before it arrives. Corrosion can then complete the older version without transferring the replaced data.
-  // If the replacement is outside the requested versions, this RPC can succeed while the affected data is still missing
-  // or outdated. This can happen during concurrent updates even when all machines are well connected.
-  //
-  // Success does not guarantee an exact snapshot or delivery of every historical value. Callers that require a specific
-  // record or condition should verify it after waiting.
-  //
-  // This RPC observes native replication without initiating synchronisation.
-  // Use the RPC deadline to bound the wait.
-  rpc WaitForStoreVersion(WaitForStoreVersionRequest) returns (google.protobuf.Empty);
-  // UpdateMachine updates the configuration of the machine.
-  rpc UpdateMachine(UpdateMachineRequest) returns (UpdateMachineResponse);
-  // InspectWireGuardNetwork retrieves the current WireGuard network configuration and peer status.
-  rpc InspectWireGuardNetwork(google.protobuf.Empty) returns (InspectWireGuardNetworkResponse);
-  // Reset restores the machine to a clean state, removing all cluster-related configuration and data.
-  rpc Reset(ResetRequest) returns (google.protobuf.Empty);
-
-  rpc InspectService(InspectServiceRequest) returns (InspectServiceResponse);
-
-  rpc MachineLogs(LogsRequest) returns (stream LogEntry);
-}
-
-message MachineInfo {
-  string id = 1;
-  string name = 2;
-  NetworkConfig network = 3;
-  IP public_ip = 4;
-  // Version of the machine daemon (uncloudd).
-  string daemon_version = 7;
-  // Version of the Docker engine running on the machine. Could be empty if unable to get.
-  string docker_version = 8;
-
-  // Operating system hostname.
-  string hostname = 5;
-  // CPU architecture.
-  string arch = 6;
-  // Human-readable operating system name and version, e.g. "Ubuntu 24.04.4 LTS". Empty if cannot be determined.
-  string os_pretty_name = 9;
-  // Kernel release version, e.g. "6.8.0-31-generic".
-  string kernel_version = 10;
-}
-
-message NetworkConfig {
-  IPPrefix subnet = 1;
-  IP management_ip = 2;
-  repeated IPPort endpoints = 3;
-  bytes public_key = 4;
-}
-
-message UpdateMachineRequest {
-  // Updated machine information. Only the set fields are applied.
-  optional string name = 1;
-  optional IP public_ip = 2;
-  repeated IPPort endpoints = 3;
-}
-
-message UpdateMachineResponse {
-  MachineInfo machine = 1;
-}
-
-message CheckPrerequisitesResponse {
-  // Overall status of the checks.
-  bool satisfied = 1;
-  // Error message if not satisfied (empty if all checks pass).
-  string error = 2;
-}
-
-message InitClusterRequest {
-  string machineName = 1;
-  IPPrefix network = 2;
-
-  oneof public_ip_config {
-    IP public_ip = 3;
-    bool public_ip_auto = 4;
-  }
-
-  // Optional WireGuard endpoints other machines will use to connect to this machine instead of auto-discovered ones.
-  repeated IPPort wireguard_endpoints = 5;
-  // WireGuard listen port for this machine. Uses the default port (51820) if 0 or not set.
-  int32 wireguard_port = 6;
-  // MTU of the WireGuard interface on this machine. The daemon auto-detects the optimal MTU if 0 or not set.
-  int32 wireguard_mtu = 7;
-}
-
-message InitClusterResponse {
-  MachineInfo machine = 1;
-}
-
-message JoinClusterRequest {
-  MachineInfo machine = 1;
-  repeated MachineInfo other_machines = 3;
-  // WireGuard listen port for this machine. Uses the default port (51820) if 0 or not set.
-  int32 wireguard_port = 5;
-  // MTU of the WireGuard interface on this machine. The daemon auto-detects the optimal MTU if 0 or not set.
-  int32 wireguard_mtu = 7;
-  // Cluster store version this machine must reach before participating.
-  // Per-actor vector (Corrosion actor UUID → minimum required db_version).
-  map<string, uint64> min_store_version = 6;
-}
-
-message InspectMachineResponse {
-  // Must contain only one repeated messages field to allow broadcasting InspectMachine requests to multiple machines.
-  repeated MachineDetails machines = 1;
-}
-
-message MachineDetails {
-  Metadata metadata = 1;
-  MachineInfo machine = 2;
-  // Round-trip times to other machines in the cluster, keyed by peer machine ID.
-  map<string, RTTStats> rtts = 4;
-  // Store replication progress observed on this machine.
-  // Maps each Corrosion actor UUID to its highest processed database version. Corrosion also counts versions whose
-  // changes were superseded and skipped. Versions at or below a reported version may still be missing or pending
-  // locally.
-  //
-  // Pass this vector to WaitForStoreVersion on another machine to wait for replication through these versions.
-  // See that RPC's data-availability limitations. To combine observations from several machines, take the maximum
-  // for each actor.
-  // Capturing this vector does not wait for replication or prevent further writes.
-  map<string, uint64> store_version = 5;
-}
-
-message WaitForStoreVersionRequest {
-  // Minimum database version to reach for each Corrosion actor UUID.
-  // Obtain a vector from InspectMachine. To combine several responses, take the maximum version for each actor.
-  // Actors omitted from this vector and versions above its targets are not awaited. An empty vector requires
-  // no replication. Unknown actors with positive targets remain pending until replication reaches them or the RPC ends.
-  map<string, uint64> min_version = 1;
-}
-
-message TokenResponse {
-  string token = 1;
-}
-
-message ResetRequest {
-}
-
-message Service {
-  string id = 1;
-  string name = 2;
-  string mode = 3;
-
-  message Container {
-    string machine_id = 1;
-    // JSON encoded Docker types.Container.
-    bytes container = 2;
-  }
-
-  repeated Container containers = 4;
-}
-
-message InspectServiceRequest {
-  string id = 1;
-}
-
-message InspectServiceResponse {
-  Service service = 1;
-}
-
-message InspectWireGuardNetworkResponse {
-  string interface_name = 1;
-  bytes public_key = 2;
-  int32 listen_port = 3;
-  repeated WireGuardPeer peers = 4;
-}
-
-message WireGuardPeer {
-  bytes public_key = 1;
-  string endpoint = 2;
-  google.protobuf.Timestamp last_handshake_time = 3;
-  int64 receive_bytes = 4;
-  int64 transmit_bytes = 5;
-  repeated string allowed_ips = 6;
-}
-
-message RTTStats {
-  google.protobuf.Duration median = 1;
-  google.protobuf.Duration std_dev = 2;
-}
@@ -1,4 +0,0 @@
- _   _  ___
-| | | |/ __|
-| |_| | (__
- \__,_|\___|
@@ -1,119 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	composecli "github.com/compose-spec/compose-go/v2/cli"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/spf13/cobra"
-)
-
-type buildOptions struct {
-	cli.BuildServicesOptions
-	files    []string
-	profiles []string
-}
-
-// NewBuildCommand creates a new command to build images for services from a Compose file.
-func NewBuildCommand() *cobra.Command {
-	opts := buildOptions{}
-	cmd := &cobra.Command{
-		Use:   "build [FLAGS] [SERVICE...]",
-		Short: "Build services from a Compose file.",
-		Long: `Build images for services from a Compose file using local Docker.
-
-By default, built images remain on the local Docker host. Use --push to upload them
-to cluster machines or --push-registry to upload them to external registries.`,
-		Example: `  # Build all services that have a build section in compose.yaml.
-  uc build
-
-  # Build specific services that have a build section.
-  uc build web api
-
-  # Build services and push images to all cluster machines or service x-machines if specified.
-  uc build --push
-
-  # Build services and push images to specific machines.
-  uc build --push -m machine1,machine2
-
-  # Build services and push images to external registries (e.g., Docker Hub).
-  uc build --push-registry
-
-  # Build services with build arguments, pull newer base images before building, and don't use cache.
-  uc build --build-arg NODE_VERSION=24 --build-arg ENV=production --no-cache --pull`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.Services = args
-
-			return runBuild(cmd.Context(), uncli, opts)
-		},
-		GroupID: "service",
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			return completion.ComposeServices(cmd.Context(), args, toComplete, opts.files, opts.profiles)
-		},
-	}
-
-	cmd.Flags().StringArrayVar(&opts.BuildArgs, "build-arg", nil,
-		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
-			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
-	cmd.Flags().BoolVar(&opts.Check, "check", false,
-		"Check the build configuration for services without building them.")
-	cmd.Flags().BoolVar(&opts.Deps, "deps", false,
-		"Also build services declared as dependencies of the selected services.")
-	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
-		"One or more Compose files to build. (default compose.yaml)")
-	cmd.Flags().StringSliceVarP(&opts.Machines, "machine", "m", nil,
-		"Machine names or IDs to push the built images to (requires --push).\n"+
-			"Can be specified multiple times or as a comma-separated list. (default is all machines or x-machines)")
-	cmd.Flags().BoolVar(&opts.NoCache, "no-cache", false,
-		"Do not use cache when building images.")
-	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
-		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVar(&opts.Pull, "pull", false,
-		"Always attempt to pull newer versions of base images before building.")
-	cmd.Flags().BoolVar(&opts.PushCluster, "push", false,
-		"Upload the built images to cluster machines after building.\n"+
-			"Use --machine to specify which machines. (default is all machines)")
-	cmd.Flags().BoolVar(&opts.PushRegistry, "push-registry", false,
-		"Upload the built images to external registries (e.g., Docker Hub) after building.")
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-// runBuild parses the Compose file(s) and builds the images for selected services.
-func runBuild(ctx context.Context, uncli *cli.CLI, opts buildOptions) error {
-	// Validate push flags.
-	if opts.PushCluster && opts.PushRegistry {
-		return fmt.Errorf("cannot specify both --push and --push-registry: choose one push target")
-	}
-
-	machines := cli.ExpandCommaSeparatedValues(opts.Machines)
-	// Special handling for an explicit "all" keyword to push to all machines.
-	if len(machines) == 1 && machines[0] == "all" {
-		machines = nil
-	}
-	opts.Machines = machines
-
-	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
-	if err != nil {
-		return fmt.Errorf("load compose file(s): %w", err)
-	}
-
-	uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
-
-	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.Services, opts.Deps)
-	if err != nil {
-		return fmt.Errorf("determine services to build: %w", err)
-	}
-	if len(servicesToBuild) == 0 {
-		fmt.Println("No services to build.")
-		return nil
-	}
-
-	return uncli.BuildServices(ctx, project, opts.BuildServicesOptions)
-}
@@ -1,167 +0,0 @@
-package cert
-
-import (
-	"context"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"slices"
-	"strings"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/caddyserver/certmagic"
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type listOptions struct {
-	machine string
-	output  string
-}
-
-func NewListCommand() *cobra.Command {
-	opts := listOptions{}
-	cmd := &cobra.Command{
-		Use:     "ls",
-		Aliases: []string{"list"},
-		Short:   "List certificates in cluster storage for Caddy.",
-		Long: `List certificates stored in the Uncloud cluster storage for Caddy.
-
-Caddy must use the Uncloud storage module (https://github.com/unlabs-dev/caddy-uncloud)
-configured with 'storage uncloud' in the global options for its certificates to appear here.
-
-This inventory does not check whether Caddy currently serves or trusts a certificate.`,
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Name or ID of the machine to read certificate storage from. (default is connected machine)")
-	cmd.Flags().StringVarP(&opts.output, "output", "o", "",
-		"Output format: 'json' or empty for a human-readable table.")
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	if opts.output != "" && opts.output != "json" {
-		return fmt.Errorf("unsupported output format '%s' (supported: json)", opts.output)
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	certs, listErr := clusterClient.Caddy.ListCertificates(ctx,
-		client.CaddyListCertificatesOptions{Machine: opts.machine})
-	if len(certs) > 0 || listErr == nil {
-		if err = printCertificates(os.Stdout, certs, opts.output); err != nil {
-			return fmt.Errorf("print Caddy certificates: %w", err)
-		}
-	}
-	if listErr != nil {
-		if len(certs) > 0 {
-			return fmt.Errorf("certificate list is partial: %w", listErr)
-		}
-		return fmt.Errorf("list Caddy certificates: %w", listErr)
-	}
-
-	return nil
-}
-
-func printCertificates(out io.Writer, certs []api.IssuedCertificate, output string) error {
-	type certificate struct {
-		api.IssuedCertificate
-		Fingerprint string
-	}
-
-	items := make([]certificate, 0, len(certs))
-	for _, cert := range certs {
-		fingerprint := cert.Fingerprint()
-		items = append(items, certificate{
-			IssuedCertificate: cert,
-			Fingerprint:       hex.EncodeToString(fingerprint[:]),
-		})
-	}
-	slices.SortFunc(items, func(a, b certificate) int {
-		if cmp := strings.Compare(a.SAN, b.SAN); cmp != 0 {
-			return cmp
-		}
-		if cmp := a.Chain[0].NotAfter.Compare(b.Chain[0].NotAfter); cmp != 0 {
-			return cmp
-		}
-		return strings.Compare(a.Fingerprint, b.Fingerprint)
-	})
-
-	if output == "json" {
-		encoder := json.NewEncoder(out)
-		encoder.SetIndent("", "  ")
-		if err := encoder.Encode(items); err != nil {
-			return fmt.Errorf("marshal certificates: %w", err)
-		}
-		return nil
-	}
-
-	if len(items) == 0 {
-		_, err := fmt.Fprintln(out, "No Caddy certificates found in cluster storage.")
-		return err
-	}
-
-	t := tui.NewTable()
-	t.Headers("ID", "NAME", "ISSUER", "EXPIRES")
-	for _, item := range items {
-		t.Row(
-			item.Fingerprint[:12],
-			item.SAN,
-			formatIssuer(item.IssuerData),
-			formatExpiry(item.Chain[0].NotAfter),
-		)
-	}
-	_, err := lipgloss.Fprintln(out, t)
-	return err
-}
-
-func formatIssuer(data api.CertificateIssuerData) string {
-	if data.ACME == nil {
-		return "unknown"
-	}
-
-	switch data.ACME.CA {
-	case certmagic.LetsEncryptProductionCA:
-		return "Let's Encrypt"
-	case certmagic.LetsEncryptStagingCA:
-		return "Let's Encrypt (staging)"
-	case certmagic.ZeroSSLProductionCA:
-		return "ZeroSSL"
-	case certmagic.GoogleTrustProductionCA:
-		return "Google Trust Services"
-	case certmagic.GoogleTrustStagingCA:
-		return "Google Trust Services (staging)"
-	default:
-		return data.ACME.CA
-	}
-}
-
-func formatExpiry(expires time.Time) string {
-	delta := expires.Sub(time.Now())
-	if delta <= 0 {
-		return fmt.Sprintf("%s (expired %s ago)", expires.UTC().Format(time.DateOnly),
-			strings.ToLower(units.HumanDuration(-delta)))
-	}
-	return fmt.Sprintf("%s (%s)", expires.UTC().Format(time.DateOnly),
-		strings.ToLower(units.HumanDuration(delta)))
-}
@@ -1,128 +0,0 @@
-package cert
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/hex"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/caddyserver/certmagic"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPrintCertificates(t *testing.T) {
-	now := time.Now().UTC().Truncate(time.Hour)
-	certs := []api.IssuedCertificate{
-		testIssuedCertificate("z.example.com", "z", now.Add(48*time.Hour), certmagic.LetsEncryptProductionCA),
-		testIssuedCertificate("a.example.com", "old", now.Add(-48*time.Hour), certmagic.LetsEncryptStagingCA),
-		testIssuedCertificate("a.example.com", "new", now.Add(72*time.Hour), "https://ca.example/directory"),
-		testIssuedCertificate("unknown.example.com", "unknown", now.Add(96*time.Hour), ""),
-	}
-
-	var table bytes.Buffer
-	require.NoError(t, printCertificates(&table, certs, ""))
-	output := table.String()
-	assert.Contains(t, output, "ID")
-	assert.Contains(t, output, "NAME")
-	assert.Contains(t, output, "ISSUER")
-	assert.Contains(t, output, "EXPIRES")
-	assert.Contains(t, output, now.Add(-48*time.Hour).Format(time.DateOnly)+" (expired ")
-	assert.Contains(t, output, now.Add(48*time.Hour).Format(time.DateOnly)+" (")
-	assert.Contains(t, output, "Let's Encrypt (staging)")
-	assert.Contains(t, output, "https://ca.example/directory")
-	assert.Less(t, strings.Index(output, now.Add(-48*time.Hour).Format(time.DateOnly)),
-		strings.Index(output, now.Add(72*time.Hour).Format(time.DateOnly)))
-	assert.Less(t, strings.Index(output, "a.example.com"), strings.Index(output, "z.example.com"))
-	assert.Contains(t, output, testFingerprint("old")[:12])
-
-	var encoded bytes.Buffer
-	require.NoError(t, printCertificates(&encoded, certs, "json"))
-	var items []struct {
-		api.IssuedCertificate
-		Fingerprint string
-	}
-	require.NoError(t, json.Unmarshal(encoded.Bytes(), &items))
-	require.Len(t, items, 4)
-	assert.Equal(t, testFingerprint("old"), items[0].Fingerprint)
-	assert.Equal(t, "a.example.com", items[0].SAN)
-	require.Len(t, items[0].Chain, 1)
-	assert.Equal(t, []byte("old"), items[0].Chain[0].Raw)
-	assert.Equal(t, now.Add(-48*time.Hour), items[0].Chain[0].NotAfter)
-	require.NotNil(t, items[0].IssuerData.ACME)
-	assert.Equal(t, certmagic.LetsEncryptStagingCA, items[0].IssuerData.ACME.CA)
-	assert.Equal(t, testFingerprint("new"), items[1].Fingerprint)
-	require.NotNil(t, items[1].IssuerData.ACME)
-	assert.Equal(t, "https://ca.example/directory", items[1].IssuerData.ACME.CA)
-	assert.Nil(t, items[2].IssuerData.ACME)
-	assert.Equal(t, "z.example.com", items[3].SAN)
-}
-
-func TestPrintCertificates_Empty(t *testing.T) {
-	for _, tt := range []struct {
-		output string
-		want   string
-	}{
-		{output: "", want: "No Caddy certificates found in cluster storage.\n"},
-		{output: "json", want: "[]\n"},
-	} {
-		var out bytes.Buffer
-		require.NoError(t, printCertificates(&out, nil, tt.output))
-		assert.Equal(t, tt.want, out.String())
-	}
-}
-
-func TestFormatIssuer(t *testing.T) {
-	for _, tt := range []struct {
-		name string
-		ca   string
-		want string
-	}{
-		{name: "production", ca: certmagic.LetsEncryptProductionCA, want: "Let's Encrypt"},
-		{name: "staging", ca: certmagic.LetsEncryptStagingCA, want: "Let's Encrypt (staging)"},
-		{name: "ZeroSSL", ca: certmagic.ZeroSSLProductionCA, want: "ZeroSSL"},
-		{name: "Google Trust Services", ca: certmagic.GoogleTrustProductionCA, want: "Google Trust Services"},
-		{name: "Google Trust Services staging", ca: certmagic.GoogleTrustStagingCA, want: "Google Trust Services (staging)"},
-		{name: "other", ca: "https://ca.example/directory", want: "https://ca.example/directory"},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, formatIssuer(api.CertificateIssuerData{
-				ACME: &api.ACMEIssuerData{CA: tt.ca},
-			}))
-		})
-	}
-
-	assert.Equal(t, "unknown", formatIssuer(api.CertificateIssuerData{}))
-}
-
-func TestFormatExpiry_UTC(t *testing.T) {
-	now := time.Now().UTC()
-	brisbane := time.FixedZone("AEST", 10*60*60)
-	expires := time.Date(now.Year(), now.Month(), now.Day()+3, 3, 0, 0, 0, brisbane)
-	assert.True(t, strings.HasPrefix(formatExpiry(expires), expires.UTC().Format(time.DateOnly)+" ("))
-	assert.NotEqual(t, expires.Format(time.DateOnly), expires.UTC().Format(time.DateOnly))
-	expired := now.Add(-2 * time.Hour)
-	assert.True(t, strings.HasPrefix(formatExpiry(expired), expired.UTC().Format(time.DateOnly)+" (expired "))
-	assert.Contains(t, formatExpiry(expired), " ago)")
-}
-
-func testIssuedCertificate(name, raw string, expires time.Time, ca string) api.IssuedCertificate {
-	cert := api.IssuedCertificate{
-		SAN:   name,
-		Chain: []*x509.Certificate{{Raw: []byte(raw), NotAfter: expires}},
-	}
-	if ca != "" {
-		cert.IssuerData.ACME = &api.ACMEIssuerData{CA: ca}
-	}
-	return cert
-}
-
-func testFingerprint(raw string) string {
-	sum := sha256.Sum256([]byte(raw))
-	return hex.EncodeToString(sum[:])
-}
@@ -1,12 +0,0 @@
-package cert
-
-import "github.com/spf13/cobra"
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "cert",
-		Short: "Inspect certificates in cluster storage for Caddy.",
-	}
-	cmd.AddCommand(NewListCommand())
-	return cmd
-}
@@ -1,72 +0,0 @@
-package caddy
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/alecthomas/chroma/v2/quick"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type configOptions struct {
-	machine string
-	noColor bool
-}
-
-func NewConfigCommand() *cobra.Command {
-	opts := configOptions{}
-
-	cmd := &cobra.Command{
-		Use:   "config",
-		Short: "Show the current Caddy configuration (Caddyfile).",
-		Long:  "Display the current Caddy configuration (Caddyfile) from the connected machine or a specified one.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runConfig(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Name or ID of the machine to get the configuration from. (default is connected machine)")
-	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
-		"Disable syntax highlighting for the output.")
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	config, err := clusterClient.Caddy.Config(ctx, client.CaddyConfigOptions{Machine: opts.machine})
-	if err != nil {
-		return fmt.Errorf("get Caddy config: %w", err)
-	}
-
-	// Print the Caddyfile with syntax highlighting.
-	if opts.noColor {
-		fmt.Print(config.Caddyfile)
-	} else {
-		if err = quick.Highlight(os.Stdout, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
-			// If highlighting fails, fall back to plain output.
-			fmt.Print(config.Caddyfile)
-		}
-	}
-
-	if config.LastReconciliationError != "" {
-		tui.PrintWarning(fmt.Sprintf("last Caddy config load failed: %s\nShowing the last saved Caddyfile.",
-			config.LastReconciliationError))
-	}
-
-	return nil
-}
@@ -1,29 +0,0 @@
-package caddy
-
-import (
-	"github.com/psviderski/uncloud/cmd/uc/service"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/logs"
-	"github.com/spf13/cobra"
-)
-
-func NewLogsCommand() *cobra.Command {
-	var options logs.Options
-
-	cmd := &cobra.Command{
-		Use:     "logs",
-		Aliases: []string{"log"},
-		Short:   "View caddy logs.",
-		Long: `View caddy logs.
-
-This calls "uc logs caddy", see "uc logs" for the documention.
-`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			args = append([]string{"caddy"}, args...)
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return service.RunLogs(cmd.Context(), uncli, args, options)
-		},
-	}
-	cmd.Flags().AddFlagSet(logs.Flags(&options))
-	return cmd
-}
@@ -1,103 +0,0 @@
-package context
-
-import (
-	"testing"
-
-	"github.com/spf13/cobra"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCommandArgsValidation(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		newCmd  func() *cobra.Command
-		args    []string
-		wantErr bool
-	}{
-		{
-			name:    "root accepts no args",
-			newCmd:  NewRootCommand,
-			args:    nil,
-			wantErr: false,
-		},
-		{
-			name:    "root rejects extra args",
-			newCmd:  NewRootCommand,
-			args:    []string{"extra"},
-			wantErr: true,
-		},
-		{
-			name:    "list accepts no args",
-			newCmd:  NewListCommand,
-			args:    nil,
-			wantErr: false,
-		},
-		{
-			name:    "list rejects extra args",
-			newCmd:  NewListCommand,
-			args:    []string{"extra"},
-			wantErr: true,
-		},
-		{
-			name:    "show accepts no args",
-			newCmd:  NewShowCommand,
-			args:    nil,
-			wantErr: false,
-		},
-		{
-			name:    "show rejects extra args",
-			newCmd:  NewShowCommand,
-			args:    []string{"extra"},
-			wantErr: true,
-		},
-		{
-			name:    "connection accepts no args",
-			newCmd:  NewConnectionCommand,
-			args:    nil,
-			wantErr: false,
-		},
-		{
-			name:    "connection rejects extra args",
-			newCmd:  NewConnectionCommand,
-			args:    []string{"extra"},
-			wantErr: true,
-		},
-		{
-			name:    "use accepts no args",
-			newCmd:  NewUseCommand,
-			args:    nil,
-			wantErr: false,
-		},
-		{
-			name:    "use accepts one arg",
-			newCmd:  NewUseCommand,
-			args:    []string{"prod"},
-			wantErr: false,
-		},
-		{
-			name:    "use rejects extra args",
-			newCmd:  NewUseCommand,
-			args:    []string{"prod", "extra"},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			cmd := tt.newCmd()
-			require.NotNil(t, cmd.Args)
-
-			err := cmd.Args(cmd, tt.args)
-			if tt.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-		})
-	}
-}
@@ -1,80 +0,0 @@
-package context
-
-import (
-	"fmt"
-
-	"charm.land/huh/v2"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/spf13/cobra"
-)
-
-func NewConnectionCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:     "connection",
-		Aliases: []string{"conn"},
-		Short:   "Choose a new default connection for the current context.",
-		Args:    cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return selectConnection(uncli)
-		},
-	}
-	return cmd
-}
-
-func selectConnection(uncli *cli.CLI) error {
-	if uncli.Config == nil {
-		return fmt.Errorf("connection management is not available: Uncloud configuration file is not being used")
-	}
-	if len(uncli.Config.Contexts) == 0 {
-		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
-	}
-
-	currentCtxName := uncli.Config.CurrentContext
-	currentCtx, ok := uncli.Config.Contexts[currentCtxName]
-	if !ok {
-		return fmt.Errorf("current context '%s' not found", currentCtxName)
-	}
-
-	if len(currentCtx.Connections) == 0 {
-		return fmt.Errorf("no connections found in context '%s'", currentCtxName)
-	}
-
-	var selectedConnection int
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewSelect[int]().
-				Title("Select a default connection").
-				Options(buildConnectionOptions(currentCtx.Connections)...).
-				Value(&selectedConnection),
-		),
-	)
-	if err := form.Run(); err != nil {
-		return fmt.Errorf("select connection: %w", err)
-	}
-
-	currentCtx.SetDefaultConnection(selectedConnection)
-	selected := currentCtx.Connections[0]
-
-	if err := uncli.Config.Save(); err != nil {
-		return fmt.Errorf("save config: %w", err)
-	}
-
-	fmt.Printf("Default connection for context '%s' is now '%s'.\n", currentCtxName, selected.String())
-	return nil
-}
-
-func buildConnectionOptions(connections []config.MachineConnection) []huh.Option[int] {
-	options := make([]huh.Option[int], len(connections))
-	for i, conn := range connections {
-		key := conn.String()
-		opt := huh.NewOption(key, i)
-		if i == 0 {
-			opt.Key += " (default)"
-			opt = opt.Selected(true)
-		}
-		options[i] = opt
-	}
-	return options
-}
@@ -1,36 +0,0 @@
-package context
-
-import (
-	"fmt"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-func NewShowCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "show",
-		Short: "Show current cluster context.",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return show(uncli)
-		},
-	}
-
-	return cmd
-}
-
-func show(uncli *cli.CLI) error {
-	// discard errors, only show the current context, otherwise nothing
-	if uncli.Config == nil {
-		return nil
-	}
-
-	if len(uncli.Config.Contexts) == 0 {
-		return nil
-	}
-	fmt.Println(uncli.Config.CurrentContext)
-
-	return nil
-}
@@ -1,313 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"charm.land/lipgloss/v2"
-	composecli "github.com/compose-spec/compose-go/v2/cli"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/logs"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/psviderski/uncloud/pkg/client/deploy/operation"
-	"github.com/spf13/cobra"
-)
-
-type deployOptions struct {
-	cli.BuildServicesOptions
-
-	files      []string
-	profiles   []string
-	services   []string
-	noBuild    bool
-	recreate   bool
-	skipHealth bool
-	yes        bool
-}
-
-// NewDeployCommand creates a new command to deploy services from a Compose file.
-func NewDeployCommand() *cobra.Command {
-	opts := deployOptions{}
-	cmd := &cobra.Command{
-		Use:   "deploy [FLAGS] [SERVICE...]",
-		Short: "Deploy services from a Compose file.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
-
-			return runDeploy(cmd.Context(), uncli, opts)
-		},
-		GroupID: "service",
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			return completion.ComposeServices(cmd.Context(), args, toComplete, opts.files, opts.profiles)
-		},
-	}
-
-	cmd.Flags().StringArrayVar(&opts.BuildServicesOptions.BuildArgs, "build-arg", nil,
-		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
-			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
-	cmd.Flags().BoolVar(&opts.BuildServicesOptions.Pull, "build-pull", false,
-		"Always attempt to pull newer versions of base images before building service images.")
-	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
-		"One or more Compose files to deploy services from. (default compose.yaml)")
-	cmd.Flags().BoolVar(&opts.noBuild, "no-build", false,
-		"Do not build new images before deploying services.")
-	cmd.Flags().BoolVar(&opts.BuildServicesOptions.NoCache, "no-cache", false,
-		"Do not use cache when building images.")
-	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
-		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
-		"Recreate containers even if their configuration and image haven't changed.")
-	cmd.Flags().BoolVar(&opts.skipHealth, "skip-health", false,
-		"Skip the monitoring period and health checks after starting new containers. Useful for faster emergency "+
-			"deployments.\n"+
-			"Warning: This may cause downtime if new containers fail to start properly.")
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm deployment plan. Should be explicitly set when running non-interactively,\n"+
-			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
-
-	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
-	//  Could be useful to test a new version on a subset of machines before rolling out to all.
-
-	return cmd
-}
-
-// runDeploy parses the Compose file(s) and deploys the services.
-func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
-	if err != nil {
-		return fmt.Errorf("load compose file(s): %w", err)
-	}
-
-	uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
-
-	if len(opts.services) > 0 {
-		// Includes service dependencies by default. This is the default docker compose behavior.
-		project, err = project.WithSelectedServices(opts.services)
-		if err != nil {
-			return fmt.Errorf("select services: %w", err)
-		}
-	}
