94 changed files with 1955 additions and 3306 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1,4 +0,0 @@
-Dockerfile
-.dockerignore
-*.swp
-*.swo
--- a/.drone.yml
+++ b/.drone.yml
@ -3,23 +3,35 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
  - name: make check
-    image: golang:1.20
+    image: golang:1.18
    commands:
      - make check

  - name: make build
-    image: golang:1.20
+    image: golang:1.18
    commands:
      - make build
-    depends_on:
-      - make check

  - name: make test
-    image: golang:1.20
+    image: golang:1.18
    commands:
      - make test
+
+  - name: notify on failure
+    image: plugins/matrix
+    settings:
+      homeserver: https://matrix.autonomic.zone
+      roomid: "IFazIpLtxiScqbHqoa:autonomic.zone"
+      userid: "@autono-bot:autonomic.zone"
+      accesstoken:
+        from_secret: autono_bot_access_token
    depends_on:
      - make check
+      - make build
+      - make test
+    when:
+      status:
+        - failure

  - name: fetch
    image: docker:git
@ -33,7 +45,7 @@ steps:
      event: tag

  - name: release
-    image: golang:1.20
+    image: golang:1.18
    environment:
      GITEA_TOKEN:
        from_secret: goreleaser_gitea_token
@ -47,23 +59,6 @@ steps:
    when:
      event: tag

-  - name: publish image
-    image: plugins/docker
-    settings:
-      auto_tag: true
-      username: 3wordchant
-      password:
-        from_secret: git_coopcloud_tech_token_3wc
-      repo: git.coopcloud.tech/coop-cloud/abra
-      tags: dev
-      registry: git.coopcloud.tech
-    when:
-      event:
-        exclude:
-          - pull_request
-    depends_on:
-      - make check
-
 volumes:
  - name: deps
    temp: {}
--- a/.gitignore
+++ b/.gitignore
@ -2,7 +2,6 @@
 .e2e.env
 .envrc
 .vscode/
-/kadabra
 abra
 dist/
 tests/integration/.abra/catalogue
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@ -1,76 +1,38 @@
 ---
+project_name: abra
 gitea_urls:
  api: https://git.coopcloud.tech/api/v1
  download: https://git.coopcloud.tech/
  skip_tls_verify: false
-
 before:
  hooks:
    - go mod tidy
-
+    - go generate ./...
 builds:
-  - id: abra
-    binary: abra
+  - env:
+      - CGO_ENABLED=0
    dir: cmd/abra
-    env:
-      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
-    goarch:
-      - 386
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 5
-      - 6
-      - 7
    ldflags:
      - "-X 'main.Commit={{ .Commit }}'"
      - "-X 'main.Version={{ .Version }}'"
-
-  - id: kadabra
-    binary: kadabra
-    dir: cmd/kadabra
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - 386
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 5
-      - 6
-      - 7
-    ldflags:
-      - "-X 'main.Commit={{ .Commit }}'"
-      - "-X 'main.Version={{ .Version }}'"
-
 archives:
  - replacements:
      386: i386
      amd64: x86_64
    format: binary
-
 checksum:
  name_template: "checksums.txt"
-
 snapshot:
  name_template: "{{ incpatch .Version }}-next"
-
 changelog:
  sort: desc
  filters:
    exclude:
-      - "^Merge"
-      - "^Revert"
      - "^WIP:"
-      - "^chore(deps):"
      - "^style:"
      - "^test:"
      - "^tests:"
+      - "^Revert"
--- a/AUTHORS.md
+++ b/AUTHORS.md
@ -1,13 +1,10 @@
 # authors

-> If you're looking at this and you hack on `abra` and you're not listed here,
-> please do add yourself! This is a community project, let's show some :heart:
+> If you're looking at this and you hack on Abra and you're not listed here,
+> please do add yourself! This is a community project, let's show

 - 3wordchant
- cassowary
 - decentral1se
- frando
 - kawaiipunk
 - knoflook
- moritz
 - roxxers
--- a/17
+++ b/17
@ -1,17 +0,0 @@
-FROM golang:1.20-alpine AS build
-
-ENV GOPRIVATE coopcloud.tech
-
-RUN apk add --no-cache make git gcc musl-dev
-
-COPY . /app
-
-WORKDIR /app
-
-RUN CGO_ENABLED=0 make build
-
-FROM scratch
-
-COPY --from=build /app/abra /abra
-
-ENTRYPOINT ["/abra"]
--- a/15
+++ b/15
@ -1,15 +0,0 @@
-Abra: The Co-op Cloud utility belt
-Copyright (C) 2022 Co-op Cloud <helo@coopcloud.tech>
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program.  If not, see <https://www.gnu.org/licenses/>.
--- a/19
+++ b/19
@ -1,10 +1,8 @@
-ABRA         := ./cmd/abra
-KADABRA      := ./cmd/kadabra
-COMMIT       := $(shell git rev-list -1 HEAD)
-GOPATH       := $(shell go env GOPATH)
-LDFLAGS      := "-X 'main.Commit=$(COMMIT)'"
+ABRA    := ./cmd/abra
+COMMIT  := $(shell git rev-list -1 HEAD)
+GOPATH  := $(shell go env GOPATH)
+LDFLAGS := "-X 'main.Commit=$(COMMIT)'"
 DIST_LDFLAGS := $(LDFLAGS)" -s -w"
-
 export GOPRIVATE=coopcloud.tech

 all: format check build test
@ -16,22 +14,19 @@ install:
 	@go install -ldflags=$(LDFLAGS) $(ABRA)

 build-dev:
-	@go build -v -ldflags=$(LDFLAGS) $(ABRA)
+	@go build -ldflags=$(LDFLAGS) $(ABRA)

 build:
-	@go build -v -ldflags=$(DIST_LDFLAGS) $(ABRA)
-	@go build -v -ldflags=$(DIST_LDFLAGS) $(KADABRA)
+	@go build -ldflags=$(DIST_LDFLAGS) $(ABRA)

 clean:
 	@rm '$(GOPATH)/bin/abra'
-	@rm '$(GOPATH)/bin/kadabra'

 format:
 	@gofmt -s -w .

 check:
-	@test -z $$(gofmt -l .) || \
-	(echo "gofmt: formatting issue - run 'make format' to resolve" && exit 1)
+	@test -z $$(gofmt -l .) || (echo "gofmt: formatting issue - run 'make format' to resolve" && exit 1)

 test:
 	@go test ./... -cover -v
--- a/README.md
+++ b/README.md
@ -1,12 +1,12 @@
-# `abra`
+# abra
+
+> https://coopcloud.tech

 [![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/abra/status.svg?ref=refs/heads/main)](https://build.coopcloud.tech/coop-cloud/abra)
 [![Go Report Card](https://goreportcard.com/badge/git.coopcloud.tech/coop-cloud/abra)](https://goreportcard.com/report/git.coopcloud.tech/coop-cloud/abra)

 The Co-op Cloud utility belt 🎩🐇

-<a href="https://github.com/egonelbre/gophers"><img align="right" width="150" src="https://github.com/egonelbre/gophers/raw/master/.thumb/sketch/adventure/poking-fire.png"/></a>
+`abra` is our flagship client & command-line tool which has been developed specifically in the context of the Co-op Cloud project for the purpose of making day-to-day operations for [operators](https://docs.coopcloud.tech/operators/) and [maintainers](https://docs.coopcloud.tech/maintainers/) as convenient as possible. It is libre software, written in [Go](https://go.dev) and maintained and extended by the community ❤

-`abra` is the flagship client & command-line tool for Co-op Cloud. It has been developed specifically for the purpose of making the day-to-day operations of [operators](https://docs.coopcloud.tech/operators/) and [maintainers](https://docs.coopcloud.tech/maintainers/) pleasant & convenient. It is libre software, written in [Go](https://go.dev) and maintained and extended by the community :heart:
-
-Please see [docs.coopcloud.tech/abra](https://docs.coopcloud.tech/abra) for help on install, upgrade, hacking, troubleshooting & more!
+Please see [docs.coopcloud.tech/abra/](https://docs.coopcloud.tech/abra/) for help on install, upgrade, hacking, troubleshooting & more!
--- a/cli/app/app.go
+++ b/cli/app/app.go
@ -9,29 +9,26 @@ var AppCommand = cli.Command{
 	Aliases:     []string{"a"},
 	Usage:       "Manage apps",
 	ArgsUsage:   "<domain>",
-	Description: "Functionality for managing the life cycle of your apps",
+	Description: "This command provides functionality for managing the life cycle of your apps",
 	Subcommands: []cli.Command{
-		appBackupCommand,
-		appCheckCommand,
-		appCmdCommand,
-		appConfigCommand,
-		appCpCommand,
-		appDeployCommand,
-		appErrorsCommand,
-		appListCommand,
-		appLogsCommand,
 		appNewCommand,
-		appPsCommand,
-		appRemoveCommand,
+		appConfigCommand,
 		appRestartCommand,
-		appRestoreCommand,
-		appRollbackCommand,
-		appRunCommand,
-		appSecretCommand,
-		appServicesCommand,
-		appUndeployCommand,
+		appDeployCommand,
 		appUpgradeCommand,
-		appVersionCommand,
+		appUndeployCommand,
+		appRemoveCommand,
+		appCheckCommand,
+		appListCommand,
+		appPsCommand,
+		appLogsCommand,
+		appCpCommand,
+		appRunCommand,
+		appRollbackCommand,
+		appSecretCommand,
 		appVolumeCommand,
+		appVersionCommand,
+		appErrorsCommand,
+		appCmdCommand,
 	},
 }
--- a/cli/app/backup.go
+++ b/cli/app/backup.go
@ -1,399 +0,0 @@
-package app
-
-import (
-	"archive/tar"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/config"
-	containerPkg "coopcloud.tech/abra/pkg/container"
-	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
-	"coopcloud.tech/abra/pkg/upstream/container"
-	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	dockerClient "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/system"
-	"github.com/klauspost/pgzip"
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
-)
-
-type backupConfig struct {
-	preHookCmd  string
-	postHookCmd string
-	backupPaths []string
-}
-
-var appBackupCommand = cli.Command{
-	Name:      "backup",
-	Aliases:   []string{"bk"},
-	Usage:     "Run app backup",
-	ArgsUsage: "<domain> [<service>]",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-	},
-	Before:       internal.SubCommandBefore,
-	BashComplete: autocomplete.AppNameComplete,
-	Description: `
-Run an app backup.
-
-A backup command and pre/post hook commands are defined in the recipe
-configuration. Abra reads this configuration and run the comands in the context
-of the deployed services. Pass <service> if you only want to back up a single
-service. All backups are placed in the ~/.abra/backups directory.
-
-A single backup file is produced for all backup paths specified for a service.
-If we have the following backup configuration:
-
-    - "backupbot.backup.path=/var/lib/foo,/var/lib/bar"
-
-And we run "abra app backup example.com app", Abra will produce a file that
-looks like:
-
-    ~/.abra/backups/example_com_app_609341138.tar.gz
-
-This file is a compressed archive which contains all backup paths. To see paths, run:
-
-    tar -tf ~/.abra/backups/example_com_app_609341138.tar.gz
-
-(Make sure to change the name of the backup file)
-
-This single file can be used to restore your app. See "abra app restore" for more.
-`,
-	Action: func(c *cli.Context) error {
-		app := internal.ValidateApp(c)
-		conf := runtime.New()
-
-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		recipe, err := recipe.Get(app.Recipe, conf)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		backupConfigs := make(map[string]backupConfig)
-		for _, service := range recipe.Config.Services {
-			if backupsEnabled, ok := service.Deploy.Labels["backupbot.backup"]; ok {
-				if backupsEnabled == "true" {
-					fullServiceName := fmt.Sprintf("%s_%s", app.StackName(), service.Name)
-					bkConfig := backupConfig{}
-
-					logrus.Debugf("backup config detected for %s", fullServiceName)
-
-					if paths, ok := service.Deploy.Labels["backupbot.backup.path"]; ok {
-						logrus.Debugf("detected backup paths for %s: %s", fullServiceName, paths)
-						bkConfig.backupPaths = strings.Split(paths, ",")
-					}
-
-					if preHookCmd, ok := service.Deploy.Labels["backupbot.backup.pre-hook"]; ok {
-						logrus.Debugf("detected pre-hook command for %s: %s", fullServiceName, preHookCmd)
-						bkConfig.preHookCmd = preHookCmd
-					}
-
-					if postHookCmd, ok := service.Deploy.Labels["backupbot.backup.post-hook"]; ok {
-						logrus.Debugf("detected post-hook command for %s: %s", fullServiceName, postHookCmd)
-						bkConfig.postHookCmd = postHookCmd
-					}
-
-					backupConfigs[service.Name] = bkConfig
-				}
-			}
-		}
-
-		serviceName := c.Args().Get(1)
-		if serviceName != "" {
-			backupConfig, ok := backupConfigs[serviceName]
-			if !ok {
-				logrus.Fatalf("no backup config for %s? does %s exist?", serviceName, serviceName)
-			}
-
-			logrus.Infof("running backup for the %s service", serviceName)
-
-			if err := runBackup(cl, app, serviceName, backupConfig); err != nil {
-				logrus.Fatal(err)
-			}
-		} else {
-			if len(backupConfigs) == 0 {
-				logrus.Fatalf("no backup configs discovered for %s?", app.Name)
-			}
-
-			for serviceName, backupConfig := range backupConfigs {
-				logrus.Infof("running backup for the %s service", serviceName)
-
-				if err := runBackup(cl, app, serviceName, backupConfig); err != nil {
-					logrus.Fatal(err)
-				}
-			}
-		}
-
-		return nil
-	},
-}
-
-// TimeStamp generates a file name friendly timestamp.
-func TimeStamp() string {
-	ts := time.Now().UTC().Format(time.RFC3339)
-	return strings.Replace(ts, ":", "-", -1)
-}
-
-// runBackup does the actual backup logic.
-func runBackup(cl *dockerClient.Client, app config.App, serviceName string, bkConfig backupConfig) error {
-	if len(bkConfig.backupPaths) == 0 {
-		return fmt.Errorf("backup paths are empty for %s?", serviceName)
-	}
-
-	// FIXME: avoid instantiating a new CLI
-	dcli, err := command.NewDockerCli()
-	if err != nil {
-		return err
-	}
-
-	filters := filters.NewArgs()
-	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))
-
-	targetContainer, err := containerPkg.GetContainer(context.Background(), cl, filters, true)
-	if err != nil {
-		return err
-	}
-
-	fullServiceName := fmt.Sprintf("%s_%s", app.StackName(), serviceName)
-	if bkConfig.preHookCmd != "" {
-		splitCmd := internal.SafeSplit(bkConfig.preHookCmd)
-
-		logrus.Debugf("split pre-hook command for %s into %s", fullServiceName, splitCmd)
-
-		preHookExecOpts := types.ExecConfig{
-			AttachStderr: true,
-			AttachStdin:  true,
-			AttachStdout: true,
-			Cmd:          splitCmd,
-			Detach:       false,
-			Tty:          true,
-		}
-
-		if err := container.RunExec(dcli, cl, targetContainer.ID, &preHookExecOpts); err != nil {
-			return fmt.Errorf("failed to run %s on %s: %s", bkConfig.preHookCmd, targetContainer.ID, err.Error())
-		}
-
-		logrus.Infof("succesfully ran %s pre-hook command: %s", fullServiceName, bkConfig.preHookCmd)
-	}
-
-	var tempBackupPaths []string
-	for _, remoteBackupPath := range bkConfig.backupPaths {
-		sanitisedPath := strings.ReplaceAll(remoteBackupPath, "/", "_")
-		localBackupPath := filepath.Join(config.BACKUP_DIR, fmt.Sprintf("%s%s_%s.tar.gz", fullServiceName, sanitisedPath, TimeStamp()))
-		logrus.Debugf("temporarily backing up %s:%s to %s", fullServiceName, remoteBackupPath, localBackupPath)
-
-		logrus.Infof("backing up %s:%s", fullServiceName, remoteBackupPath)
-
-		content, _, err := cl.CopyFromContainer(context.Background(), targetContainer.ID, remoteBackupPath)
-		if err != nil {
-			logrus.Debugf("failed to copy %s from container: %s", remoteBackupPath, err.Error())
-			if err := cleanupTempArchives(tempBackupPaths); err != nil {
-				return fmt.Errorf("failed to clean up temporary archives: %s", err.Error())
-			}
-			return fmt.Errorf("failed to copy %s from container: %s", remoteBackupPath, err.Error())
-		}
-		defer content.Close()
-
-		_, srcBase := archive.SplitPathDirEntry(remoteBackupPath)
-		preArchive := archive.RebaseArchiveEntries(content, srcBase, remoteBackupPath)
-		if err := copyToFile(localBackupPath, preArchive); err != nil {
-			logrus.Debugf("failed to create tar archive (%s): %s", localBackupPath, err.Error())
-			if err := cleanupTempArchives(tempBackupPaths); err != nil {
-				return fmt.Errorf("failed to clean up temporary archives: %s", err.Error())
-			}
-			return fmt.Errorf("failed to create tar archive (%s): %s", localBackupPath, err.Error())
-		}
-
-		tempBackupPaths = append(tempBackupPaths, localBackupPath)
-	}
-
-	logrus.Infof("compressing and merging archives...")
-
-	if err := mergeArchives(tempBackupPaths, fullServiceName); err != nil {
-		logrus.Debugf("failed to merge archive files: %s", err.Error())
-		if err := cleanupTempArchives(tempBackupPaths); err != nil {
-			return fmt.Errorf("failed to clean up temporary archives: %s", err.Error())
-		}
-		return fmt.Errorf("failed to merge archive files: %s", err.Error())
-	}
-
-	if err := cleanupTempArchives(tempBackupPaths); err != nil {
-		return fmt.Errorf("failed to clean up temporary archives: %s", err.Error())
-	}
-
-	if bkConfig.postHookCmd != "" {
-		splitCmd := internal.SafeSplit(bkConfig.postHookCmd)
-
-		logrus.Debugf("split post-hook command for %s into %s", fullServiceName, splitCmd)
-
-		postHookExecOpts := types.ExecConfig{
-			AttachStderr: true,
-			AttachStdin:  true,
-			AttachStdout: true,
-			Cmd:          splitCmd,
-			Detach:       false,
-			Tty:          true,
-		}
-
-		if err := container.RunExec(dcli, cl, targetContainer.ID, &postHookExecOpts); err != nil {
-			return err
-		}
-
-		logrus.Infof("succesfully ran %s post-hook command: %s", fullServiceName, bkConfig.postHookCmd)
-	}
-
-	return nil
-}
-
-func copyToFile(outfile string, r io.Reader) error {
-	tmpFile, err := system.TempFileSequential(filepath.Dir(outfile), ".tar_temp")
-	if err != nil {
-		return err
-	}
-
-	tmpPath := tmpFile.Name()
-
-	_, err = io.Copy(tmpFile, r)
-	tmpFile.Close()
-
-	if err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-
-	if err = os.Rename(tmpPath, outfile); err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-
-	return nil
-}
-
-func cleanupTempArchives(tarPaths []string) error {
-	for _, tarPath := range tarPaths {
-		if err := os.RemoveAll(tarPath); err != nil {
-			return err
-		}
-
-		logrus.Debugf("remove temporary archive file %s", tarPath)
-	}
-
-	return nil
-}
-
-func mergeArchives(tarPaths []string, serviceName string) error {
-	var out io.Writer
-	var cout *pgzip.Writer
-
-	localBackupPath := filepath.Join(config.BACKUP_DIR, fmt.Sprintf("%s_%s.tar.gz", serviceName, TimeStamp()))
-
-	fout, err := os.Create(localBackupPath)
-	if err != nil {
-		return fmt.Errorf("Failed to open %s: %s", localBackupPath, err)
-	}
-
-	defer fout.Close()
-	out = fout
-
-	cout = pgzip.NewWriter(out)
-	out = cout
-
-	tw := tar.NewWriter(out)
-
-	for _, tarPath := range tarPaths {
-		if err := addTar(tw, tarPath); err != nil {
-			return fmt.Errorf("failed to merge %s: %v", tarPath, err)
-		}
-	}
-
-	if err := tw.Close(); err != nil {
-		return fmt.Errorf("failed to close tar writer %v", err)
-	}
-
-	if cout != nil {
-		if err := cout.Flush(); err != nil {
-			return fmt.Errorf("failed to flush: %s", err)
-		} else if err = cout.Close(); err != nil {
-			return fmt.Errorf("failed to close compressed writer: %s", err)
-		}
-	}
-
-	logrus.Infof("backed up %s to %s", serviceName, localBackupPath)
-
-	return nil
-}
-
-func addTar(tw *tar.Writer, pth string) (err error) {
-	var tr *tar.Reader
-	var rc io.ReadCloser
-	var hdr *tar.Header
-
-	if tr, rc, err = openTarFile(pth); err != nil {
-		return
-	}
-
-	for {
-		if hdr, err = tr.Next(); err != nil {
-			if err == io.EOF {
-				err = nil
-			}
-			break
-		}
-		if err = tw.WriteHeader(hdr); err != nil {
-			break
-		} else if _, err = io.Copy(tw, tr); err != nil {
-			break
-		}
-	}
-	if err == nil {
-		err = rc.Close()
-	} else {
-		rc.Close()
-	}
-	return
-}
-
-func openTarFile(pth string) (tr *tar.Reader, rc io.ReadCloser, err error) {
-	var fin *os.File
-	var n int
-	buff := make([]byte, 1024)
-
-	if fin, err = os.Open(pth); err != nil {
-		return
-	}
-
-	if n, err = fin.Read(buff); err != nil {
-		fin.Close()
-		return
-	} else if n == 0 {
-		fin.Close()
-		err = fmt.Errorf("%s is empty", pth)
-		return
-	}
-
-	if _, err = fin.Seek(0, 0); err != nil {
-		fin.Close()
-		return
-	}
-
-	rc = fin
-	tr = tar.NewReader(rc)
-
-	return tr, rc, nil
-}
--- a/cli/app/cmd.go
+++ b/cli/app/cmd.go
@ -20,18 +20,24 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )

+var localCmd bool
+var localCmdFlag = &cli.BoolFlag{
+	Name:        "local, l",
+	Usage:       "Run command locally",
+	Destination: &localCmd,
+}
+
 var appCmdCommand = cli.Command{
 	Name:    "command",
 	Aliases: []string{"cmd"},
 	Usage:   "Run app commands",
 	Description: `
-Run an app specific command.
+This command runs app specific commands.

 These commands are bash functions, defined in the abra.sh of the recipe itself.
 They can be run within the context of a service (e.g. app) or locally on your
@ -42,28 +48,24 @@ Example:

  abra app cmd example.com app create_user -- me@example.com
 `,
-	ArgsUsage: "<domain> [<service>] <command> [-- <args>]",
+	ArgsUsage: "<domain> [<service>] <command>",
 	Flags: []cli.Flag{
 		internal.DebugFlag,
-		internal.LocalCmdFlag,
-		internal.RemoteUserFlag,
+		localCmdFlag,
 	},
 	BashComplete: autocomplete.AppNameComplete,
 	Before:       internal.SubCommandBefore,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
+		if len(c.Args()) <= 2 && !localCmd {
+			internal.ShowSubcommandHelpAndError(c, errors.New("missing <service>/<command>? did you mean to pass --local?"))
 		}

-		if internal.LocalCmd && internal.RemoteUser != "" {
-			internal.ShowSubcommandHelpAndError(c, errors.New("cannot use --local & --user together"))
+		if len(c.Args()) > 2 && localCmd {
+			internal.ShowSubcommandHelpAndError(c, errors.New("cannot specify <service> and --local together"))
 		}

-		hasCmdArgs, parsedCmdArgs := parseCmdArgs(c.Args(), internal.LocalCmd)
-
 		abraSh := path.Join(config.RECIPES_DIR, app.Recipe, "abra.sh")
 		if _, err := os.Stat(abraSh); err != nil {
 			if os.IsNotExist(err) {
@ -72,7 +74,7 @@ Example:
 			logrus.Fatal(err)
 		}

-		if internal.LocalCmd {
+		if localCmd {
 			cmdName := c.Args().Get(1)
 			if err := ensureCommand(abraSh, app.Recipe, cmdName); err != nil {
 				logrus.Fatal(err)
@ -80,26 +82,8 @@ Example:

 			logrus.Debugf("--local detected, running %s on local work station", cmdName)

-			var exportEnv string
-			for k, v := range app.Env {
-				exportEnv = exportEnv + fmt.Sprintf("%s='%s'; ", k, v)
-			}
-			var sourceAndExec string
-			if hasCmdArgs {
-				logrus.Debugf("parsed following command arguments: %s", parsedCmdArgs)
-				sourceAndExec = fmt.Sprintf("TARGET=local; APP_NAME=%s; STACK_NAME=%s; %s . %s; %s %s", app.Name, app.StackName(), exportEnv, abraSh, cmdName, parsedCmdArgs)
-			} else {
-				logrus.Debug("did not detect any command arguments")
-				sourceAndExec = fmt.Sprintf("TARGET=local; APP_NAME=%s; STACK_NAME=%s; %s . %s; %s", app.Name, app.StackName(), exportEnv, abraSh, cmdName)
-			}
-
-			shell := "/bin/bash"
-			if _, err := os.Stat(shell); errors.Is(err, os.ErrNotExist) {
-				logrus.Debugf("%s does not exist locally, use /bin/sh as fallback", shell)
-				shell = "/bin/sh"
-			}
-			cmd := exec.Command(shell, "-c", sourceAndExec)
-
+			sourceAndExec := fmt.Sprintf("TARGET=local; APP_NAME=%s; . %s; %s", app.StackName(), abraSh, cmdName)
+			cmd := exec.Command("/bin/sh", "-c", sourceAndExec)
 			if err := internal.RunCmd(cmd); err != nil {
 				logrus.Fatal(err)
 			}
@ -129,13 +113,27 @@ Example:

 			logrus.Debugf("running command %s within the context of %s_%s", cmdName, app.StackName(), targetServiceName)

+			var parsedCmdArgs string
+			var cmdArgsIdx int
+			var hasCmdArgs bool
+			for idx, arg := range c.Args() {
+				if arg == "--" {
+					cmdArgsIdx = idx
+					hasCmdArgs = true
+				}
+
+				if hasCmdArgs && idx > cmdArgsIdx {
+					parsedCmdArgs += fmt.Sprintf("%s ", c.Args().Get(idx))
+				}
+			}
+
 			if hasCmdArgs {
 				logrus.Debugf("parsed following command arguments: %s", parsedCmdArgs)
 			} else {
 				logrus.Debug("did not detect any command arguments")
 			}

-			if err := runCmdRemote(cl, app, abraSh, targetServiceName, cmdName, parsedCmdArgs); err != nil {
+			if err := runCmdRemote(app, abraSh, targetServiceName, cmdName, parsedCmdArgs); err != nil {
 				logrus.Fatal(err)
 			}
 		}
@ -144,25 +142,6 @@ Example:
 	},
 }

-func parseCmdArgs(args []string, isLocal bool) (bool, string) {
-	var (
-		parsedCmdArgs string
-		hasCmdArgs    bool
-	)
-
-	if isLocal {
-		if len(args) > 2 {
-			return true, fmt.Sprintf("%s ", strings.Join(args[2:], " "))
-		}
-	} else {
-		if len(args) > 3 {
-			return true, fmt.Sprintf("%s ", strings.Join(args[3:], " "))
-		}
-	}
-
-	return hasCmdArgs, parsedCmdArgs
-}
-
 func ensureCommand(abraSh, recipeName, execCmd string) error {
 	bytes, err := ioutil.ReadFile(abraSh)
 	if err != nil {
@ -176,7 +155,12 @@ func ensureCommand(abraSh, recipeName, execCmd string) error {
 	return nil
 }

-func runCmdRemote(cl *dockerClient.Client, app config.App, abraSh, serviceName, cmdName, cmdArgs string) error {
+func runCmdRemote(app config.App, abraSh, serviceName, cmdName, cmdArgs string) error {
+	cl, err := client.New(app.Server)
+	if err != nil {
+		return err
+	}
+
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))

@ -198,45 +182,30 @@ func runCmdRemote(cl *dockerClient.Client, app config.App, abraSh, serviceName,
 		return err
 	}

+	var cmd []string
+	if cmdArgs != "" {
+		cmd = []string{"/bin/sh", "-c", fmt.Sprintf("TARGET=%s; APP_NAME=%s; . /tmp/abra.sh; %s %s", serviceName, app.StackName(), cmdName, cmdArgs)}
+	} else {
+		cmd = []string{"/bin/sh", "-c", fmt.Sprintf("TARGET=%s; APP_NAME=%s; . /tmp/abra.sh; %s", serviceName, app.StackName(), cmdName)}
+	}
+
+	logrus.Debugf("running command: %s", strings.Join(cmd, " "))
+
+	execCreateOpts := types.ExecConfig{
+		AttachStderr: true,
+		AttachStdin:  true,
+		AttachStdout: true,
+		Cmd:          cmd,
+		Detach:       false,
+		Tty:          true,
+	}
+
 	// FIXME: avoid instantiating a new CLI
 	dcli, err := command.NewDockerCli()
 	if err != nil {
 		return err
 	}

-	shell := "/bin/bash"
-	findShell := []string{"test", "-e", shell}
-	execCreateOpts := types.ExecConfig{
-		AttachStderr: true,
-		AttachStdin:  true,
-		AttachStdout: true,
-		Cmd:          findShell,
-		Detach:       false,
-		Tty:          false,
-	}
-
-	if err := container.RunExec(dcli, cl, targetContainer.ID, &execCreateOpts); err != nil {
-		logrus.Infof("%s does not exist for %s, use /bin/sh as fallback", shell, app.Name)
-		shell = "/bin/sh"
-	}
-
-	var cmd []string
-	if cmdArgs != "" {
-		cmd = []string{shell, "-c", fmt.Sprintf("TARGET=%s; APP_NAME=%s; STACK_NAME=%s; . /tmp/abra.sh; %s %s", serviceName, app.Name, app.StackName(), cmdName, cmdArgs)}
-	} else {
-		cmd = []string{shell, "-c", fmt.Sprintf("TARGET=%s; APP_NAME=%s; STACK_NAME=%s; . /tmp/abra.sh; %s", serviceName, app.Name, app.StackName(), cmdName)}
-	}
-
-	logrus.Debugf("running command: %s", strings.Join(cmd, " "))
-
-	if internal.RemoteUser != "" {
-		logrus.Debugf("running command with user %s", internal.RemoteUser)
-		execCreateOpts.User = internal.RemoteUser
-	}
-
-	execCreateOpts.Cmd = cmd
-	execCreateOpts.Tty = true
-
 	if err := container.RunExec(dcli, cl, targetContainer.ID, &execCreateOpts); err != nil {
 		return err
 	}
--- a/cli/app/cmd_test.go
+++ b/cli/app/cmd_test.go
@ -1,31 +0,0 @@
-package app
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestParseCmdArgs(t *testing.T) {
-	tests := []struct {
-		input          []string
-		shouldParse    bool
-		expectedOutput string
-	}{
-		// `--` is not parsed when passed in from the command-line e.g. -- foo bar baz
-		// so we need to eumlate that as missing when testing if bash args are passed in
-		// see https://git.coopcloud.tech/coop-cloud/organising/issues/336 for more
-		{[]string{"foo.com", "app", "test"}, false, ""},
-		{[]string{"foo.com", "app", "test", "foo"}, true, "foo "},
-		{[]string{"foo.com", "app", "test", "foo", "bar", "baz"}, true, "foo bar baz "},
-	}
-
-	for _, test := range tests {
-		ok, parsed := parseCmdArgs(test.input, false)
-		if ok != test.shouldParse {
-			t.Fatalf("[%s] should not parse", strings.Join(test.input, " "))
-		}
-		if parsed != test.expectedOutput {
-			t.Fatalf("%s does not match %s", parsed, test.expectedOutput)
-		}
-	}
-}
--- a/cli/app/cp.go
+++ b/cli/app/cp.go
@ -14,7 +14,6 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
@ -31,7 +30,7 @@ var appCpCommand = cli.Command{
 	Before: internal.SubCommandBefore,
 	Usage:  "Copy files to/from a running app service",
 	Description: `
-Copy files to and from any app service file system.
+This command supports copying files to and from any app service file system.

