feat(scheduling): node tags + service placement_tags affinity

Operator-set node labels (node_agents.tags) gate which nodes a service
may schedule onto: services.placement_tags requires every listed tag.
auto and spread filter eligible agents by tags; tags are re-evaluated
each reconcile so retagging a node re-spreads replicas. Pin + tags and
local + tags rejected; empty array clears the requirement.

Surfaces: --placement-tags on services create/update, nodes update
--tags, MCP args, OpenAPI, node-detail tag editor, service-detail
placement-tags input.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -49,10 +49,6 @@ CONTAINR_AGENT_AUTH_TOKEN=replace_with_strong_agent_secret
 # CONTAINR_AGENT_AUTH_TOKENS=current_secret,next_secret
 # Bundled agent binaries dir served at /api/agents/download/:platform.
 # CONTAINR_AGENT_BIN_DIR=/agents
-# Directory Traefik's file provider watches. The backend writes one
-# config per remote service here so domains route to node agents. The
-# infra compose wires a shared volume — set only for custom layouts.
-# TRAEFIK_DYNAMIC_DIR=/traefik-dynamic
 # Optional remote template catalog (another Containr instance). Its
 # templates merge into GET /templates as source:"registry" and
 # materialize locally on deploy. The bundled catalog works without it.

.github/compose.ci.yml

@@ -1,18 +0,0 @@
-# CI-only compose overlay: pull and build through mirror.gcr.io so shared
-# runner egress IPs never touch docker.io (anonymous pulls get 429'd).
-# Production refs in infra/docker-compose.yml stay unchanged.
-services:
-  postgres:
-    image: mirror.gcr.io/library/postgres:15-alpine
-  traefik:
-    image: mirror.gcr.io/library/traefik:v3.2
-  backend:
-    build:
-      args:
-        GO_IMAGE: mirror.gcr.io/library/golang:1.26-alpine
-        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
-  frontend:
-    build:
-      args:
-        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
-        NGINX_IMAGE: mirror.gcr.io/library/nginx:alpine

.github/workflows/ci.yml

@@ -163,13 +163,11 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Boot stack
-        # .github/compose.ci.yml swaps every docker.io ref for
-        # mirror.gcr.io — anonymous Hub pulls 429 on shared CI IPs.
         run: |
           BETTER_AUTH_SECRET=$(openssl rand -hex 32)
           BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
           export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
-          docker compose -f infra/docker-compose.yml -f .github/compose.ci.yml up -d --build postgres dragonfly backend frontend traefik
+          docker compose -f infra/docker-compose.yml up -d --build postgres dragonfly backend frontend traefik
 
       - name: Wait for backend health
         run: |
@@ -206,13 +204,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Docker Buildx
-        # Mirror docker.io through gcr — shared CI IPs hit anonymous
-        # rate limits on base-image metadata resolution otherwise.
         uses: docker/setup-buildx-action@v3
-        with:
-          config-inline: |
-            [registry."docker.io"]
-              mirrors = ["mirror.gcr.io"]
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'

README.md

@@ -49,7 +49,7 @@ dedicated console.
 - **Public project catalog** — approved projects are browsable anonymously; new projects stay private until an admin approves them
 - **Admin console** (`/admin`) — platform stats, project approval/edit/delete, user admin management
 - **Private networking** — every project gets an isolated Docker network; services reach each other by name (`web:3000`) and share variables via `${{service.KEY}}` references
-- **Deployments & builds** — Docker deploys with history, image rollback, live build status; git-sourced services build directly on remote node agents (no registry required)
+- **Deployments & builds** — Docker deploys with history, image rollback, live build status
 - **Runtime** — replicas, published ports, domains, health checks, restart policies; start/stop/restart/redeploy from canvas or service page
 - **Git integration** — GitHub, GitLab, Bitbucket, Gitea; webhooks, GitHub App
 - **Managed databases** — create PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, or ClickHouse directly from `/databases`, with backup/restore

ROADMAP2.md

@@ -192,11 +192,8 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   compares vs edge IP → `ok|wrong-target|pending`.
 - [x] **Maintenance mode + basic-auth gate** — Traefik middleware labels;
   no proxy code needed.
-- [x] **Routing overrides** — `services.traefik_labels` jsonb with
-  allowlist validation. Keys `middlewares.<name>.<type>[.<field>]` scope
-  to the service router (`svc-<id>-<name>`), auto-attach after builtins;
-  router/service/provider-level keys rejected. API + CLI
-  (`--traefik-label`) + MCP + service page Access editor.
+- [ ] **Routing overrides** — `services.traefik_labels` jsonb with
+  allowlist validation (middlewares, headers, redirects).
 - [x] **Builder override** — `services.builder` enum
   `auto|railpack|nixpacks|dockerfile|static`; static builder = build +
   nginx serve. Fixed hardcoded `nixpacks` + `BuildImage` stream drain bug.
@@ -226,40 +223,29 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   {target_node_id}`: dump → stream transfer → provision → restore →
   re-point bound services. Deferred until Phase F lands real second
   nodes — nothing to migrate between today.
-- [x] **Backup import** — `POST /databases/:id/backups/import` accepts a
-  `.tar.gz` (multipart `file` or raw body, 2 GiB cap, gzip-magic
-  validated), stores it in the backups volume via a holder container,
-  registers a completed restore point, and ships offsite when a backup
-  target is configured. `api/backuptargets.go`. (pairs with
+- [ ] **Backup import** — upload archive → new restore point (pairs with
   migrators).
 
 ## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
 
-- [x] **Template = ordered service graph** — `services[]` entries with
+- [ ] **Template = ordered service graph** — `services[]` entries with
   `{name, type, source, build, ports, volumes, variables, depends_on}`;
-  deploy order from dependency refs. `templategraph.go`,
-  `topoSortServices`.
-- [x] **Expressions** — `{{service.KEY.prop}}` (host/port/user/password/
-  database/url), `{{secret}}`/`{{secret(N)}}`, `{{random:N}}`,
-  `{{VAR:-default}}` (incl. explicitly-empty defaults); `POST
-  /templates/:id/plan` returns the resolved graph without deploying.
-- [x] **Compose import** — `POST /templates/import/compose` (yaml →
-  graph, known DB images become managed databases), `POST
-  /templates/import/git` (compose file fetched from any git repo — clone
-  URL, ssh remote, or owner/repo via connected providers, `ref` selects
-  branch/commit); `templates import-compose|import-git` CLI, MCP tools,
-  paste-or-git toggle in the template UI.
-- [x] **Graph deploy pipeline** — creates services in dependency order,
-  resolves vars/secrets, triggers builds. `deployTemplateGraph`,
-  `POST /templates/deploy` (inline), `POST /projects/:id/import-compose`.
+  deploy order from dependency refs.
+- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
+  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
+  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
+  graph without deploying (agents love this).
+- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
+  parser → graph), `POST /templates/import/github` (compose file from
+  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
+- [ ] **Graph deploy pipeline** — creates project + services in
+  dependency order, resolves vars, triggers builds; defined
+  partial-failure policy.
 - [ ] **Visual template builder** — canvas mode: drop git/image/db
   nodes, wire refs, set order, save/publish. Reuses existing canvas
   primitives (dflow's `templates/compose` is exactly this).
-- [x] **Catalog growth** — seeded graph stacks for n8n, Gitea,
-  Nextcloud, Vaultwarden, Umami, Immich (Plausible already shipped).
-  `TestSeedTemplatesResolveCleanly` keeps every seed parseable,
-  topo-sortable, and fully resolved. Remaining single-service guides can
-  convert incrementally via the same endpoint.
+- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
+  real graph templates; screenshots + badges per the old spec.
 
 **Gate**: paste n8n compose → 3-service project with generated secrets
 and wired refs, one click or one CLI call.
@@ -310,22 +296,9 @@ and wired refs, one click or one CLI call.
   utilisation, then cpu, then container count, with uninstrumented
   agents sorting last. Lifecycle and `GET /runtime` are
   inventory-driven, so remote replicas show up and tear down wherever
-  they run. Remote ingress shipped: the agent reports assigned host
-  ports in the `create_container` result, the backend renders a
-  Traefik file-provider config per remote service into
-  `TRAEFIK_DYNAMIC_DIR` (shared volume, `watch=true`) pointing the
-  loadbalancer at each replica's mesh IP + published port; route files
-  are rewritten on every remote reconcile and removed on teardown or
-  local placement. Agents report managed-container states at every
-  heartbeat — exits, OOMs, and crash loops land in inventory between
-  reconciles (tombstones never resurrect). Remote sleep/wake shipped:
-  heartbeats carry per-container net counters, idle remote services
-  lose replicas via agent remove + tombstones, and the route file
-  repoints at `/internal/wake-page/:id` on the backend — first hit
-  retriggers the wake reconcile, which recreates replicas and restores
-  real upstreams. Remote nodes run
-  registry-pulled images only — git builds are the remaining
-  documented ceiling. Tag affinity shipped: `node_agents.tags`
+  they run. Remote nodes run registry-pulled
+  images only — git builds, Traefik domains, and remote sleep are
+  documented ceilings. Tag affinity shipped: `node_agents.tags`
   (operator-set via `PUT /agents/:id` / `nodes update --tags`) +
   `services.placement_tags` — `auto` and `spread` only consider
   online schedulable agents carrying every required tag, tags are
@@ -334,8 +307,9 @@ and wired refs, one click or one CLI call.
   and local + tags are rejected, empty array clears. Surfaces:
   `--placement-tags` on services create/update, `--tags` on
   `nodes update`, MCP args, OpenAPI, node-detail tag editor +
-  service-detail placement-tags input. Remaining: build-on-node,
-  remote sleep/wake, spread weighting by real capacity.
+  service-detail placement-tags input. Remaining: deployment
+  status reported back from agent results, spread weighting by
+  real capacity.
 - [x] **Agent self-upgrade** — `POST /agents/:id/upgrade` enqueues a
   `self_upgrade` command carrying platform + sha256 + server version;
   the agent downloads its replacement from `GET /agents/download/
@@ -348,22 +322,19 @@ and wired refs, one click or one CLI call.
   CLI, `containr_nodes_upgrade` MCP (confirm-gated), node-detail page
   button (online-gated). Ceilings: linux amd64/arm64 only; agents on
   other platforms get a `NO_BINARY` 409.
-- [x] **Build-on-node** — private registry pulls + real builds shipped.
-  Git sources materialize via `internal/source` checkout (branch/commit,
-  `GIT_ASKPASS` credential injection, dumb-transport fallback), package
-  through `BuildManager.PackageContext`, ship as agent-token artifacts,
-  and `docker build` on the node (`build_image` command). Remote rollbacks
-  `docker save` → artifact → `load_image` on the node. Verified end-to-end
-  on a live agent (PR #60).
+- [🟡] **Build-on-node** — private registry pulls shipped: the dispatch
+  payload carries the project owner's `registries` credentials for the
+  image host; the agent `docker login`s for the pull and logs out after,
+  and command payloads are scrubbed of passwords on completion. Agent
+  also verifies the container is still running ~1.5s after `run` so
+  crash-loops fail the deploy instead of reporting healthy. Remaining:
+  real builds on the node (source checkout + build daemon) — pulls
+  already work.
 - [ ] **IaC provisioning (ROADMAP §2.2, unchanged)** — Terraform/
   OpenTofu, `infra_connections`, Proxmox + AWS modules, + Hetzner module
   (dflow's second provider), cloud-init → auto-enroll.
-- [x] **Global/wildcard domain per node** (`node_agents.default_domain`) —
-  `PUT /agents/:id {default_domain}`; domainless services placed on the
-  node get `<name>.<default_domain>` (pinned → node's base; spread →
-  union of eligible nodes). `serviceDomainNames` resolves them so
-  routing, wake placeholders, and `public_url` all pick them up.
-  CLI `nodes update --domain`, MCP arg, node-detail editor.
+- [ ] **Global/wildcard domain per node** (`nodes.default_domain`) —
+  auto-domains for services on that node.
 
 ## 8. Phase G — Platform polish
 
@@ -436,11 +407,8 @@ and wired refs, one click or one CLI call.
   filters. Applied: audit logs (server-backed), builds (server + client
   date-range), activity (severity server + client category/search).
   Notifications table has no list surface yet — apply when one lands.
-- [x] **Notification producers round-out** — all shipped: deployments
-  (deployments.go), backups (databases.go `createBackupProcess` → owner),
-  agent offline/online sweep (`reconcileAgentHealth` → admins),
-  upgrade-available (`checkForUpgrade`, tag-persisted) and security-scan
-  findings (`scanner.OnScanComplete` → project owner).
+- [ ] **Notification producers round-out** — backups, agent offline,
+  upgrade available, security findings.
 - [x] **Sleep-on-idle / wake-on-traffic** (serverless-lite) —
   `services.sleep_enabled` + `sleep_idle_minutes` (PR #29). Sweeper
   polls container NetworkIO deltas; idle past threshold → workload
@@ -505,9 +473,8 @@ and wired refs, one click or one CLI call.
     a prior deployment, database start/stop/restart/backup-now.
   - **Observe** — polling log tail (300 lines, 5s refresh), per-service
     deployment history, env-doctor issues surfaced on the service view.
-  - [x] **env var edit + domain management + replica scaling** (PR #61 —
-    mobile v1.5: variables editor, domains screen, scale + sleep
-    settings, notifications tab). **cron execution history** still open.
+  - [ ] **env var edit + apply-redeploy, domain management, replica
+    scaling, cron execution history** — next iteration.
   - [ ] **Push notifications** — zero-infra path = self-hosted
     ntfy/Gotify relay (no Firebase dependency), FCM/APNs optional.
   - [ ] **Offline resilience** — cached last-known state + unreachable
@@ -517,9 +484,8 @@ and wired refs, one click or one CLI call.
 
 ## 10. Carried-over debt (ROADMAP.md items still open)
 
-- [x] **Gateway traffic path** — `/g/:slug/*` mounted → api_key auth →
-  rpm + monthly quota → `gateway/proxy.go` → usage_counters /
-  metrics_timeseries / incident_events.
+- [ ] **Gateway traffic path** — mount `/g/:slug/*` → key → rate-limit →
+  `gateway/proxy.go` → metrics. Management API exists; proxy unwired.
 - [ ] **Preview environments runtime** — real build+deploy+subdomain+TTL
   (bookkeeping only now). Pairs with clone + multi-domain.
 - [ ] **Environments** — env switcher, per-env vars/domains, promote.

app/backend/Dockerfile

@@ -1,7 +1,5 @@
 # Build Go API binary
-ARG GO_IMAGE=golang:1.26-alpine
-ARG NODE_IMAGE=node:22-alpine
-FROM ${GO_IMAGE} AS go-builder
+FROM golang:1.26-alpine AS go-builder
 
 RUN apk add --no-cache git ca-certificates tzdata
 
@@ -20,7 +18,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X main.version=${V
     CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-arm64 ./cmd/agent
 
 # Build embedded Better Auth runtime dependencies
-FROM ${NODE_IMAGE} AS auth-builder
+FROM node:22-alpine AS auth-builder
 
 WORKDIR /auth
 
@@ -30,9 +28,9 @@ RUN npm ci --omit=dev
 COPY auth/src ./src
 
 # Final runtime image (Go API + Better Auth sidecar in one container)
-FROM ${NODE_IMAGE}
+FROM node:22-alpine
 
-RUN apk --no-cache add ca-certificates tzdata wget git
+RUN apk --no-cache add ca-certificates tzdata wget
 
 RUN addgroup -g 1001 -S appgroup && \
     adduser -u 1001 -S appuser -G appgroup

app/backend/cmd/agent/main.go

@@ -204,92 +204,10 @@ func sendHeartbeat(ctx context.Context, client *http.Client, cfg agentConfig, ag
 		"system_load":     readSystemLoad(),
 		"uptime":          readSystemUptime(),
 		"version":         firstEnv("CONTAINR_AGENT_VERSION", version),
-		"containers":      managedContainerStates(),
 	}
 	return postJSON(ctx, client, cfg, "/api/agents/heartbeat", payload, nil)
 }
 
-// managedContainerStates lists every containr-managed container's docker
-// state plus cumulative network counters — state keeps runtime honest,
-// net bytes let the sleeper detect idle remote services.
-func managedContainerStates() []map[string]interface{} {
-	out, err := runDocker("ps", "-a",
-		"--filter", "label=containr.managed=true",
-		"--format", "{{.Names}}\t{{.State}}")
-	if err != nil {
-		return nil
-	}
-	netIO := containerNetIO()
-	var states []map[string]interface{}
-	for _, line := range strings.Split(out, "\n") {
-		parts := strings.SplitN(line, "\t", 2)
-		if len(parts) != 2 || parts[0] == "" {
-			continue
-		}
-		entry := map[string]interface{}{"name": parts[0], "state": parts[1]}
-		if io, ok := netIO[parts[0]]; ok {
-			entry["rx_bytes"], entry["tx_bytes"] = io[0], io[1]
-		}
-		states = append(states, entry)
-	}
-	return states
-}
-
-// containerNetIO snapshots cumulative rx/tx per running container. Stats
-// only covers running containers — stopped replicas report state without
-// counters, which is all the sleeper needs.
-func containerNetIO() map[string][2]int64 {
-	out, err := runDocker("stats", "--no-stream",
-		"--format", "{{.Name}}\t{{.NetIO}}")
-	if err != nil {
-		return nil
-	}
-	result := map[string][2]int64{}
-	for _, line := range strings.Split(out, "\n") {
-		parts := strings.SplitN(line, "\t", 2)
-		if len(parts) != 2 {
-			continue
-		}
-		io := strings.Split(parts[1], "/")
-		if len(io) != 2 {
-			continue
-		}
-		result[parts[0]] = [2]int64{parseHumanBytes(io[0]), parseHumanBytes(io[1])}
-	}
-	return result
-}
-
-// parseHumanBytes converts docker's human units ("1.2kB", "3.4MB") to bytes.
-func parseHumanBytes(s string) int64 {
-	s = strings.TrimSpace(s)
-	var num float64
-	var unit string
-	if _, err := fmt.Sscanf(s, "%f%s", &num, &unit); err != nil {
-		return 0
-	}
-	switch strings.ToUpper(unit) {
-	case "B":
-		return int64(num)
-	case "KB":
-		return int64(num * 1e3)
-	case "MB":
-		return int64(num * 1e6)
-	case "GB":
-		return int64(num * 1e9)
-	case "TB":
-		return int64(num * 1e12)
-	case "KIB":
-		return int64(num * 1024)
-	case "MIB":
-		return int64(num * 1024 * 1024)
-	case "GIB":
-		return int64(num * 1024 * 1024 * 1024)
-	case "TIB":
-		return int64(num * 1024 * 1024 * 1024 * 1024)
-	}
-	return int64(num)
-}
-
 func processCommands(ctx context.Context, client *http.Client, cfg agentConfig, agentID string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s/api/agents/%s/commands", cfg.APIURL, agentID), nil)
 	if err != nil {
@@ -316,7 +234,7 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 		if item.Type == "self_upgrade" {
 			result, reexecPath, runErr = selfUpgrade(cfg, item.Payload)
 		} else {
-			result, runErr = executeCommand(cfg, item)
+			result, runErr = executeCommand(item)
 		}
 		status := "completed"
 		errText := ""
@@ -343,7 +261,7 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 	return nil
 }
 
-func executeCommand(cfg agentConfig, item command) (string, error) {
+func executeCommand(item command) (string, error) {
 	switch item.Type {
 	case "create_container":
 		return createContainer(item.Payload)
@@ -354,16 +272,7 @@ func executeCommand(cfg agentConfig, item command) (string, error) {
 	case "restart_container":
 		return runDocker("restart", commandTarget(item.Payload))
 	case "remove_container":
-		out, err := runDocker("rm", "-f", commandTarget(item.Payload))
-		// A missing container is the desired end state — report success.
-		if err != nil && strings.Contains(out, "No such container") {
-			return out, nil
-		}
-		return out, err
-	case "build_image":
-		return buildImage(cfg, item.Payload)
-	case "load_image":
-		return loadImage(cfg, item.Payload)
+		return runDocker("rm", "-f", commandTarget(item.Payload))
 	case "prune":
 		return dockerPrune(item.Payload)
 	case "system_df":
@@ -551,139 +460,7 @@ func createContainer(payload map[string]interface{}) (string, error) {
 		logs, _ := runDocker("logs", "--tail", "5", name)
 		return "", fmt.Errorf("container %s is %q after start: %s", name, state, logs)
 	}
-	// Report the real host port bindings — ephemeral publishes pick a port
-	// the server can't guess, and remote ingress needs the actual mapping.
-	hostPorts := map[string]string{}
-	portsJSON, _ := runDocker("inspect", "-f", "{{json .NetworkSettings.Ports}}", name)
-	var bindings map[string][]struct {
-		HostIP   string `json:"HostIp"`
-		HostPort string `json:"HostPort"`
-	}
-	if json.Unmarshal([]byte(portsJSON), &bindings) == nil {
-		for cport, addrs := range bindings {
-			for _, a := range addrs {
-				if a.HostPort != "" && a.HostPort != "0" {
-					hostPorts[cport] = a.HostPort
-				}
-			}
-		}
-	}
-	out, _ := json.Marshal(map[string]interface{}{"name": name, "host_ports": hostPorts})
-	return string(out), nil
-}
-
-// fetchArtifact downloads a server-side deploy artifact (build context or
-// docker-save tarball) into a temp file the docker CLI consumes.
-func fetchArtifact(cfg agentConfig, artifactID string) (*os.File, error) {
-	if len(artifactID) != 32 {
-		return nil, fmt.Errorf("invalid artifact id")
-	}
-	url := fmt.Sprintf("%s/api/agents/artifacts/%s", cfg.APIURL, artifactID)
-	req, err := http.NewRequest(http.MethodGet, url, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("X-Containr-Agent-Token", cfg.Token)
-	resp, err := (&http.Client{Timeout: 10 * time.Minute}).Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("download artifact: %w", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("download artifact: server returned %d", resp.StatusCode)
-	}
-	f, err := os.CreateTemp("", "containr-artifact-*.tar")
-	if err != nil {
-		return nil, err
-	}
-	if _, err := io.Copy(f, resp.Body); err != nil {
-		f.Close()
-		os.Remove(f.Name())
-		return nil, fmt.Errorf("write artifact: %w", err)
-	}
-	if _, err := f.Seek(0, io.SeekStart); err != nil {
-		f.Close()
-		os.Remove(f.Name())
-		return nil, err
-	}
-	return f, nil
-}
-
-// buildImage docker-builds a packaged context tar on this node. The context
-// already carries its Dockerfile at the tar root, so `docker build -` can
-// stream it straight from stdin. Result reports the image digest so the
-// server records what each node actually produced.
-func buildImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
-	image := stringValue(payload["image"])
-	artifactID := stringValue(payload["artifact_id"])
-	if image == "" || artifactID == "" {
-		return "", errors.New("build_image requires image and artifact_id")
-	}
-	f, err := fetchArtifact(cfg, artifactID)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-	defer os.Remove(f.Name())
-
-	args := []string{"build", "-t", image}
-	if boolValue(payload["no_cache"]) {
-		args = append(args, "--no-cache")
-	}
-	// Bare --build-arg keys read their values from the process env — keeps
-	// token-bearing args out of the node's process list.
-	env := os.Environ()
-	if buildArgs, ok := payload["build_args"].(map[string]interface{}); ok {
-		for k, v := range buildArgs {
-			args = append(args, "--build-arg", k)
-			env = append(env, fmt.Sprintf("%s=%v", k, v))
-		}
-	}
-	args = append(args, "-")
-	cmd := exec.Command("docker", args...)
-	cmd.Stdin = f
-	cmd.Env = env
-	outBytes, err := cmd.CombinedOutput()
-	out := strings.TrimSpace(string(outBytes))
-	if err != nil {
-		return "", fmt.Errorf("docker build failed: %s", tailOutput(out, 4096))
-	}
-	digest, _ := runDocker("inspect", "-f", "{{.Id}}", image)
-	size, _ := runDocker("inspect", "-f", "{{.Size}}", image)
-	result, _ := json.Marshal(map[string]string{
-		"image": image, "id": digest, "size": size,
-		"log_tail": tailOutput(out, 4096),
-	})
-	return string(result), nil
-}
-
-// loadImage imports a docker-save tarball — rollbacks of locally-built tags
-// reach remote nodes this way since no registry serves containr-* images.
-func loadImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
-	artifactID := stringValue(payload["artifact_id"])
-	if artifactID == "" {
-		return "", errors.New("load_image requires artifact_id")
-	}
-	f, err := fetchArtifact(cfg, artifactID)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-	defer os.Remove(f.Name())
-	out, err := runDockerStdin(f, "load")
-	if err != nil {
-		return "", fmt.Errorf("docker load failed: %s", tailOutput(out, 4096))
-	}
-	return out, nil
-}
-
-// tailOutput bounds command results — full docker build logs would swamp
-// the agent_commands row.
-func tailOutput(s string, max int) string {
-	if len(s) <= max {
-		return s
-	}
-	return s[len(s)-max:]
+	return name, nil
 }
 
 // registryHostOf mirrors the server's registryHost: first path segment with
@@ -897,15 +674,6 @@ func runDocker(args ...string) (string, error) {
 	return strings.TrimSpace(string(output)), err
 }
 
-// runDockerStdin pipes stdin into docker — build contexts and saved image
-// tarballs stream in without a second copy on disk.
-func runDockerStdin(stdin io.Reader, args ...string) (string, error) {
-	cmd := exec.Command("docker", args...)
-	cmd.Stdin = stdin
-	output, err := cmd.CombinedOutput()
-	return strings.TrimSpace(string(output)), err
-}
-
 func dockerAvailable() bool {
 	_, err := exec.LookPath("docker")
 	if err != nil {

app/backend/internal/api/agents.go

@@ -30,24 +30,21 @@ import (
 
 // NodeAgent represents a container orchestration agent
 type NodeAgent struct {
-	ID            string            `json:"id"`
-	Name          string            `json:"name"`
-	Hostname      string            `json:"hostname"`
-	IPAddress     string            `json:"ip_address"`
-	Port          int               `json:"port"`
-	Status        string            `json:"status"`
-	Version       string            `json:"version"`
-	Capabilities  AgentCapabilities `json:"capabilities"`
-	Resources     NodeResources     `json:"resources"`
-	LastHeartbeat time.Time         `json:"last_heartbeat"`
-	AutoPrune     bool              `json:"auto_prune"`
-	Schedulable   bool              `json:"schedulable"`
+	ID            string                 `json:"id"`
+	Name          string                 `json:"name"`
+	Hostname      string                 `json:"hostname"`
+	IPAddress     string                 `json:"ip_address"`
+	Port          int                    `json:"port"`
+	Status        string                 `json:"status"`
+	Version       string                 `json:"version"`
+	Capabilities  AgentCapabilities      `json:"capabilities"`
+	Resources     NodeResources          `json:"resources"`
+	LastHeartbeat time.Time              `json:"last_heartbeat"`
+	AutoPrune     bool                   `json:"auto_prune"`
+	Schedulable   bool                   `json:"schedulable"`
 	// Tags are operator-set placement labels; services with placement_tags
 	// only schedule onto agents carrying every required tag.
-	Tags []string `json:"tags"`
-	// DefaultDomain is this node's base domain — services placed here with
-	// no explicit domains get <name>.<default_domain> automatically.
-	DefaultDomain string                 `json:"default_domain"`
+	Tags          []string               `json:"tags"`
 	CreatedAt     time.Time              `json:"created_at"`
 	UpdatedAt     time.Time              `json:"updated_at"`
 	Metadata      map[string]interface{} `json:"metadata"`
@@ -201,17 +198,6 @@ type AgentHeartbeat struct {
 	SystemLoad     SystemLoad    `json:"system_load"`
 	Uptime         int64         `json:"uptime"`
 	Version        string        `json:"version"`
-	// Containers reports managed-container liveness — {name, state} per
-	// containr.managed container on the node — so remote replica status
-	// reflects reality between reconciles (exits, OOMs, crash loops).
-	Containers []AgentContainerState `json:"containers,omitempty"`
-}
-
-type AgentContainerState struct {
-	Name    string `json:"name"`
-	State   string `json:"state"`
-	RxBytes int64  `json:"rx_bytes,omitempty"`
-	TxBytes int64  `json:"tx_bytes,omitempty"`
 }
 
 type SystemLoad struct {
@@ -275,18 +261,17 @@ func (h *NodeAgentHandler) ListNodeOptions(c *gin.Context) {
 
 func agentFromRow(row sqlcdb.NodeAgent) NodeAgent {
 	agent := NodeAgent{
-		ID:            row.ID,
-		Name:          row.Name,
-		Hostname:      row.Hostname,
-		IPAddress:     row.IpAddress,
-		Port:          int(row.Port),
-		Status:        row.Status.String,
-		Version:       row.Version.String,
-		AutoPrune:     row.AutoPrune,
-		Schedulable:   row.Schedulable,
-		Tags:          []string{},
-		DefaultDomain: row.DefaultDomain,
-		Metadata:      map[string]interface{}{},
+		ID:          row.ID,
+		Name:        row.Name,
+		Hostname:    row.Hostname,
+		IPAddress:   row.IpAddress,
+		Port:        int(row.Port),
+		Status:      row.Status.String,
+		Version:     row.Version.String,
+		AutoPrune:   row.AutoPrune,
+		Schedulable: row.Schedulable,
+		Tags:        []string{},
+		Metadata:    map[string]interface{}{},
 	}
 	if row.LastHeartbeat.Valid {
 		agent.LastHeartbeat = row.LastHeartbeat.Time
@@ -576,18 +561,6 @@ func (h *NodeAgentHandler) UpdateAgent(c *gin.Context) {
 	// Tags persist through their own column write — UpdateAgent keeps the
 	// register-path signature untouched.
 	resp := agentFromRow(updated)
-	if raw, ok := updates["default_domain"]; ok {
-		domain := strings.ToLower(strings.TrimSpace(fmt.Sprintf("%v", raw)))
-		if domain != "" && !validHostname(domain) {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "default_domain must be a valid hostname", "code": "VALIDATION"})
-			return
-		}
-		if err := h.q.SetAgentDefaultDomain(ctx, sqlcdb.SetAgentDefaultDomainParams{ID: id, DefaultDomain: domain}); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update default domain"})
-			return
-		}
-		resp.DefaultDomain = domain
-	}
 	if raw, ok := updates["tags"]; ok {
 		var tags []string
 		if b, mErr := json.Marshal(raw); mErr == nil {
@@ -692,22 +665,6 @@ func (h *NodeAgentHandler) SendHeartbeat(c *gin.Context) {
 		return
 	}
 
-	// Reconcile remote container liveness — exits and crash loops surface
-	// in inventory between reconciles. Best-effort, never fatal.
-	for _, rc := range heartbeat.Containers {
-		if rc.Name == "" || rc.State == "" {
-			continue
-		}
-		stateJSON, _ := json.Marshal(rc.State)
-		bytesJSON, _ := json.Marshal(rc.RxBytes + rc.TxBytes)
-		_ = h.q.UpdateContainerStateByName(ctx, sqlcdb.UpdateContainerStateByNameParams{
-			Name:        rc.Name,
-			NodeAgentID: heartbeat.NodeAgentID,
-			Column3:     stateJSON,
-			Column4:     bytesJSON,
-		})
-	}
-
 	c.Status(http.StatusOK)
 }
 
@@ -785,9 +742,7 @@ func (h *NodeAgentHandler) CompleteCommand(c *gin.Context) {
 }
 