-
-	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.services, false)
-	if err != nil {
-		return fmt.Errorf("determine services to build: %w", err)
-	}
-
-	if len(servicesToBuild) > 0 {
-		if opts.noBuild {
-			fmt.Println("Not building services as requested.")
-		} else {
-			// Build service images without pushing them to cluster yet to not connect to the cluster twice.
-			opts.BuildServicesOptions.Deps = true // build dependencies as deploy includes them by default
-			opts.BuildServicesOptions.Services = opts.services
-
-			if err = uncli.BuildServices(ctx, project, opts.BuildServicesOptions); err != nil {
-				return fmt.Errorf("build services: %w", err)
-			}
-		}
-		fmt.Println()
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	if len(servicesToBuild) > 0 && !opts.noBuild {
-		// Push built service images to cluster machines one at a time.
-		var errs []error
-		for _, s := range servicesToBuild {
-			if s.Image == "" {
-				// Skip services without an image name (shouldn't happen for services with build config).
-				continue
-			}
-
-			// Push to the specified x-machines or to *all* cluster machines if not specified.
-			var pushOpts client.PushImageOptions
-			if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
-				pushOpts.Machines = machines
-			}
-			if len(pushOpts.Machines) == 0 {
-				pushOpts.AllMachines = true
-			}
-
-			boldStyle := lipgloss.NewStyle().Bold(true)
-			err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-				if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
-					return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
-				}
-				return nil
-			}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
-			// Collect errors to try pushing all images.
-			if err != nil {
-				errs = append(errs, err)
-			}
-		}
-
-		if err = errors.Join(errs...); err != nil {
-			return err
-		}
-		fmt.Println()
-	}
-
-	// Resolve 'secret://name' references to actual secret values before creating a deployment.
-	if compose.HasCommandSecretRefs(project) {
-		fmt.Fprintln(os.Stderr, "Resolving secrets...")
-	}
-	if err = compose.ResolveSecrets(ctx, project); err != nil {
-		return fmt.Errorf("resolve secrets: %w", err)
-	}
-
-	strategy := &deploy.RollingStrategy{
-		ForceRecreate:     opts.recreate,
-		SkipHealthMonitor: opts.skipHealth,
-	}
-	composeDeploy, err := compose.NewDeploymentWithStrategy(ctx, clusterClient, project, strategy)
-	if err != nil {
-		return fmt.Errorf("create compose deployment: %w", err)
-	}
-
-	plan, err := composeDeploy.Plan(ctx)
-	if err != nil {
-		return fmt.Errorf("plan deployment: %w", err)
-	}
-
-	if plan.IsEmpty() {
-		fmt.Println("Services are up to date.")
-		return nil
-	}
-
-	fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
-	fmt.Println()
-
-	directConn := uncli.DirectConnection()
-	contextName := uncli.ContextOverrideOrCurrent()
-	deployTarget := ""
-	if directConn != "" {
-		deployTarget = directConn
-		fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
-		fmt.Println()
-	} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
-		// Only show context if there's more than one to avoid unnecessary clutter.
-		deployTarget = contextName
-		fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
-		fmt.Println()
-	}
-
-	fmt.Println(plan.Format())
-
-	// Ask for plan confirmation before proceeding with the deployment unless auto-confirmed with --yes.
-	if !opts.yes {
-		if !tui.IsTerminalAvailable() {
-			return errors.New("cannot ask to confirm deployment plan in non-interactive mode, " +
-				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
-		}
-
-		title := "Proceed with deployment?"
-		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
-		// deploying to the wrong cluster.
-		if deployTarget != "" {
-			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
-			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
-			title = "Proceed with deployment to " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
-		}
-
-		confirmed, err := tui.Confirm(title)
-		if err != nil {
-			return fmt.Errorf("confirm deployment: %w", err)
-		}
-		if !confirmed {
-			return cli.Cancelled("Deploy cancelled. No changes were made.")
-		}
-	}
-
-	title := "Deploying"
-	if deployTarget != "" {
-		title += " to " + tui.NameStyle.Render(deployTarget)
-	}
-	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		if err := plan.Execute(ctx, clusterClient); err != nil {
-			return fmt.Errorf("deploy services: %w", err)
-		}
-		return nil
-	}, uncli.ProgressOut(), title)
-	if err != nil {
-		fmt.Println()
-
-		tail := failedContainerLogsTail()
-		if hookErr, ok := errors.AsType[*operation.PreDeployHookError](err); ok {
-			printFailedContainerLogs(ctx, clusterClient,
-				hookErr.ServiceName, hookErr.ContainerID, hookErr.MachineName, tail,
-				fmt.Sprintf("Last %d log lines from failed pre-deploy hook:", tail))
-			fmt.Println()
-		} else if startErr, ok := errors.AsType[*operation.ContainerHealthError](err); ok {
-			printFailedContainerLogs(ctx, clusterClient,
-				startErr.ServiceName, startErr.ContainerID, startErr.MachineName, tail,
-				fmt.Sprintf("Last %d log lines from failed container:", tail))
-			fmt.Println()
-		}
-
-		return err
-	}
-	return nil
-}
-
-// printFailedContainerLogs fetches the last tail log lines from a container that failed during deployment and prints
-// them using the standard log formatter under the provided header.
-func printFailedContainerLogs(
-	ctx context.Context, cli *client.Client, serviceName, containerID, machineName string, tail int, header string,
-) {
-	_, ch, err := cli.ServiceLogs(ctx, serviceName, api.ServiceLogsOptions{
-		Containers: []string{containerID},
-		Machines:   []string{machineName},
-		Tail:       tail,
-	})
-	if err != nil {
-		shortCtrID := stringid.TruncateID(containerID)
-		fmt.Fprintf(os.Stderr, "Failed to fetch container logs '%s/%s': %v\n", serviceName, shortCtrID, err)
-		fmt.Fprintf(os.Stderr, "You can try manually with: uc logs %s/%s\n", serviceName, shortCtrID)
-		return
-	}
-
-	fmt.Println(tui.BoldRed.Render(header))
-
-	logsEmpty := true
-	formatter := logs.NewFormatter([]string{machineName}, []string{serviceName}, false)
-	for entry := range ch {
-		logsEmpty = false
-		formatter.PrintEntry(entry)
-	}
-
-	if logsEmpty {
-		fmt.Println("<no logs available>")
-	}
-}
-
-// defaultFailedContainerLogsTail is the default number of recent log lines to print from a failed container to give
-// the user immediate context without requiring a follow-up 'uc logs' invocation.
-// Overridable via UNCLOUD_FAILED_CONTAINER_LOGS_TAIL.
-const defaultFailedContainerLogsTail = 10
-
-// failedContainerLogsTail returns the number of log lines to fetch from a failed container, honouring the
-// UNCLOUD_FAILED_CONTAINER_LOGS_TAIL environment variable override when set and valid.
-func failedContainerLogsTail() int {
-	if v := os.Getenv("UNCLOUD_FAILED_CONTAINER_LOGS_TAIL"); v != "" {
-		if tail, err := logs.Tail(v); err == nil && (tail == -1 || tail > 0) {
-			return tail
-		}
-	}
-	return defaultFailedContainerLogsTail
-}
@@ -1,25 +0,0 @@
-package dns
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "dns",
-		Short: "Manage the cluster domain.",
-		Long: "Manage the cluster domain.\n" +
-			"DNS commands allow you to reserve or release a unique 'xxxxxx.uncld.dev' domain for your " +
-			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
-			"traffic to the services in the cluster.\n\n" +
-			"EXPERIMENTAL: Use 'uc dns set' to configure an externally managed domain instead. " +
-			"Uncloud does not manage DNS records for manually set domains.",
-	}
-	cmd.AddCommand(
-		NewReleaseCommand(),
-		NewReserveCommand(),
-		NewShowCommand(),
-		NewSetCommand(),
-	)
-	return cmd
-}
@@ -1,72 +0,0 @@
-package dns
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/miekg/dns"
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/grpcversion"
-	"github.com/spf13/cobra"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/metadata"
-	"google.golang.org/grpc/status"
-)
-
-func NewSetCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "set DOMAIN_NAME",
-		Args:  cobra.ExactArgs(1),
-		Short: "Set or unset an externally managed cluster domain (EXPERIMENTAL).",
-		Long: "EXPERIMENTAL: Set the cluster domain used to generate ingress hostnames for services.\n" +
-			"Configure wildcard DNS records for this domain with your DNS provider. " +
-			"Uncloud will not create, verify, update, or delete external DNS records.\n" +
-			"Pass an empty string to unset a manually set domain. " +
-			"Use 'uc dns release' to release a domain reserved in Uncloud DNS. " +
-			"Setting or unsetting the domain does not change existing service hostnames.",
-		Example: "  uc dns set apps.example.com\n  uc dns set \"\"",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return set(cmd.Context(), uncli, args[0])
-		},
-	}
-
-	return cmd
-}
-
-func set(ctx context.Context, uncli *cli.CLI, name string) error {
-	if name != "" {
-		if labels, ok := dns.IsDomainName(name); !ok || labels < 2 {
-			return fmt.Errorf("invalid cluster domain %q: must be a valid domain name with at least two labels", name)
-		}
-	}
-	tui.PrintWarning("Setting an externally managed cluster domain is experimental.")
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	ctx = metadata.AppendToOutgoingContext(ctx, grpcversion.MetadataKeyMinServerVersion, "0.21.0")
-	_, err = clusterClient.SetDomain(ctx, &pb.SetDomainRequest{Name: name})
-	if err != nil {
-		if status.Convert(err).Code() == codes.AlreadyExists {
-			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' or " +
-				"release a reservation with 'uc dns release' first")
-		}
-		return fmt.Errorf("set cluster domain: %w", err)
-	}
-
-	if name == "" {
-		fmt.Println("Unset cluster domain. External DNS records have not been changed.")
-		return nil
-	}
-	fmt.Printf("Set cluster domain: %s\n", name)
-	fmt.Println("DNS is managed externally. " +
-		"Configure wildcard DNS records pointing to machines running the Caddy service.")
-	return nil
-}
@@ -1,151 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/cobra/doc"
-)
-
-const docsDir = "website/docs/9-cli-reference"
-
-type docOptions struct {
-	manual bool
-}
-
-type cmdWrapper struct {
-	cmd *cobra.Command
-}
-
-// NewDocsCommand creates a new hidden command to generate CLI reference docs.
-func NewDocsCommand() *cobra.Command {
-	wrapper := &cmdWrapper{}
-	opts := docOptions{}
-	cmd := &cobra.Command{
-		Use:                   "docs",
-		Short:                 "Generate Uncloud CLI reference docs",
-		SilenceUsage:          true,
-		DisableFlagsInUseLine: true,
-		Hidden:                true,
-		Args:                  cobra.NoArgs,
-		ValidArgsFunction:     cobra.NoFileCompletions,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			if opts.manual {
-				header := &doc.GenManHeader{
-					Title:   "Uncloud",
-					Section: "1",
-					Source:  "Uncloud https://uncloud.run",
-				}
-				if err := doc.GenManTree(cmd.Root(), header, "."); err != nil {
-					return fmt.Errorf("generate CLI manual pages: %w", err)
-				}
-				completionFiles, err := filepath.Glob("uc-completion*.1")
-				if err != nil {
-					return fmt.Errorf("list generated manual pages: %w", err)
-				}
-				for _, f := range completionFiles {
-					if err = os.Remove(f); err != nil {
-						return fmt.Errorf("remove '%s': %w", f, err)
-					}
-				}
-
-				return nil
-			}
-
-			// Remove existing markdown files.
-			mdFiles, err := filepath.Glob(filepath.Join(docsDir, "*.md"))
-			if err != nil {
-				return fmt.Errorf("list existing CLI docs: %w", err)
-			}
-			for _, f := range mdFiles {
-				if err = os.Remove(f); err != nil {
-					return fmt.Errorf("remove '%s': %w", f, err)
-				}
-			}
-
-			// Generate new CLI reference docs.
-			wrapper.cmd.Root().DisableAutoGenTag = true
-			if err := doc.GenMarkdownTree(cmd.Root(), docsDir); err != nil {
-				return fmt.Errorf("generate CLI docs: %w", err)
-			}
-
-			// Remove *completion*.md files that contain malformatted code blocks that break Docusaurus.
-			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*completion*.md"))
-			if err != nil {
-				return fmt.Errorf("list generated CLI docs: %w", err)
-			}
-			for _, f := range mdFiles {
-				if err = os.Remove(f); err != nil {
-					return fmt.Errorf("remove '%s': %w", f, err)
-				}
-			}
-
-			// Post-process generated markdown files.
-			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*.md"))
-			if err != nil {
-				return fmt.Errorf("list generated CLI docs: %w", err)
-			}
-
-			for _, f := range mdFiles {
-				if err = postProcessMarkdown(f); err != nil {
-					return fmt.Errorf("post-process '%s': %w", f, err)
-				}
-			}
-
-			return nil
-		},
-	}
-	cmd.Flags().BoolVar(&opts.manual, "manual", false,
-		"Generate Uncloud manual pages in the current directory.")
-
-	wrapper.cmd = cmd
-	return cmd
-}
-
-// postProcessMarkdown applies transformations to generated markdown files.
-func postProcessMarkdown(filename string) error {
-	data, err := os.ReadFile(filename)
-	if err != nil {
-		return err
-	}
-
-	content := string(data)
-
-	// Replace "SEE ALSO" with "See also".
-	content = strings.ReplaceAll(content, "SEE ALSO", "See also")
-	// Escape <id> to avoid Docusaurus treating it as an HTML tag.
-	content = strings.ReplaceAll(content, "<id>", "\\<id>")
-
-	// Remove broken links to completion docs.
-	if strings.Contains(content, "[uc completion") {
-		lines := strings.Split(content, "\n")
-		var filteredLines []string
-		for _, line := range lines {
-			if !strings.Contains(line, "[uc completion") {
-				filteredLines = append(filteredLines, line)
-			}
-		}
-		content = strings.Join(filteredLines, "\n")
-	}
-
-	// Adjust heading levels. Process from shortest to longest to avoid double replacements.
-	replacements := []struct {
-		old, new string
-	}{
-		{`(?m)^## `, `# `},
-		{`(?m)^### `, `## `},
-		{`(?m)^#### `, `### `},
-		{`(?m)^##### `, `#### `},
-	}
-
-	for _, r := range replacements {
-		re := regexp.MustCompile(r.old)
-		content = re.ReplaceAllString(content, r.new)
-	}
-
-	return os.WriteFile(filename, []byte(content), 0o644)
-}
@@ -1,295 +0,0 @@
-package image
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/charmbracelet/colorprofile"
-	"github.com/containerd/platforms"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/go-units"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type listOptions struct {
-	machines   []string
-	nameFilter string
-}
-
-func NewListCommand() *cobra.Command {
-	opts := listOptions{}
-
-	cmd := &cobra.Command{
-		Use:     "ls [REPO:[TAG]]",
-		Aliases: []string{"list"},
-		Short:   "List images on machines in the cluster.",
-		Long:    "List images on machines in the cluster. By default, on all machines. Optionally filter by image name.",
-		Example: `  # List all images on all machines.
-  uc image ls
-
-  # List images on specific machine.
-  uc image ls -m machine1
-
-  # List images on multiple machines.
-  uc image ls -m machine1,machine2
-
-  # List images filtered by name (with any tag) on all machines.
-  uc image ls myapp
-
-  # List images filtered by name pattern on specific machine.
-  uc image ls "myapp:1.*" -m machine1`,
-		Args: cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if len(args) > 0 {
-				opts.nameFilter = args[0]
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
-			"(default is include all machines)")
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-// imageRow represents a single image with its metadata for display.
-type imageRow struct {
-	id           string
-	name         string
-	platforms    string
-	createdHuman string
-	createdUnix  int64
-	size         string
-	inUse        string
-	store        string
-	machine      string
-}
-
-func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	machines := cli.ExpandCommaSeparatedValues(opts.machines)
-
-	clusterImages, err := clusterClient.ListImages(ctx, api.ImageFilter{
-		Machines: machines,
-		Name:     opts.nameFilter,
-	})
-	if err != nil {
-		return fmt.Errorf("list images: %w", err)
-	}
-
-	// Collect all images from all machines.
-	var rows []imageRow
-
-	for _, machineImages := range clusterImages {
-		if err := machineImages.Error(); err != nil {
-			tui.PrintWarning(fmt.Sprintf("failed to list images on machine '%s': %s",
-				machineImages.Metadata.MachineName, err))
-			continue
-		}
-
-		// Get machine name for better readability.
-		machineName := machineImages.Metadata.MachineName
-
-		store := "docker"
-		if machineImages.ContainerdStore {
-			store = "containerd"
-		}
-
-		// Process each image for this machine.
-		for _, img := range machineImages.Images {
-			// Show the first 12 chars without 'sha256:' as the image ID like Docker does.
-			id := strings.TrimPrefix(img.ID, "sha256:")[:12]
-
-			name := "<none>"
-			if len(img.RepoTags) > 0 && img.RepoTags[0] != "<none>:<none>" {
-				name = img.RepoTags[0]
-			}
-
-			imgPlatforms, _ := imagePlatforms(img)
-			formattedPlatforms := formatPlatforms(imgPlatforms)
-
-			created := ""
-			createdAt := time.Unix(img.Created, 0)
-			if !createdAt.IsZero() {
-				created = units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
-			}
-
-			size := units.HumanSizeWithPrecision(float64(img.Size), 3)
-
-			// Check if the image is in use by any containers. Only supported by Docker API >=1.51
-			inUse := "-"
-			if img.Containers != -1 { // -1 means the info is not available.
-				if img.Containers > 0 {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
-				} else {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
-				}
-			}
-
-			rows = append(rows, imageRow{
-				id:           id,
-				name:         name,
-				platforms:    formattedPlatforms,
-				createdHuman: created,
-				createdUnix:  img.Created,
-				size:         size,
-				inUse:        inUse,
-				store:        store,
-				machine:      machineName,
-			})
-		}
-	}
-
-	if len(rows) == 0 {
-		if opts.nameFilter != "" {
-			fmt.Printf("No images matching '%s' found.\n", opts.nameFilter)
-		} else {
-			fmt.Println("No images found.")
-		}
-		return nil
-	}
-
-	// Sort images by name, then by machine name.
-	sort.Slice(rows, func(i, j int) bool {
-		if rows[i].name != rows[j].name {
-			return rows[i].name < rows[j].name
-		}
-		return rows[i].machine < rows[j].machine
-	})
-
-	// Print the images in a table format.
-	lipgloss.Println(formatImageTable(rows))
-
-	return nil
-}
-
-// imagePlatforms returns a list of platforms supported by the image and a boolean indicating if it's multi-platform.
-func imagePlatforms(img image.Summary) ([]string, bool) {
-	var formattedPlatforms []string
-	multiPlatform := false
-
-	for _, m := range img.Manifests {
-		if m.Kind != image.ManifestKindImage || !m.Available {
-			continue
-		}
-
-		if m.ID != img.ID {
-			// There is an image manifest that has digest different from the main image digest.
-			// This means the image manifest is an index or a manifest list (multi-platform image).
-			multiPlatform = true
-		}
-		formattedPlatforms = append(formattedPlatforms, platforms.Format(m.ImageData.Platform))
-	}
-
-	slices.Sort(formattedPlatforms)
-
-	return formattedPlatforms, multiPlatform
-}
-
-func formatPlatforms(platforms []string) string {
-	if len(platforms) == 0 {
-		return "-"
-	}
-
-	platformStyle := lipgloss.NewStyle().
-		BorderForeground(lipgloss.Color("152")).
-		Foreground(lipgloss.Color("0")).
-		Background(lipgloss.Color("152"))
-	// Use fancy pill borders only if the output is a terminal with color support.
-	if colorprofile.Detect(os.Stdout, os.Environ()) > colorprofile.ASCII {
-		platformStyle = platformStyle.Border(lipgloss.Border{Left: "", Right: ""}, false, true, false, true)
-	}
-
-	styledPlatforms := make([]string, len(platforms))
-	for i, p := range platforms {
-		styledPlatforms[i] = platformStyle.Render(p)
-	}
-
-	return strings.Join(styledPlatforms, " ")
-}
-
-func formatImageTable(rows []imageRow) string {
-	columns := []struct {
-		name string
-		hide bool
-	}{
-		{name: "IMAGE ID"},
-		{name: "NAME"},
-		{name: "PLATFORMS"},
-		{name: "CREATED"},
-		{name: "SIZE"},
-		{name: "IN USE"},
-		{name: "STORE"},
-		{name: "MACHINE"},
-	}
-
-	// Hide the "IN USE" column if none of the images have that info available.
-	inUseInfoAvailable := slices.ContainsFunc(rows, func(r imageRow) bool {
-		return r.inUse != "-"
-	})
-	if !inUseInfoAvailable {
-		// Hide "IN USE" column.
-		columns[5].hide = true
-	}
-
-	// Hide the "STORE" column if all machines use the containerd store.
-	hasNonContainerd := slices.ContainsFunc(rows, func(r imageRow) bool {
-		return r.store != "containerd"
-	})
-	if !hasNonContainerd {
-		columns[6].hide = true
-	}
-
-	t := tui.NewTable()
-
-	var headers []string
-	for _, col := range columns {
-		if !col.hide {
-			headers = append(headers, col.name)
-		}
-	}
-	t.Headers(headers...)
-
-	for _, row := range rows {
-		values := []string{
-			row.id,
-			tui.FormatImage(row.name, tui.NoStyle),
-			row.platforms,
-			row.createdHuman,
-			row.size,
-			row.inUse,
-			row.store,
-			row.machine,
-		}
-		var filteredValues []string
-		for i, v := range values {
-			if !columns[i].hide {
-				filteredValues = append(filteredValues, v)
-			}
-		}
-		t.Row(filteredValues...)
-	}
-
-	return t.String()
-}
@@ -1,97 +0,0 @@
-package image
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/containerd/platforms"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type pushOptions struct {
-	image    string
-	machines []string
-	platform string
-}
-
-func NewPushCommand() *cobra.Command {
-	opts := pushOptions{}
-
-	cmd := &cobra.Command{
-		Use:   "push IMAGE",
-		Short: "Upload a local Docker image to the cluster.",
-		Long: `Upload a local Docker image to the cluster transferring only the missing layers.
-The image is uploaded to all cluster machines (default) or the specified machine(s).`,
-		Example: `  # Push image to all machines in the cluster.
-  uc image push myapp:latest
-
-  # Push image to specific machine.
-  uc image push myapp:latest -m machine1
-
-  # Push image to multiple machines.
-  uc image push myapp:latest -m machine1,machine2,machine3
-
-  # Push a specific platform of a multi-platform image.
-  uc image push myapp:latest --platform linux/amd64`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			opts.image = args[0]
-			return push(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names or IDs to push the image to. Can be specified multiple times or as a comma-separated list. "+
-			"(default is all machines)")
-	cmd.Flags().StringVar(
-		&opts.platform, "platform", "",
-		"Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).\n"+
-			"Local Docker must be configured to use containerd image store to support multi-platform images.",
-	)
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	machines := cli.ExpandCommaSeparatedValues(opts.machines)
-	pushOpts := client.PushImageOptions{}
-
-	// Special handling for an explicit "all" keyword to push to all machines.
-	if len(machines) == 1 && machines[0] == "all" {
-		pushOpts.AllMachines = true
-	} else if len(machines) > 0 {
-		pushOpts.Machines = machines
-	} else {
-		// Default is to push to all machines in the cluster.
-		pushOpts.AllMachines = true
-	}
-
-	if opts.platform != "" {
-		p, err := platforms.Parse(opts.platform)
-		if err != nil {
-			return fmt.Errorf("invalid platform '%s': %w", opts.platform, err)
-		}
-		pushOpts.Platform = &p
-	}
-
-	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		if err = clusterClient.PushImage(ctx, opts.image, pushOpts); err != nil {
-			return fmt.Errorf("push image to cluster: %w", err)
-		}
-		return nil
-	}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", opts.image))
-}
@@ -1,19 +0,0 @@
-package image
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "image",
-		Short: "Manage images on machines in the cluster.",
-	}
-
-	cmd.AddCommand(
-		NewListCommand(),
-		NewPushCommand(),
-	)
-
-	return cmd
-}
@@ -1,19 +0,0 @@
-package main
-
-import (
-	"strings"
-
-	"github.com/psviderski/uncloud/cmd/uc/image"
-	"github.com/spf13/cobra"
-)
-
-// NewImagesCommand returns the 'image ls' command modified to work as 'images'.
-func NewImagesCommand() *cobra.Command {
-	listCmd := image.NewListCommand()
-	listCmd.Use = "images [IMAGE]"
-	// Remove 'list' alias since this command is already an alias.
-	listCmd.Aliases = nil
-	listCmd.Example = strings.ReplaceAll(listCmd.Example, "uc image ls", "uc images")
-
-	return listCmd
-}
@@ -1,267 +0,0 @@
-package machine
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-	"strings"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/cmd/uc/caddy"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type addOptions struct {
-	name        string
-	noCaddy     bool
-	noInstall   bool
-	publicIP    string
-	sshKey      string
-	version     string
-	wgEndpoints []string
-	wgPort      int
-	wgMTU       int
-	yes         bool
-}
-
-func NewAddCommand() *cobra.Command {
-	opts := addOptions{}
-	cmd := &cobra.Command{
-		Use:   "add [USER@]HOST[:PORT]",
-		Short: "Add a remote machine to a cluster.",
-		Long: `Add a new machine to an existing Uncloud cluster.
-
-By default, it installs Docker and the Uncloud daemon on the machine over SSH unless --no-install
-is specified, which assumes they are already installed and running.
-
-Connection methods:
-  [ssh://]user@host   - Use system 'ssh' command with full SSH config support (default, no prefix required)
-  ssh+go://user@host  - Use Go's built-in SSH library`,
-		Args: cobra.ExactArgs(1),
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-			cli.BindEnvToFlag(cmd, "version", "UNCLOUD_DAEMON_VERSION")
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			// Determine connection mode and strip scheme.
-			destination := args[0]
-			useSSHGo := strings.HasPrefix(destination, "ssh+go://")
-			destination = strings.TrimPrefix(destination, "ssh+go://")
-			destination = strings.TrimPrefix(destination, "ssh+cli://")
-			destination = strings.TrimPrefix(destination, "ssh://")
-
-			user, host, port, err := config.SSHDestination(destination).Parse()
-			if err != nil {
-				return fmt.Errorf("parse remote machine: %w", err)
-			}
-			remoteMachine := &cli.RemoteMachine{
-				User:     user,
-				Host:     host,
-				Port:     port,
-				KeyPath:  opts.sshKey,
-				UseSSHGo: useSSHGo,
-			}
-
-			return add(cmd.Context(), uncli, remoteMachine, opts)
-		},
-	}
-	cmd.Flags().StringVarP(&opts.name, "name", "n", "",
-		"Assign a name to the machine. (default is the machine's hostname)")
-	cmd.Flags().BoolVar(
-		&opts.noCaddy, "no-caddy", false,
-		"Don't deploy Caddy reverse proxy service to the machine.",
-	)
-	cmd.Flags().BoolVar(
-		&opts.noInstall, "no-install", false,
-		"Skip installation of Docker and the Uncloud daemon on the machine. "+
-			"Assumes they're already installed and running.",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "auto",
-		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
-	)
-	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
-	)
-	cmd.Flags().StringVar(
-		&opts.version, "version", "latest",
-		"Version of the Uncloud daemon to install on the machine. [$UNCLOUD_DAEMON_VERSION]",
-	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		"WireGuard endpoint address that other machines in the cluster should use to establish "+
-			"WireGuard connections\n"+
-			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
-			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is the value of --wg-port if omitted.\n"+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
-			"Defaults to the auto-detected public and routable machine IPs.",
-	)
-	cmd.Flags().IntVar(
-		&opts.wgMTU, "wg-mtu", 0,
-		"MTU of the WireGuard network interface on the machine. (default auto-detects the optimal value)",
-	)
-	cmd.Flags().IntVar(
-		&opts.wgPort, "wg-port", network.DefaultWireGuardPort,
-		"UDP port WireGuard listens on for incoming connections from other machines.",
-	)
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
-			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
-
-	return cmd
-}
-
-func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
-	var publicIP *netip.Addr
-	switch opts.publicIP {
-	case "auto":
-		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
-		publicIP = nil
-	default:
-		ip, err := netip.ParseAddr(opts.publicIP)
-		if err != nil {
-			return fmt.Errorf("parse public IP: %w", err)
-		}
-		publicIP = &ip
-	}
-
-	if opts.wgPort < 1 || opts.wgPort > 65535 {
-		return fmt.Errorf("invalid WireGuard port %d: must be between 1 and 65535", opts.wgPort)
-	}
-	if opts.wgMTU != 0 && (opts.wgMTU < network.MinWireGuardMTU || opts.wgMTU > 65535) {
-		return fmt.Errorf("invalid WireGuard MTU %d: must be 0 (auto-detect) or between %d and 65535",
-			opts.wgMTU, network.MinWireGuardMTU)
-	}
-	addOpts := cli.AddMachineOptions{
-		MachineName:   opts.name,
-		PublicIP:      publicIP,
-		RemoteMachine: remoteMachine,
-		SkipInstall:   opts.noInstall,
-		Version:       opts.version,
-		WireguardMTU:  opts.wgMTU,
-		WireguardPort: opts.wgPort,
-		AutoConfirm:   opts.yes,
-	}
-	if len(opts.wgEndpoints) > 0 {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded, uint16(opts.wgPort))
-		if err != nil {
-			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
-		}
-		addOpts.WireguardEndpoints = endpoints
-	}
-
-	clusterClient, machineClient, err := uncli.AddMachine(ctx, addOpts)
-	if err != nil {
-		return err
-	}
-	defer clusterClient.Close()
-	defer machineClient.Close()
-
-	if opts.noCaddy {
-		return nil
-	}
-
-	// Wait for the cluster to be initialised on the machine to be able to deploy the Caddy service.
-	err = tui.RunSpinner(ctx, "Waiting for the machine to join the cluster...", func(ctx context.Context) error {
-		return machineClient.WaitClusterReady(ctx, 5*time.Minute)
-	})
-	if err != nil {
-		return fmt.Errorf("wait for machine to join the cluster: %w", err)
-	}
-	fmt.Println("Machine joined the cluster.")
-
-	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
-	//  that may cause a small downtime.