 If you want to copy a myfile.txt to the root of the app service:

@ -44,11 +43,6 @@ And if you want to copy that file back to your current working directory locally
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
 		src := c.Args().Get(1)
 		dst := c.Args().Get(2)
 		if src == "" {
@ -94,24 +88,28 @@ And if you want to copy that file back to your current working directory locally
 				logrus.Fatalf("%s does not exist locally?", dstPath)
 			}
 		}
-
-		if err := configureAndCp(c, cl, app, srcPath, dstPath, service, isToContainer); err != nil {
+		err := configureAndCp(c, app, srcPath, dstPath, service, isToContainer)
+		if err != nil {
 			logrus.Fatal(err)
 		}
-
 		return nil
+
 	},
 	BashComplete: autocomplete.AppNameComplete,
 }

 func configureAndCp(
 	c *cli.Context,
-	cl *dockerClient.Client,
 	app config.App,
 	srcPath string,
 	dstPath string,
 	service string,
 	isToContainer bool) error {
+	cl, err := client.New(app.Server)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service))

--- a/cli/app/deploy.go
+++ b/cli/app/deploy.go
@ -21,8 +21,9 @@ var appDeployCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Deploy an app. It does not support incrementing the version of a deployed app,
-for this you need to look at the "abra app upgrade <domain>" command.
+This command deploys an app. It does not support incrementing the version of a
+deployed app, for this you need to look at the "abra app upgrade <domain>"
+command.

 You may pass "--force" to re-deploy the same version again. This can be useful
 if the container runtime has gotten into a weird state.
--- a/cli/app/errors.go
+++ b/cli/app/errors.go
@ -12,7 +12,6 @@ import (
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
@ -26,7 +25,7 @@ var appErrorsCommand = cli.Command{
 	Usage:     "List errors for a deployed app",
 	ArgsUsage: "<domain>",
 	Description: `
-List errors for a deployed app.
+This command lists errors for a deployed app.

 This is a best-effort implementation and an attempt to gather a number of tips
 & tricks for finding errors together into one convenient command. When an app
@ -56,7 +55,6 @@ the logs.
 	BashComplete: autocomplete.AppNameComplete,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
-		conf := runtime.New()

 		cl, err := client.New(app.Server)
 		if err != nil {
@ -73,14 +71,14 @@ the logs.
 		}

 		if !internal.Watch {
-			if err := checkErrors(c, cl, app, conf); err != nil {
+			if err := checkErrors(c, cl, app); err != nil {
 				logrus.Fatal(err)
 			}
 			return nil
 		}

 		for {
-			if err := checkErrors(c, cl, app, conf); err != nil {
+			if err := checkErrors(c, cl, app); err != nil {
 				logrus.Fatal(err)
 			}
 			time.Sleep(2 * time.Second)
@ -90,8 +88,8 @@ the logs.
 	},
 }

-func checkErrors(c *cli.Context, cl *dockerClient.Client, app config.App, conf *runtime.Config) error {
-	recipe, err := recipe.Get(app.Recipe, conf)
+func checkErrors(c *cli.Context, cl *dockerClient.Client, app config.App) error {
+	recipe, err := recipe.Get(app.Recipe)
 	if err != nil {
 		return err
 	}
--- a/cli/app/list.go
+++ b/cli/app/list.go
@ -1,7 +1,6 @@
 package app

 import (
-	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
@ -10,6 +9,7 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/recipe"
+	"coopcloud.tech/abra/pkg/ssh"
 	"coopcloud.tech/tagcmp"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
@ -22,12 +22,12 @@ var statusFlag = &cli.BoolFlag{
 	Destination: &status,
 }

-var recipeFilter string
+var appRecipe string
 var recipeFlag = &cli.StringFlag{
 	Name:        "recipe, r",
 	Value:       "",
 	Usage:       "Show apps of a specific recipe",
-	Destination: &recipeFilter,
+	Destination: &appRecipe,
 }

 var listAppServer string
@ -39,22 +39,22 @@ var listAppServerFlag = &cli.StringFlag{
 }

 type appStatus struct {
-	Server  string `json:"server"`
-	Recipe  string `json:"recipe"`
-	AppName string `json:"appName"`
-	Domain  string `json:"domain"`
-	Status  string `json:"status"`
-	Version string `json:"version"`
-	Upgrade string `json:"upgrade"`
+	server  string
+	recipe  string
+	appName string
+	domain  string
+	status  string
+	version string
+	upgrade string
 }

 type serverStatus struct {
-	Apps             []appStatus `json:"apps"`
-	AppCount         int         `json:"appCount"`
-	VersionCount     int         `json:"versionCount"`
-	UnversionedCount int         `json:"unversionedCount"`
-	LatestCount      int         `json:"latestCount"`
-	UpgradeCount     int         `json:"upgradeCount"`
+	apps             []appStatus
+	appCount         int
+	versionCount     int
+	unversionedCount int
+	latestCount      int
+	upgradeCount     int
 }

 var appListCommand = cli.Command{
@ -62,8 +62,8 @@ var appListCommand = cli.Command{
 	Aliases: []string{"ls"},
 	Usage:   "List all managed apps",
 	Description: `
-Read the local file system listing of apps and servers (e.g. ~/.abra/) to
-generate a report of all your apps.
+This command looks at your local file system listing of apps and servers (e.g.
+in ~/.abra/) to generate a report of all your apps.

 By passing the "--status/-S" flag, you can query all your servers for the
 actual live deployment status. Depending on how many servers you manage, this
@ -71,7 +71,6 @@ can take some time.
 `,
 	Flags: []cli.Flag{
 		internal.DebugFlag,
-		internal.MachineReadableFlag,
 		statusFlag,
 		listAppServerFlag,
 		recipeFlag,
@ -83,7 +82,7 @@ can take some time.
 			logrus.Fatal(err)
 		}

-		apps, err := config.GetApps(appFiles, recipeFilter)
+		apps, err := config.GetApps(appFiles)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -96,15 +95,19 @@ can take some time.
 			alreadySeen := make(map[string]bool)
 			for _, app := range apps {
 				if _, ok := alreadySeen[app.Server]; !ok {
+					if err := ssh.EnsureHostKey(app.Server); err != nil {
+						logrus.Fatal(fmt.Sprintf(internal.SSHFailMsg, app.Server))
+					}
 					alreadySeen[app.Server] = true
 				}
 			}

-			statuses, err = config.GetAppStatuses(apps, internal.MachineReadable)
+			statuses, err = config.GetAppStatuses(appFiles)
 			if err != nil {
 				logrus.Fatal(err)
 			}

+			var err error
 			catl, err = recipe.ReadRecipeCatalogue()
 			if err != nil {
 				logrus.Fatal(err)
@ -119,20 +122,20 @@ can take some time.
 			var ok bool
 			if stats, ok = allStats[app.Server]; !ok {
 				stats = serverStatus{}
-				if recipeFilter == "" {
+				if appRecipe == "" {
 					// count server, no filtering
 					totalServersCount++
 				}
 			}

-			if app.Recipe == recipeFilter || recipeFilter == "" {
-				if recipeFilter != "" {
+			if app.Recipe == appRecipe || appRecipe == "" {
+				if appRecipe != "" {
 					// only count server if matches filter
 					totalServersCount++
 				}

 				appStats := appStatus{}
-				stats.AppCount++
+				stats.appCount++
 				totalAppsCount++

 				if status {
@ -147,13 +150,13 @@ can take some time.
 						if statusMeta["status"] != "" {
 							status = statusMeta["status"]
 						}
-						stats.VersionCount++
+						stats.versionCount++
 					} else {
-						stats.UnversionedCount++
+						stats.unversionedCount++
 					}

-					appStats.Status = status
-					appStats.Version = version
+					appStats.status = status
+					appStats.version = version

 					var newUpdates []string
 					if version != "unknown" {
@ -181,38 +184,29 @@ can take some time.

 					if len(newUpdates) == 0 {
 						if version == "unknown" {
-							appStats.Upgrade = "unknown"
+							appStats.upgrade = "unknown"
 						} else {
-							appStats.Upgrade = "latest"
-							stats.LatestCount++
+							appStats.upgrade = "latest"
+							stats.latestCount++
 						}
 					} else {
 						newUpdates = internal.ReverseStringList(newUpdates)
-						appStats.Upgrade = strings.Join(newUpdates, "\n")
-						stats.UpgradeCount++
+						appStats.upgrade = strings.Join(newUpdates, "\n")
+						stats.upgradeCount++
 					}
 				}

-				appStats.Server = app.Server
-				appStats.Recipe = app.Recipe
-				appStats.AppName = app.Name
-				appStats.Domain = app.Domain
+				appStats.server = app.Server
+				appStats.recipe = app.Recipe
+				appStats.appName = app.Name
+				appStats.domain = app.Domain

-				stats.Apps = append(stats.Apps, appStats)
+				stats.apps = append(stats.apps, appStats)
 			}
+
 			allStats[app.Server] = stats
 		}

-		if internal.MachineReadable {
-			jsonstring, err := json.Marshal(allStats)
-			if err != nil {
-				logrus.Fatal(err)
-			} else {
-				fmt.Println(string(jsonstring))
-			}
-			return nil
-		}
-
 		alreadySeen := make(map[string]bool)
 		for _, app := range apps {
 			if _, ok := alreadySeen[app.Server]; ok {
@ -228,10 +222,10 @@ can take some time.

 			table := formatter.CreateTable(tableCol)

-			for _, appStat := range serverStat.Apps {
-				tableRow := []string{appStat.Recipe, appStat.Domain}
+			for _, appStat := range serverStat.apps {
+				tableRow := []string{appStat.recipe, appStat.domain}
 				if status {
-					tableRow = append(tableRow, []string{appStat.Status, appStat.Version, appStat.Upgrade}...)
+					tableRow = append(tableRow, []string{appStat.status, appStat.version, appStat.upgrade}...)
 				}
 				table.Append(tableRow)
 			}
@ -243,14 +237,14 @@ can take some time.
 					fmt.Println(fmt.Sprintf(
 						"server: %s | total apps: %v | versioned: %v | unversioned: %v | latest: %v | upgrade: %v",
 						app.Server,
-						serverStat.AppCount,
-						serverStat.VersionCount,
-						serverStat.UnversionedCount,
-						serverStat.LatestCount,
-						serverStat.UpgradeCount,
+						serverStat.appCount,
+						serverStat.versionCount,
+						serverStat.unversionedCount,
+						serverStat.latestCount,
+						serverStat.upgradeCount,
 					))
 				} else {
-					fmt.Println(fmt.Sprintf("server: %s | total apps: %v", app.Server, serverStat.AppCount))
+					fmt.Println(fmt.Sprintf("server: %s | total apps: %v", app.Server, serverStat.appCount))
 				}
 			}

--- a/cli/app/logs.go
+++ b/cli/app/logs.go
@ -11,7 +11,6 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/config"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/abra/pkg/service"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
@ -21,19 +20,17 @@ import (
 )

 var logOpts = types.ContainerLogsOptions{
+	Details:    false,
+	Follow:     true,
 	ShowStderr: true,
 	ShowStdout: true,
-	Since:      "",
-	Until:      "",
-	Timestamps: true,
-	Follow:     true,
 	Tail:       "20",
-	Details:    false,
+	Timestamps: true,
 }

 // stackLogs lists logs for all stack services
 func stackLogs(c *cli.Context, app config.App, client *dockerClient.Client) {
-	filters, err := app.Filters(true, false)
+	filters, err := app.Filters()
 	if err != nil {
 		logrus.Fatal(err)
 	}
@ -77,21 +74,18 @@ var appLogsCommand = cli.Command{
 	Usage:     "Tail app logs",
 	Flags: []cli.Flag{
 		internal.StdErrOnlyFlag,
-		internal.SinceLogsFlag,
 		internal.DebugFlag,
 	},
 	Before:       internal.SubCommandBefore,
 	BashComplete: autocomplete.AppNameComplete,
 	Action: func(c *cli.Context) error {
-		app := internal.ValidateApp(c, runtime.WithEnsureRecipeExists(false))
+		app := internal.ValidateApp(c)

 		cl, err := client.New(app.Server)
 		if err != nil {
 			logrus.Fatal(err)
 		}

-		logOpts.Since = internal.SinceLogs
-
 		serviceName := c.Args().Get(1)
 		if serviceName == "" {
 			logrus.Debugf("tailing logs for all %s services", app.Recipe)
@ -109,7 +103,7 @@ var appLogsCommand = cli.Command{

 func tailServiceLogs(c *cli.Context, cl *dockerClient.Client, app config.App, serviceName string) error {
 	filters := filters.NewArgs()
-	filters.Add("name", fmt.Sprintf("%s_%s", app.StackName(), serviceName))
+	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))

 	chosenService, err := service.GetService(context.Background(), cl, filters, internal.NoInput)
 	if err != nil {
--- a/cli/app/new.go
+++ b/cli/app/new.go
@ -7,8 +7,8 @@ import (
 )

 var appNewDescription = `
-Take a recipe and uses it to create a new app. This new app configuration is
-stored in your ~/.abra directory under the appropriate server.
+This command takes a recipe and uses it to create a new app. This new app
+configuration is stored in your ~/.abra directory under the appropriate server.

 This command does not deploy your app for you. You will need to run "abra app
 deploy <domain>" to do so.
--- a/cli/app/ps.go
+++ b/cli/app/ps.go
@ -25,7 +25,7 @@ var appPsCommand = cli.Command{
 	Aliases:     []string{"p"},
 	Usage:       "Check app status",
 	ArgsUsage:   "<domain>",
-	Description: "Show a more detailed status output of a specific deployed app",
+	Description: "This command shows a more detailed status output of a specific deployed app.",
 	Flags: []cli.Flag{
 		internal.WatchFlag,
 		internal.DebugFlag,
@ -66,7 +66,7 @@ var appPsCommand = cli.Command{

 // showPSOutput renders ps output.
 func showPSOutput(c *cli.Context, app config.App, cl *dockerClient.Client) {
-	filters, err := app.Filters(true, true)
+	filters, err := app.Filters()
 	if err != nil {
 		logrus.Fatal(err)
 	}
--- a/cli/app/remove.go
+++ b/cli/app/remove.go
@ -15,43 +15,35 @@ import (
 	"github.com/urfave/cli"
 )

+// Volumes stores the variable from VolumesFlag
+var Volumes bool
+
+// VolumesFlag is used to specify if volumes should be deleted when deleting an app
+var VolumesFlag = &cli.BoolFlag{
+	Name:        "volumes, V",
+	Destination: &Volumes,
+}
+
 var appRemoveCommand = cli.Command{
 	Name:      "remove",
 	Aliases:   []string{"rm"},
 	ArgsUsage: "<domain>",
-	Usage:     "Remove all app data, locally and remotely",
-	Description: `
-This command removes everything related to an app which is already undeployed.
-
-By default, it will prompt for confirmation before proceeding. All secrets,
-volumes and the local app env file will be deleted.
-
-Only run this command when you are sure you want to completely remove the app
-and all associated app data. This is a destructive action, Be Careful!
-
-If you would like to delete specific volumes or secrets, please use removal
-sub-commands under "app volume" and "app secret" instead.
-
-Please note, if you delete the local app env file without removing volumes and
-secrets first, Abra will *not* be able to help you remove them afterwards.
-
-To delete everything without prompt, use the "--force/-f" or the "--no-input/n"
-flag.
-`,
+	Usage:     "Remove an already undeployed app",
 	Flags: []cli.Flag{
+		VolumesFlag,
 		internal.ForceFlag,
 		internal.DebugFlag,
 		internal.NoInputFlag,
 	},
-	BashComplete: autocomplete.AppNameComplete,
-	Before:       internal.SubCommandBefore,
+	Before: internal.SubCommandBefore,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

 		if !internal.Force && !internal.NoInput {
 			response := false
-			msg := "ALERTA ALERTA: this will completely remove %s data and configurations locally and remotely, are you sure?"
-			prompt := &survey.Confirm{Message: fmt.Sprintf(msg, app.Name)}
+			prompt := &survey.Confirm{
+				Message: fmt.Sprintf("about to remove %s, are you sure?", app.Name),
+			}
 			if err := survey.AskOne(prompt, &response); err != nil {
 				logrus.Fatal(err)
 			}
@ -73,7 +65,7 @@ flag.
 			logrus.Fatalf("%s is still deployed. Run \"abra app undeploy %s\"", app.Name, app.Name)
 		}

-		fs, err := app.Filters(false, false)
+		fs, err := app.Filters()
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -92,7 +84,26 @@ flag.
 		}

 		if len(secrets) > 0 {
-			for _, name := range secretNames {
+			var secretNamesToRemove []string
+
+			if !internal.Force && !internal.NoInput {
+				secretsPrompt := &survey.MultiSelect{
+					Message: "which secrets do you want to remove?",
+					Help:    "'x' indicates selected, enter / return to confirm, ctrl-c to exit, vim mode is enabled",
+					VimMode: true,
+					Options: secretNames,
+					Default: secretNames,
+				}
+				if err := survey.AskOne(secretsPrompt, &secretNamesToRemove); err != nil {
+					logrus.Fatal(err)
+				}
+			}
+
+			if internal.Force || internal.NoInput {
+				secretNamesToRemove = secretNames
+			}
+
+			for _, name := range secretNamesToRemove {
 				err := cl.SecretRemove(context.Background(), secrets[name])
 				if err != nil {
 					logrus.Fatal(err)
@ -103,11 +114,6 @@ flag.
 			logrus.Info("no secrets to remove")
 		}

-		fs, err = app.Filters(false, true)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
 		volumeListOKBody, err := cl.VolumeList(context.Background(), fs)
 		volumeList := volumeListOKBody.Volumes
 		if err != nil {
@ -120,24 +126,44 @@ flag.
 		}

 		if len(vols) > 0 {
-			var removeVols []string
-			for _, vol := range removeVols {
-				err := cl.VolumeRemove(context.Background(), vol, internal.Force) // last argument is for force removing
-				if err != nil {
-					logrus.Fatal(err)
+			if Volumes {
+				var removeVols []string
+				if !internal.Force && !internal.NoInput {
+					volumesPrompt := &survey.MultiSelect{
+						Message: "which volumes do you want to remove?",
+						Help:    "'x' indicates selected, enter / return to confirm, ctrl-c to exit, vim mode is enabled",
+						VimMode: true,
+						Options: vols,
+						Default: vols,
+					}
+					if err := survey.AskOne(volumesPrompt, &removeVols); err != nil {
+						logrus.Fatal(err)
+					}
 				}
-				logrus.Info(fmt.Sprintf("volume %s removed", vol))
+
+				for _, vol := range removeVols {
+					err := cl.VolumeRemove(context.Background(), vol, internal.Force) // last argument is for force removing
+					if err != nil {
+						logrus.Fatal(err)
+					}
+					logrus.Info(fmt.Sprintf("volume %s removed", vol))
+				}
+			} else {
+				logrus.Info("no volumes were removed")
 			}
 		} else {
-			logrus.Info("no volumes to remove")
+			if Volumes {
+				logrus.Info("no volumes to remove")
+			}
 		}

-		if err = os.Remove(app.Path); err != nil {
+		err = os.Remove(app.Path)
+		if err != nil {
 			logrus.Fatal(err)
 		}
-
 		logrus.Info(fmt.Sprintf("file: %s removed", app.Path))

 		return nil
 	},
+	BashComplete: autocomplete.AppNameComplete,
 }
--- a/cli/app/restore.go
+++ b/cli/app/restore.go
@ -1,205 +0,0 @@
-package app
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/config"
-	containerPkg "coopcloud.tech/abra/pkg/container"
-	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
-	"coopcloud.tech/abra/pkg/upstream/container"
-	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	dockerClient "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
-)
-
-type restoreConfig struct {
-	preHookCmd  string
-	postHookCmd string
-}
-
-var appRestoreCommand = cli.Command{
-	Name:      "restore",
-	Aliases:   []string{"rs"},
-	Usage:     "Run app restore",
-	ArgsUsage: "<domain> <service> <file>",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-	},
-	Before:       internal.SubCommandBefore,
-	BashComplete: autocomplete.AppNameComplete,
-	Description: `
-Run an app restore.
-
-Pre/post hook commands are defined in the recipe configuration. Abra reads this
-configuration and run the comands in the context of the service before
-restoring the backup.
-
-Unlike "abra app backup", restore must be run on a per-service basis. You can
-not restore all services in one go. Backup files produced by Abra are
-compressed archives which use absolute paths. This allows Abra to restore
-according to standard tar command logic.
-
-Example:
-
-    abra app restore example.com app ~/.abra/backups/example_com_app_609341138.tar.gz
-`,
-	Action: func(c *cli.Context) error {
-		app := internal.ValidateApp(c)
-		conf := runtime.New()
-
-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		serviceName := c.Args().Get(1)
-		if serviceName == "" {
-			internal.ShowSubcommandHelpAndError(c, errors.New("missing <service>?"))
-		}
-
-		backupPath := c.Args().Get(2)
-		if backupPath == "" {
-			internal.ShowSubcommandHelpAndError(c, errors.New("missing <file>?"))
-		}
-
-		if _, err := os.Stat(backupPath); err != nil {
-			if os.IsNotExist(err) {
-				logrus.Fatalf("%s doesn't exist?", backupPath)
-			}
-		}
-
-		recipe, err := recipe.Get(app.Recipe, conf)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		restoreConfigs := make(map[string]restoreConfig)
-		for _, service := range recipe.Config.Services {
-			if restoreEnabled, ok := service.Deploy.Labels["backupbot.restore"]; ok {
-				if restoreEnabled == "true" {
-					fullServiceName := fmt.Sprintf("%s_%s", app.StackName(), service.Name)
-					rsConfig := restoreConfig{}
-
-					logrus.Debugf("restore config detected for %s", fullServiceName)
-
-					if preHookCmd, ok := service.Deploy.Labels["backupbot.restore.pre-hook"]; ok {
-						logrus.Debugf("detected pre-hook command for %s: %s", fullServiceName, preHookCmd)
-						rsConfig.preHookCmd = preHookCmd
-					}
-
-					if postHookCmd, ok := service.Deploy.Labels["backupbot.restore.post-hook"]; ok {
-						logrus.Debugf("detected post-hook command for %s: %s", fullServiceName, postHookCmd)
-						rsConfig.postHookCmd = postHookCmd
-					}
-
-					restoreConfigs[service.Name] = rsConfig
-				}
-			}
-		}
-
-		rsConfig, ok := restoreConfigs[serviceName]
-		if !ok {
-			rsConfig = restoreConfig{}
-		}
-
-		if err := runRestore(cl, app, backupPath, serviceName, rsConfig); err != nil {
-			logrus.Fatal(err)
-		}
-
-		return nil
-	},
-}
-
-// runRestore does the actual restore logic.
-func runRestore(cl *dockerClient.Client, app config.App, backupPath, serviceName string, rsConfig restoreConfig) error {
-	// FIXME: avoid instantiating a new CLI
-	dcli, err := command.NewDockerCli()
-	if err != nil {
-		return err
-	}
-
-	filters := filters.NewArgs()
-	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))
-
-	targetContainer, err := containerPkg.GetContainer(context.Background(), cl, filters, true)
-	if err != nil {
-		return err
-	}
-
-	fullServiceName := fmt.Sprintf("%s_%s", app.StackName(), serviceName)
-	if rsConfig.preHookCmd != "" {
-		splitCmd := internal.SafeSplit(rsConfig.preHookCmd)
-
-		logrus.Debugf("split pre-hook command for %s into %s", fullServiceName, splitCmd)
-
-		preHookExecOpts := types.ExecConfig{
-			AttachStderr: true,
-			AttachStdin:  true,
-			AttachStdout: true,
-			Cmd:          splitCmd,
-			Detach:       false,
-			Tty:          true,
-		}
-
-		if err := container.RunExec(dcli, cl, targetContainer.ID, &preHookExecOpts); err != nil {
-			return err
-		}
-
-		logrus.Infof("succesfully ran %s pre-hook command: %s", fullServiceName, rsConfig.preHookCmd)
-	}
-
-	backupReader, err := os.Open(backupPath)
-	if err != nil {
-		return err
-	}
-
-	content, err := archive.DecompressStream(backupReader)
-	if err != nil {
-		return err
-	}
-
-	// we use absolute paths so tar knows what to do. it will restore files
-	// according to the paths set in the compresed archive
-	restorePath := "/"
-
-	copyOpts := types.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
-	if err := cl.CopyToContainer(context.Background(), targetContainer.ID, restorePath, content, copyOpts); err != nil {
-		return err
-	}
-
-	logrus.Infof("restored %s to %s", backupPath, fullServiceName)
-
-	if rsConfig.postHookCmd != "" {
-		splitCmd := internal.SafeSplit(rsConfig.postHookCmd)
-
-		logrus.Debugf("split post-hook command for %s into %s", fullServiceName, splitCmd)
-
-		postHookExecOpts := types.ExecConfig{
-			AttachStderr: true,
-			AttachStdin:  true,
-			AttachStdout: true,
-			Cmd:          splitCmd,
-			Detach:       false,
-			Tty:          true,
-		}
-
-		if err := container.RunExec(dcli, cl, targetContainer.ID, &postHookExecOpts); err != nil {
-			return err
-		}
-
-		logrus.Infof("succesfully ran %s post-hook command: %s", fullServiceName, rsConfig.postHookCmd)
-	}
-
-	return nil
-}
--- a/cli/app/rollback.go
+++ b/cli/app/rollback.go
@ -8,7 +8,6 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/tagcmp"

@ -50,7 +49,6 @@ recipes.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		conf := runtime.New()

 		if !internal.Chaos {
 			if err := recipe.EnsureUpToDate(app.Recipe); err != nil {
@ -58,7 +56,7 @@ recipes.
 			}
 		}

-		r, err := recipe.Get(app.Recipe, conf)
+		r, err := recipe.Get(app.Recipe)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -180,10 +178,6 @@ recipes.
 		if err != nil {
 			logrus.Fatal(err)
 		}
-		config.ExposeAllEnv(stackName, compose, app.Env)
-		config.SetRecipeLabel(compose, stackName, app.Recipe)
-		config.SetChaosLabel(compose, stackName, internal.Chaos)
-		config.SetUpdateLabel(compose, stackName, app.Env)

 		if !internal.Force {
 			if err := internal.NewVersionOverview(app, deployedVersion, chosenDowngrade, ""); err != nil {
--- a/cli/app/secret.go
+++ b/cli/app/secret.go
@ -48,11 +48,6 @@ var appSecretGenerateCommand = cli.Command{
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
 		if len(c.Args()) == 1 && !allSecrets {
 			err := errors.New("missing arguments <secret>/<version> or '--all'")
 			internal.ShowSubcommandHelpAndError(c, err)
@ -84,7 +79,7 @@ var appSecretGenerateCommand = cli.Command{
 			}
 		}

-		secretVals, err := secret.GenerateSecrets(cl, secretsToCreate, app.StackName(), app.Server)
+		secretVals, err := secret.GenerateSecrets(secretsToCreate, app.StackName(), app.Server)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -140,11 +135,6 @@ Example:
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
 		if len(c.Args()) != 4 {
 			internal.ShowSubcommandHelpAndError(c, errors.New("missing arguments?"))
 		}
@ -154,7 +144,7 @@ Example:
 		data := c.Args().Get(3)

 		secretName := fmt.Sprintf("%s_%s_%s", app.StackName(), name, version)
-		if err := client.StoreSecret(cl, secretName, data, app.Server); err != nil {
+		if err := client.StoreSecret(secretName, data, app.Server); err != nil {
 			logrus.Fatal(err)
 		}

@ -226,7 +216,7 @@ Example:
 			logrus.Fatal(err)
 		}

-		filters, err := app.Filters(false, false)
+		filters, err := app.Filters()
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -303,7 +293,7 @@ var appSecretLsCommand = cli.Command{
 			logrus.Fatal(err)
 		}

-		filters, err := app.Filters(false, false)
+		filters, err := app.Filters()
 		if err != nil {
 			logrus.Fatal(err)
 		}
--- a/cli/app/services.go
+++ b/cli/app/services.go
@ -1,80 +0,0 @@
-package app
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/formatter"
-	"coopcloud.tech/abra/pkg/service"
-	stack "coopcloud.tech/abra/pkg/upstream/stack"
-	"github.com/docker/docker/api/types"
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
-)
-
-var appServicesCommand = cli.Command{
-	Name:      "services",
-	Aliases:   []string{"sr"},
-	Usage:     "Display all services of an app",
-	ArgsUsage: "<domain>",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-	},
-	Before:       internal.SubCommandBefore,
-	BashComplete: autocomplete.AppNameComplete,
-	Action: func(c *cli.Context) error {
-		app := internal.ValidateApp(c)
-
-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		isDeployed, _, err := stack.IsDeployed(context.Background(), cl, app.StackName())
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		if !isDeployed {
-			logrus.Fatalf("%s is not deployed?", app.Name)
-		}
-
-		filters, err := app.Filters(true, true)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		containers, err := cl.ContainerList(context.Background(), types.ContainerListOptions{Filters: filters})
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		tableCol := []string{"service name", "image"}
-		table := formatter.CreateTable(tableCol)
-
-		for _, container := range containers {
-			var containerNames []string
-			for _, containerName := range container.Names {
-				trimmed := strings.TrimPrefix(containerName, "/")
-				containerNames = append(containerNames, trimmed)
-			}
-
-			serviceShortName := service.ContainerToServiceName(container.Names, app.StackName())
-			serviceLongName := fmt.Sprintf("%s_%s", app.StackName(), serviceShortName)
-
-			tableRow := []string{
-				serviceLongName,
-				formatter.RemoveSha(container.Image),
-			}
-			table.Append(tableRow)
-		}
-
-		table.Render()
-
-		return nil
-	},
-}
--- a/cli/app/upgrade.go
+++ b/cli/app/upgrade.go
@ -10,7 +10,6 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
@ -33,8 +32,8 @@ var appUpgradeCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Upgrade an app. You can use it to choose and roll out a new upgrade to an
-existing app.
+This command supports upgrading an app. You can use it to choose and roll out a
+new upgrade to an existing app.