 // scrubCommandSecrets rewrites a completed command's payload with any
-// credential-bearing fields blanked — registry passwords and build-time
-// args (tokens like NPM_TOKEN ride along as build args). Best-effort — a
-// failed scrub leaves the row.
+// registry password blanked. Best-effort — a failed scrub leaves the row.
 func scrubCommandSecrets(ctx context.Context, q *sqlcdb.Queries, commandID string, payload pqtype.NullRawMessage) {
 	if !payload.Valid || len(payload.RawMessage) == 0 {
 		return
@@ -796,24 +751,15 @@ func scrubCommandSecrets(ctx context.Context, q *sqlcdb.Queries, commandID strin
 	if err := json.Unmarshal(payload.RawMessage, &doc); err != nil {
 		return
 	}
-	dirty := false
-	if container, ok := doc["container"].(map[string]interface{}); ok {
-		if reg, ok := container["registry"].(map[string]interface{}); ok && reg["password"] != nil {
-			reg["password"] = "***"
-			dirty = true
-		}
-	}
-	for _, key := range []string{"build_args", "environment"} {
-		if args, ok := doc[key].(map[string]interface{}); ok && len(args) > 0 {
-			for k := range args {
-				args[k] = "***"
-			}
-			dirty = true
-		}
-	}
-	if !dirty {
+	container, ok := doc["container"].(map[string]interface{})
+	if !ok {
 		return
 	}
+	reg, ok := container["registry"].(map[string]interface{})
+	if !ok || reg["password"] == nil {
+		return
+	}
+	reg["password"] = "***"
 	if err := q.ScrubCommandPayload(ctx, sqlcdb.ScrubCommandPayloadParams{
 		ID:      commandID,
 		Payload: rawJSON(doc),
@@ -1485,10 +1431,6 @@ func (h *NodeAgentHandler) SetupPublicRoutes(router *gin.RouterGroup) {
 		// public; the enroll token is the actual secret.
 		agents.GET("/install.sh", h.ServeInstallScript)
 		agents.GET("/download/:platform", h.ServeAgentBinary)
-
-		// Deploy artifacts (build contexts, image tarballs) — token-gated;
-		// the blobs are per-deployment source code, not public bootstrap.
-		agents.GET("/artifacts/:id", h.ServeArtifact)
 	}
 }
 

app/backend/internal/api/artifacts.go

@@ -1,136 +0,0 @@
-package api
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"github.com/gin-gonic/gin"
-)
-
-// containrWorkDir is the build workspace root — same dir the BuildManager
-// was constructed with; checkouts and agent artifacts live beneath it.
-const containrWorkDir = "/tmp/containr-builds"
-
-// artifacts is a one-shot blob store for node agents: build contexts and
-// docker-save tarballs the server produced on behalf of a deployment. Files
-// live under workdir/artifacts/<id> and are removed when the deployment
-// finishes or after maxArtifactAge.
-var artifacts = &artifactStore{files: map[string]string{}}
-
-type artifactStore struct {
-	mu    sync.Mutex
-	dir   string
-	files map[string]string
-}
-
-const maxArtifactAge = 2 // hours — a deployment can never outlive this
-
-// initArtifacts points the store at dir (created on demand).
-func initArtifacts(dir string) {
-	artifacts.mu.Lock()
-	defer artifacts.mu.Unlock()
-	artifacts.dir = dir
-	_ = os.MkdirAll(dir, 0o755)
-}
-
-// artifactDir returns the store root, defaulting under the build workdir.
-func artifactDir() string {
-	artifacts.mu.Lock()
-	defer artifacts.mu.Unlock()
-	if artifacts.dir != "" {
-		return artifacts.dir
-	}
-	return filepath.Join(containrWorkDir, "artifacts")
-}
-
-// putArtifact streams rc into the store and returns the artifact id.
-func putArtifact(rc io.Reader) (string, error) {
-	buf := make([]byte, 16)
-	if _, err := rand.Read(buf); err != nil {
-		return "", err
-	}
-	id := hex.EncodeToString(buf)
-	dir := artifactDir()
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return "", err
-	}
-	path := filepath.Join(dir, id+".tar")
-	f, err := os.Create(path)
-	if err != nil {
-		return "", err
-	}
-	if _, err := io.Copy(f, rc); err != nil {
-		f.Close()
-		os.Remove(path)
-		return "", err
-	}
-	f.Close()
-
-	artifacts.mu.Lock()
-	artifacts.files[id] = path
-	artifacts.mu.Unlock()
-	return id, nil
-}
-
-// removeArtifact deletes the file and forgets the id. Safe on missing ids.
-func removeArtifact(id string) {
-	artifacts.mu.Lock()
-	path, ok := artifacts.files[id]
-	delete(artifacts.files, id)
-	artifacts.mu.Unlock()
-	if ok {
-		_ = os.Remove(path)
-		return
-	}
-	// Registered before a restart — remove best-effort by name.
-	if id != "" {
-		_ = os.Remove(filepath.Join(artifactDir(), id+".tar"))
-	}
-}
-
-// ServeArtifact streams a stored blob to a token-authenticated agent. Files
-// persist across downloads — spread builds share one context — and are
-// deleted by the deployment that created them.
-func (h *NodeAgentHandler) ServeArtifact(c *gin.Context) {
-	if !h.isValidAgentAuthToken(c.Request.Context(), agentAuthTokenFromRequest(c)) {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid auth token"})
-		return
-	}
-	id := c.Param("id")
-	raw, err := hex.DecodeString(id)
-	if len(id) != 32 || err != nil || len(raw) != 16 {
-		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
-		return
-	}
-	path := filepath.Join(artifactDir(), id+".tar")
-	info, err := os.Stat(path)
-	if err != nil || info.IsDir() {
-		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
-		return
-	}
-	c.Header("Content-Type", "application/x-tar")
-	c.File(path)
-}
-
-// purgeStaleArtifacts drops files older than maxArtifactAge. Called on boot.
-func purgeStaleArtifacts() {
-	entries, err := os.ReadDir(artifactDir())
-	if err != nil {
-		return
-	}
-	for _, e := range entries {
-		info, err := e.Info()
-		if err != nil {
-			continue
-		}
-		if info.ModTime().Before(time.Now().Add(-maxArtifactAge * time.Hour)) {
-			_ = os.Remove(filepath.Join(artifactDir(), e.Name()))
-		}
-	}
-}

app/backend/internal/api/deployments.go

@@ -5,15 +5,11 @@ import (
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/docker"
-	"containr/internal/source"
-	"containr/internal/types"
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
-	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -381,23 +377,6 @@ func runDeploymentAndSyncWithImage(
 	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
 	defer cancel()
 
-	// The checkout and any shipped artifacts die with this deployment.
-	var artifactIDs []string
-	checkoutRoot := filepath.Join(containrWorkDir, "repos", dbDeployment.ID.String())
-	defer func() {
-		_ = os.RemoveAll(checkoutRoot)
-		for _, id := range artifactIDs {
-			removeArtifact(id)
-		}
-	}()
-	failDeploy := func(msg string) {
-		failedAt := time.Now()
-		_, _ = db.Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			msg, failedAt, dbDeployment.ID,
-		)
-	}
-
 	sourcePath := strings.TrimSpace(service.BuildPath)
 	if sourcePath == "" {
 		sourcePath = "."
@@ -442,31 +421,19 @@ func runDeploymentAndSyncWithImage(
 		maintURL = maintenanceURL(db)
 	}
 
-	// Node-pinned and spread services dispatch to agent command queues.
+	// Node-pinned services dispatch to the agent's command queue. Builds run
+	// on the local host, so remote placement only works for registry-pulled
+	// images — git-sourced and rollback deploys fail fast with that message.
 	nodeID := serviceNodeID(db, service.ID)
 	spread := serviceSpread(db, service.ID)
-	remote := nodeID != "" || spread
-
-	// Materialize the git checkout — local builds consume it directly;
-	// remote builds package it into a context artifact the node builds.
-	if service.GitRepo != "" && imageOverride == "" {
-		var ownerID string
-		_ = db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, service.ProjectID).Scan(&ownerID)
-		branch := req.Branch
-		if branch == "" {
-			branch = service.GitBranch
-		}
-		cloneSpec, err := resolveGitCloneSpec(db, ownerID, service.GitRepo, branch, req.CommitHash, service.BuildPath)
-		if err != nil {
-			failDeploy("resolve git source: " + err.Error())
-			return
-		}
-		src, err := source.Checkout(ctx, checkoutRoot, cloneSpec)
-		if err != nil {
-			failDeploy("git checkout: " + err.Error())
-			return
-		}
-		sourcePath = src
+	if (nodeID != "" || spread) && (service.GitRepo != "" || imageOverride != "") {
+		failedAt := time.Now()
+		msg := "service uses remote node placement but remote nodes only run registry-pulled images (git builds and rollbacks stay local — build-on-node is not yet supported)"
+		_, _ = db.Exec(
+			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
+			msg, failedAt, dbDeployment.ID,
+		)
+		return
 	}
 
 	deployReq := &deployment.DeploymentRequest{
@@ -513,36 +480,14 @@ func runDeploymentAndSyncWithImage(
 		if image == "" {
 			image = service.Image
 		}
-		if remote && strings.HasPrefix(image, "containr-") {
-			// Locally-built tag — no registry serves it. Ship the image
-			// itself as a docker-save artifact; the node loads it.
-			rc, err := engine.DockerClient().SaveImage(ctx, image)
-			if err != nil {
-				failDeploy("export rollback image: " + err.Error())
-				return
-			}
-			artifactID, err := putArtifact(rc)
-			_ = rc.Close()
-			if err != nil {
-				failDeploy("store rollback image artifact: " + err.Error())
-				return
-			}
-			artifactIDs = append(artifactIDs, artifactID)
-			deployReq.Config.RemoteLoad = &deployment.RemoteLoadSpec{ArtifactID: artifactID}
-			deployReq.BuildConfig = &deployment.BuildConfig{
-				BuildType:     "remote",
-				PrebuiltImage: image,
-			}
-		} else {
-			var ownerID string
-			_ = db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, service.ProjectID).Scan(&ownerID)
-			auth := registryAuthFor(db, ownerID, image)
-			deployReq.BuildConfig = &deployment.BuildConfig{
-				BuildType:     "prebuilt",
-				PrebuiltImage: image,
-				PullUsername:  auth.Username,
-				PullPassword:  auth.Password,
-			}
+		var ownerID string
+		_ = db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, service.ProjectID).Scan(&ownerID)
+		auth := registryAuthFor(db, ownerID, image)
+		deployReq.BuildConfig = &deployment.BuildConfig{
+			BuildType:     "prebuilt",
+			PrebuiltImage: image,
+			PullUsername:  auth.Username,
+			PullPassword:  auth.Password,
 		}
 	} else {
 		// "auto" leaves BuildType empty so the manager detects it; the static
@@ -552,54 +497,16 @@ func runDeploymentAndSyncWithImage(
 		if service.Builder != "" && service.Builder != "auto" {
 			buildType = service.Builder
 		}
-		buildArgs := map[string]string{}
-		buildCommand := ""
-		if buildType == "static" {
-			buildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
-			buildArgs["STATIC_DIR"] = firstNonEmpty(service.StaticDir, "dist")
+		deployReq.BuildConfig = &deployment.BuildConfig{
+			BuildType:  buildType,
+			SourcePath: sourcePath,
+			Branch:     req.Branch,
+			Commit:     req.CommitHash,
+			NoCache:    req.NoCache,
 		}
-		if remote {
-			// Package the context — the node docker-builds it itself.
-			packReq := &types.BuildRequest{
-				BuildType:    buildType,
-				SourcePath:   sourcePath,
-				BuildCommand: buildCommand,
-				BuildArgs:    buildArgs,
-				Environment:  env,
-			}
-			rc, err := engine.BuildManager().PackageContext(ctx, packReq)
-			if err != nil {
-				failDeploy("package build context: " + err.Error())
-				return
-			}
-			artifactID, err := putArtifact(rc)
-			_ = rc.Close()
-			if err != nil {
-				failDeploy("store build context artifact: " + err.Error())
-				return
-			}
-			artifactIDs = append(artifactIDs, artifactID)
-			deployReq.Config.RemoteBuild = &deployment.RemoteBuildSpec{
-				ArtifactID: artifactID,
-				BuildArgs:  buildArgs,
-				NoCache:    req.NoCache,
-			}
-			deployReq.BuildConfig = &deployment.BuildConfig{
-				BuildType: "remote",
-				Branch:    req.Branch,
-				Commit:    req.CommitHash,
-				NoCache:   req.NoCache,
-			}
-		} else {
-			deployReq.BuildConfig = &deployment.BuildConfig{
-				BuildType:    buildType,
-				SourcePath:   sourcePath,
-				BuildCommand: buildCommand,
-				BuildArgs:    buildArgs,
-				Branch:       req.Branch,
-				Commit:       req.CommitHash,
-				NoCache:      req.NoCache,
-			}
+		if buildType == "static" {
+			deployReq.BuildConfig.BuildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
+			deployReq.BuildConfig.BuildArgs = map[string]string{"STATIC_DIR": firstNonEmpty(service.StaticDir, "dist")}
 		}
 	}
 

app/backend/internal/api/domains.go

@@ -3,7 +3,6 @@ package api
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"net"
 	"net/http"
 	"regexp"
@@ -11,7 +10,6 @@ import (
 	"time"
 
 	"containr/internal/database"
-	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -70,72 +68,6 @@ func serviceDomainNames(db *database.DB, serviceID uuid.UUID, fallback string) [
 	if len(out) == 0 && fallback != "" {
 		out = []string{fallback}
 	}
-	if len(out) == 0 {
-		out = serviceAutoDomains(db, serviceID)
-	}
-	return out
-}
-
-// dnsLabel normalizes a service name into a DNS label: lowercase alnum
-// plus single dashes, never leading/trailing, ≤63 chars.
-func dnsLabel(name string) string {
-	var b strings.Builder
-	lastWasSep := false
-	for _, r := range strings.ToLower(strings.TrimSpace(name)) {
-		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
-			b.WriteRune(r)
-			lastWasSep = false
-			continue
-		}
-		if !lastWasSep && b.Len() > 0 {
-			b.WriteByte('-')
-			lastWasSep = true
-		}
-	}
-	out := strings.Trim(b.String(), "-")
-	if len(out) > 63 {
-		out = strings.Trim(out[:63], "-")
-	}
-	return out
-}
-
-// serviceAutoDomains generates <service>.<node-default-domain> hostnames
-// for services with no explicit domains. Pinned services take their node's
-// base domain; spread services union every eligible node's base domain.
-// Local services get nothing — there is no instance-level base domain yet.
-func serviceAutoDomains(db *database.DB, serviceID uuid.UUID) []string {
-	var name string
-	var nodeID sql.NullString
-	var spread bool
-	if err := db.QueryRow(
-		`SELECT name, node_id, COALESCE(spread, false) FROM services WHERE id = $1`, serviceID,
-	).Scan(&name, &nodeID, &spread); err != nil {
-		return nil
-	}
-	label := dnsLabel(name)
-	if label == "" {
-		return nil
-	}
-
-	var bases []string
-	ctx := context.Background()
-	q := sqlcdb.New(db.DB)
-	switch {
-	case nodeID.Valid && nodeID.String != "":
-		if a, err := q.GetAgent(ctx, nodeID.String); err == nil && a.DefaultDomain != "" {
-			bases = []string{a.DefaultDomain}
-		}
-	case spread:
-		var err error
-		bases, err = q.ListSchedulableAgentDomains(ctx, json.RawMessage(tagsJSON(servicePlacementTags(db, serviceID))))
-		if err != nil {
-			bases = nil
-		}
-	}
-	out := make([]string, 0, len(bases))
-	for _, base := range bases {
-		out = append(out, label+"."+base)
-	}
 	return out
 }
 

app/backend/internal/api/domains_test.go

@@ -1,26 +0,0 @@
-package api
-
-import "testing"
-
-func TestDNSLabel(t *testing.T) {
-	cases := map[string]string{
-		"my-app":        "my-app",
-		"My App_2":      "my-app-2",
-		"  web  ":       "web",
-		"__weird__name": "weird-name",
-		"---":           "",
-		"":              "",
-	}
-	for in, want := range cases {
-		if got := dnsLabel(in); got != want {
-			t.Errorf("dnsLabel(%q) = %q, want %q", in, got, want)
-		}
-	}
-}
-
-func TestDNSLabelLengthCap(t *testing.T) {
-	long := "a" + string(make([]byte, 0)) + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-	if got := dnsLabel(long); len(got) > 63 {
-		t.Fatalf("label over 63 chars: %d", len(got))
-	}
-}

app/backend/internal/api/gateway_proxy.go

@@ -1,311 +0,0 @@
-package api
-
-// Data plane for the public API gateway: /g/:slug/* proxies to the
-// upstream_url of the matching api_services row. Callers authenticate with
-// api_keys (X-API-Key or Authorization: Bearer), pass the rpm + monthly
-// quota gates, and every request lands in usage_counters /
-// metrics_timeseries / incident_events for the /admin/gateway analytics
-// surfaces.
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"net/http"
-	"strings"
-	"sync"
-	"time"
-
-	"containr/internal/database"
-	"containr/internal/gateway"
-
-	"github.com/gin-gonic/gin"
-	"golang.org/x/crypto/bcrypt"
-)
-
-// jarvis: ceiling — a single shared transport; per-request timeouts come
-// from api_services.request_timeout_ms on the request context.
-var gatewayHTTPClient = &http.Client{
-	Transport: &http.Transport{
-		MaxIdleConns:        100,
-		MaxIdleConnsPerHost: 10,
-		IdleConnTimeout:     90 * time.Second,
-	},
-}
-
-// gatewayRPM is a process-local per-minute counter map. Containr runs a
-// single API process, so an in-memory bucket is sufficient — a multi-node
-// control plane would need a Redis-backed limiter instead.
-var gatewayRPM = struct {
-	sync.Mutex
-	buckets map[string]*rpmBucket
-}{buckets: map[string]*rpmBucket{}}
-
-type rpmBucket struct {
-	window time.Time
-	count  int
-}
-
-// gatewayRateAllow returns false when the bucket for the current minute has
-// already reached limit. A limit <= 0 disables the check. `now` is injected
-// so tests can freeze the window.
-func gatewayRateAllow(bucketKey string, limit int, now time.Time) bool {
-	if limit <= 0 {
-		return true
-	}
-	window := now.Truncate(time.Minute)
-	gatewayRPM.Lock()
-	defer gatewayRPM.Unlock()
-	b := gatewayRPM.buckets[bucketKey]
-	if b == nil || !b.window.Equal(window) {
-		b = &rpmBucket{window: window}
-		gatewayRPM.buckets[bucketKey] = b
-		// Best-effort sweep so the map cannot grow without bound.
-		for k, old := range gatewayRPM.buckets {
-			if old.window.Before(window.Add(-time.Minute)) {
-				delete(gatewayRPM.buckets, k)
-			}
-		}
-	}
-	b.count++
-	return b.count <= limit
-}
-
-type gatewayService struct {
-	ID                 string
-	UpstreamURL        string
-	RoutePrefix        string
-	UpstreamAuthHeader sql.NullString
-	UpstreamAuthValue  sql.NullString
-	Enabled            bool
-	RPMLimit           sql.NullInt64
-	MonthlyQuota       sql.NullInt64
-	RequestTimeoutMS   int
-}
-
-type gatewayKey struct {
-	ID                string
-	Hash              string
-	Enabled           bool
-	RPMLimit          sql.NullInt64
-	MonthlyQuota      sql.NullInt64
-	AllowedServiceIDs string
-}
-
-// extractGatewayKey reads the caller's API key from X-API-Key first, then
-// Authorization: Bearer.
-func extractGatewayKey(c *gin.Context) string {
-	if k := strings.TrimSpace(c.GetHeader("X-API-Key")); k != "" {
-		return k
-	}
-	auth := strings.TrimSpace(c.GetHeader("Authorization"))
-	if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
-		return strings.TrimSpace(auth[7:])
-	}
-	return ""
-}
-
-// lookupGatewayService resolves the slug to an enabled service row.
-func lookupGatewayService(ctx context.Context, db *database.DB, slug string) (*gatewayService, error) {
-	var s gatewayService
-	var enabled int
-	err := db.QueryRowContext(ctx, `
-		SELECT id, upstream_url, route_prefix, upstream_auth_header,
-		       upstream_auth_value, enabled, rpm_limit, monthly_quota,
-		       request_timeout_ms
-		FROM api_services WHERE slug = $1
-	`, slug).Scan(&s.ID, &s.UpstreamURL, &s.RoutePrefix,
-		&s.UpstreamAuthHeader, &s.UpstreamAuthValue, &enabled,
-		&s.RPMLimit, &s.MonthlyQuota, &s.RequestTimeoutMS)
-	if err != nil {
-		return nil, err
-	}
-	s.Enabled = enabled != 0
-	return &s, nil
-}
-
-// authenticateGatewayKey resolves a presented key by its indexed prefix and
-// bcrypt-verifies candidates. Returns nil when nothing matches.
-func authenticateGatewayKey(ctx context.Context, db *database.DB, presented string) (*gatewayKey, error) {
-	prefix := presented
-	if len(prefix) > 8 {
-		prefix = prefix[:8]
-	}
-	rows, err := db.QueryContext(ctx, `
-		SELECT id, key_hash, enabled, rpm_limit, monthly_quota, allowed_service_ids
-		FROM api_keys WHERE key_prefix = $1
-	`, prefix)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	for rows.Next() {
-		var k gatewayKey
-		var enabled int
-		if err := rows.Scan(&k.ID, &k.Hash, &enabled, &k.RPMLimit, &k.MonthlyQuota, &k.AllowedServiceIDs); err != nil {
-			return nil, err
-		}
-		k.Enabled = enabled != 0
-		if bcrypt.CompareHashAndPassword([]byte(k.Hash), []byte(presented)) == nil {
-			return &k, nil
-		}
-	}
-	return nil, rows.Err()
-}
-
-// keyAllowsService applies the allowed_service_ids JSON allowlist. An empty
-// list means the key may call every service.
-func keyAllowsService(k *gatewayKey, serviceID string) bool {
-	var allowed []string
-	if err := json.Unmarshal([]byte(k.AllowedServiceIDs), &allowed); err != nil || len(allowed) == 0 {
-		return true
-	}
-	for _, id := range allowed {
-		if id == serviceID {
-			return true
-		}
-	}
-	return false
-}
-
-// monthlyUsage sums a counter dimension for the current calendar month.
-func monthlyUsage(ctx context.Context, db *database.DB, column, id, period string) (int, error) {
-	var total int
-	err := db.QueryRowContext(ctx, `
-		SELECT COALESCE(SUM(request_count), 0) FROM usage_counters
-		WHERE `+column+` = $1 AND period_month = $2
-	`, id, period).Scan(&total)
-	return total, err
-}
-
-// recordGatewayRequest persists usage, metrics, and failure incidents for a
-// proxied call. Runs in the request path but is three small writes.
-func recordGatewayRequest(ctx context.Context, db *database.DB, svc *gatewayService, k *gatewayKey, status int, period string) {
-	_, _ = db.ExecContext(ctx, `
-		INSERT INTO usage_counters (api_key_id, service_id, period_month, request_count, updated_at)
-		VALUES ($1, $2, $3, 1, NOW())
-		ON CONFLICT (api_key_id, service_id, period_month)
-		DO UPDATE SET request_count = usage_counters.request_count + 1, updated_at = NOW()
-	`, k.ID, svc.ID, period)
-	_, _ = db.ExecContext(ctx, `
-		UPDATE api_keys SET last_used_at = NOW() WHERE id = $1
-	`, k.ID)
-	labels, _ := json.Marshal(map[string]interface{}{
-		"service_id": svc.ID,
-		"key_id":     k.ID,
-		"status":     status,
-	})
-	_, _ = db.ExecContext(ctx, `
-		INSERT INTO metrics_timeseries (metric, value, labels_json, occurred_at)
-		VALUES ('gateway_request', 1, $1, NOW())
-	`, string(labels))
-}
-
-func recordGatewayIncident(ctx context.Context, db *database.DB, svcID string, keyID *string, code, msg, severity string, status int) {
-	var kid interface{}
-	if keyID != nil {
-		kid = *keyID
-	}
-	_, _ = db.ExecContext(ctx, `
-		INSERT INTO incident_events (service_id, api_key_id, code, message, severity, http_status, occurred_at)
-		VALUES ($1, $2, $3, $4, $5, $6, NOW())
-	`, svcID, kid, code, msg, severity, status)
-}
-
-// handleGatewayProxy is mounted at /g/:slug and /g/:slug/*path on the root
-// router — outside /api/v1 so route_prefix stays clean.
-func handleGatewayProxy(c *gin.Context) {
-	db := c.MustGet("db").(*database.DB)
-	ctx := c.Request.Context()
-	slug := c.Param("slug")
-
-	svc, err := lookupGatewayService(ctx, db, slug)
-	if err == sql.ErrNoRows {
-		respondError(c, http.StatusNotFound, "SERVICE_NOT_FOUND", "Gateway service not found")
-		return
-	}
-	if err != nil {
-		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to resolve gateway service")
-		return
-	}
-	if !svc.Enabled {
-		respondError(c, http.StatusServiceUnavailable, "SERVICE_DISABLED", "Gateway service is disabled")
-		return
-	}
-
-	presented := extractGatewayKey(c)
-	if presented == "" {
-		recordGatewayIncident(ctx, db, svc.ID, nil, "MISSING_API_KEY", "Request without API key", "low", http.StatusUnauthorized)
-		respondError(c, http.StatusUnauthorized, "API_KEY_REQUIRED", "An API key is required for this service")
-		return
-	}
-	key, err := authenticateGatewayKey(ctx, db, presented)
-	if err != nil {
-		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to authenticate API key")
-		return
-	}
-	// Disabled and unknown keys collapse to the same 401 — a disabled key
-	// must not leak its existence.
-	if key == nil || !key.Enabled {
-		recordGatewayIncident(ctx, db, svc.ID, nil, "INVALID_API_KEY", "Request with invalid or disabled API key", "low", http.StatusUnauthorized)
-		respondError(c, http.StatusUnauthorized, "INVALID_API_KEY", "Invalid API key")
-		return
-	}
-	if !keyAllowsService(key, svc.ID) {
-		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "KEY_SCOPE_DENIED", "API key not allowed on this service", "medium", http.StatusForbidden)
-		respondError(c, http.StatusForbidden, "KEY_SCOPE_DENIED", "API key is not permitted for this service")
-		return
-	}
-
-	now := time.Now()
-	if !gatewayRateAllow("key:"+key.ID, int(key.RPMLimit.Int64), now) ||
-		!gatewayRateAllow("svc:"+svc.ID, int(svc.RPMLimit.Int64), now) {
-		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "RATE_LIMITED", "Per-minute rate limit exceeded", "medium", http.StatusTooManyRequests)
-		respondError(c, http.StatusTooManyRequests, "RATE_LIMITED", "Rate limit exceeded")
-		return
-	}
-
-	period := now.Format("2006-01")
-	if key.MonthlyQuota.Valid && key.MonthlyQuota.Int64 > 0 {
-		if used, err := monthlyUsage(ctx, db, "api_key_id", key.ID, period); err == nil && int64(used) >= key.MonthlyQuota.Int64 {
-			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Monthly request quota exceeded")
-			return
-		}
-	}
-	if svc.MonthlyQuota.Valid && svc.MonthlyQuota.Int64 > 0 {
-		if used, err := monthlyUsage(ctx, db, "service_id", svc.ID, period); err == nil && int64(used) >= svc.MonthlyQuota.Int64 {
-			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Service monthly quota exceeded")
-			return
-		}
-	}
-
-	target, err := gateway.BuildTargetURL(svc.UpstreamURL, svc.RoutePrefix, c.Request.URL.Path, c.Request.URL.RawQuery)
-	if err != nil {
-		respondError(c, http.StatusBadGateway, "UPSTREAM_URL_INVALID", "Gateway upstream is misconfigured")
-		return
-	}
-	headers := map[string]string{}
-	if svc.UpstreamAuthHeader.Valid && svc.UpstreamAuthHeader.String != "" {
-		headers[svc.UpstreamAuthHeader.String] = svc.UpstreamAuthValue.String
-	}
-
-	timeout := time.Duration(svc.RequestTimeoutMS) * time.Millisecond
-	if timeout <= 0 {
-		timeout = 8 * time.Second
-	}
-	reqCtx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	status, _, err := gateway.ProxyRequest(gatewayHTTPClient, c.Writer, c.Request.WithContext(reqCtx), target, headers)
-	if err != nil {
-		recordGatewayIncident(reqCtx, db, svc.ID, &key.ID, "UPSTREAM_ERROR", err.Error(), "high", http.StatusBadGateway)
-		recordGatewayRequest(ctx, db, svc, key, http.StatusBadGateway, period)
-		respondError(c, http.StatusBadGateway, "UPSTREAM_ERROR", "Upstream request failed")
-		return
-	}
-
-	recordGatewayRequest(ctx, db, svc, key, status, period)
-	if status >= 500 {
-		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "UPSTREAM_5XX", "Upstream returned "+http.StatusText(status), "high", status)
-	}
-}

app/backend/internal/api/gateway_proxy_test.go

@@ -1,81 +0,0 @@
-package api
-
-import (
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/gin-gonic/gin"
-)
-
-func TestGatewayRateAllow(t *testing.T) {
-	now := time.Date(2026, 10, 15, 12, 0, 30, 0, time.UTC)
-
-	for i := 0; i < 3; i++ {
-		if !gatewayRateAllow("test:a", 3, now) {
-			t.Fatalf("call %d within limit rejected", i+1)
-		}
-	}
-	if gatewayRateAllow("test:a", 3, now) {
-		t.Fatal("call beyond limit allowed")
-	}
-	if !gatewayRateAllow("test:a", 3, now.Add(time.Minute)) {
-		t.Fatal("new minute window still rejected")
-	}
-	if !gatewayRateAllow("test:unlimited", 0, now) {
-		t.Fatal("non-positive limit should disable the check")
-	}
-}
-
-func TestExtractGatewayKey(t *testing.T) {
-	mkctx := func(headers map[string]string) *gin.Context {
-		c, _ := gin.CreateTestContext(httptest.NewRecorder())
-		c.Request = httptest.NewRequest("GET", "/g/x", nil)
-		for k, v := range headers {
-			c.Request.Header.Set(k, v)
-		}
-		return c
-	}
-
-	if got := extractGatewayKey(mkctx(map[string]string{"X-API-Key": "ap_abc"})); got != "ap_abc" {
-		t.Fatalf("X-API-Key not extracted: %q", got)
-	}
-	if got := extractGatewayKey(mkctx(map[string]string{"Authorization": "Bearer ap_def"})); got != "ap_def" {
-		t.Fatalf("Bearer not extracted: %q", got)
-	}
-	// X-API-Key wins when both are present.
-	if got := extractGatewayKey(mkctx(map[string]string{
-		"X-API-Key":     "ap_first",
-		"Authorization": "Bearer ap_second",
-	})); got != "ap_first" {
-		t.Fatalf("X-API-Key should take precedence: %q", got)
-	}
-	if got := extractGatewayKey(mkctx(map[string]string{})); got != "" {
-		t.Fatalf("expected empty key, got %q", got)
-	}
-}
-
-func TestKeyAllowsService(t *testing.T) {
-	svcID := "11111111-2222-3333-4444-555555555555"
-	other := "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
-
-	cases := []struct {
-		name    string
-		allowed string
-		want    bool
-	}{
-		{"empty list permits all", "[]", true},
-		{"blank permits all", "", true},
-		{"invalid json permits all", "not-json", true},
-		{"listed service allowed", `["` + svcID + `"]`, true},
-		{"unlisted service denied", `["` + other + `"]`, false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			k := &gatewayKey{AllowedServiceIDs: tc.allowed}
-			if got := keyAllowsService(k, svcID); got != tc.want {
-				t.Fatalf("keyAllowsService(%q) = %v, want %v", tc.allowed, got, tc.want)
-			}
-		})
-	}
-}