-	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
-	// use the deployed image version.
-	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
-	// issues accessing the API of existing machines in the cluster.
-	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
-	caddyImage := ""
-	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
-	if err != nil {
-		if errors.Is(err, api.ErrNotFound) {
-			// Caddy service is not deployed.
-			return nil
-		}
-		return fmt.Errorf("inspect caddy service: %w", err)
-	}
-	caddyImage = caddySvc.Containers[0].Container.Config.Image
-	// Find the latest created container and use its image.
-	var latestCreated time.Time
-	for _, c := range caddySvc.Containers[1:] {
-		created, err := time.Parse(time.RFC3339Nano, c.Container.Created)
-		if err != nil {
-			continue
-		}
-		if created.After(latestCreated) {
-			latestCreated = created
-			caddyImage = c.Container.Config.Image
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("Preparing Caddy deployment...")
-	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{Image: caddyImage})
-	if err != nil {
-		return fmt.Errorf("create caddy deployment: %w", err)
-	}
-
-	plan, err := d.Plan(ctx)
-	if err != nil {
-		return fmt.Errorf("plan caddy deployment: %w", err)
-	}
-
-	if len(plan.Operations) == 0 {
-		fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
-	} else {
-		fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
-		fmt.Println()
-		fmt.Print(plan.Format())
-
-		summary := plan.FormatSummary()
-		fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
-		fmt.Println(summary)
-		fmt.Println()
-
-		if !opts.yes {
-			confirmed, err := tui.Confirm("Proceed with deployment?")
-			if err != nil {
-				return fmt.Errorf("confirm deployment: %w", err)
-			}
-			if !confirmed {
-				return cli.Cancelled("Caddy deploy cancelled. The machine has been added to the cluster.")
-			}
-		}
-
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if _, err = d.Run(ctx); err != nil {
-				return fmt.Errorf("deploy caddy: %w", err)
-			}
-			return nil
-		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s (%s mode)", d.Spec.Name, d.Spec.Mode))
-		if err != nil {
-			return err
-		}
-	}
-
-	fmt.Println()
-	return caddy.UpdateDomainRecords(ctx, machineClient, uncli.ProgressOut())
-}
@@ -1,6 +0,0 @@
-package machine
-
-const (
-	// PublicIPNone is the value used to indicate removal of public IP
-	PublicIPNone = "none"
-)
@@ -1,72 +0,0 @@
-package machine
-
-import (
-	"testing"
-
-	"github.com/spf13/cobra"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// runVersionFlagEnvTest builds the given command for each case, stubs out RunE so only flag
-// parsing and PreRunE run (no SSH calls), and asserts the resolved --version flag value.
-// Note: cannot use t.Parallel() because subtests use t.Setenv().
-func runVersionFlagEnvTest(t *testing.T, newCommand func() *cobra.Command) {
-	t.Helper()
-
-	tests := []struct {
-		name string
-		args []string
-		env  string
-		want string
-	}{
-		{
-			name: "env var sets version when flag not passed",
-			args: []string{"root@localhost"},
-			env:  "v1.2.3",
-			want: "v1.2.3",
-		},
-		{
-			name: "explicit flag wins over env var",
-			args: []string{"root@localhost", "--version", "v9.9.9"},
-			env:  "v1.2.3",
-			want: "v9.9.9",
-		},
-		{
-			name: "defaults to latest when neither flag nor env var set",
-			args: []string{"root@localhost"},
-			want: "latest",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.env != "" {
-				t.Setenv("UNCLOUD_DAEMON_VERSION", tt.env)
-			}
-
-			cmd := newCommand()
-			cmd.RunE = func(*cobra.Command, []string) error {
-				return nil
-			}
-			cmd.SetArgs(tt.args)
-			require.NoError(t, cmd.Execute())
-
-			version, err := cmd.Flags().GetString("version")
-			require.NoError(t, err)
-			assert.Equal(t, tt.want, version)
-		})
-	}
-}
-
-// TestInitCommandVersionFlagEnvVar verifies that the UNCLOUD_DAEMON_VERSION environment variable
-// is bound to the --version flag of 'machine init', and that an explicit flag wins.
-func TestInitCommandVersionFlagEnvVar(t *testing.T) {
-	runVersionFlagEnvTest(t, NewInitCommand)
-}
-
-// TestAddCommandVersionFlagEnvVar verifies that the UNCLOUD_DAEMON_VERSION environment variable
-// is bound to the --version flag of 'machine add', and that an explicit flag wins.
-func TestAddCommandVersionFlagEnvVar(t *testing.T) {
-	runVersionFlagEnvTest(t, NewAddCommand)
-}
@@ -1,276 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-	"strings"
-	"time"
-
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/cmd/uc/caddy"
-	"github.com/psviderski/uncloud/cmd/uc/dns"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/machine/cluster"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type initOptions struct {
-	context     string
-	dnsEndpoint string
-	name        string
-	network     string
-	noCaddy     bool
-	noDNS       bool
-	noInstall   bool
-	publicIP    string
-	sshKey      string
-	version     string
-	wgEndpoints []string
-	wgPort      int
-	wgMTU       int
-	yes         bool
-}
-
-func NewInitCommand() *cobra.Command {
-	opts := initOptions{}
-	cmd := &cobra.Command{
-		Use:   "init [schema://]USER@HOST[:PORT]",
-		Short: "Initialise a new cluster with a remote machine as the first member.",
-		Long: `Initialise a new cluster by setting up a remote machine as the first member.
-This command creates a new context in your Uncloud config to manage the cluster.
-
-By default, it installs Docker and the Uncloud daemon on the machine over SSH unless --no-install
-is specified, which assumes they are already installed and running.
-
-Connection methods:
-  [ssh://]user@host   - Use system 'ssh' command with full SSH config support (default, no prefix required)
-  ssh+go://user@host  - Use Go's built-in SSH library`,
-		Example: `  # Initialise a new cluster with default settings.
-  uc machine init root@<your-server-ip>
-
-  # Initialise with a context name 'prod' in the Uncloud config (~/.config/uncloud/config.yaml) and machine name 'vps1'.
-  uc machine init root@<your-server-ip> -c prod -n vps1
-
-  # Initialise with a non-root user and custom SSH port and key.
-  uc machine init ubuntu@<your-server-ip>:2222 -i ~/.ssh/mykey
-
-  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.uncld.dev).
-  # You can deploy Caddy with 'uc caddy deploy' and reserve a domain with 'uc dns reserve' later.
-  uc machine init root@<your-server-ip> --no-caddy --no-dns`,
-		// TODO: support initialising a cluster on the local machine.
-		Args: cobra.MaximumNArgs(1),
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-			cli.BindEnvToFlag(cmd, "version", "UNCLOUD_DAEMON_VERSION")
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			var remoteMachine *cli.RemoteMachine
-			if len(args) > 0 {
-				// Determine connection mode and strip scheme.
-				destination := args[0]
-				useSSHGo := strings.HasPrefix(destination, "ssh+go://")
-				destination = strings.TrimPrefix(destination, "ssh+go://")
-				destination = strings.TrimPrefix(destination, "ssh+cli://")
-				destination = strings.TrimPrefix(destination, "ssh://")
-
-				user, host, port, err := config.SSHDestination(destination).Parse()
-				if err != nil {
-					return fmt.Errorf("parse remote machine: %w", err)
-				}
-				remoteMachine = &cli.RemoteMachine{
-					User:     user,
-					Host:     host,
-					Port:     port,
-					KeyPath:  opts.sshKey,
-					UseSSHGo: useSSHGo,
-				}
-			}
-
-			return initCluster(cmd.Context(), uncli, remoteMachine, opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", cli.DefaultContextName,
-		"Name of the new context to be created in the Uncloud config to manage the cluster.",
-	)
-	cmd.Flags().StringVar(&opts.dnsEndpoint, "dns-endpoint", dns.DefaultUncloudDNSAPIEndpoint,
-		"API endpoint for the Uncloud DNS service.")
-	cmd.Flags().StringVarP(
-		&opts.name, "name", "n", "",
-		"Assign a name to the machine. (default is the machine's hostname)",
-	)
-	cmd.Flags().StringVar(
-		&opts.network, "network", cluster.DefaultNetwork.String(),
-		"IPv4 network CIDR to use for machines and services.",
-	)
-	cmd.Flags().BoolVar(
-		&opts.noCaddy, "no-caddy", false,
-		"Don't deploy Caddy reverse proxy service to the machine. You can deploy it later with 'uc caddy deploy'.",
-	)
-	cmd.Flags().BoolVar(
-		&opts.noDNS, "no-dns", false,
-		"Don't reserve a cluster domain in Uncloud DNS. You can reserve it later with 'uc dns reserve'.",
-	)
-	cmd.Flags().BoolVar(
-		&opts.noInstall, "no-install", false,
-		"Skip installation of Docker and the Uncloud daemon on the machine. "+
-			"Assumes they're already installed and running.",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "auto",
-		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
-	)
-	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
-	)
-	cmd.Flags().StringVar(
-		&opts.version, "version", "latest",
-		"Version of the Uncloud daemon to install on the machine. [$UNCLOUD_DAEMON_VERSION]",
-	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		"WireGuard endpoint address that other machines in the cluster should use to establish "+
-			"WireGuard connections\n"+
-			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
-			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is the value of --wg-port if omitted.\n"+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
-			"Defaults to the auto-detected public and routable machine IPs.",
-	)
-	cmd.Flags().IntVar(
-		&opts.wgMTU, "wg-mtu", 0,
-		"MTU of the WireGuard network interface on the machine. (default auto-detects the optimal value)",
-	)
-	cmd.Flags().IntVar(
-		&opts.wgPort, "wg-port", network.DefaultWireGuardPort,
-		"UDP port WireGuard listens on for incoming connections from other machines.",
-	)
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
-			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
-
-	return cmd
-}
-
-func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts initOptions) error {
-	if uncli.Config == nil {
-		// Config is nil when connecting directly to a remote machine (--connect) without using Uncloud config
-		// or when being logged in on a machine and using the uncloud socket directly.
-		return fmt.Errorf(
-			"do not use --connect when initialising a new cluster: --connect is for overriding the connection " +
-				"to an existing cluster, but 'machine init' creates a new one and writes the new cluster context " +
-				"to the Uncloud config file (--uncloud-config), when logged in on a cluster machine, 'machine init' " +
-				"is not supported")
-	}
-
-	netPrefix, err := netip.ParsePrefix(opts.network)
-	if err != nil {
-		return fmt.Errorf("parse network CIDR: %w", err)
-	}
-
-	var publicIP *netip.Addr
-	switch opts.publicIP {
-	case "auto":
-		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
-		publicIP = nil
-	default:
-		ip, err := netip.ParseAddr(opts.publicIP)
-		if err != nil {
-			return fmt.Errorf("parse public IP: %w", err)
-		}
-		publicIP = &ip
-	}
-	if opts.wgPort < 1 || opts.wgPort > 65535 {
-		return fmt.Errorf("invalid WireGuard port %d: must be between 1 and 65535", opts.wgPort)
-	}
-	if opts.wgMTU != 0 && (opts.wgMTU < network.MinWireGuardMTU || opts.wgMTU > 65535) {
-		return fmt.Errorf("invalid WireGuard MTU %d: must be 0 (auto-detect) or between %d and 65535",
-			opts.wgMTU, network.MinWireGuardMTU)
-	}
-	initOpts := cli.InitClusterOptions{
-		Context:       opts.context,
-		MachineName:   opts.name,
-		Network:       netPrefix,
-		PublicIP:      publicIP,
-		RemoteMachine: remoteMachine,
-		SkipInstall:   opts.noInstall,
-		Version:       opts.version,
-		WireguardMTU:  opts.wgMTU,
-		WireguardPort: opts.wgPort,
-		AutoConfirm:   opts.yes,
-	}
-	if len(opts.wgEndpoints) > 0 {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded, uint16(opts.wgPort))
-		if err != nil {
-			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
-		}
-		initOpts.WireguardEndpoints = endpoints
-	}
-
-	clusterClient, err := uncli.InitCluster(ctx, initOpts)
-	if err != nil {
-		return err
-	}
-	defer clusterClient.Close()
-
-	// Since the cluster API needs a few moments to become ready after cluster initialisation,
-	// we keep the user informed during this wait. We wait here even if no Caddy or DNS is requested
-	// as the cluster needs to be ready so that commands such as 'uc machine ls' work immediately after init.
-	err = tui.RunSpinner(ctx, "Waiting for the cluster to be ready...", func(ctx context.Context) error {
-		return clusterClient.WaitClusterReady(ctx, 1*time.Minute)
-	})
-	if err != nil {
-		return fmt.Errorf("wait for cluster to be ready: %w", err)
-	}
-	fmt.Println("Cluster is ready.")
-
-	if opts.noCaddy && opts.noDNS {
-		return nil
-	}
-
-	fmt.Println()
-
-	if !opts.noDNS {
-		domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
-		if err != nil {
-			return fmt.Errorf("reserve cluster domain in Uncloud DNS: %w", err)
-		}
-		fmt.Printf("Reserved cluster domain: %s\n", domain.Name)
-	}
-
-	if !opts.noCaddy {
-		d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{})
-		if err != nil {
-			return fmt.Errorf("create caddy deployment: %w", err)
-		}
-
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if _, err = d.Run(ctx); err != nil {
-				return fmt.Errorf("deploy caddy: %w", err)
-			}
-			return nil
-		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s", d.Spec.Name))
-		if err != nil {
-			return err
-		}
-
-		fmt.Println()
-		return caddy.UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
-	}
-
-	return nil
-}
@@ -1,136 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/logs"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-func NewLogsCommand() *cobra.Command {
-	var options logs.Options
-
-	cmd := &cobra.Command{
-		Use:     "logs [SERVICE...]",
-		Aliases: []string{"log"},
-		Short:   "View system service logs.",
-		Long: `View logs from the specified system service(s) across all machines in the cluster.
-Use -m to restrict to specific machines.
-
-Supported services:
-  corrosion  the Corrosion distributed state store
-  docker     the Docker daemon
-  uncloud    the Uncloud daemon
-
-If no services are specified, streams logs from the uncloud service.`,
-		Example: `  # View recent logs for the uncloud service.
-  uc machine logs
-  uc machine logs uncloud
-
-  # Stream logs in real-time (follow mode).
-  uc machine logs -f uncloud
-
-  # View logs from multiple services.
-  uc machine logs uncloud docker corrosion
-
-  # Show last 20 lines per machine (default is 100).
-  uc machine logs -n 20 docker
-
-  # Show all logs without line limit.
-  uc machine logs -n all docker
-
-  # View logs from a specific time range.
-  uc machine logs --since 3h --until 1h30m docker
-
-  # View logs only from specific machines.
-  uc machine logs -m machine1,machine2 uncloud corrosion`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runLogs(cmd.Context(), uncli, args, options)
-		},
-	}
-
-	cmd.Flags().AddFlagSet(logs.Flags(&options))
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func runLogs(ctx context.Context, uncli *cli.CLI, services []string, opts logs.Options) error {
-	if len(services) == 0 {
-		services = []string{api.SystemServiceUncloud}
-	}
-	for _, service := range services {
-		if !slices.Contains(api.SystemServices, service) {
-			return fmt.Errorf("invalid system service '%s'; valid services: %s",
-				service, strings.Join(api.SystemServices, ", "))
-		}
-	}
-
-	tail, err := logs.Tail(opts.Tail)
-	if err != nil {
-		return err
-	}
-
-	c, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer c.Close()
-
-	logsOpts := api.ServiceLogsOptions{
-		Follow:   opts.Follow,
-		Tail:     tail,
-		Since:    opts.Since,
-		Until:    opts.Until,
-		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
-	}
-
-	// Resolve machine records for the formatter's column width computation.
-	machines, err := c.ListMachines(ctx, &api.MachineFilter{
-		NamesOrIDs: logsOpts.Machines,
-	})
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-	machineNames := make([]string, 0, len(machines))
-	for _, m := range machines {
-		machineNames = append(machineNames, m.Machine.Name)
-	}
-
-	// Collect one log stream per service. MachineLogs merges across machines internally.
-	serviceStreams := make([]<-chan api.ServiceLogEntry, 0, len(services))
-	for _, service := range services {
-		ch, err := c.MachineLogs(ctx, service, logsOpts)
-		if err != nil {
-			return fmt.Errorf("stream logs for system service '%s': %w", service, err)
-		}
-		serviceStreams = append(serviceStreams, ch)
-	}
-
-	var stream <-chan api.ServiceLogEntry
-	if len(serviceStreams) == 1 {
-		stream = serviceStreams[0]
-	} else {
-		// Each MachineLogs stream already runs its own inner merger with stall detection,
-		// so the outer merger across services skips it to avoid duplicate warnings.
-		merger := client.NewLogMerger(serviceStreams, client.LogMergerOptions{})
-		stream = merger.Stream()
-	}
-
-	formatter := logs.NewFormatter(machineNames, services, opts.UTC)
-
-	// Print merged logs.
-	for entry := range stream {
-		formatter.PrintEntry(entry)
-	}
-
-	return nil
-}
@@ -1,132 +0,0 @@
-package machine
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/netip"
-	"strings"
-
-	"charm.land/lipgloss/v2"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/spf13/cobra"
-)
-
-func NewListCommand() *cobra.Command {
-	var output string
-
-	cmd := &cobra.Command{
-		Use:     "ls",
-		Aliases: []string{"list"},
-		Short:   "List machines in a cluster.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, output)
-		},
-	}
-
-	cmd.Flags().StringVarP(&output, "output", "o", "",
-		"Output format: 'json' or empty for a human-readable table.")
-
-	return cmd
-}
-
-func list(ctx context.Context, uncli *cli.CLI, output string) error {
-	if output != "" && output != "json" {
-		return fmt.Errorf("unsupported output format '%s' (supported: json)", output)
-	}
-
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	machines, err := client.ListMachines(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-
-	if output == "json" {
-		data, err := json.MarshalIndent(machines.ToNative(), "", "  ")
-		if err != nil {
-			return fmt.Errorf("marshal machines: %w", err)
-		}
-		fmt.Println(string(data))
-		return nil
-	}
-
-	// Print the list of machines in a table format.
-	t := tui.NewTable()
-	t.Headers("NAME", "STATE", "ADDRESS", "PUBLIC IP", "WIREGUARD ENDPOINTS",
-		"OS", "KERNEL", "ARCH", "DOCKER", "VERSION")
-
-	for _, member := range machines {
-		m := member.Machine
-		subnet, _ := m.Network.Subnet.ToPrefix()
-		subnet = netip.PrefixFrom(network.MachineIP(subnet), subnet.Bits())
-
-		publicIP := "-"
-		if m.PublicIp != nil {
-			ip, _ := m.PublicIp.ToAddr()
-			publicIP = ip.String()
-		}
-
-		endpoints := make([]string, len(m.Network.Endpoints))
-		for i, ep := range m.Network.Endpoints {
-			addrPort, _ := ep.ToAddrPort()
-			endpoints[i] = addrPort.String()
-		}
-
-		arch := "-"
-		if m.Arch != "" {
-			arch = m.Arch
-		}
-
-		osName := "-"
-		if m.OsPrettyName != "" {
-			osName = m.OsPrettyName
-		}
-
-		kernel := "-"
-		if m.KernelVersion != "" {
-			kernel = m.KernelVersion
-		}
-
-		daemonVersion := "-"
-		if m.DaemonVersion != "" {
-			daemonVersion = m.DaemonVersion
-		}
-
-		dockerVersion := "-"
-		if m.DockerVersion != "" {
-			dockerVersion = m.DockerVersion
-		}
-
-		t.Row(
-			m.Name,
-			capitalise(member.State.String()),
-			subnet.String(),
-			publicIP,
-			strings.Join(endpoints, tui.Faint.Render(", ")),
-			osName,
-			kernel,
-			arch,
-			dockerVersion,
-			daemonVersion,
-		)
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
-
-// capitalise returns a string where the first character is upper case, and the rest is lower case.
-func capitalise(s string) string {
-	if s == "" {
-		return ""
-	}
-	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
-}
@@ -1,42 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-func NewRenameCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "rename OLD_NAME NEW_NAME",
-		Short: "Rename a machine in the cluster.",
-		Long: `Rename a machine in the cluster.
-
-This command changes the name of an existing machine while preserving all other
-configuration including network settings, public IP, and cluster membership.`,
-		Args: cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rename(cmd.Context(), uncli, args[0], args[1])
-		},
-	}
-	return cmd
-}
-
-func rename(ctx context.Context, uncli *cli.CLI, oldName, newName string) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	machine, err := client.RenameMachine(ctx, oldName, newName)
-	if err != nil {
-		return fmt.Errorf("rename machine: %w", err)
-	}
-
-	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
-	return nil
-}
@@ -1,273 +0,0 @@
-package machine
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"sync"
-
-	"charm.land/lipgloss/v2"
-	"charm.land/lipgloss/v2/tree"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type removeOptions struct {
-	noReset bool
-	yes     bool
-}
-
-func NewRmCommand() *cobra.Command {
-	opts := removeOptions{}
-
-	cmd := &cobra.Command{
-		Use:     "rm MACHINE",
-		Aliases: []string{"remove", "delete"},
-		Short:   "Remove a machine from a cluster and reset it.",
-		Args:    cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return remove(cmd.Context(), uncli, args[0], opts)
-		},
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Machines(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Do not prompt for confirmation before removing the machine.")
-	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
-		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")
-
-	return cmd
-}
-
-func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
-	// TODO: automatically choose a connection to the machine that is not being removed.
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	// Verify the machine exists in the cluster.
-	member, err := client.InspectMachine(ctx, nameOrID)
-	if err != nil {
-		return fmt.Errorf("inspect machine '%s': %w", nameOrID, err)
-	}
-	m := member.Machine
-
-	// Create a proxy context for the machine being removed.
-	// This is used for calls that need to run directly on that machine.
-	rmCtx := client.ProxySingleMachineContext(ctx, m.Id)
-
-	// Verify if the machine being removed is the proxy machine we're connected to.
-	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("inspect proxy machine: %w", err)
-	}
-	if proxyMachine.Id == m.Id {
-		allMachines, err := client.ListMachines(ctx, nil)
-		if err != nil {
-			return fmt.Errorf("list machines: %w", err)
-		}
-		if len(allMachines) > 1 {
-			return fmt.Errorf("cannot remove the machine you are currently connected to. "+
-				"Please connect to another machine in the cluster and try again. "+
-				"Change the default connection for the current cluster using 'uc ctx conn' or "+
-				"manually update 'connections' in your Uncloud config (%s). "+
-				"For more information on connecting to a cluster, see "+
-				"https://uncloud.run/docs/concepts/clusters/connecting/", uncli.Config.Path())
-			// It's ok to remove the proxy machine if it's the last one in the cluster.
-		}
-	}
-
-	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
-	//  from being scheduled on it while the removal is in progress.
-
-	reset := !opts.noReset
-	var containers []api.ServiceContainer
-	reachable := false
-	if reset {
-		// Check if the machine is up and has service containers.
-		listOpts := container.ListOptions{All: true}
-		machineContainers, err := client.Docker.ListServiceContainers(rmCtx, "", listOpts)
-		if err == nil {
-			reachable = true
-			containers = machineContainers[0].Containers
-			if len(containers) > 0 {
-				plural := ""
-				if len(containers) > 1 {
-					plural = "s"
-				}
-				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
-				lipgloss.Println(formatContainerTree(containers))
-				fmt.Println()
-				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
-					"and reset it to the uninitialised state.")
-			} else {
-				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
-				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
-			}
-		} else {
-			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
-				m.Name)
-		}
-	} else {
-		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
-	}
-
-	if !opts.yes {
-		confirmed, err := tui.Confirm("")
-		if err != nil {
-			return fmt.Errorf("confirm removal: %w", err)
-		}
-		if !confirmed {
-			return cli.Cancelled("Cancelled. Machine was not removed.")
-		}
-	}
-
-	if reset && len(containers) > 0 {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			return removeContainers(ctx, client, containers)
-		}, uncli.ProgressOut(), "Removing containers")
-		if err != nil {
-			return fmt.Errorf("remove containers: %w", err)
-		}
-		fmt.Println()
-	}
-
-	// Initiate reset before removing the machine from the cluster to stop it from updating the cluster store.
-	// This is still optimistic as Reset only triggers the reset process that runs asynchronously.
-	if reset && reachable {
-		_, err = client.MachineClient.Reset(rmCtx, &pb.ResetRequest{})
-		if err != nil {
-			tui.PrintWarning(fmt.Sprintf("Failed to reset machine: %v\n", err))
-		} else {
-			fmt.Println("Machine reset initiated and will complete in the background.")
-		}
-	}
-
-	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
-		return fmt.Errorf("remove machine from cluster: %w", err)
-	}
-	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
-
-	// Remove the connection to the machine from the uncloud config if it exists.
-	if uncli.Config != nil {
-		contextName := uncli.ContextOverrideOrCurrent()
-		if context, ok := uncli.Config.Contexts[contextName]; ok {
-			for i, c := range context.Connections {
-				if c.MachineID == m.Id {
-					context.Connections = slices.Delete(context.Connections, i, i+1)
-					break
-				}
-			}
-			if err := uncli.Config.Save(); err != nil {
-				return fmt.Errorf("save config: %w", err)
-			}
-		}
-	}
-
-	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
-	//  let the user know that the DNS records should be updated.
-
-	return nil
-}
-
-// formatContainerTree formats a list of containers grouped by service as a tree structure.
-func formatContainerTree(containers []api.ServiceContainer) string {
-	if len(containers) == 0 {
-		return ""
-	}
-
-	// Group containers by service.
-	serviceContainers := make(map[string][]api.ServiceContainer)
-	for _, ctr := range containers {
-		serviceName := ctr.ServiceName()
-		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
-	}
-
-	// Build tree output.
-	var output []string
-	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
-	for _, serviceName := range serviceNames {
-		ctrs := serviceContainers[serviceName]
-		mode := ctrs[0].ServiceMode()
-
-		// Format a tree for the service with its containers.
-		plural := ""
-		if len(ctrs) > 1 {
-			plural = "s"
-		}
-		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
-			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
-
-		// Add containers as children.
-		for _, ctr := range ctrs {
-			state, _ := ctr.HumanState()
-			info := fmt.Sprintf("%s • %s • %s", ctr.Name, tui.FormatImage(ctr.Config.Image, tui.NoStyle), state)
-			t.Child(info)
-		}
-
-		output = append(output, t.String())
-	}
-
-	return strings.Join(output, "\n")
-}
-
-// removeContainers removes the given service containers from the machine.
-func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
-	if len(containers) == 0 {
-		return nil
-	}
-
-	wg := sync.WaitGroup{}
-	errCh := make(chan error)
-
-	for _, ctr := range containers {
-		wg.Add(1)
-		go func(c api.ServiceContainer) {
-			defer wg.Done()
-
-			// Gracefully stop the container before removing it.
-			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
-			}
-
-			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
-				// Remove anonymous volumes created by the container.
-				RemoveVolumes: true,
-			})
-			if err != nil && !errors.Is(err, api.ErrNotFound) {
-				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
-			}
-		}(ctr)
-	}
-
-	go func() {
-		wg.Wait()
-		close(errCh)
-	}()
-
-	var err error
-	for e := range errCh {
-		err = errors.Join(err, e)
-	}
-
-	return err
-}
@@ -1,118 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/spf13/cobra"
-	"google.golang.org/protobuf/types/known/emptypb"
-)
-
-func NewRTTCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "rtt",
-		Short: "Show round-trip times between machines.",
-		Long: `Show round-trip times between machines.
-
-Round-trip time statistics are collected from the Corrosion gossip protocol
-and represent the median of recent RTT samples between each pair of machines
-in the cluster. The values shown include the median RTT and standard deviation
-for each machine-to-machine connection.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rtt(cmd.Context(), uncli)
-		},
-	}
-	return cmd
-}
-
-func rtt(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	// Setup context to proxy request to all machines.
-	ctx = client.ProxyMachinesContext(ctx, nil)
-
-	resp, err := client.MachineClient.InspectMachine(ctx, &emptypb.Empty{})
-	if err != nil {
-		return fmt.Errorf("inspect machines: %w", err)
-	}
-
-	// Map machine IDs to names for display from the response.
-	machineNames := make(map[string]string)
-	for _, m := range resp.Machines {
-		// NOTE: Metadata should never be nil in practice. This is legacy fallback that will be removed.
-		if m.Metadata == nil {
-			tui.PrintWarning("metadata is missing in response from unknown server")
-			continue
-		}
-		if m.Metadata.Error != "" {
-			tui.PrintWarning(fmt.Sprintf("failed to inspect machine '%s': %s", m.Metadata.MachineName, m.Metadata.Error))
-			continue
-		}
-		if m.Machine == nil {
-			continue
-		}
-		machineNames[m.Machine.Id] = m.Machine.Name
-	}
-
-	type row struct {
-		machine string
-		peer    string
-		median  time.Duration
-		stdDev  time.Duration
-	}
-	var rows []row
-
-	for _, m := range resp.Machines {
-		// Unlikely to occur, but might be a possible edge case when
-		// a machine is still initializing. So just to be safe.
-		if m.Machine == nil || m.Rtts == nil {