 This command specifically supports incrementing the version of running apps, as
 opposed to "abra app deploy <domain>" which will not change the version of a
@ -53,12 +52,6 @@ recipes.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		conf := runtime.New()
-
-		cl, err := client.New(app.Server)
-		if err != nil {
-			logrus.Fatal(err)
-		}

 		if !internal.Chaos {
 			if err := recipe.EnsureUpToDate(app.Recipe); err != nil {
@ -66,7 +59,7 @@ recipes.
 			}
 		}

-		r, err := recipe.Get(app.Recipe, conf)
+		r, err := recipe.Get(app.Recipe)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -75,6 +68,11 @@ recipes.
 			logrus.Fatal(err)
 		}

+		cl, err := client.New(app.Server)
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
 		logrus.Debugf("checking whether %s is already deployed", stackName)

 		isDeployed, deployedVersion, err := stack.IsDeployed(context.Background(), cl, stackName)
@ -191,10 +189,6 @@ recipes.
 		if err != nil {
 			logrus.Fatal(err)
 		}
-		config.ExposeAllEnv(stackName, compose, app.Env)
-		config.SetRecipeLabel(compose, stackName, app.Recipe)
-		config.SetChaosLabel(compose, stackName, internal.Chaos)
-		config.SetUpdateLabel(compose, stackName, app.Env)

 		if err := internal.NewVersionOverview(app, deployedVersion, chosenUpgrade, releaseNotes); err != nil {
 			logrus.Fatal(err)
--- a/cli/app/version.go
+++ b/cli/app/version.go
@ -8,7 +8,6 @@ import (
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/docker/distribution/reference"
 	"github.com/sirupsen/logrus"
@ -42,14 +41,13 @@ var appVersionCommand = cli.Command{
 	Before: internal.SubCommandBefore,
 	Usage:  "Show app versions",
 	Description: `
-Show all information about versioning related to a deployed app. This includes
-the individual image names, tags and digests. But also the Co-op Cloud recipe
-version.
+This command shows all information about versioning related to a deployed app.
+This includes the individual image names, tags and digests. But also the Co-op
+Cloud recipe version.
 `,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		conf := runtime.New()

 		cl, err := client.New(app.Server)
 		if err != nil {
@ -71,7 +69,7 @@ version.
 			logrus.Fatalf("%s is not deployed?", app.Name)
 		}

-		recipeMeta, err := recipe.GetRecipeMeta(app.Recipe, conf)
+		recipeMeta, err := recipe.GetRecipeMeta(app.Recipe)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -87,12 +85,12 @@ version.
 			logrus.Fatalf("could not retrieve deployed version (%s) from recipe catalogue?", deployedVersion)
 		}

-		tableCol := []string{"version", "service", "image"}
+		tableCol := []string{"version", "service", "image", "digest"}
 		table := formatter.CreateTable(tableCol)
 		table.SetAutoMergeCellsByColumnIndex([]int{0})

 		for serviceName, versionMeta := range versionsMeta {
-			table.Append([]string{deployedVersion, serviceName, versionMeta.Image})
+			table.Append([]string{deployedVersion, serviceName, versionMeta.Image, versionMeta.Digest})
 		}

 		table.Render()
--- a/cli/app/volume.go
+++ b/cli/app/volume.go
@ -26,17 +26,12 @@ var appVolumeListCommand = cli.Command{
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
+		filters, err := app.Filters()
 		if err != nil {
 			logrus.Fatal(err)
 		}

-		filters, err := app.Filters(false, true)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		volumeList, err := client.GetVolumes(cl, context.Background(), app.Server, filters)
+		volumeList, err := client.GetVolumes(context.Background(), app.Server, filters)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -85,17 +80,12 @@ Passing "--force/-f" will select all volumes for removal. Be careful.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)

-		cl, err := client.New(app.Server)
+		filters, err := app.Filters()
 		if err != nil {
 			logrus.Fatal(err)
 		}

-		filters, err := app.Filters(false, true)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		volumeList, err := client.GetVolumes(cl, context.Background(), app.Server, filters)
+		volumeList, err := client.GetVolumes(context.Background(), app.Server, filters)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@ -119,7 +109,7 @@ Passing "--force/-f" will select all volumes for removal. Be careful.
 			volumesToRemove = volumeNames
 		}

-		err = client.RemoveVolumes(cl, context.Background(), app.Server, volumesToRemove, internal.Force)
+		err = client.RemoveVolumes(context.Background(), app.Server, volumesToRemove, internal.Force)
 		if err != nil {
 			logrus.Fatal(err)
 		}
--- a/cli/catalogue/catalogue.go
+++ b/cli/catalogue/catalogue.go
@ -8,16 +8,56 @@ import (

 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/catalogue"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	gitPkg "coopcloud.tech/abra/pkg/git"
+	"coopcloud.tech/abra/pkg/limit"
 	"coopcloud.tech/abra/pkg/recipe"
 	"github.com/go-git/go-git/v5"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )

+// CatalogueSkipList is all the repos that are not recipes.
+var CatalogueSkipList = map[string]bool{
+	"abra":                   true,
+	"abra-apps":              true,
+	"abra-aur":               true,
+	"abra-bash":              true,
+	"abra-capsul":            true,
+	"abra-gandi":             true,
+	"abra-hetzner":           true,
+	"apps":                   true,
+	"aur-abra-git":           true,
+	"auto-apps-json":         true,
+	"auto-mirror":            true,
+	"backup-bot":             true,
+	"backup-bot-two":         true,
+	"beta.coopcloud.tech":    true,
+	"comrade-renovate-bot":   true,
+	"coopcloud.tech":         true,
+	"coturn":                 true,
+	"docker-cp-deploy":       true,
+	"docker-dind-bats-kcov":  true,
+	"docs.coopcloud.tech":    true,
+	"drone-abra":             true,
+	"example":                true,
+	"gardening":              true,
+	"go-abra":                true,
+	"organising":             true,
+	"outline-with-patch":     true,
+	"pyabra":                 true,
+	"radicle-seed-node":      true,
+	"recipes-catalogue-json": true,
+	"recipes-wishlist":       true,
+	"recipes.coopcloud.tech": true,
+	"stack-ssh-deploy":       true,
+	"swarm-cronjob":          true,
+	"tagcmp":                 true,
+	"traefik-cert-dumper":    true,
+	"tyop":                   true,
+}
+
 var catalogueGenerateCommand = cli.Command{
 	Name:    "generate",
 	Aliases: []string{"g"},
@ -31,14 +71,13 @@ var catalogueGenerateCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Generate a new copy of the recipe catalogue which can be found on:
+This command generates a new copy of the recipe catalogue which can be found on:

-    https://recipes.coopcloud.tech (website that humans read)
-    https://recipes.coopcloud.tech/recipes.json (JSON that Abra reads)
+    https://recipes.coopcloud.tech

 It polls the entire git.coopcloud.tech/coop-cloud/... recipe repository
-listing, parses README.md and git tags to produce recipe metadata which is
-loaded into the catalogue JSON file.
+listing, parses README.md and git tags of those repositories to produce recipe
+metadata and produces a recipes JSON file.

 It is possible to generate new metadata for a single recipe by passing
 <recipe>. The existing local catalogue will be updated, not overwritten.
@ -47,7 +86,7 @@ It is quite easy to get rate limited by Docker Hub when running this command.
 If you have a Hub account you can have Abra log you in to avoid this. Pass
 "--user" and "--pass".

-Push your new release to git.coopcloud.tech with "-p/--publish". This requires
+Push your new release git.coopcloud.tech with "-p/--publish". This requires
 that you have permission to git push to these repositories and have your SSH
 keys configured on your account.
 `,
@ -55,11 +94,7 @@ keys configured on your account.
 	Action: func(c *cli.Context) error {
 		recipeName := c.Args().First()
 		if recipeName != "" {
-			internal.ValidateRecipe(c)
-		}
-
-		if err := catalogue.EnsureUpToDate(); err != nil {
-			logrus.Fatal(err)
+			internal.ValidateRecipe(c, true)
 		}

 		repos, err := recipe.ReadReposMetadata()
@ -79,7 +114,7 @@ keys configured on your account.

 		if !internal.SkipUpdates {
 			logrus.Warn(logMsg)
-			if err := recipe.UpdateRepositories(repos, recipeName); err != nil {
+			if err := updateRepositories(repos, recipeName); err != nil {
 				logrus.Fatal(err)
 			}
 		}
@ -92,7 +127,7 @@ keys configured on your account.
 				continue
 			}

-			if _, exists := catalogue.CatalogueSkipList[recipeMeta.Name]; exists {
+			if _, exists := CatalogueSkipList[recipeMeta.Name]; exists {
 				catlBar.Add(1)
 				continue
 			}
@ -221,3 +256,62 @@ var CatalogueCommand = cli.Command{
 		catalogueGenerateCommand,
 	},
 }
+
+func updateRepositories(repos recipe.RepoCatalogue, recipeName string) error {
+	var barLength int
+	if recipeName != "" {
+		barLength = 1
+	} else {
+		barLength = len(repos)
+	}
+
+	cloneLimiter := limit.New(10)
+
+	retrieveBar := formatter.CreateProgressbar(barLength, "ensuring recipes are cloned & up-to-date...")
+	ch := make(chan string, barLength)
+	for _, repoMeta := range repos {
+		go func(rm recipe.RepoMeta) {
+			cloneLimiter.Begin()
+			defer cloneLimiter.End()
+
+			if recipeName != "" && recipeName != rm.Name {
+				ch <- rm.Name
+				retrieveBar.Add(1)
+				return
+			}
+			if _, exists := CatalogueSkipList[rm.Name]; exists {
+				ch <- rm.Name
+				retrieveBar.Add(1)
+				return
+			}
+
+			recipeDir := path.Join(config.RECIPES_DIR, rm.Name)
+
+			if err := gitPkg.Clone(recipeDir, rm.CloneURL); err != nil {
+				logrus.Fatal(err)
+			}
+
+			isClean, err := gitPkg.IsClean(recipeDir)
+			if err != nil {
+				logrus.Fatal(err)
+			}
+
+			if !isClean {
+				logrus.Fatalf("%s has locally unstaged changes", rm.Name)
+			}
+
+			if err := recipe.EnsureUpToDate(rm.Name); err != nil {
+				logrus.Fatal(err)
+			}
+
+			ch <- rm.Name
+			retrieveBar.Add(1)
+		}(repoMeta)
+	}
+
+	for range repos {
+		<-ch // wait for everything
+	}
+
+	return nil
+}
--- a/cli/cli.go
+++ b/cli/cli.go
@ -27,13 +27,19 @@ var AutoCompleteCommand = cli.Command{
 	Aliases: []string{"ac"},
 	Usage:   "Configure shell autocompletion (recommended)",
 	Description: `
-Set up auto-completion in your shell by downloading the relevant files and
-laying out what additional information must be loaded. Supported shells are as
-follows: bash, fish, fizsh & zsh.
+This command helps set up autocompletion in your shell by downloading the
+relevant autocompletion files and laying out what additional information must
+be loaded.

 Example:

    abra autocomplete bash
+
+Supported shells are as follows:
+
+		fizsh
+		zsh
+    bash
 `,
 	ArgsUsage: "<shell>",
 	Flags: []cli.Flag{
@ -50,7 +56,6 @@ Example:
 			"bash":  true,
 			"zsh":   true,
 			"fizsh": true,
-			"fish":  true,
 		}

 		if _, ok := supportedShells[shellType]; !ok {
@ -81,27 +86,19 @@ Example:
 		switch shellType {
 		case "bash":
 			fmt.Println(fmt.Sprintf(`
-# Run the following commands to install auto-completion
+# Run the following commands to install autocompletion
 sudo mkdir /etc/bash_completion.d/
 sudo cp %s /etc/bash_completion.d/abra
 echo "source /etc/bash_completion.d/abra" >> ~/.bashrc
-# To test, run the following: "abra app <hit tab key>" - you should see command completion!
+# And finally run "abra app ps <hit tab key>" to test things are working, you should see app domains listed!
 `, autocompletionFile))
 		case "zsh":
 			fmt.Println(fmt.Sprintf(`
-# Run the following commands to install auto-completion
+# Run the following commands to install autocompletion
 sudo mkdir /etc/zsh/completion.d/
 sudo cp %s /etc/zsh/completion.d/abra
 echo "PROG=abra\n_CLI_ZSH_AUTOCOMPLETE_HACK=1\nsource /etc/zsh/completion.d/abra" >> ~/.zshrc
-# To test, run the following: "abra app <hit tab key>" - you should see command completion!
-`, autocompletionFile))
-		case "fish":
-			fmt.Println(fmt.Sprintf(`
-# Run the following commands to install auto-completion
-sudo mkdir -p /etc/fish/completions
-sudo cp %s /etc/fish/completions/abra
-echo "source /etc/fish/completions/abra" >> ~/.config/fish/config.fish
-# To test, run the following: "abra app <hit tab key>" - you should see command completion!
+# And finally run "abra app ps <hit tab key>" to test things are working, you should see app domains listed!
 `, autocompletionFile))
 		}

@ -115,11 +112,13 @@ var UpgradeCommand = cli.Command{
 	Aliases: []string{"u"},
 	Usage:   "Upgrade Abra itself",
 	Description: `
-Upgrade Abra in-place with the latest stable or release candidate.
+This command allows you to upgrade Abra in-place with the latest stable or
+release candidate.

-Pass "-r/--rc" to install the latest release candidate. Please bear in mind
-that it may contain catastrophic bugs. Thank you very much for the testing
-efforts!
+If you would like to install the latest release candidate, please pass the
+"-r/--rc" option. Please bear in mind that the latest release candidate may
+have some catastrophic bugs contained in it. In any case, thank you very much
+for the testing efforts!
 `,
 	Flags: []cli.Flag{internal.RCFlag},
 	Action: func(c *cli.Context) error {
@ -173,7 +172,6 @@ func newAbraApp(version, commit string) *cli.App {
 			path.Join(config.SERVERS_DIR),
 			path.Join(config.RECIPES_DIR),
 			path.Join(config.VENDOR_DIR),
-			path.Join(config.BACKUP_DIR),
 		}

 		for _, path := range paths {
@ -189,7 +187,6 @@ func newAbraApp(version, commit string) *cli.App {

 		return nil
 	}
-
 	return app
 }

--- a/cli/internal/backup.go
+++ b/cli/internal/backup.go
@ -1,35 +0,0 @@
-package internal
-
-import (
-	"strings"
-)
-
-// SafeSplit splits up a string into a list of commands safely.
-func SafeSplit(s string) []string {
-	split := strings.Split(s, " ")
-
-	var result []string
-	var inquote string
-	var block string
-	for _, i := range split {
-		if inquote == "" {
-			if strings.HasPrefix(i, "'") || strings.HasPrefix(i, "\"") {
-				inquote = string(i[0])
-				block = strings.TrimPrefix(i, inquote) + " "
-			} else {
-				result = append(result, i)
-			}
-		} else {
-			if !strings.HasSuffix(i, inquote) {
-				block += i + " "
-			} else {
-				block += strings.TrimSuffix(i, inquote)
-				inquote = ""
-				result = append(result, block)
-				block = ""
-			}
-		}
-	}
-
-	return result
-}
--- a/cli/internal/cli.go
+++ b/cli/internal/cli.go
@ -243,16 +243,6 @@ var DebugFlag = &cli.BoolFlag{
 	Usage:       "Show DEBUG messages",
 }

-// MachineReadable stores the variable from MachineReadableFlag
-var MachineReadable bool
-
-// MachineReadableFlag turns on/off machine readable output where supported
-var MachineReadableFlag = &cli.BoolFlag{
-	Name:        "machine, m",
-	Destination: &MachineReadable,
-	Usage:       "Output in a machine-readable format (where supported)",
-}
-
 // RC signifies the latest release candidate
 var RC bool

@ -328,14 +318,6 @@ var StdErrOnlyFlag = &cli.BoolFlag{
 	Destination: &StdErrOnly,
 }

-var SinceLogs string
-var SinceLogsFlag = &cli.StringFlag{
-	Name:        "since, S",
-	Value:       "",
-	Usage:       "tail logs since YYYY-MM-DDTHH:MM:SSZ",
-	Destination: &SinceLogs,
-}
-
 var DontWaitConverge bool
 var DontWaitConvergeFlag = &cli.BoolFlag{
 	Name:        "no-converge-checks, c",
@ -371,20 +353,72 @@ var AllTagsFlag = &cli.BoolFlag{
 	Destination: &AllTags,
 }

-var LocalCmd bool
-var LocalCmdFlag = &cli.BoolFlag{
-	Name:        "local, l",
-	Usage:       "Run command locally",
-	Destination: &LocalCmd,
-}
+// SSHFailMsg is a hopefully helpful SSH failure message
+var SSHFailMsg = `
+Woops, Abra is unable to connect to connect to %s.

-var RemoteUser string
-var RemoteUserFlag = &cli.StringFlag{
-	Name:        "user, u",
-	Value:       "",
-	Usage:       "User to run command within a service context",
-	Destination: &RemoteUser,
-}
+Here are a few tips for debugging your local SSH config. Abra uses plain 'ol
+SSH to make connections to servers, so if your SSH config is working, Abra is
+working.
+
+In the first place, Abra will always try to read your Docker context connection
+string for SSH connection details. You can view your server context configs
+with the following command. Are they correct?
+
+    abra server ls
+
+Is your ssh-agent running? You can start it by running the following command:
+
+    eval "$(ssh-agent)"
+
+If your SSH private key loaded? You can check by running the following command:
+
+    ssh-add -L
+
+If, you can add it with:
+
+    ssh-add ~/.ssh/<private-key-part>
+
+If you are using a non-default public/private key, you can configure this in
+your ~/.ssh/config file which Abra will read in order to figure out connection
+details:
+
+Host foo.coopcloud.tech
+  Hostname foo.coopcloud.tech
+  User bar
+  Port 12345
+  IdentityFile ~/.ssh/bar@foo.coopcloud.tech
+
+If you're only using password authentication, you can use the following config:
+
+Host foo.coopcloud.tech
+  Hostname foo.coopcloud.tech
+  User bar
+  Port 12345
+  PreferredAuthentications=password
+  PubkeyAuthentication=no
+
+Good luck!
+
+`
+
+var ServerAddFailMsg = `
+Failed to add server %s.
+
+This could be caused by two things.
+
+Abra isn't picking up your SSH configuration or you need to specify it on the
+command-line (e.g you use a non-standard port or username to connect). Run
+"server add" with "-d/--debug" to learn more about what Abra is doing under the
+hood.
+
+Docker is not installed on your server. You can pass "-p/--provision" to
+install Docker and initialise Docker Swarm mode. See help output for "server
+add"
+
+See "abra server add -h" for more.
+
+`

 // SubCommandBefore wires up pre-action machinery (e.g. --debug handling).
 func SubCommandBefore(c *cli.Context) error {
--- a/cli/internal/deploy.go
+++ b/cli/internal/deploy.go
@ -15,7 +15,6 @@ import (
 	"coopcloud.tech/abra/pkg/git"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/sirupsen/logrus"
@ -25,12 +24,6 @@ import (
 // DeployAction is the main command-line action for this package
 func DeployAction(c *cli.Context) error {
 	app := ValidateApp(c)
-	conf := runtime.New()
-
-	cl, err := client.New(app.Server)
-	if err != nil {
-		logrus.Fatal(err)
-	}

 	if !Chaos {
 		if err := recipe.EnsureUpToDate(app.Recipe); err != nil {
@ -38,7 +31,7 @@ func DeployAction(c *cli.Context) error {
 		}
 	}

-	r, err := recipe.Get(app.Recipe, conf)
+	r, err := recipe.Get(app.Recipe)
 	if err != nil {
 		logrus.Fatal(err)
 	}
@ -47,6 +40,11 @@ func DeployAction(c *cli.Context) error {
 		logrus.Fatal(err)
 	}

+	cl, err := client.New(app.Server)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
 	logrus.Debugf("checking whether %s is already deployed", app.StackName())

 	isDeployed, deployedVersion, err := stack.IsDeployed(context.Background(), cl, app.StackName())
@ -85,7 +83,7 @@ func DeployAction(c *cli.Context) error {
 			}
 			version = formatter.SmallSHA(head.String())
 			logrus.Warn("no versions detected, using latest commit")
-			if err := recipe.EnsureLatest(app.Recipe, conf); err != nil {
+			if err := recipe.EnsureLatest(app.Recipe); err != nil {
 				logrus.Fatal(err)
 			}
 		}
@ -136,23 +134,15 @@ func DeployAction(c *cli.Context) error {
 	if err != nil {
 		logrus.Fatal(err)
 	}
-	config.ExposeAllEnv(app.StackName(), compose, app.Env)
-	config.SetRecipeLabel(compose, app.StackName(), app.Recipe)
-	config.SetChaosLabel(compose, app.StackName(), Chaos)
-	config.SetUpdateLabel(compose, app.StackName(), app.Env)

 	if err := DeployOverview(app, version, "continue with deployment?"); err != nil {
 		logrus.Fatal(err)
 	}

 	if !NoDomainChecks {
-		domainName, ok := app.Env["DOMAIN"]
-		if ok {
-			if _, err = dns.EnsureDomainsResolveSameIPv4(domainName, app.Server); err != nil {
-				logrus.Fatal(err)
-			}
-		} else {
-			logrus.Warn("skipping domain checks as no DOMAIN=... configured for app")
+		domainName := app.Env["DOMAIN"]
+		if _, err = dns.EnsureDomainsResolveSameIPv4(domainName, app.Server); err != nil {
+			logrus.Fatal(err)
 		}
 	} else {
 		logrus.Warn("skipping domain checks as requested")
--- a/cli/internal/new.go
+++ b/cli/internal/new.go
@ -5,16 +5,14 @@ import (
 	"path"

 	"coopcloud.tech/abra/pkg/app"
-	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
-	"coopcloud.tech/abra/pkg/jsontable"
 	"coopcloud.tech/abra/pkg/recipe"
 	recipePkg "coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/abra/pkg/secret"
+	"coopcloud.tech/abra/pkg/ssh"
 	"github.com/AlecAivazis/survey/v2"
-	dockerClient "github.com/docker/docker/client"
+	"github.com/olekukonko/tablewriter"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
@ -26,7 +24,7 @@ type AppSecrets map[string]string
 var RecipeName string

 // createSecrets creates all secrets for a new app.
-func createSecrets(cl *dockerClient.Client, sanitisedAppName string) (AppSecrets, error) {
+func createSecrets(sanitisedAppName string) (AppSecrets, error) {
 	appEnvPath := path.Join(config.ABRA_DIR, "servers", NewAppServer, fmt.Sprintf("%s.env", Domain))
 	appEnv, err := config.ReadEnv(appEnvPath)
 	if err != nil {
@ -34,7 +32,7 @@ func createSecrets(cl *dockerClient.Client, sanitisedAppName string) (AppSecrets
 	}

 	secretEnvVars := secret.ReadSecretEnvVars(appEnv)
-	secrets, err := secret.GenerateSecrets(cl, secretEnvVars, sanitisedAppName, NewAppServer)
+	secrets, err := secret.GenerateSecrets(secretEnvVars, sanitisedAppName, NewAppServer)
 	if err != nil {
 		return nil, err
 	}
@ -120,7 +118,7 @@ func ensureServerFlag() error {

 // NewAction is the new app creation logic
 func NewAction(c *cli.Context) error {
-	recipe := ValidateRecipeWithPrompt(c, runtime.WithEnsureRecipeLatest(false))
+	recipe := ValidateRecipeWithPrompt(c, false)

 	if err := recipePkg.EnsureUpToDate(recipe.Name); err != nil {
 		logrus.Fatal(err)
@ -145,15 +143,15 @@ func NewAction(c *cli.Context) error {
 		logrus.Fatal(err)
 	}

-	cl, err := client.New(NewAppServer)
-	if err != nil {
-		logrus.Fatal(err)
-	}
-
 	var secrets AppSecrets
-	var secretTable *jsontable.JSONTable
+	var secretTable *tablewriter.Table
 	if Secrets {
-		secrets, err := createSecrets(cl, sanitisedAppName)
+		if err := ssh.EnsureHostKey(NewAppServer); err != nil {
+			logrus.Fatal(err)
+		}
+
+		var err error
+		secrets, err = createSecrets(sanitisedAppName)
 		if err != nil {
 			logrus.Fatal(err)
 		}
--- a/cli/internal/validate.go
+++ b/cli/internal/validate.go
@ -9,7 +9,7 @@ import (
 	"coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
+	"coopcloud.tech/abra/pkg/ssh"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
@ -19,15 +19,14 @@ import (
 var AppName string

 // ValidateRecipe ensures the recipe arg is valid.
-func ValidateRecipe(c *cli.Context, opts ...runtime.Option) recipe.Recipe {
+func ValidateRecipe(c *cli.Context, ensureLatest bool) recipe.Recipe {
 	recipeName := c.Args().First()
-	conf := runtime.New(opts...)

 	if recipeName == "" {
 		ShowSubcommandHelpAndError(c, errors.New("no recipe name provided"))
 	}

-	chosenRecipe, err := recipe.Get(recipeName, conf)
+	chosenRecipe, err := recipe.Get(recipeName)
 	if err != nil {
 		if c.Command.Name == "generate" {
 			if strings.Contains(err.Error(), "missing a compose") {
@ -35,15 +34,12 @@ func ValidateRecipe(c *cli.Context, opts ...runtime.Option) recipe.Recipe {
 			}
 			logrus.Warn(err)
 		} else {
-			if strings.Contains(err.Error(), "template_driver is not allowed") {
-				logrus.Warnf("ensure %s recipe compose.* files include \"version: '3.8'\"", recipeName)
-			}
-			logrus.Fatalf("unable to validate recipe: %s", err)
+			logrus.Fatal(err)
 		}
 	}

-	if conf.EnsureRecipeLatest {
-		if err := recipe.EnsureLatest(recipeName, conf); err != nil {
+	if ensureLatest {
+		if err := recipe.EnsureLatest(recipeName); err != nil {
 			logrus.Fatal(err)
 		}
 	}
@ -55,9 +51,8 @@ func ValidateRecipe(c *cli.Context, opts ...runtime.Option) recipe.Recipe {

 // ValidateRecipeWithPrompt ensures a recipe argument is present before
 // validating, asking for input if required.
-func ValidateRecipeWithPrompt(c *cli.Context, opts ...runtime.Option) recipe.Recipe {
+func ValidateRecipeWithPrompt(c *cli.Context, ensureLatest bool) recipe.Recipe {
 	recipeName := c.Args().First()
-	conf := runtime.New(opts...)

 	if recipeName == "" && !NoInput {
 		var recipes []string
@ -105,13 +100,13 @@ func ValidateRecipeWithPrompt(c *cli.Context, opts ...runtime.Option) recipe.Rec
 		ShowSubcommandHelpAndError(c, errors.New("no recipe name provided"))
 	}

-	chosenRecipe, err := recipe.Get(recipeName, conf)
+	chosenRecipe, err := recipe.Get(recipeName)
 	if err != nil {
 		logrus.Fatal(err)
 	}

-	if conf.EnsureRecipeLatest {
-		if err := recipe.EnsureLatest(recipeName, conf); err != nil {
+	if ensureLatest {
+		if err := recipe.EnsureLatest(recipeName); err != nil {
 			logrus.Fatal(err)
 		}
 	}
@ -122,9 +117,8 @@ func ValidateRecipeWithPrompt(c *cli.Context, opts ...runtime.Option) recipe.Rec
 }

 // ValidateApp ensures the app name arg is valid.
-func ValidateApp(c *cli.Context, opts ...runtime.Option) config.App {
+func ValidateApp(c *cli.Context) config.App {
 	appName := c.Args().First()
-	conf := runtime.New(opts...)

 	if AppName != "" {
 		appName = AppName
@ -140,7 +134,11 @@ func ValidateApp(c *cli.Context, opts ...runtime.Option) config.App {
 		logrus.Fatal(err)
 	}

-	if err := recipe.EnsureExists(app.Recipe, conf); err != nil {
+	if err := recipe.EnsureExists(app.Recipe); err != nil {
+		logrus.Fatal(err)
+	}
+
+	if err := ssh.EnsureHostKey(app.Server); err != nil {
 		logrus.Fatal(err)
 	}

--- a/cli/recipe/fetch.go
+++ b/cli/recipe/fetch.go
@ -1,40 +0,0 @@
-package recipe
-
-import (
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/recipe"
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
-)
-
-var recipeFetchCommand = cli.Command{
-	Name:        "fetch",
-	Usage:       "Fetch recipe local copies",
-	Aliases:     []string{"f"},
-	ArgsUsage:   "[<recipe>]",
-	Description: "Fetchs all recipes without arguments.",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-	},
-	Before:       internal.SubCommandBefore,
-	BashComplete: autocomplete.RecipeNameComplete,
-	Action: func(c *cli.Context) error {
-		recipeName := c.Args().First()
-		if recipeName != "" {
-			internal.ValidateRecipe(c)
-			return nil // ValidateRecipe ensures latest checkout
-		}
-
-		repos, err := recipe.ReadReposMetadata()
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		if err := recipe.UpdateRepositories(repos, recipeName); err != nil {
-			logrus.Fatal(err)
-		}
-
-		return nil
-	},
-}
--- a/cli/recipe/lint.go
+++ b/cli/recipe/lint.go
@ -24,68 +24,44 @@ var recipeLintCommand = cli.Command{
 	Before:       internal.SubCommandBefore,
 	BashComplete: autocomplete.RecipeNameComplete,
 	Action: func(c *cli.Context) error {
-		recipe := internal.ValidateRecipe(c)
+		recipe := internal.ValidateRecipe(c, true)

 		if err := recipePkg.EnsureUpToDate(recipe.Name); err != nil {
 			logrus.Fatal(err)
 		}

-		tableCol := []string{"ref", "rule", "severity", "satisfied", "skipped", "resolve"}
+		tableCol := []string{"ref", "rule", "satisfied", "severity", "resolve"}
 		table := formatter.CreateTable(tableCol)

 		hasError := false
 		bar := formatter.CreateProgressbar(-1, "running recipe lint rules...")
 		for level := range lint.LintRules {
 			for _, rule := range lint.LintRules[level] {
-				if internal.OnlyErrors && rule.Level != "error" {
-					logrus.Debugf("skipping %s, does not have level \"error\"", rule.Ref)
-					continue
+				ok, err := rule.Function(recipe)
+				if err != nil {
+					logrus.Warn(err)
 				}

-				skipped := false
-				if rule.Skip(recipe) {
-					skipped = true
+				if !ok && rule.Level == "error" {
+					hasError = true
 				}

-				skippedOutput := "-"
-				if skipped {
-					skippedOutput = "yes"
+				var result string
+				if ok {
+					result = "yes"
+				} else {
+					result = "NO"
 				}

-				satisfied := false
-				if !skipped {
-					ok, err := rule.Function(recipe)
-					if err != nil {
-						logrus.Warn(err)
-					}
-
+				if internal.OnlyErrors {
 					if !ok && rule.Level == "error" {
-						hasError = true
-					}
-
-					if ok {
-						satisfied = true
+						table.Append([]string{rule.Ref, rule.Description, result, rule.Level, rule.HowToResolve})
+						bar.Add(1)
 					}
+				} else {
+					table.Append([]string{rule.Ref, rule.Description, result, rule.Level, rule.HowToResolve})
+					bar.Add(1)
 				}
-
-				satisfiedOutput := "yes"
-				if !satisfied {
-					satisfiedOutput = "NO"
-					if skipped {
-						satisfiedOutput = "-"
-					}
-				}
-
-				table.Append([]string{
-					rule.Ref,
-					rule.Description,
-					rule.Level,
-					satisfiedOutput,
-					skippedOutput,
-					rule.HowToResolve,
-				})
-
-				bar.Add(1)
 			}
 		}

--- a/cli/recipe/list.go
+++ b/cli/recipe/list.go
@ -27,7 +27,6 @@ var recipeListCommand = cli.Command{
 	Aliases: []string{"ls"},
 	Flags: []cli.Flag{
 		internal.DebugFlag,
-		internal.MachineReadableFlag,
 		patternFlag,
 	},
 	Before: internal.SubCommandBefore,
@ -67,14 +66,10 @@ var recipeListCommand = cli.Command{
 			}
 		}

+		table.SetCaption(true, fmt.Sprintf("total recipes: %v", len))
+
 		if table.NumLines() > 0 {
-			if internal.MachineReadable {
-				table.SetCaption(false, "")
-				table.JSONRender()
-			} else {
-				table.SetCaption(true, fmt.Sprintf("total recipes: %v", len))
-				table.Render()
-			}
+			table.Render()
 		}

 		return nil
--- a/cli/recipe/new.go
+++ b/cli/recipe/new.go
@ -41,9 +41,9 @@ var recipeNewCommand = cli.Command{
 	Usage:     "Create a new recipe",
 	ArgsUsage: "<recipe>",
 	Description: `
-Create a new recipe.
+This command creates a new recipe.

-Abra uses the built-in example repository which is available here:
+Abra uses our built-in example repository which is available here:

    https://git.coopcloud.tech/coop-cloud/example

@ -111,7 +111,7 @@ In order to share your recipe, you can upload it the git repository to:

 If you're not sure how to do that, come chat with us:

-    https://docs.coopcloud.tech/intro/contact
+    https://docs.coopcloud.tech/contact

 See "abra recipe -h" for additional recipe maintainer commands.

--- a/cli/recipe/recipe.go
+++ b/cli/recipe/recipe.go
@ -13,8 +13,7 @@ var RecipeCommand = cli.Command{
 	Description: `
 A recipe is a blueprint for an app. It is a bunch of config files which
 describe how to deploy and maintain an app. Recipes are maintained by the Co-op
-Cloud community and you can use Abra to read them, deploy them and create apps
-for you.
+Cloud community and you can use Abra to read them and create apps for you.

 Anyone who uses a recipe can become a maintainer. Maintainers typically make
 sure the recipe is in good working order and the config upgraded in a timely
@ -22,13 +21,12 @@ manner. Abra supports convenient automation for recipe maintainenace, see the
 "abra recipe upgrade", "abra recipe sync" and "abra recipe release" commands.
 `,
 	Subcommands: []cli.Command{
-		recipeFetchCommand,
-		recipeLintCommand,
 		recipeListCommand,
-		recipeNewCommand,
-		recipeReleaseCommand,
-		recipeSyncCommand,
-		recipeUpgradeCommand,
 		recipeVersionCommand,
+		recipeReleaseCommand,
+		recipeNewCommand,
+		recipeUpgradeCommand,
+		recipeSyncCommand,
+		recipeLintCommand,
 	},
 }
--- a/cli/recipe/release.go
+++ b/cli/recipe/release.go
@ -13,7 +13,6 @@ import (
 	gitPkg "coopcloud.tech/abra/pkg/git"
 	"coopcloud.tech/abra/pkg/recipe"
 	recipePkg "coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/docker/distribution/reference"
@ -28,16 +27,17 @@ var recipeReleaseCommand = cli.Command{
 	Usage:     "Release a new recipe version",
 	ArgsUsage: "<recipe> [<version>]",
 	Description: `
-Create a new version of a recipe. These versions are then published on the
-Co-op Cloud recipe catalogue. These versions take the following form:
+This command is used to specify a new version of a recipe. These versions are
+then published on the Co-op Cloud recipe catalogue. These versions take the
+following form:

    a.b.c+x.y.z

-Where the "a.b.c" part is a semantic version determined by the maintainer. The
-"x.y.z" part is the image tag of the recipe "app" service (the main container
-which contains the software to be used, by naming convention).
+Where the "a.b.c" part is a semantic version determined by the maintainer. And
+the "x.y.z" part is the image tag of the recipe "app" service (the main
+container which contains the software to be used).