app/backend/internal/api/gitcreds.go

@@ -1,84 +0,0 @@
-package api
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"containr/internal/database"
-	"containr/internal/source"
-)
-
-// resolveGitCloneSpec turns a service's git_repo (clone URL, ssh remote, or
-// owner/repo) into a source.Spec with the project owner's provider token.
-// Public repos get no token — the clone proceeds anonymously. github_app
-// providers store the installation id, not a usable token; a fresh
-// installation token is minted per deploy.
-func resolveGitCloneSpec(db *database.DB, ownerID, gitRepo, branch, commit, buildPath string) (source.Spec, error) {
-	raw := strings.TrimSpace(gitRepo)
-	cloneURL, err := source.NormalizeCloneURL(raw)
-	if err != nil {
-		return source.Spec{}, err
-	}
-
-	spec := source.Spec{Branch: branch, Commit: commit, BuildPath: buildPath}
-
-	var providerID string
-	if !strings.Contains(cloneURL, "://") {
-		// Bare owner/repo — the connected repository row knows the host.
-		err = db.QueryRow(
-			`SELECT clone_url, provider_id FROM git_repositories
-			 WHERE full_name = $1 AND user_id = $2 LIMIT 1`,
-			cloneURL, ownerID,
-		).Scan(&cloneURL, &providerID)
-		if err != nil {
-			return source.Spec{}, fmt.Errorf("repository %s is not connected — connect it under Git settings or store a clone URL", raw)
-		}
-	} else {
-		// URL form — match a connected repo for its provider when possible;
-		// an unmatched public URL still clones, just without credentials.
-		_ = db.QueryRow(
-			`SELECT provider_id FROM git_repositories
-			 WHERE clone_url = $1 AND user_id = $2 LIMIT 1`,
-			cloneURL, ownerID,
-		).Scan(&providerID)
-	}
-
-	if err := source.ValidateRemoteURL(cloneURL); err != nil {
-		return source.Spec{}, err
-	}
-	spec.CloneURL = cloneURL
-
-	if providerID == "" {
-		return spec, nil
-	}
-	var name, apiURL, token string
-	if err := db.QueryRow(
-		`SELECT name, api_url, access_token FROM git_providers
-		 WHERE id = $1 AND user_id = $2`,
-		providerID, ownerID,
-	).Scan(&name, &apiURL, &token); err != nil {
-		return spec, nil // provider row gone — anonymous clone still works for public repos
-	}
-
-	switch strings.ToLower(name) {
-	case "github_app":
-		installationID, err := strconv.ParseInt(strings.TrimSpace(token), 10, 64)
-		if err == nil && installationID > 0 {
-			if minted, err := getGitHubAppInstallationToken(apiURL, installationID); err == nil {
-				spec.Token = minted
-				spec.User = "x-access-token"
-			}
-		}
-	case "gitlab":
-		spec.Token = token
-		spec.User = "oauth2"
-	case "bitbucket":
-		spec.Token = token
-		spec.User = "x-token-auth"
-	default:
-		spec.Token = token
-		spec.User = "x-access-token"
-	}
-	return spec, nil
-}

app/backend/internal/api/ingress.go

@@ -1,212 +0,0 @@
-package api
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"containr/internal/database"
-	"containr/internal/database/sqlcdb"
-	"containr/internal/deployment"
-)
-
-// Remote ingress: replicas on node agents aren't on the hub's
-// containr-network, so Traefik's Docker provider can't see them. Instead
-// the backend renders one file-provider config per service into
-// TRAEFIK_DYNAMIC_DIR (a directory Traefik watches), pointing the
-// loadbalancer at the node's reachable IP + the ephemeral host port the
-// agent reported back after `create_container`.
-//
-// Empty dir → feature off (bare-metal dev). Files are best-effort: a
-// failed write never fails a reconcile.
-
-func ingressDir() string { return os.Getenv("TRAEFIK_DYNAMIC_DIR") }
-
-func ingressFile(serviceID string) string {
-	return filepath.Join(ingressDir(), "containr-"+serviceID+".yml")
-}
-
-// jsonInt coerces JSON-ish numbers (int/int32/int64/float64) to int —
-// spec fields arrive as int32, agent payloads unmarshal as float64.
-func jsonInt(v interface{}) int {
-	switch n := v.(type) {
-	case int:
-		return n
-	case int32:
-		return int(n)
-	case int64:
-		return int(n)
-	case float64:
-		return int(n)
-	}
-	return 0
-}
-
-// reportedHostPorts parses the agent's create_container result —
-// {"name": ..., "host_ports": {"80/tcp": "32768"}}. Older agents return a
-// bare name string; JSON parse failure means no port info.
-func reportedHostPorts(result string) map[string]string {
-	var out struct {
-		HostPorts map[string]string `json:"host_ports"`
-	}
-	if json.Unmarshal([]byte(result), &out) != nil {
-		return nil
-	}
-	return out.HostPorts
-}
-
-// nodeIngressIP picks the address the hub can reach the node on. Mesh
-// overlays first — the agent operator joined a mesh precisely so the hub
-// can reach it — then the reported primary IP as a LAN fallback.
-func nodeIngressIP(agent sqlcdb.NodeAgent) string {
-	var meta struct {
-		Mesh map[string]string `json:"mesh"`
-	}
-	_ = json.Unmarshal(agent.Metadata.RawMessage, &meta)
-	for _, prefix := range []string{"tailscale", "netbird", "wg", "zt"} {
-		var keys []string
-		for name := range meta.Mesh {
-			keys = append(keys, name)
-		}
-		sort.Strings(keys)
-		for _, name := range keys {
-			if strings.HasPrefix(name, prefix) && meta.Mesh[name] != "" {
-				return meta.Mesh[name]
-			}
-		}
-	}
-	return agent.IpAddress
-}
-
-// syncRemoteIngress rewrites the service's file-provider config from the
-// live remote replica set. Called after every remote reconcile so replica
-// adds/removals and node retargets converge the upstream list.
-func syncRemoteIngress(ctx context.Context, db *database.DB, spec deployment.RuntimeSpec) {
-	if ingressDir() == "" {
-		return
-	}
-	domains := spec.Domains
-	if len(domains) == 0 && spec.Domain != "" {
-		domains = []string{spec.Domain}
-	}
-	if len(domains) == 0 || spec.Port <= 0 {
-		removeServiceIngress(spec.ServiceID)
-		return
-	}
-
-	q := sqlcdb.New(db.DB)
-	rows, err := q.ListServiceContainers(ctx, spec.ServiceID)
-	if err != nil {
-		return
-	}
-	type upstream struct{ ip, port string }
-	var servers []upstream
-	for _, row := range rows {
-		var st struct {
-			State string `json:"state"`
-		}
-		_ = json.Unmarshal(row.Status.RawMessage, &st)
-		if st.State != "running" {
-			continue
-		}
-		var port string
-		var plist []map[string]interface{}
-		if err := json.Unmarshal(row.Ports.RawMessage, &plist); err == nil {
-			for _, p := range plist {
-				if hp, ok := p["host_port"].(float64); ok && hp > 0 {
-					port = fmt.Sprintf("%d", int(hp))
-				}
-			}
-		}
-		if port == "" {
-			continue
-		}
-		agent, err := q.GetAgent(ctx, row.NodeAgentID)
-		if err != nil {
-			continue
-		}
-		if ip := nodeIngressIP(agent); ip != "" {
-			servers = append(servers, upstream{ip, port})
-		}
-	}
-	if len(servers) == 0 {
-		removeServiceIngress(spec.ServiceID)
-		return
-	}
-
-	router := "svc-" + spec.ServiceID[:8]
-	rules := make([]string, 0, len(domains))
-	for _, d := range domains {
-		rules = append(rules, "Host(`"+d+"`)")
-	}
-	var b strings.Builder
-	b.WriteString("http:\n  routers:\n    " + router + ":\n")
-	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
-	b.WriteString("      entrypoints: [web]\n")
-	b.WriteString("      service: " + router + "\n")
-	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
-	for _, s := range servers {
-		b.WriteString("          - url: \"http://" + s.ip + ":" + s.port + "\"\n")
-	}
-	// Atomic-ish: write temp then rename so Traefik's watcher never reads a
-	// truncated file.
-	tmp := ingressFile(spec.ServiceID) + ".tmp"
-	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
-		return
-	}
-	_ = os.Rename(tmp, ingressFile(spec.ServiceID))
-}
-
-// removeServiceIngress deletes the service's remote route. Called on
-// remote teardown and when a service returns to local placement.
-func removeServiceIngress(serviceID string) {
-	if ingressDir() == "" {
-		return
-	}
-	_ = os.Remove(ingressFile(serviceID))
-}
-
-// wakeUpstreamURL is where a sleeping remote service's route points —
-// the backend's wake-page endpoint. Defaults to the compose service name;
-// TRAEFIK_BACKEND_URL overrides for custom layouts.
-func wakeUpstreamURL(apiPort int) string {
-	if v := strings.TrimSpace(os.Getenv("TRAEFIK_BACKEND_URL")); v != "" {
-		return strings.TrimRight(v, "/")
-	}
-	return fmt.Sprintf("http://containr-backend:%d", apiPort)
-}
-
-// writeWakeIngress routes the service's domains at the wake-page endpoint —
-// first hit triggers the wake reconcile and serves a reloading page.
-func writeWakeIngress(serviceID string, domains []string, apiPort int) {
-	if ingressDir() == "" {
-		return
-	}
-	sort.Strings(domains)
-	router := "svc-" + serviceID[:8] + "-wake"
-	rules := make([]string, 0, len(domains))
-	for _, d := range domains {
-		rules = append(rules, "Host(`"+d+"`)")
-	}
-	var b strings.Builder
-	mw := router + "-rw"
-	b.WriteString("http:\n  routers:\n    " + router + ":\n")
-	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
-	b.WriteString("      entrypoints: [web]\n")
-	b.WriteString("      service: " + router + "\n")
-	b.WriteString("      priority: 100\n")
-	b.WriteString("      middlewares: [" + mw + "]\n")
-	b.WriteString("  middlewares:\n    " + mw + ":\n")
-	b.WriteString("      replacePath:\n        path: \"/api/v1/internal/wake-page/" + serviceID + "\"\n")
-	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
-	b.WriteString("          - url: \"" + wakeUpstreamURL(apiPort) + "\"\n")
-	tmp := ingressFile(serviceID) + ".tmp"
-	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
-		return
-	}
-	_ = os.Rename(tmp, ingressFile(serviceID))
-}

app/backend/internal/api/noderunner.go

@@ -19,8 +19,8 @@ import (
 
 // agentNodeRunner implements deployment.NodeRunner by dispatching container
 // lifecycle commands to a node agent's command queue and waiting for the
-// reported result. Domains route through the file provider —
-// syncRemoteIngress renders per-service configs from live inventory.
+// reported result. Remote nodes have no Traefik — domains stay local-only
+// until per-node ingress lands.
 type agentNodeRunner struct {
 	q  *sqlcdb.Queries
 	db *database.DB
@@ -131,6 +131,10 @@ func (r *agentNodeRunner) RemoteRuntimeState(ctx context.Context, serviceID stri
 // targetFor and retires stale replicas on any agent — including leftovers
 // from a previous pin or a different spread assignment.
 func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment.RuntimeSpec, targetFor func(replica int) string) (*deployment.RuntimeState, error) {
+	if len(spec.Domains) > 0 || spec.Domain != "" {
+		return nil, fmt.Errorf("domains are routed by the local Traefik — remove the service's domains or run it on the local node")
+	}
+
 	replicas := spec.Replicas
 	if replicas < 1 {
 		replicas = 1
@@ -147,7 +151,7 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 		if keep {
 			continue
 		}
-		if _, cmdErr := r.enqueueAndWait(ctx, row.NodeAgentID, "", "remove_container",
+		if cmdErr := r.enqueueAndWait(ctx, row.NodeAgentID, "", "remove_container",
 			map[string]interface{}{"container_name": row.Name}); cmdErr != nil {
 			return nil, fmt.Errorf("remove stale replica %s on node %s: %w", row.Name, row.NodeAgentID, cmdErr)
 		}
@@ -157,45 +161,6 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 		})
 	}
 
-	// Ship the image to every distinct target agent before replicas start.
-	// RemoteBuild nodes docker-build from the packaged context artifact;
-	// RemoteLoad nodes docker-load a saved tarball (local-tag rollbacks).
-	// Registry-pullable images skip this — docker run pulls on demand.
-	if spec.RemoteBuild != nil || spec.RemoteLoad != nil {
-		seen := map[string]bool{}
-		for i := 0; i < replicas; i++ {
-			agentID := targetFor(i)
-			if seen[agentID] {
-				continue
-			}
-			seen[agentID] = true
-			if spec.RemoteBuild != nil {
-				buildArgs := map[string]interface{}{}
-				for k, v := range spec.RemoteBuild.BuildArgs {
-					buildArgs[k] = v
-				}
-				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "build_image",
-					map[string]interface{}{
-						"artifact_id": spec.RemoteBuild.ArtifactID,
-						"image":       spec.Image,
-						"build_args":  buildArgs,
-						"no_cache":    spec.RemoteBuild.NoCache,
-					}, 25*time.Minute)
-				if err != nil {
-					return nil, fmt.Errorf("build image on node %s: %w", agentID, err)
-				}
-			} else if spec.RemoteLoad != nil {
-				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "load_image",
-					map[string]interface{}{
-						"artifact_id": spec.RemoteLoad.ArtifactID,
-					}, 10*time.Minute)
-				if err != nil {
-					return nil, fmt.Errorf("load image on node %s: %w", agentID, err)
-				}
-			}
-		}
-	}
-
 	state := &deployment.RuntimeState{Desired: replicas, Status: "running"}
 	for i := 0; i < replicas; i++ {
 		agentID := targetFor(i)
@@ -220,41 +185,18 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 			HealthCheck:   rawJSON(map[string]interface{}{"path": spec.HealthPath}),
 		})
 
-		result, err := r.enqueueAndWait(ctx, agentID, containerID, "create_container",
-			map[string]interface{}{"container": container})
-		if err != nil {
+		if err := r.enqueueAndWait(ctx, agentID, containerID, "create_container",
+			map[string]interface{}{"container": container}); err != nil {
 			return nil, fmt.Errorf("replica %d on node %s: %w", i, agentID, err)
 		}
-		if assigned := reportedHostPorts(result); len(assigned) > 0 {
-			for _, p := range ports {
-				pm, ok := p.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				cport := jsonInt(pm["container_port"])
-				proto, _ := pm["protocol"].(string)
-				if hp, ok := assigned[fmt.Sprintf("%d/%s", cport, proto)]; ok {
-					if n, err := strconv.Atoi(hp); err == nil {
-						pm["host_port"] = n
-					}
-				}
-			}
-			_ = r.q.UpdateContainerPorts(ctx, sqlcdb.UpdateContainerPortsParams{
-				ID:     containerID,
-				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
-				Ports:  rawJSON(ports),
-			})
-		} else {
-			_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
-				ID:     containerID,
-				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
-			})
-		}
+		_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
+			ID:     containerID,
+			Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
+		})
 		state.Containers = append(state.Containers, deployment.RuntimeContainer{
 			ID: containerID, Name: name, State: "running", Replica: i,
 		})
 	}
-	syncRemoteIngress(ctx, r.db, spec)
 	return state, nil
 }
 
@@ -354,17 +296,7 @@ func (r *agentNodeRunner) ControlService(ctx context.Context, serviceID, agentID
 		if row.ServiceID != serviceID {
 			continue
 		}
-		// Tombstoned replicas are already gone remotely — skip the dispatch
-		// or a fresh docker rm on a missing name reports a false failure.
-		if action == "remove" {
-			var st struct {
-				State string `json:"state"`
-			}
-			if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil && st.State == "removed" {
-				continue
-			}
-		}
-		if _, err := r.enqueueAndWait(ctx, agentID, row.ID, cmdType,
+		if err := r.enqueueAndWait(ctx, agentID, row.ID, cmdType,
 			map[string]interface{}{"container_name": row.Name}); err != nil {
 			return fmt.Errorf("%s %s on node: %w", action, row.Name, err)
 		}
@@ -382,42 +314,16 @@ func (r *agentNodeRunner) RemoveService(ctx context.Context, serviceID, agentID
 	if err := r.ControlService(ctx, serviceID, agentID, "remove"); err != nil {
 		return err
 	}
-	if err := r.q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
+	return r.q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
 		NodeAgentID: agentID,
 		ServiceID:   serviceID,
-	}); err != nil {
-		return err
-	}
-	removeServiceIngress(serviceID)
-	return nil
-}
-
-// RetireService removes the service's remote replicas wherever they run —
-// called when the service converges to local placement so a cleared pin or
-// removed tag requirement doesn't leave containers behind.
-func (r *agentNodeRunner) RetireService(ctx context.Context, serviceID string) error {
-	agentIDs, err := r.q.ListServiceAgents(ctx, serviceID)
-	if err != nil {
-		return err
-	}
-	for _, agentID := range agentIDs {
-		if err := r.RemoveService(ctx, serviceID, agentID); err != nil {
-			return fmt.Errorf("retire on node %s: %w", agentID, err)
-		}
-	}
-	removeServiceIngress(serviceID)
-	return nil
+	})
 }
 
 // enqueueAndWait pushes a command to the agent's queue and polls for the
-// reported result, returning the agent's result string on success. Agents
-// poll on their own interval (≥5s), so this blocks — it runs inside the
-// deploy queue worker, never on a request path.
-func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}) (string, error) {
-	return r.enqueueAndWaitTimeout(ctx, agentID, containerID, cmdType, payload, 8*time.Minute)
-}
-
-func (r *agentNodeRunner) enqueueAndWaitTimeout(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}, timeout time.Duration) (string, error) {
+// reported result. Agents poll on their own interval (≥5s), so this blocks —
+// it runs inside the deploy queue worker, never on a request path.
+func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}) error {
 	var cid sql.NullString
 	if containerID != "" {
 		cid = sql.NullString{String: containerID, Valid: true}
@@ -430,10 +336,10 @@ func (r *agentNodeRunner) enqueueAndWaitTimeout(ctx context.Context, agentID, co
 		Payload:     rawJSON(payload),
 	})
 	if err != nil {
-		return "", err
+		return err
 	}
 
-	deadline := time.Now().Add(timeout) // image pulls/builds on a cold node
+	deadline := time.Now().Add(8 * time.Minute) // image pulls on a cold node
 	for {
 		row, err := r.q.GetCommandForAgent(ctx, sqlcdb.GetCommandForAgentParams{
 			ID:          cmd.ID,
@@ -442,20 +348,20 @@ func (r *agentNodeRunner) enqueueAndWaitTimeout(ctx context.Context, agentID, co
 		if err == nil {
 			switch row.Status.String {
 			case "completed":
-				return row.Result.String, nil
+				return nil
 			case "failed":
 				if row.Error.Valid && row.Error.String != "" {
-					return "", fmt.Errorf("agent: %s", row.Error.String)
+					return fmt.Errorf("agent: %s", row.Error.String)
 				}
-				return "", fmt.Errorf("agent reported failure")
+				return fmt.Errorf("agent reported failure")
 			}
 		}
 		if time.Now().After(deadline) {
-			return "", fmt.Errorf("command %s timed out waiting for the agent", cmdType)
+			return fmt.Errorf("command %s timed out waiting for the agent", cmdType)
 		}
 		select {
 		case <-ctx.Done():
-			return "", ctx.Err()
+			return ctx.Err()
 		case <-time.After(2 * time.Second):
 		}
 	}

app/backend/internal/api/routes.go

@@ -5,7 +5,6 @@ import (
 	"log"
 	"net/http"
 	"os"
-	"path/filepath"
 	"time"
 
 	"containr/internal/build"
@@ -44,8 +43,6 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		dockerClient = client
 		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
 		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
-		initArtifacts(filepath.Join("/tmp/containr-builds", "artifacts"))
-		purgeStaleArtifacts()
 		// Node-pinned services dispatch container lifecycle to the agent's
 		// command queue instead of the local Docker socket.
 		deploymentEngine.SetNodeRunner(newAgentNodeRunner(db))
@@ -269,12 +266,6 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	// endpoint, verified against the provisioned webhook secret.
 	router.POST("/api/git/github-app/webhook", handleGitHubAppWebhook)
 
-	// Public API gateway data plane. Lives outside /api/v1 so each service's
-	// route_prefix (/g/<slug>) maps cleanly; auth is the caller's api_key,
-	// not a session.
-	router.Any("/g/:slug", handleGatewayProxy)
-	router.Any("/g/:slug/*path", handleGatewayProxy)
-
 	v1 := router.Group("/api/v1")
 	{
 		// Public routes (no authentication required)
@@ -294,7 +285,6 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			// Wake callback for sleep-mode placeholders. Unauthenticated but
 			// non-destructive: it only reconciles the service back to running.
 			public.Any("/internal/wake/:id", handleServiceWake)
-			public.Any("/internal/wake-page/:id", handleServiceWakePage)
 		}
 
 		// Read routes — public browsing. OptionalAuth resolves a session when
@@ -493,7 +483,6 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/templates/:id/deploy", handleCreateFromTemplate)
 			authed.POST("/templates/:id/plan", handlePlanTemplate)
 			authed.POST("/templates/import/compose", handleImportCompose)
-			authed.POST("/templates/import/git", handleImportGitCompose)
 			authed.POST("/templates/deploy", handleDeployInlineGraph)
 
 			authed.POST("/cron-jobs", handleCreateCronJob)

app/backend/internal/api/runtime.go

@@ -121,7 +121,6 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 	spec.Volumes = loadServiceVolumes(db, service.ID)
 	spec.Domains = serviceDomainNames(db, service.ID, service.Domain)
 	spec.Maintenance, spec.BasicAuthUsers = serviceAccess(db, service.ID)
-	spec.TraefikLabels = serviceTraefikLabels(db, service.ID)
 	if spec.Maintenance {
 		spec.MaintenanceURL = maintenanceURL(db)
 	}
@@ -659,8 +658,6 @@ func liveServiceStatus(c *gin.Context, db *database.DB, service *Service) {
 	persistPublishedPort(db, service.ID, state.Ports)
 	if service.Domain != "" {
 		service.PublicURL = "https://" + service.Domain
-	} else if auto := serviceAutoDomains(db, service.ID); len(auto) > 0 {
-		service.PublicURL = "https://" + auto[0]
 	} else if len(state.URLs) > 0 {
 		service.PublicURL = rewriteLoopbackURL(state.URLs[0], requestHostname(c))
 	}

app/backend/internal/api/services.go

@@ -9,7 +9,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"regexp"
 	"strings"
 	"time"
 
@@ -59,12 +58,9 @@ type Service struct {
 	Spread bool `json:"spread" db:"-"`
 	// PlacementTags restrict auto/spread candidates to agents carrying all
 	// listed tags. An explicit pin overrides them — pin + tags is rejected.
-	PlacementTags []string `json:"placement_tags,omitempty" db:"-"`
-	// TraefikLabels holds per-service middleware overrides —
-	// "middlewares.<name>.<type>.<field>" → value. Lazy-read.
-	TraefikLabels map[string]string `json:"traefik_labels,omitempty" db:"-"`
-	CreatedAt     time.Time         `json:"created_at" db:"created_at"`
-	UpdatedAt     time.Time         `json:"updated_at" db:"updated_at"`
+	PlacementTags []string  `json:"placement_tags,omitempty" db:"-"`
+	CreatedAt     time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at" db:"updated_at"`
 }
 
 // loadServiceSleep fills the sleep-mode columns, which live outside the
@@ -127,78 +123,6 @@ func normalizePlacementTags(tags []string) []string {
 	return out
 }
 
-// traefikLabelKey matches "middlewares.<name>.<type>" with an optional
-// ".<subkey>" tail — e.g. "middlewares.rl.ratelimit.average".
-var traefikLabelKey = regexp.MustCompile(`^middlewares\.([A-Za-z0-9][A-Za-z0-9_-]{0,39})\.([A-Za-z]+)(\.[A-Za-z0-9_.*+-]+)?$`)
-
-// traefikMiddlewareTypes are the Traefik middleware kinds a service may
-// define. Router/service/provider-level keys are never accepted — those
-// would let a tenant hijack someone else's routing.
-var traefikMiddlewareTypes = map[string]bool{
-	"addprefix": true, "basicauth": true, "buffering": true, "chain": true,
-	"circuitbreaker": true, "compress": true, "digestauth": true,
-	"errors": true, "forwardauth": true, "grpcweb": true, "headers": true,
-	"inflightreq": true, "ipallowlist": true, "ipwhitelist": true,
-	"passtlsclientcert": true, "ratelimit": true, "redirectregex": true,
-	"redirectscheme": true, "replacepath": true, "replacepathregex": true,
-	"retry": true, "stripprefix": true, "stripprefixregex": true,
-}
-
-// normalizeTraefikLabels validates a raw override map. Returns the cleaned
-// map (middleware type lowercased — Traefik label keys are canonical-lower)
-// or an error naming the offending key.
-func normalizeTraefikLabels(raw map[string]string) (map[string]string, error) {
-	if len(raw) > 32 {
-		return nil, fmt.Errorf("traefik_labels: at most 32 entries (got %d)", len(raw))
-	}
-	out := make(map[string]string, len(raw))
-	names := map[string]bool{}
-	for k, v := range raw {
-		m := traefikLabelKey.FindStringSubmatch(k)
-		if m == nil {
-			return nil, fmt.Errorf("traefik_labels: invalid key %q — want middlewares.<name>.<type>[.<field>]", k)
-		}
-		mwType := strings.ToLower(m[2])
-		if !traefikMiddlewareTypes[mwType] {
-			return nil, fmt.Errorf("traefik_labels: unsupported middleware type %q", m[2])
-		}
-		if len(v) == 0 {
-			return nil, fmt.Errorf("traefik_labels: %q has an empty value", k)
-		}
-		if len(v) > 512 || strings.ContainsAny(v, "\r\n") {
-			return nil, fmt.Errorf("traefik_labels: %q value must be a single line under 512 chars", k)
-		}
-		out["middlewares."+m[1]+"."+mwType+m[3]] = v
-		names[m[1]] = true
-	}
-	if len(names) > 16 {
-		return nil, fmt.Errorf("traefik_labels: at most 16 middleware names")
-	}
-	return out, nil
-}
-
-// serviceTraefikLabels lazy-reads the traefik_labels column.
-func serviceTraefikLabels(db *database.DB, serviceID uuid.UUID) map[string]string {
-	var raw []byte
-	if err := db.QueryRow(`SELECT traefik_labels FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
-		return nil
-	}
-	var labels map[string]string
-	if err := json.Unmarshal(raw, &labels); err != nil || len(labels) == 0 {
-		return nil
-	}
-	return labels
-}
-
-// traefikLabelsJSON marshals an override map for the jsonb column.
-func traefikLabelsJSON(labels map[string]string) []byte {
-	if len(labels) == 0 {
-		return []byte("{}")
-	}
-	raw, _ := json.Marshal(labels)
-	return raw
-}
-
 // tagsJSON marshals a tag list for a jsonb column; empty stays an array, not null.
 func tagsJSON(tags []string) []byte {
 	if len(tags) == 0 {
@@ -215,7 +139,6 @@ func loadServiceNode(db *database.DB, s *Service) {
 	s.NodeID = serviceNodeID(db, s.ID)
 	s.Spread = serviceSpread(db, s.ID)
 	s.PlacementTags = servicePlacementTags(db, s.ID)
-	s.TraefikLabels = serviceTraefikLabels(db, s.ID)
 	if s.NodeID == "" {
 		return
 	}
@@ -301,10 +224,6 @@ type CreateServiceRequest struct {
 	MemoryReserve   string          `json:"memory_reserve"`
 	StaticBuildCmd  string          `json:"static_build_cmd"`
 	StaticDir       string          `json:"static_dir"`
-	// SleepEnabled/SleepIdleMinutes opt the service into scale-to-zero at
-	// create time — previously update-only, which surprised API/CLI users.
-	SleepEnabled     *bool `json:"sleep_enabled"`
-	SleepIdleMinutes *int  `json:"sleep_idle_minutes"`
 	// NodeID pins placement to a node agent; "auto" picks the least-loaded
 	// online agent, "local"/"" runs on the Containr host.
 	NodeID string `json:"node_id"`
@@ -314,10 +233,6 @@ type CreateServiceRequest struct {
 	// PlacementTags restrict auto/spread candidates to agents carrying all
 	// listed tags. Mutually exclusive with an explicit node pin.
 	PlacementTags []string `json:"placement_tags"`
-	// TraefikLabels defines extra Traefik middlewares for this service's
-	// router — keys "middlewares.<name>.<type>[.<field>]", validated against
-	// an allowlist. Defined middlewares attach to the router automatically.
-	TraefikLabels map[string]string `json:"traefik_labels"`
 }
 
 // UpdateServiceRequest represents a request to update a service
@@ -356,9 +271,6 @@ type UpdateServiceRequest struct {
 	// listed tags; pointer so [] clears the requirement. Mutually exclusive
 	// with an explicit node pin.
 	PlacementTags *[]string `json:"placement_tags"`
-	// TraefikLabels replaces the service's middleware overrides; pointer so
-	// {} clears them and nil leaves them untouched.
-	TraefikLabels *map[string]string `json:"traefik_labels"`
 }
 
 // handleGetServices retrieves all services for a project
@@ -562,14 +474,6 @@ func handleCreateService(c *gin.Context) {
 	if service.Builder == "static" && service.StaticDir == "" {
 		service.StaticDir = "dist"
 	}
-	if len(req.TraefikLabels) > 0 {
-		labels, err := normalizeTraefikLabels(req.TraefikLabels)
-		if err != nil {
-			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
-			return
-		}
-		service.TraefikLabels = labels
-	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -607,16 +511,6 @@ func handleCreateService(c *gin.Context) {
 
 	sourceType := inferServiceSourceType(service)
 
-	if req.SleepEnabled != nil {
-		service.SleepEnabled = *req.SleepEnabled
-	}
-	if req.SleepIdleMinutes != nil {
-		if *req.SleepIdleMinutes < 1 || *req.SleepIdleMinutes > 1440 {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "sleep_idle_minutes must be 1-1440", "code": "VALIDATION"})
-			return
-		}
-		service.SleepIdleMinutes = *req.SleepIdleMinutes
-	}
 	if req.Spread != nil {
 		service.Spread = *req.Spread
 	}
@@ -648,10 +542,9 @@ func handleCreateService(c *gin.Context) {
 				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
 				 healthcheck_path, restart_policy, volumes,
 				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 node_id, spread, placement_tags, sleep_enabled, sleep_idle_minutes,
-				 traefik_labels, created_at, updated_at)
+				 node_id, spread, placement_tags, created_at, updated_at)
 			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26,
-					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39)`,
+					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36)`,
 		service.ID, service.ProjectID, service.Name, environmentID, service.Type,
 		sourceType, firstNonEmpty(service.GitRepo, service.Image), service.Image,
 		"", service.Command, service.Type, service.Status, service.Image, service.Command,
@@ -662,9 +555,6 @@ func handleCreateService(c *gin.Context) {
 		sql.NullString{String: service.NodeID, Valid: service.NodeID != ""},
 		service.Spread,
 		tagsJSON(service.PlacementTags),
-		service.SleepEnabled,
-		sql.NullInt32{Int32: int32(service.SleepIdleMinutes), Valid: service.SleepIdleMinutes > 0},
-		traefikLabelsJSON(service.TraefikLabels),
 		service.CreatedAt, service.UpdatedAt,
 	)
 