-			continue
-		}
-		for peerID, stats := range m.Rtts {
-			peerName := peerID
-			if name, ok := machineNames[peerID]; ok {
-				peerName = name
-			}
-			rows = append(rows, row{
-				machine: m.Machine.Name,
-				peer:    peerName,
-				median:  stats.Median.AsDuration(),
-				stdDev:  stats.StdDev.AsDuration(),
-			})
-		}
-	}
-
-	// Sort by machine name then peer name.
-	sort.Slice(rows, func(i, j int) bool {
-		if rows[i].machine == rows[j].machine {
-			return rows[i].peer < rows[j].peer
-		}
-		return rows[i].machine < rows[j].machine
-	})
-
-	// Print table.
-	t := tui.NewTable()
-	t.Headers("MACHINE", "PEER", "MEDIAN", "STDDEV")
-
-	for _, r := range rows {
-		t.Row(r.machine, r.peer, tui.FormatRTT(r.median), formatRTTStdDev(r.stdDev))
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
-
-// formatRTTStdDev formats a round-trip time standard deviation with one decimal place, e.g. "±19.4ms".
-func formatRTTStdDev(d time.Duration) string {
-	return fmt.Sprintf("±%.1fms", float64(d)/float64(time.Millisecond))
-}
@@ -1,180 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-	"strings"
-
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/spf13/cobra"
-)
-
-type updateOptions struct {
-	name        string
-	publicIP    string
-	wgEndpoints []string
-}
-
-func NewUpdateCommand() *cobra.Command {
-	opts := updateOptions{}
-	cmd := &cobra.Command{
-		Use:   "update MACHINE [flags]",
-		Short: "Update machine configuration in the cluster.",
-		Long: `Update machine configuration in the cluster.
-
-Change the name, public IP address, or WireGuard endpoints of an existing machine.
-At least one flag must be specified to perform an update.`,
-		Example: `  # Rename a machine.
-  uc machine update machine1 --name web-server
-
-  # Set the public IP address of a machine.
-  uc machine update machine1 --public-ip 203.0.113.10
-
-  # Remove the public IP address from a machine.
-  uc machine update machine1 --public-ip none
-
-  # Update WireGuard endpoints for a machine.
-  uc machine update machine1 --wg-endpoint 203.0.113.10 --wg-endpoint 192.168.1.5
-
-  # Update multiple properties at once.
-  uc machine update machine1 --name web-server --public-ip 203.0.113.10`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return update(cmd.Context(), uncli, cmd, opts, args[0])
-		},
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Machines(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	cmd.Flags().StringVar(
-		&opts.name, "name", "",
-		"New name for the machine",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "",
-		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.",
-			PublicIPNone),
-	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		fmt.Sprintf("WireGuard endpoint address that other machines in the cluster should use to establish "+
-			"WireGuard connections\n"+
-			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
-			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is %d if omitted.\n",
-			network.DefaultWireGuardPort)+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.",
-	)
-
-	return cmd
-}
-
-func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
-	// Check if at least one flag was explicitly set.
-	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") && !cmd.Flags().Changed("wg-endpoint") {
-		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip, --wg-endpoint)")
-	}
-
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	// Resolve the machine to capture its current configuration for the before/after report and to validate existence.
-	machine, err := client.InspectMachine(ctx, machineNameOrID)
-	if err != nil {
-		return fmt.Errorf("find machine: %w", err)
-	}
-
-	req := &pb.UpdateMachineRequest{}
-
-	if opts.name != "" {
-		req.Name = &opts.name
-	}
-
-	// Check if --public-ip flag was explicitly provided
-	if cmd.Flags().Changed("public-ip") {
-		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
-			req.PublicIp = &pb.IP{} // Empty IP to signal removal
-		} else {
-			// Parse and validate the public IP
-			ip, err := netip.ParseAddr(opts.publicIP)
-			if err != nil {
-				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
-			}
-			req.PublicIp = pb.NewIP(ip)
-		}
-	}
-
-	// Parse and set endpoints if the flag was explicitly provided.
-	if cmd.Flags().Changed("wg-endpoint") {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded, network.DefaultWireGuardPort)
-		if err != nil {
-			return err
-		}
-		if len(endpoints) == 0 {
-			return fmt.Errorf("at least one endpoint must be specified if --wg-endpoint flag is used")
-		}
-		req.Endpoints = endpoints
-	}
-
-	updatedMachine, err := client.UpdateMachine(ctx, machine.Machine.Id, req)
-	if err != nil {
-		return fmt.Errorf("update machine: %w", err)
-	}
-
-	// Report what was changed
-	changes := make([]string, 0)
-	if opts.name != "" {
-		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
-	}
-	if cmd.Flags().Changed("public-ip") {
-		oldIP := PublicIPNone
-		if machine.Machine.PublicIp != nil {
-			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
-				oldIP = addr.String()
-			}
-		}
-		newIP := PublicIPNone
-		if updatedMachine.PublicIp != nil {
-			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
-				newIP = addr.String()
-			}
-		}
-		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
-	}
-	if cmd.Flags().Changed("wg-endpoint") {
-		formatEndpoints := func(eps []*pb.IPPort) string {
-			if len(eps) == 0 {
-				return "none"
-			}
-			parts := make([]string, len(eps))
-			for i, ep := range eps {
-				ap, _ := ep.ToAddrPort()
-				parts[i] = ap.String()
-			}
-			return strings.Join(parts, ", ")
-		}
-		oldEndpoints := formatEndpoints(machine.Machine.Network.Endpoints)
-		newEndpoints := formatEndpoints(updatedMachine.Network.Endpoints)
-		changes = append(changes, fmt.Sprintf("endpoints: %s -> %s", oldEndpoints, newEndpoints))
-	}
-
-	fmt.Printf("Machine '%s' (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
-	for _, change := range changes {
-		fmt.Printf("  %s\n", change)
-	}
-
-	return nil
-}
@@ -1,194 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-	"os"
-	"strings"
-
-	"github.com/psviderski/uncloud/cmd/uc/caddy"
-	cmdcontext "github.com/psviderski/uncloud/cmd/uc/context"
-	"github.com/psviderski/uncloud/cmd/uc/dns"
-	"github.com/psviderski/uncloud/cmd/uc/image"
-	cmdmachine "github.com/psviderski/uncloud/cmd/uc/machine"
-	"github.com/psviderski/uncloud/cmd/uc/service"
-	"github.com/psviderski/uncloud/cmd/uc/volume"
-	"github.com/psviderski/uncloud/cmd/uc/wg"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/fs"
-	"github.com/psviderski/uncloud/internal/log"
-	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/psviderski/uncloud/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-type globalOptions struct {
-	configPath string
-	connect    string
-	context    string
-}
-
-func main() {
-	log.InitLoggerFromEnv()
-
-	opts := globalOptions{}
-	cmd := &cobra.Command{
-		Use:           "uc",
-		Short:         "A CLI tool for managing Uncloud resources such as machines, services, and volumes.",
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-			// Shell completion runs through the hidden __complete command which has flag parsing disabled,
-			// so the global flags from the completed command line are never parsed. Apply them manually to make
-			// completion work with --connect, --context, and --uncloud-config.
-			if cmd.Name() == cobra.ShellCompRequestCmd {
-				applyGlobalFlagsFromCompletionArgs(cmd.Root().PersistentFlags(), os.Args[1:])
-			}
-
-			cli.BindEnvToFlag(cmd, "connect", "UNCLOUD_CONNECT")
-			cli.BindEnvToFlag(cmd, "context", "UNCLOUD_CONTEXT")
-			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
-
-			var conn *config.MachineConnection
-			if opts.connect != "" {
-				if after, ok := strings.CutPrefix(opts.connect, "tcp://"); ok {
-					addrPort, err := netip.ParseAddrPort(after)
-					if err != nil {
-						return fmt.Errorf("parse TCP address: %w", err)
-					}
-					conn = &config.MachineConnection{
-						TCP: &addrPort,
-					}
-				} else if after, ok := strings.CutPrefix(opts.connect, "ssh+go://"); ok {
-					conn = &config.MachineConnection{
-						SSHGo: config.SSHDestination(after),
-					}
-				} else if after, ok := strings.CutPrefix(opts.connect, "ssh+cli://"); ok {
-					// Backward-compatible alias for ssh://.
-					conn = &config.MachineConnection{
-						SSH: config.SSHDestination(after),
-					}
-				} else if strings.HasPrefix(opts.connect, "unix://") {
-					conn = &config.MachineConnection{
-						Unix: opts.connect[len("unix://"):],
-					}
-				} else {
-					// Default: system ssh CLI command (no prefix or ssh:// prefix).
-					dest := strings.TrimPrefix(opts.connect, "ssh://")
-					conn = &config.MachineConnection{
-						SSH: config.SSHDestination(dest),
-					}
-				}
-			}
-
-			configPath := fs.ExpandHomeDir(opts.configPath)
-
-			// Make uc connect via the local Unix socket when running on a cluster machine.
-			if opts.connect == "" {
-				if !fs.Exists(configPath) && fs.Exists(machine.DefaultClusterAPISockPath) {
-					conn = &config.MachineConnection{
-						Unix: machine.DefaultClusterAPISockPath,
-					}
-				}
-			}
-
-			uncli, err := cli.New(configPath, conn, opts.context)
-			if err != nil {
-				return fmt.Errorf("initialise CLI: %w", err)
-			}
-			cmd.SetContext(context.WithValue(cmd.Context(), "cli", uncli))
-			return nil
-		},
-	}
-
-	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
-		"Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]\n"+
-			"Format: [ssh://]user@host[:port], ssh+go://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock")
-	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
-		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
-	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
-	cmd.PersistentFlags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]")
-
-	// Set custom help function to show links to docs and Discord only for the root 'uc' command.
-	defaultHelpFunc := cmd.HelpFunc()
-	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
-		defaultHelpFunc(c, args)
-		// Only show links for the root 'uc' command.
-		if c.Name() == "uc" {
-			fmt.Fprintln(c.OutOrStdout())
-			fmt.Fprintf(c.OutOrStdout(), "Learn more about Uncloud:       %s\n",
-				tui.URLStyle.Render(version.DocsURL))
-			fmt.Fprintf(c.OutOrStdout(), "Join our Discord community:     %s\n",
-				tui.URLStyle.Render(version.DiscordURL))
-		}
-	})
-
-	cmd.AddGroup(&cobra.Group{
-		ID:    "service",
-		Title: "Deploy and manage services:",
-	})
-
-	cmd.AddCommand(
-		NewBuildCommand(),
-		NewDeployCommand(),
-		NewDocsCommand(),
-		NewImagesCommand(),
-		NewPsCommand(),
-		NewProxyCommand(),
-		caddy.NewRootCommand(),
-		cmdcontext.NewRootCommand(),
-		dns.NewRootCommand(),
-		image.NewRootCommand(),
-		cmdmachine.NewRootCommand(),
-		service.NewRootCommand(),
-		service.NewExecCommand("service"),
-		service.NewInspectCommand("service"),
-		service.NewListCommand("service"),
-		service.NewLogsCommand("service"),
-		service.NewRmCommand("service"),
-		service.NewRunCommand("service"),
-		service.NewScaleCommand("service"),
-		service.NewStartCommand("service"),
-		service.NewStopCommand("service"),
-		NewVersionCommand(),
-		volume.NewRootCommand(),
-		wg.NewRootCommand(),
-	)
-	if err := cmd.Execute(); err != nil {
-		if cancelled, ok := errors.AsType[*cli.CancelledError](err); ok {
-			fmt.Fprintln(os.Stderr, cancelled.Error())
-			os.Exit(1)
-		}
-		cobra.CheckErr(err)
-	}
-}
-
-// applyGlobalFlagsFromCompletionArgs parses the global flags from the raw arguments of a __complete command and applies
-// the ones found to flags. The trailing word being completed, unknown flags, and positional arguments are ignored.
-func applyGlobalFlagsFromCompletionArgs(flags *pflag.FlagSet, args []string) {
-	// The shell always passes the word being completed as the last argument, even if it's empty.
-	// Exclude it from parsing as its value may not be complete yet.
-	if len(args) == 0 {
-		return
-	}
-	args = args[:len(args)-1]
-
-	fset := pflag.NewFlagSet("global", pflag.ContinueOnError)
-	fset.ParseErrorsAllowlist.UnknownFlags = true
-	fset.String("connect", "", "")
-	fset.StringP("context", "c", "", "")
-	fset.String("uncloud-config", "", "")
-	// Parsing an incomplete command line may fail, apply the flags parsed so far anyway.
-	_ = fset.Parse(args)
-
-	fset.Visit(func(f *pflag.Flag) {
-		// Setting the flag marks it as changed so it takes precedence over environment variables.
-		_ = flags.Set(f.Name, f.Value.String())
-	})
-}
@@ -1,116 +0,0 @@
-package main
-
-import (
-	"slices"
-	"testing"
-
-	"github.com/spf13/pflag"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestApplyGlobalFlagsFromCompletionArgs(t *testing.T) {
-	defaultConfigPath := "~/.config/uncloud/config.yaml"
-
-	tests := []struct {
-		name           string
-		args           []string
-		wantConnect    string
-		wantContext    string
-		wantConfigPath string
-		// Flag names expected to be marked as changed on the target flag set.
-		wantChanged []string
-	}{
-		{
-			name: "no flags",
-			args: []string{"__complete", "inspect", ""},
-		},
-		{
-			name:        "connect with space",
-			args:        []string{"__complete", "--connect", "ssh://user@host", "inspect", ""},
-			wantConnect: "ssh://user@host",
-			wantChanged: []string{"connect"},
-		},
-		{
-			name:        "connect with equals",
-			args:        []string{"__complete", "--connect=tcp://127.0.0.1:51000", "inspect", ""},
-			wantConnect: "tcp://127.0.0.1:51000",
-			wantChanged: []string{"connect"},
-		},
-		{
-			name:        "context shorthand",
-			args:        []string{"__complete", "-c", "prod", "inspect", ""},
-			wantContext: "prod",
-			wantChanged: []string{"context"},
-		},
-		{
-			name:           "all flags",
-			args:           []string{"__complete", "--connect", "user@host", "-c", "prod", "--uncloud-config", "/tmp/uncloud.yaml", "inspect", ""},
-			wantConnect:    "user@host",
-			wantContext:    "prod",
-			wantConfigPath: "/tmp/uncloud.yaml",
-			wantChanged:    []string{"connect", "context", "uncloud-config"},
-		},
-		{
-			name:        "unknown flags are ignored",
-			args:        []string{"__complete", "--quiet", "-n", "5", "--connect", "user@host", "logs", ""},
-			wantConnect: "user@host",
-			wantChanged: []string{"connect"},
-		},
-		{
-			name: "flags after double dash are ignored",
-			args: []string{"__complete", "exec", "svc", "--", "sh", "--connect", "user@host"},
-		},
-		{
-			name:        "flags before double dash are applied",
-			args:        []string{"__complete", "--connect", "user@host", "exec", "svc", "--", "sh", "-c", "env"},
-			wantConnect: "user@host",
-			wantChanged: []string{"connect"},
-		},
-		{
-			name:        "partial flag name being completed is excluded",
-			args:        []string{"__complete", "--connect", "user@host", "inspect", "--context"},
-			wantConnect: "user@host",
-			wantChanged: []string{"connect"},
-		},
-		{
-			name: "partial flag value being completed is excluded",
-			args: []string{"__complete", "--uncloud-config", "/tmp/"},
-		},
-		{
-			name: "partial connect value being completed is excluded",
-			args: []string{"__complete", "--connect", "tcp://127.0.0.1:5"},
-		},
-		{
-			name:           "completed flag value with partial command word",
-			args:           []string{"__complete", "--uncloud-config", "/tmp/uncloud.yaml", "insp"},
-			wantConfigPath: "/tmp/uncloud.yaml",
-			wantChanged:    []string{"uncloud-config"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Mirror the global persistent flags defined on the root command.
-			var opts globalOptions
-			flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
-			flags.StringVar(&opts.connect, "connect", "", "")
-			flags.StringVarP(&opts.context, "context", "c", "", "")
-			flags.StringVar(&opts.configPath, "uncloud-config", defaultConfigPath, "")
-
-			applyGlobalFlagsFromCompletionArgs(flags, tt.args)
-
-			assert.Equal(t, tt.wantConnect, opts.connect)
-			assert.Equal(t, tt.wantContext, opts.context)
-			wantConfigPath := tt.wantConfigPath
-			if wantConfigPath == "" {
-				wantConfigPath = defaultConfigPath
-			}
-			assert.Equal(t, wantConfigPath, opts.configPath)
-
-			for _, name := range []string{"connect", "context", "uncloud-config"} {
-				assert.Equal(t, slices.Contains(tt.wantChanged, name), flags.Changed(name),
-					"changed status of flag '%s'", name)
-			}
-		})
-	}
-}
@@ -1,175 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/proxy"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type proxyOptions struct {
-	localPort  int
-	remotePort int
-	service    string
-}
-
-// NewProxyCommand creates a new command to proxy a local port to a service's port in the cluster.
-func NewProxyCommand() *cobra.Command {
-	opts := proxyOptions{}
-	cmd := &cobra.Command{
-		Use:   "proxy SERVICE [LOCAL_PORT:]REMOTE_PORT",
-		Args:  cobra.ExactArgs(2),
-		Short: "Proxy a service port to a local port.",
-		Long: `Proxy a service port in the cluster to a local port on this machine.
-
-If the service runs multiple containers, the command connects to the first running and healthy one.
-If you don't provide a local port, the command picks a random one.
-
-The connection stays open for as long as the command runs.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			opts.service = args[0]
-
-			parts := strings.Split(args[1], ":")
-			switch len(parts) {
-			case 1:
-				remoteport, err := strconv.Atoi(parts[0])
-				if err != nil {
-					return fmt.Errorf("invalid remote port: '%s': %w", parts[0], err)
-				}
-				opts.remotePort = remoteport
-			case 2:
-				localport, err := strconv.Atoi(parts[0])
-				if err != nil {
-					return fmt.Errorf("invalid local port: '%s': %w", parts[0], err)
-				}
-				remoteport, err := strconv.Atoi(parts[1])
-				if err != nil {
-					return fmt.Errorf("invalid remote port: '%s': %w", parts[1], err)
-				}
-				opts.localPort = localport
-				opts.remotePort = remoteport
-			default:
-				return fmt.Errorf("invalid port")
-			}
-
-			return runProxy(cmd.Context(), uncli, opts)
-		},
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	return cmd
-}
-
-func runProxy(ctx context.Context, uncli *cli.CLI, opts proxyOptions) error {
-	if opts.localPort < 0 || opts.localPort > 65535 {
-		return fmt.Errorf("invalid local port %d: must be between 0 and 65535", opts.localPort)
-	}
-	if opts.remotePort < 1 || opts.remotePort > 65535 {
-		return fmt.Errorf("invalid remote port %d: must be between 1 and 65535", opts.remotePort)
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	svc, err := clusterClient.InspectService(ctx, opts.service)
-	if err != nil {
-		if errors.Is(err, api.ErrNotFound) {
-			return fmt.Errorf("service '%s' not found in the cluster", opts.service)
-		}
-		return fmt.Errorf("inspect service '%s': %w", opts.service, err)
-	}
-
-	// Pick the first running and healthy container to proxy to.
-	var ctr *api.MachineServiceContainer
-	for i := range svc.Containers {
-		if svc.Containers[i].Container.Healthy() {
-			ctr = &svc.Containers[i]
-			break
-		}
-	}
-	if ctr == nil {
-		return fmt.Errorf("no running healthy container found for service '%s'", opts.service)
-	}
-
-	containerID := ctr.Container.ShortID()
-	ip := ctr.Container.UncloudNetworkIP()
-	if !ip.IsValid() {
-		return fmt.Errorf("container '%s' is not connected to the uncloud Docker network (could be host network)",
-			containerID)
-	}
-
-	dialer, err := clusterClient.Dialer()
-	if err != nil {
-		return fmt.Errorf("get proxy dialer: %w", err)
-	}
-
-	listener, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(opts.localPort)))
-	if err != nil {
-		return fmt.Errorf("listen on 127.0.0.1:%d: %w", opts.localPort, err)
-	}
-
-	// There is no precheck if we can connect, as this always succeeds, only the proxy connects with the
-	// endpoint and shuffles the data, *it* will actually experience errors.
-	remoteAddr := net.JoinHostPort(ip.String(), strconv.Itoa(opts.remotePort))
-
-	p := &proxy.Proxy{
-		Listener:    listener,
-		RemoteAddr:  remoteAddr,
-		DialContext: dialer.DialContext,
-		OnError: func(err error) {
-			if proxy.IsConnectionClosedError(err) {
-				return
-			}
-			// A more actionable error instead of the cryptic [ssh -W] command error.
-			if strings.Contains(err.Error(), "Session open refused by peer") {
-				fmt.Printf("Could not connect to '%s': connection refused. "+
-					"Check that the service is running and listening on port %d inside the container.\n",
-					remoteAddr, opts.remotePort)
-				return
-			}
-
-			fmt.Printf("Failed to proxy a connection to '%s': %v\n", remoteAddr, err)
-		},
-	}
-
-	// Prefix the local address with the scheme for common HTTP ports so it becomes control-clickable in most
-	// terminals. We assume plain HTTP since TLS is typically terminated by Caddy in front of the service.
-	fmt.Printf("%s%s → %s (%s%s%s)\n", schemeForPort(opts.remotePort), p.Listener.Addr().String(),
-		remoteAddr, opts.service, tui.Faint.Render("/"), containerID)
-
-	if err = p.Run(ctx); err != nil {
-		return fmt.Errorf("run proxy to '%s': %w", remoteAddr, err)
-	}
-	return nil
-}
-
-// schemeForPort returns the "http://" URL scheme prefix for the ports most likely to serve plain HTTP,
-// or an empty string otherwise.
-func schemeForPort(port int) string {
-	switch port {
-	case 80, 3000, 8000, 8080, 8081, 8888, 9090:
-		return "http://"
-	default:
-		return ""
-	}
-}
@@ -1,269 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-const (
-	sortByService = "service"
-	sortByMachine = "machine"
-	sortByHealth  = "health"
-)
-
-type containerHighlight int
-
-const (
-	highlightDanger containerHighlight = iota
-	highlightWarning
-	highlightSuccess
-	highlightNormal
-)
-
-type psOptions struct {
-	sortBy string
-}
-
-func NewPsCommand() *cobra.Command {
-	opts := psOptions{}
-	cmd := &cobra.Command{
-		Use:   "ps",
-		Short: "List all service containers.",
-		Long: `List all service containers across all machines in the cluster.
-
-This command provides a comprehensive overview of all running containers that are part of a service,
-making it easy to see the distribution and status of containers across the cluster.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if opts.sortBy != sortByService && opts.sortBy != sortByMachine && opts.sortBy != sortByHealth {
-				return fmt.Errorf("invalid value for --sort: %q, must be one of '%s', '%s' or '%s'", opts.sortBy,
-					sortByService, sortByMachine, sortByHealth)
-			}
-
-			return runPs(cmd.Context(), uncli, opts)
-		},
-		GroupID: "service",
-	}
-	cmd.Flags().StringVarP(&opts.sortBy, "sort", "s", sortByService,
-		"Sort containers by 'service', 'machine', or 'health'.")
-	return cmd
-}
-
-type containerInfo struct {
-	serviceName string
-	machineName string
-	id          string
-	image       string
-	status      string
-	highlight   containerHighlight
-	created     time.Time
-	ip          string
-	// Hook type (e.g., "pre-deploy"), empty for regular containers.
-	hook string
-}
-
-func runPs(ctx context.Context, uncli *cli.CLI, opts psOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	var containers []containerInfo
-	err = tui.RunSpinner(ctx, "Collecting container info...", func(ctx context.Context) error {
-		containers, err = collectContainers(ctx, clusterClient)
-		return err
-	})
-	if err != nil {
-		return fmt.Errorf("collect containers: %w", err)
-	}
-
-	// Sort the containers based on the sorting option.
-	sort.SliceStable(containers, func(i, j int) bool {
-		a, b := containers[i], containers[j]
-		switch opts.sortBy {
-		case sortByHealth:
-			if a.highlight != b.highlight {
-				return a.highlight < b.highlight
-			}
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		case sortByMachine:
-			if a.machineName != b.machineName {
-				return a.machineName < b.machineName
-			}
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		default: // sortByService
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		}
-		// Fallback to creation time (newest first).
-		return a.created.After(b.created)
-	})
-
-	return printContainers(containers)
-}
-
-func printContainers(containers []containerInfo) error {
-	t := tui.NewTable()
-
-	// Show HOOK column only when hook containers are present.
-	hasHooks := false
-	for _, ctr := range containers {
-		if ctr.hook != "" {
-			hasHooks = true
-			break
-		}
-	}
-
-	if hasHooks {
-		t.Headers("SERVICE", "CONTAINER ID", "IMAGE", "CREATED", "STATUS", "HOOK", "IP ADDRESS", "MACHINE")
-	} else {
-		t.Headers("SERVICE", "CONTAINER ID", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
-	}
-
-	for _, ctr := range containers {
-		id := ctr.id
-		if len(id) > 12 {
-			id = id[:12]
-		}
-
-		created := units.HumanDuration(time.Now().UTC().Sub(ctr.created)) + " ago"
-
-		var statusStyle lipgloss.Style
-		switch ctr.highlight {
-		case highlightSuccess:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("2")) // Green
-		case highlightDanger:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("1")) // Red
-		case highlightWarning:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("3")) // Yellow
-		default:
-			statusStyle = lipgloss.NewStyle() // Default
-		}
-
-		if hasHooks {
-			t.Row(
-				ctr.serviceName,
-				id,
-				tui.FormatImage(ctr.image, tui.NoStyle),
-				created,
-				statusStyle.Render(ctr.status),
-				ctr.hook,
-				ctr.ip,
-				ctr.machineName,
-			)
-		} else {
-			t.Row(
-				ctr.serviceName,
-				id,
-				tui.FormatImage(ctr.image, tui.NoStyle),
-				created,
-				statusStyle.Render(ctr.status),
-				ctr.ip,
-				ctr.machineName,
-			)
-		}
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
-
-func collectContainers(ctx context.Context, cli *client.Client) ([]containerInfo, error) {
-	listCtx := client.ProxyMachinesContext(ctx, nil)
-
-	// List all service containers across all machines in the cluster.
-	machineContainers, err := cli.Docker.ListServiceContainers(
-		listCtx, "", container.ListOptions{All: true},
-	)
-	if err != nil {
-		return nil, fmt.Errorf("list service containers: %w", err)
-	}
-
-	var containers []containerInfo
-	for _, msc := range machineContainers {
-		// NOTE: Metadata should never be nil in practice. This is legacy fallback that will be removed.
-		if msc.Metadata == nil {
-			tui.PrintWarning("metadata is missing in response from unknown server")
-			continue
-		}
-
-		machineName := msc.Metadata.MachineName
-
-		if msc.Metadata.Error != "" {
-			tui.PrintWarning(fmt.Sprintf("failed to list service containers on machine %s: %s",
-				machineName, msc.Metadata.Error))
-			continue
-		}
-
-		for _, ctr := range append(msc.Containers, msc.HookContainers...) {
-			if ctr.Container.State == nil || ctr.Container.Config == nil {
-				continue
-			}
-
-			status, err := ctr.Container.HumanState()
-			if err != nil {
-				return nil, fmt.Errorf("get human state for container %s: %w", ctr.Container.ID, err)
-			}
-
-			var highlight containerHighlight
-			healthStatus := ""
-			if ctr.Container.State.Health != nil {
-				healthStatus = ctr.Container.State.Health.Status
-			}
-
-			if healthStatus == container.Unhealthy || ctr.Container.State.Status == "dead" || ctr.Container.State.OOMKilled || ctr.Container.State.Dead {
-				highlight = highlightDanger
-			} else if healthStatus == container.Healthy {
-				highlight = highlightSuccess
-			} else if ctr.Container.State.Status == "running" {
-				highlight = highlightNormal
-			} else if ctr.IsHook() && ctr.Container.State.Status == "exited" && ctr.Container.State.ExitCode == 0 {
-				// Hook containers (e.g., pre-deploy) are expected to exit successfully.
-				highlight = highlightNormal
-			} else { // Other non-critical but noteworthy states
-				highlight = highlightWarning
-			}
-
-			created, _ := time.Parse(time.RFC3339Nano, ctr.Container.Created)
-
-			ip := ctr.Container.UncloudNetworkIP()
-			ipStr := ""
-			// The container might not have an IP if it's not running or uses the host network.
-			if ip.IsValid() {
-				ipStr = ip.String()
-			}
-
-			info := containerInfo{
-				serviceName: ctr.ServiceName(),
-				machineName: machineName,
-				id:          ctr.Container.ID,
-				image:       ctr.Container.Config.Image,
-				status:      status,
-				highlight:   highlight,
-				created:     created,
-				ip:          ipStr,
-				hook:        ctr.Config.Labels[api.LabelHook],
-			}
-			containers = append(containers, info)
-		}
-	}
-	return containers, nil
-}
@@ -1,105 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/docker"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-)
-
-type mockDockerClient struct {
-	pb.DockerClient
-	listResp *pb.ListServiceContainersResponse
-	listErr  error
-}
-
-func (m *mockDockerClient) ListServiceContainers(ctx context.Context, in *pb.ListServiceContainersRequest, opts ...grpc.CallOption) (*pb.ListServiceContainersResponse, error) {
-	return m.listResp, m.listErr
-}
-
-func TestCollectContainers(t *testing.T) {
-	containerData1 := map[string]interface{}{
-		"Id":   "container1",
-		"Name": "container-1",
-		"Config": map[string]any{
-			"Image": "image-1",
-		},
-		"State": map[string]any{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]any{
-			"Networks": map[string]any{},
-		},
-	}
-	containerJSON1, _ := json.Marshal(containerData1)
-
-	containerData2 := map[string]any{
-		"Id":   "container2",
-		"Name": "container-2",
-		"Config": map[string]any{
-			"Image": "image-2",
-		},
-		"State": map[string]any{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]any{
-			"Networks": map[string]any{},
-		},
-	}
-	containerJSON2, _ := json.Marshal(containerData2)
-
-	serviceSpecJSON, _ := json.Marshal(map[string]any{})
-
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: &pb.Metadata{MachineAddr: "10.0.0.1", MachineName: "machine-1"},
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON1,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-				{
-					Metadata: &pb.Metadata{MachineAddr: "10.0.0.2", MachineName: "machine-2"},
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON2,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	cli := &client.Client{