-We maintain a semantic versioning scheme ("a.b.c") alongside the recipe
+We maintain a semantic versioning scheme ("a.b.c") alongside the libre app
 versioning scheme ("x.y.z") in order to maximise the chances that the nature of
 recipe updates are properly communicated. I.e. developers of an app might
 publish a minor version but that might lead to changes in the recipe which are
@ -59,7 +59,7 @@ your SSH keys configured on your account.
 	Before:       internal.SubCommandBefore,
 	BashComplete: autocomplete.RecipeNameComplete,
 	Action: func(c *cli.Context) error {
-		recipe := internal.ValidateRecipeWithPrompt(c, runtime.WithEnsureRecipeLatest(false))
+		recipe := internal.ValidateRecipeWithPrompt(c, false)

 		imagesTmp, err := getImageVersions(recipe)
 		if err != nil {
@ -374,7 +374,7 @@ func createReleaseFromPreviousTag(tagString, mainAppVersion string, recipe recip
 	}

 	if lastGitTag.String() == tagString {
-		logrus.Fatalf("latest git tag (%s) and synced label (%s) are the same?", lastGitTag, tagString)
+		logrus.Fatalf("latest git tag (%s) and synced lable (%s) are the same?", lastGitTag, tagString)
 	}

 	if !internal.NoInput {
@ -393,15 +393,15 @@ func createReleaseFromPreviousTag(tagString, mainAppVersion string, recipe recip
 	}

 	if err := commitRelease(recipe, tagString); err != nil {
-		logrus.Fatalf("failed to commit changes: %s", err.Error())
+		logrus.Fatal(err)
 	}

 	if err := tagRelease(tagString, repo); err != nil {
-		logrus.Fatalf("failed to tag release: %s", err.Error())
+		logrus.Fatal(err)
 	}

 	if err := pushRelease(recipe, tagString); err != nil {
-		logrus.Fatalf("failed to publish new release: %s", err.Error())
+		logrus.Fatal(err)
 	}

 	return nil
--- a/cli/recipe/sync.go
+++ b/cli/recipe/sync.go
@ -8,7 +8,6 @@ import (
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/config"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/go-git/go-git/v5"
@ -32,8 +31,8 @@ var recipeSyncCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Generate labels for the main recipe service (i.e. by convention, the service
-named "app") which corresponds to the following format:
+This command will generate labels for the main recipe service (i.e. by
+convention, the service named 'app') which corresponds to the following format:

    coop-cloud.${STACK_NAME}.version=<version>

@ -42,7 +41,7 @@ auto-generate it for you. The <recipe> configuration will be updated on the
 local file system.
 `,
 	Action: func(c *cli.Context) error {
-		recipe := internal.ValidateRecipeWithPrompt(c, runtime.WithEnsureRecipeLatest(false))
+		recipe := internal.ValidateRecipeWithPrompt(c, false)

 		mainApp, err := internal.GetMainAppImage(recipe)
 		if err != nil {
--- a/cli/recipe/upgrade.go
+++ b/cli/recipe/upgrade.go
@ -31,9 +31,9 @@ var recipeUpgradeCommand = cli.Command{
 	Aliases: []string{"u"},
 	Usage:   "Upgrade recipe image tags",
 	Description: `
-Parse all image tags within the given <recipe> configuration and prompt with
-more recent tags to upgrade to. It will update the relevant compose file tags
-on the local file system.
+This command reads and attempts to parse all image tags within the given
+<recipe> configuration and prompt with more recent tags to upgrade to. It will
+update the relevant compose file tags on the local file system.

 Some image tags cannot be parsed because they do not follow some sort of
 semver-like convention. In this case, all possible tags will be listed and it
@ -59,11 +59,7 @@ You may invoke this command in "wizard" mode and be prompted for input:
 	},
 	Before: internal.SubCommandBefore,
 	Action: func(c *cli.Context) error {
-		recipe := internal.ValidateRecipeWithPrompt(c)
-
-		if err := recipePkg.EnsureUpToDate(recipe.Name); err != nil {
-			logrus.Fatal(err)
-		}
+		recipe := internal.ValidateRecipeWithPrompt(c, true)

 		bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
 		if bumpType != 0 {
--- a/cli/recipe/version.go
+++ b/cli/recipe/version.go
@ -5,7 +5,6 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/formatter"
 	recipePkg "coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
@ -21,7 +20,7 @@ var recipeVersionCommand = cli.Command{
 	Before:       internal.SubCommandBefore,
 	BashComplete: autocomplete.RecipeNameComplete,
 	Action: func(c *cli.Context) error {
-		recipe := internal.ValidateRecipe(c, runtime.WithEnsureRecipeLatest(false))
+		recipe := internal.ValidateRecipe(c, false)

 		catalogue, err := recipePkg.ReadRecipeCatalogue()
 		if err != nil {
@ -33,13 +32,13 @@ var recipeVersionCommand = cli.Command{
 			logrus.Fatalf("%s recipe doesn't exist?", recipe.Name)
 		}

-		tableCol := []string{"Version", "Service", "Image", "Tag"}
+		tableCol := []string{"Version", "Service", "Image", "Tag", "Digest"}
 		table := formatter.CreateTable(tableCol)

 		for i := len(recipeMeta.Versions) - 1; i >= 0; i-- {
 			for tag, meta := range recipeMeta.Versions[i] {
 				for service, serviceMeta := range meta {
-					table.Append([]string{tag, service, serviceMeta.Image, serviceMeta.Tag})
+					table.Append([]string{tag, service, serviceMeta.Image, serviceMeta.Tag, serviceMeta.Digest})
 				}
 			}
 		}
--- a/cli/record/list.go
+++ b/cli/record/list.go
@ -25,8 +25,8 @@ var RecordListCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-List all domain name records managed by a 3rd party provider for a specific
-zone.
+This command lists all domain name records managed by a 3rd party provider for
+a specific zone.

 You must specify a zone (e.g. example.com) under which your domain name records
 are listed. This zone must already be created on your provider account.
--- a/cli/record/new.go
+++ b/cli/record/new.go
@ -33,7 +33,7 @@ var RecordNewCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Create a new domain name record for a specific zone.
+This command creates a new domain name record for a specific zone.

 You must specify a zone (e.g. example.com) under which your domain name records
 are listed. This zone must already be created on your provider account.
--- a/cli/record/record.go
+++ b/cli/record/record.go
@ -11,9 +11,9 @@ var RecordCommand = cli.Command{
 	Aliases:   []string{"rc"},
 	ArgsUsage: "<record>",
 	Description: `
-Manage domain name records via 3rd party providers such as Gandi DNS. It
-supports listing, creating and removing all types of records that you might
-need for managing Co-op Cloud apps.
+This command supports managing domain name records via 3rd party providers such
+as Gandi DNS. It supports listing, creating and removing all types of records
+that you might need for managing Co-op Cloud apps.

 The following providers are supported:

--- a/cli/record/remove.go
+++ b/cli/record/remove.go
@ -30,7 +30,7 @@ var RecordRemoveCommand = cli.Command{
 	},
 	Before: internal.SubCommandBefore,
 	Description: `
-Remove a domain name record for a specific zone.
+This command removes a domain name record for a specific zone.

 It uses the type of record and name to match existing records and choose one
 for deletion. You must specify a zone (e.g. example.com) under which your
--- a/cli/server/add.go
+++ b/cli/server/add.go
@ -1,9 +1,14 @@
 package server

 import (
+	"context"
 	"errors"
+	"fmt"
 	"os"
+	"os/exec"
+	"os/user"
 	"path/filepath"
+	"strings"

 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/client"
@ -11,11 +16,34 @@ import (
 	contextPkg "coopcloud.tech/abra/pkg/context"
 	"coopcloud.tech/abra/pkg/dns"
 	"coopcloud.tech/abra/pkg/server"
-	sshPkg "coopcloud.tech/abra/pkg/ssh"
+	"coopcloud.tech/abra/pkg/ssh"
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/swarm"
+	dockerClient "github.com/docker/docker/client"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )

+var (
+	dockerInstallMsg = `
+A docker installation cannot be found on %s. This is a required system
+dependency for running Co-op Cloud on your server. If you would like, Abra can
+attempt to install Docker for you using the upstream non-interactive
+installation script.
+
+See the following documentation for more:
+
+    https://docs.docker.com/engine/install/debian/#install-using-the-convenience-script
+
+N.B Docker doesn't recommend it for production environments but many use it for
+such purposes. Docker stable is now installed by default by this script. The
+source for this script can be seen here:
+
+    https://github.com/docker/docker-install
+`
+)
+
 var local bool
 var localFlag = &cli.BoolFlag{
 	Name:        "local, l",
@ -23,36 +51,106 @@ var localFlag = &cli.BoolFlag{
 	Destination: &local,
 }

+var provision bool
+var provisionFlag = &cli.BoolFlag{
+	Name:        "provision, p",
+	Usage:       "Provision server so it can deploy apps",
+	Destination: &provision,
+}
+
+var sshAuth string
+var sshAuthFlag = &cli.StringFlag{
+	Name:        "ssh-auth, s",
+	Value:       "identity-file",
+	Usage:       "Select SSH authentication method (identity-file, password)",
+	Destination: &sshAuth,
+}
+
+var askSudoPass bool
+var askSudoPassFlag = &cli.BoolFlag{
+	Name:        "ask-sudo-pass, a",
+	Usage:       "Ask for sudo password",
+	Destination: &askSudoPass,
+}
+
 func cleanUp(domainName string) {
-	if domainName != "default" {
-		logrus.Infof("cleaning up context for %s", domainName)
-		if err := client.DeleteContext(domainName); err != nil {
-			logrus.Fatal(err)
-		}
+	logrus.Warnf("cleaning up context for %s", domainName)
+	if err := client.DeleteContext(domainName); err != nil {
+		logrus.Fatal(err)
 	}

-	logrus.Infof("attempting to clean up server directory for %s", domainName)
-
-	serverDir := filepath.Join(config.SERVERS_DIR, domainName)
-	files, err := config.GetAllFilesInDirectory(serverDir)
-	if err != nil {
-		logrus.Fatalf("unable to list files in %s: %s", serverDir, err)
-	}
-
-	if len(files) > 0 {
-		logrus.Warnf("aborting clean up of %s because it is not empty", serverDir)
-		return
-	}
-
-	if err := os.RemoveAll(serverDir); err != nil {
+	logrus.Warnf("cleaning up server directory for %s", domainName)
+	if err := os.RemoveAll(filepath.Join(config.SERVERS_DIR, domainName)); err != nil {
 		logrus.Fatal(err)
 	}
 }

-// newContext creates a new internal Docker context for a server. This is how
-// Docker manages SSH connection details. These are stored to disk in
-// ~/.docker. Abra can manage this completely for the user, so it's an
-// implementation detail.
+func installDockerLocal(c *cli.Context) error {
+	fmt.Println(fmt.Sprintf(dockerInstallMsg, "this local server"))
+
+	response := false
+	prompt := &survey.Confirm{
+		Message: fmt.Sprintf("attempt install docker on local server?"),
+	}
+	if err := survey.AskOne(prompt, &response); err != nil {
+		return err
+	}
+	if !response {
+		logrus.Fatal("exiting as requested")
+	}
+
+	for _, exe := range []string{"wget", "bash"} {
+		exists, err := ensureLocalExecutable(exe)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("%s missing, please install it", exe)
+		}
+	}
+
+	cmd := exec.Command("bash", "-c", "wget -O- https://get.docker.com | bash")
+	if err := internal.RunCmd(cmd); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func newLocalServer(c *cli.Context, domainName string) error {
+	if err := createServerDir(domainName); err != nil {
+		return err
+	}
+
+	cl, err := newClient(c, domainName)
+	if err != nil {
+		return err
+	}
+
+	if provision {
+		exists, err := ensureLocalExecutable("docker")
+		if err != nil {
+			return err
+		}
+
+		if !exists {
+			if err := installDockerLocal(c); err != nil {
+				return err
+			}
+		}
+
+		if err := initSwarmLocal(c, cl, domainName); err != nil {
+			if !strings.Contains(err.Error(), "proxy already exists") {
+				logrus.Fatal(err)
+			}
+		}
+	}
+
+	logrus.Info("local server has been added")
+
+	return nil
+}
+
 func newContext(c *cli.Context, domainName, username, port string) error {
 	store := contextPkg.NewDefaultDockerContextStore()
 	contexts, err := store.Store.List()
@ -76,7 +174,187 @@ func newContext(c *cli.Context, domainName, username, port string) error {
 	return nil
 }

-// createServerDir creates the ~/.abra/servers/... directory for a new server.
+func newClient(c *cli.Context, domainName string) (*dockerClient.Client, error) {
+	cl, err := client.New(domainName)
+	if err != nil {
+		return &dockerClient.Client{}, err
+	}
+	return cl, nil
+}
+
+func installDocker(c *cli.Context, cl *dockerClient.Client, sshCl *ssh.Client, domainName string) error {
+	exists, err := ensureRemoteExecutable("docker", sshCl)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		fmt.Println(fmt.Sprintf(dockerInstallMsg, domainName))
+
+		response := false
+		prompt := &survey.Confirm{
+			Message: fmt.Sprintf("attempt install docker on %s?", domainName),
+		}
+
+		if err := survey.AskOne(prompt, &response); err != nil {
+			return err
+		}
+
+		if !response {
+			logrus.Fatal("exiting as requested")
+		}
+
+		exes := []string{"wget", "bash"}
+		if askSudoPass {
+			exes = append(exes, "ssh-askpass")
+		}
+
+		for _, exe := range exes {
+			exists, err := ensureRemoteExecutable(exe, sshCl)
+			if err != nil {
+				return err
+			}
+			if !exists {
+				return fmt.Errorf("%s missing on remote, please install it", exe)
+			}
+		}
+
+		var sudoPass string
+		if askSudoPass {
+			cmd := "wget -O- https://get.docker.com | bash"
+
+			prompt := &survey.Password{
+				Message: "sudo password?",
+			}
+
+			if err := survey.AskOne(prompt, &sudoPass); err != nil {
+				return err
+			}
+
+			logrus.Debugf("running %s on %s now with sudo password", cmd, domainName)
+
+			if sudoPass == "" {
+				return fmt.Errorf("missing sudo password but requested --ask-sudo-pass?")
+			}
+
+			logrus.Warn("installing docker, this could take some time...")
+
+			if err := ssh.RunSudoCmd(cmd, sudoPass, sshCl); err != nil {
+				fmt.Print(fmt.Sprintf(`
+Abra was unable to bootstrap Docker, see below for logs:
+
+
+%s
+
+If nothing works, you try running the Docker install script manually on your server:
+
+    wget -O- https://get.docker.com | bash
+
+`, string(err.Error())))
+				logrus.Fatal("Process exited with status 1")
+			}
+
+			logrus.Infof("docker is installed on %s", domainName)
+
+			remoteUser := sshCl.SSHClient.Conn.User()
+			logrus.Infof("adding %s to docker group", remoteUser)
+			permsCmd := fmt.Sprintf("sudo usermod -aG docker %s", remoteUser)
+			if err := ssh.RunSudoCmd(permsCmd, sudoPass, sshCl); err != nil {
+				return err
+			}
+		} else {
+			cmd := "wget -O- https://get.docker.com | bash"
+
+			logrus.Debugf("running %s on %s now without sudo password", cmd, domainName)
+
+			logrus.Warn("installing docker, this could take some time...")
+
+			if out, err := sshCl.Exec(cmd); err != nil {
+				fmt.Print(fmt.Sprintf(`
+Abra was unable to bootstrap Docker, see below for logs:
+
+
+%s
+
+This could be due to a number of things but one of the most common is that your
+server user account does not have sudo access, and if it does, you need to pass
+"--ask-sudo-pass" in order to supply Abra with your password.
+
+If nothing works, you try running the Docker install script manually on your server:
+
+    wget -O- https://get.docker.com | bash
+
+`, string(out)))
+				logrus.Fatal(err)
+			}
+
+			logrus.Infof("docker is installed on %s", domainName)
+		}
+	}
+
+	return nil
+}
+
+func initSwarmLocal(c *cli.Context, cl *dockerClient.Client, domainName string) error {
+	initReq := swarm.InitRequest{ListenAddr: "0.0.0.0:2377"}
+	if _, err := cl.SwarmInit(context.Background(), initReq); err != nil {
+		if strings.Contains(err.Error(), "is already part of a swarm") ||
+			strings.Contains(err.Error(), "must specify a listening address") {
+			logrus.Infof("swarm mode already initialised on %s", domainName)
+		} else {
+			return err
+		}
+	} else {
+		logrus.Infof("initialised swarm mode on local server")
+	}
+
+	netOpts := types.NetworkCreate{Driver: "overlay", Scope: "swarm"}
+	if _, err := cl.NetworkCreate(context.Background(), "proxy", netOpts); err != nil {
+		if !strings.Contains(err.Error(), "proxy already exists") {
+			return err
+		}
+		logrus.Info("swarm overlay network already created on local server")
+	} else {
+		logrus.Infof("swarm overlay network created on local server")
+	}
+
+	return nil
+}
+
+func initSwarm(c *cli.Context, cl *dockerClient.Client, domainName string) error {
+	ipv4, err := dns.EnsureIPv4(domainName)
+	if err != nil {
+		return err
+	}
+
+	initReq := swarm.InitRequest{
+		ListenAddr:    "0.0.0.0:2377",
+		AdvertiseAddr: ipv4,
+	}
+	if _, err := cl.SwarmInit(context.Background(), initReq); err != nil {
+		if strings.Contains(err.Error(), "is already part of a swarm") ||
+			strings.Contains(err.Error(), "must specify a listening address") {
+			logrus.Infof("swarm mode already initialised on %s", domainName)
+		} else {
+			return err
+		}
+	} else {
+		logrus.Infof("initialised swarm mode on %s", domainName)
+	}
+
+	netOpts := types.NetworkCreate{Driver: "overlay", Scope: "swarm"}
+	if _, err := cl.NetworkCreate(context.Background(), "proxy", netOpts); err != nil {
+		if !strings.Contains(err.Error(), "proxy already exists") {
+			return err
+		}
+		logrus.Infof("swarm overlay network already created on %s", domainName)
+	} else {
+		logrus.Infof("swarm overlay network created on %s", domainName)
+	}
+
+	return nil
+}
+
 func createServerDir(domainName string) error {
 	if err := server.CreateServerDir(domainName); err != nil {
 		if !os.IsExist(err) {
@ -84,7 +362,6 @@ func createServerDir(domainName string) error {
 		}
 		logrus.Debugf("server dir for %s already created", domainName)
 	}
-
 	return nil
 }

@ -93,21 +370,34 @@ var serverAddCommand = cli.Command{
 	Aliases: []string{"a"},
 	Usage:   "Add a server to your configuration",
 	Description: `
-Add a new server to your configuration so that it can be managed by Abra.
+This command adds a new server to your configuration so that it can be managed
+by Abra. This command can also provision your server ("--provision/-p") with a
+Docker installation so that it is capable of hosting Co-op Cloud apps.

-Abra uses the SSH command-line to discover connection details for your server.
-It is advised to configure an entry per-host in your ~/.ssh/config for each
-server. For example:
+Abra will default to expecting that you have a running ssh-agent and are using
+SSH keys to connect to your new server. Abra will also read your SSH config
+(matching "Host" as <domain>). SSH connection details precedence follows as
+such: command-line > SSH config > guessed defaults.

-Host example.com
-  Hostname example.com
-  User exampleUser
-  Port 12345
-  IdentityFile ~/.ssh/example@somewhere
+If you have no SSH key configured for this host and are instead using password
+authentication, you may pass "--ssh-auth password" to have Abra ask you for the
+password. "--ask-sudo-pass" may be passed if you run your provisioning commands
+via sudo privilege escalation.

-Abra can then load SSH connection details from this configuratiion with:
+The <domain> argument must be a publicy accessible domain name which points to
+your server. You should working SSH access to this server already, Abra will
+assume port 22 and will use your current system username to make an initial
+connection. You can use the <user> and <port> arguments to adjust this.

-    abra server add example.com
+Example:
+
+    abra server add varia.zone glodemodem 12345 -p
+
+Abra will construct the following SSH connection and Docker context:
+
+    ssh://globemodem@varia.zone:12345
+
+All communication between Abra and the server will use this SSH connection.

 If "--local" is passed, then Abra assumes that the current local server is
 intended as the target server. This is useful when you want to have your entire
@ -118,64 +408,104 @@ developer machine.
 		internal.DebugFlag,
 		internal.NoInputFlag,
 		localFlag,
+		provisionFlag,
+		sshAuthFlag,
+		askSudoPassFlag,
 	},
 	Before:    internal.SubCommandBefore,
-	ArgsUsage: "<domain>",
+	ArgsUsage: "<domain> [<user>] [<port>]",
 	Action: func(c *cli.Context) error {
 		if len(c.Args()) > 0 && local || !internal.ValidateSubCmdFlags(c) {
 			err := errors.New("cannot use <domain> and --local together")
 			internal.ShowSubcommandHelpAndError(c, err)
 		}

-		var domainName string
-		if local {
-			domainName = "default"
-		} else {
-			domainName = internal.ValidateDomain(c)
+		if sshAuth != "password" && sshAuth != "identity-file" {
+			err := errors.New("--ssh-auth only accepts identity-file or password")
+			internal.ShowSubcommandHelpAndError(c, err)
 		}

+		domainName := internal.ValidateDomain(c)
+
 		if local {
-			if err := createServerDir(domainName); err != nil {
+			if err := newLocalServer(c, "default"); err != nil {
 				logrus.Fatal(err)
 			}
-
-			logrus.Infof("attempting to create client for %s", domainName)
-			if _, err := client.New(domainName); err != nil {
-				cleanUp(domainName)
-				logrus.Fatal(err)
-			}
-
-			logrus.Info("local server added")
-
 			return nil
 		}

-		if _, err := dns.EnsureIPv4(domainName); err != nil {
-			logrus.Fatal(err)
+		username := c.Args().Get(1)
+		if username == "" {
+			systemUser, err := user.Current()
+			if err != nil {
+				return err
+			}
+			username = systemUser.Username
+		}
+
+		port := c.Args().Get(2)
+		if port == "" {
+			port = "22"
 		}

 		if err := createServerDir(domainName); err != nil {
 			logrus.Fatal(err)
 		}

-		hostConfig, err := sshPkg.GetHostConfig(domainName)
+		if err := newContext(c, domainName, username, port); err != nil {
+			logrus.Fatal(err)
+		}
+
+		cl, err := newClient(c, domainName)
 		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		if err := newContext(c, domainName, hostConfig.User, hostConfig.Port); err != nil {
-			logrus.Fatal(err)
-		}
-
-		logrus.Infof("attempting to create client for %s", domainName)
-		if _, err := client.New(domainName); err != nil {
 			cleanUp(domainName)
 			logrus.Debugf("failed to construct client for %s, saw %s", domainName, err.Error())
-			logrus.Fatal(sshPkg.Fatal(domainName, err))
+			logrus.Fatalf(fmt.Sprintf(internal.ServerAddFailMsg, domainName))
 		}

-		logrus.Infof("%s added", domainName)
+		if provision {
+			logrus.Debugf("attempting to construct SSH client for %s", domainName)
+			sshCl, err := ssh.New(domainName, sshAuth, username, port)
+			if err != nil {
+				cleanUp(domainName)
+				logrus.Fatalf(fmt.Sprintf(internal.ServerAddFailMsg, domainName))
+			}
+			defer sshCl.Close()
+			logrus.Debugf("successfully created SSH client for %s", domainName)
+
+			if err := installDocker(c, cl, sshCl, domainName); err != nil {
+				logrus.Fatal(err)
+			}
+			if err := initSwarm(c, cl, domainName); err != nil {
+				logrus.Fatal(err)
+			}
+		}
+
+		if _, err := cl.Info(context.Background()); err != nil {
+			cleanUp(domainName)
+			logrus.Fatalf(fmt.Sprintf(internal.ServerAddFailMsg, domainName))
+		}

 		return nil
 	},
 }
+
+// ensureLocalExecutable ensures that an executable is present on the local machine
+func ensureLocalExecutable(exe string) (bool, error) {
+	out, err := exec.Command("which", exe).Output()
+	if err != nil {
+		return false, err
+	}
+
+	return string(out) != "", nil
+}
+
+// ensureRemoteExecutable ensures that an executable is present on a remote machine
+func ensureRemoteExecutable(exe string, sshCl *ssh.Client) (bool, error) {
+	out, err := sshCl.Exec(fmt.Sprintf("which %s", exe))
+	if err != nil && string(out) != "" {
+		return false, err
+	}
+
+	return string(out) != "", nil
+}
--- a/cli/server/list.go
+++ b/cli/server/list.go
@ -12,22 +12,12 @@ import (
 	"github.com/urfave/cli"
 )

-var problemsFilter bool
-
-var problemsFilterFlag = &cli.BoolFlag{
-	Name:        "problems, p",
-	Usage:       "Show only servers with potential connection problems",
-	Destination: &problemsFilter,
-}
-
 var serverListCommand = cli.Command{
 	Name:    "list",
 	Aliases: []string{"ls"},
 	Usage:   "List managed servers",
 	Flags: []cli.Flag{
-		problemsFilterFlag,
 		internal.DebugFlag,
-		internal.MachineReadableFlag,
 	},
 	Before: internal.SubCommandBefore,
 	Action: func(c *cli.Context) error {
@ -39,11 +29,8 @@ var serverListCommand = cli.Command{

 		tableColumns := []string{"name", "host", "user", "port"}
 		table := formatter.CreateTable(tableColumns)
-		if internal.MachineReadable {
-			defer table.JSONRender()
-		} else {
-			defer table.Render()
-		}
+		defer table.Render()
+
 		serverNames, err := config.ReadServerNames()
 		if err != nil {
 			logrus.Fatal(err)
@ -57,7 +44,6 @@ var serverListCommand = cli.Command{
 					// No local context found, we can continue safely
 					continue
 				}
-
 				if ctx.Name == serverName {
 					sp, err := ssh.ParseURL(endpoint)
 					if err != nil {
@ -66,7 +52,6 @@ var serverListCommand = cli.Command{
 					row = []string{serverName, sp.Host, sp.User, sp.Port}
 				}
 			}
-
 			if len(row) == 0 {
 				if serverName == "default" {
 					row = []string{serverName, "local", "n/a", "n/a"}
@ -74,14 +59,7 @@ var serverListCommand = cli.Command{
 					row = []string{serverName, "unknown", "unknown", "unknown"}
 				}
 			}
-
-			if problemsFilter {
-				if row[1] == "unknown" {
-					table.Append(row)
-				}
-			} else {
-				table.Append(row)
-			}
+			table.Append(row)
 		}

 		return nil
--- a/cli/server/new.go
+++ b/cli/server/new.go
@ -99,10 +99,9 @@ You can access this new VPS via SSH using the following command:
    ssh root@%s

 Please note, this server is not managed by Abra yet (i.e. "abra server ls" will
-not list this server)! You will need to assign a domain name record (manually
-or by using "abra record new") and add the server to your Abra configuration
-("abra server add") to have a working server that you can deploy Co-op Cloud
-apps to.
+not list this server)! You will need to assign a domain name record ("abra
+record new") and add the server to your Abra configuration ("abra server add")
+to have a working server that you can deploy Co-op Cloud apps to.

 When setting up domain name records, you probably want to set up the following
 2 A records. This supports deploying apps to your root domain (e.g.
@ -111,6 +110,7 @@ bar.example.com).

    @  1800 IN A %s
    *  1800 IN A %s
+
 	`,
 		internal.HetznerCloudName, ip, rootPassword,
 		ip, ip, ip,
@ -181,10 +181,9 @@ address. You can learn all about how to get SSH access to your new Capsul on:
    %s/about-ssh

 Please note, this server is not managed by Abra yet (i.e. "abra server ls" will
-not list this server)! You will need to assign a domain name record (manually
-or by using "abra record new") and add the server to your Abra configuration
-("abra server add") to have a working server that you can deploy Co-op Cloud
-apps to.
+not list this server)! You will need to assign a domain name record ("abra
+record new") and add the server to your Abra configuration ("abra server add")
+to have a working server that you can deploy Co-op Cloud apps to.

 When setting up domain name records, you probably want to set up the following
 2 A records. This supports deploying apps to your root domain (e.g.
@ -193,6 +192,7 @@ bar.example.com).

    @  1800 IN A <your-capsul-ip>
    *  1800 IN A <your-capsul-ip>
+
 	`, internal.CapsulName, resp.ID, internal.CapsulInstanceURL))

 	return nil
@ -203,7 +203,7 @@ var serverNewCommand = cli.Command{
 	Aliases: []string{"n"},
 	Usage:   "Create a new server using a 3rd party provider",
 	Description: `
-Create a new server via a 3rd party provider.
+This command creates a new server via a 3rd party provider.

 The following providers are supported:

@ -217,6 +217,8 @@ You may invoke this command in "wizard" mode and be prompted for input:
 API tokens are read from the environment if specified, e.g.

    export HCLOUD_TOKEN=...
+
+Where "$provider_TOKEN" is the expected env var format.
 `,
 	Flags: []cli.Flag{
 		internal.DebugFlag,
--- a/cli/server/remove.go
+++ b/cli/server/remove.go
@ -104,7 +104,7 @@ var serverRemoveCommand = cli.Command{
 	ArgsUsage: "[<server>]",
 	Usage:     "Remove a managed server",
 	Description: `
-Remova a server from Abra management.
+This command removes a server from Abra management.

 Depending on whether you used a 3rd party provider to create this server ("abra
 server new"), you can also destroy the virtual server as well. Pass
--- a/cli/server/server.go
+++ b/cli/server/server.go
@ -10,12 +10,13 @@ var ServerCommand = cli.Command{
 	Aliases: []string{"s"},
 	Usage:   "Manage servers",
 	Description: `
-Create, manage and remove servers using 3rd party integrations. 
+These commands support creating, managing and removing servers using 3rd party
+integrations. 