@@ -941,16 +831,6 @@ func handleUpdateService(c *gin.Context) {
 		}
 		existingService.SleepIdleMinutes = *req.SleepIdleMinutes
 	}
-	if req.TraefikLabels != nil {
-		labels, err := normalizeTraefikLabels(*req.TraefikLabels)
-		if err != nil {
-			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
-			return
-		}
-		existingService.TraefikLabels = labels
-	} else {
-		existingService.TraefikLabels = serviceTraefikLabels(db.(*database.DB), serviceID)
-	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -1027,7 +907,7 @@ func handleUpdateService(c *gin.Context) {
 				builder = $19, cpu_reserve = $20, memory_reserve = $21,
 				static_build_cmd = $22, static_dir = $23,
 				sleep_enabled = $24, sleep_idle_minutes = $25, node_id = $26, spread = $27,
-				placement_tags = $28::jsonb, traefik_labels = $29::jsonb
+				placement_tags = $28::jsonb
 			WHERE id = $18`,
 		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
 		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
@@ -1041,7 +921,6 @@ func handleUpdateService(c *gin.Context) {
 		sql.NullString{String: existingService.NodeID, Valid: existingService.NodeID != ""},
 		existingService.Spread,
 		tagsJSON(existingService.PlacementTags),
-		traefikLabelsJSON(existingService.TraefikLabels),
 	)
 
 	if err != nil {

app/backend/internal/api/services_routing_test.go

@@ -1,64 +0,0 @@
-package api
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestNormalizeTraefikLabels(t *testing.T) {
-	valid := map[string]string{
-		"middlewares.rl.ratelimit.average":                             "100",
-		"middlewares.rl.ratelimit.period":                              "1m",
-		"middlewares.sec.headers.customrequestheaders.X-Frame-Options": "DENY",
-		"middlewares.gzip.compress":                                    "true",
-	}
-	out, err := normalizeTraefikLabels(valid)
-	if err != nil {
-		t.Fatalf("valid labels rejected: %v", err)
-	}
-	if len(out) != len(valid) {
-		t.Fatalf("expected %d labels, got %d", len(valid), len(out))
-	}
-	if out["middlewares.gzip.compress"] != "true" {
-		t.Fatalf("flag-style middleware missing: %v", out)
-	}
-}
-
-func TestNormalizeTraefikLabelsLowercasesType(t *testing.T) {
-	out, err := normalizeTraefikLabels(map[string]string{
-		"middlewares.rl.RateLimit.average": "10",
-	})
-	if err != nil {
-		t.Fatalf("mixed-case type rejected: %v", err)
-	}
-	if out["middlewares.rl.ratelimit.average"] != "10" {
-		t.Fatalf("type not lowercased: %v", out)
-	}
-}
-
-func TestNormalizeTraefikLabelsRejects(t *testing.T) {
-	cases := map[string]string{
-		"traefik.enable":                                 "true", // provider-level
-		"middlewares..ratelimit.average":                 "1",    // empty name
-		"middlewares.x.evilinject.thing":                 "1",    // unknown type
-		"routers.svc.rule":                               "x",    // router hijack
-		"middlewares.x.ratelimit.average.bad\ninjection": "1",    // control char in key fails regex
-	}
-	for k, v := range cases {
-		if _, err := normalizeTraefikLabels(map[string]string{k: v}); err == nil {
-			t.Fatalf("key %q should have been rejected", k)
-		}
-	}
-}
-
-func TestNormalizeTraefikLabelsRejectsBadValues(t *testing.T) {
-	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": ""}); err == nil {
-		t.Fatal("empty value accepted")
-	}
-	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": strings.Repeat("x", 600)}); err == nil {
-		t.Fatal("oversized value accepted")
-	}
-	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": "1\nmalicious"}); err == nil {
-		t.Fatal("newline value accepted")
-	}
-}

app/backend/internal/api/sleeper.go

@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"containr/internal/database"
-	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/docker"
 
@@ -101,20 +100,7 @@ func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engi
 	}
 	rows.Close()
 
-	q := sqlcdb.New(db.DB)
 	for _, svc := range candidates {
-		// Remote replicas live in inventory, not the local docker host —
-		// idleness comes from heartbeat-reported net counters instead.
-		if remote := remoteLiveContainers(ctx, q, svc.ID.String()); len(remote) > 0 {
-			var total uint64
-			for _, row := range remote {
-				total += rowNetBytes(row)
-			}
-			if markIdle(svc.ID, total, time.Duration(svc.IdleMinutes)*time.Minute) {
-				putToSleepRemote(ctx, db, q, svc, apiPort)
-			}
-			continue
-		}
 		containers, err := engine.ListServiceContainers(ctx, svc.ID.String())
 		if err != nil || len(containers) == 0 {
 			continue
@@ -139,65 +125,6 @@ func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engi
 	}
 }
 
-// remoteLiveContainers returns inventory rows whose replicas are alive on
-// node agents — the signal that idleness must be measured remotely.
-func remoteLiveContainers(ctx context.Context, q *sqlcdb.Queries, serviceID string) []sqlcdb.ListServiceContainersRow {
-	rows, err := q.ListServiceContainers(ctx, serviceID)
-	if err != nil {
-		return nil
-	}
-	live := rows[:0]
-	for _, row := range rows {
-		var st struct {
-			State string `json:"state"`
-		}
-		if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil &&
-			st.State != "" && st.State != "removed" && st.State != "sleeping" {
-			live = append(live, row)
-		}
-	}
-	return live
-}
-
-// rowNetBytes reads the cumulative rx+tx the agent reported at its last
-// heartbeat — 0 for rows written before the counter existed.
-func rowNetBytes(row sqlcdb.ListServiceContainersRow) uint64 {
-	var res struct {
-		NetBytes uint64 `json:"net_bytes"`
-	}
-	_ = json.Unmarshal(row.Resources.RawMessage, &res)
-	return res.NetBytes
-}
-
-// putToSleepRemote removes the service's remote replicas via their agents,
-// marks the service sleeping, and repoints the domain route at the wake
-// endpoint so inbound traffic brings it back.
-func putToSleepRemote(ctx context.Context, db *database.DB, q *sqlcdb.Queries, svc sleepCandidate, apiPort int) {
-	runner := newAgentNodeRunner(db)
-	for _, agentID := range remoteAgentsForService(ctx, db, svc.ID) {
-		if err := runner.ControlService(ctx, svc.ID.String(), agentID, "remove"); err != nil {
-			log.Printf("sleep: remote remove on %s failed: %v", agentID, err)
-			continue
-		}
-		_ = q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
-			NodeAgentID: agentID,
-			ServiceID:   svc.ID.String(),
-		})
-	}
-	tracker.mu.Lock()
-	delete(tracker.activity, svc.ID)
-	tracker.mu.Unlock()
-	_, _ = db.Exec(`UPDATE services SET status = 'sleeping', updated_at = $1 WHERE id = $2`, time.Now(), svc.ID)
-	log.Printf("sleep: %s (%s) remote replicas removed after idle timeout", svc.Name, svc.ID)
-
-	var domain string
-	_ = db.QueryRow(`SELECT COALESCE(domain,'') FROM services WHERE id = $1`, svc.ID).Scan(&domain)
-	domains := serviceDomainNames(db, svc.ID, domain)
-	if len(domains) > 0 {
-		writeWakeIngress(svc.ID.String(), domains, apiPort)
-	}
-}
-
 // markIdle returns true when the network counter stopped growing past the
 // timeout. First sighting only sets the baseline — no idle without history.
 func markIdle(id uuid.UUID, bytes uint64, timeout time.Duration) bool {
@@ -264,20 +191,9 @@ func putToSleep(ctx context.Context, db *database.DB, dc *docker.Client, engine
 	}
 }
 
-// wakeCGIScript is installed as /cgi-bin/wake in the wake container. It
-// fires the wake callback on the first reachable candidate URL, in the
-// background, then serves the reloading placeholder page. Deliberately
-// single-quote-free — the file is written through printf '%s'.
-const wakeCGIScript = `#!/bin/sh
-for u in $WAKE_URLS; do wget -q -O /dev/null --timeout=20 "$u" && break; done >/dev/null 2>&1 &
-printf "Content-Type: text/html\r\n\r\n"
-printf "%s" "$WAKE_PAGE"
-`
-
 // spawnWakeContainer runs a busybox httpd holding the service's Traefik
-// host rule at higher priority. Inbound hits redirect to /cgi-bin/wake,
-// which calls the internal wake endpoint and serves a reloading page
-// until the reconcile removes the placeholder.
+// host rule at higher priority. On boot it calls the wake endpoint, then
+// keeps serving a reloading page until the next reconcile removes it.
 func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client, engine *deployment.DeploymentEngine, svc sleepCandidate, domains []string, apiPort int) error {
 	edgeNet := ""
 	for _, n := range networkList(ctx, dc) {
@@ -307,25 +223,19 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 		"traefik.http.services." + router + ".loadbalancer.server.port": "80",
 	}
 
-	wakeURLs := wakeEndpointURLs(ctx, dc, apiPort, svc.ID, edgeNet)
+	wakeURL := wakeEndpointURL(ctx, dc, apiPort, svc.ID, edgeNet)
 	page := `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
 		`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
 		`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
 		`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
-	// The wake callback must fire when a request arrives, not at boot —
-	// firing unconditionally makes the service flap sleep→wake forever.
-	// index.html redirects to /cgi-bin/wake; the CGI fires the callback
-	// (first reachable URL wins) and serves the reloading page.
-	indexPage := `<!doctype html><html><head><meta http-equiv="refresh" content="0;url=/cgi-bin/wake"></head><body></body></html>`
-	// httpd without -f daemonizes, so PID1 ends on sleep infinity. URLs
-	// and the page travel via env so the CGI script needs no quoting.
+	// httpd without -f daemonizes, so the sequence is: write page, start
+	// httpd, fire the wake callback, then hold PID1 on sleep infinity.
 	cmd := fmt.Sprintf(
-		`mkdir -p /www/cgi-bin && printf '%%s' '%s' > /www/index.html && `+
-			`printf '%%s' '%s' > /www/cgi-bin/wake && chmod +x /www/cgi-bin/wake && `+
-			`printf '%%s\n' 'E404:/cgi-bin/wake' > /www/httpd.conf && `+
-			`httpd -p 80 -h /www && sleep infinity`,
-		strings.ReplaceAll(indexPage, "'", "'\\''"),
-		strings.ReplaceAll(wakeCGIScript, "'", "'\\''"))
+		`mkdir -p /www && printf '%%s' '%s' > /www/index.html && `+
+			`httpd -p 80 -h /www && `+
+			`(sleep 2; wget -q -O /dev/null --timeout=20 '%s' 2>/dev/null || true) && `+
+			`sleep infinity`,
+		strings.ReplaceAll(page, "'", "'\\''"), wakeURL)
 
 	endpoints := map[string]*network.EndpointSettings{edgeNet: {}}
 	if ownNet := dc.OwnNetworkName(ctx); ownNet != "" && ownNet != edgeNet {
@@ -346,13 +256,9 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 	}
 
 	id, err := dc.CreateContainer(ctx, docker.ContainerConfig{
-		Name:  name,
-		Image: wakeImage,
-		Cmd:   []string{"sh", "-c", cmd},
-		Env: []string{
-			"WAKE_URLS=" + strings.Join(wakeURLs, " "),
-			"WAKE_PAGE=" + page,
-		},
+		Name:     name,
+		Image:    wakeImage,
+		Cmd:      []string{"sh", "-c", cmd},
 		Labels:   labels,
 		Networks: endpoints,
 	})
@@ -374,41 +280,25 @@ func networkList(ctx context.Context, dc *docker.Client) []string {
 	return names
 }
 
-// wakeEndpointURLs builds ordered candidate URLs for the wake container to
-// call, deduplicated. No single address covers every topology: a containerized
-// API resolves by name on the shared network; Docker Desktop containers reach
-// the host via host.docker.internal; on native Docker the edge network's
-// gateway routes to host-published ports. busybox wget walks the chain until
-// one answers.
-func wakeEndpointURLs(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) []string {
-	var hosts []string
+// wakeEndpointURL builds the internal URL the wake container calls. The
+// edge network's gateway reaches the host's published API port; when the
+// API itself is containerized its own name resolves on the shared network.
+func wakeEndpointURL(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) string {
 	if dc.OwnNetworkName(ctx) != "" {
 		if self, err := dc.GetContainer(ctx, selfID()); err == nil {
-			if name := strings.TrimPrefix(self.Name, "/"); name != "" {
-				hosts = append(hosts, name)
+			name := strings.TrimPrefix(self.Name, "/")
+			if name != "" {
+				return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", name, apiPort, serviceID)
 			}
 		}
 	}
-	hosts = append(hosts, "host.docker.internal")
 	if gw := networkGateway(ctx, dc, edgeNet); gw != "" {
-		hosts = append(hosts, gw)
+		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", gw, apiPort, serviceID)
 	}
 	if probe := dc.HostProbeHost(ctx); probe != "" {
-		hosts = append(hosts, probe)
+		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", probe, apiPort, serviceID)
 	}
-	seen := map[string]bool{}
-	var urls []string
-	for _, h := range hosts {
-		if h == "" || seen[h] {
-			continue
-		}
-		seen[h] = true
-		urls = append(urls, fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", h, apiPort, serviceID))
-	}
-	if len(urls) == 0 {
-		urls = append(urls, fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID))
-	}
-	return urls
+	return fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID)
 }
 
 func networkGateway(ctx context.Context, dc *docker.Client, name string) string {
@@ -456,40 +346,18 @@ func pruneWakeContainers(ctx context.Context, db *database.DB, dc *docker.Client
 // idempotent and non-destructive, so no token is required; the endpoint
 // never mutates configuration.
 func handleServiceWake(c *gin.Context) {
-	code, body := triggerServiceWake(c)
-	if code != 0 {
-		c.JSON(code, body)
-	}
-}
-
-// handleServiceWakePage is the remote ingress wake target — Traefik routes
-// a sleeping remote service's domain here via the file provider. Every hit
-// (re)triggers the wake reconcile and returns a reloading page.
-func handleServiceWakePage(c *gin.Context) {
-	triggerServiceWake(c)
-	c.Header("Content-Type", "text/html; charset=utf-8")
-	c.String(http.StatusOK, wakePageHTML)
-}
-
-const wakePageHTML = `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
-	`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
-	`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
-	`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
-
-// triggerServiceWake loads the service and reconciles it back to running
-// in the background. Returns (0, nil) when a response was already written
-// by an embedded handler path, else the JSON status to send.
-func triggerServiceWake(c *gin.Context) (int, gin.H) {
 	dbVal, _ := c.Get("db")
 	db := dbVal.(*database.DB)
 	engineVal, _ := c.Get("deployment_engine")
 	engine, _ := engineVal.(*deployment.DeploymentEngine)
 	if engine == nil {
-		return http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"}
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"})
+		return
 	}
 	id, err := uuid.Parse(c.Param("id"))
 	if err != nil {
-		return http.StatusBadRequest, gin.H{"error": "invalid service id"}
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid service id"})
+		return
 	}
 	var service Service
 	err = db.QueryRow(
@@ -517,23 +385,22 @@ func triggerServiceWake(c *gin.Context) (int, gin.H) {
 		&service.CreatedAt, &service.UpdatedAt,
 	)
 	if err != nil {
-		return http.StatusNotFound, gin.H{"error": "service not found"}
+		c.JSON(http.StatusNotFound, gin.H{"error": "service not found"})
+		return
 	}
 	if service.Status == "running" || service.Status == "deployed" {
-		return http.StatusOK, gin.H{"status": service.Status}
+		c.JSON(http.StatusOK, gin.H{"status": service.Status})
+		return
 	}
 	go func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 		defer cancel()
 		spec, err := serviceRuntimeSpec(db, service)
 		if err != nil {
-			log.Printf("wake: runtime spec for %s failed: %v", service.ID, err)
-			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}
 		state, err := engine.ReconcileService(ctx, spec)
 		if err != nil {
-			log.Printf("wake: reconcile for %s failed: %v", service.ID, err)
 			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}
@@ -544,7 +411,7 @@ func triggerServiceWake(c *gin.Context) (int, gin.H) {
 		}
 		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
 	}()
-	return http.StatusAccepted, gin.H{"status": "waking"}
+	c.JSON(http.StatusAccepted, gin.H{"status": "waking"})
 }
 
 // handleServiceSleep puts a service to sleep immediately (owner+ only).
@@ -571,12 +438,7 @@ func handleServiceSleep(c *gin.Context) {
 		Name:      service.Name,
 		Status:    service.Status,
 	}
-	q := sqlcdb.New(db.DB)
-	if len(remoteLiveContainers(c.Request.Context(), q, service.ID.String())) > 0 {
-		go putToSleepRemote(context.Background(), db, q, svc, apiPortFromContext(c))
-	} else {
-		go putToSleep(context.Background(), db, dc, engine, svc, apiPortFromContext(c))
-	}
+	go putToSleep(context.Background(), db, dc, engine, svc, apiPortFromContext(c))
 	c.JSON(http.StatusAccepted, gin.H{"status": "sleeping"})
 }
 

app/backend/internal/api/templategraph.go

@@ -11,8 +11,6 @@ import (
 	"log"
 	"math/big"
 	"net/http"
-	"os"
-	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
@@ -24,7 +22,6 @@ import (
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
-	"containr/internal/source"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -230,9 +227,7 @@ func resolveStaticExpr(value string, userVars map[string]string, unresolved *[]s
 		if val, ok := userVars[key]; ok {
 			return val
 		}
-		// {{VAR:-x}} supplies a default; {{VAR:-}} declares an explicitly
-		// empty one. Both resolve — only a bare {{VAR}} is unresolved.
-		if strings.Contains(m, ":-") {
+		if sub[2] != "" {
 			return sub[2]
 		}
 		if unresolved != nil {
@@ -1117,130 +1112,6 @@ func handleImportCompose(c *gin.Context) {
 	})
 }
 
-// handleImportGitCompose fetches a compose file out of a git repository and
-// runs it through the same conversion as handleImportCompose. Works with any
-// git remote — connected providers (including GitHub App installs) supply
-// credentials for private repos. Nothing is persisted; the response feeds
-// the template create form or a direct deploy.
-func handleImportGitCompose(c *gin.Context) {
-	userID, ok := requireAuthenticatedUserID(c)
-	if !ok {
-		return
-	}
-	db := c.MustGet("db").(*database.DB)
-
-	var req struct {
-		Repo string `json:"repo" binding:"required"`
-		Path string `json:"path"`
-		Ref  string `json:"ref"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	branch, commit := "", ""
-	if ref := strings.TrimSpace(req.Ref); ref != "" {
-		if isCommitSHA(ref) {
-			commit = ref
-		} else {
-			branch = ref
-		}
-	}
-	spec, err := resolveGitCloneSpec(db, userID, req.Repo, branch, commit, "")
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Minute)
-	defer cancel()
-	checkoutRoot := filepath.Join(containrWorkDir, "repos", "import-"+uuid.NewString())
-	defer os.RemoveAll(checkoutRoot)
-	repoDir, err := source.Checkout(ctx, checkoutRoot, spec)
-	if err != nil {
-		c.JSON(http.StatusBadGateway, gin.H{"error": "git fetch failed: " + err.Error(), "code": "GIT_FETCH"})
-		return
-	}
-
-	// Default search order mirrors common compose conventions.
-	candidates := []string{req.Path}
-	if strings.TrimSpace(req.Path) == "" {
-		candidates = []string{"compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"}
-	}
-	var raw []byte
-	for _, rel := range candidates {
-		p, rerr := resolveRepoFile(repoDir, rel)
-		if rerr != nil {
-			continue
-		}
-		raw, err = os.ReadFile(p)
-		if err == nil {
-			break
-		}
-	}
-	if raw == nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "compose file not found in repository", "code": "NOT_FOUND"})
-		return
-	}
-	if len(raw) > 512*1024 {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Compose file exceeds 512 KiB"})
-		return
-	}
-
-	var file composeFileDef
-	if err := yaml.Unmarshal(raw, &file); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid compose YAML: " + err.Error()})
-		return
-	}
-	services, warnings, convErr := composeToSpecs(&file)
-	if convErr != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": convErr.Error()})
-		return
-	}
-	config := TemplateConfig{Version: 2, Services: services}
-	configJSON, _ := json.Marshal(config)
-	c.JSON(http.StatusOK, gin.H{
-		"config":    json.RawMessage(configJSON),
-		"variables": []TemplateVariable{},
-		"warnings":  warnings,
-	})
-}
-
-// resolveRepoFile maps a repo-relative file path onto the checkout and
-// rejects escapes — same containment rule as ResolveBuildPath, for files.
-func resolveRepoFile(checkoutDir, rel string) (string, error) {
-	rel = strings.TrimSpace(rel)
-	if rel == "" || filepath.IsAbs(rel) {
-		return "", fmt.Errorf("invalid repo path %q", rel)
-	}
-	clean := filepath.Clean(rel)
-	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
-		return "", fmt.Errorf("path escapes the checkout: %q", rel)
-	}
-	resolved := filepath.Join(checkoutDir, clean)
-	info, err := os.Stat(resolved)
-	if err != nil {
-		return "", fmt.Errorf("path %q not found in checkout", rel)
-	}
-	if !info.Mode().IsRegular() {
-		return "", fmt.Errorf("path %q is not a file", rel)
-	}
-	return resolved, nil
-}
-
-func isCommitSHA(ref string) bool {
-	if len(ref) != 40 {
-		return false
-	}
-	for _, r := range ref {
-		if !('0' <= r && r <= '9') && !('a' <= r && r <= 'f') {
-			return false
-		}
-	}
-	return true
-}
-
 // composeToSpecs converts a parsed compose file into graph service specs.
 // Compose service names become keys; declaration order follows YAML document
 // order — yaml.v3 maps lose order, so sort keys for stability.

app/backend/internal/api/templategraph_compose_test.go

@@ -1,8 +1,6 @@
 package api
 
 import (
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -126,42 +124,3 @@ func TestComposeToSpecsWarnings(t *testing.T) {
 		t.Errorf("missing env warning: %v", warnings)
 	}
 }
-
-func TestResolveRepoFileContainment(t *testing.T) {
-	dir := t.TempDir()
-	inner := filepath.Join(dir, "sub")
-	if err := os.MkdirAll(inner, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(inner, "compose.yml"), []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	p, err := resolveRepoFile(dir, "sub/compose.yml")
-	if err != nil {
-		t.Fatalf("valid file rejected: %v", err)
-	}
-	if p != filepath.Join(dir, "sub", "compose.yml") {
-		t.Errorf("unexpected path %q", p)
-	}
-
-	for _, bad := range []string{"", "/etc/passwd", "../escape.yml", "..", "sub/../../out.yml"} {
-		if _, err := resolveRepoFile(dir, bad); err == nil {
-			t.Errorf("path %q should have been rejected", bad)
-		}
-	}
-	if _, err := resolveRepoFile(dir, "sub"); err == nil {
-		t.Error("directory accepted as file")
-	}
-}
-
-func TestIsCommitSHA(t *testing.T) {
-	if !isCommitSHA("0123456789abcdef0123456789abcdef01234567") {
-		t.Error("40-hex ref not recognised as a commit")
-	}
-	for _, bad := range []string{"main", "v1.2.3", "0123456789abcdef0123456789abcdef0123456", "0123456789abcdef0123456789abcdef0123456G"} {
-		if isCommitSHA(bad) {
-			t.Errorf("ref %q misclassified as commit SHA", bad)
-		}
-	}
-}

app/backend/internal/api/templates.go

@@ -1102,98 +1102,6 @@ func SeedTemplates() []ServiceTemplate {
 			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
 			IsOfficial: true,
 		},
-		{
-			ID:          "tpl-n8n",
-			Name:        "n8n + PostgreSQL + Redis",
-			Description: "Workflow automation in queue mode with managed PostgreSQL and Redis",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/n8n",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"n8n","POSTGRES_USER":"n8n"},"volumes":[{"source":"n8n-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"redis","type":"database","runtime":"redis"},
-				{"key":"n8n","type":"web","runtime":"docker.n8n.io/n8nio/n8n:latest","port":5678,"health_check":"/healthz","depends_on":["db","redis"],
-				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","N8N_HOST":"{{APP_URL:-http://localhost:5678}}","N8N_EDITOR_BASE_URL":"{{APP_URL:-http://localhost:5678}}"},
-				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]},
-				{"key":"worker","name":"n8n-worker","type":"worker","runtime":"docker.n8n.io/n8nio/n8n:latest","start_command":"worker","depends_on":["n8n","db","redis"],
-				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","QUEUE_HEALTH_CHECK_ACTIVE":"true"},
-				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]}]}`,
-			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
-			IsOfficial: true,
-		},
-		{
-			ID:          "tpl-gitea",
-			Name:        "Gitea + PostgreSQL",
-			Description: "Self-hosted git service with managed PostgreSQL",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/gitea",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"gitea","POSTGRES_USER":"gitea"},"volumes":[{"source":"gitea-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"gitea","type":"web","runtime":"gitea/gitea:latest","port":3000,"health_check":"/api/healthz","depends_on":["db"],
-				 "environment":{"GITEA__database__DB_TYPE":"postgres","GITEA__database__HOST":"{{service.db.host}}:{{service.db.port}}","GITEA__database__NAME":"{{service.db.database}}","GITEA__database__USER":"{{service.db.user}}","GITEA__database__PASSWD":"{{service.db.password}}","GITEA__security__INSTALL_LOCK":"true","GITEA__security__SECRET_KEY":"{{secret(32)}}","GITEA__security__INTERNAL_TOKEN":"{{secret(64)}}","GITEA__server__DOMAIN":"{{DOMAIN:-localhost}}","GITEA__server__ROOT_URL":"{{ROOT_URL:-http://localhost:3000}}","GITEA__server__SSH_PORT":"2222","USER_UID":"1000","USER_GID":"1000"},
-				 "volumes":[{"source":"gitea-data","target":"/data"}]}]}`,
-			Variables:  `[{"key":"DOMAIN","label":"Public domain","default":"","required":false,"secret":false},{"key":"ROOT_URL","label":"Root URL","default":"","required":false,"secret":false}]`,
-			IsOfficial: true,
-		},
-		{
-			ID:          "tpl-nextcloud",
-			Name:        "Nextcloud + PostgreSQL + Redis",
-			Description: "Self-hosted file sync and collaboration with managed PostgreSQL and Redis",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/nextcloud",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"nextcloud","POSTGRES_USER":"nextcloud"},"volumes":[{"source":"nextcloud-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"redis","type":"database","runtime":"redis"},
-				{"key":"nextcloud","type":"web","runtime":"nextcloud:latest","port":80,"depends_on":["db","redis"],
-				 "environment":{"POSTGRES_HOST":"{{service.db.host}}","POSTGRES_DB":"{{service.db.database}}","POSTGRES_USER":"{{service.db.user}}","POSTGRES_PASSWORD":"{{service.db.password}}","REDIS_HOST":"{{service.redis.host}}","REDIS_HOST_PASSWORD":"{{service.redis.password}}","NEXTCLOUD_ADMIN_USER":"admin","NEXTCLOUD_ADMIN_PASSWORD":"{{secret(24)}}","NEXTCLOUD_TRUSTED_DOMAINS":"{{DOMAIN:-localhost}}","OVERWRITEHOST":"{{DOMAIN:-}}","OVERWRITEPROTOCOL":"https"},
-				 "volumes":[{"source":"nextcloud-data","target":"/var/www/html"}]}]}`,
-			Variables:  `[{"key":"DOMAIN","label":"Trusted domain","default":"localhost","required":false,"secret":false}]`,
-			IsOfficial: true,
-		},
-		{
-			ID:          "tpl-vaultwarden",
-			Name:        "Vaultwarden + PostgreSQL",
-			Description: "Bitwarden-compatible password manager with managed PostgreSQL",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/vaultwarden",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"vaultwarden","POSTGRES_USER":"vaultwarden"},"volumes":[{"source":"vaultwarden-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"vaultwarden","type":"web","runtime":"vaultwarden/server:latest","port":80,"health_check":"/alive","depends_on":["db"],
-				 "environment":{"DATABASE_URL":"{{service.db.url}}","ADMIN_TOKEN":"{{secret(48)}}","DOMAIN":"{{DOMAIN:-http://localhost:80}}","SIGNUPS_ALLOWED":"false","WEBSOCKET_ENABLED":"true"},
-				 "volumes":[{"source":"vaultwarden-data","target":"/data"}]}]}`,
-			Variables:  `[{"key":"DOMAIN","label":"Public URL","default":"","required":false,"secret":false}]`,
-			IsOfficial: true,
-		},
-		{
-			ID:          "tpl-umami",
-			Name:        "Umami + PostgreSQL",
-			Description: "Lightweight privacy-first web analytics with managed PostgreSQL",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/umami",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"umami","POSTGRES_USER":"umami"},"volumes":[{"source":"umami-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"umami","type":"web","runtime":"ghcr.io/umami-software/umami:postgresql-latest","port":3000,"depends_on":["db"],
-				 "environment":{"DATABASE_URL":"{{service.db.url}}","APP_SECRET":"{{secret(32)}}"}}]}`,
-			Variables:  `[]`,
-			IsOfficial: true,
-		},
-		{
-			ID:          "tpl-immich",
-			Name:        "Immich + PostgreSQL + Redis",
-			Description: "Self-hosted photo and video backup with managed PostgreSQL and Redis",
-			Category:    "stack",
-			Logo:        "https://cdn.simpleicons.org/immich",
-			Config: `{"version":2,"services":[
-				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"immich","POSTGRES_USER":"immich"},"volumes":[{"source":"immich-db","target":"/var/lib/postgresql/data"}]},
-				{"key":"redis","type":"database","runtime":"redis"},
-				{"key":"ml","name":"immich-machine-learning","type":"worker","runtime":"ghcr.io/immich-app/immich-machine-learning:release",
-				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
-				 "volumes":[{"source":"immich-model-cache","target":"/cache"}]},
-				{"key":"immich","name":"immich-server","type":"web","runtime":"ghcr.io/immich-app/immich-server:release","port":2283,"health_check":"/api/server/ping","depends_on":["db","redis","ml"],
-				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
-				 "volumes":[{"source":"immich-upload","target":"/usr/src/app/upload"}]}]}`,
-			Variables:  `[]`,
-			IsOfficial: true,
-		},
 	}
 	return templates
 }

app/backend/internal/api/templates_test.go

@@ -1,9 +1,6 @@
 package api
 
-import (
-	"encoding/json"
-	"testing"
-)
+import "testing"
 
 func TestNormalizeTemplateServiceType(t *testing.T) {
 	valid := []string{"web", "worker", "database", "cron"}
@@ -74,32 +71,3 @@ func TestResolveTemplateRuntimeImage(t *testing.T) {
 		t.Fatalf("expected unknown runtime passthrough, got %q", got)
 	}
 }
-
-func TestSeedTemplatesResolveCleanly(t *testing.T) {
-	for _, tpl := range SeedTemplates() {
-		var config TemplateConfig
-		if err := json.Unmarshal([]byte(tpl.Config), &config); err != nil {
-			t.Fatalf("%s: invalid config JSON: %v", tpl.ID, err)
-		}
-		var variables []TemplateVariable
-		if err := json.Unmarshal([]byte(tpl.Variables), &variables); err != nil {
-			t.Fatalf("%s: invalid variables JSON: %v", tpl.ID, err)
-		}
-		if len(config.Services) == 0 {
-			continue // legacy single-service template
-		}
-		sorted, err := topoSortServices(config.Services)
-		if err != nil {
-			t.Fatalf("%s: topo sort: %v", tpl.ID, err)
-		}
-		if err := validateTemplateGraph(sorted); err != nil {
-			t.Fatalf("%s: graph validation: %v", tpl.ID, err)
-		}
-		// User vars left empty — every expression must still resolve via
-		// defaults, secrets, or service refs.
-		graph := resolveTemplateGraph(sorted, map[string]string{})
-		if len(graph.unresolved) > 0 {
-			t.Fatalf("%s: unresolved expressions: %v", tpl.ID, graph.unresolved)
-		}
-	}
-}

app/backend/internal/build/dockerfile.go

@@ -539,16 +539,12 @@ func createBuildContext(sourcePath, dockerfileContent string) (io.ReadCloser, er
 		return nil, err
 	}
 
-	// Add source files to tar. The checkout's .git metadata is never build
-	// context — it bloats the tar and ships clone URLs to remote daemons.
+	// Add source files to tar
 	err = filepath.Walk(sourcePath, func(file string, fi os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
 		if fi.IsDir() {
-			if fi.Name() == ".git" {
-				return filepath.SkipDir
-			}
 			return nil
 		}
 

app/backend/internal/build/manager.go

@@ -3,8 +3,6 @@ package build
 import (
 	"context"
 	"fmt"
-	"io"
-	"os"
 	"path/filepath"
 	"time"
 