-		Docker: &docker.Client{GRPCClient: mockDocker},
-	}
-
-	containers, err := collectContainers(context.Background(), cli)
-	require.NoError(t, err)
-
-	assert.Len(t, containers, 2)
-	for _, c := range containers {
-		if c.id == "container1" {
-			assert.Equal(t, "machine-1", c.machineName)
-		} else if c.id == "container2" {
-			assert.Equal(t, "machine-2", c.machineName)
-		} else {
-			t.Errorf("unexpected container id: %s", c.id)
-		}
-	}
-}
@@ -1,150 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/docker/cli/cli/streams"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type execCliOptions struct {
-	detach      bool
-	interactive bool
-	noTty       bool
-	containerId string
-}
-
-var DEFAULT_COMMAND = []string{"sh", "-c", "command -v bash >/dev/null 2>&1 && exec bash || exec sh"}
-
-func NewExecCommand(groupID string) *cobra.Command {
-	opts := execCliOptions{}
-
-	execCmd := &cobra.Command{
-		Use:   "exec [OPTIONS] SERVICE [COMMAND ARGS...]",
-		Short: "Execute a command in a running service container.",
-		Long: `Execute a command (interactive shell by default) in a running container within a service.
-If the service has multiple replicas and no container ID is specified, the command will be executed in a random container.
-	`,
-		Example: `
-  # Start an interactive shell ("bash" or "sh" will be tried by default)
-  uc exec web-service
-
-  # Start an interactive shell with explicit command
-  uc exec web-service /bin/zsh
-
-  # List files in the specific container of the service; --container accepts full ID or a (unique) prefix
-  uc exec --container d792e web-service ls -la
-
-  # Pipe input to a command inside the service container
-  cat backup.sql | uc exec -T db-service psql -U postgres mydb
-
-  # Run a task in the background (detached mode)
-  uc exec -d web-service /scripts/cleanup.sh`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			serviceName, command := normalizeExecArgs(args)
-			if len(command) == 0 {
-				command = DEFAULT_COMMAND
-			}
-			return runExec(cmd.Context(), uncli, serviceName, command, opts)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	execCmd.Flags().BoolVarP(&opts.detach, "detach", "d", false, "Detached mode: run command in the background")
-
-	execCmd.Flags().BoolVarP(&opts.noTty, "no-tty", "T", false,
-		"Disable pseudo-TTY allocation. By default 'uc exec' allocates a TTY when connected to a terminal.")
-
-	// Keep "-i" and "-t" flags hidden for compatibility with docker exec
-	execCmd.Flags().BoolVarP(&opts.interactive, "interactive", "i", true, "Keep STDIN open even if not attached")
-	execCmd.Flags().MarkHidden("interactive")
-
-	execCmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
-	execCmd.Flags().MarkHidden("tty")
-
-	// Common flags
-	execCmd.Flags().StringVar(&opts.containerId, "container", "",
-		"ID of the container to exec into. Accepts full ID or a unique prefix "+
-			"(default is the random container of the service)")
-
-	// This tells Cobra that all flags must come before positional arguments, so that
-	// commands with their own flags can be handled correctly.
-	execCmd.Flags().SetInterspersed(false)
-
-	return execCmd
-}
-
-func normalizeExecArgs(args []string) (serviceName string, command []string) {
-	serviceName = args[0]
-	command = args[1:]
-	if len(command) > 0 && command[0] == "--" {
-		command = command[1:]
-	}
-	return serviceName, command
-}
-
-func runExec(ctx context.Context, uncli *cli.CLI, serviceName string, command []string, opts execCliOptions) error {
-	// Disable TTY allocation if not connected to a terminal
-	if !tui.IsStdoutTerminal() {
-		opts.noTty = true
-	}
-
-	if !opts.detach {
-		// Check if we're trying to attach to a TTY from a non-TTY client, e.g.
-		// when doing an 'cmd | uc exec ...'
-		stdin := streams.NewIn(os.Stdin)
-		// TODO: this logic/behavior mirrors docker-compose, but we can be smarter about it and detect TTY dynamically
-		if err := stdin.CheckTty(opts.interactive, !opts.noTty); err != nil {
-			return fmt.Errorf("check TTY: %w; use -T option to disable TTY allocation", err)
-		}
-	}
-
-	client, err := uncli.ConnectClusterWithOptions(ctx, cli.ConnectOptions{
-		ShowProgress: false,
-	})
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	execConfig := api.ExecOptions{
-		Command:     command,
-		AttachStdin: opts.interactive,
-		Tty:         !opts.noTty,
-		Detach:      opts.detach,
-	}
-
-	if !opts.detach {
-		execConfig.AttachStdout = true
-		execConfig.AttachStderr = true
-	}
-
-	exitCode, err := client.ExecContainer(ctx, serviceName, opts.containerId, execConfig)
-	if err != nil {
-		return fmt.Errorf("exec container: %w", err)
-	}
-
-	// For non-detached mode, exit with the same code as the executed command
-	if !opts.detach {
-		if exitCode != 0 {
-			os.Exit(exitCode)
-		}
-	}
-
-	return nil
-}
@@ -1,61 +0,0 @@
-package service
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNormalizeExecArgs(t *testing.T) {
-	tests := []struct {
-		name            string
-		args            []string
-		wantServiceName string
-		wantCommand     []string
-	}{
-		{
-			name:            "service only",
-			args:            []string{"test-service"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{},
-		},
-		{
-			name:            "service with command",
-			args:            []string{"test-service", "echo", "hello"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{"echo", "hello"},
-		},
-		{
-			name:            "service with separator and command",
-			args:            []string{"test-service", "--", "echo", "hello"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{"echo", "hello"},
-		},
-		{
-			name:            "service with separator only",
-			args:            []string{"test-service", "--"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{},
-		},
-		{
-			name:            "separator preserves command flag",
-			args:            []string{"test-service", "--", "--help"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{"--help"},
-		},
-		{
-			name:            "only first separator is removed",
-			args:            []string{"test-service", "--", "cmd", "--", "arg"},
-			wantServiceName: "test-service",
-			wantCommand:     []string{"cmd", "--", "arg"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			gotServiceName, gotCommand := normalizeExecArgs(tt.args)
-			assert.Equal(t, tt.wantServiceName, gotServiceName)
-			assert.Equal(t, tt.wantCommand, gotCommand)
-		})
-	}
-}
@@ -1,132 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type inspectOptions struct {
-	service string
-}
-
-func NewInspectCommand(groupID string) *cobra.Command {
-	opts := inspectOptions{}
-	cmd := &cobra.Command{
-		Use:   "inspect SERVICE",
-		Short: "Display detailed information on a service.",
-		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.service = args[0]
-			return inspect(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-	return cmd
-}
-
-func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	svc, err := client.InspectService(ctx, opts.service)
-	if err != nil {
-		return fmt.Errorf("inspect service: %w", err)
-	}
-
-	fmt.Printf("Service ID: %s\n", svc.ID)
-	fmt.Printf("Name:       %s\n", svc.Name)
-	fmt.Printf("Mode:       %s\n", svc.Mode)
-	fmt.Println()
-
-	// Combine regular and hook containers.
-	allContainers := append(svc.Containers, svc.HookContainers...)
-
-	// Parse created times for sorting and display.
-	createdTimes := make(map[string]time.Time, len(allContainers))
-	for _, ctr := range allContainers {
-		createdTimes[ctr.Container.ID], _ = time.Parse(time.RFC3339Nano, ctr.Container.Created)
-	}
-
-	// Sort containers by created time (newest first).
-	slices.SortFunc(allContainers, func(a, b api.MachineServiceContainer) int {
-		return createdTimes[b.Container.ID].Compare(createdTimes[a.Container.ID])
-	})
-
-	// Print the list of containers in a table format.
-	// Show HOOK column only when hook containers are present.
-	hasHooks := len(svc.HookContainers) > 0
-
-	t := tui.NewTable()
-	if hasHooks {
-		t.Headers("CONTAINER ID", "IMAGE", "CREATED", "STATUS", "HOOK", "IP ADDRESS", "MACHINE")
-	} else {
-		t.Headers("CONTAINER ID", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
-	}
-
-	now := time.Now().UTC()
-	for _, ctr := range allContainers {
-		created := units.HumanDuration(now.Sub(createdTimes[ctr.Container.ID])) + " ago"
-
-		machine := ctr.MachineName
-		if machine == "" {
-			machine = ctr.MachineID
-		}
-		state, err := ctr.Container.HumanState()
-		if err != nil {
-			return fmt.Errorf("get human state: %w", err)
-		}
-
-		ip := ctr.Container.UncloudNetworkIP()
-		ipStr := ""
-		// The container might not have an IP if it's not running or uses the host network.
-		if ip.IsValid() {
-			ipStr = ip.String()
-		}
-
-		if hasHooks {
-			t.Row(
-				stringid.TruncateID(ctr.Container.ID),
-				tui.FormatImage(ctr.Container.Config.Image, tui.NoStyle),
-				created,
-				state,
-				ctr.Container.Config.Labels[api.LabelHook],
-				ipStr,
-				machine,
-			)
-		} else {
-			t.Row(
-				stringid.TruncateID(ctr.Container.ID),
-				tui.FormatImage(ctr.Container.Config.Image, tui.NoStyle),
-				created,
-				state,
-				ipStr,
-				machine,
-			)
-		}
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
@@ -1,194 +0,0 @@
-package service
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	mapset "github.com/deckarep/golang-set/v2"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/logs"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/spf13/cobra"
-)
-
-func NewLogsCommand(groupID string) *cobra.Command {
-	var options logs.Options
-
-	cmd := &cobra.Command{
-		Use:     "logs [SERVICE[/CONTAINER]...]",
-		Aliases: []string{"log"},
-		Short:   "View service logs.",
-		Long: `View logs from all replicas of the specified service(s) across all machines in the cluster.
-
-To view logs from specific replicas (containers) within a service, use the SERVICE/CONTAINER form,
-where CONTAINER is a container name, full ID, or unique ID prefix.
-
-If no services are specified, streams logs from all services defined in the Compose file
-(compose.yaml by default or the file(s) specified with --file).`,
-		Example: `  # View recent logs for a service.
-  uc logs web
-
-  # Stream logs in real-time (follow mode).
-  uc logs -f web
-
-  # View logs from multiple services.
-  uc logs web api db
-
-  # View logs from all services in compose.yaml.
-  uc logs
-
-  # Show last 20 lines per replica (default is 100).
-  uc logs -n 20 web
-
-  # Show all logs without line limit.
-  uc logs -n all web
-
-  # View logs from a specific time range.
-  uc logs --since 3h --until 1h30m web
-
-  # View logs only from specific replicas (containers).
-  uc logs web/61d57fd3428f api/2f60
-
-  # View logs only from replicas running on specific machines.
-  uc logs -m machine1,machine2 web api`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return RunLogs(cmd.Context(), uncli, args, options)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	cmd.Flags().StringSliceVar(&options.Files, "file", nil,
-		"One or more Compose files to load service names from when no services are specified. (default compose.yaml)")
-
-	cmd.Flags().AddFlagSet(logs.Flags(&options))
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func RunLogs(ctx context.Context, uncli *cli.CLI, args []string, opts logs.Options) error {
-	serviceArgs, err := logs.ParseServiceArgs(args)
-	if err != nil {
-		return err
-	}
-
-	// If no services specified, try to load them from the Compose file(s).
-	fromCompose := false
-	if len(serviceArgs) == 0 {
-		fromCompose = true
-		project, err := compose.LoadProject(ctx, opts.Files)
-		if err != nil {
-			return fmt.Errorf("load Compose file(s): %w", err)
-		}
-
-		uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
-
-		// View logs for all services, including disabled by inactive profiles.
-		composeServices := append(project.ServiceNames(), project.DisabledServiceNames()...)
-		if len(composeServices) == 0 {
-			return errors.New("no services found in Compose file(s)")
-		}
-
-		serviceArgs = make([]logs.ServiceArg, len(composeServices))
-		for i, name := range composeServices {
-			serviceArgs[i] = logs.ServiceArg{Service: name}
-		}
-	}
-
-	// Parse tail option.
-	tail, err := logs.Tail(opts.Tail)
-	if err != nil {
-		return err
-	}
-
-	c, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer c.Close()
-
-	baseOpts := api.ServiceLogsOptions{
-		Follow:   opts.Follow,
-		Tail:     tail,
-		Since:    opts.Since,
-		Until:    opts.Until,
-		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
-	}
-
-	// Collect log streams from all services. When service names come from a Compose file,
-	// skip the ones that are not found in the cluster (they may have been removed or not deployed yet).
-	machineIDsSet := mapset.NewSet[string]()
-	svcStreams := make([]<-chan api.ServiceLogEntry, 0, len(serviceArgs))
-	var foundServices, notFoundServices []string
-
-	for _, sa := range serviceArgs {
-		svcOpts := baseOpts
-		svcOpts.Containers = sa.Containers
-
-		svc, ch, err := c.ServiceLogs(ctx, sa.Service, svcOpts)
-		if err != nil {
-			if errors.Is(err, api.ErrNotFound) && fromCompose {
-				notFoundServices = append(notFoundServices, sa.Service)
-				continue
-			}
-			return fmt.Errorf("stream logs for service '%s': %w", sa.Service, err)
-		}
-		svcStreams = append(svcStreams, ch)
-		foundServices = append(foundServices, sa.Service)
-
-		machineIDs := svc.MachineIDs()
-		machineIDsSet.Append(machineIDs...)
-	}
-
-	if fromCompose {
-		if len(foundServices) == 0 {
-			return fmt.Errorf("stream logs for services defined in %s: no services found in the cluster",
-				strings.Join(opts.Files, ", "))
-		}
-
-		for _, name := range notFoundServices {
-			tui.PrintWarning(fmt.Sprintf("service '%s' not found in the cluster, skipping", name))
-		}
-	}
-
-	var stream <-chan api.ServiceLogEntry
-	if len(svcStreams) == 1 {
-		stream = svcStreams[0]
-	} else {
-		// Merge all service streams into a single sorted stream without stall detection as its handled per-service.
-		merger := client.NewLogMerger(svcStreams, client.LogMergerOptions{})
-		stream = merger.Stream()
-	}
-
-	// Fetch machine names for all machines (machineIDsSet) service containers are running on.
-	// Note: this is the full set per service, not narrowed by --machine or per-container filters,
-	// so the formatter may pad columns wider than strictly needed when filters are active.
-	machines, err := c.ListMachines(ctx, &api.MachineFilter{NamesOrIDs: machineIDsSet.ToSlice()})
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-	machineNames := make([]string, 0, len(machines))
-	for _, m := range machines {
-		machineNames = append(machineNames, m.Machine.Name)
-	}
-
-	formatter := logs.NewFormatter(machineNames, foundServices, opts.UTC)
-
-	// Print merged logs.
-	for entry := range stream {
-		formatter.PrintEntry(entry)
-	}
-
-	return nil
-}
@@ -1,88 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-
-	"charm.land/lipgloss/v2"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-func NewListCommand(groupID string) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:     "ls",
-		Aliases: []string{"list"},
-		Short:   "List services.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli)
-		},
-		GroupID: groupID,
-	}
-	return cmd
-}
-
-func list(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	services, err := client.ListServices(ctx)
-	if err != nil {
-		return fmt.Errorf("list services: %w", err)
-	}
-
-	// Sort services by name.
-	haveDuplicateNames := false
-	slices.SortFunc(services, func(a, b api.Service) int {
-		if a.Name == b.Name {
-			haveDuplicateNames = true
-			return strings.Compare(a.ID, b.ID)
-		}
-		return strings.Compare(a.Name, b.Name)
-	})
-
-	// Print the list of services in a table format.
-	t := tui.NewTable()
-
-	// Include the ID column if there are duplicate service names to differentiate them.
-	headers := []string{"NAME", "MODE", "REPLICAS", "IMAGE", "ENDPOINTS"}
-	if haveDuplicateNames {
-		headers = append([]string{"ID"}, headers...)
-	}
-	t.Headers(headers...)
-
-	for _, s := range services {
-		images := s.Images()
-		for i, img := range images {
-			images[i] = tui.FormatImage(img, tui.NoStyle)
-		}
-		formattedImages := strings.Join(images, tui.Faint.Render(", "))
-		endpoints := strings.Join(s.Endpoints(), tui.Faint.Render(", "))
-
-		// If no endpoints from ports, check if the service uses custom Caddy config.
-		if endpoints == "" {
-			for _, ctr := range s.Containers {
-				if ctr.Container.ServiceSpec.CaddyConfig() != "" {
-					endpoints = "(custom Caddy config)"
-				}
-			}
-		}
-
-		row := []string{s.Name, s.Mode, fmt.Sprintf("%d", len(s.Containers)), formattedImages, endpoints}
-		if haveDuplicateNames {
-			row = append([]string{s.ID}, row...)
-		}
-		t.Row(row...)
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
@@ -1,25 +0,0 @@
-package service
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:     "service",
-		Aliases: []string{"svc"},
-		Short:   "Manage services in the cluster.",
-	}
-	cmd.AddCommand(
-		NewExecCommand(""),
-		NewInspectCommand(""),
-		NewListCommand(""),
-		NewLogsCommand(""),
-		NewRmCommand(""),
-		NewRunCommand(""),
-		NewScaleCommand(""),
-		NewStartCommand(""),
-		NewStopCommand(""),
-	)
-	return cmd
-}
@@ -1,177 +0,0 @@
-package service
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type scaleOptions struct {
-	service  string
-	replicas uint
-	yes      bool
-}
-
-func NewScaleCommand(groupID string) *cobra.Command {
-	opts := scaleOptions{}
-	cmd := &cobra.Command{
-		Use:   "scale SERVICE REPLICAS",
-		Short: "Scale a replicated service by changing the number of replicas.",
-		Long:  "Scale a replicated service by changing the number of replicas.",
-		Args:  cobra.ExactArgs(2),
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			opts.service = args[0]
-			replicas, err := strconv.ParseUint(args[1], 10, 0)
-			if err != nil {
-				return fmt.Errorf("invalid number of replicas: %w", err)
-			}
-			opts.replicas = uint(replicas)
-
-			return scale(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm scaling plan. Should be explicitly set when running non-interactively,\n"+
-			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
-
-	return cmd
-}
-
-func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
-	if opts.replicas == 0 {
-		return fmt.Errorf(
-			"scaling to zero replicas is not supported. This would effectively remove the service without preserving "+
-				"its configuration, making it impossible to scale back up. Uncloud derives the service configuration "+
-				"from existing containers. Use 'uc rm %s' instead if you want to remove the service",
-			opts.service,
-		)
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	svc, err := clusterClient.InspectService(ctx, opts.service)
-	if err != nil {
-		return fmt.Errorf("inspect service '%s': %w", opts.service, err)
-	}
-
-	if svc.Mode != api.ServiceModeReplicated {
-		return fmt.Errorf("scaling is only supported for services in %s mode, service '%s' is in %s mode",
-			api.ServiceModeReplicated, svc.Name, svc.Mode)
-	}
-
-	currentReplicas := uint(len(svc.Containers))
-
-	if currentReplicas == opts.replicas {
-		fmt.Printf("Service %s already has %s replicas. No changes required.\n",
-			tui.NameStyle.Render(svc.Name), tui.Bold.Render(fmt.Sprintf("%d", currentReplicas)))
-		return nil
-	}
-
-	// TODO: Check if all containers have the same spec. If not, prompt user to choose which one to scale.
-	//  This can happen if a service deployment failed midway and some containers were not updated.
-	spec := svc.Containers[0].Container.ServiceSpec
-	spec.Replicas = opts.replicas
-	deployment := clusterClient.NewDeployment(spec, nil)
-	plan, err := deployment.Plan(ctx)
-	if err != nil {
-		return fmt.Errorf("plan deployment: %w", err)
-	}
-
-	if len(plan.Operations) == 0 {
-		fmt.Printf("Service %s is already scaled to %d replicas.\n", tui.NameStyle.Render(svc.Name), opts.replicas)
-		return nil
-	}
-
-	fmt.Println(tui.Bold.Underline(true).Render("Scaling plan"))
-	fmt.Println()
-
-	directConn := uncli.DirectConnection()
-	contextName := uncli.ContextOverrideOrCurrent()
-	deployTarget := ""
-	if directConn != "" {
-		deployTarget = directConn
-		fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
-		fmt.Println()
-	} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
-		// Only show context if there's more than one to avoid unnecessary clutter.
-		deployTarget = contextName
-		fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
-		fmt.Println()
-	}
-
-	fmt.Println(plan.Format())
-
-	summary := plan.FormatSummary()
-	fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
-	fmt.Println(summary)
-	fmt.Println()
-
-	// Ask for confirmation unless auto-confirmed with --yes.
-	if !opts.yes {
-		if !tui.IsTerminalAvailable() {
-			return errors.New("cannot ask to confirm scaling plan in non-interactive mode, " +
-				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
-		}
-
-		title := "Proceed with scaling?"
-		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
-		// scaling on the wrong cluster.
-		if deployTarget != "" {
-			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
-			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
-			title = "Proceed with scaling on " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
-		}
-
-		confirmed, err := tui.Confirm(title)
-		if err != nil {
-			return fmt.Errorf("confirm scaling: %w", err)
-		}
-		if !confirmed {
-			return cli.Cancelled("Scaling cancelled. No changes were made.")
-		}
-	}
-
-	title := fmt.Sprintf("Scaling service %s (%d → %d replicas)",
-		tui.NameStyle.Render(svc.Name), currentReplicas, opts.replicas)
-	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		if _, err = deployment.Run(ctx); err != nil {
-			return fmt.Errorf("deploy service: %w", err)
-		}
-		return nil
-	}, uncli.ProgressOut(), title)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
@@ -1,59 +0,0 @@
-//nolint:dupl
-package service
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/spf13/cobra"
-)
-
-type startOptions struct {
-	services []string
-}
-
-func NewStartCommand(groupID string) *cobra.Command {
-	opts := startOptions{}
-	cmd := &cobra.Command{
-		Use:   "start SERVICE [SERVICE...]",
-		Short: "Start one or more services.",
-		Long: `Start one or more previously stopped services.
-
-Starts all containers of the specified service(s) across all machines in the cluster.
-Services can be specified by name or ID.`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
-			return start(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-	return cmd
-}
-
-func start(ctx context.Context, uncli *cli.CLI, opts startOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	for _, s := range opts.services {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if err = client.StartService(ctx, s); err != nil {
-				return fmt.Errorf("start service '%s': %w", s, err)
-			}
-			return nil
-		}, uncli.ProgressOut(), "Starting service "+s)
-	}
-
-	return err
-}
@@ -1,73 +0,0 @@
-//nolint:dupl
-package service
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/spf13/cobra"
-)
-
-type stopOptions struct {
-	services []string
-	signal   string
-	timeout  int
-}
-
-func NewStopCommand(groupID string) *cobra.Command {
-	opts := stopOptions{}
-	cmd := &cobra.Command{
-		Use:   "stop SERVICE [SERVICE...]",
-		Short: "Stop one or more services.",
-		Long: `Stop one or more running services.
-
-Gracefully stops all containers of the specified service(s) across all machines in the cluster.
-Services can be specified by name or ID. Stopped services can be restarted with 'uc start'.`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
-			return stop(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-	cmd.Flags().StringVarP(&opts.signal, "signal", "s", "",
-		"Signal to send to each container's main process.\n"+
-			"Can be a signal name (SIGTERM, SIGINT, SIGHUP, etc.) or a number. (default SIGTERM)")
-	cmd.Flags().IntVarP(&opts.timeout, "timeout", "t", 10,
-		"Seconds to wait for each container to stop gracefully before forcibly killing it with SIGKILL.\n"+
-			"Use -1 to wait indefinitely.")
-	return cmd
-}
-
-func stop(ctx context.Context, uncli *cli.CLI, opts stopOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	stopOpts := container.StopOptions{
-		Signal:  opts.signal,
-		Timeout: &opts.timeout,
-	}
-
-	for _, s := range opts.services {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if err = client.StopService(ctx, s, stopOpts); err != nil {
-				return fmt.Errorf("stop service '%s': %w", s, err)
-			}
-			return nil
-		}, uncli.ProgressOut(), "Stopping service "+s)
-	}
-
-	return err
-}
@@ -1,82 +0,0 @@
-package main
-
-import (
-	"bytes"
-	_ "embed"
-	"fmt"
-	"strings"
-	"text/template"
-
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/version"
-	"github.com/spf13/cobra"
-)
-
-//go:embed art.txt
-var asciiArt string
-
-// NewVersionCommand creates a new command to print the version and build information for the binary.
-func NewVersionCommand() *cobra.Command {
-	var output string
-
-	cmd := &cobra.Command{
-		Use:   "version",
-		Short: "Show version and build information.",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			info := version.GetInfo()
-			w := cmd.OutOrStdout()
-
-			switch output {
-			case "":
-				fmt.Fprint(w, humanVersion(info))
-			case "json":
-				s, err := info.JSONString()
-				if err != nil {
-					return err
-				}
-				fmt.Fprintln(w, s)
-			default:
-				s, err := templateVersion(output, info)
-				if err != nil {
-					return err
-				}
-				fmt.Fprint(w, s)
-			}
-
-			return nil
-		},
-	}
-
-	cmd.Flags().StringVarP(&output, "output", "o", "",
-		"Output format: 'json' or a Go template (e.g. '{{.Version}}').\n"+
-			"Run with '-o json' to discover the field names available to the template.\n"+
-			"(default is human-readable)")
-
-	return cmd
-}
-
-func humanVersion(info version.Info) string {
-	var b strings.Builder
-	b.WriteString(asciiArt)
-	b.WriteString("\n")
-	b.WriteString(fmt.Sprintf("uc: Uncloud CLI tool for deploying apps and managing resources (%s)",
-		tui.URLStyle.Render(version.WebsiteURL)))
-	b.WriteString("\n\n")
-	b.WriteString(info.String())
-	return b.String()
-}
-
-// templateVersion renders the version info using the provided Go template.
-func templateVersion(tmpl string, info version.Info) (string, error) {
-	t, err := template.New("version").Parse(tmpl)
-	if err != nil {
-		return "", fmt.Errorf("parse template: %w", err)
-	}
-
-	var buf bytes.Buffer
-	if err = t.Execute(&buf, info); err != nil {
-		return "", fmt.Errorf("execute template: %w", err)
-	}
-	return buf.String(), nil
-}
@@ -1,139 +0,0 @@
-package wg
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/spf13/cobra"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "wg",
-		Short: "Inspect WireGuard network",
-	}
-	cmd.AddCommand(newShowCommand())
-	return cmd
-}
-
-type showOptions struct {
-	machine string
-}
-
-func newShowCommand() *cobra.Command {
-	opts := showOptions{}
-	cmd := &cobra.Command{
-		Use:   "show",
-		Short: "Show WireGuard network configuration for a machine.",
-		Long: "Show the WireGuard network configuration for the machine currently connected to " +
-			"(or specified by the global --connect flag).",
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runShow(cmd.Context(), uncli, opts)
-		},
-	}
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Name or ID of the machine to show the configuration for. (default is connected machine)")
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func runShow(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connection failed: %w", err)
-	}
-	defer client.Close()
-
-	if opts.machine != "" {
-		// Proxy requests to the specified machine.
-		ctx = client.ProxySingleMachineContext(ctx, opts.machine)
-	}
-
-	resp, err := client.MachineClient.InspectWireGuardNetwork(ctx, nil)
-	if err != nil {
-		if status.Code(err) == codes.Unimplemented {
-			return fmt.Errorf("inspect WireGuard network: "+
-				"make sure the target machine is running uncloudd daemon version >= 0.16.0: %w", err)
-		}
-		return err
-	}
-
-	machines, err := client.ListMachines(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-	machinesByPublicKey := make(map[string]*pb.MachineInfo)
-	for _, m := range machines {
-		publicKey := wgtypes.Key(m.Machine.Network.PublicKey).String()
-		machinesByPublicKey[publicKey] = m.Machine
-	}
-
-	// Fetch the machine's info and RTTs for display.
-	var selfMachine *pb.MachineDetails
-	inspectResp, err := client.MachineClient.InspectMachine(ctx, nil)
-	if err == nil {
-		selfMachine = inspectResp.Machines[0]
-		fmt.Printf("Machine name:         %s\n", selfMachine.Machine.Name)
-	}
-
-	fmt.Printf("WireGuard interface:  %s\n", resp.InterfaceName)
-	fmt.Printf("WireGuard public key: %s\n", wgtypes.Key(resp.PublicKey).String())
-	fmt.Printf("WireGuard port:       %d\n", resp.ListenPort)
-	fmt.Println()
-
-	if len(resp.Peers) == 0 {
-		fmt.Println("No WireGuard peers configured.")
-		return nil
-	}
-
-	t := tui.NewTable()
-	t.Headers("PEER", "PUBLIC KEY", "ENDPOINT", "HANDSHAKE", "RTT", "RECEIVED", "SENT", "ALLOWED IPS")
-
-	for _, peer := range resp.Peers {
-		publicKeyStr := wgtypes.Key(peer.PublicKey).String()
-		machineName := "(unknown)"
-		rtt := "-"
-		if m, ok := machinesByPublicKey[publicKeyStr]; ok {
-			machineName = m.Name
-			if selfMachine != nil {
-				if stats, ok := selfMachine.Rtts[m.Id]; ok {
-					rtt = tui.FormatRTT(stats.Median.AsDuration())
-				}
-			}
-		}
-
-		lastHandshake := ""
-		if peer.LastHandshakeTime != nil {
-			lastHandshake = time.Since(peer.LastHandshakeTime.AsTime()).Round(time.Second).String() + " ago"
-		}
-
-		t.Row(
-			machineName,
-			publicKeyStr,
-			peer.Endpoint,
-			lastHandshake,
-			rtt,
-			units.HumanSize(float64(peer.ReceiveBytes)),
-			units.HumanSize(float64(peer.TransmitBytes)),
-			strings.Join(peer.AllowedIps, tui.Faint.Render(", ")),
-		)
-	}
-
-	lipgloss.Println(t)
-	return nil
-}
@@ -2,9 +2,8 @@ package cluster