 Servers can be created from scratch using the "abra server new" command. If you
 already have a server, you can add it to your configuration using "abra server
 add". Abra can provision servers so that they are ready to deploy Co-op Cloud
-recipes, see available flags on "abra server add" for more.
+apps, see available flags on "server add" for more.
 `,
 	Subcommands: []cli.Command{
 		serverNewCommand,
--- a/cli/updater/updater.go
+++ b/cli/updater/updater.go
@ -1,497 +0,0 @@
-package updater
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/config"
-	"coopcloud.tech/abra/pkg/lint"
-	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/runtime"
-	"coopcloud.tech/abra/pkg/upstream/convert"
-	"coopcloud.tech/abra/pkg/upstream/stack"
-	"coopcloud.tech/tagcmp"
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	dockerclient "github.com/docker/docker/client"
-
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
-)
-
-const SERVER = "localhost"
-
-var majorUpdate bool
-var majorFlag = &cli.BoolFlag{
-	Name:        "major, m",
-	Usage:       "Also check for major updates",
-	Destination: &majorUpdate,
-}
-
-var updateAll bool
-var allFlag = &cli.BoolFlag{
-	Name:        "all, a",
-	Usage:       "Update all deployed apps",
-	Destination: &updateAll,
-}
-
-// Notify checks for available upgrades
-var Notify = cli.Command{
-	Name:    "notify",
-	Aliases: []string{"n"},
-	Usage:   "Check for available upgrades",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-		majorFlag,
-	},
-	Before: internal.SubCommandBefore,
-	Description: `
-It reads the deployed app versions and looks for new versions in the recipe
-catalogue. If a new patch/minor version is available, a notification is
-printed. To include major versions use the --major flag.
-`,
-	Action: func(c *cli.Context) error {
-		cl, err := client.New("default")
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		stacks, err := stack.GetStacks(cl)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		for _, stackInfo := range stacks {
-			stackName := stackInfo.Name
-			recipeName, err := getLabel(cl, stackName, "recipe")
-			if err != nil {
-				logrus.Fatal(err)
-			}
-
-			if recipeName != "" {
-				_, err = getLatestUpgrade(cl, stackName, recipeName)
-				if err != nil {
-					logrus.Fatal(err)
-				}
-			}
-		}
-
-		return nil
-	},
-}
-
-// UpgradeApp upgrades apps.
-var UpgradeApp = cli.Command{
-	Name:      "upgrade",
-	Aliases:   []string{"u"},
-	Usage:     "Upgrade apps",
-	ArgsUsage: "<stack-name> <recipe>",
-	Flags: []cli.Flag{
-		internal.DebugFlag,
-		internal.ChaosFlag,
-		majorFlag,
-		allFlag,
-	},
-	Before: internal.SubCommandBefore,
-	Description: `
-Upgrade an app by specifying its stack name and recipe. By passing "--all"
-instead, every deployed app is upgraded. For each apps with enabled auto
-updates the deployed version is compared with the current recipe catalogue
-version. If a new patch/minor version is available, the app is upgraded. To
-include major versions use the "--major" flag. Don't do that, it will probably
-break things. Only apps that are not deployed with "--chaos" are upgraded, to
-update chaos deployments use the "--chaos" flag. Use it with care.
-`,
-	Action: func(c *cli.Context) error {
-		cl, err := client.New("default")
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		conf := runtime.New()
-
-		if !updateAll {
-			stackName := c.Args().Get(0)
-			recipeName := c.Args().Get(1)
-			err = tryUpgrade(cl, stackName, recipeName, conf)
-			if err != nil {
-				logrus.Fatal(err)
-			}
-
-			return nil
-		}
-
-		stacks, err := stack.GetStacks(cl)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		for _, stackInfo := range stacks {
-			stackName := stackInfo.Name
-			recipeName, err := getLabel(cl, stackName, "recipe")
-			if err != nil {
-				logrus.Fatal(err)
-			}
-
-			err = tryUpgrade(cl, stackName, recipeName, conf)
-			if err != nil {
-				logrus.Fatal(err)
-			}
-		}
-
-		return nil
-	},
-}
-
-// getLabel reads docker labels in the format of "coop-cloud.${STACK_NAME}.${LABEL}".
-func getLabel(cl *dockerclient.Client, stackName string, label string) (string, error) {
-	filter := filters.NewArgs()
-	filter.Add("label", fmt.Sprintf("%s=%s", convert.LabelNamespace, stackName))
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filter})
-	if err != nil {
-		return "", err
-	}
-
-	for _, service := range services {
-		labelKey := fmt.Sprintf("coop-cloud.%s.%s", stackName, label)
-		if labelValue, ok := service.Spec.Labels[labelKey]; ok {
-			return labelValue, nil
-		}
-	}
-
-	logrus.Debugf("no %s label found for %s", label, stackName)
-
-	return "", nil
-}
-
-// getBoolLabel reads a boolean docker label.
-func getBoolLabel(cl *dockerclient.Client, stackName string, label string) (bool, error) {
-	lableValue, err := getLabel(cl, stackName, label)
-	if err != nil {
-		return false, err
-	}
-
-	if lableValue != "" {
-		value, err := strconv.ParseBool(lableValue)
-		if err != nil {
-			return false, err
-		}
-
-		return value, nil
-	}
-
-	logrus.Debugf("Boolean label %s could not be found for %s, set default to false.", label, stackName)
-
-	return false, nil
-}
-
-// getEnv reads env variables from docker services.
-func getEnv(cl *dockerclient.Client, stackName string) (config.AppEnv, error) {
-	envMap := make(map[string]string)
-	filter := filters.NewArgs()
-	filter.Add("label", fmt.Sprintf("%s=%s", convert.LabelNamespace, stackName))
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filter})
-	if err != nil {
-		return nil, err
-	}
-
-	for _, service := range services {
-		envList := service.Spec.TaskTemplate.ContainerSpec.Env
-		for _, envString := range envList {
-			splitString := strings.SplitN(envString, "=", 2)
-			if len(splitString) != 2 {
-				logrus.Debugf("can't separate key from value: %s (this variable is probably unset)", envString)
-				continue
-			}
-			k := splitString[0]
-			v := splitString[1]
-			logrus.Debugf("For %s read env %s with value: %s from docker service", stackName, k, v)
-			envMap[k] = v
-		}
-	}
-
-	return envMap, nil
-}
-
-// getLatestUpgrade returns the latest available version for an app respecting
-// the "--major" flag if it is newer than the currently deployed version.
-func getLatestUpgrade(cl *dockerclient.Client, stackName string, recipeName string) (string, error) {
-	deployedVersion, err := getDeployedVersion(cl, stackName, recipeName)
-	if err != nil {
-		return "", err
-	}
-
-	availableUpgrades, err := getAvailableUpgrades(cl, stackName, recipeName, deployedVersion)
-	if err != nil {
-		return "", err
-	}
-
-	if len(availableUpgrades) == 0 {
-		logrus.Debugf("no available upgrades for %s", stackName)
-		return "", nil
-	}
-
-	var chosenUpgrade string
-	if len(availableUpgrades) > 0 {
-		chosenUpgrade = availableUpgrades[len(availableUpgrades)-1]
-		logrus.Infof("%s (%s) can be upgraded from version %s to %s", stackName, recipeName, deployedVersion, chosenUpgrade)
-	}
-
-	return chosenUpgrade, nil
-}
-
-// getDeployedVersion returns the currently deployed version of an app.
-func getDeployedVersion(cl *dockerclient.Client, stackName string, recipeName string) (string, error) {
-	logrus.Debugf("Retrieve deployed version whether %s is already deployed", stackName)
-
-	isDeployed, deployedVersion, err := stack.IsDeployed(context.Background(), cl, stackName)
-	if err != nil {
-		return "", err
-	}
-
-	if !isDeployed {
-		return "", fmt.Errorf("%s is not deployed?", stackName)
-	}
-
-	if deployedVersion == "unknown" {
-		return "", fmt.Errorf("failed to determine deployed version of %s", stackName)
-	}
-
-	return deployedVersion, nil
-}
-
-// getAvailableUpgrades returns all available versions of an app that are newer
-// than the deployed version. It only includes major upgrades if the "--major"
-// flag is set.
-func getAvailableUpgrades(cl *dockerclient.Client, stackName string, recipeName string,
-	deployedVersion string) ([]string, error) {
-	catl, err := recipe.ReadRecipeCatalogue()
-	if err != nil {
-		return nil, err
-	}
-
-	versions, err := recipe.GetRecipeCatalogueVersions(recipeName, catl)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(versions) == 0 {
-		return nil, fmt.Errorf("no published releases for %s in the recipe catalogue?", recipeName)
-	}
-
-	var availableUpgrades []string
-	for _, version := range versions {
-		parsedDeployedVersion, err := tagcmp.Parse(deployedVersion)
-		if err != nil {
-			return nil, err
-		}
-
-		parsedVersion, err := tagcmp.Parse(version)
-		if err != nil {
-			return nil, err
-		}
-
-		versionDelta, err := parsedDeployedVersion.UpgradeDelta(parsedVersion)
-		if err != nil {
-			return nil, err
-		}
-
-		if 0 < versionDelta.UpgradeType() && (versionDelta.UpgradeType() < 4 || majorUpdate) {
-			availableUpgrades = append(availableUpgrades, version)
-		}
-	}
-
-	logrus.Debugf("Available updates for %s: %s", stackName, availableUpgrades)
-
-	return availableUpgrades, nil
-}
-
-// processRecipeRepoVersion clones, pulls, checks out the version and lints the
-// recipe repository.
-func processRecipeRepoVersion(recipeName, version string, conf *runtime.Config) error {
-	if err := recipe.EnsureExists(recipeName, conf); err != nil {
-		return err
-	}
-
-	if err := recipe.EnsureUpToDate(recipeName); err != nil {
-		return err
-	}
-
-	if err := recipe.EnsureVersion(recipeName, version); err != nil {
-		return err
-	}
-
-	if r, err := recipe.Get(recipeName, conf); err != nil {
-		return err
-	} else if err := lint.LintForErrors(r); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// mergeAbraShEnv merges abra.sh env vars into the app env vars.
-func mergeAbraShEnv(recipeName string, env config.AppEnv) error {
-	abraShPath := fmt.Sprintf("%s/%s/%s", config.RECIPES_DIR, recipeName, "abra.sh")
-	abraShEnv, err := config.ReadAbraShEnvVars(abraShPath)
-	if err != nil {
-		return err
-	}
-
-	for k, v := range abraShEnv {
-		logrus.Debugf("read v:%s k: %s", v, k)
-		env[k] = v
-	}
-
-	return nil
-}
-
-// createDeployConfig merges and enriches the compose config for the deployment.
-func createDeployConfig(recipeName string, stackName string, env config.AppEnv) (*composetypes.Config, stack.Deploy, error) {
-	env["STACK_NAME"] = stackName
-
-	deployOpts := stack.Deploy{
-		Namespace:    stackName,
-		Prune:        false,
-		ResolveImage: stack.ResolveImageAlways,
-	}
-
-	composeFiles, err := config.GetAppComposeFiles(recipeName, env)
-	if err != nil {
-		return nil, deployOpts, err
-	}
-
-	deployOpts.Composefiles = composeFiles
-	compose, err := config.GetAppComposeConfig(stackName, deployOpts, env)
-	if err != nil {
-		return nil, deployOpts, err
-	}
-
-	config.ExposeAllEnv(stackName, compose, env)
-
-	// after the upgrade the deployment won't be in chaos state anymore
-	config.SetChaosLabel(compose, stackName, false)
-	config.SetRecipeLabel(compose, stackName, recipeName)
-	config.SetUpdateLabel(compose, stackName, env)
-
-	return compose, deployOpts, nil
-}
-
-// tryUpgrade performs the upgrade if all the requirements are fulfilled.
-func tryUpgrade(cl *dockerclient.Client, stackName, recipeName string, conf *runtime.Config) error {
-	if recipeName == "" {
-		logrus.Debugf("Don't update %s due to missing recipe name", stackName)
-		return nil
-	}
-
-	chaos, err := getBoolLabel(cl, stackName, "chaos")
-	if err != nil {
-		return err
-	}
-
-	if chaos && !internal.Chaos {
-		logrus.Debugf("Don't update %s due to chaos deployment.", stackName)
-		return nil
-	}
-
-	updatesEnabled, err := getBoolLabel(cl, stackName, "autoupdate")
-	if err != nil {
-		return err
-	}
-
-	if !updatesEnabled {
-		logrus.Debugf("Don't update %s due to disabling auto updates or missing ENABLE_AUTOUPDATE env.", stackName)
-		return nil
-	}
-
-	upgradeVersion, err := getLatestUpgrade(cl, stackName, recipeName)
-	if err != nil {
-		return err
-	}
-
-	if upgradeVersion == "" {
-		logrus.Debugf("Don't update %s due to no new version.", stackName)
-		return nil
-	}
-
-	err = upgrade(cl, stackName, recipeName, upgradeVersion, conf)
-
-	return err
-}
-
-// upgrade performs all necessary steps to upgrade an app.
-func upgrade(cl *dockerclient.Client, stackName, recipeName, upgradeVersion string, conf *runtime.Config) error {
-	env, err := getEnv(cl, stackName)
-	if err != nil {
-		return err
-	}
-
-	app := config.App{
-		Name:   stackName,
-		Recipe: recipeName,
-		Server: SERVER,
-		Env:    env,
-	}
-
-	if err = processRecipeRepoVersion(recipeName, upgradeVersion, conf); err != nil {
-		return err
-	}
-
-	if err = mergeAbraShEnv(recipeName, app.Env); err != nil {
-		return err
-	}
-
-	compose, deployOpts, err := createDeployConfig(recipeName, stackName, app.Env)
-	if err != nil {
-		return err
-	}
-
-	logrus.Infof("Upgrade %s (%s) to version %s", stackName, recipeName, upgradeVersion)
-
-	err = stack.RunDeploy(cl, deployOpts, compose, stackName, true)
-
-	return err
-}
-
-func newAbraApp(version, commit string) *cli.App {
-	app := &cli.App{
-		Name: "kadabra",
-		Usage: `The Co-op Cloud auto-updater
-    ____                           ____ _                 _
-   / ___|___         ___  _ __    / ___| | ___  _   _  __| |
-  | |   / _ \ _____ / _ \| '_ \  | |   | |/ _ \| | | |/ _' |
-  | |__| (_) |_____| (_) | |_) | | |___| | (_) | |_| | (_| |
-   \____\___/       \___/| .__/   \____|_|\___/ \__,_|\__,_|
-                         |_|
-`,
-		Version: fmt.Sprintf("%s-%s", version, commit[:7]),
-		Commands: []cli.Command{
-			Notify,
-			UpgradeApp,
-		},
-	}
-
-	app.Before = func(c *cli.Context) error {
-		logrus.Debugf("kadabra version %s, commit %s", version, commit)
-		return nil
-	}
-
-	return app
-}
-
-// RunApp runs CLI abra app.
-func RunApp(version, commit string) {
-	app := newAbraApp(version, commit)
-
-	if err := app.Run(os.Args); err != nil {
-		logrus.Fatal(err)
-	}
-}
--- a/cmd/abra/main.go
+++ b/cmd/abra/main.go
@ -5,10 +5,10 @@ import (
 	"coopcloud.tech/abra/cli"
 )

-// Version is the current version of Abra.
+// Version is the current version of Abra
 var Version string

-// Commit is the current git commit of Abra.
+// Commit is the current git commit of Abra
 var Commit string

 func main() {
--- a/cmd/kadabra/main.go
+++ b/cmd/kadabra/main.go
@ -1,23 +0,0 @@
-// Package main provides the command-line entrypoint.
-package main
-
-import (
-	"coopcloud.tech/abra/cli/updater"
-)
-
-// Version is the current version of Kadabra.
-var Version string
-
-// Commit is the current git commit of Kadabra.
-var Commit string
-
-func main() {
-	if Version == "" {
-		Version = "dev"
-	}
-	if Commit == "" {
-		Commit = "       "
-	}
-
-	updater.RunApp(Version, Commit)
-}
--- a/go.mod
+++ b/go.mod
@ -4,38 +4,40 @@ go 1.16

 require (
 	coopcloud.tech/tagcmp v0.0.0-20211103052201-885b22f77d52
-	github.com/AlecAivazis/survey/v2 v2.3.6
+	github.com/AlecAivazis/survey/v2 v2.3.4
 	github.com/Autonomic-Cooperative/godotenv v1.3.1-0.20210731094149-b031ea1211e7
 	github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4
-	github.com/docker/cli v20.10.23+incompatible
+	github.com/docker/cli v20.10.14+incompatible
 	github.com/docker/distribution v2.8.1+incompatible
-	github.com/docker/docker v20.10.23+incompatible
-	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.5.2
-	github.com/hetznercloud/hcloud-go v1.40.0
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/docker/go-units v0.4.0
+	github.com/go-git/go-git/v5 v5.4.2
+	github.com/hetznercloud/hcloud-go v1.33.1
 	github.com/moby/sys/signal v0.7.0
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.13.0
-	github.com/sirupsen/logrus v1.9.0
-	gotest.tools/v3 v3.4.0
+	github.com/schollz/progressbar/v3 v3.8.6
+	github.com/schultz-is/passgen v1.0.1
+	github.com/sirupsen/logrus v1.8.1
+	gotest.tools/v3 v3.1.0
 )

 require (
 	coopcloud.tech/libcapsul v0.0.0-20211022074848-c35e78fe3f3e
+	github.com/ProtonMail/go-crypto v0.0.0-20211112122917-428f8eabeeb3 // indirect
 	github.com/buger/goterm v1.0.4
 	github.com/containerd/containerd v1.5.9 // indirect
 	github.com/containers/image v3.0.2+incompatible
 	github.com/containers/storage v1.38.2 // indirect
-	github.com/decentral1se/passgen v1.0.1
 	github.com/docker/docker-credential-helpers v0.6.4 // indirect
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/fvbommel/sortorder v1.0.2 // indirect
+	github.com/gliderlabs/ssh v0.3.3
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.2
-	github.com/klauspost/pgzip v1.2.5
+	github.com/hashicorp/go-retryablehttp v0.7.0
+	github.com/kevinburke/ssh_config v1.1.0
 	github.com/libdns/gandi v1.0.2
 	github.com/libdns/libdns v0.2.1
 	github.com/moby/sys/mount v0.2.0 // indirect
@ -43,8 +45,9 @@ require (
 	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/spf13/cobra v1.3.0 // indirect
 	github.com/theupdateframework/notary v0.7.0 // indirect
-	github.com/urfave/cli v1.22.9
+	github.com/urfave/cli v1.22.5
+	github.com/xanzy/ssh-agent v0.3.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190809123943-df4f5c81cb3b // indirect
-	golang.org/x/crypto v0.5.0 // indirect
-	golang.org/x/sys v0.5.0
+	golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838
+	golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27
 )
--- a/go.sum
+++ b/go.sum
@ -51,8 +51,8 @@ coopcloud.tech/libcapsul v0.0.0-20211022074848-c35e78fe3f3e/go.mod h1:HEQ9pSJRsD
 coopcloud.tech/tagcmp v0.0.0-20211103052201-885b22f77d52 h1:cyFFOl0tKe+dVHt8saejG8xoff33eQiHxFCVzRpPUjM=
 coopcloud.tech/tagcmp v0.0.0-20211103052201-885b22f77d52/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/AlecAivazis/survey/v2 v2.3.6 h1:NvTuVHISgTHEHeBFqt6BHOe4Ny/NwGZr7w+F8S9ziyw=
-github.com/AlecAivazis/survey/v2 v2.3.6/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI=
+github.com/AlecAivazis/survey/v2 v2.3.4 h1:pchTU9rsLUSvWEl2Aq9Pv3k0IE2fkqtGxazskAMd9Ng=
+github.com/AlecAivazis/survey/v2 v2.3.4/go.mod h1:hrV6Y/kQCLhIZXGcriDCUBtB3wnN7156gMXJ3+b23xM=
 github.com/Autonomic-Cooperative/godotenv v1.3.1-0.20210731094149-b031ea1211e7 h1:asQtdXYbxEYWcwAQqJTVYC/RltB4eqoWKvqWg/LFPOg=
 github.com/Autonomic-Cooperative/godotenv v1.3.1-0.20210731094149-b031ea1211e7/go.mod h1:oZRCMMRS318l07ei4DTqbZoOawfJlJ4yyo8juk2v4Rk=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
@ -84,9 +84,9 @@ github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugX
 github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
 github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.5.2 h1:a9IhgEQBCUEk6QCdml9CiJGhAws+YwffDHEMp1VMrpA=
-github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
@ -104,8 +104,9 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4 h1:ra2OtmuW0AE5csawV4YXMNGNQQXvLRps3z2Z59OPO+I=
-github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4/go.mod h1:UBYPn8k0D56RtnR8RFQMjmh4KrZzWJ5o7Z9SYjossQ8=
+github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
+github.com/ProtonMail/go-crypto v0.0.0-20211112122917-428f8eabeeb3 h1:XcF0cTDJeiuZ5NU8w7WUDge0HRwwNRmxj/GGk6KSA6g=
+github.com/ProtonMail/go-crypto v0.0.0-20211112122917-428f8eabeeb3/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@ -121,6 +122,7 @@ github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@ -158,7 +160,6 @@ github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembj
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@ -184,8 +185,6 @@ github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.1.0 h1:bZgT/A+cikZnKIwn7xL2OBj012Bmvho/o6RpRvv3GKY=
-github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@ -326,8 +325,6 @@ github.com/danieljoos/wincred v1.1.0/go.mod h1:XYlo+eRTsVA9aHGp7NGjFkPla4m+DCL7h
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/decentral1se/passgen v1.0.1 h1:j2AxK/kHKxDHWZZfkJj8Wgae9+O+DYEqR5sjKthIYKA=
-github.com/decentral1se/passgen v1.0.1/go.mod h1:530V+lNoPhKtkrX2fIVsIfLhkl47CuiOM7HRgi7C+SU=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
@ -335,16 +332,16 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZm
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v20.10.23+incompatible h1:qwyha/T3rXk9lfuVcn533cKFc7n/6IzL5GXVAgMVPBg=
-github.com/docker/cli v20.10.23+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v20.10.14+incompatible h1:dSBKJOVesDgHo7rbxlYjYsXe7gPzrTT+/cKQgpDAazg=
+github.com/docker/cli v20.10.14+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
 github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.23+incompatible h1:1ZQUUYAdh+oylOT85aA2ZcfRp22jmLhoaEcVEfK8dyA=
-github.com/docker/docker v20.10.23+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.14+incompatible h1:+T9/PRYWNDo5SZl5qS1r9Mo/0Q8AwxKKPtu9S1yxM0w=
+github.com/docker/docker v20.10.14+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
@ -357,9 +354,8 @@ github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6Uezg
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
@ -371,8 +367,8 @@ github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7Bv
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
-github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
+github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@ -392,6 +388,7 @@ github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5Kwzbycv
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
@ -405,17 +402,18 @@ github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYis
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
-github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
+github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/gliderlabs/ssh v0.3.3 h1:mBQ8NiOgDkINJrZtoizkC3nDNYgSaWtxyem6S2XHBtA=
+github.com/gliderlabs/ssh v0.3.3/go.mod h1:ZSS+CUoKHDrqVakTfTWUlKSr9MtMFkC4UvtQKD7O914=
 github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
 github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
+github.com/go-git/go-billy/v5 v5.2.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
+github.com/go-git/go-billy/v5 v5.3.1 h1:CPiOUAzKtMRvolEKw+bG1PLRpT7D3LIs3/3ey4Aiu34=
 github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-billy/v5 v5.4.0 h1:Vaw7LaSTRJOUric7pe4vnzBSgyuf2KrLsu2Y4ZpQBDE=
-github.com/go-git/go-billy/v5 v5.4.0/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
-github.com/go-git/go-git-fixtures/v4 v4.3.1 h1:y5z6dd3qi8Hl+stezc8p3JxDkoTRqMAlKnXHuzrfjTQ=
-github.com/go-git/go-git-fixtures/v4 v4.3.1/go.mod h1:8LHG1a3SRW71ettAD/jW13h8c6AqjVSeL11RAdgaqpo=
-github.com/go-git/go-git/v5 v5.5.2 h1:v8lgZa5k9ylUw+OR/roJHTxR4QItsNFI5nKtAXFuynw=
-github.com/go-git/go-git/v5 v5.5.2/go.mod h1:BE5hUJ5yaV2YMxhmaP4l6RBQ08kMxKSPD4BlxtH7OjI=
+github.com/go-git/go-git-fixtures/v4 v4.2.1 h1:n9gGL1Ct/yIw+nfsfr8s4+sbhT+Ncu2SubfXjIWgci8=
+github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
+github.com/go-git/go-git/v5 v5.4.2 h1:BXyZu9t0VkbiHtqrsvdq39UDhGJTl1h55VW6CSC4aY4=
+github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@ -510,9 +508,8 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@ -586,8 +583,8 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
-github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/go-retryablehttp v0.7.0 h1:eu1EI/mbirUgP5C8hVsTNaGZreBDlYiwC1FZWkvQPQ4=
+github.com/hashicorp/go-retryablehttp v0.7.0/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
@ -605,8 +602,8 @@ github.com/hashicorp/memberlist v0.2.2/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOn
 github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
-github.com/hetznercloud/hcloud-go v1.40.0 h1:rchS+LVd80GuAOQUM5pLs0Fn7tb4PflPCuxskLYc1JQ=
-github.com/hetznercloud/hcloud-go v1.40.0/go.mod h1:jcKomw7kDIjrJ9FI72S/RdRPK8X8arYzEnXjRM/uXT8=
+github.com/hetznercloud/hcloud-go v1.33.1 h1:W1HdO2bRLTKU4WsyqAasDSpt54fYO4WNckWYfH5AuCQ=
+github.com/hetznercloud/hcloud-go v1.33.1/go.mod h1:XX/TQub3ge0yWR2yHWmnDVIrB+MQbda1pHxkUmDlUME=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@ -617,9 +614,8 @@ github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
@ -651,17 +647,16 @@ github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8
 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
-github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kevinburke/ssh_config v1.1.0 h1:pH/t1WS9NzT8go394IqZeJTMHVm6Cr6ZJ6AQ+mdNo/o=
+github.com/kevinburke/ssh_config v1.1.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.14.2 h1:S0OHlFk/Gbon/yauFJ4FfJJF5V0fc5HbBTJazi28pRw=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@ -709,13 +704,12 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
-github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
+github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
@ -736,6 +730,7 @@ github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
@ -833,8 +828,6 @@ github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrap
 github.com/pelletier/go-toml v1.9.4 h1:tjENF6MfZAg8e4ZmZTeWaWiT2vXtsoO6+iuOjFhECwM=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.2.3 h1:uKQP/7QOzNtKYH7UTohZLcjF5/55EnTw0jO/Ru4jZwI=
-github.com/pjbgf/sha1cd v0.2.3/go.mod h1:HOK9QrgzdHpbc2Kzip0Q1yi3M2MFGPADtR6HjG65m5M=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@ -884,9 +877,8 @@ github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0 h1:mxy4L2jP6qMonqmq+aTtOx1ifVWUgG/TAmntgbh3xv4=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw=
-github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@ -899,8 +891,10 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.13.0 h1:9TeeWRcjW2qd05I8Kf9knPkW4vLM/hYoa6z9ABvxje8=
-github.com/schollz/progressbar/v3 v3.13.0/go.mod h1:ZBYnSuLAX2LU8P8UiKN/KgF2DY58AJC8yfVYLPC8Ly4=
+github.com/schollz/progressbar/v3 v3.8.6 h1:QruMUdzZ1TbEP++S1m73OqRJk20ON11m6Wqv4EoGg8c=
+github.com/schollz/progressbar/v3 v3.8.6/go.mod h1:W5IEwbJecncFGBvuEh4A7HT1nZZ6WNIL2i3qbnI0WKY=
+github.com/schultz-is/passgen v1.0.1 h1:wUINzqW1Xmmy3yREHR6YTj+83VlFYjj2DIDMHzIi5TQ=
+github.com/schultz-is/passgen v1.0.1/go.mod h1:NnqzT2aSfvyheNQvBtlLUa0YlPFLDj60Jw2DZVwqiJk=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
@ -916,11 +910,8 @@ github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMB
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.1.0 h1:Wvr9V0MxhjRbl3f9nMnKnFfiWTJmtECJ9Njkea3ysW0=
-github.com/skeema/knownhosts v1.1.0/go.mod h1:sKFq3RD6/TKZkSWn8boUbDC7Qkgcv+8XXijpFO6roag=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
@ -988,8 +979,8 @@ github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijb
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.9 h1:cv3/KhXGBGjEXLC4bH0sLuJ9BewaAbpk5oyMOveu4pw=
-github.com/urfave/cli v1.22.9/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/urfave/cli v1.22.5 h1:lNq9sAHXK2qfdI8W+GRItjCEkI+2oR4d+MEHy1CKXoU=
+github.com/urfave/cli v1.22.5/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/vbatts/tar-split v0.11.2/go.mod h1:vV3ZuO2yWSVsz+pfFzDG/upWH1JhjOiEaWq6kXyQ3VI=
 github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
@ -999,8 +990,9 @@ github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
-github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
-github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/xanzy/ssh-agent v0.3.1 h1:AmzO1SSWxw73zxFZPRwaMN1MohDw8UyHnmuxyceTEGo=
+github.com/xanzy/ssh-agent v0.3.1/go.mod h1:QIE4lCeL7nkC25x+yA3LBIYfwCc1TFziCtG7cBAac6w=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190809123943-df4f5c81cb3b h1:6cLsL+2FW6dRAdl5iMtHgRogVCff0QpRi9653YmdcJA=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190809123943-df4f5c81cb3b/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@ -1016,7 +1008,6 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
 github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
@ -1049,6 +1040,7 @@ golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@ -1064,14 +1056,12 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220826181053-bd7e27e6170d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838 h1:71vQrMauZZhcTVK6KdYM+rklehEEwb3E+ZhaE5jrPrE=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@ -1108,7 +1098,6 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@ -1156,17 +1145,14 @@ golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
+golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 h1:CIJ76btIcR3eFI5EgSo6k1qKw9KJexJuRLI9G7Hp5wE=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@ -1195,7 +1181,6 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -1284,6 +1269,7 @@ golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@ -1303,26 +1289,13 @@ golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@ -1331,10 +1304,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@ -1406,10 +1377,10 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
@ -1518,6 +1489,7 @@ google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa h1:I0YcKz0I7OAhddo7ya8kMnvprhcWM045PmkBdMO9zN0=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
@ -1550,6 +1522,7 @@ google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.42.0 h1:XT2/MFpuPFsEX2fWh3YQtHkZ+WYZFQRfaUgLZYj/p6A=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@ -1605,15 +1578,14 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+gotest.tools/v3 v3.1.0 h1:rVV8Tcg/8jHUkPUorwjaMTtemIMVXfIPKiOqnhEhakk=
+gotest.tools/v3 v3.1.0/go.mod h1:fHy7eyTmJFO5bQbUsEGQ1v4m2J3Jz9eWL54TP2/ZuYQ=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
--- a/pkg/app/app.go
+++ b/pkg/app/app.go
@ -1,9 +1,13 @@
 package app

 import (
+	"context"
+	"fmt"
 	"strings"

 	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/upstream/stack"
+	apiclient "github.com/docker/docker/client"
 	"github.com/sirupsen/logrus"
 )

@ -33,6 +37,45 @@ type deployedServiceSpec struct {
 // VersionSpec represents a deployed app and associated metadata.
 type VersionSpec map[string]deployedServiceSpec

+// DeployedVersions lists metadata (e.g. versions) for deployed
+func DeployedVersions(ctx context.Context, cl *apiclient.Client, app config.App) (VersionSpec, bool, error) {
+	services, err := stack.GetStackServices(ctx, cl, app.StackName())
+	if err != nil {
+		return VersionSpec{}, false, err
+	}
+
+	appSpec := make(VersionSpec)
+	for _, service := range services {
+		serviceName := ParseServiceName(service.Spec.Name)
+		label := fmt.Sprintf("coop-cloud.%s.%s.version", app.StackName(), serviceName)
+		if deployLabel, ok := service.Spec.Labels[label]; ok {
+			version, _ := ParseVersionLabel(deployLabel)
+			appSpec[serviceName] = deployedServiceSpec{Name: serviceName, Version: version}
+		}
+	}
+
+	deployed := len(services) > 0
+
+	if deployed {
+		logrus.Debugf("detected %s as deployed versions of %s", appSpec, app.Name)
+	} else {
+		logrus.Debugf("detected %s as not deployed", app.Name)
+	}
+
+	return appSpec, len(services) > 0, nil
+}
+
+// ParseVersionLabel parses a $VERSION-$DIGEST app service label.
+func ParseVersionLabel(label string) (string, string) {
+	// versions may look like v4.2-abcd or v4.2-alpine-abcd
+	idx := strings.LastIndex(label, "-")
+	version := label[:idx]
+	digest := label[idx+1:]
+	logrus.Debugf("parsed %s as version from %s", version, label)
+	logrus.Debugf("parsed %s as digest from %s", digest, label)
+	return version, digest
+}
+
 // ParseServiceName parses a $STACK_NAME_$SERVICE_NAME service label.
 func ParseServiceName(label string) string {
 	idx := strings.LastIndex(label, "_")
--- a/pkg/catalogue/catalogue.go
+++ b/pkg/catalogue/catalogue.go
@ -1,122 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"path"
-	"strings"
-
-	"coopcloud.tech/abra/pkg/config"
-	gitPkg "coopcloud.tech/abra/pkg/git"
-	"github.com/go-git/go-git/v5"
-	"github.com/sirupsen/logrus"
-)
-
-// CatalogueSkipList is all the repos that are not recipes.
-var CatalogueSkipList = map[string]bool{
-	"abra":                        true,
-	"abra-apps":                   true,
-	"abra-aur":                    true,
-	"abra-bash":                   true,
-	"abra-capsul":                 true,
-	"abra-gandi":                  true,
-	"abra-hetzner":                true,
-	"apps":                        true,
-	"aur-abra-git":                true,
-	"auto-recipes-catalogue-json": true,
-	"auto-mirror":                 true,
-	"backup-bot":                  true,
-	"backup-bot-two":              true,
-	"beta.coopcloud.tech":         true,
-	"comrade-renovate-bot":        true,
-	"coopcloud.tech":              true,
-	"coturn":                      true,
-	"docker-cp-deploy":            true,
-	"docker-dind-bats-kcov":       true,
-	"docs.coopcloud.tech":         true,
-	"drone-abra":                  true,
-	"example":                     true,
-	"gardening":                   true,
-	"go-abra":                     true,
-	"organising":                  true,
-	"pyabra":                      true,
-	"radicle-seed-node":           true,
-	"recipes-catalogue-json":      true,
-	"recipes-wishlist":            true,
-	"recipes.coopcloud.tech":      true,
-	"stack-ssh-deploy":            true,
-	"swarm-cronjob":               true,
-	"tagcmp":                      true,
-	"traefik-cert-dumper":         true,
-	"tyop":                        true,
-}
-
-// EnsureCatalogue ensures that the catalogue is cloned locally & present.
-func EnsureCatalogue() error {
-	catalogueDir := path.Join(config.ABRA_DIR, "catalogue")
-	if _, err := os.Stat(catalogueDir); err != nil && os.IsNotExist(err) {
-		url := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, config.CATALOGUE_JSON_REPO_NAME)
-		if err := gitPkg.Clone(catalogueDir, url); err != nil {
-			return err
-		}
-
-		logrus.Debugf("cloned catalogue repository to %s", catalogueDir)
-	}
-
-	return nil
-}
-
-// EnsureUpToDate ensures that the local catalogue has no unstaged changes as
-// is up to date. This is useful to run before doing catalogue generation.
-func EnsureUpToDate() error {
-	isClean, err := gitPkg.IsClean(config.CATALOGUE_DIR)
-	if err != nil {
-		return err
-	}
-
-	if !isClean {
-		msg := "%s has locally unstaged changes? please commit/remove your changes before proceeding"
-		return fmt.Errorf(msg, config.CATALOGUE_DIR)
-	}
-
-	repo, err := git.PlainOpen(config.CATALOGUE_DIR)
-	if err != nil {
-		return err
-	}
-
-	remotes, err := repo.Remotes()
-	if err != nil {
-		return err
-	}
-
-	if len(remotes) == 0 {
-		msg := "cannot ensure %s is up-to-date, no git remotes configured"
-		logrus.Debugf(msg, config.CATALOGUE_DIR)
-		return nil
-	}
-
-	worktree, err := repo.Worktree()
-	if err != nil {
-		return err
-	}
-
-	branch, err := gitPkg.CheckoutDefaultBranch(repo, config.CATALOGUE_DIR)
-	if err != nil {
-		return err
-	}
-
-	opts := &git.PullOptions{
-		Force:         true,
-		ReferenceName: branch,
-	}
-
-	if err := worktree.Pull(opts); err != nil {
-		if !strings.Contains(err.Error(), "already up-to-date") {
-			return err
-		}
-	}
-
-	logrus.Debugf("fetched latest git changes for %s", config.CATALOGUE_DIR)
-
-	return nil
-}
--- a/pkg/client/client.go
+++ b/pkg/client/client.go
@ -2,31 +2,24 @@
 package client

 import (
-	"context"
-	"errors"
-	"fmt"
 	"net/http"
 	"os"
 	"time"

 	contextPkg "coopcloud.tech/abra/pkg/context"
-	sshPkg "coopcloud.tech/abra/pkg/ssh"
 	commandconnPkg "coopcloud.tech/abra/pkg/upstream/commandconn"
 	"github.com/docker/docker/client"
 	"github.com/sirupsen/logrus"
 )

-// New initiates a new Docker client. New client connections are validated so
-// that we ensure connections via SSH to the daemon can succeed. It takes into
-// account that you may only want the local client and not communicate via SSH.
-// For this use-case, please pass "default" as the contextName.
-func New(serverName string) (*client.Client, error) {
+// New initiates a new Docker client.
+func New(contextName string) (*client.Client, error) {
 	var clientOpts []client.Opt

-	if serverName != "default" {
-		context, err := GetContext(serverName)
+	if contextName != "default" {
+		context, err := GetContext(contextName)
 		if err != nil {
-			return nil, fmt.Errorf("unknown server, run \"abra server add %s\"?", serverName)
+			return nil, err
 		}

 		ctxEndpoint, err := contextPkg.GetContextEndpoint(context)
@ -40,6 +33,7 @@ func New(serverName string) (*client.Client, error) {
 		}

 		httpClient := &http.Client{
+			// No tls, no proxy
 			Transport: &http.Transport{
 				DialContext:     helper.Dialer,
 				IdleConnTimeout: 30 * time.Second,
@ -65,20 +59,7 @@ func New(serverName string) (*client.Client, error) {
 		return nil, err
 	}

-	logrus.Debugf("created client for %s", serverName)
-
-	info, err := cl.Info(context.Background())
-	if err != nil {
-		return cl, sshPkg.Fatal(serverName, err)
-	}
-
-	if info.Swarm.LocalNodeState == "inactive" {
-		if serverName != "default" {
-			return cl, fmt.Errorf("swarm mode not enabled on %s?", serverName)
-		} else {
-			return cl, errors.New("swarm mode not enabled on local server?")
-		}
-	}
+	logrus.Debugf("created client for %s", contextName)

 	return cl, nil
 }
--- a/pkg/client/registry.go
+++ b/pkg/client/registry.go
@ -3,10 +3,13 @@ package client
 import (
 	"context"
 	"fmt"
+	"strings"

 	"github.com/containers/image/docker"
 	"github.com/containers/image/types"
 	"github.com/docker/distribution/reference"
+	"github.com/docker/docker/client"
+	"github.com/sirupsen/logrus"
 )

 // GetRegistryTags retrieves all tags of an image from a container registry.
@ -26,3 +29,29 @@ func GetRegistryTags(img reference.Named) ([]string, error) {

 	return tags, nil
 }
+
+// GetTagDigest retrieves an image digest from a container registry.
+func GetTagDigest(cl *client.Client, image reference.Named) (string, error) {
+	target := fmt.Sprintf("//%s", reference.Path(image))
+
+	ref, err := docker.ParseReference(target)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse image %s, saw: %s", image, err.Error())
+	}
+
+	ctx := context.Background()
+	img, err := ref.NewImage(ctx, nil)
+	if err != nil {
+		logrus.Debugf("failed to query remote registry for %s, saw: %s", image, err.Error())
+		return "", fmt.Errorf("unable to read digest for %s", image)
+	}
+	defer img.Close()
+
+	digest := img.ConfigInfo().Digest.String()
+
+	if digest == "" {
+		return digest, fmt.Errorf("unable to read digest for %s", image)
+	}
+
+	return strings.Split(digest, ":")[1][:7], nil
+}
--- a/pkg/client/secret.go
+++ b/pkg/client/secret.go
@ -4,14 +4,20 @@ import (
 	"context"

 	"github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/client"
 )

-func StoreSecret(cl *client.Client, secretName, secretValue, server string) error {
+func StoreSecret(secretName, secretValue, server string) error {
+	cl, err := New(server)
+	if err != nil {
+		return err
+	}
+
+	ctx := context.Background()
 	ann := swarm.Annotations{Name: secretName}
 	spec := swarm.SecretSpec{Annotations: ann, Data: []byte(secretValue)}

-	if _, err := cl.SecretCreate(context.Background(), spec); err != nil {
+	// We don't bother with the secret IDs for now
+	if _, err := cl.SecretCreate(ctx, spec); err != nil {
 		return err
 	}

--- a/pkg/client/volumes.go
+++ b/pkg/client/volumes.go
@ -5,10 +5,14 @@ import (

 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/client"
 )

-func GetVolumes(cl *client.Client, ctx context.Context, server string, fs filters.Args) ([]*types.Volume, error) {
+func GetVolumes(ctx context.Context, server string, fs filters.Args) ([]*types.Volume, error) {
+	cl, err := New(server)
+	if err != nil {
+		return nil, err
+	}
+
 	volumeListOKBody, err := cl.VolumeList(ctx, fs)
 	volumeList := volumeListOKBody.Volumes
 	if err != nil {
@ -28,7 +32,12 @@ func GetVolumeNames(volumes []*types.Volume) []string {
 	return volumeNames
 }

-func RemoveVolumes(cl *client.Client, ctx context.Context, server string, volumeNames []string, force bool) error {
+func RemoveVolumes(ctx context.Context, server string, volumeNames []string, force bool) error {
+	cl, err := New(server)
+	if err != nil {
+		return err
+	}
+
 	for _, volName := range volumeNames {
 		err := cl.VolumeRemove(ctx, volName, force)
 		if err != nil {
--- a/pkg/config/app.go
+++ b/pkg/config/app.go
@ -2,15 +2,12 @@ package config

 import (
 	"fmt"
+	"html/template"
 	"io/ioutil"
 	"os"
 	"path"
-	"strconv"
 	"strings"

-	"github.com/schollz/progressbar/v3"
-
-	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
@ -47,9 +44,9 @@ type App struct {
 	Path   string
 }

-// StackName gets whatever the docker safe (uses the right delimiting
-// character, e.g. "_") stack name is for the app. In general, you don't want
-// to use this to show anything to end-users, you want use a.Name instead.
+// StackName gets what the docker safe stack name is for the app. This should
+// not not shown to the user, use a.Name for that. Give the output of this
+// command to Docker only.
 func (a App) StackName() string {
 	if _, exists := a.Env["STACK_NAME"]; exists {
 		return a.Env["STACK_NAME"]
@ -67,13 +64,8 @@ func (a App) StackName() string {
 	return stackName
 }

-// Filters retrieves exact app filters for querying the container runtime. Due
-// to upstream issues, filtering works different depending on what you're
-// querying. So, for example, secrets don't work with regex! The caller needs
-// to implement their own validation that the right secrets are matched. In
-// order to handle these cases, we provide the `appendServiceNames` /
-// `exactMatch` modifiers.
-func (a App) Filters(appendServiceNames, exactMatch bool) (filters.Args, error) {
+// Filters retrieves exact app filters for querying the container runtime.
+func (a App) Filters() (filters.Args, error) {
 	filters := filters.NewArgs()

 	composeFiles, err := GetAppComposeFiles(a.Recipe, a.Env)
@ -88,22 +80,7 @@ func (a App) Filters(appendServiceNames, exactMatch bool) (filters.Args, error)
 	}

 	for _, service := range compose.Services {
-		var filter string
-
-		if appendServiceNames {
-			if exactMatch {
-				filter = fmt.Sprintf("^%s_%s", a.StackName(), service.Name)
-			} else {
-				filter = fmt.Sprintf("%s_%s", a.StackName(), service.Name)
-			}
-		} else {
-			if exactMatch {
-				filter = fmt.Sprintf("^%s", a.StackName())
-			} else {
-				filter = fmt.Sprintf("%s", a.StackName())
-			}
-		}
-
+		filter := fmt.Sprintf("^%s_%s", a.StackName(), service.Name)
 		filters.Add("name", filter)
 	}

@ -173,7 +150,7 @@ func newApp(env AppEnv, name string, appFile AppFile) (App, error) {
 	if !exists {
 		recipe, exists = env["TYPE"]
 		if !exists {
-			return App{}, fmt.Errorf("%s is missing the TYPE env var?", name)
+			return App{}, fmt.Errorf("%s is missing the RECIPE env var", name)
 		}
 	}

@ -187,7 +164,7 @@ func newApp(env AppEnv, name string, appFile AppFile) (App, error) {
 	}, nil
 }

-// LoadAppFiles gets all app files for a given set of servers or all servers.
+// LoadAppFiles gets all app files for a given set of servers or all servers
 func LoadAppFiles(servers ...string) (AppFiles, error) {
 	appFiles := make(AppFiles)
 	if len(servers) == 1 {
@ -196,7 +173,7 @@ func LoadAppFiles(servers ...string) (AppFiles, error) {
 			var err error
 			servers, err = GetAllFoldersInDirectory(SERVERS_DIR)
 			if err != nil {
-				return appFiles, err
+				return nil, err
 			}
 		}
 	}
@ -205,11 +182,10 @@ func LoadAppFiles(servers ...string) (AppFiles, error) {

 	for _, server := range servers {
 		serverDir := path.Join(SERVERS_DIR, server)
-		files, err := GetAllFilesInDirectory(serverDir)
+		files, err := getAllFilesInDirectory(serverDir)
 		if err != nil {
-			return appFiles, fmt.Errorf("server %s doesn't exist? Run \"abra server ls\" to check", server)
+			return nil, fmt.Errorf("server %s doesn't exist? Run \"abra server ls\" to check", server)
 		}
-
 		for _, file := range files {
 			appName := strings.TrimSuffix(file.Name(), ".env")
 			appFilePath := path.Join(SERVERS_DIR, server, file.Name())
@ -219,13 +195,12 @@ func LoadAppFiles(servers ...string) (AppFiles, error) {
 			}
 		}
 	}
-
 	return appFiles, nil
 }

-// GetApp loads an apps settings, reading it from file, in preparation to use
-// it. It should only be used when ready to use the env file to keep IO
-// operations down.
+// GetApp loads an apps settings, reading it from file, in preparation to use it
+//
+// ONLY use when ready to use the env file to keep IO down
 func GetApp(apps AppFiles, name AppName) (App, error) {
 	appFile, exists := apps[name]
 	if !exists {
@ -240,9 +215,8 @@ func GetApp(apps AppFiles, name AppName) (App, error) {
 	return app, nil
 }

-// GetApps returns a slice of Apps with their env files read from a given
-// slice of AppFiles.
-func GetApps(appFiles AppFiles, recipeFilter string) ([]App, error) {
+// GetApps returns a slice of Apps with their env files read from a given slice of AppFiles
+func GetApps(appFiles AppFiles) ([]App, error) {
 	var apps []App

 	for name := range appFiles {
@ -250,14 +224,7 @@ func GetApps(appFiles AppFiles, recipeFilter string) ([]App, error) {
 		if err != nil {
 			return nil, err
 		}
-
-		if recipeFilter != "" {
-			if app.Recipe == recipeFilter {
-				apps = append(apps, app)
-			}
-		} else {
-			apps = append(apps, app)
-		}
+		apps = append(apps, app)
 	}

 	return apps, nil
@ -304,7 +271,7 @@ func GetAppNames() ([]string, error) {
 		return appNames, err
 	}

-	apps, err := GetApps(appFiles, "")
+	apps, err := GetApps(appFiles)
 	if err != nil {
 		return appNames, err
 	}
@ -316,8 +283,7 @@ func GetAppNames() ([]string, error) {
 	return appNames, nil
 }

-// TemplateAppEnvSample copies the example env file for the app into the users
-// env files.
+// TemplateAppEnvSample copies the example env file for the app into the users env files
 func TemplateAppEnvSample(recipeName, appName, server, domain string) error {
 	envSamplePath := path.Join(RECIPES_DIR, recipeName, ".env.sample")
 	envSample, err := ioutil.ReadFile(envSamplePath)
@ -335,15 +301,24 @@ func TemplateAppEnvSample(recipeName, appName, server, domain string) error {
 		return err
 	}

-	read, err := ioutil.ReadFile(appEnvPath)
+	file, err := os.OpenFile(appEnvPath, os.O_RDWR, 0664)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	tpl, err := template.ParseFiles(appEnvPath)
 	if err != nil {
 		return err
 	}

-	newContents := strings.Replace(string(read), recipeName+".example.com", domain, -1)
+	type templateVars struct {
+		Name   string
+		Domain string
+	}

-	err = ioutil.WriteFile(appEnvPath, []byte(newContents), 0)
-	if err != nil {
+	tvars := templateVars{Name: recipeName, Domain: domain}
+	if err := tpl.Execute(file, tvars); err != nil {
 		return err
 	}

@ -352,49 +327,35 @@ func TemplateAppEnvSample(recipeName, appName, server, domain string) error {
 	return nil
 }

-// SanitiseAppName makes a app name usable with Docker by replacing illegal
-// characters.
+// SanitiseAppName makes a app name usable with Docker by replacing illegal characters
 func SanitiseAppName(name string) string {
 	return strings.ReplaceAll(name, ".", "_")
 }

-// GetAppStatuses queries servers to check the deployment status of given apps.
-func GetAppStatuses(apps []App, MachineReadable bool) (map[string]map[string]string, error) {
+// GetAppStatuses queries servers to check the deployment status of given apps
+func GetAppStatuses(appFiles AppFiles) (map[string]map[string]string, error) {
 	statuses := make(map[string]map[string]string)

+	var unique []string
 	servers := make(map[string]struct{})
-	for _, app := range apps {
-		if _, ok := servers[app.Server]; !ok {
-			servers[app.Server] = struct{}{}
+	for _, appFile := range appFiles {
+		if _, ok := servers[appFile.Server]; !ok {
+			servers[appFile.Server] = struct{}{}
+			unique = append(unique, appFile.Server)
 		}
 	}

-	var bar *progressbar.ProgressBar
-	if !MachineReadable {
-		bar = formatter.CreateProgressbar(len(servers), "querying remote servers...")
-	}
-
+	bar := formatter.CreateProgressbar(len(servers), "querying remote servers...")
 	ch := make(chan stack.StackStatus, len(servers))
 	for server := range servers {
-		cl, err := client.New(server)
-		if err != nil {
-			return statuses, err
-		}
-
 		go func(s string) {
-			ch <- stack.GetAllDeployedServices(cl, s)
-			if !MachineReadable {
-				bar.Add(1)
-			}
+			ch <- stack.GetAllDeployedServices(s)
+			bar.Add(1)
 		}(server)
 	}

 	for range servers {
 		status := <-ch
-		if status.Err != nil {
-			return statuses, status.Err
-		}
-
 		for _, service := range status.Services {
 			result := make(map[string]string)
 			name := service.Spec.Labels[convert.LabelNamespace]
@ -457,61 +418,3 @@ func GetAppComposeConfig(recipe string, opts stack.Deploy, appEnv AppEnv) (*comp

 	return compose, nil
 }
-
-// ExposeAllEnv exposes all env variables to the app container
-func ExposeAllEnv(stackName string, compose *composetypes.Config, appEnv AppEnv) {
-	for _, service := range compose.Services {
-		if service.Name == "app" {
-			logrus.Debugf("Add the following environment to the app service config of %s:", stackName)
-			for k, v := range appEnv {
-				_, exists := service.Environment[k]
-				if !exists {
-					value := v
-					service.Environment[k] = &value
-					logrus.Debugf("Add Key: %s Value: %s to %s", k, value, stackName)
-				}
-			}
-		}
-	}
-}
-
-// SetRecipeLabel adds the label 'coop-cloud.${STACK_NAME}.recipe=${RECIPE}' to the app container
-// to signal which recipe is connected to the deployed app
-func SetRecipeLabel(compose *composetypes.Config, stackName string, recipe string) {
-	for _, service := range compose.Services {
-		if service.Name == "app" {
-			logrus.Debugf("set recipe label 'coop-cloud.%s.recipe' to %s for %s", stackName, recipe, stackName)
-			labelKey := fmt.Sprintf("coop-cloud.%s.recipe", stackName)
-			service.Deploy.Labels[labelKey] = recipe
-		}
-	}
-}
-
-// SetChaosLabel adds the label 'coop-cloud.${STACK_NAME}.chaos=true/false' to the app container
-// to signal if the app is deployed in chaos mode
-func SetChaosLabel(compose *composetypes.Config, stackName string, chaos bool) {
-	for _, service := range compose.Services {
-		if service.Name == "app" {
-			logrus.Debugf("set label 'coop-cloud.%s.chaos' to %v for %s", stackName, chaos, stackName)
-			labelKey := fmt.Sprintf("coop-cloud.%s.chaos", stackName)
-			service.Deploy.Labels[labelKey] = strconv.FormatBool(chaos)
-		}
-	}
-}
-
-// SetUpdateLabel adds env ENABLE_AUTO_UPDATE as label to enable/disable the
-// auto update process for this app. The default if this variable is not set is to disable
-// the auto update process.
-func SetUpdateLabel(compose *composetypes.Config, stackName string, appEnv AppEnv) {
-	for _, service := range compose.Services {
-		if service.Name == "app" {
-			enable_auto_update, exists := appEnv["ENABLE_AUTO_UPDATE"]
-			if !exists {
-				enable_auto_update = "false"
-			}
-			logrus.Debugf("set label 'coop-cloud.%s.autoupdate' to %s for %s", stackName, enable_auto_update, stackName)
-			labelKey := fmt.Sprintf("coop-cloud.%s.autoupdate", stackName)
-			service.Deploy.Labels[labelKey] = enable_auto_update
-		}
-	}
-}
--- a/pkg/config/env.go
+++ b/pkg/config/env.go
@ -18,8 +18,6 @@ var ABRA_DIR = os.ExpandEnv("$HOME/.abra")
 var SERVERS_DIR = path.Join(ABRA_DIR, "servers")
 var RECIPES_DIR = path.Join(ABRA_DIR, "recipes")
 var VENDOR_DIR = path.Join(ABRA_DIR, "vendor")
-var BACKUP_DIR = path.Join(ABRA_DIR, "backups")
-var CATALOGUE_DIR = path.Join(ABRA_DIR, "catalogue")
 var RECIPES_JSON = path.Join(ABRA_DIR, "catalogue", "recipes.json")
 var REPOS_BASE_URL = "https://git.coopcloud.tech/coop-cloud"
 var CATALOGUE_JSON_REPO_NAME = "recipes-catalogue-json"
@ -66,8 +64,8 @@ func ReadServerNames() ([]string, error) {
 	return serverNames, nil
 }

-// GetAllFilesInDirectory returns filenames of all files in directory
-func GetAllFilesInDirectory(directory string) ([]fs.FileInfo, error) {
+// getAllFilesInDirectory returns filenames of all files in directory
+func getAllFilesInDirectory(directory string) ([]fs.FileInfo, error) {
 	var realFiles []fs.FileInfo

 	files, err := ioutil.ReadDir(directory)
--- a/pkg/config/env_test.go
+++ b/pkg/config/env_test.go
@ -54,7 +54,7 @@ func TestGetAllFoldersInDirectory(t *testing.T) {
 }

 func TestGetAllFilesInDirectory(t *testing.T) {
-	files, err := GetAllFilesInDirectory(testFolder)
+	files, err := getAllFilesInDirectory(testFolder)
 	if err != nil {
 		t.Fatal(err)
 	}
--- a/pkg/dns/common.go
+++ b/pkg/dns/common.go
@ -1,6 +1,7 @@
 package dns

 import (
+	"context"
 	"fmt"
 	"net"
 	"os"
@ -31,20 +32,39 @@ func NewToken(provider, providerTokenEnvVar string) (string, error) {

 // EnsureIPv4 ensures that an ipv4 address is set for a domain name
 func EnsureIPv4(domainName string) (string, error) {
-	ipv4, err := net.ResolveIPAddr("ip", domainName)
-	if err != nil {
-		return "", err
+	var ipv4 string
+
+	// comrade librehosters DNS resolver -> https://www.privacy-handbuch.de/handbuch_93d.htm
+	freifunkDNS := "5.1.66.255:53"
+
+	resolver := &net.Resolver{
+		PreferGo: false,
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			d := net.Dialer{
+				Timeout: time.Millisecond * time.Duration(10000),
+			}
+			return d.DialContext(ctx, "udp", freifunkDNS)
+		},
 	}

-	return ipv4.String(), nil
+	ctx := context.Background()
+	ips, err := resolver.LookupIPAddr(ctx, domainName)
+	if err != nil {
+		return ipv4, err
+	}
+
+	if len(ips) == 0 {
+		return ipv4, fmt.Errorf("unable to retrieve ipv4 address for %s", domainName)
+	}
+
+	ipv4 = ips[0].IP.To4().String()
+	logrus.Debugf("%s points to %s (resolver: %s)", domainName, ipv4, freifunkDNS)
+
+	return ipv4, nil
 }

 // EnsureDomainsResolveSameIPv4 ensures that domains resolve to the same ipv4 address
 func EnsureDomainsResolveSameIPv4(domainName, server string) (string, error) {
-	if server == "default" || server == "local" {
-		return "", nil
-	}
-
 	var ipv4 string

 	domainIPv4, err := EnsureIPv4(domainName)
--- a/pkg/formatter/formatter.go
+++ b/pkg/formatter/formatter.go
@ -6,8 +6,7 @@ import (
 	"time"

 	"github.com/docker/go-units"
-	// "github.com/olekukonko/tablewriter"
-	"coopcloud.tech/abra/pkg/jsontable"
+	"github.com/olekukonko/tablewriter"
 	"github.com/schollz/progressbar/v3"
 	"github.com/sirupsen/logrus"
 )
@ -33,8 +32,8 @@ func HumanDuration(timestamp int64) string {
 }

 // CreateTable prepares a table layout for output.
-func CreateTable(columns []string) *jsontable.JSONTable {
-	table := jsontable.NewJSONTable(os.Stdout)
+func CreateTable(columns []string) *tablewriter.Table {
+	table := tablewriter.NewWriter(os.Stdout)
 	table.SetAutoWrapText(false)
 	table.SetHeader(columns)
 	return table
--- a/pkg/git/branch.go
+++ b/pkg/git/branch.go
@ -1,34 +1,11 @@
 package git

 import (
-	"fmt"
-
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/sirupsen/logrus"
 )

-// Check if a branch exists in a repo. Use this and not repository.Branch(),
-// because the latter does not actually check for existing branches. See
-// https://github.com/gogit/gogit/issues/518 for more.
-func HasBranch(repository *git.Repository, name string) bool {
-	var exist bool
-
-	if iter, err := repository.Branches(); err == nil {
-		iterFunc := func(reference *plumbing.Reference) error {
-			if name == reference.Name().Short() {
-				exist = true
-				return nil
-			}
-			return nil
-		}
-		_ = iter.ForEach(iterFunc)
-	}
-
-	return exist
-}
-
-// GetCurrentBranch retrieves the current branch of a repository.
+// GetCurrentBranch retrieves the current branch of a repository
 func GetCurrentBranch(repository *git.Repository) (string, error) {
 	branchRefs, err := repository.Branches()
 	if err != nil {
@ -56,45 +33,3 @@ func GetCurrentBranch(repository *git.Repository) (string, error) {

 	return currentBranchName, nil
 }
-
-// GetDefaultBranch retrieves the default branch of a repository.
-func GetDefaultBranch(repo *git.Repository, repoPath string) (plumbing.ReferenceName, error) {
-	branch := "master"
-
-	if !HasBranch(repo, "master") {
-		if !HasBranch(repo, "main") {
-			return "", fmt.Errorf("failed to select default branch in %s", repoPath)
-		}
-		branch = "main"
-	}
-
-	return plumbing.ReferenceName(fmt.Sprintf("refs/heads/%s", branch)), nil
-}
-
-// CheckoutDefaultBranch checks out the default branch of a repository.
-func CheckoutDefaultBranch(repo *git.Repository, repoPath string) (plumbing.ReferenceName, error) {
-	branch, err := GetDefaultBranch(repo, repoPath)
-	if err != nil {
-		return plumbing.ReferenceName(""), err
-	}
-
-	worktree, err := repo.Worktree()
-	if err != nil {
-		return plumbing.ReferenceName(""), err
-	}
-
-	checkOutOpts := &git.CheckoutOptions{
-		Create: false,
-		Force:  true,
-		Branch: branch,
-	}
-
-	if err := worktree.Checkout(checkOutOpts); err != nil {
-		logrus.Debugf("failed to check out %s in %s", branch, repoPath)
-		return branch, err
-	}
-
-	logrus.Debugf("successfully checked out %v in %s", branch, repoPath)
-
-	return branch, nil
-}
--- a/pkg/git/clone.go
+++ b/pkg/git/clone.go
@ -15,32 +15,22 @@ import (
 func Clone(dir, url string) error {
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
 		logrus.Debugf("%s does not exist, attempting to git clone from %s", dir, url)
-
-		_, err := git.PlainClone(dir, false, &git.CloneOptions{
-			URL:           url,
-			Tags:          git.AllTags,
-			ReferenceName: plumbing.ReferenceName("refs/heads/master"),
-			SingleBranch:  true,
-		})
+		_, err := git.PlainClone(dir, false, &git.CloneOptions{URL: url, Tags: git.AllTags})
 		if err != nil {
 			logrus.Debugf("cloning %s default branch failed, attempting from main branch", url)
-
 			_, err := git.PlainClone(dir, false, &git.CloneOptions{
 				URL:           url,
 				Tags:          git.AllTags,
 				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-				SingleBranch:  true,
 			})
 			if err != nil {
 				if strings.Contains(err.Error(), "authentication required") {
 					name := filepath.Base(dir)
 					return fmt.Errorf("unable to clone %s, does %s exist?", name, url)
 				}
-
 				return err
 			}
 		}
-
 		logrus.Debugf("%s has been git cloned successfully", dir)
 	} else {
 		logrus.Debugf("%s already exists", dir)
--- a/pkg/jsontable/jsontable.go
+++ b/pkg/jsontable/jsontable.go
@ -1,203 +0,0 @@
-package jsontable
-
-import (
-	"fmt"
-	"io"
-
-	"github.com/olekukonko/tablewriter"
-)
-
-// A quick-and-dirty proxy/emulator of tablewriter to enable more easy machine readable output
-// - Does not strictly support types, just quoted or unquoted values
-// - Does not support nested values.
-// If a datalabel is set with SetDataLabel(true, "..."), that will be used as the key for teh data of the table,
-// otherwise if the caption is set with SetCaption(true, "..."), the data label will be set to the default of
-// "rows", otherwise the table will output as a JSON list.
-//
-// Proxys all actions through to the tablewriter except addrow and addbatch, which it does at render time
-//
-
-type JSONTable struct {
-	out             io.Writer
-	colsize         int
-	rows            [][]string
-	keys            []string
-	quoted          []bool // hack to do output typing, quoted vs. unquoted
-	hasDataLabel    bool
-	dataLabel       string
-	hasCaption      bool
-	caption         string // the actual caption
-	hasCaptionLabel bool
-	captionLabel    string // the key in the dictionary for the caption
-	tbl             *tablewriter.Table
-}
-
-func writeChar(w io.Writer, c byte) {
-	w.Write([]byte{c})
-
-}
-
-func NewJSONTable(writer io.Writer) *JSONTable {
-	t := &JSONTable{
-		out:             writer,
-		colsize:         0,
-		rows:            [][]string{},
-		keys:            []string{},
-		quoted:          []bool{},
-		hasDataLabel:    false,
-		dataLabel:       "rows",
-		hasCaption:      false,
-		caption:         "",
-		hasCaptionLabel: false,
-		captionLabel:    "caption",
-		tbl:             tablewriter.NewWriter(writer),
-	}
-	return t
-}
-
-func (t *JSONTable) NumLines() int {
-	// JSON only but reflects a shared state.
-	return len(t.rows)
-}
-
-func (t *JSONTable) SetHeader(keys []string) {
-	// Set the keys value which will assign each column to the keys.
-	// Note that we'll ignore values that are beyond the length of the keys list
-	t.colsize = len(keys)
-	t.keys = []string{}
-	for _, k := range keys {
-		t.keys = append(t.keys, k)
-		t.quoted = append(t.quoted, true)
-	}
-	t.tbl.SetHeader(keys)
-}
-
-func (t *JSONTable) SetColumnQuoting(quoting []bool) {
-	// Specify which columns are quoted or unquoted in output
-	// JSON only
-	for i := 0; i < t.colsize; i++ {
-		t.quoted[i] = quoting[i]
-	}
-}
-
-func (t *JSONTable) Append(row []string) {
-	// We'll just append whatever to the rows list. If they fix the keys after appending rows, it'll work as
-	// expected.
-	// We should detect if the row is narrower than the key list tho.
-	// JSON only (but we use the rows later when rendering a regular table)
-	t.rows = append(t.rows, row)
-}
-
-func (t *JSONTable) Render() {
-	// Load the table with rows and render.
-	// Proxy only
-	for _, row := range t.rows {
-		t.tbl.Append(row)
-	}
-
-	t.tbl.Render()
-}
-
-func (t *JSONTable) _JSONRenderInner() {
-	// JSON only
-	// Render the list of dictionaries to the writer.
-	//// inner render loop
-	writeChar(t.out, '[')
-	for rowidx, row := range t.rows {
-		if rowidx != 0 {
-			writeChar(t.out, ',')
-		}
-		writeChar(t.out, '{')
-		for keyidx, key := range t.keys {
-			value := "nil"
-			if keyidx < len(row) {
-				value = row[keyidx]
-			}
-			if keyidx != 0 {
-				writeChar(t.out, ',')
-			}
-			if t.quoted[keyidx] {
-				fmt.Fprintf(t.out, "\"%s\":\"%s\"", key, value)
-			} else {
-				fmt.Fprintf(t.out, "\"%s\":%s", key, value)
-			}
-		}
-		writeChar(t.out, '}')
-	}
-	writeChar(t.out, ']')
-
-}
-
-func (t *JSONTable) JSONRender() {
-	// write JSON table to output
-	// JSON only
-
-	if t.hasDataLabel || t.hasCaption {
-		// dict mode
-		writeChar(t.out, '{')
-
-		if t.hasCaption {
-			fmt.Fprintf(t.out, "\"%s\":\"%s\",", t.captionLabel, t.caption)
-
-		}
-		fmt.Fprintf(t.out, "\"%s\":", t.dataLabel)
-
-	}
-
-	// write list
-	t._JSONRenderInner()
-
-	if t.hasDataLabel || t.hasCaption {
-		// dict mode
-		writeChar(t.out, '}')
-	}
-
-}
-
-func (t *JSONTable) SetCaption(caption bool, captionText ...string) {
-	t.hasCaption = caption
-	if len(captionText) == 1 {
-		t.caption = captionText[0]
-	}
-	t.tbl.SetCaption(caption, captionText...)
-}
-
-func (t *JSONTable) SetCaptionLabel(captionLabel bool, captionLabelText ...string) {
-	// JSON only
-	t.hasCaptionLabel = captionLabel
-	if len(captionLabelText) == 1 {
-		t.captionLabel = captionLabelText[0]
-	}
-}
-
-func (t *JSONTable) SetDataLabel(dataLabel bool, dataLabelText ...string) {
-	// JSON only
-	t.hasDataLabel = dataLabel
-	if len(dataLabelText) == 1 {
-		t.dataLabel = dataLabelText[0]
-	}
-}
-
-func (t *JSONTable) AppendBulk(rows [][]string) {
-	// JSON only but reflects shared state
-	for _, row := range rows {
-		t.Append(row)
-	}
-}
-
-// Stuff we should implement but we just proxy for now.
-func (t *JSONTable) SetAutoMergeCellsByColumnIndex(cols []int) {
-	// FIXME
-	t.tbl.SetAutoMergeCellsByColumnIndex(cols)
-}
-
-func (t *JSONTable) SetAutoMergeCells(auto bool) {
-	// FIXME
-	t.tbl.SetAutoMergeCells(auto)
-}
-
-// Stub functions
-func (t *JSONTable) SetAutoWrapText(auto bool) {
-	t.tbl.SetAutoWrapText(auto)
-	return
-}
--- a/pkg/jsontable/jsontable_test.go
+++ b/pkg/jsontable/jsontable_test.go
@ -1,83 +0,0 @@
-package jsontable
-
-import (
-	"testing"
-
-	"bytes"
-	"encoding/json"
-
-	"github.com/olekukonko/tablewriter"
-)
-
-var TestLine = []string{"1", "2"}
-var TestGroup = [][]string{{"1", "2", "3"}, {"a", "teohunteohu", "c", "d"}, {"☺", "☹"}}
-var TestKeys = []string{"key0", "key1", "key2"}
-
-// test creation
-func TestNewTable(t *testing.T) {
-	var b bytes.Buffer
-	tbl := NewJSONTable(&b)
-	if tbl.NumLines() != 0 {
-		t.Fatalf("Something went weird when making table (should have 0 lines)")
-	}
-}
-
-// test adding things
-func TestTableAdd(t *testing.T) {
-	var b bytes.Buffer
-	tbl := NewJSONTable(&b)
-
-	tbl.Append(TestLine)
-	if tbl.NumLines() != 1 {
-		t.Fatalf("Appending a line does not result in a length of 1.")
-	}
-
-	tbl.AppendBulk(TestGroup)
-	numlines := tbl.NumLines()
-	if numlines != (len(TestGroup) + 1) {
-		t.Fatalf("Appending two lines does not result in a length of 4 (length is %d).", numlines)
-	}
-}
-
-// test JSON output is parsable
-func TestJsonParsable(t *testing.T) {
-	var b bytes.Buffer
-	tbl := NewJSONTable(&b)
-
-	tbl.AppendBulk(TestGroup)
-	tbl.SetHeader(TestKeys)
-
-	tbl.JSONRender()
-
-	var son []map[string]interface{}
-
-	err := json.Unmarshal(b.Bytes(), &son)
-
-	if err != nil {
-		t.Fatalf("Did not produce parsable JSON: %s", err.Error())
-	}
-}
-
-// test identical commands to a tablewriter and jsontable produce the same rendered output
-func TestTableWriter(t *testing.T) {
-	var bjson bytes.Buffer
-	var btable bytes.Buffer
-
-	tbl := NewJSONTable(&bjson)
-
-	tbl.AppendBulk(TestGroup)
-	tbl.SetHeader(TestKeys)
-	tbl.Render()
-
-	wtbl := tablewriter.NewWriter(&btable)
-
-	wtbl.AppendBulk(TestGroup)
-	wtbl.SetHeader(TestKeys)
-	wtbl.Render()
-
-	if bytes.Compare(bjson.Bytes(), btable.Bytes()) != 0 {
-		t.Fatalf("JSON table and TableWriter produce non-identical outputs.\n%s\n%s", bjson.Bytes(), btable.Bytes())
-	}
-}
-
-/// FIXME test different output formats when captions etc. are added
--- a/pkg/lint/recipe.go
+++ b/pkg/lint/recipe.go
@ -19,40 +19,12 @@ var Critical = "critical"

 type LintFunction func(recipe.Recipe) (bool, error)

-// SkipFunction determines whether the LintFunction is run or not. It should
-// not take the lint rule level into account because some rules are always an
-// error but may depend on some additional context of the recipe configuration.
-// This function aims to cover those additional cases.
-type SkipFunction func(recipe.Recipe) (bool, error)
-
-// LintRule is a linting rule which helps a recipe maintainer avoid common
-// problems in their recipe configurations. We aim to highlight things that
-// might result in critical errors or hours lost in debugging obscure
-// Docker-isms. Humans make the final call on these rules, please raise an
-// issue if you disagree.
 type LintRule struct {
-	Ref           string       // Reference of the linting rule
-	Level         string       // Level of the warning
-	Description   string       // Description of the issue
-	HowToResolve  string       // Documentation for recipe maintainer
-	Function      LintFunction // Rule implementation
-	SkipCondition SkipFunction // Whether or not to execute the lint rule
-}
-
-// Skip implements the SkipFunction for the lint rule.
-func (l LintRule) Skip(recipe recipe.Recipe) bool {
-	if l.SkipCondition != nil {
-		ok, err := l.SkipCondition(recipe)
-		if err != nil {
-			logrus.Debugf("%s: skip condition: %s", l.Ref, err)
-		}
-		if ok {
-			logrus.Debugf("skipping %s based on skip condition", l.Ref)
-			return true
-		}
-	}
-
-	return false
+	Ref          string
+	Level        string
+	Description  string
+	HowToResolve string
+	Function     LintFunction
 }

 var LintRules = map[string][]LintRule{
@ -130,12 +102,11 @@ var LintRules = map[string][]LintRule{
 			Function:     LintAppService,
 		},
 		{
-			Ref:           "R010",
-			Level:         "error",
-			Description:   "traefik routing enabled",
-			HowToResolve:  "include \"traefik.enable=true\" deploy label",
-			Function:      LintTraefikEnabled,
-			SkipCondition: LintTraefikEnabledSkipCondition,
+			Ref:          "R010",
+			Level:        "error",
+			Description:  "traefik routing enabled",
+			HowToResolve: "include \"traefik.enable=true\" deploy label",
+			Function:     LintTraefikEnabled,
 		},
 		{
 			Ref:          "R011",
@ -154,9 +125,6 @@ var LintRules = map[string][]LintRule{
 	},
 }

-// LintForErrors lints specifically for errors and not other levels. This is
-// used in code paths such as "app deploy" to avoid nasty surprises but not for
-// the typical linting commands, which do handle other levels.
 func LintForErrors(recipe recipe.Recipe) error {
 	logrus.Debugf("linting for critical errors in %s configs", recipe.Name)

@ -164,12 +132,7 @@ func LintForErrors(recipe recipe.Recipe) error {
 		if level != "error" {
 			continue
 		}
-
 		for _, rule := range LintRules[level] {
-			if rule.Skip(recipe) {
-				continue
-			}
-
 			ok, err := rule.Function(recipe)
 			if err != nil {
 				return err
@ -212,24 +175,6 @@ func LintAppService(recipe recipe.Recipe) (bool, error) {
 	return false, nil
 }

-// LintTraefikEnabledSkipCondition signals a skip for this linting rule if it
-// confirms that there is no "DOMAIN=..." in the .env.sample configuration of
-// the recipe. This typically means that no domain is required to deploy and
-// therefore no matching traefik deploy label will be present.
-func LintTraefikEnabledSkipCondition(recipe recipe.Recipe) (bool, error) {
-	envSamplePath := path.Join(config.RECIPES_DIR, recipe.Name, ".env.sample")
-	sampleEnv, err := config.ReadEnv(envSamplePath)
-	if err != nil {
-		return false, fmt.Errorf("Unable to discover .env.sample for %s", recipe.Name)
-	}
-
-	if _, ok := sampleEnv["DOMAIN"]; !ok {
-		return true, nil
-	}
-
-	return false, nil
-}
-
 func LintTraefikEnabled(recipe recipe.Recipe) (bool, error) {
 	for _, service := range recipe.Config.Services {
 		for label := range service.Deploy.Labels {
--- a/pkg/recipe/recipe.go
+++ b/pkg/recipe/recipe.go
@ -2,36 +2,31 @@ package recipe

 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"time"

-	"coopcloud.tech/abra/pkg/catalogue"
+	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/compose"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	gitPkg "coopcloud.tech/abra/pkg/git"
-	"coopcloud.tech/abra/pkg/limit"
-	"coopcloud.tech/abra/pkg/runtime"
 	"coopcloud.tech/abra/pkg/upstream/stack"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/abra/pkg/web"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/distribution/reference"
 	"github.com/go-git/go-git/v5"
-	gitConfig "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/sirupsen/logrus"
 )

 // RecipeCatalogueURL is the only current recipe catalogue available.
-const RecipeCatalogueURL = "https://recipes.coopcloud.tech/recipes.json"
+const RecipeCatalogueURL = "https://recipes.coopcloud.tech"

 // ReposMetadataURL is the recipe repository metadata
 const ReposMetadataURL = "https://git.coopcloud.tech/api/v1/orgs/coop-cloud/repos"
@ -44,8 +39,9 @@ type service = string

 // ServiceMeta represents meta info associated with a service.
 type ServiceMeta struct {
-	Image string `json:"image"`
-	Tag   string `json:"tag"`
+	Digest string `json:"digest"`
+	Image  string `json:"image"`
+	Tag    string `json:"tag"`
 }

 // RecipeVersions are the versions associated with a recipe.
@ -207,8 +203,8 @@ func (r Recipe) Tags() ([]string, error) {
 }

 // Get retrieves a recipe.
-func Get(recipeName string, conf *runtime.Config) (Recipe, error) {
-	if err := EnsureExists(recipeName, conf); err != nil {
+func Get(recipeName string) (Recipe, error) {
+	if err := EnsureExists(recipeName); err != nil {
 		return Recipe{}, err
 	}

@ -234,7 +230,7 @@ func Get(recipeName string, conf *runtime.Config) (Recipe, error) {
 		return Recipe{}, err
 	}

-	meta, err := GetRecipeMeta(recipeName, conf)
+	meta, err := GetRecipeMeta(recipeName)
 	if err != nil {
 		if strings.Contains(err.Error(), "does not exist") {
 			meta = RecipeMeta{}
@ -251,11 +247,7 @@ func Get(recipeName string, conf *runtime.Config) (Recipe, error) {
 }

 // EnsureExists ensures that a recipe is locally cloned
-func EnsureExists(recipeName string, conf *runtime.Config) error {
-	if !conf.EnsureRecipeExists {
-		return nil
-	}
-
+func EnsureExists(recipeName string) error {
 	recipeDir := path.Join(config.RECIPES_DIR, recipeName)

 	if _, err := os.Stat(recipeDir); os.IsNotExist(err) {
@ -315,7 +307,8 @@ func EnsureVersion(recipeName, version string) error {
 	logrus.Debugf("read %s as tags for recipe %s", strings.Join(parsedTags, ", "), recipeName)

 	if tagRef.String() == "" {
-		return fmt.Errorf("no published release discovered for %s", recipeName)
+		logrus.Warnf("no published release discovered for %s", recipeName)
+		return nil
 	}

 	worktree, err := repo.Worktree()
@ -338,7 +331,7 @@ func EnsureVersion(recipeName, version string) error {
 }

 // EnsureLatest makes sure the latest commit is checked out for a local recipe repository
-func EnsureLatest(recipeName string, conf *runtime.Config) error {
+func EnsureLatest(recipeName string) error {
 	recipeDir := path.Join(config.RECIPES_DIR, recipeName)

 	isClean, err := gitPkg.IsClean(recipeDir)
@ -366,21 +359,11 @@ func EnsureLatest(recipeName string, conf *runtime.Config) error {
 		return err
 	}

-	meta, err := GetRecipeMeta(recipeName, conf)
+	branch, err := GetDefaultBranch(repo, recipeName)
 	if err != nil {
 		return err
 	}

-	var branch plumbing.ReferenceName
-	if meta.DefaultBranch != "" {
-		branch = plumbing.ReferenceName(fmt.Sprintf("refs/heads/%s", meta.DefaultBranch))
-	} else {
-		branch, err = gitPkg.GetDefaultBranch(repo, recipeDir)
-		if err != nil {
-			return err
-		}
-	}
-
 	checkOutOpts := &git.CheckoutOptions{
 		Create: false,
 		Force:  true,
@ -480,9 +463,6 @@ func GetRecipeFeaturesAndCategory(recipeName string) (Features, string, error) {
 		"\n")

 	for _, val := range readmeLines {
-		if strings.Contains(val, "**Status**") {
-			feat.Status, _ = strconv.Atoi(strings.TrimSpace(strings.Split(strings.TrimPrefix(val, "* **Status**:"), ",")[0]))
-		}
 		if strings.Contains(val, "**Category**") {
 			category = strings.TrimSpace(
 				strings.TrimPrefix(val, "* **Category**:"),
@ -588,22 +568,21 @@ func EnsureUpToDate(recipeName string) error {

 	isClean, err := gitPkg.IsClean(recipeDir)
 	if err != nil {
-		return fmt.Errorf("unable to check git clean status in %s: %s", recipeDir, err)
+		return err
 	}

 	if !isClean {
-		msg := "%s (%s) has locally unstaged changes? please commit/remove your changes before proceeding"
-		return fmt.Errorf(msg, recipeName, recipeDir)
+		return fmt.Errorf("%s has locally unstaged changes", recipeName)
 	}

 	repo, err := git.PlainOpen(recipeDir)
 	if err != nil {
-		return fmt.Errorf("unable to open %s: %s", recipeDir, err)
+		return err
 	}

 	remotes, err := repo.Remotes()
 	if err != nil {
-		return fmt.Errorf("unable to read remotes in %s: %s", recipeDir, err)
+		return err
 	}

 	if len(remotes) == 0 {
@ -613,35 +592,22 @@ func EnsureUpToDate(recipeName string) error {

 	worktree, err := repo.Worktree()
 	if err != nil {
-		return fmt.Errorf("unable to open git work tree in %s: %s", recipeDir, err)
+		return err
 	}

-	branch, err := gitPkg.CheckoutDefaultBranch(repo, recipeDir)
+	branch, err := CheckoutDefaultBranch(repo, recipeName)
 	if err != nil {
-		return fmt.Errorf("unable to check out default branch in %s: %s", recipeDir, err)
-	}
-
-	fetchOpts := &git.FetchOptions{
-		Tags: git.AllTags,
-		RefSpecs: []gitConfig.RefSpec{
-			gitConfig.RefSpec(fmt.Sprintf("%s:%s", branch, branch)),
-		},
-	}
-	if err := repo.Fetch(fetchOpts); err != nil {
-		if !strings.Contains(err.Error(), "already up-to-date") {
-			return fmt.Errorf("unable to fetch tags in %s: %s", recipeDir, err)
-		}
+		return err
 	}

 	opts := &git.PullOptions{
 		Force:         true,
 		ReferenceName: branch,
-		SingleBranch:  true,
 	}

 	if err := worktree.Pull(opts); err != nil {
 		if !strings.Contains(err.Error(), "already up-to-date") {
-			return fmt.Errorf("unable to git pull in %s: %s", recipeDir, err)
+			return err
 		}
 	}

@ -650,12 +616,53 @@ func EnsureUpToDate(recipeName string) error {
 	return nil
 }

-type CatalogueOfflineError struct {
-	msg string
+func GetDefaultBranch(repo *git.Repository, recipeName string) (plumbing.ReferenceName, error) {
+	recipeDir := path.Join(config.RECIPES_DIR, recipeName)
+
+	meta, _ := GetRecipeMeta(recipeName)
+	if meta.DefaultBranch != "" {
+		return plumbing.ReferenceName(fmt.Sprintf("refs/heads/%s", meta.DefaultBranch)), nil
+	}
+
+	branch := "master"
+	if _, err := repo.Branch("master"); err != nil {
+		if _, err := repo.Branch("main"); err != nil {
+			return "", fmt.Errorf("failed to select default branch in %s", recipeDir)
+		}
+		branch = "main"
+	}
+
+	return plumbing.ReferenceName(fmt.Sprintf("refs/heads/%s", branch)), nil
 }

-func (e *CatalogueOfflineError) Error() string {
-	return fmt.Sprintf("catalogue offline: %s", e.msg)
+func CheckoutDefaultBranch(repo *git.Repository, recipeName string) (plumbing.ReferenceName, error) {
+	recipeDir := path.Join(config.RECIPES_DIR, recipeName)
+
+	branch, err := GetDefaultBranch(repo, recipeName)
+	if err != nil {
+		return plumbing.ReferenceName(""), err
+	}
+
+	worktree, err := repo.Worktree()
+	if err != nil {
+		return plumbing.ReferenceName(""), err
+	}
+
+	checkOutOpts := &git.CheckoutOptions{
+		Create: false,
+		Force:  true,
+		Branch: branch,
+	}
+
+	if err := worktree.Checkout(checkOutOpts); err != nil {
+		recipeDir := path.Join(config.RECIPES_DIR, recipeName)
+		logrus.Debugf("failed to check out %s in %s", branch, recipeDir)
+		return branch, err
+	}
+
+	logrus.Debugf("successfully checked out %v in %s", branch, recipeDir)
+
+	return branch, nil
 }

 // recipeCatalogueFSIsLatest checks whether the recipe catalogue stored locally
@ -664,7 +671,7 @@ func recipeCatalogueFSIsLatest() (bool, error) {
 	httpClient := web.NewHTTPRetryClient()
 	res, err := httpClient.Head(RecipeCatalogueURL)
 	if err != nil {
-		return false, &CatalogueOfflineError{err.Error()}
+		return false, err
 	}

 	lastModified := res.Header["Last-Modified"][0]
@ -699,20 +706,13 @@ func recipeCatalogueFSIsLatest() (bool, error) {
 func ReadRecipeCatalogue() (RecipeCatalogue, error) {
 	recipes := make(RecipeCatalogue)

-	if err := catalogue.EnsureCatalogue(); err != nil {
+	if err := EnsureCatalogue(); err != nil {
 		return nil, err
 	}

 	recipeFSIsLatest, err := recipeCatalogueFSIsLatest()
 	if err != nil {
-		var offlineErr *CatalogueOfflineError
-		if errors.As(err, &offlineErr) {
-			logrus.Error(err)
-			logrus.Error("unable to retrieve catalogue from internet, using local copy.")
-			recipeFSIsLatest = true
-		} else {
-			return nil, err
-		}
+		return nil, err
 	}

 	if !recipeFSIsLatest {
@ -795,7 +795,7 @@ func VersionsOfService(recipe, serviceName string) ([]string, error) {
 }

 // GetRecipeMeta retrieves the recipe metadata from the recipe catalogue.
-func GetRecipeMeta(recipeName string, conf *runtime.Config) (RecipeMeta, error) {
+func GetRecipeMeta(recipeName string) (RecipeMeta, error) {
 	catl, err := ReadRecipeCatalogue()
 	if err != nil {
 		return RecipeMeta{}, err
@ -806,7 +806,7 @@ func GetRecipeMeta(recipeName string, conf *runtime.Config) (RecipeMeta, error)
 		return RecipeMeta{}, fmt.Errorf("recipe %s does not exist?", recipeName)
 	}

-	if err := EnsureExists(recipeName, conf); err != nil {
+	if err := EnsureExists(recipeName); err != nil {
 		return RecipeMeta{}, err
 	}

@ -928,9 +928,8 @@ func ReadReposMetadata() (RepoCatalogue, error) {
 }

 // GetRecipeVersions retrieves all recipe versions.
-func GetRecipeVersions(recipeName string, opts ...runtime.Option) (RecipeVersions, error) {
+func GetRecipeVersions(recipeName string) (RecipeVersions, error) {
 	versions := RecipeVersions{}
-	conf := runtime.New(opts...)

 	recipeDir := path.Join(config.RECIPES_DIR, recipeName)

@ -968,11 +967,17 @@ func GetRecipeVersions(recipeName string, opts ...runtime.Option) (RecipeVersion

 		logrus.Debugf("successfully checked out %s in %s", ref.Name(), recipeDir)

-		recipe, err := Get(recipeName, conf)
+		recipe, err := Get(recipeName)
 		if err != nil {
 			return err
 		}

+		cl, err := client.New("default") // only required for container registry calls
+		if err != nil {
+			return err
+		}
+
+		queryCache := make(map[reference.Named]string)
 		versionMeta := make(map[string]ServiceMeta)
 		for _, service := range recipe.Config.Services {

@ -994,9 +999,28 @@ func GetRecipeVersions(recipeName string, opts ...runtime.Option) (RecipeVersion
 				continue
 			}

+			var exists bool
+			var digest string
+			if digest, exists = queryCache[img]; !exists {
+				logrus.Debugf("cache miss: querying for image: %s, tag: %s", path, tag)
+
+				var err error
+				digest, err = client.GetTagDigest(cl, img)
+				if err != nil {
+					logrus.Warn(err)
+					digest = "unknown"
+				}
+
+				queryCache[img] = digest
+				logrus.Debugf("cached insert: %s, tag: %s, digest: %s", path, tag, digest)
+			} else {
+				logrus.Debugf("cache hit: image: %s, tag: %s, digest: %s", path, tag, digest)
+			}
+
 			versionMeta[service.Name] = ServiceMeta{
-				Image: path,
-				Tag:   tag,
+				Digest: digest,
+				Image:  path,
+				Tag:    img.(reference.NamedTagged).Tag(),
 			}
 		}

@ -1007,7 +1031,7 @@ func GetRecipeVersions(recipeName string, opts ...runtime.Option) (RecipeVersion
 		return versions, err
 	}

-	_, err = gitPkg.CheckoutDefaultBranch(repo, recipeDir)
+	_, err = CheckoutDefaultBranch(repo, recipeName)
 	if err != nil {
 		return versions, err
 	}
@ -1032,52 +1056,16 @@ func GetRecipeCatalogueVersions(recipeName string, catl RecipeCatalogue) ([]stri
 	return versions, nil
 }

-// UpdateRepositories clones and updates all recipe repositories locally.
-func UpdateRepositories(repos RepoCatalogue, recipeName string) error {
-	var barLength int
-	if recipeName != "" {
-		barLength = 1
-	} else {
-		barLength = len(repos)
-	}
+// EnsureCatalogue ensures that the catalogue is cloned locally & present.
+func EnsureCatalogue() error {
+	catalogueDir := path.Join(config.ABRA_DIR, "catalogue")
+	if _, err := os.Stat(catalogueDir); err != nil && os.IsNotExist(err) {
+		url := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, config.CATALOGUE_JSON_REPO_NAME)
+		if err := gitPkg.Clone(catalogueDir, url); err != nil {
+			return err
+		}

-	cloneLimiter := limit.New(10)
-
-	retrieveBar := formatter.CreateProgressbar(barLength, "ensuring recipes are cloned & up-to-date...")
-	ch := make(chan string, barLength)
-	for _, repoMeta := range repos {
-		go func(rm RepoMeta) {
-			cloneLimiter.Begin()
-			defer cloneLimiter.End()
-
-			if recipeName != "" && recipeName != rm.Name {
-				ch <- rm.Name
-				retrieveBar.Add(1)
-				return
-			}
-			if _, exists := catalogue.CatalogueSkipList[rm.Name]; exists {
-				ch <- rm.Name
-				retrieveBar.Add(1)
-				return
-			}
-
-			recipeDir := path.Join(config.RECIPES_DIR, rm.Name)
-
-			if err := gitPkg.Clone(recipeDir, rm.CloneURL); err != nil {
-				logrus.Fatal(err)
-			}
-
-			if err := EnsureUpToDate(rm.Name); err != nil {
-				logrus.Fatal(err)
-			}
-
-			ch <- rm.Name
-			retrieveBar.Add(1)
-		}(repoMeta)
-	}
-
-	for range repos {
-		<-ch // wait for everything
+		logrus.Debugf("cloned catalogue repository to %s", catalogueDir)
 	}

 	return nil
--- a/pkg/runtime/runtime.go
+++ b/pkg/runtime/runtime.go
@ -1,58 +0,0 @@
-package runtime
-
-import "github.com/sirupsen/logrus"
-
-// Config is an internal configuration modifier. It can be instantiated on a
-// command call and can be changed on the fly to help make decisions further
-// down in the internals, e.g. whether or not to clone the recipe locally or
-// not.
-type Config struct {
-	EnsureRecipeExists bool // ensure that the recipe is cloned locally
-	EnsureRecipeLatest bool // ensure the local recipe has latest changes
-}
-
-// Option modified a Config.
-type Option func(c *Config)
-
-// New instantiates a new Config.
-func New(opts ...Option) *Config {
-	conf := &Config{
-		EnsureRecipeExists: true,
-	}
-
-	for _, optFunc := range opts {
-		optFunc(conf)
-	}
-
-	return conf
-}
-
-// WithEnsureRecipeExists determines whether or not we should be cloning the
-// local recipe or not. This can be useful for being more adaptable to offline
-// scenarios.
-func WithEnsureRecipeExists(ensureRecipeExists bool) Option {
-	return func(c *Config) {
-		if ensureRecipeExists {
-			logrus.Debugf("runtime config: EnsureRecipeExists = %v, ensuring recipes are cloned", ensureRecipeExists)
-		} else {
-			logrus.Debugf("runtime config: EnsureRecipeExists = %v, not cloning recipes", ensureRecipeExists)
-		}
-
-		c.EnsureRecipeExists = ensureRecipeExists
-	}
-}
-
-// WithEnsureRecipeLatest determines whether we should update the local recipes
-// remotely via Git. This can be useful when e.g. ensuring we have the latest
-// changes before making new ones.
-func WithEnsureRecipeLatest(ensureRecipeLatest bool) Option {
-	return func(c *Config) {
-		if ensureRecipeLatest {
-			logrus.Debugf("runtime config: EnsureRecipeLatest = %v, ensuring recipes have latest changes", ensureRecipeLatest)
-		} else {
-			logrus.Debugf("runtime config: EnsureRecipeLatest = %v, leaving recipes alone", ensureRecipeLatest)
-		}
-
-		c.EnsureRecipeLatest = ensureRecipeLatest
-	}
-}
--- a/pkg/secret/secret.go
+++ b/pkg/secret/secret.go
@ -12,8 +12,7 @@ import (

 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/config"
-	"github.com/decentral1se/passgen"
-	dockerClient "github.com/docker/docker/client"
+	"github.com/schultz-is/passgen"
 	"github.com/sirupsen/logrus"
 )

@ -118,7 +117,7 @@ func ParseSecretEnvVarValue(secret string) (secretValue, error) {
 }

 // GenerateSecrets generates secrets locally and sends them to a remote server for storage.
-func GenerateSecrets(cl *dockerClient.Client, secretEnvVars map[string]string, appName, server string) (map[string]string, error) {
+func GenerateSecrets(secretEnvVars map[string]string, appName, server string) (map[string]string, error) {
 	secrets := make(map[string]string)

 	var mutex sync.Mutex
@ -147,7 +146,7 @@ func GenerateSecrets(cl *dockerClient.Client, secretEnvVars map[string]string, a
 					return
 				}

-				if err := client.StoreSecret(cl, secretRemoteName, passwords[0], server); err != nil {
+				if err := client.StoreSecret(secretRemoteName, passwords[0], server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						logrus.Warnf("%s already exists, moving on...", secretRemoteName)
 						ch <- nil
@ -167,7 +166,7 @@ func GenerateSecrets(cl *dockerClient.Client, secretEnvVars map[string]string, a
 					return
 				}

-				if err := client.StoreSecret(cl, secretRemoteName, passphrases[0], server); err != nil {
+				if err := client.StoreSecret(secretRemoteName, passphrases[0], server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						logrus.Warnf("%s already exists, moving on...", secretRemoteName)
 						ch <- nil
--- a/pkg/ssh/ssh.go
+++ b/pkg/ssh/ssh.go
@ -1,13 +1,37 @@
 package ssh

 import (
+	"bufio"
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
-	"os/exec"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
 	"strings"
+	"sync"
+	"time"

+	"coopcloud.tech/abra/pkg/context"
+	"github.com/AlecAivazis/survey/v2"
+	dockerSSHPkg "github.com/docker/cli/cli/connhelper/ssh"
+	sshPkg "github.com/gliderlabs/ssh"
+	"github.com/kevinburke/ssh_config"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/crypto/ssh/knownhosts"
 )

+var KnownHostsPath = filepath.Join(os.Getenv("HOME"), ".ssh", "known_hosts")
+
+type Client struct {
+	SSHClient *ssh.Client
+}
+
 // HostConfig is a SSH host config.
 type HostConfig struct {
 	Host         string
@ -16,70 +40,509 @@ type HostConfig struct {
 	User         string
 }

-// String presents a human friendly output for the HostConfig.
-func (h HostConfig) String() string {
-	return fmt.Sprintf(
-		"{host: %s, username: %s, port: %s, identityfile: %s}",
-		h.Host,
-		h.User,
-		h.Port,
-		h.IdentityFile,
-	)
+// Exec cmd on the remote host and return stderr and stdout
+func (c *Client) Exec(cmd string) ([]byte, error) {
+	session, err := c.SSHClient.NewSession()
+	if err != nil {
+		return nil, err
+	}
+	defer session.Close()
+
+	return session.CombinedOutput(cmd)
 }

-// GetHostConfig retrieves a ~/.ssh/config config for a host using /usr/bin/ssh
-// directly. We therefore maintain consistent interop with this standard
-// tooling. This is useful because SSH confuses a lot of people and having to
-// learn how two tools (`ssh` and `abra`) handle SSH connection details instead
-// of one (just `ssh`) is Not Cool. Here's to less bug reports on this topic!
-func GetHostConfig(hostname string) (HostConfig, error) {
-	var hostConfig HostConfig
+// Close the underlying SSH connection
+func (c *Client) Close() error {
+	return c.SSHClient.Close()
+}

-	out, err := exec.Command("ssh", "-G", hostname).Output()
+// New creates a new SSH client connection.
+func New(domainName, sshAuth, username, port string) (*Client, error) {
+	var client *Client
+
+	ctxConnDetails, err := GetContextConnDetails(domainName)
 	if err != nil {
-		return hostConfig, err
+		return client, nil
 	}

-	for _, line := range strings.Split(string(out), "\n") {
-		entries := strings.Split(line, " ")
-		for idx, entry := range entries {
-			if entry == "hostname" {
-				hostConfig.Host = entries[idx+1]
+	if sshAuth == "identity-file" {
+		var err error
+		client, err = connectWithAgentTimeout(
+			ctxConnDetails.Host,
+			ctxConnDetails.User,
+			ctxConnDetails.Port,
+			5*time.Second,
+		)
+		if err != nil {
+			return client, err
+		}
+	} else {
+		password := ""
+		prompt := &survey.Password{
+			Message: "SSH password?",
+		}
+		if err := survey.AskOne(prompt, &password); err != nil {
+			return client, err
+		}
+
+		var err error
+		client, err = connectWithPasswordTimeout(
+			ctxConnDetails.Host,
+			ctxConnDetails.User,
+			ctxConnDetails.Port,
+			password,
+			5*time.Second,
+		)
+		if err != nil {
+			return client, err
+		}
+	}
+
+	return client, nil
+}
+
+// sudoWriter supports sudo command handling
+type sudoWriter struct {
+	b     bytes.Buffer
+	pw    string
+	stdin io.Writer
+	m     sync.Mutex
+}
+
+// Write satisfies the write interface for sudoWriter
+func (w *sudoWriter) Write(p []byte) (int, error) {
+	if strings.Contains(string(p), "sudo_password") {
+		w.stdin.Write([]byte(w.pw + "\n"))
+		w.pw = ""
+		return len(p), nil
+	}
+
+	w.m.Lock()
+	defer w.m.Unlock()
+
+	return w.b.Write(p)
+}
+
+// RunSudoCmd runs SSH commands and streams output
+func RunSudoCmd(cmd, passwd string, cl *Client) error {
+	session, err := cl.SSHClient.NewSession()
+	if err != nil {
+		return err
+	}
+	defer session.Close()
+
+	sudoCmd := fmt.Sprintf("SSH_ASKPASS=/usr/bin/ssh-askpass; sudo -p sudo_password -S %s", cmd)
+
+	w := &sudoWriter{pw: passwd}
+	w.stdin, err = session.StdinPipe()
+	if err != nil {
+		return err
+	}
+
+	session.Stdout = w
+	session.Stderr = w
+
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          0,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+	}
+
+	err = session.RequestPty("xterm", 80, 40, modes)
+	if err != nil {
+		return err
+	}
+
+	if err := session.Run(sudoCmd); err != nil {
+		return fmt.Errorf("%s", string(w.b.Bytes()))
+	}
+
+	return nil
+}
+
+// EnsureKnowHostsFiles ensures that ~/.ssh/known_hosts is created
+func EnsureKnowHostsFiles() error {
+	if _, err := os.Stat(KnownHostsPath); os.IsNotExist(err) {
+		logrus.Debugf("missing %s, creating now", KnownHostsPath)
+		file, err := os.OpenFile(KnownHostsPath, os.O_CREATE, 0600)
+		if err != nil {
+			return err
+		}
+		file.Close()
+	}
+
+	return nil
+}
+
+// GetHostKey checks if a host key is registered in the ~/.ssh/known_hosts file
+func GetHostKey(hostname string) (bool, sshPkg.PublicKey, error) {
+	var hostKey sshPkg.PublicKey
+
+	ctxConnDetails, err := GetContextConnDetails(hostname)
+	if err != nil {
+		return false, hostKey, err
+	}
+
+	if err := EnsureKnowHostsFiles(); err != nil {
+		return false, hostKey, err
+	}
+
+	file, err := os.Open(KnownHostsPath)
+	if err != nil {
+		return false, hostKey, err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), " ")
+		if len(fields) != 3 {
+			continue
+		}
+
+		hostnameAndPort := fmt.Sprintf("%s:%s", ctxConnDetails.Host, ctxConnDetails.Port)
+		hashed := knownhosts.Normalize(hostnameAndPort)
+
+		if strings.Contains(fields[0], hashed) {
+			var err error
+			hostKey, _, _, _, err = ssh.ParseAuthorizedKey(scanner.Bytes())
+			if err != nil {
+				return false, hostKey, fmt.Errorf("error parsing server SSH host key %q: %v", fields[2], err)
 			}
-			if entry == "user" {
-				hostConfig.User = entries[idx+1]
+			break
+		}
+	}
+
+	if hostKey != nil {
+		logrus.Debugf("server SSH host key present in ~/.ssh/known_hosts for %s", hostname)
+		return true, hostKey, nil
+	}
+
+	return false, hostKey, nil
+}
+
+// InsertHostKey adds a new host key to the ~/.ssh/known_hosts file
+func InsertHostKey(hostname string, remote net.Addr, pubKey ssh.PublicKey) error {
+	file, err := os.OpenFile(KnownHostsPath, os.O_APPEND|os.O_WRONLY, 0600)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	hashedHostname := knownhosts.Normalize(hostname)
+	lineHostname := knownhosts.Line([]string{hashedHostname}, pubKey)
+	_, err = file.WriteString(fmt.Sprintf("%s\n", lineHostname))
+	if err != nil {
+		return err
+	}
+
+	hashedRemote := knownhosts.Normalize(remote.String())
+	lineRemote := knownhosts.Line([]string{hashedRemote}, pubKey)
+	_, err = file.WriteString(fmt.Sprintf("%s\n", lineRemote))
+	if err != nil {
+		return err
+	}
+
+	logrus.Debugf("SSH host key generated: %s", lineHostname)
+	logrus.Debugf("SSH host key generated: %s", lineRemote)
+
+	return nil
+}
+
+// HostKeyAddCallback ensures server ssh host keys are handled
+func HostKeyAddCallback(hostnameAndPort string, remote net.Addr, pubKey ssh.PublicKey) error {
+	exists, _, err := GetHostKey(hostnameAndPort)
+	if err != nil {
+		return err
+	}
+
+	if exists {
+		hostname := strings.Split(hostnameAndPort, ":")[0]
+		logrus.Debugf("server SSH host key found for %s", hostname)
+		return nil
+	}
+
+	if !exists {
+		hostname := strings.Split(hostnameAndPort, ":")[0]
+		parsedPubKey := FingerprintSHA256(pubKey)
+
+		fmt.Printf(fmt.Sprintf(`
+You are attempting to make an SSH connection to a server but there is no entry
+in your ~/.ssh/known_hosts file which confirms that you have already validated
+that this is indeed the server you want to connect to. Please take a moment to
+validate the following SSH host key, it is important.
+
+    Host:        %s
+    Fingerprint: %s
+
+If this is confusing to you, you can read the article below and learn how to
+validate this fingerprint safely. Thanks to the comrades at cyberia.club for
+writing this extensive guide <3
+
+    https://sequentialread.com/understanding-the-secure-shell-protocol-ssh/
+
+`, hostname, parsedPubKey))
+
+		response := false
+		prompt := &survey.Confirm{
+			Message: "are you sure you trust this host key?",
+		}
+
+		if err := survey.AskOne(prompt, &response); err != nil {
+			return err
+		}
+
+		if !response {
+			logrus.Fatal("exiting as requested")
+		}
+
+		logrus.Debugf("attempting to insert server SSH host key for %s, %s", hostnameAndPort, remote)
+
+		if err := InsertHostKey(hostnameAndPort, remote, pubKey); err != nil {
+			return err
+		}
+
+		logrus.Infof("successfully added server SSH host key for %s", hostname)
+	}
+
+	return nil
+}
+
+// connect makes the SSH connection
+func connect(username, host, port string, authMethod ssh.AuthMethod, timeout time.Duration) (*Client, error) {
+	config := &ssh.ClientConfig{
+		User:            username,
+		Auth:            []ssh.AuthMethod{authMethod},
+		HostKeyCallback: HostKeyAddCallback, // the main reason why we fork
+	}
+
+	hostnameAndPort := fmt.Sprintf("%s:%s", host, port)
+
+	logrus.Debugf("tcp dialing %s", hostnameAndPort)
+
+	var conn net.Conn
+	var err error
+	conn, err = net.DialTimeout("tcp", hostnameAndPort, timeout)
+	if err != nil {
+		logrus.Debugf("tcp dialing %s failed, trying via ~/.ssh/config", hostnameAndPort)
+		hostConfig, err := GetHostConfig(host, username, port, true)
+		if err != nil {
+			return nil, err
+		}
+		conn, err = net.DialTimeout("tcp", fmt.Sprintf("%s:%s", hostConfig.Host, hostConfig.Port), timeout)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	sshConn, chans, reqs, err := ssh.NewClientConn(conn, hostnameAndPort, config)
+	if err != nil {
+		return nil, err
+	}
+
+	client := ssh.NewClient(sshConn, chans, reqs)
+	c := &Client{SSHClient: client}
+
+	return c, nil
+}
+
+func connectWithAgentTimeout(host, username, port string, timeout time.Duration) (*Client, error) {
+	logrus.Debugf("using ssh-agent to make an SSH connection for %s", host)
+
+	sshAgent, err := net.Dial("unix", os.Getenv("SSH_AUTH_SOCK"))
+	if err != nil {
+		return nil, err
+	}
+
+	agentCl := agent.NewClient(sshAgent)
+	authMethod := ssh.PublicKeysCallback(agentCl.Signers)
+
+	loadedKeys, err := agentCl.List()
+	if err != nil {
+		return nil, err
+	}
+
+	var convertedKeys []string
+	for _, key := range loadedKeys {
+		convertedKeys = append(convertedKeys, key.String())
+	}
+
+	if len(convertedKeys) > 0 {
+		logrus.Debugf("ssh-agent has these keys loaded: %s", strings.Join(convertedKeys, ","))
+	} else {
+		logrus.Debug("ssh-agent has no keys loaded")
+	}
+
+	return connect(username, host, port, authMethod, timeout)
+}
+
+func connectWithPasswordTimeout(host, username, port, pass string, timeout time.Duration) (*Client, error) {
+	authMethod := ssh.Password(pass)
+
+	return connect(username, host, port, authMethod, timeout)
+}
+
+// EnsureHostKey ensures that a host key trusted and added to the ~/.ssh/known_hosts file
+func EnsureHostKey(hostname string) error {
+	if hostname == "default" || hostname == "local" {
+		logrus.Debugf("not checking server SSH host key against local/default target")
+		return nil
+	}
+
+	exists, _, err := GetHostKey(hostname)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+
+	ctxConnDetails, err := GetContextConnDetails(hostname)
+	if err != nil {
+		return err
+	}
+
+	_, err = connectWithAgentTimeout(
+		ctxConnDetails.Host,
+		ctxConnDetails.User,
+		ctxConnDetails.Port,
+		5*time.Second,
+	)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// FingerprintSHA256 generates the SHA256 fingerprint for a server SSH host key
+func FingerprintSHA256(key ssh.PublicKey) string {
+	hash := sha256.Sum256(key.Marshal())
+	b64hash := base64.StdEncoding.EncodeToString(hash[:])
+	trimmed := strings.TrimRight(b64hash, "=")
+	return fmt.Sprintf("SHA256:%s", trimmed)
+}
+
+// GetContextConnDetails retrieves SSH connection details from a docker context endpoint
+func GetContextConnDetails(serverName string) (*dockerSSHPkg.Spec, error) {
+	dockerContextStore := context.NewDefaultDockerContextStore()
+	contexts, err := dockerContextStore.Store.List()
+	if err != nil {
+		return &dockerSSHPkg.Spec{}, err
+	}
+
+	if strings.Contains(serverName, ":") {
+		serverName = strings.Split(serverName, ":")[0]
+	}
+
+	for _, ctx := range contexts {
+		endpoint, err := context.GetContextEndpoint(ctx)
+		if err != nil && strings.Contains(err.Error(), "does not exist") {
+			// No local context found, we can continue safely
+			continue
+		}
+		if ctx.Name == serverName {
+			ctxConnDetails, err := dockerSSHPkg.ParseURL(endpoint)
+			if err != nil {
+				return &dockerSSHPkg.Spec{}, err
 			}
-			if entry == "port" {
-				hostConfig.Port = entries[idx+1]
+			logrus.Debugf("found context connection details %v for %s", ctxConnDetails, serverName)
+			return ctxConnDetails, nil
+		}
+	}
+
+	hostConfig, err := GetHostConfig(serverName, "", "", false)
+	if err != nil {
+		return &dockerSSHPkg.Spec{}, err
+	}
+
+	logrus.Debugf("couldn't find a docker context matching %s", serverName)
+	logrus.Debugf("searching ~/.ssh/config for a Host entry for %s", serverName)
+
+	connDetails := &dockerSSHPkg.Spec{
+		Host: hostConfig.Host,
+		User: hostConfig.User,
+		Port: hostConfig.Port,
+	}
+
+	logrus.Debugf("using %v from ~/.ssh/config for connection details", connDetails)
+
+	return connDetails, nil
+}
+
+// GetHostConfig retrieves a ~/.ssh/config config for a host.
+func GetHostConfig(hostname, username, port string, override bool) (HostConfig, error) {
+	var hostConfig HostConfig
+
+	if hostname == "" || override {
+		if sshHost := ssh_config.Get(hostname, "Hostname"); sshHost != "" {
+			hostname = sshHost
+		}
+	}
+
+	if username == "" || override {
+		if sshUser := ssh_config.Get(hostname, "User"); sshUser != "" {
+			username = sshUser
+		} else {
+			systemUser, err := user.Current()
+			if err != nil {
+				return hostConfig, err
 			}
-			if entry == "identityfile" {
-				if hostConfig.IdentityFile == "" {
-					hostConfig.IdentityFile = entries[idx+1]
-				}
+			username = systemUser.Username
+		}
+	}
+
+	if port == "" || override {
+		if sshPort := ssh_config.Get(hostname, "Port"); sshPort != "" {
+			// skip override probably correct port with dummy default value from
+			// ssh_config which is 22. only when the original port number is empty
+			// should we try this default. this might not cover all cases
+			// unfortunately.
+			if port != "" && sshPort != "22" {
+				port = sshPort
 			}
 		}
 	}

-	logrus.Debugf("retrieved ssh config for %s: %s", hostname, hostConfig.String())
+	if idf := ssh_config.Get(hostname, "IdentityFile"); idf != "" && idf != "~/.ssh/identity" {
+		var err error
+		idf, err = identityFileAbsPath(idf)
+		if err != nil {
+			return hostConfig, err
+		}
+		hostConfig.IdentityFile = idf
+	} else {
+		hostConfig.IdentityFile = ""
+	}
+
+	hostConfig.Host = hostname
+	hostConfig.Port = port
+	hostConfig.User = username
+
+	logrus.Debugf("constructed SSH config %s for %s", hostConfig, hostname)

 	return hostConfig, nil
 }

-// Fatal is a error output wrapper which aims to make SSH failures easier to
-// parse through re-wording.
-func Fatal(hostname string, err error) error {
-	out := err.Error()
-	if strings.Contains(out, "Host key verification failed.") {
-		return fmt.Errorf("SSH host key verification failed for %s", hostname)
-	} else if strings.Contains(out, "Could not resolve hostname") {
-		return fmt.Errorf("could not resolve hostname for %s", hostname)
-	} else if strings.Contains(out, "Connection timed out") {
-		return fmt.Errorf("connection timed out for %s", hostname)
-	} else if strings.Contains(out, "Permission denied") {
-		return fmt.Errorf("ssh auth: permission denied for %s", hostname)
-	} else if strings.Contains(out, "Network is unreachable") {
-		return fmt.Errorf("unable to connect to %s, network is unreachable?", hostname)
+func identityFileAbsPath(relPath string) (string, error) {
+	var err error
+	var absPath string
+
+	if strings.HasPrefix(relPath, "~/") {
+		systemUser, err := user.Current()
+		if err != nil {
+			return absPath, err
+		}
+		absPath = filepath.Join(systemUser.HomeDir, relPath[2:])
 	} else {
-		return err
+		absPath, err = filepath.Abs(relPath)
+		if err != nil {
+			return absPath, err
+		}
 	}
+
+	logrus.Debugf("resolved %s to %s to read the ssh identity file", relPath, absPath)
+
+	return absPath, nil
 }
--- a/pkg/test/test.go
+++ b/pkg/test/test.go
@ -1,38 +0,0 @@
-package test
-
-import (
-	"log"
-	"os"
-
-	"github.com/sirupsen/logrus"
-)
-
-// RmServerAppRecipe deletes the test server / app / recipe.
-func RmServerAppRecipe() {
-	testAppLink := os.ExpandEnv("$HOME/.abra/servers/foo.com")
-	if err := os.Remove(testAppLink); err != nil {
-		logrus.Fatal(err)
-	}
-
-	testRecipeLink := os.ExpandEnv("$HOME/.abra/recipes/test")
-	if err := os.Remove(testRecipeLink); err != nil {
-		logrus.Fatal(err)
-	}
-}
-
-// MkServerAppRecipe symlinks the test server / app / recipe.
-func MkServerAppRecipe() {
-	RmServerAppRecipe()
-
-	testAppDir := os.ExpandEnv("$PWD/../../tests/resources/testapp")
-	testAppLink := os.ExpandEnv("$HOME/.abra/servers/foo.com")
-	if err := os.Symlink(testAppDir, testAppLink); err != nil {
-		log.Fatal(err)
-	}
-
-	testRecipeDir := os.ExpandEnv("$PWD/../../tests/resources/testrecipe")
-	testRecipeLink := os.ExpandEnv("$HOME/.abra/recipes/test")
-	if err := os.Symlink(testRecipeDir, testRecipeLink); err != nil {
-		log.Fatal(err)
-	}
-}
--- a/pkg/upstream/commandconn/connection.go
+++ b/pkg/upstream/commandconn/connection.go
@ -2,15 +2,18 @@ package commandconn

 import (
 	"context"
+	"fmt"
 	"net"
 	"net/url"

+	sshPkg "coopcloud.tech/abra/pkg/ssh"
 	"github.com/docker/cli/cli/connhelper"
 	"github.com/docker/cli/cli/connhelper/ssh"
 	"github.com/docker/cli/cli/context/docker"
 	dCliContextStore "github.com/docker/cli/cli/context/store"
 	dClient "github.com/docker/docker/client"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )

 // GetConnectionHelper returns Docker-specific connection helper for the given URL.
@ -33,6 +36,25 @@ func getConnectionHelper(daemonURL string, sshFlags []string) (*connhelper.Conne
 			return nil, errors.Wrap(err, "ssh host connection is not valid")
 		}

+		if err := sshPkg.EnsureHostKey(ctxConnDetails.Host); err != nil {
+			return nil, err
+		}
+
+		hostConfig, err := sshPkg.GetHostConfig(
+			ctxConnDetails.Host,
+			ctxConnDetails.User,
+			ctxConnDetails.Port,
+			false,
+		)
+		if err != nil {
+			return nil, err
+		}
+		if hostConfig.IdentityFile != "" {
+			msg := "discovered %s as identity file for %s, using for ssh connection"
+			logrus.Debugf(msg, hostConfig.IdentityFile, ctxConnDetails.Host)
+			sshFlags = append(sshFlags, fmt.Sprintf("-o IdentityFile=%s", hostConfig.IdentityFile))
+		}
+
 		return &connhelper.ConnectionHelper{
 			Dialer: func(ctx context.Context, network, addr string) (net.Conn, error) {
 				return New(ctx, "ssh", append(sshFlags, ctxConnDetails.Args("docker", "system", "dial-stdio")...)...)
--- a/pkg/upstream/stack/stack.go
+++ b/pkg/upstream/stack/stack.go
@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"

+	abraClient "coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	"github.com/docker/cli/cli/command/service/progress"
-	"github.com/docker/cli/cli/command/stack/formatter"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
@ -18,7 +18,7 @@ import (
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
-	dockerClient "github.com/docker/docker/client"
+	dockerclient "github.com/docker/docker/client"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@ -57,10 +57,20 @@ func GetStackServices(ctx context.Context, dockerclient client.APIClient, namesp
 }

 // GetDeployedServicesByLabel filters services by label
-func GetDeployedServicesByLabel(cl *dockerClient.Client, contextName string, label string) StackStatus {
+func GetDeployedServicesByLabel(contextName string, label string) StackStatus {
+	cl, err := abraClient.New(contextName)
+	if err != nil {
+		if strings.Contains(err.Error(), "does not exist") {
+			// No local context found, bail out gracefully
+			return StackStatus{[]swarm.Service{}, nil}
+		}
+		return StackStatus{[]swarm.Service{}, err}
+	}
+
+	ctx := context.Background()
 	filters := filters.NewArgs()
 	filters.Add("label", label)
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filters})
+	services, err := cl.ServiceList(ctx, types.ServiceListOptions{Filters: filters})
 	if err != nil {
 		return StackStatus{[]swarm.Service{}, err}
 	}
@ -68,8 +78,18 @@ func GetDeployedServicesByLabel(cl *dockerClient.Client, contextName string, lab
 	return StackStatus{services, nil}
 }

-func GetAllDeployedServices(cl *dockerClient.Client, contextName string) StackStatus {
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: getAllStacksFilter()})
+func GetAllDeployedServices(contextName string) StackStatus {
+	cl, err := abraClient.New(contextName)
+	if err != nil {
+		if strings.Contains(err.Error(), "does not exist") {
+			// No local context found, bail out gracefully
+			return StackStatus{[]swarm.Service{}, nil}
+		}
+		return StackStatus{[]swarm.Service{}, err}
+	}
+
+	ctx := context.Background()
+	services, err := cl.ServiceList(ctx, types.ServiceListOptions{Filters: getAllStacksFilter()})
 	if err != nil {
 		return StackStatus{[]swarm.Service{}, err}
 	}
@ -78,7 +98,7 @@ func GetAllDeployedServices(cl *dockerClient.Client, contextName string) StackSt
 }

 // GetDeployedServicesByName filters services by name
-func GetDeployedServicesByName(ctx context.Context, cl *dockerClient.Client, stackName, serviceName string) StackStatus {
+func GetDeployedServicesByName(ctx context.Context, cl *dockerclient.Client, stackName, serviceName string) StackStatus {
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("%s_%s", stackName, serviceName))

@ -91,7 +111,7 @@ func GetDeployedServicesByName(ctx context.Context, cl *dockerClient.Client, sta
 }

 // IsDeployed chekcks whether an appp is deployed or not.
-func IsDeployed(ctx context.Context, cl *dockerClient.Client, stackName string) (bool, string, error) {
+func IsDeployed(ctx context.Context, cl *dockerclient.Client, stackName string) (bool, string, error) {
 	version := "unknown"
 	isDeployed := false

@ -122,7 +142,7 @@ func IsDeployed(ctx context.Context, cl *dockerClient.Client, stackName string)
 }

 // pruneServices removes services that are no longer referenced in the source
-func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, services map[string]struct{}) {
+func pruneServices(ctx context.Context, cl *dockerclient.Client, namespace convert.Namespace, services map[string]struct{}) {
 	oldServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
 		logrus.Infof("Failed to list services: %s\n", err)
@ -138,7 +158,9 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 }

 // RunDeploy is the swarm implementation of docker stack deploy
-func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, appName string, dontWait bool) error {
+func RunDeploy(cl *dockerclient.Client, opts Deploy, cfg *composetypes.Config, appName string, dontWait bool) error {
+	ctx := context.Background()
+
 	if err := validateResolveImageFlag(&opts); err != nil {
 		return err
 	}
@ -148,7 +170,7 @@ func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, a
 		opts.ResolveImage = ResolveImageNever
 	}

-	return deployCompose(context.Background(), cl, opts, cfg, appName, dontWait)
+	return deployCompose(ctx, cl, opts, cfg, appName, dontWait)
 }

 // validateResolveImageFlag validates the opts.resolveImage command line option
@ -161,7 +183,7 @@ func validateResolveImageFlag(opts *Deploy) error {
 	}
 }

-func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, config *composetypes.Config, appName string, dontWait bool) error {
+func deployCompose(ctx context.Context, cl *dockerclient.Client, opts Deploy, config *composetypes.Config, appName string, dontWait bool) error {
 	namespace := convert.NewNamespace(opts.Namespace)

 	if opts.Prune {
@ -219,7 +241,7 @@ func getServicesDeclaredNetworks(serviceConfigs []composetypes.ServiceConfig) ma
 	return serviceNetworks
 }

-func validateExternalNetworks(ctx context.Context, client dockerClient.NetworkAPIClient, externalNetworks []string) error {
+func validateExternalNetworks(ctx context.Context, client dockerclient.NetworkAPIClient, externalNetworks []string) error {
 	for _, networkName := range externalNetworks {
 		if !container.NetworkMode(networkName).IsUserDefined() {
 			// Networks that are not user defined always exist on all nodes as
@ -228,7 +250,7 @@ func validateExternalNetworks(ctx context.Context, client dockerClient.NetworkAP
 		}
 		network, err := client.NetworkInspect(ctx, networkName, types.NetworkInspectOptions{})
 		switch {
-		case dockerClient.IsErrNotFound(err):
+		case dockerclient.IsErrNotFound(err):
 			return errors.Errorf("network %q is declared as external, but could not be found. You need to create a swarm-scoped network before the stack is deployed", networkName)
 		case err != nil:
 			return err
@ -239,7 +261,7 @@ func validateExternalNetworks(ctx context.Context, client dockerClient.NetworkAP
 	return nil
 }

-func createSecrets(ctx context.Context, cl *dockerClient.Client, secrets []swarm.SecretSpec) error {
+func createSecrets(ctx context.Context, cl *dockerclient.Client, secrets []swarm.SecretSpec) error {
 	for _, secretSpec := range secrets {
 		secret, _, err := cl.SecretInspectWithRaw(ctx, secretSpec.Name)
 		switch {
@ -248,7 +270,7 @@ func createSecrets(ctx context.Context, cl *dockerClient.Client, secrets []swarm
 			if err := cl.SecretUpdate(ctx, secret.ID, secret.Meta.Version, secretSpec); err != nil {
 				return errors.Wrapf(err, "failed to update secret %s", secretSpec.Name)
 			}
-		case dockerClient.IsErrNotFound(err):
+		case dockerclient.IsErrNotFound(err):
 			// secret does not exist, then we create a new one.
 			logrus.Infof("Creating secret %s\n", secretSpec.Name)
 			if _, err := cl.SecretCreate(ctx, secretSpec); err != nil {
@ -261,7 +283,7 @@ func createSecrets(ctx context.Context, cl *dockerClient.Client, secrets []swarm
 	return nil
 }

-func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm.ConfigSpec) error {
+func createConfigs(ctx context.Context, cl *dockerclient.Client, configs []swarm.ConfigSpec) error {
 	for _, configSpec := range configs {
 		config, _, err := cl.ConfigInspectWithRaw(ctx, configSpec.Name)
 		switch {
@ -270,7 +292,7 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 			if err := cl.ConfigUpdate(ctx, config.ID, config.Meta.Version, configSpec); err != nil {
 				return errors.Wrapf(err, "failed to update config %s", configSpec.Name)
 			}
-		case dockerClient.IsErrNotFound(err):
+		case dockerclient.IsErrNotFound(err):
 			// config does not exist, then we create a new one.
 			logrus.Infof("Creating config %s\n", configSpec.Name)
 			if _, err := cl.ConfigCreate(ctx, configSpec); err != nil {
@ -283,7 +305,7 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 	return nil
 }

-func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, networks map[string]types.NetworkCreate) error {
+func createNetworks(ctx context.Context, cl *dockerclient.Client, namespace convert.Namespace, networks map[string]types.NetworkCreate) error {
 	existingNetworks, err := getStackNetworks(ctx, cl, namespace.Name())
 	if err != nil {
 		return err
@ -313,7 +335,7 @@ func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace conv

 func deployServices(
 	ctx context.Context,
-	cl *dockerClient.Client,
+	cl *dockerclient.Client,
 	services map[string]swarm.ServiceSpec,
 	namespace convert.Namespace,
 	sendAuth bool,
@ -447,7 +469,7 @@ func getStackConfigs(ctx context.Context, dockerclient client.APIClient, namespa

 // https://github.com/docker/cli/blob/master/cli/command/service/helpers.go
 // https://github.com/docker/cli/blob/master/cli/command/service/progress/progress.go
-func WaitOnService(ctx context.Context, cl *dockerClient.Client, serviceID, appName string) error {
+func WaitOnService(ctx context.Context, cl *dockerclient.Client, serviceID, appName string) error {
 	errChan := make(chan error, 1)
 	pipeReader, pipeWriter := io.Pipe()

@ -485,37 +507,3 @@ If a service is failing to even start, try smoke out the error with:
 `, appName, timeout, appName, appName, appName))
 	}
 }
-
-// Copypasta from https://github.com/docker/cli/blob/master/cli/command/stack/swarm/list.go
-// GetStacks lists the swarm stacks.
-func GetStacks(cl *dockerClient.Client) ([]*formatter.Stack, error) {
-	services, err := cl.ServiceList(
-		context.Background(),
-		types.ServiceListOptions{Filters: getAllStacksFilter()})
-	if err != nil {
-		return nil, err
-	}
-	m := make(map[string]*formatter.Stack)
-	for _, service := range services {
-		labels := service.Spec.Labels
-		name, ok := labels[convert.LabelNamespace]
-		if !ok {
-			return nil, errors.Errorf("cannot get label %s for service %s",
-				convert.LabelNamespace, service.ID)
-		}
-		ztack, ok := m[name]
-		if !ok {
-			m[name] = &formatter.Stack{
-				Name:     name,
-				Services: 1,
-			}
-		} else {
-			ztack.Services++
-		}
-	}
-	var stacks []*formatter.Stack
-	for _, stack := range m {
-		stacks = append(stacks, stack)
-	}
-	return stacks, nil
-}
--- a/renovate.json
+++ b/renovate.json
@ -1,13 +1,3 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "packageRules": [{
-    "matchUpdateTypes": ["minor", "patch"],
-    "automerge": true
-  }],
-  "postUpdateOptions": [
-    "gomodTidy"
-  ],
-  "ignoreDeps": [
-    "github.com/urfave/cli"
-  ]
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
 }
--- a/scripts/autocomplete/fish
+++ b/scripts/autocomplete/fish
@ -1,7 +0,0 @@
-function complete_abra_args
-    set -l cmd (commandline -poc) --generate-bash-completion
-    $cmd
-end
-complete -c abra -f -n "not __fish_seen_subcommand_from -h --help -v --version complete_abra_args" -a "(complete_abra_args)"
-complete -c abra -f -s h -l help -d 'show help'
-complete -c abra -f -s v -l version -d 'print the version'
--- a/scripts/installer/installer
+++ b/scripts/installer/installer
@ -1,8 +1,8 @@
 #!/usr/bin/env bash

-ABRA_VERSION="0.6.0-beta"
+ABRA_VERSION="0.3.0-alpha"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/coop-cloud/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.7.0-rc2-beta"
+RC_VERSION="0.4.0-alpha-rc7"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/coop-cloud/abra/releases/tags/$RC_VERSION"

 for arg in "$@"; do
@ -44,17 +44,8 @@ function install_abra_release {
    exit 1
  fi

-  ARCH=$(uname -m)
-  if [[ $ARCH =~ "aarch64" ]]; then
-      ARCH="arm64"
-  elif [[ $ARCH =~ "armv5l" ]]; then
-      ARCH="armv5"
-  elif [[ $ARCH =~ "armv6l" ]]; then
-      ARCH="armv6"
-  elif [[ $ARCH =~ "armv7l" ]]; then
-      ARCH="armv7"
-  fi
-  PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')_$ARCH
+
+  PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m)
  FILENAME="abra_"$ABRA_VERSION"_"$PLATFORM""
  sed_command_rel='s/.*"assets":\[\{[^]]*"name":"'$FILENAME'"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
  sed_command_checksums='s/.*"assets":\[\{[^\]*"name":"checksums.txt"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
--- a/scripts/release/upx.sh
+++ b/scripts/release/upx.sh
@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-upx ./dist/abra_*/abra
--- a/tests/integration/.gitignore
+++ b/tests/integration/.gitignore
@ -1 +0,0 @@
-logs
--- a/tests/integration/autocomplete.sh
+++ b/tests/integration/autocomplete.sh
@ -8,5 +8,3 @@ run_test '$ABRA autocomplete bash'
 run_test '$ABRA autocomplete fizsh'

 run_test '$ABRA autocomplete zsh'
-
-run_test '$ABRA autocomplete fish'
--- a/tests/integration/cmd.sh
+++ b/tests/integration/cmd.sh
@ -1,14 +0,0 @@
-#!/bin/bash
-
-source ./testfunctions.sh
-source ./common.sh
-
-create_server_app_recipe
-
-run_test '$ABRA app cmd foo.com test --local'
-
-run_test '$ABRA app cmd foo.com test --local -- foo'
-
-run_test '$ABRA app cmd foo.com test --local -- foo bar baz'
-
-clean_server_app_recipe
--- a/tests/integration/common.sh
+++ b/tests/integration/common.sh
@ -2,16 +2,6 @@

 set -e

-create_server_app_recipe() {
-  ln -srf ../resources/testapp ~/.abra/servers/foo.com
-  ln -srf ../resources/testrecipe ~/.abra/recipes
-}
-
-clean_server_app_recipe() {
-  unlink ~/.abra/servers/foo.com
-  unlink ~/.abra/recipes/testrecipe
-}
-
 function init() {
  ABRA="$(pwd)/../../abra"
  INSTALLER_URL="https://git.coopcloud.tech/coop-cloud/abra/raw/branch/main/scripts/installer/installer"
--- a/tests/integration/test_all.sh
+++ b/tests/integration/test_all.sh
@ -16,7 +16,7 @@ run_test () {
    echo $logfile
 }

-testScripts=("app.sh" "autocomplete.sh" "catalogue.sh" "install.sh" "recipe.sh" "records.sh" "server.sh", "cmd.sh")
+testScripts=("app.sh" "autocomplete.sh" "catalogue.sh" "install.sh" "recipe.sh" "records.sh" "server.sh")

 for i in "${testScripts[@]}"; do
    cmd="./$i $res_dir${i/sh/log}"
--- a/tests/resources/testapp/foo.com.env
+++ b/tests/resources/testapp/foo.com.env
@ -1 +0,0 @@
-TYPE=test
--- a/tests/resources/testapp/testapp
+++ b/tests/resources/testapp/testapp
@ -1 +0,0 @@
-.
--- a/tests/resources/testrecipe/abra.sh
+++ b/tests/resources/testrecipe/abra.sh
@ -1,5 +0,0 @@
-test(){
-  echo "1: $1"
-  echo "2: $2"
-  echo "all: $@"
-}
--- a/tests/resources/testrecipe/compose.yml
+++ b/tests/resources/testrecipe/compose.yml
@ -1,5 +0,0 @@
---
-version: "3.8"
-
-services:
-  app: []