@@ -94,75 +92,6 @@ func (bm *BuildManager) Build(ctx context.Context, req *types.BuildRequest) (*ty
 	}
 }
 
-// PackageContext produces the same build-context tar Build would hand the
-// local daemon, without building it. Node agents download the tar and run
-// docker build themselves — the Dockerfile lands at the tar root.
-func (bm *BuildManager) PackageContext(ctx context.Context, req *types.BuildRequest) (io.ReadCloser, error) {
-	if req.BuildType == "" {
-		detectedType, err := bm.DetectBuildType(ctx, req.SourcePath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to detect build type: %w", err)
-		}
-		req.BuildType = string(detectedType)
-	}
-
-	var dockerfileContent string
-	switch BuildType(req.BuildType) {
-	case BuildTypeDockerfile:
-		name, err := bm.dockerfileBuilder.DetectDockerfile(ctx, req.SourcePath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to detect Dockerfile: %w", err)
-		}
-		path := filepath.Join(req.SourcePath, name)
-		if optimized, err := bm.dockerfileBuilder.OptimizeDockerfile(ctx, path); err == nil {
-			path = optimized
-		}
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read Dockerfile: %w", err)
-		}
-		dockerfileContent = string(data)
-	case BuildTypeRailpack:
-		if err := bm.railpackBuilder.DetectRailpack(ctx, req.SourcePath); err != nil {
-			return nil, fmt.Errorf("Railpack cannot build this project: %w", err)
-		}
-		content, err := bm.railpackBuilder.generateDockerfile(ctx, req.SourcePath, &RailpackConfig{
-			BuildCmd: req.BuildCommand,
-			StartCmd: req.StartCommand,
-			Env:      req.Environment,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to generate Dockerfile with Railpack: %w", err)
-		}
-		dockerfileContent = content
-	case BuildTypeNixpacks:
-		plan, err := bm.nixpacksBuilder.GeneratePlan(ctx, req.SourcePath, &NixpacksConfig{
-			BuildCmd: req.BuildCommand,
-			StartCmd: req.StartCommand,
-			Env:      req.Environment,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to generate build plan: %w", err)
-		}
-		path, err := bm.nixpacksBuilder.generateDockerfile(plan)
-		if err != nil {
-			return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
-		}
-		defer os.Remove(path)
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
-		}
-		dockerfileContent = string(data)
-	case BuildTypeStatic:
-		dockerfileContent = staticDockerfile
-	default:
-		return nil, fmt.Errorf("unsupported build type for remote packaging: %s", req.BuildType)
-	}
-
-	return createBuildContext(req.SourcePath, dockerfileContent)
-}
-
 // buildPrebuilt handles prebuilt image deployments
 func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildRequest) (*types.BuildResponse, error) {
 	if req.PrebuiltImage == "" {

app/backend/internal/build/nixpacks.go

@@ -476,22 +476,17 @@ func (n *NixpacksBuilder) Build(ctx context.Context, req *types.BuildRequest) (*
 	}
 
 	// Create temporary Dockerfile
-	dockerfilePath, err := n.generateDockerfile(plan)
+	dockerfile, err := n.generateDockerfile(plan)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
 	}
-	defer os.Remove(dockerfilePath)
+	defer os.Remove(dockerfile)
 
 	// Build Docker image
 	imageName := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
 
-	// Create build context tar — createBuildContext takes the Dockerfile
-	// contents, not its path.
-	dockerfileData, err := os.ReadFile(dockerfilePath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
-	}
-	buildCtx, err := createBuildContext(req.SourcePath, string(dockerfileData))
+	// Create build context tar
+	buildCtx, err := createBuildContext(req.SourcePath, dockerfile)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create build context: %w", err)
 	}

app/backend/internal/cli/commands/nodes.go

@@ -84,7 +84,7 @@ var nodesDeleteCmd = &cobra.Command{
 
 var nodesUpdateCmd = &cobra.Command{
 	Use:   "update <id>",
-	Short: "Update a node agent (--name, --auto-prune, --tags, --domain)",
+	Short: "Update a node agent (--name, --auto-prune, --tags)",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
 		c, err := client()
@@ -108,11 +108,8 @@ var nodesUpdateCmd = &cobra.Command{
 			}
 			body["tags"] = tags
 		}
-		if cmd.Flags().Changed("domain") {
-			body["default_domain"], _ = cmd.Flags().GetString("domain")
-		}
 		if len(body) == 0 {
-			return &APIError{Message: "nothing to update — pass --name, --auto-prune, --tags or --domain", ExitCode: ExitError}
+			return &APIError{Message: "nothing to update — pass --name, --auto-prune or --tags", ExitCode: ExitError}
 		}
 		data, err := c.Do("PUT", "/agents/"+args[0], body)
 		if err != nil {
@@ -307,7 +304,6 @@ func init() {
 	nodesUpdateCmd.Flags().String("name", "", "node display name")
 	nodesUpdateCmd.Flags().Bool("auto-prune", false, "enqueue a daily bounded docker prune")
 	nodesUpdateCmd.Flags().String("tags", "", "comma-separated placement tags (services with placement_tags only schedule onto matching nodes)")
-	nodesUpdateCmd.Flags().String("domain", "", "base domain for this node — domainless services placed here get <name>.<domain> automatically (empty clears)")
 	nodesPruneCmd.Flags().String("until", "", "only prune objects older than this duration (e.g. 168h)")
 	nodesPruneCmd.Flags().Bool("volumes", false, "also prune volumes (destructive — asks twice)")
 	nodeTokensCmd.AddCommand(nodeTokensIssueCmd, nodeTokensListCmd, nodeTokensRevokeCmd)

app/backend/internal/cli/commands/services.go

@@ -117,14 +117,6 @@ var servicesCreateCmd = &cobra.Command{
 		if v, _ := cmd.Flags().GetBool("spread"); v {
 			body["spread"] = v
 		}
-		if cmd.Flags().Changed("sleep") {
-			v, _ := cmd.Flags().GetBool("sleep")
-			body["sleep_enabled"] = v
-		}
-		if cmd.Flags().Changed("sleep-idle") {
-			v, _ := cmd.Flags().GetInt("sleep-idle")
-			body["sleep_idle_minutes"] = v
-		}
 		if v, _ := cmd.Flags().GetString("placement-tags"); v != "" {
 			tags := []string{}
 			for _, t := range strings.Split(v, ",") {
@@ -134,11 +126,6 @@ var servicesCreateCmd = &cobra.Command{
 			}
 			body["placement_tags"] = tags
 		}
-		if labels, err := traefikLabelFlag(cmd); err != nil {
-			return err
-		} else if labels != nil {
-			body["traefik_labels"] = labels
-		}
 		data, err := c.Do("POST", "/projects/"+args[0]+"/services", body)
 		if err != nil {
 			return err
@@ -153,28 +140,6 @@ var servicesCreateCmd = &cobra.Command{
 	},
 }
 
-// traefikLabelFlag parses --traefik-label key=value pairs into the API's
-// map shape. Returns nil when the flag was never passed; an empty map when
-// only empty values were given (clears overrides on update).
-func traefikLabelFlag(cmd *cobra.Command) (map[string]string, error) {
-	if !cmd.Flags().Changed("traefik-label") {
-		return nil, nil
-	}
-	pairs, _ := cmd.Flags().GetStringArray("traefik-label")
-	labels := map[string]string{}
-	for _, p := range pairs {
-		if strings.TrimSpace(p) == "" {
-			continue
-		}
-		k, v, ok := strings.Cut(p, "=")
-		if !ok || strings.TrimSpace(k) == "" {
-			return nil, &APIError{Message: fmt.Sprintf("invalid --traefik-label %q — want key=value", p), ExitCode: ExitError}
-		}
-		labels[strings.TrimSpace(k)] = v
-	}
-	return labels, nil
-}
-
 var servicesDeleteCmd = &cobra.Command{
 	Use:   "delete <id>",
 	Short: "Delete a service",
@@ -268,11 +233,6 @@ var servicesUpdateCmd = &cobra.Command{
 			v, _ := cmd.Flags().GetInt("sleep-idle")
 			body["sleep_idle_minutes"] = v
 		}
-		if labels, err := traefikLabelFlag(cmd); err != nil {
-			return err
-		} else if labels != nil {
-			body["traefik_labels"] = labels
-		}
 		if cmd.Flags().Changed("maintenance") {
 			v, _ := cmd.Flags().GetString("maintenance")
 			body["maintenance_mode"] = v == "on" || v == "true"
@@ -560,12 +520,9 @@ func init() {
 	f.String("memory-reserve", "", "soft memory reservation (e.g. 128Mi)")
 	f.String("static-cmd", "", "build command for the static builder")
 	f.String("static-dir", "", "output dir for the static builder (default dist)")
-	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded")
+	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded (image services only)")
 	f.Bool("spread", false, "distribute replicas across all online schedulable nodes")
-	f.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
-	f.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
 	f.String("placement-tags", "", "comma-separated node tags required for remote placement (auto/spread only)")
-	f.StringArray("traefik-label", nil, "Traefik middleware override, key=value (e.g. middlewares.rl.ratelimit.average=100); repeatable")
 
 	uf := servicesUpdateCmd.Flags()
 	uf.String("name", "", "service name")
@@ -590,7 +547,6 @@ func init() {
 	uf.String("static-dir", "", "output dir for the static builder (empty clears)")
 	uf.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
 	uf.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
-	uf.StringArray("traefik-label", nil, "Traefik middleware override, key=value; repeatable; empty list clears via --traefik-label ''")
 	uf.String("node", "", "pin to a node agent id, 'auto' for least-loaded, 'local' to clear")
 	uf.Bool("spread", false, "spread replicas across all online schedulable nodes (--spread=false to disable)")
 	uf.String("placement-tags", "", "comma-separated node tags required for remote placement (empty clears)")

app/backend/internal/cli/commands/templates.go

@@ -194,32 +194,6 @@ var templatesImportComposeCmd = &cobra.Command{
 	},
 }
 
-var templatesImportGitCmd = &cobra.Command{
-	Use:   "import-git <repo> [path]",
-	Short: "Fetch a compose file from a git repo and convert it into a template graph config",
-	Long:  "repo accepts a clone URL, ssh remote, or owner/repo shorthand resolved via connected git providers (private repos included). path defaults to compose.yaml/yml or docker-compose.yml/yaml. --ref selects a branch or commit.",
-	Args:  cobra.RangeArgs(1, 2),
-	RunE: func(cmd *cobra.Command, args []string) error {
-		body := map[string]string{"repo": args[0]}
-		if len(args) > 1 {
-			body["path"] = args[1]
-		}
-		if v, _ := cmd.Flags().GetString("ref"); v != "" {
-			body["ref"] = v
-		}
-		c, err := client()
-		if err != nil {
-			return err
-		}
-		data, err := c.Do("POST", "/templates/import/git", body)
-		if err != nil {
-			return err
-		}
-		PrintRaw(data)
-		return nil
-	},
-}
-
 var templatesDeployGraphCmd = &cobra.Command{
 	Use:   "deploy-graph <project-id> <config.json|->",
 	Short: "Deploy an ad-hoc service graph (v2 config with services[]) without a stored template",
@@ -283,6 +257,5 @@ func init() {
 	templatesDeployCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesPlanCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesDeployGraphCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
-	templatesImportGitCmd.Flags().String("ref", "", "git branch or commit (default: remote HEAD)")
-	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesImportGitCmd, templatesDeployGraphCmd)
+	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesDeployGraphCmd)
 }

app/backend/internal/database/sqlcdb/agents.sql.go

@@ -75,7 +75,7 @@ INSERT INTO node_agents (
     id, name, hostname, ip_address, port, status, version,
     capabilities, resources, last_heartbeat, metadata
 ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags
 `
 
 type CreateAgentParams struct {
@@ -124,7 +124,6 @@ func (q *Queries) CreateAgent(ctx context.Context, arg CreateAgentParams) (NodeA
 		&i.AutoPrune,
 		&i.Schedulable,
 		&i.Tags,
-		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -259,7 +258,7 @@ func (q *Queries) DeleteServiceContainersOnAgent(ctx context.Context, arg Delete
 }
 
 const getAgent = `-- name: GetAgent :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents WHERE id = $1
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags FROM node_agents WHERE id = $1
 `
 
 func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
@@ -282,13 +281,12 @@ func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
 		&i.AutoPrune,
 		&i.Schedulable,
 		&i.Tags,
-		&i.DefaultDomain,
 	)
 	return i, err
 }
 
 const getAgentByHostAndIP = `-- name: GetAgentByHostAndIP :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags FROM node_agents
 WHERE hostname = $1 AND ip_address = $2
 LIMIT 1
 `
@@ -318,7 +316,6 @@ func (q *Queries) GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAnd
 		&i.AutoPrune,
 		&i.Schedulable,
 		&i.Tags,
-		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -526,7 +523,7 @@ func (q *Queries) ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHea
 }
 
 const listAgents = `-- name: ListAgents :many
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents ORDER BY created_at ASC
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags FROM node_agents ORDER BY created_at ASC
 `
 
 func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
@@ -555,7 +552,6 @@ func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
 			&i.AutoPrune,
 			&i.Schedulable,
 			&i.Tags,
-			&i.DefaultDomain,
 		); err != nil {
 			return nil, err
 		}
@@ -699,39 +695,6 @@ func (q *Queries) ListPendingCommands(ctx context.Context, nodeAgentID string) (
 	return items, nil
 }
 
-const listSchedulableAgentDomains = `-- name: ListSchedulableAgentDomains :many
-SELECT DISTINCT default_domain FROM node_agents
-WHERE status = 'online' AND schedulable
-  AND default_domain <> ''
-  AND tags @> $1::jsonb
-ORDER BY default_domain
-`
-
-// Base domains of every online, schedulable agent carrying the required
-// placement tags — auto-domain candidates for spread services.
-func (q *Queries) ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error) {
-	rows, err := q.db.QueryContext(ctx, listSchedulableAgentDomains, dollar_1)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	items := []string{}
-	for rows.Next() {
-		var default_domain string
-		if err := rows.Scan(&default_domain); err != nil {
-			return nil, err
-		}
-		items = append(items, default_domain)
-	}
-	if err := rows.Close(); err != nil {
-		return nil, err
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return items, nil
-}
-
 const listSchedulableAgents = `-- name: ListSchedulableAgents :many
 SELECT id, name FROM node_agents
 WHERE status = 'online' AND schedulable
@@ -802,36 +765,8 @@ func (q *Queries) ListSchedulableAgentsMatching(ctx context.Context, dollar_1 js
 	return items, nil
 }
 
-const listServiceAgents = `-- name: ListServiceAgents :many
-SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1
-`
-
-// Distinct agents holding inventory rows for a service.
-func (q *Queries) ListServiceAgents(ctx context.Context, serviceID string) ([]string, error) {
-	rows, err := q.db.QueryContext(ctx, listServiceAgents, serviceID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	items := []string{}
-	for rows.Next() {
-		var node_agent_id string
-		if err := rows.Scan(&node_agent_id); err != nil {
-			return nil, err
-		}
-		items = append(items, node_agent_id)
-	}
-	if err := rows.Close(); err != nil {
-		return nil, err
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return items, nil
-}
-
 const listServiceContainers = `-- name: ListServiceContainers :many
-SELECT id, name, node_agent_id, status, ports, resources FROM container_instances
+SELECT id, name, node_agent_id, status FROM container_instances
 WHERE service_id = $1
 `
 
@@ -840,8 +775,6 @@ type ListServiceContainersRow struct {
 	Name        string                `json:"name"`
 	NodeAgentID string                `json:"node_agent_id"`
 	Status      pqtype.NullRawMessage `json:"status"`
-	Ports       pqtype.NullRawMessage `json:"ports"`
-	Resources   pqtype.NullRawMessage `json:"resources"`
 }
 
 func (q *Queries) ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error) {
@@ -858,8 +791,6 @@ func (q *Queries) ListServiceContainers(ctx context.Context, serviceID string) (
 			&i.Name,
 			&i.NodeAgentID,
 			&i.Status,
-			&i.Ports,
-			&i.Resources,
 		); err != nil {
 			return nil, err
 		}
@@ -947,20 +878,6 @@ func (q *Queries) ScrubCommandPayload(ctx context.Context, arg ScrubCommandPaylo
 	return err
 }
 
-const setAgentDefaultDomain = `-- name: SetAgentDefaultDomain :exec
-UPDATE node_agents SET default_domain = $2, updated_at = NOW() WHERE id = $1
-`
-
-type SetAgentDefaultDomainParams struct {
-	ID            string `json:"id"`
-	DefaultDomain string `json:"default_domain"`
-}
-
-func (q *Queries) SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error {
-	_, err := q.db.ExecContext(ctx, setAgentDefaultDomain, arg.ID, arg.DefaultDomain)
-	return err
-}
-
 const setAgentSchedulable = `-- name: SetAgentSchedulable :exec
 UPDATE node_agents SET schedulable = $2, updated_at = NOW() WHERE id = $1
 `
@@ -1005,7 +922,7 @@ UPDATE node_agents SET
     schedulable = $13,
     updated_at = NOW()
 WHERE id = $1
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags
 `
 
 type UpdateAgentParams struct {
@@ -1058,7 +975,6 @@ func (q *Queries) UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeA
 		&i.AutoPrune,
 		&i.Schedulable,
 		&i.Tags,
-		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -1089,53 +1005,6 @@ func (q *Queries) UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeart
 	return err
 }
 
-const updateContainerPorts = `-- name: UpdateContainerPorts :exec
-UPDATE container_instances SET status = $2, ports = $3, updated_at = NOW()
-WHERE id = $1
-`
-
-type UpdateContainerPortsParams struct {
-	ID     string                `json:"id"`
-	Status pqtype.NullRawMessage `json:"status"`
-	Ports  pqtype.NullRawMessage `json:"ports"`
-}
-
-// Agent reports the real host bindings after create — persist them with
-// the status flip so ingress can route to the assigned port.
-func (q *Queries) UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error {
-	_, err := q.db.ExecContext(ctx, updateContainerPorts, arg.ID, arg.Status, arg.Ports)
-	return err
-}
-
-const updateContainerStateByName = `-- name: UpdateContainerStateByName :exec
-UPDATE container_instances SET
-    status = jsonb_set(status, '{state}', $3::jsonb),
-    resources = jsonb_set(COALESCE(resources, '{}'::jsonb), '{net_bytes}', $4::jsonb),
-    updated_at = NOW()
-WHERE name = $1 AND node_agent_id = $2
-  AND status->>'state' IS DISTINCT FROM 'removed'
-`
-
-type UpdateContainerStateByNameParams struct {
-	Name        string          `json:"name"`
-	NodeAgentID string          `json:"node_agent_id"`
-	Column3     json.RawMessage `json:"column_3"`
-	Column4     json.RawMessage `json:"column_4"`
-}
-
-// Agent heartbeat reports real docker state + net counters; reconcile
-// inventory for rows this node owns. Tombstones win — never resurrect a
-// removed replica. $4 is the cumulative rx+tx byte counter.
-func (q *Queries) UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error {
-	_, err := q.db.ExecContext(ctx, updateContainerStateByName,
-		arg.Name,
-		arg.NodeAgentID,
-		arg.Column3,
-		arg.Column4,
-	)
-	return err
-}
-
 const updateContainerStatus = `-- name: UpdateContainerStatus :exec
 UPDATE container_instances SET status = $2, updated_at = NOW()
 WHERE id = $1

app/backend/internal/database/sqlcdb/models.go

@@ -178,7 +178,6 @@ type NodeAgent struct {
 	AutoPrune     bool                  `json:"auto_prune"`
 	Schedulable   bool                  `json:"schedulable"`
 	Tags          json.RawMessage       `json:"tags"`
-	DefaultDomain string                `json:"default_domain"`
 }
 
 type Notification struct {
@@ -280,7 +279,6 @@ type Service struct {
 	NodeID          sql.NullString  `json:"node_id"`
 	Spread          bool            `json:"spread"`
 	PlacementTags   json.RawMessage `json:"placement_tags"`
-	TraefikLabels   json.RawMessage `json:"traefik_labels"`
 }
 
 type ServiceDomain struct {

app/backend/internal/database/sqlcdb/querier.go

@@ -95,14 +95,9 @@ type Querier interface {
 	// display, when the caller owns or is a member of it, or when the caller is a
 	// platform admin. Anonymous callers pass user_id = uuid.Nil, is_admin = false.
 	ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error)
-	// Base domains of every online, schedulable agent carrying the required
-	// placement tags — auto-domain candidates for spread services.
-	ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error)
 	ListSchedulableAgents(ctx context.Context) ([]ListSchedulableAgentsRow, error)
 	// Only agents carrying every required placement tag (jsonb array containment).
 	ListSchedulableAgentsMatching(ctx context.Context, dollar_1 json.RawMessage) ([]ListSchedulableAgentsMatchingRow, error)
-	// Distinct agents holding inventory rows for a service.
-	ListServiceAgents(ctx context.Context, serviceID string) ([]string, error)
 	ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error)
 	ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error)
 	ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error)
@@ -121,7 +116,6 @@ type Querier interface {
 	RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error)
 	RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error)
 	ScrubCommandPayload(ctx context.Context, arg ScrubCommandPayloadParams) error
-	SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error
 	SetAgentSchedulable(ctx context.Context, arg SetAgentSchedulableParams) error
 	SetAgentTags(ctx context.Context, arg SetAgentTagsParams) error
 	SetDatabaseBackupRemoteKeyByID(ctx context.Context, arg SetDatabaseBackupRemoteKeyByIDParams) error
@@ -140,13 +134,6 @@ type Querier interface {
 	UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeartbeatParams) error
 	UpdateBackupTargetByIDAndUser(ctx context.Context, arg UpdateBackupTargetByIDAndUserParams) error
 	UpdateBanner(ctx context.Context, arg UpdateBannerParams) (Banner, error)
-	// Agent reports the real host bindings after create — persist them with
-	// the status flip so ingress can route to the assigned port.
-	UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error
-	// Agent heartbeat reports real docker state + net counters; reconcile
-	// inventory for rows this node owns. Tombstones win — never resurrect a
-	// removed replica. $4 is the cumulative rx+tx byte counter.
-	UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error
 	UpdateContainerStatus(ctx context.Context, arg UpdateContainerStatusParams) error
 	UpdateDatabaseServiceNameAndPlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameAndPlanByIDAndUserParams) error
 	UpdateDatabaseServiceNameByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameByIDAndUserParams) error

app/backend/internal/deployment/edge_labels_test.go

@@ -1,60 +0,0 @@
-package deployment
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestEdgeLabelsCustomMiddlewares(t *testing.T) {
-	spec := RuntimeSpec{
-		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
-		Port:      8080,
-		Domains:   []string{"app.example.com"},
-		TraefikLabels: map[string]string{
-			"middlewares.rl.ratelimit.average":                              "100",
-			"middlewares.rl.ratelimit.period":                               "1m",
-			"middlewares.sec.headers.customresponseheaders.X-Frame-Options": "DENY",
-		},
-	}
-	labels := edgeLabels(spec, "containr-edge")
-
-	if got := labels["traefik.http.middlewares.svc-01234567-rl.ratelimit.average"]; got != "100" {
-		t.Fatalf("ratelimit label missing: %v", labels)
-	}
-	if got := labels["traefik.http.middlewares.svc-01234567-sec.headers.customresponseheaders.X-Frame-Options"]; got != "DENY" {
-		t.Fatalf("headers label missing: %v", labels)
-	}
-	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
-	if chain != "svc-01234567-rl,svc-01234567-sec" {
-		t.Fatalf("middleware chain wrong: %q", chain)
-	}
-}
-
-func TestEdgeLabelsCustomAfterBuiltins(t *testing.T) {
-	spec := RuntimeSpec{
-		ServiceID:      "01234567-89ab-cdef-0123-456789abcdef",
-		Port:           8080,
-		Domains:        []string{"app.example.com"},
-		BasicAuthUsers: "u:$apr1$x",
-		TraefikLabels: map[string]string{
-			"middlewares.rl.ratelimit.average": "10",
-		},
-	}
-	labels := edgeLabels(spec, "containr-edge")
-	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
-	if !strings.HasPrefix(chain, "svc-01234567-auth,") || !strings.HasSuffix(chain, "svc-01234567-rl") {
-		t.Fatalf("builtin should precede custom: %q", chain)
-	}
-}
-
-func TestEdgeLabelsNoCustom(t *testing.T) {
-	spec := RuntimeSpec{
-		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
-		Port:      8080,
-		Domains:   []string{"app.example.com"},
-	}
-	labels := edgeLabels(spec, "containr-edge")
-	if _, ok := labels["traefik.http.routers.svc-01234567.middlewares"]; ok {
-		t.Fatal("middleware chain should be absent with no middlewares")
-	}
-}

app/backend/internal/deployment/engine.go

@@ -32,9 +32,6 @@ type NodeRunner interface {
 	// RemoteRuntimeState reads the service's remote replicas from inventory
 	// across all agents. nil/empty means nothing runs remotely.
 	RemoteRuntimeState(ctx context.Context, serviceID string) (*RuntimeState, error)
-	// RetireService removes every remote replica of the service across all
-	// agents — used when a service returns to local placement.
-	RetireService(ctx context.Context, serviceID string) error
 }
 
 type DeploymentEngine struct {
@@ -95,29 +92,12 @@ type ServiceConfig struct {
 	// reuses it so public URLs survive restarts. 0 = pick ephemeral.
 	PublishedPort int32 `json:"published_port,omitempty"`
 	// NodeID pins the service to a registered node agent; "" = local Docker
-	// host.
+	// host. Remote placement requires a registry-pullable image — builds stay
+	// on the local host (build-on-node is not yet supported).
 	NodeID string `json:"node_id,omitempty"`
 	// Spread distributes replicas across every online, schedulable agent.
+	// Same registry-image constraint as NodeID.
 	Spread bool `json:"spread,omitempty"`
-	// RemoteBuild, when set, makes each target node docker-build the image
-	// itself from a packaged context artifact instead of pulling a registry
-	// tag. The image name comes from the deployment, not the spec.
-	RemoteBuild *RemoteBuildSpec `json:"remote_build,omitempty"`
-	// RemoteLoad ships a docker-save tarball to each target node — used for
-	// rollbacks of locally-built tags that no registry can serve.
-	RemoteLoad *RemoteLoadSpec `json:"remote_load,omitempty"`
-}
-
-// RemoteBuildSpec is the agent-side docker build request.
-type RemoteBuildSpec struct {
-	ArtifactID string            `json:"artifact_id"`
-	BuildArgs  map[string]string `json:"build_args,omitempty"`
-	NoCache    bool              `json:"no_cache,omitempty"`
-}
-
-// RemoteLoadSpec asks the agent to docker-load an image tarball artifact.
-type RemoteLoadSpec struct {
-	ArtifactID string `json:"artifact_id"`
 }
 
 type PortMapping struct {
@@ -228,12 +208,6 @@ func (de *DeploymentEngine) DockerClient() *docker.Client {
 	return de.dockerClient
 }
 
-// BuildManager exposes the engine's builders for context packaging — remote
-// nodes build the tar this produces themselves.
-func (de *DeploymentEngine) BuildManager() *build.BuildManager {
-	return de.buildManager
-}
-
 // SetNodeRunner wires remote-node dispatch for services pinned to an agent.
 func (de *DeploymentEngine) SetNodeRunner(r NodeRunner) {
 	de.nodeRunner = r
@@ -349,19 +323,11 @@ func (de *DeploymentEngine) executeDeployment(ctx context.Context, deployment *D
 	})
 }
 
-// buildImage builds the container image. "remote" build types produce no
-// local image — the target node builds or loads it from an artifact; the
-// deployment still needs a deterministic tag so every node names it alike.
+// buildImage builds the container image
 func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployment, buildConfig *BuildConfig) (string, error) {
 	if buildConfig == nil {
 		return "", fmt.Errorf("build config is required")
 	}
-	if buildConfig.BuildType == "remote" {
-		if buildConfig.PrebuiltImage != "" {
-			return buildConfig.PrebuiltImage, nil
-		}
-		return fmt.Sprintf("containr-%s-%s:%s", deployment.ServiceID, deployment.Environment, deployment.ID), nil
-	}
 
 	buildReq := &types.BuildRequest{
 		BuildType:     buildConfig.BuildType,
@@ -424,8 +390,6 @@ func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deplo
 		BasicAuthUsers: cfg.BasicAuthUsers,
 		NodeID:         cfg.NodeID,
 		Spread:         cfg.Spread,
-		RemoteBuild:    cfg.RemoteBuild,
-		RemoteLoad:     cfg.RemoteLoad,
 	}
 	for _, pm := range cfg.PortMappings {
 		if spec.Port == 0 {

app/backend/internal/deployment/runtime.go

@@ -55,10 +55,6 @@ type RuntimeSpec struct {
 	Maintenance    bool          // redirect traffic to MaintenanceURL
 	MaintenanceURL string        // absolute URL; empty = serve empty response
 	BasicAuthUsers string        // htpasswd-format user:hash pairs, comma-separated
-	// TraefikLabels defines extra middlewares for this service's router —
-	// keys "middlewares.<name>.<type>[.<field>]" (API-validated against an
-	// allowlist). Defined middlewares attach to the router after builtins.
-	TraefikLabels map[string]string
 	// NodeID pins the service to a node agent; "" runs on the local host.
 	NodeID string
 	// Spread distributes replicas across all online, schedulable agents
@@ -67,12 +63,6 @@ type RuntimeSpec struct {
 	// PlacementTags restricts auto/spread candidates to agents carrying
 	// every listed tag. An explicit NodeID pin bypasses tag filtering.
 	PlacementTags []string
-	// RemoteBuild makes target nodes docker-build Image from a packaged
-	// context artifact before replicas start (git-sourced remote deploys).
-	RemoteBuild *RemoteBuildSpec
-	// RemoteLoad makes target nodes docker-load a saved image tarball —
-	// remote rollbacks of locally-built tags.
-	RemoteLoad *RemoteLoadSpec
 }
 
 // RuntimeContainer describes one live replica.
@@ -192,12 +182,6 @@ func (de *DeploymentEngine) ReconcileService(ctx context.Context, spec RuntimeSp
 		}
 		return de.nodeRunner.ReconcileAuto(ctx, spec)
 	}
-	// Local placement: retire any remote leftovers from a previous pin,
-	// spread, or tag affinity before reconciling local replicas.
-	if de.nodeRunner != nil {
-		_ = de.nodeRunner.RetireService(ctx, spec.ServiceID)
-	}
-
 	if spec.Replicas < 1 {
 		spec.Replicas = 1
 	}
@@ -278,9 +262,44 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 		projectNet: {Aliases: []string{spec.Name}},
 	}
 	if edgeNet != "" {
+		router := "svc-" + spec.ServiceID[:8]
+		domains := spec.Domains
+		if len(domains) == 0 && spec.Domain != "" {
+			domains = []string{spec.Domain}
+		}
+		sort.Strings(domains)
+		rules := make([]string, 0, len(domains))
+		for _, d := range domains {
+			rules = append(rules, "Host(`"+d+"`)")
+		}
 		endpoints[edgeNet] = &network.EndpointSettings{}
-		for k, v := range edgeLabels(spec, edgeNet) {
-			labels[k] = v
+		labels["traefik.enable"] = "true"
+		labels["traefik.docker.network"] = edgeNet
+		labels["traefik.http.routers."+router+".rule"] = strings.Join(rules, " || ")
+		labels["traefik.http.routers."+router+".entrypoints"] = "web"
+		labels["traefik.http.services."+router+".loadbalancer.server.port"] = fmt.Sprintf("%d", spec.Port)
+
+		var middlewares []string
+		if spec.Maintenance {
+			if spec.MaintenanceURL != "" {
+				mw := router + "-maint"
+				labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
+				labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
+				labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
+				middlewares = append(middlewares, mw)
+			} else {
+				// No redirect target configured — take the site offline with
+				// empty responses instead of leaking traffic to the app.
+				labels["traefik.http.routers."+router+".service"] = "noop@internal"
+			}
+		}
+		if spec.BasicAuthUsers != "" {
+			mw := router + "-auth"
+			labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
+			middlewares = append(middlewares, mw)
+		}
+		if len(middlewares) > 0 {
+			labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
 		}
 	}
 