 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )

 func NewCreateCommand() *cobra.Command {
@@ -1,40 +0,0 @@
-package cluster
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/internal/ucind"
-	"github.com/spf13/cobra"
-)
-
-func NewListCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:     "ls",
-		Aliases: []string{"list"},
-		Short:   "List clusters.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			p := cmd.Context().Value("provisioner").(*ucind.Provisioner)
-			clusters, err := p.ListClusters(cmd.Context())
-			if err != nil {
-				return fmt.Errorf("list clusters: %w", err)
-			}
-			t := tui.NewTable()
-			t.Headers("NAME", "MACHINES")
-			for _, cluster := range clusters {
-				machines := []string{}
-				for _, m := range cluster.Machines {
-					machines = append(machines, m.Name)
-				}
-				t.Row(
-					cluster.Name,
-					strings.Join(machines, tui.Faint.Render(", ")),
-				)
-			}
-			fmt.Println(t)
-			return nil
-		},
-	}
-	return cmd
-}
@@ -2,18 +2,15 @@ package cluster

 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
-	"github.com/psviderski/uncloud/internal/ucind/completion"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )

 func NewRemoveCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "rm [NAME]",
-		Short:   "Remove a cluster.",
-		Aliases: []string{"remove", "delete"},
-		Args:    cobra.MaximumNArgs(1),
+		Use:   "rm [NAME]",
+		Short: "Remove a cluster.",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			p := cmd.Context().Value("provisioner").(*ucind.Provisioner)

@@ -28,12 +25,6 @@ func NewRemoveCommand() *cobra.Command {
 			fmt.Printf("Cluster '%s' removed.\n", name)
 			return nil
 		},
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			return completion.Clusters(cmd, args, toComplete)
-		},
 	}
 	return cmd
 }
@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		NewListCommand(),
+		//NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd
@@ -8,7 +8,6 @@ import (

 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/cmd/ucind/cluster"
-	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
 )
@@ -24,8 +23,6 @@ func main() {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
-
 			cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 			if err != nil {
 				return fmt.Errorf("create Docker client: %w", err)
@@ -47,8 +44,9 @@ func main() {
 		},
 	}

+	// TODO: allow to override using UNCLOUD_CONFIG env var.
 	cmd.PersistentFlags().StringVar(&configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
-		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
+		"path to the Uncloud configuration file.")
 	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")

 	cmd.AddCommand(
@@ -0,0 +1,77 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+// NewBuildCommand creates a new command to build services from a Compose file.
+func NewBuildCommand() *cobra.Command {
+	opts := cli.BuildOptions{}
+	cmd := &cobra.Command{
+		Use:   "build [FLAGS] [SERVICE...]",
+		Short: "Build services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) > 0 {
+				opts.Services = args
+			}
+
+			return runBuild(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
+		"One or more Compose files to build (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
+		"Push built images to the registry after building. (default false)")
+	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
+		"Do not use cache when building images. (default false)")
+
+	return cmd
+}
+
+// TODO: deduplicate with a similar functino for deploy options
+// projectOpts returns the project options for the Compose file(s).
+func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.Profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
+	}
+
+	return projectOpts
+}
+
+// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
+func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
+	projectOpts := projectOptsFromBuildOpts(opts)
+	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	if len(opts.Services) > 0 {
+		project, err = project.WithSelectedServices(opts.Services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) == 0 {
+		fmt.Println("No services to build.")
+		return nil
+	}
+
+	return cli.BuildServices(ctx, servicesToBuild, opts)
+}
@@ -5,26 +5,22 @@ import (
 	"errors"
 	"fmt"
 	"maps"
-	"os"
 	"slices"
 	"strings"

-	"charm.land/lipgloss/v2"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/api/pb"
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
 )

 type deployOptions struct {
-	caddyfile string
-	image     string
-	machines  []string
+	image    string
+	machines []string
+	context  string
 }

 func NewDeployCommand() *cobra.Command {
@@ -41,30 +37,21 @@ func NewDeployCommand() *cobra.Command {
 		},
 	}

-	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
-		"Path to a custom global Caddy config (Caddyfile) that will be prepended to the auto-generated Caddy config.")
 	cmd.Flags().StringVar(&opts.image, "image", "",
 		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names or IDs to deploy to. Can be specified multiple times or as a comma-separated "+
-			"list. (default is all machines)")
-
-	completion.MachinesFlag(cmd)
+		"Machine names to deploy to. Can be specified multiple times or as a comma-separated "+
+			"list of machine names. (default is all machines)")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to. (default is the current context)",
+	)

 	return cmd
 }

 func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	caddyfile := ""
-	if opts.caddyfile != "" {
-		data, err := os.ReadFile(opts.caddyfile)
-		if err != nil {
-			return fmt.Errorf("read Caddyfile: %w", err)
-		}
-		caddyfile = strings.TrimSpace(string(data))
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -75,11 +62,9 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
 		}
-		fmt.Println(tui.Faint.Render("service: ") + tui.NameStyle.Render(client.CaddyServiceName) +
-			tui.Faint.Render(" (not running)"))
+		fmt.Printf("Service: %s (not running)\n", client.CaddyServiceName)
 	} else {
-		fmt.Println(tui.Faint.Render("service: ") + tui.NameStyle.Render(svc.Name) +
-			tui.Faint.Render(" ("+svc.Mode+" mode)"))
+		fmt.Printf("Service: %s (%s mode)\n", svc.Name, svc.Mode)

 		// Collect unique images of all containers in the running caddy service.
 		images := make(map[string]struct{}, len(svc.Containers))
@@ -89,19 +74,15 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		currentImages := slices.Collect(maps.Keys(images))

 		if len(currentImages) > 1 {
-			formattedImages := make([]string, len(currentImages))
-			for i, img := range currentImages {
-				formattedImages[i] = tui.FormatImage(img, tui.NoStyle)
-			}
-			fmt.Println(tui.Faint.Render("current images (multiple versions detected): ") +
-				strings.Join(formattedImages, tui.Faint.Render(", ")))
+			commaSeparatedImages := strings.Join(currentImages, ", ")
+			fmt.Printf("Current images (multiple versions detected): %s\n", commaSeparatedImages)
 		} else {
-			fmt.Println(tui.Faint.Render("current image: ") + tui.FormatImage(currentImages[0], tui.NoStyle))
+			fmt.Printf("Current image: %s\n", currentImages[0])
 		}
 	}

 	if opts.image != "" {
-		fmt.Println(tui.Faint.Render("target image: ") + tui.FormatImage(opts.image, tui.Green))
+		fmt.Printf("Target image: %s\n", opts.image)
 	}

 	fmt.Println()
@@ -110,16 +91,13 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	placement := api.Placement{
 		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
 	}
-	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{
-		Image: opts.image, Config: caddyfile, Placement: placement,
-	})
+	d, err := clusterClient.NewCaddyDeployment(opts.image, placement)
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

 	if opts.image == "" {
-		fmt.Println(tui.Faint.Render("target image: ") + tui.FormatImage(d.Spec.Container.Image,
-			tui.Green) + tui.Faint.Render(" (latest stable)"))
+		fmt.Printf("Target image: %s (latest stable)\n", d.Spec.Container.Image)
 	}

 	plan, err := d.Plan(ctx)
@@ -138,46 +116,24 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 			}
 		}

-		fmt.Println()
-		fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
-		fmt.Println()
-
-		directConn := uncli.DirectConnection()
-		contextName := uncli.ContextOverrideOrCurrent()
-		deployTarget := ""
-		if directConn != "" {
-			deployTarget = directConn
-			fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
-			fmt.Println()
-		} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
-			// Only show context if there's more than one to avoid unnecessary clutter.
-			deployTarget = contextName
-			fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
-			fmt.Println()
+		// Initialise a machine and container name resolver to properly format the plan output.
+		resolver, err := clusterClient.ServiceOperationNameResolver(ctx, svc)
+		if err != nil {
+			return fmt.Errorf("create machine and container name resolver for service operations: %w", err)
 		}

-		fmt.Println(plan.Format())
-
-		summary := plan.FormatSummary()
-		fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
-		fmt.Println(summary)
+		fmt.Println()
+		fmt.Println("Deployment plan:")
+		fmt.Println(plan.Format(resolver))
 		fmt.Println()

-		title := "Proceed with deployment?"
-		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
-		// deploying to the wrong cluster.
-		if deployTarget != "" {
-			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
-			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
-			title = "Proceed with deployment to " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
-		}
-
-		confirmed, err := tui.Confirm(title)
+		confirmed, err := cli.Confirm()
 		if err != nil {
 			return fmt.Errorf("confirm deployment: %w", err)
 		}
 		if !confirmed {
-			return cli.Cancelled("Caddy deploy cancelled. No changes were made.")
+			fmt.Println("Cancelled. No changes were made.")
+			return nil
 		}

 		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
@@ -204,10 +160,6 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 		}
 		return fmt.Errorf("get cluster domain: %w", err)
 	}
-	if !domain.Reserved {
-		fmt.Printf("Skipping DNS records update as cluster domain '%s' is managed externally.\n", domain.Name)
-		return nil
-	}

 	fmt.Println("Updating cluster domain records in Uncloud DNS to point to machines running caddy service...")
 	// TODO: split the method into two: one to get the records and one to update them to ask for update confirmation.
@@ -222,7 +174,7 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 		if errors.Is(err, client.ErrNoReachableMachines) {
 			fmt.Println()
 			fmt.Printf("DNS records for domain '%s' could not be updated as there are no internet-reachable "+
-				"machines running caddy containers.\n", domain.Name)
+				"machines running caddy containers.\n", domain)
 			fmt.Println()
 			fmt.Println("Possible solutions:")
 			fmt.Println("- Ensure your machines have public IP addresses")
@@ -1,7 +1,6 @@
 package caddy

 import (
-	"github.com/psviderski/uncloud/cmd/uc/caddy/cert"
 	"github.com/spf13/cobra"
 )

@@ -11,10 +10,7 @@ func NewRootCommand() *cobra.Command {
 		Short: "Manage Caddy reverse proxy service.",
 	}
 	cmd.AddCommand(
-		cert.NewRootCommand(),
-		NewConfigCommand(),
 		NewDeployCommand(),
-		NewLogsCommand(),
 	)
 	return cmd
 }
@@ -3,26 +3,32 @@ package context
 import (
 	"fmt"
 	"maps"
+	"os"
 	"slices"
+	"text/tabwriter"

-	"charm.land/lipgloss/v2"
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/tui"
 	"github.com/spf13/cobra"
 )

 func NewListCommand() *cobra.Command {
+	var clusterContext string
+
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List available cluster contexts.",
-		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 			return list(uncli)
 		},
 	}

+	cmd.Flags().StringVarP(
+		&clusterContext, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

@@ -39,18 +45,17 @@ func list(uncli *cli.CLI) error {
 	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))
 	currentContext := uncli.Config.CurrentContext

-	t := tui.NewTable()
-	t.Headers("NAME", "CURRENT", "CONNECTIONS")
+	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+	fmt.Fprintln(tw, "NAME\tCURRENT\tCONNECTIONS")

 	for _, name := range contextNames {
 		current := ""
 		if name == currentContext {
-			current = "✓"
+			current = "*"
 		}
 		connCount := len(uncli.Config.Contexts[name].Connections)
-		t.Row(name, current, fmt.Sprintf("%d", connCount))
+		fmt.Fprintf(tw, "%s\t%s\t%d\n", name, current, connCount)
 	}

-	lipgloss.Println(t)
-	return nil
+	return tw.Flush()
 }
@@ -10,7 +10,6 @@ func NewRootCommand() *cobra.Command {
 		Use:     "ctx",
 		Aliases: []string{"context"},
 		Short:   "Switch between different cluster contexts. Contains subcommands to manage contexts.",
-		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 			return selectContext(uncli)
@@ -20,8 +19,6 @@ func NewRootCommand() *cobra.Command {
 	cmd.AddCommand(
 		NewListCommand(),
 		NewUseCommand(),
-		NewConnectionCommand(),
-		NewShowCommand(),
 	)

 	return cmd
@@ -5,10 +5,8 @@ import (
 	"maps"
 	"slices"

-	"charm.land/huh/v2"
+	"github.com/charmbracelet/huh"
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
 	"github.com/spf13/cobra"
 )