@@ -368,81 +387,6 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 // vpnkit drops a conflicting binding).
 var errPortNotBound = errors.New("requested host port not bound")
 
-// edgeLabels builds the Traefik router/service/middleware labels for a
-// replica on the edge network: host rules, load balancer port, builtin
-// maintenance/basic-auth middlewares, then operator-defined overrides.
-func edgeLabels(spec RuntimeSpec, edgeNet string) map[string]string {
-	router := "svc-" + spec.ServiceID[:8]
-	domains := spec.Domains
-	if len(domains) == 0 && spec.Domain != "" {
-		domains = []string{spec.Domain}
-	}
-	sort.Strings(domains)
-	rules := make([]string, 0, len(domains))
-	for _, d := range domains {
-		rules = append(rules, "Host(`"+d+"`)")
-	}
-
-	labels := map[string]string{
-		"traefik.enable":                                                "true",
-		"traefik.docker.network":                                        edgeNet,
-		"traefik.http.routers." + router + ".rule":                      strings.Join(rules, " || "),
-		"traefik.http.routers." + router + ".entrypoints":               "web",
-		"traefik.http.services." + router + ".loadbalancer.server.port": fmt.Sprintf("%d", spec.Port),
-	}
-
-	var middlewares []string
-	if spec.Maintenance {
-		if spec.MaintenanceURL != "" {
-			mw := router + "-maint"
-			labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
-			labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
-			labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
-			middlewares = append(middlewares, mw)
-		} else {
-			// No redirect target configured — take the site offline with
-			// empty responses instead of leaking traffic to the app.
-			labels["traefik.http.routers."+router+".service"] = "noop@internal"
-		}
-	}
-	if spec.BasicAuthUsers != "" {
-		mw := router + "-auth"
-		labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
-		middlewares = append(middlewares, mw)
-	}
-	// Operator-defined middlewares: "middlewares.<name>.<rest>" becomes
-	// "<router>-<name>.<rest>", and every defined name joins the router's
-	// chain after builtins. Names sort for a deterministic chain order.
-	customMWs := map[string][]string{}
-	for k, v := range spec.TraefikLabels {
-		rest := strings.TrimPrefix(k, "middlewares.")
-		dot := strings.Index(rest, ".")
-		if dot <= 0 {
-			continue
-		}
-		customMWs[rest[:dot]] = append(customMWs[rest[:dot]], rest[dot+1:]+"="+v)
-	}
-	mwNames := make([]string, 0, len(customMWs))
-	for name := range customMWs {
-		mwNames = append(mwNames, name)
-	}
-	sort.Strings(mwNames)
-	for _, name := range mwNames {
-		mw := router + "-" + name
-		sort.Strings(customMWs[name])
-		for _, kv := range customMWs[name] {
-			if i := strings.Index(kv, "="); i > 0 {
-				labels["traefik.http.middlewares."+mw+"."+kv[:i]] = kv[i+1:]
-			}
-		}
-		middlewares = append(middlewares, mw)
-	}
-	if len(middlewares) > 0 {
-		labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
-	}
-	return labels
-}
-
 // isPortConflict reports whether a container create failed because the
 // requested host port was already bound.
 func isPortConflict(err error) bool {

app/backend/internal/docker/client.go

@@ -336,13 +336,6 @@ func (c *Client) BuildImage(ctx context.Context, buildContext io.Reader, options
 	return resp, nil
 }
 
-// SaveImage streams refs as a docker-save tarball. Remote nodes receive
-// these through the artifact endpoint and docker load them — that is how
-// locally-built rollback tags reach nodes without a registry.
-func (c *Client) SaveImage(ctx context.Context, refs ...string) (io.ReadCloser, error) {
-	return c.cli.ImageSave(ctx, refs)
-}
-
 // RemoveImage removes an image
 func (c *Client) RemoveImage(ctx context.Context, imageID string, force bool) ([]image.DeleteResponse, error) {
 	return c.cli.ImageRemove(ctx, imageID, image.RemoveOptions{

app/backend/internal/gateway/proxy_test.go

@@ -1,64 +0,0 @@
-package gateway
-
-import "testing"
-
-func TestBuildTargetURL(t *testing.T) {
-	cases := []struct {
-		name                                       string
-		upstream, prefix, path, query, want        string
-	}{
-		{
-			name:     "strips route prefix",
-			upstream: "https://api.internal:8080",
-			prefix:   "/g/weather",
-			path:     "/g/weather/v1/current",
-			query:    "city=oslo",
-			want:     "https://api.internal:8080/v1/current?city=oslo",
-		},
-		{
-			name:     "prefix root maps to upstream root",
-			upstream: "https://api.internal",
-			prefix:   "/g/weather",
-			path:     "/g/weather",
-			want:     "https://api.internal/",
-		},
-		{
-			name:     "upstream base path is preserved",
-			upstream: "https://api.internal/base",
-			prefix:   "/g/x",
-			path:     "/g/x/ping",
-			want:     "https://api.internal/base/ping",
-		},
-		{
-			name:     "root prefix leaves path untouched",
-			upstream: "https://api.internal",
-			prefix:   "/",
-			path:     "/g/raw",
-			want:     "https://api.internal/g/raw",
-		},
-		{
-			name:     "path without prefix is still proxied",
-			upstream: "https://api.internal",
-			prefix:   "/g/x",
-			path:     "/other",
-			want:     "https://api.internal/other",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := BuildTargetURL(tc.upstream, tc.prefix, tc.path, tc.query)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tc.want {
-				t.Fatalf("got %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestBuildTargetURL_InvalidUpstream(t *testing.T) {
-	if _, err := BuildTargetURL("://bad", "/g/x", "/g/x/y", ""); err == nil {
-		t.Fatal("expected error for unparsable upstream")
-	}
-}

app/backend/internal/mcpserver/server.go

@@ -53,7 +53,7 @@ func init() {
 	// Services
 	register(spec{"containr_services_list", "List services in a project", "GET", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_get", "Get a service by id", "GET", "/services/{id}", []string{"id"}, nil, false})
-	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, sleep_enabled (bool — scale to zero on idle), sleep_idle_minutes (1-1440, default 15), node_id (agent id | 'auto' = least-loaded online node; git services build on the node itself), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin), placement_tags (string array — remote placement only onto nodes carrying every tag; re-resolved per reconcile, pin overrides), traefik_labels (object — extra Traefik middlewares for this service's router; keys 'middlewares.<name>.<type>[.<field>]', allowlist-validated; defined middlewares attach to the router automatically).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
+	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, node_id (agent id | 'auto' = least-loaded online node; image services only — remote nodes can't run git builds), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin), placement_tags (string array — remote placement only onto nodes carrying every tag; re-resolved per reconcile, pin overrides).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_delete", "Delete a service. Requires confirm:true.", "DELETE", "/services/{id}", []string{"id"}, nil, true})
 	register(spec{"containr_services_start", "Start a service", "POST", "/services/{id}/start", []string{"id"}, nil, false})
 	register(spec{"containr_services_stop", "Stop a service", "POST", "/services/{id}/stop", []string{"id"}, nil, false})
@@ -66,7 +66,7 @@ func init() {
 	register(spec{"containr_services_move", "Move a service to another project the caller owns. Args: id, project_id (required).", "POST", "/services/{id}/move", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_services_logs", "Get service runtime logs. Args: id, tail (default 100).", "GET", "/services/{id}/logs", []string{"id"}, nil, false})
 	register(spec{"containr_services_exec", "Run a one-off command in the service container (30s ceiling). Args: id, command (required).", "POST", "/services/{id}/exec", []string{"id"}, []string{"command"}, false})
-	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned. placement_tags (string array; [] clears) restricts auto/spread placement to nodes carrying every tag; mutually exclusive with an explicit pin — clear the pin first. traefik_labels (object; {} clears) replaces the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]', e.g. {'middlewares.rl.ratelimit.average': '100'}.", "PUT", "/services/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned. placement_tags (string array; [] clears) restricts auto/spread placement to nodes carrying every tag; mutually exclusive with an explicit pin — clear the pin first.", "PUT", "/services/{id}", []string{"id"}, nil, false})
 
 	// Domains
 	register(spec{"containr_domains_list", "List domains attached to a service", "GET", "/services/{id}/domains", []string{"id"}, nil, false})
@@ -133,7 +133,6 @@ func init() {
 	register(spec{"containr_templates_deploy", "Deploy a template into a project. Args: id (template), project_id.", "POST", "/templates/{id}/deploy", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_templates_plan", "Dry-resolve a template: expanded expressions, service refs, missing variables. Args: id, variables (object).", "POST", "/templates/{id}/plan", []string{"id"}, nil, false})
 	register(spec{"containr_templates_import_compose", "Convert docker-compose YAML into a v2 template graph config. Args: compose_yaml.", "POST", "/templates/import/compose", nil, []string{"compose_yaml"}, false})
-	register(spec{"containr_templates_import_git", "Fetch a compose file from a git repo (clone URL, ssh remote, or owner/repo via connected providers) and convert it into a v2 template graph config. Args: repo (required), path (default: compose.yaml/yml or docker-compose.yml/yaml), ref (branch or commit).", "POST", "/templates/import/git", nil, []string{"repo", "path", "ref"}, false})
 	register(spec{"containr_templates_deploy_graph", "Deploy an ad-hoc service graph without a stored template. Args: project_id, config ({services:[...]}), variables, plan, region.", "POST", "/templates/deploy", nil, []string{"project_id", "config", "variables", "plan", "region"}, false})
 	register(spec{"containr_projects_import_compose", "Deploy a docker-compose file straight into a project. Args: id (project), compose_yaml, variables, plan, region.", "POST", "/projects/{id}/import-compose", []string{"id"}, []string{"compose_yaml", "variables", "plan", "region"}, false})
 
@@ -174,7 +173,7 @@ func init() {
 	register(spec{"containr_nodes_get", "Get a node agent (admin)", "GET", "/agents/{id}", []string{"id"}, nil, false})
 	register(spec{"containr_agent_tokens_issue", "Issue an agent onboarding token (admin). Args: label.", "POST", "/agent-tokens", nil, []string{"label"}, false})
 	register(spec{"containr_agent_tokens_list", "List agent onboarding tokens (admin)", "GET", "/agent-tokens", nil, nil, false})
-	register(spec{"containr_nodes_update", "Update a node agent (admin). Args: id; optional auto_prune, name, tags (string array — placement labels services can require via placement_tags; [] clears), default_domain (base domain — services placed on this node with no explicit domains get <name>.<default_domain>; empty clears).", "PUT", "/agents/{id}", []string{"id"}, []string{"auto_prune", "name", "tags", "default_domain"}, false})
+	register(spec{"containr_nodes_update", "Update a node agent (admin). Args: id; optional auto_prune, name, tags (string array — placement labels services can require via placement_tags; [] clears).", "PUT", "/agents/{id}", []string{"id"}, []string{"auto_prune", "name", "tags"}, false})
 	register(spec{"containr_nodes_cordon", "Cordon a node: blocks new pins and 'auto' placements; running replicas stay (admin). Args: id.", "POST", "/agents/{id}/cordon", []string{"id"}, nil, false})
 	register(spec{"containr_nodes_uncordon", "Re-open a node for placement (admin). Args: id.", "POST", "/agents/{id}/uncordon", []string{"id"}, nil, false})
 	register(spec{"containr_nodes_drain", "Drain a node: cordon + remove all service containers via the agent + unpin affected services so they redeploy locally. Requires the node online (admin). Args: id.", "POST", "/agents/{id}/drain", []string{"id"}, nil, true})

app/backend/internal/source/source.go

@@ -1,190 +0,0 @@
-// Package source materializes git checkouts for builds. Services reference
-// a repository by URL (or owner/repo); deployments fetch the exact branch or
-// commit into an isolated workdir, then point the builders at build_path
-// inside it. Credentials travel through GIT_ASKPASS so tokens never land in
-// argv, .git/config, logs, or the build context.
-package source
-
-import (
-	"context"
-	"fmt"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// Spec describes one checkout.
-type Spec struct {
-	CloneURL  string // https URL (NormalizeCloneURL output); local paths allowed for tests
-	Branch    string // ref to fetch when Commit is empty
-	Commit    string // optional SHA pinned over Branch
-	BuildPath string // subdirectory inside the repo; "" or "." = repo root
-	Token     string // optional http credential
-	User      string // credential username; defaults per provider in ResolveUser
-}
-
-// NormalizeCloneURL converts the forms services store into an https clone
-// URL: ssh remotes (git@host:org/repo, ssh://git@host/org/repo) map onto
-// https so token auth works uniformly. A bare "owner/repo" is returned
-// unchanged — the caller resolves the host through git_repositories.
-func NormalizeCloneURL(raw string) (string, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return "", fmt.Errorf("empty repository reference")
-	}
-	// scp-style ssh remote: [email protected]:org/repo(.git)
-	if strings.HasPrefix(raw, "git@") && strings.Contains(raw, ":") {
-		host := raw[len("git@"):strings.Index(raw, ":")]
-		path := strings.TrimPrefix(raw[strings.Index(raw, ":")+1:], "/")
-		return "https://" + host + "/" + path, nil
-	}
-	if strings.HasPrefix(raw, "ssh://") {
-		u, err := url.Parse(raw)
-		if err != nil {
-			return "", fmt.Errorf("invalid ssh remote %q", raw)
-		}
-		return "https://" + u.Host + u.Path, nil
-	}
-	if strings.HasPrefix(raw, "http://") || strings.HasPrefix(raw, "https://") {
-		return raw, nil
-	}
-	if strings.Contains(raw, "://") {
-		return "", fmt.Errorf("unsupported repository scheme in %q", raw)
-	}
-	if strings.Count(raw, "/") == 1 && !strings.ContainsAny(raw, " @:") {
-		return raw, nil // owner/repo — resolved against git_repositories upstream
-	}
-	return "", fmt.Errorf("unsupported repository reference %q", raw)
-}
-
-// ValidateRemoteURL rejects non-http(s) clones before a deploy accepts them.
-// Local checkouts (tests, mounted workspaces) bypass this via Checkout.
-func ValidateRemoteURL(cloneURL string) error {
-	if strings.HasPrefix(cloneURL, "http://") || strings.HasPrefix(cloneURL, "https://") {
-		return nil
-	}
-	return fmt.Errorf("clone URL must be http(s), got %q", cloneURL)
-}
-
-// Checkout fetches spec into destDir/repo and returns the directory the
-// builders should consume (checkout root + build_path). Callers
-// RemoveAll(destDir) — the checkout is a per-deployment workspace, never
-// shared. The askpass helper lives outside repo so it can't leak into the
-// build context.
-func Checkout(ctx context.Context, destDir string, spec Spec) (string, error) {
-	repoDir := filepath.Join(destDir, "repo")
-	if err := os.MkdirAll(repoDir, 0o755); err != nil {
-		return "", err
-	}
-
-	env := append(os.Environ(), "GIT_TERMINAL_PROMPT=0")
-	if spec.Token != "" {
-		// Askpass keeps the token out of argv and .git/config.
-		askpass := filepath.Join(destDir, ".git-askpass")
-		script := "#!/bin/sh\ncase \"$1\" in\n*sername*) printf '%s' \"$CONTAINR_GIT_USER\" ;;\n*) printf '%s' \"$CONTAINR_GIT_TOKEN\" ;;\nesac\n"
-		if err := os.WriteFile(askpass, []byte(script), 0o700); err != nil {
-			return "", fmt.Errorf("write askpass: %w", err)
-		}
-		user := spec.User
-		if user == "" {
-			user = "x-access-token"
-		}
-		env = append(env,
-			"GIT_ASKPASS="+askpass,
-			"CONTAINR_GIT_USER="+user,
-			"CONTAINR_GIT_TOKEN="+spec.Token,
-		)
-	}
-
-	run := func(args ...string) error {
-		cmd := exec.CommandContext(ctx, "git", args...)
-		cmd.Dir = repoDir
-		cmd.Env = env
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("git %s: %s", args[0], strings.TrimSpace(string(out)))
-		}
-		return nil
-	}
-
-	if err := run("init", "-q"); err != nil {
-		return "", err
-	}
-	if err := run("remote", "add", "origin", spec.CloneURL); err != nil {
-		return "", err
-	}
-
-	ref := spec.Commit
-	if ref == "" {
-		ref = spec.Branch
-	}
-	if ref == "" {
-		ref = "HEAD"
-	}
-	// Cheap path first, widening on failure: dumb transports reject
-	// --depth outright, and some hosts refuse direct SHA fetches so a
-	// pinned commit may only be reachable through its branch.
-	attempts := [][]string{
-		{"fetch", "--depth", "1", "origin", ref},
-		{"fetch", "origin", ref},
-	}
-	if spec.Commit != "" {
-		branchRef := spec.Branch
-		if branchRef == "" {
-			branchRef = "HEAD"
-		}
-		attempts = append(attempts,
-			[]string{"fetch", "--depth", "100", "origin", branchRef},
-			[]string{"fetch", "origin", branchRef},
-		)
-	}
-	var fetchErr error
-	for _, args := range attempts {
-		if fetchErr = run(args...); fetchErr == nil {
-			break
-		}
-	}
-	if fetchErr != nil {
-		return "", fetchErr
-	}
-	if err := run("checkout", "-q", spec.CommitOrFetchHead()); err != nil {
-		return "", err
-	}
-
-	return ResolveBuildPath(repoDir, spec.BuildPath)
-}
-
-// CommitOrFetchHead is the checkout target: the pinned commit or FETCH_HEAD.
-func (s Spec) CommitOrFetchHead() string {
-	if s.Commit != "" {
-		return s.Commit
-	}
-	return "FETCH_HEAD"
-}
-
-// ResolveBuildPath maps build_path onto the checkout and rejects escapes —
-// a path like ../../etc must never leave the workspace.
-func ResolveBuildPath(checkoutDir, buildPath string) (string, error) {
-	bp := strings.TrimSpace(buildPath)
-	if bp == "" || bp == "." {
-		return checkoutDir, nil
-	}
-	if filepath.IsAbs(bp) {
-		return "", fmt.Errorf("build_path must be relative, got %q", bp)
-	}
-	clean := filepath.Clean(bp)
-	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
-		return "", fmt.Errorf("build_path escapes the checkout: %q", bp)
-	}
-	resolved := filepath.Join(checkoutDir, clean)
-	info, err := os.Stat(resolved)
-	if err != nil {
-		return "", fmt.Errorf("build_path %q not found in checkout", bp)
-	}
-	if !info.IsDir() {
-		return "", fmt.Errorf("build_path %q is not a directory", bp)
-	}
-	return resolved, nil
-}

app/backend/internal/source/source_test.go

@@ -1,152 +0,0 @@
-package source
-
-import (
-	"context"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-)
-
-func TestNormalizeCloneURL(t *testing.T) {
-	cases := []struct {
-		in, want string
-		err      bool
-	}{
-		{"https://github.com/org/repo.git", "https://github.com/org/repo.git", false},
-		{"[email protected]:org/repo.git", "https://github.com/org/repo.git", false},
-		{"ssh://[email protected]/org/repo.git", "https://gitlab.example.com/org/repo.git", false},
-		{"org/repo", "org/repo", false},
-		{"  https://gitlab.com/a/b.git  ", "https://gitlab.com/a/b.git", false},
-		{"", "", true},
-		{"ftp://example.com/repo", "", true},
-		{"weird string", "", true},
-	}
-	for _, c := range cases {
-		got, err := NormalizeCloneURL(c.in)
-		if c.err {
-			if err == nil {
-				t.Errorf("%q: expected error, got %q", c.in, got)
-			}
-			continue
-		}
-		if err != nil {
-			t.Errorf("%q: unexpected error %v", c.in, err)
-			continue
-		}
-		if got != c.want {
-			t.Errorf("%q: got %q, want %q", c.in, got, c.want)
-		}
-	}
-}
-
-func TestValidateRemoteURL(t *testing.T) {
-	if err := ValidateRemoteURL("https://github.com/o/r.git"); err != nil {
-		t.Errorf("https should pass: %v", err)
-	}
-	if err := ValidateRemoteURL("file:///tmp/repo"); err == nil {
-		t.Error("file:// should be rejected")
-	}
-	if err := ValidateRemoteURL("/tmp/repo"); err == nil {
-		t.Error("local path should be rejected")
-	}
-}
-
-// initRepo creates a small git repo with a branch and returns its path.
-func initRepo(t *testing.T) string {
-	t.Helper()
-	dir := t.TempDir()
-	run := func(args ...string) {
-		t.Helper()
-		cmd := exec.Command("git", args...)
-		cmd.Dir = dir
-		cmd.Env = append(os.Environ(),
-			"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@t",
-			"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@t")
-		if out, err := cmd.CombinedOutput(); err != nil {
-			t.Fatalf("git %v: %s", args, out)
-		}
-	}
-	run("init", "-q", "-b", "main")
-	if err := os.WriteFile(filepath.Join(dir, "app.txt"), []byte("v1"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "sub", "inner.txt"), []byte("sub"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	run("add", ".")
-	run("commit", "-q", "-m", "first")
-	return dir
-}
-
-func TestCheckoutBranch(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available")
-	}
-	repo := initRepo(t)
-	dest := t.TempDir()
-	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Branch: "main"})
-	if err != nil {
-		t.Fatalf("checkout: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "app.txt")); err != nil {
-		t.Errorf("expected app.txt in checkout: %v", err)
-	}
-}
-
-func TestCheckoutBuildPath(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available")
-	}
-	repo := initRepo(t)
-	dest := t.TempDir()
-	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Branch: "main", BuildPath: "sub"})
-	if err != nil {
-		t.Fatalf("checkout: %v", err)
-	}
-	if filepath.Base(dir) != "sub" {
-		t.Errorf("expected sub build path, got %s", dir)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "inner.txt")); err != nil {
-		t.Errorf("expected inner.txt under build path: %v", err)
-	}
-}
-
-func TestCheckoutCommit(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available")
-	}
-	repo := initRepo(t)
-	out, err := exec.Command("git", "-C", repo, "rev-parse", "HEAD").Output()
-	if err != nil {
-		t.Fatal(err)
-	}
-	sha := string(out[:len(out)-1])
-	dest := t.TempDir()
-	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Commit: sha, Branch: "main"})
-	if err != nil {
-		t.Fatalf("checkout commit: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "app.txt")); err != nil {
-		t.Errorf("expected app.txt in pinned checkout: %v", err)
-	}
-}
-
-func TestResolveBuildPathEscapes(t *testing.T) {
-	root := t.TempDir()
-	if _, err := ResolveBuildPath(root, "../../etc"); err == nil {
-		t.Error("escape should be rejected")
-	}
-	if _, err := ResolveBuildPath(root, "/abs/path"); err == nil {
-		t.Error("absolute path should be rejected")
-	}
-	if _, err := ResolveBuildPath(root, "missing"); err == nil {
-		t.Error("missing dir should be rejected")
-	}
-	if got, err := ResolveBuildPath(root, "."); err != nil || got != root {
-		t.Errorf("dot should resolve to root, got %q err=%v", got, err)
-	}
-}

app/backend/migrations_goose/20261113000000_service_traefik_labels.sql

@@ -1,9 +0,0 @@
--- +goose Up
--- Routing overrides: per-service Traefik middleware definitions stored as
--- { "middlewares.<name>.<type>.<field>": "value" }. Validated against an
--- allowlist; applied to the service's router and auto-attached to its
--- middleware chain at reconcile time.
-ALTER TABLE services ADD COLUMN IF NOT EXISTS traefik_labels jsonb NOT NULL DEFAULT '{}';
-
--- +goose Down
-ALTER TABLE services DROP COLUMN IF EXISTS traefik_labels;

app/backend/migrations_goose/20261114000000_node_default_domain.sql

@@ -1,8 +0,0 @@
--- +goose Up
--- Per-node base domain: services pinned/spread onto an agent with
--- default_domain get auto-generated hostnames (<service>.<domain>) when
--- they have no explicit service_domains rows.
-ALTER TABLE node_agents ADD COLUMN IF NOT EXISTS default_domain VARCHAR(255) NOT NULL DEFAULT '';
-
--- +goose Down
-ALTER TABLE node_agents DROP COLUMN IF EXISTS default_domain;

app/backend/sqlc/queries/agents.sql

@@ -110,12 +110,6 @@ RETURNING *;
 UPDATE container_instances SET status = $2, updated_at = NOW()
 WHERE id = $1;
 
--- name: UpdateContainerPorts :exec
--- Agent reports the real host bindings after create — persist them with
--- the status flip so ingress can route to the assigned port.
-UPDATE container_instances SET status = $2, ports = $3, updated_at = NOW()
-WHERE id = $1;
-
 -- name: GetLastAgentCommandByType :one
 SELECT * FROM agent_commands
 WHERE node_agent_id = $1 AND type = $2
@@ -179,20 +173,8 @@ LIMIT 1;
 -- name: SetAgentTags :exec
 UPDATE node_agents SET tags = $2::jsonb, updated_at = NOW() WHERE id = $1;
 
--- name: SetAgentDefaultDomain :exec
-UPDATE node_agents SET default_domain = $2, updated_at = NOW() WHERE id = $1;
-
--- name: ListSchedulableAgentDomains :many
--- Base domains of every online, schedulable agent carrying the required
--- placement tags — auto-domain candidates for spread services.
-SELECT DISTINCT default_domain FROM node_agents
-WHERE status = 'online' AND schedulable
-  AND default_domain <> ''
-  AND tags @> $1::jsonb
-ORDER BY default_domain;
-
 -- name: ListServiceContainers :many
-SELECT id, name, node_agent_id, status, ports, resources FROM container_instances
+SELECT id, name, node_agent_id, status FROM container_instances
 WHERE service_id = $1;
 
 -- name: SetAgentSchedulable :exec
@@ -215,20 +197,5 @@ ON CONFLICT (id) DO UPDATE SET
 -- name: DeleteServiceContainersOnAgent :exec
 DELETE FROM container_instances WHERE node_agent_id = $1 AND service_id = $2;
 
--- name: UpdateContainerStateByName :exec
--- Agent heartbeat reports real docker state + net counters; reconcile
--- inventory for rows this node owns. Tombstones win — never resurrect a
--- removed replica. $4 is the cumulative rx+tx byte counter.
-UPDATE container_instances SET
-    status = jsonb_set(status, '{state}', $3::jsonb),
-    resources = jsonb_set(COALESCE(resources, '{}'::jsonb), '{net_bytes}', $4::jsonb),
-    updated_at = NOW()
-WHERE name = $1 AND node_agent_id = $2
-  AND status->>'state' IS DISTINCT FROM 'removed';
-
--- name: ListServiceAgents :many
--- Distinct agents holding inventory rows for a service.
-SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1;
-
 -- name: ScrubCommandPayload :exec
 UPDATE agent_commands SET payload = $2, updated_at = NOW() WHERE id = $1;

app/backend/sqlc/schema.sql

@@ -69,8 +69,7 @@ CREATE TABLE services (
     static_dir VARCHAR(255) NOT NULL DEFAULT '',
     node_id VARCHAR(255),
     spread BOOLEAN NOT NULL DEFAULT false,
-    placement_tags JSONB NOT NULL DEFAULT '[]',
-    traefik_labels JSONB NOT NULL DEFAULT '{}'
+    placement_tags JSONB NOT NULL DEFAULT '[]'
 );
 
 CREATE TABLE registries (
@@ -199,8 +198,7 @@ CREATE TABLE node_agents (
     metadata JSONB,
     auto_prune BOOLEAN NOT NULL DEFAULT false,
     schedulable BOOLEAN NOT NULL DEFAULT true,
-    tags JSONB NOT NULL DEFAULT '[]',
-    default_domain VARCHAR(255) NOT NULL DEFAULT ''
+    tags JSONB NOT NULL DEFAULT '[]'
 );
 
 CREATE TABLE container_instances (

app/frontend/Dockerfile

@@ -1,7 +1,5 @@
 # Build stage
-ARG NODE_IMAGE=node:22-alpine
-ARG NGINX_IMAGE=nginx:alpine
-FROM ${NODE_IMAGE} AS builder
+FROM node:22-alpine AS builder
 