@@ -18,7 +16,6 @@ func NewUseCommand() *cobra.Command {
 		Short: "Switch to a different cluster context.",
 		Long: "Switch to a different cluster context. If no context is provided, " +
 			"a list of available contexts will be displayed for selection.",
-		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)

@@ -32,13 +29,6 @@ func NewUseCommand() *cobra.Command {

 			return selectContext(uncli)
 		},
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Contexts(cmd.Context(), uncli, args, toComplete)
-		},
 	}

 	return cmd
@@ -51,10 +41,6 @@ func selectContext(uncli *cli.CLI) error {
 	if len(uncli.Config.Contexts) == 0 {
 		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
 	}
-	if !tui.IsTerminalAvailable() {
-		return fmt.Errorf("cannot select a context interactively without a terminal. " +
-			"Pass the context name explicitly: uc ctx use CONTEXT")
-	}

 	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/psviderski/uncloud/pkg/client/deploy"
+	"github.com/spf13/cobra"
+)
+
+type deployOptions struct {
+	files    []string
+	profiles []string
+	services []string
+	noBuild  bool
+
+	context string
+}
+
+// NewDeployCommand creates a new command to deploy services from a Compose file.
+func NewDeployCommand() *cobra.Command {
+	opts := deployOptions{}
+	cmd := &cobra.Command{
+		Use:   "deploy [FLAGS] [SERVICE...]",
+		Short: "Deploy services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) > 0 {
+				opts.services = args
+			}
+
+			return runDeploy(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to deploy services from. (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to (default is the current context)")
+	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
+		"Do not build images before deploying services. (default false)")
+
+	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
+	//  Could be useful to test a new version on a subset of machines before rolling out to all.
+
+	return cmd
+}
+
+// projectOpts returns the project options for the Compose file(s).
+func projectOpts(opts deployOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.profiles...))
+	}
+
+	return projectOpts
+}
+
+// runDeploy parses the Compose file(s) and deploys the services.
+func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	projectOpts := projectOpts(opts)
+
+	project, err := compose.LoadProject(ctx, opts.files, projectOpts...)
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	if len(opts.services) > 0 {
+		// Includes service dependencies by default. This is the default docker compose behavior.
+		project, err = project.WithSelectedServices(opts.services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) > 0 {
+		if opts.noBuild {
+			fmt.Println("Not building services as requested.")
+		} else {
+			buildOpts := cli.BuildOptions{
+				Push:    true,
+				NoCache: false,
+			}
+
+			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
+				return fmt.Errorf("build services: %w", err)
+			}
+		}
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	composeDeploy, err := compose.NewDeployment(ctx, clusterClient, project)
+	if err != nil {
+		return fmt.Errorf("create compose deployment: %w", err)
+	}
+
+	plan, err := composeDeploy.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan deployment: %w", err)
+	}
+
+	if len(plan.Operations) == 0 {
+		fmt.Println("Services are up to date.")
+		return nil
+	}
+
+	fmt.Println("Deployment plan:")
+	if err = printPlan(ctx, clusterClient, plan); err != nil {
+		return fmt.Errorf("print deployment plan: %w", err)
+	}
+	fmt.Println()
+
+	confirmed, err := cli.Confirm()
+	if err != nil {
+		return fmt.Errorf("confirm deployment: %w", err)
+	}
+	if !confirmed {
+		fmt.Println("Cancelled. No changes were made.")
+		return nil
+	}
+
+	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if err := plan.Execute(ctx, clusterClient); err != nil {
+			return fmt.Errorf("deploy services: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), "Deploying services")
+}
+
+func printPlan(ctx context.Context, cli *client.Client, plan deploy.SequenceOperation) error {
+	for _, op := range plan.Operations {
+		svcPlan, ok := op.(*deploy.Plan)
+		if !ok {
+			fmt.Println("- " + op.Format(nil))
+			continue
+		}
+
+		svc, err := cli.InspectService(ctx, svcPlan.ServiceID)
+		if err != nil && !errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("inspect service: %w", err)
+		}
+		// Initialise a machine and container name resolver to properly format the service plan output.
+		resolver, err := cli.ServiceOperationNameResolver(ctx, svc)
+		if err != nil {
+			return fmt.Errorf("create machine and container name resolver for service operations: %w", err)
+		}
+
+		fmt.Printf("- Deploy service [name=%s]\n", svcPlan.ServiceName)
+		fmt.Println(indent(svcPlan.Format(resolver), "  "))
+	}
+
+	return nil
+}
+
+func indent(text, prefix string) string {
+	lines := strings.Split(text, "\n")
+	for i, line := range lines {
+		lines[i] = prefix + line
+	}
+	return strings.Join(lines, "\n")
+}
@@ -12,21 +12,32 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )

+type releaseOptions struct {
+	context string
+}
+
 func NewReleaseCommand() *cobra.Command {
+	opts := releaseOptions{}
+
 	cmd := &cobra.Command{
 		Use:   "release",
 		Short: "Release the reserved cluster domain.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return release(cmd.Context(), uncli)
+			return release(cmd.Context(), uncli, opts)
 		},
 	}

+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

-func release(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
+func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -37,7 +48,6 @@ func release(ctx context.Context, uncli *cli.CLI) error {
 		if status.Convert(err).Code() == codes.NotFound {
 			return errors.New("no domain reserved")
 		}
-		return fmt.Errorf("release cluster domain: %w", err)
 	}

 	fmt.Printf("Released cluster domain: %s\n", domain.Name)
@@ -5,9 +5,9 @@ import (
 	"errors"
 	"fmt"

-	"github.com/psviderski/uncloud/api/pb"
-	"github.com/psviderski/uncloud/cmd/uc/caddy"
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
@@ -19,6 +19,7 @@ const DefaultUncloudDNSAPIEndpoint = "https://dns.uncloud.run/v1"

 type reserveOptions struct {
 	endpoint string
+	context  string
 }

 func NewReserveCommand() *cobra.Command {
@@ -35,12 +36,16 @@ func NewReserveCommand() *cobra.Command {

 	cmd.Flags().StringVar(&opts.endpoint, "endpoint", DefaultUncloudDNSAPIEndpoint,
 		"API endpoint for the Uncloud DNS service.")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)

 	return cmd
 }

 func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -49,8 +54,7 @@ func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
 	domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.endpoint})
 	if err != nil {
 		if status.Convert(err).Code() == codes.AlreadyExists {
-			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' " +
-				"or release a reservation with 'uc dns release' first")
+			return errors.New("domain already reserved")
 		}
 		return err
 	}
@@ -0,0 +1,22 @@
+package dns
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "dns",
+		Short: "Manage cluster domain in Uncloud DNS.",
+		Long: "Manage cluster domain in Uncloud DNS.\n" +
+			"DNS commands allow you to reserve or release a unique '<id>.cluster.uncloud.run' domain for your " +
+			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
+			"traffic to the services in the cluster.",
+	}
+	cmd.AddCommand(
+		NewReleaseCommand(),
+		NewReserveCommand(),
+		NewShowCommand(),
+	)
+	return cmd
+}
@@ -10,21 +10,32 @@ import (
 	"github.com/spf13/cobra"
 )

+type showOptions struct {
+	context string
+}
+
 func NewShowCommand() *cobra.Command {
+	opts := showOptions{}
+
 	cmd := &cobra.Command{
 		Use:   "show",
 		Short: "Print the cluster domain name.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return show(cmd.Context(), uncli)
+			return show(cmd.Context(), uncli, opts)
 		},
 	}

+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

-func show(ctx context.Context, uncli *cli.CLI) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
+func show(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -33,11 +44,11 @@ func show(ctx context.Context, uncli *cli.CLI) error {
 	domain, err := clusterClient.GetDomain(ctx)
 	if err != nil {
 		if errors.Is(err, api.ErrNotFound) {
-			return errors.New("no cluster domain configured")
+			return errors.New("no domain reserved")
 		}
 		return err
 	}

-	fmt.Println(domain.Name)
+	fmt.Println(domain)
 	return nil
 }
@@ -0,0 +1,187 @@
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type addOptions struct {
+	name     string
+	noCaddy  bool
+	publicIP string
+	sshKey   string
+	context  string
+	version  string
+}
+
+func NewAddCommand() *cobra.Command {
+	opts := addOptions{}
+	cmd := &cobra.Command{
+		Use:   "add [USER@]HOST[:PORT]",
+		Short: "Add a remote machine to a cluster.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			user, host, port, err := config.SSHDestination(args[0]).Parse()
+			if err != nil {
+				return fmt.Errorf("parse remote machine: %w", err)
+			}
+			remoteMachine := cli.RemoteMachine{
+				User:    user,
+				Host:    host,
+				Port:    port,
+				KeyPath: opts.sshKey,
+			}
+
+			return add(cmd.Context(), uncli, remoteMachine, opts)
+		},
+	}
+	cmd.Flags().StringVarP(&opts.name, "name", "n", "", "Assign a name to the machine.")
+	cmd.Flags().BoolVar(
+		&opts.noCaddy, "no-caddy", false,
+		"Don't deploy Caddy reverse proxy service to the machine.",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "auto",
+		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
+	)
+	cmd.Flags().StringVarP(
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
+	)
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine.",
+	)
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to add the machine to. (default is the current context)",
+	)
+
+	return cmd
+}
+
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, opts addOptions) error {
+	var publicIP *netip.Addr
+	switch opts.publicIP {
+	case "auto":
+		publicIP = &netip.Addr{}
+	case "", "none":
+		publicIP = nil
+	default:
+		ip, err := netip.ParseAddr(opts.publicIP)
+		if err != nil {
+			return fmt.Errorf("parse public IP: %w", err)
+		}
+		publicIP = &ip
+	}
+
+	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+		Context:       opts.context,
+		MachineName:   opts.name,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		Version:       opts.version,
+	})
+	if err != nil {
+		return err
+	}
+	defer clusterClient.Close()
+	defer machineClient.Close()
+
+	if opts.noCaddy {
+		return nil
+	}
+
+	// Wait for the cluster to be initialised to be able to deploy the Caddy service.
+	fmt.Println("Waiting for the machine to be ready...")
+	fmt.Println()
+	if err = waitClusterInitialised(ctx, machineClient); err != nil {
+		return fmt.Errorf("wait for cluster to be initialised on machine: %w", err)
+	}
+
+	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
+	// use the deployed image version. Otherwise, use the latest version.
+	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
+	// issues accessing the Machine API of existing machines in the cluster.
+	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
+	caddyImage := ""
+	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
+	if err != nil {
+		if !errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("inspect caddy service: %w", err)
+		}
+	} else {
+		caddyImage = caddySvc.Containers[0].Container.Config.Image
+		// Find the latest created container and use its image.
+		var latestCreated time.Time
+		for _, c := range caddySvc.Containers[1:] {
+			created, err := time.Parse(time.RFC3339Nano, c.Container.Created)
+			if err != nil {
+				continue
+			}
+			if created.After(latestCreated) {
+				latestCreated = created
+				caddyImage = c.Container.Config.Image
+			}
+		}
+	}
+
+	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
+	//  that may cause a small downtime.
+	d, err := clusterClient.NewCaddyDeployment(caddyImage, api.Placement{})
+	if err != nil {
+		return fmt.Errorf("create caddy deployment: %w", err)
+	}
+
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if _, err = d.Run(ctx); err != nil {
+			return fmt.Errorf("deploy caddy: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s", d.Spec.Name))
+	if err != nil {
+		return err
+	}
+
+	fmt.Println()
+	return caddy.UpdateDomainRecords(ctx, machineClient, uncli.ProgressOut())
+}
+
+func waitClusterInitialised(ctx context.Context, client *client.Client) error {
+	boff := backoff.WithContext(backoff.NewExponentialBackOff(
+		backoff.WithMaxInterval(1*time.Second),
+		backoff.WithMaxElapsedTime(5*time.Minute),
+	), ctx)
+
+	check := func() error {
+		_, err := client.ListMachines(ctx, nil)
+		if err == nil {
+			return nil
+		}
+
+		statusErr := status.Convert(err)
+		if statusErr.Code() == codes.FailedPrecondition {
+			return err
+		}
+		return backoff.Permanent(err)
+	}
+
+	return backoff.Retry(check, boff)
+}
@@ -0,0 +1,169 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	"github.com/psviderski/uncloud/cmd/uncloud/dns"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/cluster"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type initOptions struct {
+	dnsEndpoint string
+	name        string
+	network     string
+	noCaddy     bool
+	noDNS       bool
+	publicIP    string
+	sshKey      string
+	version     string
+	context     string
+}
+
+func NewInitCommand() *cobra.Command {
+	opts := initOptions{}
+	cmd := &cobra.Command{
+		Use:   "init [USER@HOST:PORT]",
+		Short: "Initialise a new cluster with a remote machine as the first member.",
+		// TODO: include usage examples of initialising a remote machine.
+		// TODO: support initialising a cluster on the local machine.
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			var remoteMachine *cli.RemoteMachine
+			if len(args) > 0 {
+				user, host, port, err := config.SSHDestination(args[0]).Parse()
+				if err != nil {
+					return fmt.Errorf("parse remote machine: %w", err)
+				}
+				remoteMachine = &cli.RemoteMachine{
+					User:    user,
+					Host:    host,
+					Port:    port,
+					KeyPath: opts.sshKey,
+				}
+			}
+
+			return initCluster(cmd.Context(), uncli, remoteMachine, opts)
+		},
+	}
+	cmd.Flags().StringVar(&opts.dnsEndpoint, "dns-endpoint", dns.DefaultUncloudDNSAPIEndpoint,
+		"API endpoint for the Uncloud DNS service.")
+	cmd.Flags().StringVarP(
+		&opts.name, "name", "n", "",
+		"Assign a name to the machine.",
+	)
+	cmd.Flags().StringVar(
+		&opts.network, "network", cluster.DefaultNetwork.String(),
+		"IPv4 network CIDR to use for machines and services.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noCaddy, "no-caddy", false,
+		"Don't deploy Caddy reverse proxy service to the machine.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noDNS, "no-dns", false,
+		"Don't reserve a cluster domain in Uncloud DNS.",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "auto",
+		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
+	)
+	cmd.Flags().StringVarP(
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
+	)
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine.",
+	)
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "default",
+		"Name of the created context for the initialised cluster in the Uncloud config.",
+	)
+
+	return cmd
+}
+
+func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts initOptions) error {
+	netPrefix, err := netip.ParsePrefix(opts.network)
+	if err != nil {
+		return fmt.Errorf("parse network CIDR: %w", err)
+	}
+
+	var publicIP *netip.Addr
+	switch opts.publicIP {
+	case "auto":
+		publicIP = &netip.Addr{}
+	case "", "none":
+		publicIP = nil
+	default:
+		ip, err := netip.ParseAddr(opts.publicIP)
+		if err != nil {
+			return fmt.Errorf("parse public IP: %w", err)
+		}
+		publicIP = &ip
+	}
+	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
+		Context:       opts.context,
+		MachineName:   opts.name,
+		Network:       netPrefix,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		Version:       opts.version,
+	})
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	if opts.noCaddy && opts.noDNS {
+		return nil
+	}
+
+	// Deploy the Caddy service to the initialised machine.
+	// The creation of a deployment plan talks to cluster API. Since the API needs a few moments to become available
+	// after cluster initialisation, we keep the user informed during this wait.
+	fmt.Println("Waiting for the machine to be ready...")
+	fmt.Println()
+
+	if !opts.noDNS {
+		domain, err := client.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
+		if err != nil {
+			return fmt.Errorf("reserve cluster domain in Uncloud DNS: %w", err)
+		}
+		fmt.Printf("Reserved cluster domain: %s\n", domain.Name)
+	}
+
+	if !opts.noCaddy {
+		d, err := client.NewCaddyDeployment("", api.Placement{})
+		if err != nil {
+			return fmt.Errorf("create caddy deployment: %w", err)
+		}
+
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if _, err = d.Run(ctx); err != nil {
+				return fmt.Errorf("deploy caddy: %w", err)
+			}
+			return nil
+		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s", d.Spec.Name))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println()
+		return caddy.UpdateDomainRecords(ctx, client, uncli.ProgressOut())
+	}
+
+	return nil
+}
@@ -0,0 +1,86 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"os"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/spf13/cobra"
+)
+
+func NewListCommand() *cobra.Command {
+	var contextName string
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List machines in a cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, contextName)
+		},
+	}
+	cmd.Flags().StringVarP(
+		&contextName, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
+	client, err := uncli.ConnectCluster(ctx, clusterName)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	machines, err := client.ListMachines(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+
+	// Print the list of machines in a table format.
+	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+	// Print header.
+	if _, err = fmt.Fprintln(tw, "NAME\tSTATE\tADDRESS\tPUBLIC IP\tWIREGUARD ENDPOINTS"); err != nil {
+		return fmt.Errorf("write header: %w", err)
+	}
+	// Print rows.
+	for _, member := range machines {
+		m := member.Machine
+		subnet, _ := m.Network.Subnet.ToPrefix()
+		subnet = netip.PrefixFrom(network.MachineIP(subnet), subnet.Bits())
+
+		publicIP := "-"
+		if m.PublicIp != nil {
+			ip, _ := m.PublicIp.ToAddr()
+			publicIP = ip.String()
+		}
+
+		endpoints := make([]string, len(m.Network.Endpoints))
+		for i, ep := range m.Network.Endpoints {
+			addrPort, _ := ep.ToAddrPort()
+			endpoints[i] = addrPort.String()
+		}
+
+		if _, err = fmt.Fprintf(
+			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
+			strings.Join(endpoints, ", "),
+		); err != nil {
+			return fmt.Errorf("write row: %w", err)
+		}
+	}
+	return tw.Flush()
+}
+
+// capitalise returns a string where the first character is upper case, and the rest is lower case.
+func capitalise(s string) string {
+	if s == "" {
+		return ""
+	}
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+}
@@ -0,0 +1,200 @@
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/tree"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type removeOptions struct {
+	force   bool
+	yes     bool
+	context string
+}
+
+func NewRmCommand() *cobra.Command {
+	opts := removeOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "rm MACHINE",
+		Aliases: []string{"remove", "delete"},
+		Short:   "Remove a machine from a cluster.",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return remove(cmd.Context(), uncli, args[0], opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Do not prompt for confirmation before removing the machine.")
+
+	return cmd
+}
+
+func remove(ctx context.Context, uncli *cli.CLI, machineName string, opts removeOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Verify the machine exists and list all service containers on it including stopped ones.
+	listCtx, machines, err := api.ProxyMachinesContext(ctx, client, []string{machineName})
+	if err != nil {
+		return err
+	}
+	if len(machines) == 0 {
+		return fmt.Errorf("machine '%s' not found in the cluster", machineName)
+	}
+	m := machines[0].Machine
+
+	listOpts := container.ListOptions{All: true}
+	machineContainers, err := client.Docker.ListServiceContainers(listCtx, "", listOpts)
+	if err != nil {
+		return fmt.Errorf("list containers: %w", err)
+	}
+	containers := machineContainers[0].Containers
+
+	if len(containers) > 0 {
+		plural := ""
+		if len(containers) > 1 {
+			plural = "s"
+		}
+		fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
+		fmt.Println(formatContainerTree(containers))
+		fmt.Println()
+		fmt.Println("This will remove all service containers on the machine, reset it to the uninitialised state, " +
+			"and remove it from the cluster.")
+	} else {
+		fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
+		fmt.Println("This will reset the machine to the uninitialised state and remove it from the cluster.")
+	}
+
+	if !opts.yes {
+		confirmed, err := cli.Confirm()
+		if err != nil {
+			return fmt.Errorf("confirm removal: %w", err)
+		}
+		if !confirmed {
+			fmt.Println("Cancelled. Machine was not removed.")
+			return nil
+		}
+	}
+
+	if len(containers) > 0 {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			return removeContainers(ctx, client, containers)
+		}, uncli.ProgressOut(), "Removing containers")
+
+		if err != nil {
+			return fmt.Errorf("remove containers: %w", err)
+		}
+		fmt.Println()
+	}
+
+	// TODO: 4. Implement and call Reset via Machine API to reset the machine state to uninitialised.
+	// TODO: 5. Remove the machine from the cluster store.
+
+	return fmt.Errorf("resetting machine is not fully implemented yet")
+	//fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+	//return nil
+}
+
+// formatContainerTree formats a list of containers grouped by service as a tree structure.
+func formatContainerTree(containers []api.ServiceContainer) string {
+	if len(containers) == 0 {
+		return ""
+	}
+
+	// Group containers by service.
+	serviceContainers := make(map[string][]api.ServiceContainer)
+	for _, ctr := range containers {
+		serviceName := ctr.ServiceName()
+		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
+	}
+
+	// Build tree output.
+	var output []string
+	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
+	for _, serviceName := range serviceNames {
+		ctrs := serviceContainers[serviceName]
+		mode := ctrs[0].ServiceMode()
+
+		// Format a tree for the service with its containers.
+		plural := ""
+		if len(ctrs) > 1 {
+			plural = "s"
+		}
+		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
+			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
+
+		// Add containers as children.
+		for _, ctr := range ctrs {
+			state, _ := ctr.HumanState()
+			info := fmt.Sprintf("%s • %s • %s", ctr.Name, ctr.Config.Image, state)
+			t.Child(info)
+		}
+
+		output = append(output, t.String())
+	}
+
+	return strings.Join(output, "\n")
+}
+
+// removeContainers removes the given service containers from the machine.
+func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
+	if len(containers) == 0 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	errCh := make(chan error)
+
+	for _, ctr := range containers {
+		wg.Add(1)
+		go func(c api.ServiceContainer) {
+			defer wg.Done()
+
+			// Gracefully stop the container before removing it.
+			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
+			}
+
+			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
+				// Remove anonymous volumes created by the container.
+				RemoveVolumes: true,
+			})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
+			}
+		}(ctr)
+	}
+
+	go func() {
+		wg.Wait()
+		close(errCh)
+	}()
+
+	var err error
+	for e := range errCh {
+		err = errors.Join(err, e)
+	}
+
+	return err
+}
@@ -8,17 +8,14 @@ func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "machine",
 		Aliases: []string{"m"},
-		Short:   "Manage machines in the cluster.",
+		Short:   "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
-		NewLogsCommand(),
-		NewRenameCommand(),
 		NewRmCommand(),
-		NewRTTCommand(),
-		NewUpdateCommand(),
+		NewTokenCommand(),
 	)
 	return cmd
 }
@@ -0,0 +1,38 @@
+package machine
+
+import (
+	"fmt"
+	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/daemon"
+	"github.com/psviderski/uncloud/internal/machine"
+)
+
+type tokenOptions struct {
+	dataDir string
+}
+
+func NewTokenCommand() *cobra.Command {
+	opts := tokenOptions{}
+	cmd := &cobra.Command{
+		Use:   "token",
+		Short: "Print the local machine's token for adding it to a cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			token, err := daemon.MachineToken(opts.dataDir)
+			if err != nil {
+				return fmt.Errorf("get machine token: %w", err)
+			}
+			tokenStr, err := token.String()
+			if err != nil {
+				return fmt.Errorf("encode machine token: %w", err)
+			}
+			fmt.Println(tokenStr)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.dataDir, "data-dir", "d", machine.DefaultDataDir,
+		"Directory for storing persistent machine state.")
+	_ = cmd.MarkFlagDirname("data-dir")
+
+	return cmd
+}