 # Set working directory
 WORKDIR /app
@@ -26,7 +24,7 @@ ENV VITE_AUTH_URL=${VITE_AUTH_URL}
 RUN npm run build
 
 # Production stage
-FROM ${NGINX_IMAGE}
+FROM nginx:alpine
 
 # Copy custom nginx config
 COPY nginx.conf /etc/nginx/nginx.conf

app/frontend/src/features/nodes/NodeDetailPage.tsx

@@ -48,7 +48,6 @@ export function NodeDetailPage() {
   const [confirmVolumes, setConfirmVolumes] = useState(false);
   const [confirmDrain, setConfirmDrain] = useState(false);
   const [tagDraft, setTagDraft] = useState<string | null>(null);
-  const [domainDraft, setDomainDraft] = useState<string | null>(null);
 
   const agentQuery = useQuery({
     queryKey: ['node-agent', id],
@@ -81,8 +80,8 @@ export function NodeDetailPage() {
     queryClient.invalidateQueries({ queryKey: ['usage-agents'] });
   };
   const updateMutation = useMutation({
-    mutationFn: (body: { name?: string; auto_prune?: boolean; tags?: string[]; default_domain?: string }) => updateAgent(id, body),
-    onSuccess: () => { setRename(null); setTagDraft(null); setDomainDraft(null); invalidate(); },
+    mutationFn: (body: { name?: string; auto_prune?: boolean; tags?: string[] }) => updateAgent(id, body),
+    onSuccess: () => { setRename(null); setTagDraft(null); invalidate(); },
   });
   const pruneMutation = useMutation({
     mutationFn: (volumes: boolean) => pruneAgent(id, { volumes }),
@@ -219,44 +218,6 @@ export function NodeDetailPage() {
                   </>
                 )}
               </p>
-              <p className="v-mono mt-1 text-[11px] text-[var(--text-tertiary)] flex items-center gap-1.5 flex-wrap">
-                domain:
-                {domainDraft === null ? (
-                  <>
-                    <span className={agent.defaultDomain ? 'text-[var(--text-secondary)]' : 'text-[var(--text-muted)]'}>
-                      {agent.defaultDomain || 'none'}
-                    </span>
-                    {isAdmin && (
-                      <button
-                        onClick={() => setDomainDraft(agent.defaultDomain || '')}
-                        className="text-[var(--text-muted)] hover:text-[var(--text-primary)]"
-                        title="Node base domain — domainless services placed here get <name>.<domain> hostnames"
-                      >
-                        <Pencil size={11} />
-                      </button>
-                    )}
-                  </>
-                ) : (
-                  <>
-                    <input
-                      value={domainDraft}
-                      onChange={(e) => setDomainDraft(e.target.value)}
-                      onKeyDown={(e) => {
-                        if (e.key === 'Enter') updateMutation.mutate({ default_domain: domainDraft.trim().toLowerCase() });
-                        if (e.key === 'Escape') setDomainDraft(null);
-                      }}
-                      autoFocus
-                      placeholder="apps.node1.example.com — empty clears"
-                      className="rounded-md border border-[var(--border-subtle)] bg-[var(--bg-tertiary)] px-2 py-0.5 text-[11px] text-[var(--text-primary)] w-64"
-                    />
-                    <button
-                      onClick={() => updateMutation.mutate({ default_domain: domainDraft.trim().toLowerCase() })}
-                      className="text-[var(--accent-primary)] hover:underline"
-                    >save</button>
-                    <button onClick={() => setDomainDraft(null)} className="text-[var(--text-muted)] hover:underline">cancel</button>
-                  </>
-                )}
-              </p>
             </div>
             <div className="flex items-center gap-3">
               <span className={`v-mono text-[11px] px-2 py-1 rounded-md border ${online

app/frontend/src/features/service/pages/ServiceDetailPage.tsx

@@ -485,7 +485,7 @@ export function ServiceDetailPage() {
   const [volumesForm, setVolumesForm] = useState<ServiceVolume[] | null>(null);
   const [domainInput, setDomainInput] = useState('');
   const [domainChecks, setDomainChecks] = useState<Record<string, DomainCheckResult> | null>(null);
-  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string; traefikLabels: string } | null>(null);
+  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string } | null>(null);
   const [sleepDraft, setSleepDraft] = useState<{ id: string; enabled: boolean; minutes: string } | null>(null);
   const [nodeDraft, setNodeDraft] = useState<string | null>(null);
   const nodesQuery = useQuery({
@@ -2490,13 +2490,7 @@ export function ServiceDetailPage() {
                     <button
                       type="button"
                       onClick={() =>
-                        setAccessForm({
-                          maintenance: Boolean(service.maintenanceMode),
-                          basicAuth: '',
-                          traefikLabels: Object.entries(service.traefikLabels ?? {})
-                            .map(([k, v]) => `${k}=${v}`)
-                            .join('\n'),
-                        })
+                        setAccessForm({ maintenance: Boolean(service.maintenanceMode), basicAuth: '' })
                       }
                       className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs font-medium hover:border-[var(--border-default)] transition-colors"
                     >
@@ -2517,14 +2511,6 @@ export function ServiceDetailPage() {
                         {(service.basicAuth ?? []).length > 0 ? (service.basicAuth ?? []).join(', ') : 'off'}
                       </p>
                     </div>
-                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
-                      <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Routing overrides</p>
-                      <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">
-                        {Object.keys(service.traefikLabels ?? {}).length > 0
-                          ? `${Object.keys(service.traefikLabels ?? {}).length} label(s)`
-                          : 'off'}
-                      </p>
-                    </div>
                   </div>
                 ) : (
                   <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 space-y-4">
@@ -2546,16 +2532,6 @@ export function ServiceDetailPage() {
                         className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
                       />
                     </div>
-                    <div>
-                      <label className="block text-xs text-[var(--text-tertiary)] mb-1">Routing overrides — Traefik middleware labels, key=value per line; empty clears</label>
-                      <textarea
-                        value={accessForm.traefikLabels}
-                        onChange={(e) => setAccessForm({ ...accessForm, traefikLabels: e.target.value })}
-                        rows={3}
-                        placeholder={"middlewares.rl.ratelimit.average=100\nmiddlewares.sec.headers.customresponseheaders.X-Frame-Options=DENY"}
-                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
-                      />
-                    </div>
                     <div className="flex items-center gap-2">
                       <button
                         type="button"
@@ -2570,17 +2546,8 @@ export function ServiceDetailPage() {
                               return i > 0 ? { username: l.slice(0, i), password: l.slice(i + 1) } : null;
                             })
                             .filter((x): x is { username: string; password: string } => x !== null);
-                          const labels: Record<string, string> = {};
-                          accessForm.traefikLabels
-                            .split('\n')
-                            .map((l) => l.trim())
-                            .filter(Boolean)
-                            .forEach((l) => {
-                              const i = l.indexOf('=');
-                              if (i > 0) labels[l.slice(0, i).trim()] = l.slice(i + 1).trim();
-                            });
                           updateServiceMutation.mutate(
-                            { maintenance_mode: accessForm.maintenance, basic_auth: creds, traefik_labels: labels },
+                            { maintenance_mode: accessForm.maintenance, basic_auth: creds },
                             { onSuccess: () => setAccessForm(null) },
                           );
                         }}

app/frontend/src/features/templates/pages/TemplatesPage.tsx

@@ -8,7 +8,6 @@ import {
   getCurrentUserProfile,
   getTemplateById,
   importComposeTemplate,
-  importGitComposeTemplate,
   listProjects,
   listTemplates,
   updateTemplate,
@@ -155,10 +154,6 @@ export function TemplatesPage() {
   const [composeYaml, setComposeYaml] = useState('');
   const [composeWarnings, setComposeWarnings] = useState<string[]>([]);
   const [composeError, setComposeError] = useState<string | null>(null);
-  const [composeMode, setComposeMode] = useState<'paste' | 'git'>('paste');
-  const [gitRepo, setGitRepo] = useState('');
-  const [gitPath, setGitPath] = useState('');
-  const [gitRef, setGitRef] = useState('');
 
   const [lastDeployment, setLastDeployment] = useState<{
     projectId: string;
@@ -369,10 +364,7 @@ export function TemplatesPage() {
   });
 
   const composeImportMutation = useMutation({
-    mutationFn: () =>
-      composeMode === 'git'
-        ? importGitComposeTemplate(gitRepo.trim(), gitPath.trim(), gitRef.trim())
-        : importComposeTemplate(composeYaml),
+    mutationFn: (yaml: string) => importComposeTemplate(yaml),
     onSuccess: (result) => {
       setComposeWarnings(result.warnings);
       setComposeError(null);
@@ -1115,7 +1107,7 @@ export function TemplatesPage() {
               <div>
                 <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Import docker-compose</h2>
                 <p className="text-xs text-[var(--text-tertiary)]">
-                  Paste a compose file or pull one from a git repo — known database images become managed databases.
+                  Paste a compose file — known database images become managed databases, everything else becomes services.
                 </p>
               </div>
               <button
@@ -1126,67 +1118,13 @@ export function TemplatesPage() {
                 <X size={15} />
               </button>
             </div>
-            <div className="flex gap-1 border-b border-[var(--border-subtle)] px-5 pt-3">
-              {(['paste', 'git'] as const).map((m) => (
-                <button
-                  key={m}
-                  type="button"
-                  onClick={() => setComposeMode(m)}
-                  className={`rounded-t-[var(--radius-md)] px-3 py-1.5 text-xs font-medium ${
-                    composeMode === m
-                      ? 'bg-[var(--surface-muted)] text-[var(--text-primary)]'
-                      : 'text-[var(--text-tertiary)] hover:text-[var(--text-secondary)]'
-                  }`}
-                >
-                  {m === 'paste' ? 'Paste YAML' : 'From git repo'}
-                </button>
-              ))}
-            </div>
-            {composeMode === 'paste' ? (
-              <textarea
-                value={composeYaml}
-                onChange={(e) => setComposeYaml(e.target.value)}
-                spellCheck={false}
-                placeholder={'services:\n  db:\n    image: postgres:16\n  web:\n    image: myapp:latest\n    depends_on: [db]'}
-                className="mono min-h-[320px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
-              />
-            ) : (
-              <div className="flex min-h-[320px] flex-1 flex-col gap-3 bg-[var(--bg-void)] p-4">
-                <label className="text-xs text-[var(--text-tertiary)]">
-                  Repository
-                  <input
-                    value={gitRepo}
-                    onChange={(e) => setGitRepo(e.target.value)}
-                    spellCheck={false}
-                    placeholder="owner/repo or https://github.com/owner/repo.git"
-                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
-                  />
-                </label>
-                <label className="text-xs text-[var(--text-tertiary)]">
-                  Compose file path <span className="opacity-60">(optional — compose.yaml / docker-compose.yml searched)</span>
-                  <input
-                    value={gitPath}
-                    onChange={(e) => setGitPath(e.target.value)}
-                    spellCheck={false}
-                    placeholder="deploy/compose.yml"
-                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
-                  />
-                </label>
-                <label className="text-xs text-[var(--text-tertiary)]">
-                  Branch or commit <span className="opacity-60">(optional)</span>
-                  <input
-                    value={gitRef}
-                    onChange={(e) => setGitRef(e.target.value)}
-                    spellCheck={false}
-                    placeholder="main"
-                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
-                  />
-                </label>
-                <p className="text-[11px] text-[var(--text-tertiary)]">
-                  Private repos use your connected git providers for credentials.
-                </p>
-              </div>
-            )}
+            <textarea
+              value={composeYaml}
+              onChange={(e) => setComposeYaml(e.target.value)}
+              spellCheck={false}
+              placeholder={'services:\n  db:\n    image: postgres:16\n  web:\n    image: myapp:latest\n    depends_on: [db]'}
+              className="mono min-h-[320px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
+            />
             {composeError ? (
               <div className="border-t border-[var(--border-subtle)] bg-[var(--error-soft)] px-5 py-2.5 text-xs text-[var(--error)]">
                 {composeError}
@@ -1202,8 +1140,8 @@ export function TemplatesPage() {
               </button>
               <button
                 type="button"
-                onClick={() => composeImportMutation.mutate()}
-                disabled={(composeMode === 'paste' ? !composeYaml.trim() : !gitRepo.trim()) || composeImportMutation.isPending}
+                onClick={() => composeImportMutation.mutate(composeYaml)}
+                disabled={!composeYaml.trim() || composeImportMutation.isPending}
                 className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
               >
                 {composeImportMutation.isPending ? <Loader2 size={13} className="animate-spin" /> : <FileCode size={13} />}

app/frontend/src/generated/api-types.ts

@@ -3243,80 +3243,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/templates/import/git": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Import a compose file from a git repository
-         * @description Fetches a compose file out of a git repository and runs it through
-         *     the same conversion as POST /templates/import/compose. `repo`
-         *     accepts a clone URL, ssh remote, or `owner/repo` shorthand —
-         *     connected git providers (including GitHub App installs) supply
-         *     credentials, so private repositories work. `path` defaults to
-         *     `compose.yaml`, `compose.yml`, `docker-compose.yml`, then
-         *     `docker-compose.yaml`; `ref` selects a branch or commit SHA.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** @description Clone URL, ssh remote, or owner/repo shorthand */
-                        repo: string;
-                        /** @description Repo-relative compose file path (searched by convention when empty) */
-                        path?: string;
-                        /** @description Branch name or 40-char commit SHA */
-                        ref?: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Converted config */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            config?: components["schemas"]["TemplateConfig"];
-                            variables?: Record<string, never>[];
-                            warnings?: string[];
-                        };
-                    };
-                };
-                /** @description Invalid repo reference, compose file missing, or conversion error */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Git fetch failed */
-                502: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/templates/deploy": {
         parameters: {
             query?: never;
@@ -8179,7 +8105,7 @@ export interface paths {
         };
         /**
          * Update node agent
-         * @description Partial update — accepts any subset of agent fields (name, status, auto_prune, tags, default_domain). `tags` sets the node's placement labels; services with placement_tags only schedule onto agents carrying every required tag. `default_domain` gives the node a base domain — domainless services placed there get `<name>.<default_domain>` auto-hostnames; empty string clears it.
+         * @description Partial update — accepts any subset of agent fields (name, status, auto_prune, tags). `tags` sets the node's placement labels; services with placement_tags only schedule onto agents carrying every required tag.
          */
         put: {
             parameters: {
@@ -11013,7 +10939,7 @@ export interface components {
             sleep_enabled?: boolean;
             /** @description Idle timeout in minutes before sleeping (1-1440, default 15) */
             sleep_idle_minutes?: number;
-            /** @description Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Git-sourced services build on the node itself (build context ships as an agent-token artifact); rollbacks of locally-built tags ship the image via docker save/load. */
+            /** @description Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Remote nodes run registry-pulled images only (no git builds, no Traefik domains). */
             node_id?: string;
             /** @description Display name of the pinned node agent (read-only) */
             node_name?: string;
@@ -11021,10 +10947,6 @@ export interface components {
             spread?: boolean;
             /** @description Node tags required for remote placement — auto/spread only consider agents carrying every tag; re-resolved each reconcile. Mutually exclusive with an explicit node_id pin (read-only on responses when a pin is set). */
             placement_tags?: string[];
-            /** @description Extra Traefik middlewares defined for this service's router — keys 'middlewares.<name>.<type>[.<field>]' (e.g. 'middlewares.rl.ratelimit.average'), allowlist-validated; each defined middleware attaches to the router after builtins */
-            traefik_labels?: {
-                [key: string]: string;
-            };
             /** @description Computed public URL (published port or domain) */
             public_url?: string;
             /**
@@ -11101,10 +11023,6 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; mutually exclusive with an explicit pin or 'local' */
             placement_tags?: string[];
-            /** @description Extra Traefik middlewares on the service router — keys 'middlewares.<name>.<type>[.<field>]'; allowlist-validated */
-            traefik_labels?: {
-                [key: string]: string;
-            };
         };
         UpdateServiceRequest: {
             /** @description Service name */
@@ -11172,10 +11090,6 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; [] clears. Mutually exclusive with a pin or 'local' — clear the pin first */
             placement_tags?: string[];
-            /** @description Replace the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]'; {} clears */
-            traefik_labels?: {
-                [key: string]: string;
-            };
         };
         ServiceDomain: {
             /** Format: uuid */
@@ -12297,8 +12211,6 @@ export interface components {
             schedulable?: boolean;
             /** @description Operator-set placement labels; services with placement_tags require all of them on the target node. */
             tags?: string[];
-            /** @description Node base domain — services placed on this node (pin or spread) with no explicit service_domains get `<name>.<default_domain>` hostnames automatically. Wildcard DNS for `*.<default_domain>` must resolve to the Containr edge. */
-            default_domain?: string;
             /** Format: date-time */
             last_heartbeat?: string;
             /** Format: date-time */

app/frontend/src/generated/docs-snapshot.ts

@@ -40,7 +40,7 @@ export const bundledDocs: BundledDoc[] = [
     "path": "guides/CLI.md",
     "section": "guides",
     "title": "Containr CLI",
-    "markdown": "# Containr CLI\n\nThe CLI controls every part of a Containr instance — the same API surface\nthe web UI uses. Build it with `scripts/build-cli.sh` or\n`go build ./cmd/cli` from `app/backend`.\n\n## Authentication\n\nCreate a personal access token in the web UI under\n**Settings → Personal Access Tokens** (or `containr tokens create`), then:\n\n```bash\ncontainr auth login cnp_...                      # verify + store\ncontainr auth login cnp_... --url https://containr.example.com\ncontainr auth login cnp_... --name production    # named profile\ncontainr auth status                             # show active profile + identity\ncontainr auth logout\n```\n\nResolution order for every command: `--token`/`--api-url` flags >\n`CONTAINR_TOKEN`/`CONTAINR_API_URL` env > active profile >\n`http://localhost:8080/api/v1`. The active profile is `--profile` >\n`CONTAINR_PROFILE` > `current_profile` in `~/.containr.yaml`.\n\n## Output and scripting\n\n- `--json` prints the raw API response — safe to pipe and parse.\n- `--yes` / `-y` skips confirmation on destructive commands (delete,\n  revoke, restore, failover). Non-interactive shells refuse destructive\n  commands without it.\n- Exit codes are stable: `0` ok, `1` error, `2` auth/permission,\n  `3` not found, `4` validation, `5` unreachable.\n\n## Commands\n\n```\nauth login|logout|status         token auth and profiles\ntokens list|create|revoke        personal access tokens\nprojects list|get|create|delete\nservices list|get|create|update|delete|start|stop|restart|redeploy\nservices clone|move              duplicate config or re-parent a service\nservices domains list|add|remove|default|check   multi-domain + DNS preflight\nregistries list|add|update|remove  private-image pull credentials\nvolumes list|delete              docker volume inventory + cleanup (admin)\ndeploy <service-id>              trigger a deployment (--no-cache, --commit-hash, --branch)\ndeployments list|get|logs|rollback|cancel\nlogs <service-id> [--follow]     runtime logs (SSE follow)\nexec <service-id> -- <cmd>       one-off container command\nvariables list|set|unset         env vars (secrets masked; --redeploy applies them)\nvariables shared list|set|unset  project shared vars — referenced as ${{shared.KEY}}\ndatabases list|get|create|update|delete|action|backup|restore|download-backup|import-backup\n                               import-backup <id> <file.tar.gz|-> uploads an archive as a restore\n                               point; ships offsite too when a backup target is assigned\ndatabases list|get|create|update|delete|action|backup|restore|download-backup\n                               create --public exposes the port on all interfaces;\n                               update <id> --public/--public=false toggles it (container recreates, data persists)\ndatabases register <name>      register an external database (--type --host --port --database --username --password --ssl; probed before storing)\ndatabases test-connection      probe a connection — by id, or ad-hoc flags\nbackup-targets list|add|update|remove|test\n                               S3-compatible archive destinations; add/update probe the bucket\n                               first, empty --access-key/--secret-key on update keep stored keys;\n                               update <db-id> --backup-target assigns a target (\"\" clears it)\ncron list|get|create|delete|trigger|executions\ntemplates list|get|create|delete|deploy|plan|import-compose|deploy-graph\n                               deploy --name --var K=V; plan dry-resolves expressions;\n                               import-compose <compose.yml|-> converts a compose file into\n                               a v2 graph config; deploy-graph <project-id> <config.json|->\n                               deploys an ad-hoc service graph\nimport compose <project-id> <compose.yml|->\n                               deploys a docker-compose file straight into a project —\n                               no template row. DB images become managed databases\n                               attached under their service name; --var K=V overrides\n                               template variables\nnodes list|get|delete|tokens     node agents + onboarding tokens (admin)\nnodes add <user@host>            SSH bootstrap — one session installs the agent, then never needed again (--print for manual runs)\nnodes update|prune|commands      rename/auto-prune, bounded docker prune, command history\nmigrate railway                  pull a Railway project (services, vars, domains) via GraphQL and recreate it — --dry-run prints the plan\nmigrate dflow                    import a dflow project (services, vars, volumes, domains) via its Payload REST API — needs --url + --api-key, --dry-run prints the plan\nscaling status|policies|services|scale\nha status|alerts|health|policies|enable|disable|failover\nsecurity scan|vulnerabilities|metrics\ngateway services|keys|anLine truncated
+    "markdown": "# Containr CLI\n\nThe CLI controls every part of a Containr instance — the same API surface\nthe web UI uses. Build it with `scripts/build-cli.sh` or\n`go build ./cmd/cli` from `app/backend`.\n\n## Authentication\n\nCreate a personal access token in the web UI under\n**Settings → Personal Access Tokens** (or `containr tokens create`), then:\n\n```bash\ncontainr auth login cnp_...                      # verify + store\ncontainr auth login cnp_... --url https://containr.example.com\ncontainr auth login cnp_... --name production    # named profile\ncontainr auth status                             # show active profile + identity\ncontainr auth logout\n```\n\nResolution order for every command: `--token`/`--api-url` flags >\n`CONTAINR_TOKEN`/`CONTAINR_API_URL` env > active profile >\n`http://localhost:8080/api/v1`. The active profile is `--profile` >\n`CONTAINR_PROFILE` > `current_profile` in `~/.containr.yaml`.\n\n## Output and scripting\n\n- `--json` prints the raw API response — safe to pipe and parse.\n- `--yes` / `-y` skips confirmation on destructive commands (delete,\n  revoke, restore, failover). Non-interactive shells refuse destructive\n  commands without it.\n- Exit codes are stable: `0` ok, `1` error, `2` auth/permission,\n  `3` not found, `4` validation, `5` unreachable.\n\n## Commands\n\n```\nauth login|logout|status         token auth and profiles\ntokens list|create|revoke        personal access tokens\nprojects list|get|create|delete\nservices list|get|create|update|delete|start|stop|restart|redeploy\nservices clone|move              duplicate config or re-parent a service\nservices domains list|add|remove|default|check   multi-domain + DNS preflight\nregistries list|add|update|remove  private-image pull credentials\nvolumes list|delete              docker volume inventory + cleanup (admin)\ndeploy <service-id>              trigger a deployment (--no-cache, --commit-hash, --branch)\ndeployments list|get|logs|rollback|cancel\nlogs <service-id> [--follow]     runtime logs (SSE follow)\nexec <service-id> -- <cmd>       one-off container command\nvariables list|set|unset         env vars (secrets masked; --redeploy applies them)\nvariables shared list|set|unset  project shared vars — referenced as ${{shared.KEY}}\ndatabases list|get|create|update|delete|action|backup|restore|download-backup|import-backup\n                               import-backup <id> <file.tar.gz|-> uploads an archive as a restore\n                               point; ships offsite too when a backup target is assigned\ndatabases list|get|create|update|delete|action|backup|restore|download-backup\n                               create --public exposes the port on all interfaces;\n                               update <id> --public/--public=false toggles it (container recreates, data persists)\ndatabases register <name>      register an external database (--type --host --port --database --username --password --ssl; probed before storing)\ndatabases test-connection      probe a connection — by id, or ad-hoc flags\nbackup-targets list|add|update|remove|test\n                               S3-compatible archive destinations; add/update probe the bucket\n                               first, empty --access-key/--secret-key on update keep stored keys;\n                               update <db-id> --backup-target assigns a target (\"\" clears it)\ncron list|get|create|delete|trigger|executions\ntemplates list|get|create|delete|deploy|plan|import-compose|deploy-graph\n                               deploy --name --var K=V; plan dry-resolves expressions;\n                               import-compose <compose.yml|-> converts a compose file into\n                               a v2 graph config; deploy-graph <project-id> <config.json|->\n                               deploys an ad-hoc service graph\nimport compose <project-id> <compose.yml|->\n                               deploys a docker-compose file straight into a project —\n                               no template row. DB images become managed databases\n                               attached under their service name; --var K=V overrides\n                               template variables\nnodes list|get|delete|tokens     node agents + onboarding tokens (admin)\nnodes add <user@host>            SSH bootstrap — one session installs the agent, then never needed again (--print for manual runs)\nnodes update|prune|commands      rename/auto-prune, bounded docker prune, command history\nmigrate railway                  pull a Railway project (services, vars, domains) via GraphQL and recreate it — --dry-run prints the plan\nmigrate dflow                    import a dflow project (services, vars, volumes, domains) via its Payload REST API — needs --url + --api-key, --dry-run prints the plan\nscaling status|policies|services|scale\nha status|alerts|health|policies|enable|disable|failover\nsecurity scan|vulnerabilities|metrics\ngateway services|keys|anLine truncated
   },
   {
     "path": "guides/CLOUDFLARE_SETUP.md",

app/frontend/src/lib/api-client.ts

@@ -88,7 +88,6 @@ export type ServiceEntity = {
   nodeName?: string;
   spread?: boolean;
   placementTags?: string[];
-  traefikLabels?: Record<string, string>;
   publicUrl?: string;
 };
 
@@ -362,7 +361,6 @@ export type NodeAgentEntity = {
   autoPrune: boolean;
   schedulable: boolean;
   tags: string[];
-  defaultDomain?: string;
   metadata: Record<string, unknown>;
   lastHeartbeat?: string;
   createdAt?: string;
@@ -704,7 +702,6 @@ function normalizeService(service: RawService): ServiceEntity | null {
     nodeName: service.node_name,
     spread: service.spread,
     placementTags: service.placement_tags,
-    traefikLabels: service.traefik_labels,
     publicUrl: service.public_url,
   };
 }
@@ -1108,7 +1105,6 @@ function normalizeAgent(agent: RawNodeAgent): NodeAgentEntity | null {
     autoPrune: agent.auto_prune ?? false,
     schedulable: agent.schedulable ?? true,
     tags: Array.isArray(agent.tags) ? agent.tags : [],
-    defaultDomain: agent.default_domain || '',
     metadata: (agent.metadata ?? {}) as Record<string, unknown>,
     createdAt: agent.created_at,
     updatedAt: agent.updated_at,
@@ -1148,7 +1144,7 @@ export async function listAgents(): Promise<NodeAgentEntity[]> {
   return normalizeAgentArray(payload.agents);
 }
 
-export async function updateAgent(id: string, body: { name?: string; auto_prune?: boolean; tags?: string[]; default_domain?: string }): Promise<NodeAgentEntity | null> {
+export async function updateAgent(id: string, body: { name?: string; auto_prune?: boolean; tags?: string[] }): Promise<NodeAgentEntity | null> {
   const payload = await requestJson<{ agent?: RawNodeAgent }>(`/agents/${id}`, {
     method: 'PUT',
     body: JSON.stringify(body),
@@ -1928,21 +1924,6 @@ export async function importComposeTemplate(composeYaml: string): Promise<Compos
   return { config: payload.config, warnings: payload.warnings ?? [] };
 }
 
-export async function importGitComposeTemplate(
-  repo: string,
-  path: string,
-  ref: string,
-): Promise<ComposeImportResult> {
-  const payload = await requestJson<{ config?: Record<string, unknown>; warnings?: string[] }>(
-    '/templates/import/git',
-    { method: 'POST', body: JSON.stringify({ repo, path: path || undefined, ref: ref || undefined }) },
-  );
-  if (!payload.config || typeof payload.config !== 'object') {
-    throw new ApiError('Git import response is invalid', 500);
-  }
-  return { config: payload.config, warnings: payload.warnings ?? [] };
-}
-
 export type ProjectComposeImportResult = {
   created: Array<{ key: string; kind: string; id: string; name: string; deployment_id?: string }>;
   warnings: string[];

app/mobile/src/api.ts

@@ -68,36 +68,6 @@ export interface Template {
   icon?: string;
 }
 
-export interface Variable {
-  id?: string;
-  key: string;
-  value: string;
-  is_secret: boolean;
-}
-
-export interface ServiceDomain {
-  id: string;
-  domain: string;
-  is_default: boolean;
-  cert_type?: string;
-  cert_status?: string;
-}
-
-export interface AppNotification {
-  id: string;
-  kind: string;
-  title: string;
-  body?: string;
-  resource_type?: string;
-  resource_id?: string;
-  read_at?: string | null;
-  created_at?: string;
-}
-
-// Masked value the API returns for secret variables; echoing it back on
-// update preserves the stored ciphertext.
-export const MASKED_SECRET = '********';
-
 export class ApiError extends Error {
   constructor(
     public status: number,
@@ -175,69 +145,6 @@ export class Api {
     return this.req<EnvCheck>('GET', `/services/${id}/env-check`);
   }
 
-  serviceVariables(id: string) {
-    return this.req<{ variables: Variable[] }>('GET', `/services/${id}/variables`).then(
-      (r) => r.variables ?? [],
-    );
-  }
-
-  updateVariables(id: string, variables: { key: string; value: string; is_secret: boolean }[]) {
-    return this.req<unknown>('PUT', `/services/${id}/variables`, { variables });
-  }
-
-  serviceDomains(id: string) {
-    return this.req<{ domains: ServiceDomain[] }>('GET', `/services/${id}/domains`).then(
-      (r) => r.domains ?? [],
-    );
-  }
-
-  addDomain(id: string, domain: string) {
-    return this.req<unknown>('POST', `/services/${id}/domains`, { domain });
-  }
-
-  deleteDomain(id: string, domainId: string) {
-    return this.req<unknown>('DELETE', `/services/${id}/domains/${domainId}`);
-  }
-
-  setDefaultDomain(id: string, domainId: string) {
-    return this.req<unknown>('POST', `/services/${id}/domains/${domainId}/default`);
-  }
-
-  updateService(
-    id: string,
-    patch: Partial<{
-      name: string;
-      command: string;
-      replicas: number;
-      port: number;
-      domain: string;
-      restart_policy: string;
-      healthcheck_path: string;
-      cpu: string;
-      memory: string;
-      sleep_enabled: boolean;
-      sleep_idle_minutes: number;
-      maintenance_mode: boolean;
-    }>,
-  ) {
-    return this.req<unknown>('PUT', `/services/${id}`, patch);
-  }
-
-  notifications() {
-    return this.req<{ notifications: AppNotification[]; unread: number }>(
-      'GET',
-      '/notifications?limit=50',
-    );
-  }
-
-  markNotificationRead(id: string) {
-    return this.req<unknown>('POST', `/notifications/${id}/read`);
-  }
-
-  markAllNotificationsRead() {
-    return this.req<unknown>('POST', '/notifications/read-all');
-  }
-
   serviceDeployments(id: string) {
     return this.req<{ deployments: Deployment[] }>(
       'GET',

app/mobile/src/app/(tabs)/_layout.tsx

@@ -1,19 +1,9 @@
 import React from 'react';
 import { Tabs } from 'expo-router';
 import { Ionicons } from '@expo/vector-icons';
-import { useQuery } from '@tanstack/react-query';
-import { useApi } from '../../session';
 import { colors } from '../../theme';
 
 export default function TabsLayout() {
-  const api = useApi();
-  const notifs = useQuery({
-    queryKey: ['notifications'],
-    queryFn: () => api.notifications(),
-    refetchInterval: 60_000,
-  });
-  const unread = notifs.data?.unread ?? 0;
-
   return (
     <Tabs
       screenOptions={{
@@ -51,16 +41,6 @@ export default function TabsLayout() {
           ),
         }}
       />
-      <Tabs.Screen
-        name="notifications"
-        options={{
-          title: 'Alerts',
-          tabBarBadge: unread > 0 ? unread : undefined,
-          tabBarIcon: ({ color, size }) => (
-            <Ionicons name="notifications-outline" size={size} color={color} />
-          ),
-        }}
-      />
       <Tabs.Screen
         name="settings"
         options={{

app/mobile/src/app/(tabs)/notifications.tsx

@@ -1,107 +0,0 @@
-import React from 'react';
-import { FlatList, RefreshControl, StyleSheet, Text, View } from 'react-native';
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useApi } from '../../session';
-import { colors } from '../../theme';
-import { relTime } from '../../time';
-import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
-
-const KIND_COLOR: Record<string, string> = {
-  deployment_failed: colors.err,
-  deployment: colors.accent,
-  alert: colors.warn,
-  scale: colors.info,
-};
-
-export default function Notifications() {
-  const api = useApi();
-  const qc = useQueryClient();
-
-  const notifs = useQuery({
-    queryKey: ['notifications'],
-    queryFn: () => api.notifications(),
-    refetchInterval: 30_000,
-  });
-
-  const markAll = useMutation({
-    mutationFn: () => api.markAllNotificationsRead(),
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['notifications'] }),
-  });
-  const markRead = useMutation({
-    mutationFn: (id: string) => api.markNotificationRead(id),
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['notifications'] }),
-  });
-
-  if (notifs.isLoading) return <Loading />;
-  if (notifs.error) return <ErrorBox error={notifs.error} />;
-
-  const items = notifs.data?.notifications ?? [];
-  const unread = notifs.data?.unread ?? 0;
-
-  return (
-    <FlatList
-      style={styles.root}
-      contentContainerStyle={{ padding: 16 }}
-      refreshControl={
-        <RefreshControl
-          refreshing={notifs.isRefetching}
-          onRefresh={() => notifs.refetch()}
-          tintColor={colors.accent}
-        />
-      }
-      ListHeaderComponent={
-        unread > 0 ? (
-          <ActionButton
-            label={`Mark all read (${unread})`}
-            disabled={markAll.isPending}
-            onPress={() => markAll.mutate()}
-          />
-        ) : null
-      }
-      ListEmptyComponent={<Empty text="No notifications" />}
-      data={items}
-      keyExtractor={(n) => n.id}
-      renderItem={({ item }) => {
-        const isUnread = !item.read_at;
-        const dot = KIND_COLOR[item.kind] ?? colors.accent;
-        return (
-          <Card
-            style={isUnread ? { borderColor: colors.accent } : undefined}
-          >
-            <View style={styles.row}>
-              <View style={[styles.dot, { backgroundColor: isUnread ? dot : colors.border }]} />
-              <View style={{ flex: 1 }}>
-                <Text style={[styles.title, !isUnread && { color: colors.textDim }]}>
-                  {item.title}
-                </Text>
-                {item.body ? <Text style={styles.body}>{item.body}</Text> : null}
-                <Text style={styles.meta}>
-                  {item.kind}
-                  {item.created_at ? ` · ${relTime(item.created_at)}` : ''}
-                </Text>
-              </View>
-              {isUnread ? (
-                <Text
-                  style={styles.markRead}
-                  onPress={() => markRead.mutate(item.id)}
-                >
-                  Mark read
-                </Text>
-              ) : null}
-            </View>
-          </Card>
-        );
-      }}
-    />
-  );
-}
-
-const styles = StyleSheet.create({
-  root: { flex: 1, backgroundColor: colors.bg },
-  row: { flexDirection: 'row', alignItems: 'flex-start' },
-  dot: { width: 8, height: 8, borderRadius: 4, marginTop: 5, marginRight: 10 },
-  title: { color: colors.text, fontSize: 15, fontWeight: '600' },
-  body: { color: colors.textDim, fontSize: 13, marginTop: 4, lineHeight: 18 },
-  meta: { color: colors.textDim, fontSize: 11, marginTop: 6 },
-  markRead: { color: colors.accent, fontSize: 12, fontWeight: '600', marginLeft: 8 },
-});

app/mobile/src/app/_layout.tsx

@@ -37,9 +37,6 @@ function AuthGate() {
         <Stack.Screen name="project/[id]" options={{ title: 'Project' }} />
         <Stack.Screen name="service/[id]" options={{ title: 'Service' }} />
         <Stack.Screen name="service/logs" options={{ title: 'Logs' }} />
-        <Stack.Screen name="service/variables" options={{ title: 'Variables' }} />
-        <Stack.Screen name="service/domains" options={{ title: 'Domains' }} />
-        <Stack.Screen name="service/settings" options={{ title: 'Service settings' }} />
       </Stack.Protected>
       <Stack.Screen name="login" options={{ headerShown: false }} />
     </Stack>

app/mobile/src/app/service/[id].tsx

@@ -11,7 +11,6 @@ import {
   Empty,
   ErrorBox,
   Loading,
-  Row,
   SectionTitle,
   StatusBadge,
 } from '../../components';
@@ -143,28 +142,6 @@ export default function ServiceDetail() {
         />
       </View>
 
-      <SectionTitle>Manage</SectionTitle>
-      <Card>
-        <Row
-          title="Variables"
-          subtitle="Environment and secrets"
-          onPress={() =>
-            router.push(`/service/variables?id=${s.id}&name=${encodeURIComponent(s.name)}`)
-          }
-        />
-        <Row
-          title="Domains"
-          subtitle={s.domain ?? 'Hostnames routed to this service'}
-          onPress={() => router.push(`/service/domains?id=${s.id}`)}
-        />
-        <Row
-          title="Scale & sleep"
-          subtitle={`${s.replicas ?? 1} replica${(s.replicas ?? 1) === 1 ? '' : 's'}` +
-            (s.sleep_enabled ? ` · sleeps after ${s.sleep_idle_minutes}m idle` : '')}
-          onPress={() => router.push(`/service/settings?id=${s.id}`)}
-        />
-      </Card>
-
       {s.sleep_enabled ? (
         <Text style={styles.hint}>
           Sleep enabled — scales to zero after {s.sleep_idle_minutes}m idle, wakes on traffic.

app/mobile/src/app/service/domains.tsx

@@ -1,151 +0,0 @@
-import React, { useState } from 'react';
-import {
-  Alert,
-  ScrollView,
-  StyleSheet,
-  Text,
-  TextInput,
-  TouchableOpacity,
-  View,
-} from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
-import { useLocalSearchParams } from 'expo-router';
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useApi } from '../../session';
-import { colors } from '../../theme';
-import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
-
-export default function ServiceDomains() {
-  const { id } = useLocalSearchParams<{ id: string }>();
-  const api = useApi();
-  const qc = useQueryClient();
-  const [newDomain, setNewDomain] = useState('');
-
-  const domains = useQuery({
-    queryKey: ['domains', id],
-    queryFn: () => api.serviceDomains(id!),
-    enabled: !!id,
-  });
-
-  const invalidate = () => {
-    qc.invalidateQueries({ queryKey: ['domains', id] });
-    qc.invalidateQueries({ queryKey: ['service', id] });
-  };
-  const onErr = (e: unknown) =>
-    Alert.alert('Failed', e instanceof Error ? e.message : String(e));
-
-  const add = useMutation({
-    mutationFn: (d: string) => api.addDomain(id!, d),
-    onSuccess: () => {
-      setNewDomain('');
-      invalidate();
-    },
-    onError: onErr,
-  });
-  const del = useMutation({
-    mutationFn: (domainId: string) => api.deleteDomain(id!, domainId),
-    onSuccess: invalidate,
-    onError: onErr,
-  });
-  const makeDefault = useMutation({
-    mutationFn: (domainId: string) => api.setDefaultDomain(id!, domainId),
-    onSuccess: invalidate,
-    onError: onErr,
-  });
-
-  if (domains.isLoading) return <Loading />;
-  if (domains.error) return <ErrorBox error={domains.error} />;
-
-  const submit = () => {
-    const d = newDomain.trim().toLowerCase();
-    if (d) add.mutate(d);
-  };
-
-  return (
-    <ScrollView style={styles.root} contentContainerStyle={{ padding: 16 }}>
-      <Text style={styles.hint}>
-        Hostnames routed to this service. The default domain is the one shown on cards and used
-        for generated links.
-      </Text>
-
-      {domains.data?.length === 0 ? <Empty text="No domains configured" /> : null}
-      {(domains.data ?? []).map((d) => (
-        <Card key={d.id}>
-          <View style={styles.row}>
-            <View style={{ flex: 1 }}>
-              <Text style={styles.domain}>{d.domain}</Text>
-              <Text style={styles.meta}>
-                {d.is_default ? 'default · ' : ''}
-                {d.cert_status ? `tls: ${d.cert_status}` : 'tls pending'}
-              </Text>
-            </View>
-            {!d.is_default ? (
-              <TouchableOpacity
-                onPress={() => makeDefault.mutate(d.id)}
-                hitSlop={8}
-                style={styles.iconBtn}
-              >
-                <Ionicons name="star-outline" size={20} color={colors.accent} />
-              </TouchableOpacity>
-            ) : (
-              <Ionicons name="star" size={20} color={colors.warn} style={styles.iconBtn} />
-            )}
-            <TouchableOpacity
-              onPress={() =>
-                Alert.alert('Remove domain', `Detach ${d.domain} from this service?`, [
-                  { text: 'Cancel', style: 'cancel' },
-                  { text: 'Remove', style: 'destructive', onPress: () => del.mutate(d.id) },
-                ])
-              }
-              hitSlop={8}
-              style={styles.iconBtn}
-            >
-              <Ionicons name="trash-outline" size={18} color={colors.err} />
-            </TouchableOpacity>
-          </View>
-        </Card>
-      ))}
-
-      <View style={styles.addRow}>
-        <TextInput
-          style={styles.input}
-          value={newDomain}
-          onChangeText={setNewDomain}
-          placeholder="app.example.com"
-          placeholderTextColor={colors.textDim}
-          autoCapitalize="none"
-          autoCorrect={false}
-          keyboardType="url"
-          onSubmitEditing={submit}
-        />
-        <ActionButton
-          label={add.isPending ? '…' : 'Add'}
-          kind="primary"
-          disabled={add.isPending || newDomain.trim() === ''}
-          onPress={submit}
-        />
-      </View>
-    </ScrollView>
-  );
-}
-
-const styles = StyleSheet.create({
-  root: { flex: 1, backgroundColor: colors.bg },
-  hint: { color: colors.textDim, fontSize: 12, marginBottom: 12, lineHeight: 17 },
-  row: { flexDirection: 'row', alignItems: 'center' },
-  domain: { color: colors.text, fontSize: 15, fontWeight: '600' },
-  meta: { color: colors.textDim, fontSize: 12, marginTop: 3 },
-  iconBtn: { padding: 6, marginLeft: 10 },
-  addRow: { flexDirection: 'row', alignItems: 'center', marginTop: 8 },
-  input: {
-    flex: 1,
-    color: colors.text,
-    backgroundColor: colors.surface,
-    borderWidth: 1,
-    borderColor: colors.border,
-    borderRadius: 10,
-    padding: 12,
-    marginRight: 8,
-    fontSize: 14,
-  },
-});

app/mobile/src/app/service/settings.tsx

@@ -1,174 +0,0 @@
-import React, { useState } from 'react';
-import {
-  Alert,
-  ScrollView,
-  StyleSheet,
-  Switch,
-  Text,
-  TextInput,
-  TouchableOpacity,
-  View,
-} from 'react-native';
-import { useLocalSearchParams } from 'expo-router';
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useApi } from '../../session';
-import { Service } from '../../api';
-import { colors } from '../../theme';
-import { ActionButton, Card, ErrorBox, Loading, SectionTitle } from '../../components';
-
-export default function ServiceSettings() {
-  const { id } = useLocalSearchParams<{ id: string }>();
-  const api = useApi();
-
-  const service = useQuery({
-    queryKey: ['service', id],
-    queryFn: () => api.service(id!),
-    enabled: !!id,
-  });
-
-  if (service.isLoading) return <Loading />;
-  if (service.error || !service.data) {
-    return <ErrorBox error={service.error ?? new Error('Not found')} />;
-  }
-
-  // Form mounts once data exists; its state initializes from the fetch.
-  return <Form serviceId={id!} initial={service.data} />;
-}
-
-function Form({ serviceId, initial }: { serviceId: string; initial: Service }) {
-  const api = useApi();
-  const qc = useQueryClient();
-  const [replicas, setReplicas] = useState(initial.replicas ?? 1);
-  const [port, setPort] = useState(String(initial.port ?? 0));
-  const [sleepEnabled, setSleepEnabled] = useState(!!initial.sleep_enabled);
-  const [sleepMinutes, setSleepMinutes] = useState(
-    String(initial.sleep_idle_minutes || 30),
-  );
-
-  const save = useMutation({
-    mutationFn: () =>
-      api.updateService(serviceId, {
-        replicas,
-        port: parseInt(port, 10) || 0,
-        sleep_enabled: sleepEnabled,
-        sleep_idle_minutes: Math.min(1440, Math.max(1, parseInt(sleepMinutes, 10) || 30)),
-      }),
-    onSuccess: () => {
-      qc.invalidateQueries({ queryKey: ['service', serviceId] });
-      qc.invalidateQueries({ queryKey: ['services'] });
-      Alert.alert('Saved', 'Changes apply on the next deploy.');
-    },
-    onError: (e) => Alert.alert('Save failed', e instanceof Error ? e.message : String(e)),
-  });
-
-  const clampReplicas = (n: number) => Math.min(16, Math.max(0, n));
-
-  return (
-    <ScrollView style={styles.root} contentContainerStyle={{ padding: 16 }}>
-      <SectionTitle>Scaling</SectionTitle>
-      <Card>
-        <View style={styles.stepRow}>
-          <View style={{ flex: 1 }}>
-            <Text style={styles.label}>Replicas</Text>
-            <Text style={styles.sub}>Containers run per deploy; 0 parks the service.</Text>
-          </View>
-          <TouchableOpacity
-            style={styles.stepBtn}
-            onPress={() => setReplicas((r) => clampReplicas(r - 1))}
-            disabled={replicas <= 0}
-          >
-            <Text style={styles.stepText}>−</Text>
-          </TouchableOpacity>
-          <Text style={styles.stepValue}>{replicas}</Text>
-          <TouchableOpacity
-            style={styles.stepBtn}
-            onPress={() => setReplicas((r) => clampReplicas(r + 1))}
-            disabled={replicas >= 16}
-          >
-            <Text style={styles.stepText}>+</Text>
-          </TouchableOpacity>
-        </View>
-        <View style={styles.field}>
-          <Text style={styles.label}>Container port</Text>
-          <TextInput
-            style={styles.input}
-            value={port}
-            onChangeText={setPort}
-            keyboardType="number-pad"
-            placeholder="0 = none"
-            placeholderTextColor={colors.textDim}
-          />
-        </View>
-      </Card>
-
-      <SectionTitle>Scale to zero</SectionTitle>
-      <Card>
-        <View style={styles.switchRow}>
-          <View style={{ flex: 1 }}>
-            <Text style={styles.label}>Sleep when idle</Text>
-            <Text style={styles.sub}>Scales to zero after idle; incoming traffic wakes it.</Text>
-          </View>
-          <Switch
-            value={sleepEnabled}
-            onValueChange={setSleepEnabled}
-            trackColor={{ false: colors.border, true: colors.accentDim }}
-            thumbColor={sleepEnabled ? colors.accent : colors.textDim}
-          />
-        </View>
-        {sleepEnabled ? (
-          <View style={styles.field}>
-            <Text style={styles.label}>Idle minutes before sleep (1–1440)</Text>
-            <TextInput
-              style={styles.input}
-              value={sleepMinutes}
-              onChangeText={setSleepMinutes}
-              keyboardType="number-pad"
-              placeholder="30"
-              placeholderTextColor={colors.textDim}
-            />
-          </View>
-        ) : null}
-      </Card>
-
-      <ActionButton
-        label={save.isPending ? 'Saving…' : 'Save settings'}
-        kind="primary"
-        disabled={save.isPending}
-        onPress={() => save.mutate()}
-      />
-    </ScrollView>
-  );
-}
-
-const styles = StyleSheet.create({
-  root: { flex: 1, backgroundColor: colors.bg },
-  label: { color: colors.text, fontSize: 15, fontWeight: '600' },
-  sub: { color: colors.textDim, fontSize: 12, marginTop: 2 },
-  stepRow: { flexDirection: 'row', alignItems: 'center' },
-  stepBtn: {
-    width: 38,
-    height: 38,
-    borderRadius: 8,
-    backgroundColor: colors.surfaceAlt,
-    alignItems: 'center',
-    justifyContent: 'center',
-  },
-  stepText: { color: colors.text, fontSize: 20, fontWeight: '700' },
-  stepValue: {
-    color: colors.text,
-    fontSize: 18,
-    fontWeight: '700',
-    minWidth: 36,
-    textAlign: 'center',
-  },
-  switchRow: { flexDirection: 'row', alignItems: 'center' },
-  field: { marginTop: 12 },
-  input: {
-    color: colors.text,
-    backgroundColor: colors.surfaceAlt,
-    borderRadius: 8,
-    padding: 10,
-    marginTop: 6,
-    fontSize: 14,
-  },
-});

app/mobile/src/app/service/variables.tsx

@@ -1,187 +0,0 @@
-import React, { useState } from 'react';
-import {
-  Alert,
-  KeyboardAvoidingView,
-  Platform,
-  ScrollView,
-  StyleSheet,
-  Text,
-  TextInput,
-  TouchableOpacity,
-  View,
-} from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
-import { useLocalSearchParams } from 'expo-router';
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useApi } from '../../session';
-import { MASKED_SECRET, Variable } from '../../api';
-import { colors } from '../../theme';
-import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
-
-interface Row {
-  key: string;
-  value: string;
-  is_secret: boolean;
-  // Secret untouched by the user — submits the masked placeholder so the
-  // server keeps the stored ciphertext.
-  keepSecret: boolean;
-}
-
-export default function ServiceVariables() {
-  const { id, name } = useLocalSearchParams<{ id: string; name?: string }>();
-  const api = useApi();
-
-  const vars = useQuery({
-    queryKey: ['variables', id],
-    queryFn: () => api.serviceVariables(id!),
-    enabled: !!id,
-  });
-
-  if (vars.isLoading) return <Loading />;
-  if (vars.error) return <ErrorBox error={vars.error} />;
-  if (!vars.data) return <ErrorBox error={new Error('Not found')} />;
-
-  // Editor mounts once data exists; its state initializes from the fetch.
-  return <Editor serviceId={id!} name={name} initial={vars.data} />;
-}
-
-function Editor({
-  serviceId,
-  name,
-  initial,
-}: {
-  serviceId: string;
-  name?: string;
-  initial: Variable[];
-}) {
-  const api = useApi();
-  const qc = useQueryClient();
-  const [rows, setRows] = useState<Row[]>(() =>
-    initial.map((v) => ({
-      key: v.key,
-      value: v.is_secret ? '' : v.value,
-      is_secret: v.is_secret,
-      keepSecret: v.is_secret,
-    })),
-  );
-
-  const save = useMutation({
-    mutationFn: () => {
-      const clean = rows
-        .filter((r) => r.key.trim() !== '')
-        .map((r) => ({
-          key: r.key.trim(),
-          value: r.keepSecret ? MASKED_SECRET : r.value,
-          is_secret: r.is_secret,
-        }));
-      return api.updateVariables(serviceId, clean);
-    },
-    onSuccess: () => {
-      qc.invalidateQueries({ queryKey: ['variables', serviceId] });
-      qc.invalidateQueries({ queryKey: ['env-check', serviceId] });
-      Alert.alert('Saved', 'Variables apply on the next deploy/restart.');
-    },
-    onError: (e) => Alert.alert('Save failed', e instanceof Error ? e.message : String(e)),
-  });
-
-  const set = (i: number, patch: Partial<Row>) =>
-    setRows((rs) => rs.map((r, j) => (j === i ? { ...r, ...patch } : r)));
-
-  return (
-    <KeyboardAvoidingView
-      style={styles.root}
-      behavior={Platform.OS === 'ios' ? 'padding' : undefined}
-    >
-      <ScrollView contentContainerStyle={{ padding: 16 }}>
-        <Text style={styles.hint}>
-          Variables for {name ?? 'this service'}. Secret values are stored encrypted — leave a
-          secret blank to keep it, type to replace.
-        </Text>
-
-        {rows.length === 0 ? <Empty text="No variables yet" /> : null}
-        {rows.map((r, i) => (
-          <Card key={i}>
-            <View style={styles.rowHead}>
-              <TextInput
-                style={styles.keyInput}
-                value={r.key}
-                onChangeText={(t) => set(i, { key: t.toUpperCase().replace(/\s/g, '_') })}
-                placeholder="KEY"
-                placeholderTextColor={colors.textDim}
-                autoCapitalize="characters"
-                autoCorrect={false}
-              />
-              <TouchableOpacity
-                onPress={() =>
-                  set(i, r.is_secret ? { is_secret: false, keepSecret: false } : { is_secret: true })
-                }
-                hitSlop={8}
-                style={styles.iconBtn}
-              >
-                <Ionicons
-                  name={r.is_secret ? 'lock-closed' : 'lock-open-outline'}
-                  size={18}
-                  color={r.is_secret ? colors.warn : colors.textDim}
-                />
-              </TouchableOpacity>
-              <TouchableOpacity
-                onPress={() => setRows((rs) => rs.filter((_, j) => j !== i))}
-                hitSlop={8}
-                style={styles.iconBtn}
-              >
-                <Ionicons name="trash-outline" size={18} color={colors.err} />
-              </TouchableOpacity>
-            </View>
-            <TextInput
-              style={styles.valueInput}
-              value={r.value}
-              onChangeText={(t) => set(i, { value: t, keepSecret: false })}
-              placeholder={r.keepSecret ? '••••••••  (unchanged)' : 'value'}
-              placeholderTextColor={colors.textDim}
-              secureTextEntry={r.is_secret && !r.keepSecret}
-              autoCapitalize="none"
-              autoCorrect={false}
-              multiline={false}
-            />
-          </Card>
-        ))}
-
-        <ActionButton
-          label="+ Add variable"
-          onPress={() =>
-            setRows((rs) => [...rs, { key: '', value: '', is_secret: false, keepSecret: false }])
-          }
-        />
-        <ActionButton
-          label={save.isPending ? 'Saving…' : 'Save variables'}
-          kind="primary"
-          disabled={save.isPending}
-          onPress={() => save.mutate()}
-        />
-        <View style={{ height: 40 }} />
-      </ScrollView>
-    </KeyboardAvoidingView>
-  );
-}
-
-const styles = StyleSheet.create({
-  root: { flex: 1, backgroundColor: colors.bg },
-  hint: { color: colors.textDim, fontSize: 12, marginBottom: 12, lineHeight: 17 },
-  rowHead: { flexDirection: 'row', alignItems: 'center', marginBottom: 6 },
-  keyInput: {
-    flex: 1,
-    color: colors.text,
-    fontSize: 14,
-    fontWeight: '700',
-    fontFamily: Platform.OS === 'ios' ? 'Menlo' : 'monospace',
-  },
-  valueInput: {
-    color: colors.text,
-    fontSize: 14,
-    fontFamily: Platform.OS === 'ios' ? 'Menlo' : 'monospace',
-    backgroundColor: colors.surfaceAlt,
-    borderRadius: 8,
-    padding: 10,
-  },
-  iconBtn: { padding: 6, marginLeft: 6 },
-});

docs/api/openapi.yaml

@@ -2156,62 +2156,6 @@ paths:
                     items:
                       type: string
 
-  /templates/import/git:
-    post:
-      tags:
-        - Templates
-      summary: Import a compose file from a git repository
-      description: |
-        Fetches a compose file out of a git repository and runs it through
-        the same conversion as POST /templates/import/compose. `repo`
-        accepts a clone URL, ssh remote, or `owner/repo` shorthand —
-        connected git providers (including GitHub App installs) supply
-        credentials, so private repositories work. `path` defaults to
-        `compose.yaml`, `compose.yml`, `docker-compose.yml`, then
-        `docker-compose.yaml`; `ref` selects a branch or commit SHA.
-      security:
-        - bearerAuth: []
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required:
-                - repo
-              properties:
-                repo:
-                  type: string
-                  description: Clone URL, ssh remote, or owner/repo shorthand
-                path:
-                  type: string
-                  description: Repo-relative compose file path (searched by convention when empty)
-                ref:
-                  type: string
-                  description: Branch name or 40-char commit SHA
-      responses:
-        '200':
-          description: Converted config
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  config:
-                    $ref: '#/components/schemas/TemplateConfig'
-                  variables:
-                    type: array
-                    items:
-                      type: object
-                  warnings:
-                    type: array
-                    items:
-                      type: string
-        '400':
-          description: Invalid repo reference, compose file missing, or conversion error
-        '502':
-          description: Git fetch failed
-
   /templates/deploy:
     post:
       tags:
@@ -5216,7 +5160,7 @@ paths:
       tags:
         - Agents
       summary: Update node agent
-      description: Partial update — accepts any subset of agent fields (name, status, auto_prune, tags, default_domain). `tags` sets the node's placement labels; services with placement_tags only schedule onto agents carrying every required tag. `default_domain` gives the node a base domain — domainless services placed there get `<name>.<default_domain>` auto-hostnames; empty string clears it.
+      description: Partial update — accepts any subset of agent fields (name, status, auto_prune, tags). `tags` sets the node's placement labels; services with placement_tags only schedule onto agents carrying every required tag.
       security:
         - bearerAuth: []
       parameters:
@@ -7069,7 +7013,7 @@ components:
           description: Idle timeout in minutes before sleeping (1-1440, default 15)
         node_id:
           type: string
-          description: Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Git-sourced services build on the node itself (build context ships as an agent-token artifact); rollbacks of locally-built tags ship the image via docker save/load.
+          description: Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Remote nodes run registry-pulled images only (no git builds, no Traefik domains).
         node_name:
           type: string
           description: Display name of the pinned node agent (read-only)
@@ -7080,10 +7024,6 @@ components:
           type: array
           items: { type: string }
           description: Node tags required for remote placement — auto/spread only consider agents carrying every tag; re-resolved each reconcile. Mutually exclusive with an explicit node_id pin (read-only on responses when a pin is set).
-        traefik_labels:
-          type: object
-          additionalProperties: { type: string }
-          description: Extra Traefik middlewares defined for this service's router — keys 'middlewares.<name>.<type>[.<field>]' (e.g. 'middlewares.rl.ratelimit.average'), allowlist-validated; each defined middleware attaches to the router after builtins
         public_url:
           type: string
           description: Computed public URL (published port or domain)
@@ -7185,10 +7125,6 @@ components:
           type: array
           items: { type: string }
           description: Restrict remote placement to agents carrying every listed tag; mutually exclusive with an explicit pin or 'local'
-        traefik_labels:
-          type: object
-          additionalProperties: { type: string }
-          description: Extra Traefik middlewares on the service router — keys 'middlewares.<name>.<type>[.<field>]'; allowlist-validated
 
     UpdateServiceRequest:
       type: object
@@ -7285,10 +7221,6 @@ components:
           type: array
           items: { type: string }
           description: Restrict remote placement to agents carrying every listed tag; [] clears. Mutually exclusive with a pin or 'local' — clear the pin first
-        traefik_labels:
-          type: object
-          additionalProperties: { type: string }
-          description: Replace the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]'; {} clears
 
     ServiceDomain:
       type: object
@@ -9178,13 +9110,6 @@ components:
           type: array
           items: { type: string }
           description: Operator-set placement labels; services with placement_tags require all of them on the target node.
-        default_domain:
-          type: string
-          description: >-
-            Node base domain — services placed on this node (pin or spread)
-            with no explicit service_domains get `<name>.<default_domain>`
-            hostnames automatically. Wildcard DNS for `*.<default_domain>`
-            must resolve to the Containr edge.
         last_heartbeat:
           type: string
           format: date-time

docs/guides/CLI.md

@@ -161,13 +161,8 @@ containr nodes update <id> --tags gpu,eu-west
 containr services update <id> --placement-tags gpu     # only gpu nodes are eligible
 ```
 
-Remote nodes run registry-pulled images only — git builds stay local.
-Domains work remotely: the agent publishes the service port and the
-backend writes a Traefik file-provider route to the node's mesh IP
-(TRAEFIK_DYNAMIC_DIR — wired by the infra compose). Sleep mode works
-too: heartbeats carry per-container net counters, idle remote services
-lose their replicas via the agent, and the route repoints at the
-backend's wake page — the next hit reconciles the service back. Start,
+Remote nodes run registry-pulled images only — git builds, domains
+(Traefik lives on the host), and sleep detection stay local. Start,
 stop, restart, redeploy, and delete all fan out to the pinned node's
 agent. `services get` shows the resolved `node_name`.
 

infra/docker-compose.yml

@@ -7,8 +7,7 @@ services:
       - "--api.insecure=${TRAEFIK_API_INSECURE:-true}"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.file.directory=/traefik-dynamic"
-      - "--providers.file.watch=true"
+      - "--providers.file.filename=/etc/traefik/traefik-dynamic.yml"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.traefik.address=:8080"
@@ -27,8 +26,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ../data/letsencrypt:/letsencrypt
-      - traefik_dynamic:/traefik-dynamic
-      - ./traefik-dynamic.yml:/traefik-dynamic/00-base.yml:ro
+      - ./traefik-dynamic.yml:/etc/traefik/traefik-dynamic.yml:ro
     networks:
       - containr-network
     restart: unless-stopped
@@ -102,8 +100,6 @@ services:
       - JWT_SECRET=${JWT_SECRET:-dev_jwt_secret_key_change_in_production}
       - CONTAINR_AGENT_AUTH_TOKEN=${CONTAINR_AGENT_AUTH_TOKEN:-}
       - CONTAINR_AGENT_AUTH_TOKENS=${CONTAINR_AGENT_AUTH_TOKENS:-}
-      - TRAEFIK_DYNAMIC_DIR=/traefik-dynamic
-      - TRAEFIK_BACKEND_URL=http://containr-backend:8080
       - COOKIE_SECURE=${COOKIE_SECURE:-true}
       - TRUSTED_PROXY_CIDR=${TRUSTED_PROXY_CIDR:-172.20.0.0/16}
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost,http://localhost:3000}
@@ -140,7 +136,6 @@ services:
       - GITEA_BASE_URL=${GITEA_BASE_URL:-https://gitea.example.com}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - traefik_dynamic:/traefik-dynamic
     group_add:
       - "${DOCKER_GID:-0}"
     networks:
@@ -218,8 +213,6 @@ volumes:
     driver: local
   dragonfly_data:
     driver: local
-  traefik_dynamic:
-    driver: local
 
 networks:
   containr-network:

llms.txt

@@ -19,7 +19,7 @@ Base URL: `https://<host>/api/v1`. OpenAPI: `docs/api/openapi.yaml`.
 - **Variables**: service env values support `${{service.KEY}}` cross-service refs (builtins HOST/PORT) and `${{shared.KEY}}` project shared variables (`GET|PUT /projects/{id}/variables`, CLI `variables shared …`). Resolved at deploy/reconcile, not live-updated.
 - **Volumes**: service mounts via `PUT /services/{id}` `volumes: [{type: volume|bind, source, target, read_only}]` — replaces the whole list (`[]` clears), applied on next deploy. `GET /admin/volumes` inventories node volumes with `in_use` flags; `DELETE /admin/volumes/{name}` removes unused ones (admin).
 - **Domains**: multiple hostnames per service via `GET|POST /services/{id}/domains`, `DELETE /services/{id}/domains/{domain_id}`, `POST …/{domain_id}/default` (mirrors `services.domain`). `GET /services/{id}/domains/check` returns `ok|wrong-target|pending` per domain vs `app_settings.public_ip`/`PUBLIC_IP`. `PUT` `maintenance_mode` redirects all traffic to `GET /maintenance` (needs `base_url`/`BASE_URL` setting); `basic_auth: [{username,password}]` stores bcrypt htpasswd and gates the route — responses return usernames only.
-- **Builders & resources**: service field `builder` = `auto|railpack|nixpacks|dockerfile|static` (auto detects; static builds assets with `static_build_cmd` and serves `static_dir` via nginx:80). `cpu`/`memory` are hard caps; `cpu_reserve`/`memory_reserve` are soft reservations (CPU shares / MemoryReservation) — empty string clears. `app_settings.default_cpu`/`default_memory` set instance defaults; `app_settings.capacity_policy=block` rejects deploys exceeding node memory (default `warn`). Services pinned to remote node agents (`node_id`) build git sources on the node itself: the server checks out the repo, packages a Docker context artifact served over the agent-token endpoint (`GET /api/agents/artifacts/{id}`), and the node's `build_image` command runs `docker build` — no registry needed. Rollbacks of locally-built tags ship the image as a docker-save artifact consumed by `load_image`.
+- **Builders & resources**: service field `builder` = `auto|railpack|nixpacks|dockerfile|static` (auto detects; static builds assets with `static_build_cmd` and serves `static_dir` via nginx:80). `cpu`/`memory` are hard caps; `cpu_reserve`/`memory_reserve` are soft reservations (CPU shares / MemoryReservation) — empty string clears. `app_settings.default_cpu`/`default_memory` set instance defaults; `app_settings.capacity_policy=block` rejects deploys exceeding node memory (default `warn`).
 - **Clone & move**: `POST /services/{id}/clone` `{name?, project_id?, environment?}` copies config, volumes, domains, access gates, and variables (secret ciphertext verbatim; clone starts stopped). `POST /services/{id}/move` `{project_id}` re-parents a service — both require ownership of source and target; name conflicts → `CONFLICT`. Cloned domains are verbatim copies: the same hostname on two services makes routing ambiguous.
 - **Registries**: `GET|POST /registries`, `PUT|DELETE /registries/{id}` — owner-scoped private-image pull credentials, encrypted at rest, never returned (`has_password` signals presence). `host` matched against the image reference on image deploys (`docker.io` for Docker Hub; scheme/case normalized). Empty `password` on update keeps the stored credential.
 - **External databases**: `POST /databases/register-external` (probes first; `{name,type,host,port,database,username,password,ssl}`), `POST /databases/test-connection` (ad-hoc probe → `{ok,latency_ms,error}`), `POST /databases/{id}/test-connection` (re-probe with stored credentials). Rows carry `provider:"external"` + `external{host,port,database,username,has_password,ssl}`; passwords encrypted at rest, never returned. Lifecycle actions and backups reject external rows — no container exists.

scripts/build-cli.sh

@@ -38,17 +38,8 @@ for platform in $PLATFORMS; do
         -ldflags "$LDFLAGS" \
         -o "bin/${MCP_NAME}" \
         ./cmd/mcp
-done
-
-# Node agents are linux-only — the download endpoint serves the same two
-# arches, and install-agent.sh falls back to these GH release assets.
-for arch in amd64 arm64; do
-    echo "📦 Building agent for linux/${arch}..."
-    CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build \
-        -ldflags "-X main.version=${VERSION}" \
-        -o "bin/containr-agent-linux-${arch}" \
-        ./cmd/agent
-    echo "✅ Built bin/containr-agent-linux-${arch}"
+    
+    echo "✅ Built bin/${OUTPUT_NAME} + bin/${MCP_NAME}"
 done
 
 echo "🎉 CLI build complete!"

templates/n8n.md

@@ -103,8 +103,7 @@ services:
       - n8n_storage:/home/node/.n8n
     command: worker
     depends_on:
-      n8n:
-        condition: service_started
+      - n8n
       redis:
         condition: service_healthy
       postgres: