wowowowowo

- Add .gitea/workflows/ci.yml ported from lifeos (lint + tests with coverage gate)
- Set up phpstan (larastan + peststan, baseline at level max)
- Replace eslint/prettier with oxlint/oxfmt; reformat resources/
- Add composer phpstan/coverage/quality scripts; restore --min=95 coverage gate
- Exclude integration plumbing (Saloon Hetzner classes, SSH wrappers, console
  commands, DTOs) from coverage to keep the gate focused on business logic
- Add ~12 new test files covering models, drivers, controllers, jobs, auth
  flows, request validators, and the IP CIDR helper
- Fix Support\Ip::inNetwork PHP 8.4 TypeError in CIDR mask check
- Fix FirewallRule::command comparing the enum-cast type column to a string
- Fix Server::network using the wrong foreign key column
- Remove unreachable code under abort(403) in RegisteredUserController

.env.example

@@ -63,3 +63,5 @@ AWS_BUCKET=
 AWS_USE_PATH_STYLE_ENDPOINT=false
 
 VITE_APP_NAME="${APP_NAME}"
+
+HETZNER_KEY=

.gitea/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    container:
+      image: git.bayliss.cloud/harry/gitea-ci-runner:php8.4
+
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Composer dependencies
+        run: composer install --no-interaction --prefer-dist --optimize-autoloader
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run frontend lint
+        run: bun run lint:check
+
+      - name: Check frontend formatting
+        run: bun run format:check
+
+      - name: Check PHP formatting
+        run: vendor/bin/pint --test
+
+      - name: Run static analysis
+        run: composer phpstan
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    container:
+      image: git.bayliss.cloud/harry/gitea-ci-runner:php8.4
+
+    defaults:
+      run:
+        shell: bash
+
+    env:
+      APP_ENV: testing
+      APP_KEY: base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+      CACHE_STORE: array
+      DB_CONNECTION: sqlite
+      DB_DATABASE: database/testing.sqlite
+      MAIL_MAILER: array
+      QUEUE_CONNECTION: sync
+      SESSION_DRIVER: array
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Prepare SQLite database
+        run: touch database/testing.sqlite
+
+      - name: Install Composer dependencies
+        run: composer install --no-interaction --prefer-dist --optimize-autoloader
+
+      - name: Run test suite with coverage
+        run: composer coverage

.instructions/project-refactor.md

@@ -0,0 +1,11 @@
+The project's structure is changing. The current setup is Applications have Environments and those environments have slices that belong to them.
+
+We're no longer doing this. The application is changing to be more server-centric.
+
+Slices and Environments can be removed.
+
+Servers are going to have services, which can be selected on server provision. Once the server has finished provisioning, we run deployments for all of the services the user has selected for that server.
+
+Applications can be installed on a server. The application could be installed across multiple servers, and deployed at the same time. The application isn't tied directly to the server, instead it has an Instance model that acts as an intermediary. This means that the user can deploy an Application which will update both instances.
+
+Create a plan for refactoring the project to support this new structure.

.mcp.json

@@ -0,0 +1,11 @@
+{
+    "mcpServers": {
+        "laravel-boost": {
+            "command": "php",
+            "args": [
+                "artisan",
+                "boost:mcp"
+            ]
+        }
+    }
+}

.prettierignore

@@ -1,3 +0,0 @@
-resources/js/components/ui/*
-resources/js/ziggy.js
-resources/views/mail/*

.prettierrc

@@ -1,18 +0,0 @@
-{
-    "semi": true,
-    "singleQuote": true,
-    "singleAttributePerLine": false,
-    "htmlWhitespaceSensitivity": "css",
-    "printWidth": 150,
-    "plugins": ["prettier-plugin-organize-imports", "prettier-plugin-tailwindcss"],
-    "tailwindFunctions": ["clsx", "cn"],
-    "tabWidth": 4,
-    "overrides": [
-        {
-            "files": "**/*.yml",
-            "options": {
-                "tabWidth": 2
-            }
-        }
-    ]
-}

AGENTS.md

@@ -0,0 +1,287 @@
+<laravel-boost-guidelines>
+=== foundation rules ===
+
+# Laravel Boost Guidelines
+
+The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to enhance the user's satisfaction building Laravel applications.
+
+## Foundational Context
+This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
+
+- php - 8.4.16
+- inertiajs/inertia-laravel (INERTIA) - v2
+- laravel/framework (LARAVEL) - v12
+- laravel/prompts (PROMPTS) - v0
+- tightenco/ziggy (ZIGGY) - v2
+- laravel/pint (PINT) - v1
+- laravel/sail (SAIL) - v1
+- pestphp/pest (PEST) - v3
+- phpunit/phpunit (PHPUNIT) - v11
+
+
+## Conventions
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, naming.
+- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
+- Check for existing components to reuse before writing a new one.
+
+## Verification Scripts
+- Do not create verification scripts or tinker when tests cover that functionality and prove it works. Unit and feature tests are more important.
+
+## Application Structure & Architecture
+- Stick to existing directory structure - don't create new base folders without approval.
+- Do not change the application's dependencies without approval.
+
+## Frontend Bundling
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+
+## Replies
+- Be concise in your explanations - focus on what's important rather than explaining obvious details.
+
+## Documentation Files
+- You must only create documentation files if explicitly requested by the user.
+
+
+=== boost rules ===
+
+## Laravel Boost
+- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
+
+## Artisan
+- Use the `list-artisan-commands` tool when you need to call an Artisan command to double check the available parameters.
+
+## URLs
+- Whenever you share a project URL with the user you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain / IP, and port.
+
+## Tinker / Debugging
+- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
+- Use the `database-query` tool when you only need to read from the database.
+
+## Reading Browser Logs With the `browser-logs` Tool
+- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
+- Only recent browser logs will be useful - ignore old logs.
+
+## Searching Documentation (Critically Important)
+- Boost comes with a powerful `search-docs` tool you should use before any other approaches. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation specific for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- The 'search-docs' tool is perfect for all Laravel related packages, including Laravel, Inertia, Livewire, Filament, Tailwind, Pest, Nova, Nightwatch, etc.
+- You must use this tool to search for Laravel-ecosystem documentation before falling back to other approaches.
+- Search the documentation before making code changes to ensure we are taking the correct approach.
+- Use multiple, broad, simple, topic based queries to start. For example: `['rate limiting', 'routing rate limiting', 'routing']`.
+- Do not add package names to queries - package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+
+### Available Search Syntax
+- You can and should pass multiple queries at once. The most relevant results will be returned first.
+
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit"
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - Words must be adjacent and in that order
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit"
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms
+
+
+=== php rules ===
+
+## PHP
+
+- Always use curly braces for control structures, even if it has one line.
+
+### Constructors
+- Use PHP 8 constructor property promotion in `__construct()`.
+    - <code-snippet>public function __construct(public GitHub $github) { }</code-snippet>
+- Do not allow empty `__construct()` methods with zero parameters.
+
+### Type Declarations
+- Always use explicit return type declarations for methods and functions.
+- Use appropriate PHP type hints for method parameters.
+
+<code-snippet name="Explicit Return Types and Method Params" lang="php">
+protected function isAccessible(User $user, ?string $path = null): bool
+{
+    ...
+}
+</code-snippet>
+
+## Comments
+- Prefer PHPDoc blocks over comments. Never use comments within the code itself unless there is something _very_ complex going on.
+
+## PHPDoc Blocks
+- Add useful array shape type definitions for arrays when appropriate.
+
+## Enums
+- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
+
+
+=== inertia-laravel/core rules ===
+
+## Inertia Core
+
+- Inertia.js components should be placed in the `resources/js/Pages` directory unless specified differently in the JS bundler (vite.config.js).
+- Use `Inertia::render()` for server-side routing instead of traditional Blade views.
+- Use `search-docs` for accurate guidance on all things Inertia.
+
+<code-snippet lang="php" name="Inertia::render Example">
+// routes/web.php example
+Route::get('/users', function () {
+    return Inertia::render('Users/Index', [
+        'users' => User::all()
+    ]);
+});
+</code-snippet>
+
+
+=== inertia-laravel/v2 rules ===
+
+## Inertia v2
+
+- Make use of all Inertia features from v1 & v2. Check the documentation before making any changes to ensure we are taking the correct approach.
+
+### Inertia v2 New Features
+- Polling
+- Prefetching
+- Deferred props
+- Infinite scrolling using merging props and `WhenVisible`
+- Lazy loading data on scroll
+
+### Deferred Props & Empty States
+- When using deferred props on the frontend, you should add a nice empty state with pulsing / animated skeleton.
+
+### Inertia Form General Guidance
+- Build forms using the `useForm` helper. Use the code examples and `search-docs` tool with a query of `useForm helper` for guidance.
+
+
+=== laravel/core rules ===
+
+## Do Things the Laravel Way
+
+- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
+- If you're creating a generic PHP class, use `artisan make:class`.
+- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
+
+### Database
+- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
+- Use Eloquent models and relationships before suggesting raw database queries
+- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
+- Generate code that prevents N+1 query problems by using eager loading.
+- Use Laravel's query builder for very complex database operations.
+
+### Model Creation
+- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
+
+### APIs & Eloquent Resources
+- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
+
+### Controllers & Validation
+- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
+- Check sibling Form Requests to see if the application uses array or string based validation rules.
+
+### Queues
+- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
+
+### Authentication & Authorization
+- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
+
+### URL Generation
+- When generating links to other pages, prefer named routes and the `route()` function.
+
+### Configuration
+- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
+
+### Testing
+- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
+- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
+- When creating tests, make use of `php artisan make:test [options] <name>` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
+
+### Vite Error
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+
+
+=== laravel/v12 rules ===
+
+## Laravel 12
+
+- Use the `search-docs` tool to get version specific documentation.
+- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
+
+### Laravel 12 Structure
+- No middleware files in `app/Http/Middleware/`.
+- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
+- `bootstrap/providers.php` contains application specific service providers.
+- **No app\Console\Kernel.php** - use `bootstrap/app.php` or `routes/console.php` for console configuration.
+- **Commands auto-register** - files in `app/Console/Commands/` are automatically available and do not require manual registration.
+
+### Database
+- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
+- Laravel 11 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
+
+### Models
+- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
+
+
+=== pint/core rules ===
+
+## Laravel Pint Code Formatter
+
+- You must run `vendor/bin/pint --dirty` before finalizing changes to ensure your code matches the project's expected style.
+- Do not run `vendor/bin/pint --test`, simply run `vendor/bin/pint` to fix any formatting issues.
+
+
+=== pest/core rules ===
+
+## Pest
+
+### Testing
+- If you need to verify a feature is working, write or update a Unit / Feature test.
+
+### Pest Tests
+- All tests must be written using Pest. Use `php artisan make:test --pest <name>`.
+- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files - these are core to the application.
+- Tests should test all of the happy paths, failure paths, and weird paths.
+- Tests live in the `tests/Feature` and `tests/Unit` directories.
+- Pest tests look and behave like this:
+<code-snippet name="Basic Pest Test Example" lang="php">
+it('is true', function () {
+    expect(true)->toBeTrue();
+});
+</code-snippet>
+
+### Running Tests
+- Run the minimal number of tests using an appropriate filter before finalizing code edits.
+- To run all tests: `php artisan test`.
+- To run all tests in a file: `php artisan test tests/Feature/ExampleTest.php`.
+- To filter on a particular test name: `php artisan test --filter=testName` (recommended after making a change to a related file).
+- When the tests relating to your changes are passing, ask the user if they would like to run the entire test suite to ensure everything is still passing.
+
+### Pest Assertions
+- When asserting status codes on a response, use the specific method like `assertForbidden` and `assertNotFound` instead of using `assertStatus(403)` or similar, e.g.:
+<code-snippet name="Pest Example Asserting postJson Response" lang="php">
+it('returns all', function () {
+    $response = $this->postJson('/api/docs', []);
+
+    $response->assertSuccessful();
+});
+</code-snippet>
+
+### Mocking
+- Mocking can be very helpful when appropriate.
+- When mocking, you can use the `Pest\Laravel\mock` Pest function, but always import it via `use function Pest\Laravel\mock;` before using it. Alternatively, you can use `$this->mock()` if existing tests do.
+- You can also create partial mocks using the same import or self method.
+
+### Datasets
+- Use datasets in Pest to simplify tests which have a lot of duplicated data. This is often the case when testing validation rules, so consider going with this solution when writing tests for validation rules.
+
+<code-snippet name="Pest Dataset Example" lang="php">
+it('has emails', function (string $email) {
+    expect($email)->not->toBeEmpty();
+})->with([
+    'james' => 'james@laravel.com',
+    'taylor' => 'taylor@laravel.com',
+]);
+</code-snippet>
+
+
+=== tests rules ===
+
+## Test Enforcement
+
+- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test` with a specific filename or filter.
+</laravel-boost-guidelines>

CLAUDE.md

@@ -0,0 +1,287 @@
+<laravel-boost-guidelines>
+=== foundation rules ===
+
+# Laravel Boost Guidelines
+
+The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to enhance the user's satisfaction building Laravel applications.
+
+## Foundational Context
+This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
+
+- php - 8.4.16
+- inertiajs/inertia-laravel (INERTIA) - v2
+- laravel/framework (LARAVEL) - v12
+- laravel/prompts (PROMPTS) - v0
+- tightenco/ziggy (ZIGGY) - v2
+- laravel/pint (PINT) - v1
+- laravel/sail (SAIL) - v1
+- pestphp/pest (PEST) - v3
+- phpunit/phpunit (PHPUNIT) - v11
+
+
+## Conventions
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, naming.
+- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
+- Check for existing components to reuse before writing a new one.
+
+## Verification Scripts
+- Do not create verification scripts or tinker when tests cover that functionality and prove it works. Unit and feature tests are more important.
+
+## Application Structure & Architecture
+- Stick to existing directory structure - don't create new base folders without approval.
+- Do not change the application's dependencies without approval.
+
+## Frontend Bundling
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+
+## Replies
+- Be concise in your explanations - focus on what's important rather than explaining obvious details.
+
+## Documentation Files
+- You must only create documentation files if explicitly requested by the user.
+
+
+=== boost rules ===
+
+## Laravel Boost
+- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
+
+## Artisan
+- Use the `list-artisan-commands` tool when you need to call an Artisan command to double check the available parameters.
+
+## URLs
+- Whenever you share a project URL with the user you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain / IP, and port.
+
+## Tinker / Debugging
+- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
+- Use the `database-query` tool when you only need to read from the database.
+
+## Reading Browser Logs With the `browser-logs` Tool
+- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
+- Only recent browser logs will be useful - ignore old logs.
+
+## Searching Documentation (Critically Important)
+- Boost comes with a powerful `search-docs` tool you should use before any other approaches. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation specific for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- The 'search-docs' tool is perfect for all Laravel related packages, including Laravel, Inertia, Livewire, Filament, Tailwind, Pest, Nova, Nightwatch, etc.
+- You must use this tool to search for Laravel-ecosystem documentation before falling back to other approaches.
+- Search the documentation before making code changes to ensure we are taking the correct approach.
+- Use multiple, broad, simple, topic based queries to start. For example: `['rate limiting', 'routing rate limiting', 'routing']`.
+- Do not add package names to queries - package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+
+### Available Search Syntax
+- You can and should pass multiple queries at once. The most relevant results will be returned first.
+
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit"
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - Words must be adjacent and in that order
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit"
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms
+
+
+=== php rules ===
+
+## PHP
+
+- Always use curly braces for control structures, even if it has one line.
+
+### Constructors
+- Use PHP 8 constructor property promotion in `__construct()`.
+    - <code-snippet>public function __construct(public GitHub $github) { }</code-snippet>
+- Do not allow empty `__construct()` methods with zero parameters.
+
+### Type Declarations
+- Always use explicit return type declarations for methods and functions.
+- Use appropriate PHP type hints for method parameters.
+
+<code-snippet name="Explicit Return Types and Method Params" lang="php">
+protected function isAccessible(User $user, ?string $path = null): bool
+{
+    ...
+}
+</code-snippet>
+
+## Comments
+- Prefer PHPDoc blocks over comments. Never use comments within the code itself unless there is something _very_ complex going on.
+
+## PHPDoc Blocks
+- Add useful array shape type definitions for arrays when appropriate.
+
+## Enums
+- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
+
+
+=== inertia-laravel/core rules ===
+
+## Inertia Core
+
+- Inertia.js components should be placed in the `resources/js/Pages` directory unless specified differently in the JS bundler (vite.config.js).
+- Use `Inertia::render()` for server-side routing instead of traditional Blade views.
+- Use `search-docs` for accurate guidance on all things Inertia.
+
+<code-snippet lang="php" name="Inertia::render Example">
+// routes/web.php example
+Route::get('/users', function () {
+    return Inertia::render('Users/Index', [
+        'users' => User::all()
+    ]);
+});
+</code-snippet>
+
+
+=== inertia-laravel/v2 rules ===
+
+## Inertia v2
+
+- Make use of all Inertia features from v1 & v2. Check the documentation before making any changes to ensure we are taking the correct approach.
+
+### Inertia v2 New Features
+- Polling
+- Prefetching
+- Deferred props
+- Infinite scrolling using merging props and `WhenVisible`
+- Lazy loading data on scroll
+
+### Deferred Props & Empty States
+- When using deferred props on the frontend, you should add a nice empty state with pulsing / animated skeleton.
+
+### Inertia Form General Guidance
+- Build forms using the `useForm` helper. Use the code examples and `search-docs` tool with a query of `useForm helper` for guidance.
+
+
+=== laravel/core rules ===
+
+## Do Things the Laravel Way
+
+- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
+- If you're creating a generic PHP class, use `artisan make:class`.
+- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
+
+### Database
+- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
+- Use Eloquent models and relationships before suggesting raw database queries
+- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
+- Generate code that prevents N+1 query problems by using eager loading.
+- Use Laravel's query builder for very complex database operations.
+
+### Model Creation
+- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
+
+### APIs & Eloquent Resources
+- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
+
+### Controllers & Validation
+- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
+- Check sibling Form Requests to see if the application uses array or string based validation rules.
+
+### Queues
+- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
+
+### Authentication & Authorization
+- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
+
+### URL Generation
+- When generating links to other pages, prefer named routes and the `route()` function.
+
+### Configuration
+- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
+
+### Testing
+- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
+- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
+- When creating tests, make use of `php artisan make:test [options] <name>` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
+
+### Vite Error
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+
+
+=== laravel/v12 rules ===
+
+## Laravel 12
+
+- Use the `search-docs` tool to get version specific documentation.
+- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
+
+### Laravel 12 Structure
+- No middleware files in `app/Http/Middleware/`.
+- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
+- `bootstrap/providers.php` contains application specific service providers.
+- **No app\Console\Kernel.php** - use `bootstrap/app.php` or `routes/console.php` for console configuration.
+- **Commands auto-register** - files in `app/Console/Commands/` are automatically available and do not require manual registration.
+
+### Database
+- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
+- Laravel 11 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
+
+### Models
+- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
+
+
+=== pint/core rules ===
+
+## Laravel Pint Code Formatter
+
+- You must run `vendor/bin/pint --dirty` before finalizing changes to ensure your code matches the project's expected style.
+- Do not run `vendor/bin/pint --test`, simply run `vendor/bin/pint` to fix any formatting issues.
+
+
+=== pest/core rules ===
+
+## Pest
+
+### Testing
+- If you need to verify a feature is working, write or update a Unit / Feature test.
+
+### Pest Tests
+- All tests must be written using Pest. Use `php artisan make:test --pest <name>`.
+- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files - these are core to the application.
+- Tests should test all of the happy paths, failure paths, and weird paths.
+- Tests live in the `tests/Feature` and `tests/Unit` directories.
+- Pest tests look and behave like this:
+<code-snippet name="Basic Pest Test Example" lang="php">
+it('is true', function () {
+    expect(true)->toBeTrue();
+});
+</code-snippet>
+
+### Running Tests
+- Run the minimal number of tests using an appropriate filter before finalizing code edits.
+- To run all tests: `php artisan test`.
+- To run all tests in a file: `php artisan test tests/Feature/ExampleTest.php`.
+- To filter on a particular test name: `php artisan test --filter=testName` (recommended after making a change to a related file).
+- When the tests relating to your changes are passing, ask the user if they would like to run the entire test suite to ensure everything is still passing.
+
+### Pest Assertions
+- When asserting status codes on a response, use the specific method like `assertForbidden` and `assertNotFound` instead of using `assertStatus(403)` or similar, e.g.:
+<code-snippet name="Pest Example Asserting postJson Response" lang="php">
+it('returns all', function () {
+    $response = $this->postJson('/api/docs', []);
+
+    $response->assertSuccessful();
+});
+</code-snippet>
+
+### Mocking
+- Mocking can be very helpful when appropriate.
+- When mocking, you can use the `Pest\Laravel\mock` Pest function, but always import it via `use function Pest\Laravel\mock;` before using it. Alternatively, you can use `$this->mock()` if existing tests do.
+- You can also create partial mocks using the same import or self method.
+
+### Datasets
+- Use datasets in Pest to simplify tests which have a lot of duplicated data. This is often the case when testing validation rules, so consider going with this solution when writing tests for validation rules.
+
+<code-snippet name="Pest Dataset Example" lang="php">
+it('has emails', function (string $email) {
+    expect($email)->not->toBeEmpty();
+})->with([
+    'james' => 'james@laravel.com',
+    'taylor' => 'taylor@laravel.com',
+]);
+</code-snippet>
+
+
+=== tests rules ===
+
+## Test Enforcement
+
+- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test` with a specific filename or filter.
+</laravel-boost-guidelines>

app/Actions/Applications/CreateLaravelEnvironment.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Actions\Applications;
+
+use App\Enums\DeployPolicy;
+use App\Enums\SchedulerMode;
+use App\Enums\ServiceCategory;
+use App\Enums\ServiceStatus;
+use App\Enums\ServiceType;
+use App\Models\Application;
+use App\Models\Environment;
+
+class CreateLaravelEnvironment
+{
+    public function execute(
+        Application $application,
+        string $name,
+        ?string $branch = null,
+        string $phpVersion = '8.4',
+    ): Environment {
+        $environment = $application->environments()->create([
+            'name' => $name,
+            'branch' => $branch ?? $application->default_branch,
+            'status' => 'pending',
+            'scheduler_enabled' => true,
+            'scheduler_mode' => SchedulerMode::SINGLE,
+            'build_config' => [
+                'php_version' => $phpVersion,
+                'document_root' => 'public',
+                'health_path' => '/up',
+                'js_build_command' => null,
+                'js_package_manager' => 'bun',
+            ],
+        ]);
+
+        $web = $environment->services()->create([
+            'organisation_id' => $application->organisation_id,
+            'name' => 'web',
+            'category' => ServiceCategory::APPLICATION,
+            'type' => ServiceType::LARAVEL,
+            'version' => "php-{$phpVersion}",
+            'version_track' => "php-{$phpVersion}",
+            'driver_name' => "laravel.php-{$phpVersion}",
+            'status' => ServiceStatus::NOT_INSTALLED,
+            'desired_replicas' => 1,
+            'deploy_policy' => DeployPolicy::WITH_ENVIRONMENT,
+            'process_roles' => ['web', 'scheduler'],
+            'config' => [
+                'migration_mode' => 'auto',
+                'migration_timing' => 'pre_switch',
+                'migration_command' => 'php artisan migrate --force',
+                'document_root' => 'public',
+                'health_path' => '/up',
+                'js_build_command' => null,
+                'js_package_manager' => 'bun',
+            ],
+        ]);
+
+        $environment->forceFill([
+            'scheduler_target_service_id' => $web->id,
+        ])->save();
+
+        return $environment->refresh();
+    }
+}

app/Actions/Applications/GenerateDeployKey.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Actions\Applications;
+
+use App\Models\Application;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+use RuntimeException;
+use Throwable;
+
+class GenerateDeployKey
+{
+    /**
+     * @param  array{public: string, private: string, fingerprint?: string}|null  $keyPair
+     */
+    public function execute(Application $application, ?array $keyPair = null): Application
+    {
+        $keyPair ??= $this->generateWithSshKeygen($application);
+
+        $application->forceFill([
+            'deploy_key_public' => $keyPair['public'],
+            'deploy_key_private' => $keyPair['private'],
+            'deploy_key_fingerprint' => $keyPair['fingerprint'] ?? $this->fingerprint($keyPair['public']),
+            'deploy_key_installed_at' => null,
+        ])->save();
+
+        return $application->refresh();
+    }
+
+    /**
+     * @return array{public: string, private: string, fingerprint: string}
+     */
+    private function generateWithSshKeygen(Application $application): array
+    {
+        $directory = storage_path('app/private/deploy-keys/'.str()->uuid()->toString());
+        $privateKeyPath = $directory.'/id_ed25519';
+
+        File::ensureDirectoryExists($directory, 0700);
+
+        try {
+            $result = Process::run([
+                'ssh-keygen',
+                '-t',
+                'ed25519',
+                '-C',
+                "keystone-application-{$application->id}",
+                '-N',
+                '',
+                '-f',
+                $privateKeyPath,
+            ]);
+
+            if ($result->failed()) {
+                throw new RuntimeException('Unable to generate deploy key: '.$result->errorOutput());
+            }
+
+            return [
+                'public' => trim(File::get($privateKeyPath.'.pub')),
+                'private' => trim(File::get($privateKeyPath)),
+                'fingerprint' => $this->fingerprint(trim(File::get($privateKeyPath.'.pub'))),
+            ];
+        } finally {
+            rescue(fn () => File::deleteDirectory($directory), report: false);
+        }
+    }
+
+    private function fingerprint(string $publicKey): string
+    {
+        try {
+            $parts = explode(' ', trim($publicKey));
+            $keyMaterial = $parts[1] ?? $publicKey;
+
+            return 'SHA256:'.rtrim(strtr(base64_encode(hash('sha256', base64_decode($keyMaterial, true) ?: $publicKey, true)), '+/', '-_'), '=');
+        } catch (Throwable) {
+            return 'SHA256:'.hash('sha256', $publicKey);
+        }
+    }
+}

app/Actions/Applications/VerifyRepositoryAccess.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Actions\Applications;
+
+use App\Models\Application;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+use RuntimeException;
+
+class VerifyRepositoryAccess
+{
+    public function execute(Application $application): bool
+    {
+        if (! $application->deploy_key_private) {
+            throw new RuntimeException('Application does not have a deploy key.');
+        }
+
+        $directory = storage_path('app/private/operations/repository-access-'.$application->id.'-'.str()->random(8));
+        $keyPath = $directory.'/deploy_key';
+
+        File::ensureDirectoryExists($directory, 0700);
+        File::put($keyPath, $application->deploy_key_private);
+        File::chmod($keyPath, 0600);
+
+        try {
+            $result = Process::path($directory)
+                ->env([
+                    'GIT_SSH_COMMAND' => 'ssh -i '.$keyPath.' -o IdentitiesOnly=yes -o StrictHostKeyChecking=no',
+                ])
+                ->run([
+                    'git',
+                    'ls-remote',
+                    '--heads',
+                    $application->repository_url,
+                    $application->default_branch,
+                ]);
+
+            if ($result->successful()) {
+                $application->forceFill([
+                    'deploy_key_installed_at' => now(),
+                ])->save();
+
+                return true;
+            }
+
+            return false;
+        } finally {
+            rescue(fn () => File::deleteDirectory($directory), report: false);
+        }
+    }
+}

app/Actions/Environments/AttachManagedService.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Drivers\Concerns\SupportsSlices;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\EnvironmentVariableSource;
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
+use App\Enums\ServiceType;
+use App\Models\Environment;
+use App\Models\EnvironmentAttachment;
+use App\Models\Service;
+use App\Models\ServiceSlice;
+use Illuminate\Support\Str;
+use InvalidArgumentException;
+
+class AttachManagedService
+{
+    public function execute(
+        Environment $environment,
+        Service $service,
+        EnvironmentAttachmentRole $role,
+        ?string $name = null,
+        ?string $envPrefix = null,
+        bool $isPrimary = true,
+    ): EnvironmentAttachment {
+        $slice = $this->createDefaultSlice($environment, $service, $role, $name);
+
+        $attachment = $environment->attachments()->create([
+            'service_id' => $service->id,
+            'service_slice_id' => $slice?->id,
+            'role' => $role,
+            'env_prefix' => $envPrefix,
+            'is_primary' => $isPrimary,
+        ]);
+
+        $this->syncManagedVariables($environment, $service, $slice, $envPrefix, $role);
+        $this->createSliceProvisionOperation($service, $slice);
+
+        return $attachment;
+    }
+
+    private function createDefaultSlice(
+        Environment $environment,
+        Service $service,
+        EnvironmentAttachmentRole $role,
+        ?string $name,
+    ): ?ServiceSlice {
+        return match ($service->type) {
+            ServiceType::POSTGRES => $service->slices()->firstOrCreate([
+                'environment_id' => $environment->id,
+                'type' => 'database_user',
+                'name' => $name ?? $this->sliceName($environment),
+            ], [
+                'status' => 'pending',
+                'config' => [],
+                'credentials' => [
+                    'database' => $name ?? $this->sliceName($environment),
+                    'username' => $name ?? $this->sliceName($environment),
+                    'password' => Str::password(32),
+                ],
+            ]),
+            ServiceType::VALKEY => $service->slices()->firstOrCreate([
+                'environment_id' => $environment->id,
+                'type' => 'logical_database',
+                'name' => $name ?? $this->sliceName($environment),
+            ], [
+                'status' => 'pending',
+                'config' => [
+                    'database' => $this->nextValkeyDatabase($service),
+                ],
+            ]),
+            ServiceType::CADDY => $service->slices()->firstOrCreate([
+                'environment_id' => $environment->id,
+                'type' => 'route',
+                'name' => $name ?? $environment->name,
+            ], [
+                'status' => 'pending',
+                'config' => [],
+            ]),
+            default => $role === EnvironmentAttachmentRole::CUSTOM ? null : throw new InvalidArgumentException("Service [{$service->type->value}] does not support managed attachments."),
+        };
+    }
+
+    private function syncManagedVariables(Environment $environment, Service $service, ?ServiceSlice $slice, ?string $envPrefix, EnvironmentAttachmentRole $role): void
+    {
+        if (! $slice) {
+            return;
+        }
+
+        $driver = $service->driver();
+
+        if (! $driver instanceof SupportsSlices) {
+            return;
+        }
+
+        foreach ($driver->environmentExportsForSlice($slice, $role) as $key => $value) {
+            $environment->variables()->updateOrCreate([
+                'key' => $this->variableKey($key, $envPrefix),
+            ], [
+                'value' => $value,
+                'source' => EnvironmentVariableSource::MANAGED_ATTACHMENT,
+                'service_slice_id' => $slice->id,
+                'overridable' => false,
+            ]);
+        }
+    }
+
+    private function createSliceProvisionOperation(Service $service, ?ServiceSlice $slice): void
+    {
+        if (! $slice || ! $slice->wasRecentlyCreated) {
+            return;
+        }
+
+        $driver = $service->driver();
+
+        if (! $driver instanceof SupportsSlices) {
+            return;
+        }
+
+        $operation = $slice->operations()->create([
+            'kind' => OperationKind::SLICE_PROVISION,
+            'status' => OperationStatus::PENDING,
+        ]);
+
+        $operation->steps()->create([
+            'name' => 'Provision '.$service->type->value.' slice',
+            'order' => 1,
+            'status' => OperationStatus::PENDING,
+            'script' => $driver->provisionSliceScript($slice),
+        ]);
+    }
+
+    private function nextValkeyDatabase(Service $service): int
+    {
+        return ((int) $service->slices()
+            ->where('type', 'logical_database')
+            ->get()
+            ->max(fn (ServiceSlice $slice): int => (int) ($slice->config['database'] ?? 0))) + 1;
+    }
+
+    private function sliceName(Environment $environment): string
+    {
+        return str($environment->application->name.' '.$environment->name)->slug('_')->value();
+    }
+
+    private function variableKey(string $key, ?string $envPrefix): string
+    {
+        return $envPrefix ? $envPrefix.'_'.$key : $key;
+    }
+}

app/Actions/Environments/BuildApplicationArtifact.php

@@ -0,0 +1,192 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Enums\BuildArtifactStatus;
+use App\Enums\BuildStrategy;
+use App\Models\BuildArtifact;
+use App\Models\Operation;
+use App\Models\Server;
+use App\Models\Service;
+use App\Services\Operations\RemoteCommandRunner;
+use RuntimeException;
+
+class BuildApplicationArtifact
+{
+    public function __construct(
+        private readonly RemoteCommandRunner $remoteCommandRunner,
+    ) {}
+
+    public function execute(BuildArtifact $artifact, ?Operation $operation = null): BuildArtifact
+    {
+        $artifact->loadMissing('environment.application', 'builtByService.server', 'builtByService.replicas.server');
+
+        $application = $artifact->environment->application;
+        $strategy = BuildStrategy::tryFrom($artifact->metadata['build_strategy'] ?? BuildStrategy::TARGET_SERVER->value)
+            ?? BuildStrategy::TARGET_SERVER;
+
+        $server = $this->buildServer($artifact);
+
+        $artifact->update([
+            'status' => BuildArtifactStatus::BUILDING,
+            'built_by_operation_id' => $operation?->id,
+        ]);
+
+        try {
+            $output = $this->remoteCommandRunner->run(
+                $server,
+                $strategy === BuildStrategy::EXTERNAL_REGISTRY
+                    ? $this->manifestDigestScript($artifact)
+                    : $this->buildScript($artifact, $strategy)
+            );
+
+            $artifact->update([
+                'image_digest' => $this->digestFromOutput($output),
+                'status' => BuildArtifactStatus::AVAILABLE,
+            ]);
+
+            return $artifact->refresh();
+        } catch (\Throwable $exception) {
+            $artifact->update([
+                'status' => BuildArtifactStatus::FAILED,
+                'metadata' => [
+                    ...($artifact->metadata ?? []),
+                    'error' => $exception->getMessage(),
+                ],
+            ]);
+
+            throw $exception;
+        }
+    }
+
+    private function buildServer(BuildArtifact $artifact): Server
+    {
+        if ($artifact->builtByService instanceof Service) {
+            $server = $artifact->builtByService->replicas->first()?->server ?: $artifact->builtByService->server;
+
+            if ($server instanceof Server) {
+                return $server;
+            }
+        }
+
+        if (($artifact->metadata['build_strategy'] ?? null) === BuildStrategy::DEDICATED_BUILDER->value) {
+            throw new RuntimeException('Dedicated builder strategy requires a builder service.');
+        }
+
+        $services = $artifact->environment->services()
+            ->with(['server', 'replicas.server'])
+            ->get();
+
+        $server = $services
+            ->flatMap(fn (Service $service) => $service->replicas->pluck('server')->filter())
+            ->first() ?: $services->pluck('server')->filter()->first();
+
+        if (! $server instanceof Server) {
+            $serverId = $services
+                ->flatMap(fn (Service $service) => collect($service->config['server_ids'] ?? []))
+                ->filter()
+                ->first();
+
+            $server = $serverId ? Server::find($serverId) : null;
+        }
+
+        if (! $server instanceof Server) {
+            throw new RuntimeException('A target server is required to build this artifact over SSH.');
+        }
+
+        return $server;
+    }
+
+    private function buildScript(BuildArtifact $artifact, BuildStrategy $strategy): string
+    {
+        $application = $artifact->environment->application;
+
+        if (! $application->deploy_key_private) {
+            throw new RuntimeException('Application does not have a deploy key.');
+        }
+
+        $operationDirectory = '/home/keystone/operations/build-'.$artifact->id.'-'.str()->random(8);
+        $imageReference = $artifact->registry_ref ?: $artifact->image_tag;
+        $pushCommand = $strategy === BuildStrategy::DEDICATED_BUILDER && $artifact->registry_ref
+            ? "\ndocker push ".escapeshellarg($imageReference)
+            : '';
+
+        return implode("\n", [
+            'set -euo pipefail',
+            'operation_dir='.escapeshellarg($operationDirectory),
+            'source_dir="$operation_dir/source"',
+            'rm -rf "$operation_dir"',
+            'mkdir -p "$operation_dir"',
+            'chmod 700 "$operation_dir"',
+            'cleanup() { rm -rf "$operation_dir"; }',
+            'trap cleanup EXIT',
+            $this->writeFileCommand('$operation_dir/deploy_key', $application->deploy_key_private),
+            'chmod 600 "$operation_dir/deploy_key"',
+            'export GIT_SSH_COMMAND="ssh -i $operation_dir/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"',
+            'git clone --depth 1 --branch '.escapeshellarg($artifact->environment->branch).' '.escapeshellarg($application->repository_url).' "$source_dir"',
+            $this->writeFileCommand('$source_dir/Dockerfile.keystone', $this->dockerfile($artifact)),
+            'cd "$source_dir"',
+            'docker build --file Dockerfile.keystone --tag '.escapeshellarg($imageReference).' .'.$pushCommand,
+            'digest=$(docker image inspect --format '.escapeshellarg('{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}{{.Id}}{{end}}').' '.escapeshellarg($imageReference).')',
+            'printf "image_digest=%s\n" "$digest"',
+        ]);
+    }
+
+    private function manifestDigestScript(BuildArtifact $artifact): string
+    {
+        $imageReference = $artifact->registry_ref ?: $artifact->image_tag;
+
+        return implode("\n", [
+            'set -euo pipefail',
+            'manifest=$(docker manifest inspect '.escapeshellarg($imageReference).')',
+            'digest=$(printf "%s" "$manifest" | sed -n '.escapeshellarg('s/.*"digest": "\(sha256:[^"]*\)".*/\1/p').' | head -n 1)',
+            'test -n "$digest"',
+            'printf "image_digest=%s\n" "$digest"',
+        ]);
+    }
+
+    private function dockerfile(BuildArtifact $artifact): string
+    {
+        $service = $artifact->environment->services()
+            ->where('type', \App\Enums\ServiceType::LARAVEL)
+            ->first();
+
+        if ($service && method_exists($service->driver(), 'dockerfileTemplate')) {
+            return $service->driver()->dockerfileTemplate();
+        }
+
+        return <<<'DOCKERFILE'
+FROM serversideup/php:8.4-frankenphp
+WORKDIR /var/www/html
+COPY --chown=www-data:www-data . .
+RUN composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+ENV SERVER_DOCUMENT_ROOT=/var/www/html/public
+DOCKERFILE;
+    }
+
+    private function writeFileCommand(string $path, string $contents): string
+    {
+        return implode("\n", [
+            'cat > '.$path." <<'KEYSTONE_FILE'",
+            rtrim($contents),
+            'KEYSTONE_FILE',
+        ]);
+    }
+
+    private function digestFromOutput(string $output): string
+    {
+        if (preg_match('/image_digest=(?<digest>\S+)/', $output, $matches)) {
+            return $this->digestFromOutput($matches['digest']);
+        }
+
+        if (str_contains($output, '@')) {
+            return str($output)->after('@')->trim()->value();
+        }
+
+        if (str_starts_with($output, 'sha256:')) {
+            return $output;
+        }
+
+        throw new RuntimeException('Unable to resolve built image digest.');
+    }
+}

app/Actions/Environments/BuildMigrationScript.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Models\Service;
+
+class BuildMigrationScript
+{
+    public function execute(Service $service, bool $respectAutomaticMode = true): string
+    {
+        if ($respectAutomaticMode && in_array($service->config['migration_mode'] ?? 'auto', ['disabled', 'manual'], true)) {
+            return 'true';
+        }
+
+        $command = $service->config['migration_command'] ?? 'php artisan migrate --force';
+        $serviceKey = str($service->name)->slug('_')->value() ?: 'service';
+
+        return "docker compose -f /home/keystone/services/{$service->id}/compose.yml run --rm {$serviceKey} {$command}";
+    }
+}

app/Actions/Environments/CreateLaravelWorkerService.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Enums\DeployPolicy;
+use App\Enums\ServiceCategory;
+use App\Enums\ServiceStatus;
+use App\Enums\ServiceType;
+use App\Models\Environment;
+use App\Models\Service;
+
+class CreateLaravelWorkerService
+{
+    public function execute(Environment $environment): Service
+    {
+        $environment->loadMissing('application');
+
+        $phpVersion = $environment->build_config['php_version'] ?? '8.4';
+
+        return $environment->services()->firstOrCreate([
+            'name' => 'worker',
+            'type' => ServiceType::LARAVEL,
+        ], [
+            'organisation_id' => $environment->application->organisation_id,
+            'category' => ServiceCategory::APPLICATION,
+            'version' => "php-{$phpVersion}",
+            'version_track' => "php-{$phpVersion}",
+            'driver_name' => "laravel.php-{$phpVersion}",
+            'status' => ServiceStatus::NOT_INSTALLED,
+            'desired_replicas' => 1,
+            'deploy_policy' => DeployPolicy::WITH_ENVIRONMENT,
+            'process_roles' => ['worker'],
+            'config' => [
+                'command' => 'php artisan queue:work --sleep=3 --tries=3',
+                'health_path' => null,
+                'migration_mode' => 'disabled',
+            ],
+        ]);
+    }
+}

app/Actions/Environments/CreateMigrationOperation.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
+use App\Enums\ServiceType;
+use App\Models\Environment;
+use App\Models\Operation;
+use App\Models\Service;
+use InvalidArgumentException;
+
+class CreateMigrationOperation
+{
+    public function __construct(
+        private readonly BuildMigrationScript $buildMigrationScript,
+    ) {}
+
+    public function execute(Environment $environment, ?Service $service = null): Operation
+    {
+        $service ??= $environment->services()
+            ->where('type', ServiceType::LARAVEL)
+            ->get()
+            ->first(fn (Service $service): bool => in_array('web', $service->process_roles ?? [], true));
+
+        if (! $service || $service->type !== ServiceType::LARAVEL) {
+            throw new InvalidArgumentException('Laravel migrations must run against a Laravel runtime service.');
+        }
+
+        $operation = $service->operations()->create([
+            'kind' => OperationKind::CONFIG_CHANGE,
+            'status' => OperationStatus::PENDING,
+        ]);
+
+        $operation->steps()->create([
+            'name' => 'Run Laravel migrations',
+            'order' => 1,
+            'status' => OperationStatus::PENDING,
+            'script' => $this->buildMigrationScript->execute($service, respectAutomaticMode: false),
+        ]);
+
+        return $operation;
+    }
+}

app/Actions/Environments/PlanBuildArtifact.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Enums\BuildArtifactStatus;
+use App\Enums\BuildStrategy;
+use App\Enums\ServiceCategory;
+use App\Models\BuildArtifact;
+use App\Models\Environment;
+use RuntimeException;
+
+class PlanBuildArtifact
+{
+    public function execute(Environment $environment, string $commitSha): BuildArtifact
+    {
+        $environment->loadMissing(['application.organisation.registries', 'services.replicas']);
+
+        $existingArtifact = $environment->buildArtifacts()
+            ->where('commit_sha', $commitSha)
+            ->whereIn('status', [BuildArtifactStatus::PENDING, BuildArtifactStatus::BUILDING, BuildArtifactStatus::AVAILABLE])
+            ->latest()
+            ->first();
+
+        if ($existingArtifact) {
+            return $existingArtifact;
+        }
+
+        $targetServerCount = $this->targetServerCount($environment);
+        $registry = $environment->application->organisation->registries()->first();
+
+        if ($targetServerCount > 1 && ! $registry) {
+            throw new RuntimeException('A registry is required before building artifacts for multi-server deployments.');
+        }
+
+        $builder = $environment->application->organisation->services()
+            ->where('category', ServiceCategory::BUILDER)
+            ->first();
+
+        $strategy = match (true) {
+            $registry !== null => BuildStrategy::EXTERNAL_REGISTRY,
+            $builder !== null => BuildStrategy::DEDICATED_BUILDER,
+            default => BuildStrategy::TARGET_SERVER,
+        };
+
+        $imageTag = str($environment->application->name)
+            ->slug()
+            ->append(':'.substr($commitSha, 0, 12))
+            ->value();
+
+        return $environment->buildArtifacts()->create([
+            'commit_sha' => $commitSha,
+            'image_tag' => $imageTag,
+            'registry_ref' => $registry ? rtrim((string) $registry->url, '/').'/'.$imageTag : null,
+            'built_by_service_id' => $builder?->id,
+            'status' => BuildArtifactStatus::PENDING,
+            'metadata' => [
+                'build_strategy' => $strategy->value,
+                'target_server_count' => $targetServerCount,
+            ],
+        ]);
+    }
+
+    private function targetServerCount(Environment $environment): int
+    {
+        $replicaServerCount = $environment->services
+            ->flatMap(fn ($service) => $service->replicas->pluck('server_id')->filter())
+            ->unique()
+            ->count();
+
+        if ($replicaServerCount > 0) {
+            return $replicaServerCount;
+        }
+
+        return $environment->services->sum('desired_replicas') > 1 ? 2 : 1;
+    }
+}

app/Actions/Environments/PlanEnvironmentDeployment.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Data\Environments\EnvironmentDeploymentPlan;
+use App\Enums\DeployPolicy;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\SchedulerMode;
+use App\Models\Environment;
+
+class PlanEnvironmentDeployment
+{
+    public function execute(Environment $environment): EnvironmentDeploymentPlan
+    {
+        $environment->loadMissing([
+            'services',
+            'attachments.service',
+            'attachments.serviceSlice',
+        ]);
+
+        $deployableServices = $environment->services
+            ->where('deploy_policy', DeployPolicy::WITH_ENVIRONMENT)
+            ->values();
+
+        $dependencies = $environment->attachments
+            ->map(fn ($attachment) => $attachment->service)
+            ->filter()
+            ->unique('id')
+            ->values();
+
+        $targetServerCount = $deployableServices
+            ->flatMap(fn ($service) => $service->replicas->pluck('server_id')->filter())
+            ->unique()
+            ->count();
+
+        if ($targetServerCount === 0) {
+            $targetServerCount = $deployableServices->sum('desired_replicas') > 1 ? 2 : 1;
+        }
+
+        return new EnvironmentDeploymentPlan(
+            services: $deployableServices->all(),
+            dependencies: $dependencies->all(),
+            requiresRegistry: $targetServerCount > 1 && $environment->application->organisation->registries()->doesntExist(),
+            warnings: $this->warnings($environment),
+            blockers: $this->blockers($environment),
+        );
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function warnings(Environment $environment): array
+    {
+        $warnings = [];
+
+        if ($environment->variables()
+            ->where('key', 'QUEUE_CONNECTION')
+            ->get()
+            ->contains(fn ($variable) => $variable->value === 'sync')) {
+            $warnings[] = 'QUEUE_CONNECTION=sync is not recommended for deployed Laravel environments.';
+        }
+
+        if ($environment->attachments->contains('role', EnvironmentAttachmentRole::QUEUE)) {
+            $hasWorker = $environment->services->contains(fn ($service) => in_array('worker', $service->process_roles ?? [], true));
+
+            if (! $hasWorker) {
+                $warnings[] = 'Queue attachment exists without a dedicated worker service.';
+            }
+        }
+
+        return $warnings;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function blockers(Environment $environment): array
+    {
+        if (! $environment->scheduler_enabled || $environment->scheduler_mode !== SchedulerMode::SINGLE) {
+            return [];
+        }
+
+        $target = $environment->services->firstWhere('id', $environment->scheduler_target_service_id);
+
+        if ($target && $target->desired_replicas > 1 && in_array('scheduler', $target->process_roles ?? [], true)) {
+            return ['Scheduler mode single requires the scheduler target service to run exactly one replica.'];
+        }
+
+        return [];
+    }
+}

app/Actions/Environments/ResolveEnvironmentCommit.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Actions\Environments;
+
+use App\Models\Environment;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+use RuntimeException;
+
+class ResolveEnvironmentCommit
+{
+    public function execute(Environment $environment): string
+    {
+        $environment->loadMissing('application');
+
+        $application = $environment->application;
+
+        if (! $application->deploy_key_private) {
+            throw new RuntimeException('Application does not have a deploy key.');
+        }
+
+        $directory = storage_path('app/private/operations/resolve-'.$environment->id.'-'.str()->random(8));
+        $keyPath = $directory.'/deploy_key';
+
+        File::ensureDirectoryExists($directory, 0700);
+        File::put($keyPath, $application->deploy_key_private);
+        File::chmod($keyPath, 0600);
+
+        try {
+            $result = Process::path($directory)
+                ->env([
+                    'GIT_SSH_COMMAND' => 'ssh -i '.$keyPath.' -o IdentitiesOnly=yes -o StrictHostKeyChecking=no',
+                ])
+                ->run([
+                    'git',
+                    'ls-remote',
+                    $application->repository_url,
+                    'refs/heads/'.$environment->branch,
+                ]);
+
+            if ($result->failed()) {
+                throw new RuntimeException(trim($result->errorOutput()) ?: 'Unable to resolve environment commit.');
+            }
+
+            return $this->commitFromOutput($result->output(), $environment->branch);
+        } finally {
+            rescue(fn () => File::deleteDirectory($directory), report: false);
+        }
+    }
+
+    private function commitFromOutput(string $output, string $branch): string
+    {
+        $commit = str($output)->before("\t")->trim()->value();
+
+        if (preg_match('/^[a-f0-9]{40}$/i', $commit) !== 1) {
+            throw new RuntimeException("Unable to resolve commit for branch {$branch}.");
+        }
+
+        return strtolower($commit);
+    }
+}

app/Actions/Servers/SyncUfwRules.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Actions\Servers;
+
+use App\Models\Server;
+use Spatie\QueueableAction\QueueableAction;
+
+class SyncUfwRules
+{
+    use QueueableAction;
+
+    public function execute(
+        Server $server,
+    ) {
+        $ssh = $server->sshClient();
+        $result = $ssh->execute('wg show wg0');
+
+        if (! $result->isSuccessful()) {
+            logger()->error('Failed to retrieve WireGuard rules', [
+                'server_id' => $server->id,
+                'error' => $result->getErrorOutput(),
+            ]);
+            throw new \Exception('Failed to retrieve WireGuard rules');
+        }
+    }
+}

app/Actions/Servers/SyncWireguardRules.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Actions\Servers;
-
-use App\Models\Server;
-use Illuminate\Support\Str;
-use Spatie\QueueableAction\QueueableAction;
-
-class SyncWireguardRules
-{
-    use QueueableAction;
-
-    public function execute(
-        Server $server,
-    ) {
-        $ssh = $server->sshClient();
-        $result = $ssh->execute('wg show wg0');
-
-        if (! $result->isSuccessful()) {
-            logger()->error('Failed to retrieve WireGuard rules', [
-                'server_id' => $server->id,
-                'error' => $result->getErrorOutput(),
-            ]);
-            throw new \Exception('Failed to retrieve WireGuard rules');
-        }
-
-        $output = $result->getOutput();
-        $commands = collect();
-
-        $server->organisation->servers()->where('id', '!=', $server->id)->each(function ($organisationServer) use (&$commands, $output, $server) {
-            if (Str::contains($output, $organisationServer->internal_public_key)) {
-                $commands->push("wg set wg0 peer {$organisationServer->internal_public_key} remove");
-            }
-
-            if ($organisationServer->external_network_id === $server->external_network_id) {
-                $commands->push("wg set wg0 peer {$organisationServer->internal_public_key} allowed-ips {$organisationServer->internal_ip}/32");
-            } else {
-                $commands->push("wg set wg0 peer {$organisationServer->internal_public_key} allowed-ips {$organisationServer->ipv4}/32,{$organisationServer->ipv6}/128");
-            }
-        });
-
-        $result = $ssh->execute($commands->toArray());
-
-        if (! $result->isSuccessful()) {
-            logger()->error('Failed to sync WireGuard rules', [
-                'server_id' => $server->id,
-                'error' => $result->getErrorOutput(),
-            ]);
-            throw new \Exception('Failed to sync WireGuard rules');
-        }
-
-        logger()->info('Successfully synced WireGuard rules', [
-            'server_id' => $server->id,
-            'commands' => $commands->toArray(),
-            'output' => $result->getOutput(),
-        ]);
-    }
-}

app/Actions/Services/CreateService.php

@@ -2,11 +2,14 @@
 
 namespace App\Actions\Services;
 
+use App\Enums\DeployPolicy;
 use App\Enums\ServiceCategory;
 use App\Enums\ServiceStatus;
 use App\Enums\ServiceType;
 use App\Jobs\Services\DeployService;
 use App\Models\Server;
+use App\Models\Service;
+use RuntimeException;
 
 class CreateService
 {
@@ -16,15 +19,25 @@ class CreateService
         ServiceCategory $category,
         ServiceType $type,
         string $version,
-    ) {
+    ): Service {
+        if ($category === ServiceCategory::GATEWAY && $server->services()->where('category', ServiceCategory::GATEWAY)->exists()) {
+            throw new RuntimeException('This server already has a gateway service.');
+        }
+
         $driverName = "{$type->value}.{$version}";
         $service = $server->services()->create([
+            'organisation_id' => $server->organisation_id,
             'name' => $name,
             'category' => $category,
-            'type' => $type, // postgres
-            'version' => $version, // 17
-            'driver_name' => $driverName, // postgres.17
+            'type' => $type,
+            'version' => $version,
+            'version_track' => $version,
+            'driver_name' => $driverName,
             'status' => ServiceStatus::NOT_INSTALLED,
+            'deploy_policy' => $this->defaultDeployPolicy($category, $type),
+            'process_roles' => [],
+            'desired_replicas' => 1,
+            'config' => [],
         ]);
 
         if (method_exists($service->driver(), 'defaultCredentials')) {
@@ -32,8 +45,40 @@ class CreateService
             $service->save();
         }
 
+        $service->replicas()->create([
+            'server_id' => $server->id,
+            'container_name' => "keystone-service-{$service->id}-1",
+            'internal_host' => "keystone-service-{$service->id}",
+            'internal_port' => $this->defaultInternalPort($type),
+            'status' => 'pending',
+            'health_status' => 'unknown',
+            'config' => [],
+        ]);
+
         dispatch(new DeployService($service));
 
         return $service;
     }
+
+    private function defaultDeployPolicy(ServiceCategory $category, ServiceType $type): DeployPolicy
+    {
+        return match (true) {
+            $category === ServiceCategory::APPLICATION => DeployPolicy::WITH_ENVIRONMENT,
+            $category === ServiceCategory::DATABASE,
+            $category === ServiceCategory::CACHE,
+            $category === ServiceCategory::STORAGE => DeployPolicy::DEPENDENCY_ONLY,
+            $category === ServiceCategory::GATEWAY => DeployPolicy::MANUAL_OR_ON_ROUTE_CHANGE,
+            default => DeployPolicy::MANUAL,
+        };
+    }
+
+    private function defaultInternalPort(ServiceType $type): int
+    {
+        return match ($type) {
+            ServiceType::POSTGRES => 5432,
+            ServiceType::VALKEY => 6379,
+            ServiceType::CADDY,
+            ServiceType::LARAVEL => 80,
+        };
+    }
 }

app/Actions/Services/CreateStatefulServiceUpdateOperation.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace App\Actions\Services;
+
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
+use App\Enums\ServiceType;
+use App\Models\Operation;
+use App\Models\Service;
+use App\Services\Compose\ComposeRenderer;
+use InvalidArgumentException;
+
+class CreateStatefulServiceUpdateOperation
+{
+    public function execute(Service $service, string $imageDigest, bool $backupRequested = false): Operation
+    {
+        if (! in_array($service->type, [ServiceType::POSTGRES, ServiceType::VALKEY], true)) {
+            throw new InvalidArgumentException('Only Postgres and Valkey have v1 stateful update operations.');
+        }
+
+        if ($backupRequested && ! ($service->config['backup_enabled'] ?? false)) {
+            throw new InvalidArgumentException('Backups are not configured for this service.');
+        }
+
+        $service->forceFill([
+            'available_image_digest' => $imageDigest,
+            'update_status' => 'update_pending',
+        ])->save();
+
+        $operation = $service->operations()->create([
+            'kind' => OperationKind::SERVICE_DEPLOY,
+            'status' => OperationStatus::PENDING,
+        ]);
+
+        $composePath = "/home/keystone/services/{$service->id}/compose.yml";
+        $serviceKey = str($service->name)->slug('_')->value() ?: 'service';
+        $volumeName = $this->namedVolume($service);
+
+        $steps = [
+            'Acknowledge downtime and data risk' => 'echo '.escapeshellarg('Stateful update requires downtime and preserves named volumes.'),
+        ];
+
+        if ($backupRequested) {
+            $steps['Run pre-update backup'] = $service->config['backup_command'] ?? 'echo '.escapeshellarg('Run configured backup before stateful update.');
+        }
+
+        $steps += [
+            'Render compose with updated image digest' => $this->composeUploadScript($service),
+            'Stop existing container' => "docker compose -f {$composePath} stop {$serviceKey}",
+            'Preserve named volume' => $volumeName ? "docker volume inspect {$volumeName} >/dev/null" : 'true',
+            'Start service with updated image digest' => "docker compose -f {$composePath} up -d {$serviceKey}",
+            'Health check updated service' => implode("\n", [
+                "container_id=$(docker compose -f {$composePath} ps -q {$serviceKey})",
+                'test -n "$container_id"',
+                'for attempt in $(seq 1 30); do',
+                '  health_status=$(docker inspect --format "{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}" "$container_id")',
+                '  test "$health_status" = "healthy" -o "$health_status" = "running" && exit 0',
+                '  sleep 2',
+                'done',
+                'printf "health_status=%s\n" "$health_status"',
+                'exit 1',
+            ]),
+        ];
+
+        $order = 1;
+        foreach ($steps as $name => $script) {
+            $operation->steps()->create([
+                'name' => $name,
+                'order' => $order++,
+                'status' => OperationStatus::PENDING,
+                'script' => $script,
+            ]);
+        }
+
+        return $operation;
+    }
+
+    private function composeUploadScript(Service $service): string
+    {
+        $servicePath = "/home/keystone/services/{$service->id}";
+        $renderer = app(ComposeRenderer::class);
+        $compose = $renderer->render($service);
+        $env = $renderer->renderEnvironmentFile($service);
+
+        return implode("\n", [
+            "mkdir -p {$servicePath}",
+            'printf %s '.escapeshellarg(base64_encode($compose))." | base64 -d > {$servicePath}/compose.yml",
+            'printf %s '.escapeshellarg(base64_encode($env))." | base64 -d > {$servicePath}/.env",
+        ]);
+    }
+
+    private function namedVolume(Service $service): ?string
+    {
+        return match ($service->type) {
+            ServiceType::POSTGRES => "keystone_service_{$service->id}_postgres_data",
+            ServiceType::VALKEY => ($service->config['persistence'] ?? false) ? "keystone_service_{$service->id}_valkey_data" : null,
+            default => null,
+        };
+    }
+}

app/Actions/Services/RegisterServiceEndpoint.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Actions\Services;
+
+use App\Enums\ServiceEndpointScope;
+use App\Models\ServiceEndpoint;
+use App\Models\ServiceReplica;
+
+class RegisterServiceEndpoint
+{
+    public function execute(ServiceReplica $replica, ?ServiceReplica $consumerReplica = null, bool $allowPublicFallback = false): ServiceEndpoint
+    {
+        $scope = $this->scope($replica, $consumerReplica, $allowPublicFallback);
+
+        return $replica->service->endpoints()->updateOrCreate([
+            'service_replica_id' => $replica->id,
+            'scope' => $scope,
+            'port' => $replica->internal_port,
+        ], [
+            'hostname' => $this->hostname($replica, $scope),
+            'ip_address' => $this->ipAddress($replica, $scope),
+            'priority' => $this->priority($scope),
+            'health_status' => $replica->health_status,
+        ]);
+    }
+
+    private function scope(ServiceReplica $replica, ?ServiceReplica $consumerReplica, bool $allowPublicFallback): ServiceEndpointScope
+    {
+        if ($consumerReplica && $consumerReplica->server_id === $replica->server_id) {
+            return ServiceEndpointScope::DOCKER_NETWORK;
+        }
+
+        if ($replica->server?->private_ip) {
+            return ServiceEndpointScope::PRIVATE_NETWORK;
+        }
+
+        if ($allowPublicFallback && $replica->server?->ipv4) {
+            return ServiceEndpointScope::PUBLIC;
+        }
+
+        return ServiceEndpointScope::DOCKER_NETWORK;
+    }
+
+    private function hostname(ServiceReplica $replica, ServiceEndpointScope $scope): string
+    {
+        return match ($scope) {
+            ServiceEndpointScope::DOCKER_NETWORK => $replica->internal_host,
+            ServiceEndpointScope::PRIVATE_NETWORK => $replica->server->private_ip,
+            ServiceEndpointScope::PUBLIC => $replica->server->ipv4,
+        };
+    }
+
+    private function ipAddress(ServiceReplica $replica, ServiceEndpointScope $scope): ?string
+    {
+        return match ($scope) {
+            ServiceEndpointScope::DOCKER_NETWORK => null,
+            ServiceEndpointScope::PRIVATE_NETWORK => $replica->server->private_ip,
+            ServiceEndpointScope::PUBLIC => $replica->server->ipv4,
+        };
+    }
+
+    private function priority(ServiceEndpointScope $scope): int
+    {
+        return match ($scope) {
+            ServiceEndpointScope::DOCKER_NETWORK => 10,
+            ServiceEndpointScope::PRIVATE_NETWORK => 20,
+            ServiceEndpointScope::PUBLIC => 100,
+        };
+    }
+}

app/Actions/Services/ResolveServiceImageDigest.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Actions\Services;
+
+use App\Drivers\Concerns\RendersCompose;
+use App\Models\Server;
+use App\Models\Service;
+use App\Services\Operations\RemoteCommandRunner;
+use RuntimeException;
+
+class ResolveServiceImageDigest
+{
+    public function __construct(
+        private readonly RemoteCommandRunner $remoteCommandRunner,
+    ) {}
+
+    public function execute(Service $service): string
+    {
+        $image = $this->imageReference($service);
+
+        if (str_starts_with($image, 'sha256:')) {
+            return $image;
+        }
+
+        $output = $this->remoteCommandRunner->run($this->targetServer($service), implode("\n", [
+            'set -euo pipefail',
+            'image='.escapeshellarg($image),
+            'digest=$(docker image inspect --format '.escapeshellarg('{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}{{.Id}}{{end}}').' "$image" 2>/dev/null || true)',
+            'if [ -z "$digest" ]; then',
+            '    docker pull "$image"',
+            '    digest=$(docker image inspect --format '.escapeshellarg('{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}{{.Id}}{{end}}').' "$image")',
+            'fi',
+            'printf "image_digest=%s\n" "$digest"',
+        ]));
+
+        if (preg_match('/image_digest=(?<digest>\S+)/', $output, $matches)) {
+            return $this->digestFromOutput($matches['digest'], $image);
+        }
+
+        return $this->digestFromOutput($output, $image);
+    }
+
+    private function imageReference(Service $service): string
+    {
+        $driver = $service->driver();
+
+        if (! $driver instanceof RendersCompose) {
+            throw new RuntimeException("Driver [{$service->driver_name}] cannot resolve an image digest.");
+        }
+
+        $image = $driver->composeService()['image'] ?? null;
+
+        if (! is_string($image) || $image === '') {
+            throw new RuntimeException("Driver [{$service->driver_name}] did not provide an image reference.");
+        }
+
+        return $image;
+    }
+
+    private function targetServer(Service $service): Server
+    {
+        $service->loadMissing('server', 'replicas.server');
+
+        $server = $service->replicas->first()?->server ?: $service->server;
+
+        if (! $server instanceof Server) {
+            throw new RuntimeException("Service [{$service->id}] must have a target server before resolving an image digest.");
+        }
+
+        return $server;
+    }
+
+    private function digestFromOutput(string $output, string $image): string
+    {
+        if (str_contains($output, '@')) {
+            return str($output)->after('@')->trim()->value();
+        }
+
+        if (str_starts_with($output, 'sha256:')) {
+            return $output;
+        }
+
+        throw new RuntimeException("Unable to resolve image digest for [{$image}].");
+    }
+}

app/Console/Commands/CreateServiceCommand.php

@@ -14,7 +14,7 @@ class CreateServiceCommand extends Command
 
     protected $description = 'Create a service';
 
-    public function handle()
+    public function handle(): void
     {
         $serverId = $this->components->ask('Enter the server ID');
         $server = Server::find($serverId);
@@ -26,7 +26,7 @@ class CreateServiceCommand extends Command
         }
 
         $serviceType = $this->components->choice('select the service you want to install', [
-            'postgres-17',
+            'postgres-18',
         ]);
 
         $serviceName = $this->components->ask('Enter the service name');
@@ -36,7 +36,7 @@ class CreateServiceCommand extends Command
             server: $server,
             name: $serviceName,
             category: ServiceCategory::DATABASE,
-            type: ServiceType::tryFrom($type),
+            type: ServiceType::from($type),
             version: $version,
         );
 

app/Console/Commands/GenerateJSEnums.php

@@ -20,7 +20,7 @@ class GenerateJSEnums extends Command
 
     public function handle(): int
     {
-        $enums = base_path('app/enums');
+        $enums = app_path('Enums');
 
         $this->load($enums);
 
@@ -87,7 +87,7 @@ class GenerateJSEnums extends Command
 
             // Skip format, JS date formats are different to PHP ones.
             if ($name !== 'Format') {
-                file_put_contents(base_path('resources/js/Enums/'.$name.'.js'), $js);
+                file_put_contents(resource_path('js/enums/'.$name.'.js'), $js);
                 $this->info('Stored '.$enum);
             } else {
                 $this->info('Skipped '.$name.'s');

app/Data/Environments/EnvironmentDeploymentPlan.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Data\Environments;
+
+use App\Models\Service;
+
+class EnvironmentDeploymentPlan
+{
+    /**
+     * @param  array<int, Service>  $services
+     * @param  array<int, Service>  $dependencies
+     * @param  array<int, string>  $warnings
+     * @param  array<int, string>  $blockers
+     */
+    public function __construct(
+        public array $services = [],
+        public array $dependencies = [],
+        public bool $requiresRegistry = false,
+        public array $warnings = [],
+        public array $blockers = [],
+    ) {
+        //
+    }
+}

app/Data/Operations/Plan.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Data\Deployments;
+namespace App\Data\Operations;
 
 class Plan
 {

app/Data/Operations/PlannedStep.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Data\Deployments;
+namespace App\Data\Operations;
 
 class PlannedStep
 {
@@ -11,28 +11,34 @@ class PlannedStep
         protected array $secrets = [],
         string|callable $script = 'echo "Incomplete Step"',
     ) {
-        if (is_callable($script)) {
-            $this->script = $script();
-        } else {
-            $this->script = $script;
-        }
+        $this->script = is_callable($script) ? $script() : $script;
     }
 
     public function getSafeScript(): string
     {
         $script = $this->script;
         foreach ($this->secrets as $key => $value) {
-            $script = str_replace("[!{$key}]", '********', $script);
+            $script = str_replace("[!{$key}!]", '********', $script);
         }
 
         return $script;
     }
 
+    public function getScriptTemplate(): string
+    {
+        return $this->script;
+    }
+
+    public function secrets(): array
+    {
+        return $this->secrets;
+    }
+
     public function getScript(): string
     {
         $script = $this->script;
         foreach ($this->secrets as $key => $value) {
-            $script = str_replace("[!{$key}]", $value, $script);
+            $script = str_replace("[!{$key}!]", $value, $script);
         }
 
         return $script;

app/Data/Slices/CaddySliceData.php

@@ -1,12 +0,0 @@
-<?php
-
-namespace App\Data\Slices;
-
-class CaddySliceData
-{
-    public function __construct(
-        public string $domain,
-        public string $type,
-        public array $targets
-    ) {}
-}

app/Drivers/Caddy/Caddy2Driver.php

@@ -2,15 +2,20 @@
 
 namespace App\Drivers\Caddy;
 
+use App\Data\Operations\Plan;
+use App\Data\Operations\PlannedStep;
+use App\Drivers\Concerns\RendersCompose;
+use App\Drivers\Concerns\SupportsSlices;
 use App\Drivers\GatewayDriver;
-use App\Data\Deployments\Plan;
-use App\Data\Deployments\PlannedStep as Step;
-use App\Enums\DeploymentStatus;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\ServiceType;
 use App\Models\Service;
+use App\Models\ServiceSlice;
 
-class Caddy2Driver extends GatewayDriver
+class Caddy2Driver extends GatewayDriver implements RendersCompose, SupportsSlices
 {
     public ?string $containerName;
+
     public ?string $containerId;
 
     public function __construct(
@@ -23,55 +28,112 @@ class Caddy2Driver extends GatewayDriver
         $this->service = $service;
     }
 
-    public function getDeploymentPlan(string $deploymentHash): Plan
+    public function getOperationPlan(string $operationHash): Plan
     {
-        $previousDeployment = $this->service?->deployments()
-            ->where('status', DeploymentStatus::COMPLETED)
-            ->first();
-
         return new Plan(steps: [
-            new Step(
-                name: 'Generate Caddyfile',
-                script: function () {
-                    $script = collect();
-                    $script->push('cd ~');
-                    $script->push('test -d services || mkdir services');
-                    $script->push('cd services');
-                    $script->push("test -d {$this->service->id} || mkdir {$this->service->id}");
-                    $script->push("cd {$this->service->id}");
-                    return $script->join("\n");
-                }
+            new PlannedStep(
+                name: 'Render Caddy Compose files',
+                script: "mkdir -p /home/keystone/gateway /home/keystone/services/{$this->service?->id}",
             ),
-            new Step(
-                name: 'Run the docker image',
-                script: function () use ($previousDeployment, $deploymentHash) {
-                    $script = collect();
-                    if ($this->containerName && $previousDeployment) {
-                        $script->push("docker stop \"{$this->containerName}-{$previousDeployment->hash}\" || true");
-                    } elseif ($this->containerId) {
-                        $script->push('docker stop ' . $this->containerId . ' || true');
-                    }
-
-                    $runCommand = 'docker run -d';
-                    if ($this->containerName) {
-                        $runCommand .= " --name \"{$this->containerName}-{$deploymentHash}\"";
-                    }
-                    $runCommand .= ' -p 80:80 -p 443:443 caddy:2';
-
-                    $script->push($runCommand);
-
-                    return $script->join(" && ");
-                }
+            new PlannedStep(
+                name: 'Start Caddy gateway',
+                script: "docker compose -f /home/keystone/services/{$this->service?->id}/compose.yml up -d",
             ),
         ]);
     }
 
-    public function buildCaddyfile(): string
+    public function serviceType(): ServiceType
     {
-        $caddyfile = "http://{$this->service->name} {\n";
-        $caddyfile .= "    reverse_proxy {$this->service->credentials['backend']}\n";
-        $caddyfile .= "}\n";
+        return ServiceType::CADDY;
+    }
 
-        return $caddyfile;
+    public function versionTrack(): string
+    {
+        return '2';
+    }
+
+    public function defaultImage(): string
+    {
+        return 'caddy:2';
+    }
+
+    public function defaultPorts(): array
+    {
+        return [80, 443];
+    }
+
+    public function firewallRules(): array
+    {
+        return ['80/tcp', '443/tcp'];
+    }
+
+    public function environmentSchema(): array
+    {
+        return [];
+    }
+
+    public function resourceDefaults(): array
+    {
+        return [];
+    }
+
+    public function updateBehavior(): string
+    {
+        return 'stateless_redeploy';
+    }
+
+    public function composeService(): array
+    {
+        return [
+            'image' => $this->service?->available_image_digest
+                ?: $this->service?->current_image_digest
+                ?: $this->defaultImage(),
+            'restart' => 'unless-stopped',
+            'ports' => ['80:80', '443:443'],
+            'volumes' => [
+                '/home/keystone/gateway/Caddyfile:/etc/caddy/Caddyfile:ro',
+                "keystone_service_{$this->service?->id}_caddy_data:/data",
+                "keystone_service_{$this->service?->id}_caddy_config:/config",
+            ],
+            'healthcheck' => [
+                'test' => ['CMD', 'caddy', 'version'],
+                'interval' => '10s',
+                'timeout' => '5s',
+                'retries' => 5,
+            ],
+        ];
+    }
+
+    public function composeVolumes(): array
+    {
+        return [
+            "keystone_service_{$this->service?->id}_caddy_data" => null,
+            "keystone_service_{$this->service?->id}_caddy_config" => null,
+        ];
+    }
+
+    public function environmentExports(): array
+    {
+        return [];
+    }
+
+    public function supportedSliceTypes(): array
+    {
+        return ['route'];
+    }
+
+    public function environmentExportsForSlice(ServiceSlice $slice, ?EnvironmentAttachmentRole $role = null): array
+    {
+        return [];
+    }
+
+    public function provisionSliceScript(ServiceSlice $slice): string
+    {
+        return implode("\n", [
+            'set -euo pipefail',
+            'mkdir -p /home/keystone/gateway/Caddyfile.d',
+            'test -f /home/keystone/gateway/Caddyfile || touch /home/keystone/gateway/Caddyfile',
+            "test ! -e /home/keystone/gateway/Caddyfile.d/{$slice->id}.caddy || true",
+        ]);
     }
 }

app/Drivers/Concerns/RendersCompose.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Drivers\Concerns;
+
+interface RendersCompose
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function composeService(): array;
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function composeVolumes(): array;
+
+    /**
+     * @return array<string, string>
+     */
+    public function environmentExports(): array;
+}

app/Drivers/Concerns/SupportsSlices.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Drivers\Concerns;
+
+use App\Enums\EnvironmentAttachmentRole;
+use App\Models\ServiceSlice;
+
+interface SupportsSlices
+{
+    /**
+     * @return array<int, string>
+     */
+    public function supportedSliceTypes(): array;
+
+    /**
+     * @return array<string, string>
+     */
+    public function environmentExportsForSlice(ServiceSlice $slice, ?EnvironmentAttachmentRole $role = null): array;
+
+    public function provisionSliceScript(ServiceSlice $slice): string;
+}

app/Drivers/Driver.php

@@ -2,7 +2,9 @@
 
 namespace App\Drivers;
 
-use App\Data\Deployments\Plan;
+use App\Data\Operations\Plan;
+use App\Data\Operations\PlannedStep;
+use App\Enums\ServiceType;
 use App\Models\Service;
 
 abstract class Driver
@@ -19,5 +21,41 @@ abstract class Driver
         ?Service $service = null,
     );
 
-    abstract public function getDeploymentPlan(string $deploymentHash): Plan;
+    abstract public function getOperationPlan(string $operationHash): Plan;
+
+    abstract public function serviceType(): ServiceType;
+
+    abstract public function versionTrack(): string;
+
+    abstract public function defaultImage(): string;
+
+    /**
+     * @return array<int, int>
+     */
+    abstract public function defaultPorts(): array;
+
+    /**
+     * @return array<int, string>
+     */
+    abstract public function firewallRules(): array;
+
+    /**
+     * @return array<string, string>
+     */
+    abstract public function environmentSchema(): array;
+
+    /**
+     * @return array{cpu?: string, memory_mb?: int}
+     */
+    abstract public function resourceDefaults(): array;
+
+    abstract public function updateBehavior(): string;
+
+    /**
+     * @return array<int, PlannedStep>
+     */
+    public function preSwitchSteps(): array
+    {
+        return [];
+    }
 }

app/Drivers/Laravel/LaravelRuntimeDriver.php

@@ -0,0 +1,205 @@
+<?php
+
+namespace App\Drivers\Laravel;
+
+use App\Actions\Environments\BuildMigrationScript;
+use App\Data\Operations\Plan;
+use App\Data\Operations\PlannedStep;
+use App\Drivers\Concerns\RendersCompose;
+use App\Drivers\Driver;
+use App\Enums\SchedulerMode;
+use App\Enums\ServiceType;
+use App\Models\Service;
+
+class LaravelRuntimeDriver extends Driver implements RendersCompose
+{
+    public function __construct(
+        public ?string $containerName = null,
+        public ?string $containerId = null,
+        public ?Service $service = null,
+    ) {
+        //
+    }
+
+    public function getOperationPlan(string $operationHash): Plan
+    {
+        return new Plan(steps: [
+            new PlannedStep(
+                name: 'Render Laravel Compose file',
+                script: "mkdir -p /home/keystone/services/{$this->service?->id}",
+            ),
+            new PlannedStep(
+                name: 'Run migrations',
+                script: $this->service
+                    ? app(BuildMigrationScript::class)->execute($this->service)
+                    : 'true',
+            ),
+            new PlannedStep(
+                name: 'Start Laravel replica',
+                script: "docker compose -f /home/keystone/services/{$this->service?->id}/compose.yml up -d",
+            ),
+        ]);
+    }
+
+    public function serviceType(): ServiceType
+    {
+        return ServiceType::LARAVEL;
+    }
+
+    public function versionTrack(): string
+    {
+        return 'php-8.4';
+    }
+
+    public function defaultImage(): string
+    {
+        return 'serversideup/php:8.4-frankenphp';
+    }
+
+    public function defaultPorts(): array
+    {
+        return [80];
+    }
+
+    public function firewallRules(): array
+    {
+        return [];
+    }
+
+    public function environmentSchema(): array
+    {
+        return [
+            'APP_ENV' => 'string',
+            'SERVER_NAME' => 'string',
+        ];
+    }
+
+    public function resourceDefaults(): array
+    {
+        return [];
+    }
+
+    public function updateBehavior(): string
+    {
+        return 'stateless_gateway_cutover';
+    }
+
+    public function composeService(): array
+    {
+        $image = $this->service?->available_image_digest
+            ?: $this->service?->current_image_digest
+            ?: ($this->service?->config['image'] ?? $this->defaultImage());
+
+        $service = [
+            'image' => $image,
+            'restart' => 'unless-stopped',
+            'environment' => $this->environmentExports(),
+        ];
+
+        if ($command = $this->service?->config['command'] ?? null) {
+            $service['command'] = $command;
+        }
+
+        if (! in_array('worker', $this->service?->process_roles ?? [], true)) {
+            $service['healthcheck'] = [
+                'test' => ['CMD-SHELL', 'curl -fsS http://localhost'.($this->service?->config['health_path'] ?? '/up').' || exit 1'],
+                'interval' => '10s',
+                'timeout' => '5s',
+                'retries' => 5,
+            ];
+        }
+
+        if ($this->service?->default_cpu_limit) {
+            $service['cpus'] = (string) $this->service->default_cpu_limit;
+        }
+
+        if ($this->service?->default_memory_limit_mb) {
+            $service['mem_limit'] = "{$this->service->default_memory_limit_mb}m";
+            $service['memswap_limit'] = "{$this->service->default_memory_limit_mb}m";
+        }
+
+        return $service;
+    }
+
+    public function composeVolumes(): array
+    {
+        return [];
+    }
+
+    public function environmentExports(): array
+    {
+        $environment = $this->service?->environment?->variables()
+            ->pluck('value', 'key')
+            ->all() ?? [];
+
+        $environment = [
+            ...$environment,
+            'APP_ENV' => $this->service?->environment?->name ?? 'production',
+            'SERVER_NAME' => ':80',
+        ];
+
+        if ($this->shouldAutorunScheduler()) {
+            $environment['AUTORUN_LARAVEL_SCHEDULER'] = 'true';
+        }
+
+        return $environment;
+    }
+
+    private function shouldAutorunScheduler(): bool
+    {
+        if (! in_array('scheduler', $this->service?->process_roles ?? [], true)) {
+            return false;
+        }
+
+        $environment = $this->service?->environment;
+
+        if (! $environment?->scheduler_enabled) {
+            return false;
+        }
+
+        if ($environment->scheduler_target_service_id && $environment->scheduler_target_service_id !== $this->service?->id) {
+            return false;
+        }
+
+        return $environment->scheduler_mode !== SchedulerMode::SINGLE
+            || (int) $this->service?->desired_replicas === 1;
+    }
+
+    public function dockerfileTemplate(): string
+    {
+        $phpVersion = $this->service?->config['php_version'] ?? '8.4';
+        $documentRoot = $this->service?->config['document_root'] ?? 'public';
+        $jsBuildCommand = $this->service?->config['js_build_command'] ?? $this->service?->environment?->build_config['js_build_command'] ?? null;
+        $jsPackageManager = $this->service?->config['js_package_manager'] ?? $this->service?->environment?->build_config['js_package_manager'] ?? 'bun';
+        $jsBuildSteps = $this->jsBuildSteps($jsPackageManager, $jsBuildCommand);
+
+        return <<<DOCKERFILE
+FROM serversideup/php:{$phpVersion}-frankenphp
+
+ENV SSL_MODE=off
+ENV AUTORUN_ENABLED=true
+ENV PHP_OPCACHE_ENABLE=1
+
+WORKDIR /var/www/html
+
+COPY --chown=www-data:www-data . .
+
+RUN composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+{$jsBuildSteps}
+
+ENV SERVER_DOCUMENT_ROOT=/var/www/html/{$documentRoot}
+DOCKERFILE;
+    }
+
+    private function jsBuildSteps(string $packageManager, ?string $buildCommand): string
+    {
+        if (! $buildCommand) {
+            return '';
+        }
+
+        return match ($packageManager) {
+            'npm' => "\nRUN npm ci && {$buildCommand}",
+            default => "\nRUN curl -fsSL https://bun.sh/install | bash && export PATH=\"/root/.bun/bin:\$PATH\" && bun install --frozen-lockfile && {$buildCommand}",
+        };
+    }
+}

app/Drivers/Postgres/Postgres17Driver.php

@@ -1,94 +0,0 @@
-<?php
-
-namespace App\Drivers\Postgres;
-
-use App\Data\Deployments\Plan;
-use App\Data\Deployments\PlannedStep as Step;
-use App\Drivers\DatabaseDriver;
-use App\Enums\DeploymentStatus;
-use App\Models\Service;
-use Illuminate\Support\Str;
-
-class Postgres17Driver extends DatabaseDriver
-{
-    public Plan $deploymentPlan;
-
-    public function __construct(
-        public ?string $containerName = null,
-        public ?string $containerId = null,
-        public ?Service $service = null,
-        public ?array $credentials = null,
-    ) {
-        $credentials = $credentials ?? $this->defaultCredentials();
-    }
-
-    public function getDeploymentPlan(string $deploymentHash): Plan
-    {
-        $user = $credentials['user'] ?? null;
-        $password = $credentials['password'] ?? null;
-        $db = $credentials['db'] ?? null;
-
-        if (!$user || !$password || !$db) {
-            throw new \InvalidArgumentException('Missing required credentials');
-        }
-
-        $previousDeployment = $this->service?->deployments()
-            ->where('status', DeploymentStatus::COMPLETED)
-            ->first();
-
-        return new Plan(steps: [
-            new Step(
-                name: 'Run the docker image',
-                secrets: [
-                    'password' => $password
-                ],
-                script: function () use ($user, $password, $db, $previousDeployment, $deploymentHash) {
-                    $script = collect();
-
-                    if ($this->containerName && $previousDeployment) {
-                        $script->push("docker stop \"{$this->containerName}-{$previousDeployment->hash}\" || true");
-                    } elseif ($this->containerId) {
-                        $script->push('docker stop ' . $this->containerId . ' || true');
-                    }
-
-                    $runCommand = 'docker run -d';
-                    if ($this->containerName) {
-                        $runCommand .= " --name \"{$this->containerName}-{$deploymentHash}\"";
-                    }
-                    if ($password) {
-                        $runCommand .= ' -e POSTGRES_PASSWORD=[!password!]';
-                    }
-                    if ($user) {
-                        $runCommand .= " -e POSTGRES_USER={$user}";
-                    }
-                    if ($db) {
-                        $runCommand .= " -e POSTGRES_DB={$db}";
-                    }
-                    $runCommand .= ' -p 5432:5432 postgres:17';
-
-                    $script->push($runCommand);
-
-                    return $script->join(" && ");
-                }
-            ),
-            new Step(
-                name: 'Configure firewall', // @todo this should create a Firewallrule
-                script: 'ufw allow 5432/tcp || true',
-            ),
-        ]);
-    }
-
-    public function defaultCredentials(): array
-    {
-        return [
-            'password' => Str::random(16),
-            'user' => 'keystone',
-            'db' => 'keystone',
-        ];
-    }
-
-    public function createUser(string $user, string $password): string
-    {
-        return "psql -U {$this->credentials['user']} -d {$this->credentials['db']} -c \"CREATE USER {$user} WITH PASSWORD '{$password}';\"";
-    }
-}

app/Drivers/Postgres/Postgres18Driver.php

@@ -0,0 +1,203 @@
+<?php
+
+namespace App\Drivers\Postgres;
+
+use App\Data\Operations\Plan;
+use App\Data\Operations\PlannedStep;
+use App\Drivers\Concerns\RendersCompose;
+use App\Drivers\Concerns\SupportsSlices;
+use App\Drivers\DatabaseDriver;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\ServiceType;
+use App\Models\Service;
+use App\Models\ServiceSlice;
+use Illuminate\Support\Str;
+
+class Postgres18Driver extends DatabaseDriver implements RendersCompose, SupportsSlices
+{
+    public Plan $operationPlan;
+
+    public function __construct(
+        public ?string $containerName = null,
+        public ?string $containerId = null,
+        public ?Service $service = null,
+        public ?array $credentials = null,
+    ) {
+        $this->credentials = $credentials ?? $this->defaultCredentials();
+    }
+
+    public function getOperationPlan(string $operationHash): Plan
+    {
+        $credentials = $this->credentials ?? $this->defaultCredentials();
+        $user = $credentials['user'] ?? null;
+        $password = $credentials['password'] ?? null;
+        $db = $credentials['db'] ?? null;
+
+        if (! $user || ! $password || ! $db) {
+            throw new \InvalidArgumentException('Missing required credentials');
+        }
+
+        return new Plan(steps: [
+            new PlannedStep(
+                name: 'Render Compose file',
+                script: "mkdir -p /home/keystone/services/{$this->service?->id}",
+            ),
+            new PlannedStep(
+                name: 'Start Postgres service',
+                script: "docker compose -f /home/keystone/services/{$this->service?->id}/compose.yml up -d",
+            ),
+            new PlannedStep(
+                name: 'Check Postgres health',
+                script: "docker compose -f /home/keystone/services/{$this->service?->id}/compose.yml ps --status running",
+            ),
+            new PlannedStep(
+                name: 'Configure firewall',
+                script: 'ufw allow 5432/tcp || true',
+            ),
+        ]);
+    }
+
+    public function serviceType(): ServiceType
+    {
+        return ServiceType::POSTGRES;
+    }
+
+    public function versionTrack(): string
+    {
+        return '18';
+    }
+
+    public function defaultImage(): string
+    {
+        return 'postgres:18';
+    }
+
+    public function defaultPorts(): array
+    {
+        return [5432];
+    }
+
+    public function firewallRules(): array
+    {
+        return ['5432/tcp'];
+    }
+
+    public function environmentSchema(): array
+    {
+        return [
+            'POSTGRES_USER' => 'string',
+            'POSTGRES_PASSWORD' => 'secret',
+            'POSTGRES_DB' => 'string',
+        ];
+    }
+
+    public function resourceDefaults(): array
+    {
+        return [];
+    }
+
+    public function updateBehavior(): string
+    {
+        return 'stateful_downtime';
+    }
+
+    public function defaultCredentials(): array
+    {
+        return [
+            'password' => Str::random(32),
+            'user' => 'keystone',
+            'db' => 'keystone',
+        ];
+    }
+
+    public function createUser(string $user, string $password): string
+    {
+        return "psql -U {$this->credentials['user']} -d {$this->credentials['db']} -c \"CREATE USER {$user} WITH PASSWORD '{$password}';\"";
+    }
+
+    public function supportedSliceTypes(): array
+    {
+        return ['database_user'];
+    }
+
+    public function environmentExportsForSlice(ServiceSlice $slice, ?EnvironmentAttachmentRole $role = null): array
+    {
+        $credentials = $slice->credentials ?? [];
+
+        return [
+            'DB_CONNECTION' => 'pgsql',
+            'DB_HOST' => $slice->config['host'] ?? "keystone-service-{$slice->service_id}",
+            'DB_PORT' => (string) ($slice->config['port'] ?? 5432),
+            'DB_DATABASE' => $credentials['database'] ?? $slice->name,
+            'DB_USERNAME' => $credentials['username'] ?? $slice->name,
+            'DB_PASSWORD' => $credentials['password'] ?? '',
+        ];
+    }
+
+    public function provisionSliceScript(ServiceSlice $slice): string
+    {
+        $credentials = $slice->credentials ?? [];
+        $database = $credentials['database'] ?? $slice->name;
+        $username = $credentials['username'] ?? $slice->name;
+        $password = $credentials['password'] ?? Str::password(32);
+        $admin = ($this->credentials ?? $this->defaultCredentials())['user'] ?? 'keystone';
+        $serviceKey = str($slice->service->name)->slug('_')->value() ?: 'postgres';
+
+        return implode("\n", [
+            'set -euo pipefail',
+            "docker compose -f /home/keystone/services/{$slice->service_id}/compose.yml exec -T {$serviceKey} psql -U ".escapeshellarg($admin).' -d postgres <<\'KEYSTONE_SQL\'',
+            "SELECT 'CREATE DATABASE \"{$this->sqlIdentifier($database)}\"' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '{$this->sqlLiteral($database)}')\\gexec",
+            'DO $$ BEGIN CREATE USER "'.$this->sqlIdentifier($username).'" WITH PASSWORD \''.$this->sqlLiteral($password).'\'; EXCEPTION WHEN duplicate_object THEN ALTER USER "'.$this->sqlIdentifier($username).'" WITH PASSWORD \''.$this->sqlLiteral($password).'\'; END $$;',
+            "GRANT ALL PRIVILEGES ON DATABASE \"{$this->sqlIdentifier($database)}\" TO \"{$this->sqlIdentifier($username)}\";",
+            'KEYSTONE_SQL',
+        ]);
+    }
+
+    public function composeService(): array
+    {
+        $credentials = $this->credentials ?? $this->defaultCredentials();
+
+        return [
+            'image' => $this->service?->available_image_digest
+                ?: $this->service?->current_image_digest
+                ?: $this->defaultImage(),
+            'restart' => 'unless-stopped',
+            'environment' => [
+                'POSTGRES_USER' => $credentials['user'],
+                'POSTGRES_PASSWORD' => $credentials['password'],
+                'POSTGRES_DB' => $credentials['db'],
+            ],
+            'volumes' => [
+                "keystone_service_{$this->service?->id}_postgres_data:/var/lib/postgresql/data",
+            ],
+            'healthcheck' => [
+                'test' => ['CMD-SHELL', 'pg_isready -U '.$credentials['user']],
+                'interval' => '10s',
+                'timeout' => '5s',
+                'retries' => 5,
+            ],
+        ];
+    }
+
+    public function composeVolumes(): array
+    {
+        return [
+            "keystone_service_{$this->service?->id}_postgres_data" => null,
+        ];
+    }
+
+    public function environmentExports(): array
+    {
+        return [];
+    }
+
+    private function sqlIdentifier(string $value): string
+    {
+        return str_replace('"', '""', $value);
+    }
+
+    private function sqlLiteral(string $value): string
+    {
+        return str_replace("'", "''", $value);
+    }
+}

app/Drivers/Valkey/Valkey8Driver.php

@@ -0,0 +1,154 @@
+<?php
+
+namespace App\Drivers\Valkey;
+
+use App\Data\Operations\Plan;
+use App\Data\Operations\PlannedStep;
+use App\Drivers\Concerns\RendersCompose;
+use App\Drivers\Concerns\SupportsSlices;
+use App\Drivers\Driver;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\ServiceType;
+use App\Models\Service;
+use App\Models\ServiceSlice;
+
+class Valkey8Driver extends Driver implements RendersCompose, SupportsSlices
+{
+    public function __construct(
+        public ?string $containerName = null,
+        public ?string $containerId = null,
+        public ?Service $service = null,
+    ) {
+        //
+    }
+
+    public function getOperationPlan(string $operationHash): Plan
+    {
+        return new Plan(steps: [
+            new PlannedStep(
+                name: 'Render Compose file',
+                script: "mkdir -p /home/keystone/services/{$this->service?->id}",
+            ),
+            new PlannedStep(
+                name: 'Start Valkey service',
+                script: "docker compose -f /home/keystone/services/{$this->service?->id}/compose.yml up -d",
+            ),
+        ]);
+    }
+
+    public function serviceType(): ServiceType
+    {
+        return ServiceType::VALKEY;
+    }
+
+    public function versionTrack(): string
+    {
+        return '8';
+    }
+
+    public function defaultImage(): string
+    {
+        return 'valkey/valkey:8';
+    }
+
+    public function defaultPorts(): array
+    {
+        return [6379];
+    }
+
+    public function firewallRules(): array
+    {
+        return ['6379/tcp'];
+    }
+
+    public function environmentSchema(): array
+    {
+        return [];
+    }
+
+    public function resourceDefaults(): array
+    {
+        return [];
+    }
+
+    public function updateBehavior(): string
+    {
+        return 'stateful_downtime';
+    }
+
+    public function supportedSliceTypes(): array
+    {
+        return ['logical_database'];
+    }
+
+    public function environmentExportsForSlice(ServiceSlice $slice, ?EnvironmentAttachmentRole $role = null): array
+    {
+        $exports = [
+            'REDIS_HOST' => $slice->config['host'] ?? "keystone-service-{$slice->service_id}",
+            'REDIS_PORT' => (string) ($slice->config['port'] ?? 6379),
+            'REDIS_DB' => (string) ($slice->config['database'] ?? 0),
+        ];
+
+        return match ($role) {
+            EnvironmentAttachmentRole::CACHE => [
+                ...$exports,
+                'CACHE_STORE' => 'redis',
+            ],
+            EnvironmentAttachmentRole::QUEUE => [
+                ...$exports,
+                'QUEUE_CONNECTION' => 'redis',
+            ],
+            EnvironmentAttachmentRole::CUSTOM,
+            EnvironmentAttachmentRole::DATABASE,
+            EnvironmentAttachmentRole::GATEWAY,
+            EnvironmentAttachmentRole::STORAGE,
+            null => $exports,
+        };
+    }
+
+    public function provisionSliceScript(ServiceSlice $slice): string
+    {
+        $serviceKey = str($slice->service->name)->slug('_')->value() ?: 'valkey';
+
+        return 'docker compose -f /home/keystone/services/'.$slice->service_id.'/compose.yml exec -T '.$serviceKey.' valkey-cli -n '.escapeshellarg((string) ($slice->config['database'] ?? 0)).' PING';
+    }
+
+    public function composeService(): array
+    {
+        $service = [
+            'image' => $this->service?->available_image_digest
+                ?: $this->service?->current_image_digest
+                ?: $this->defaultImage(),
+            'restart' => 'unless-stopped',
+            'healthcheck' => [
+                'test' => ['CMD', 'valkey-cli', 'ping'],
+                'interval' => '10s',
+                'timeout' => '5s',
+                'retries' => 5,
+            ],
+        ];
+
+        if ($this->service?->config['persistence'] ?? false) {
+            $service['volumes'] = ["keystone_service_{$this->service->id}_valkey_data:/data"];
+            $service['command'] = ['valkey-server', '--appendonly', 'yes'];
+        }
+
+        return $service;
+    }
+
+    public function composeVolumes(): array
+    {
+        if (! ($this->service?->config['persistence'] ?? false)) {
+            return [];
+        }
+
+        return [
+            "keystone_service_{$this->service->id}_valkey_data" => null,
+        ];
+    }
+
+    public function environmentExports(): array
+    {
+        return [];
+    }
+}

app/Enums/BuildArtifactStatus.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum BuildArtifactStatus: string
+{
+    use Arrayable;
+
+    case PENDING = 'pending';
+    case BUILDING = 'building';
+    case AVAILABLE = 'available';
+    case FAILED = 'failed';
+}

app/Enums/BuildStrategy.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum BuildStrategy: string
+{
+    use Arrayable;
+
+    case TARGET_SERVER = 'target_server';
+    case DEDICATED_BUILDER = 'dedicated_builder';
+    case EXTERNAL_REGISTRY = 'external_registry';
+}

app/Enums/DeployPolicy.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum DeployPolicy: string
+{
+    use Arrayable;
+
+    case WITH_ENVIRONMENT = 'with_environment';
+    case DEPENDENCY_ONLY = 'dependency_only';
+    case MANUAL_OR_ON_ROUTE_CHANGE = 'manual_or_on_route_change';
+    case MANUAL = 'manual';
+}

app/Enums/EnvironmentAttachmentRole.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum EnvironmentAttachmentRole: string
+{
+    use Arrayable;
+
+    case DATABASE = 'database';
+    case CACHE = 'cache';
+    case QUEUE = 'queue';
+    case STORAGE = 'storage';
+    case GATEWAY = 'gateway';
+    case CUSTOM = 'custom';
+}

app/Enums/EnvironmentVariableSource.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum EnvironmentVariableSource: string
+{
+    use Arrayable;
+
+    case USER = 'user';
+    case MANAGED_ATTACHMENT = 'managed_attachment';
+    case SYSTEM = 'system';
+}

app/Enums/NetworkType.php

@@ -1,13 +0,0 @@
-<?php
-
-namespace App\Enums;
-
-use App\Enums\Concerns\Arrayable;
-
-enum NetworkType: string
-{
-    use Arrayable;
-
-    case EXTERNAL = 'external'; // managed by provider
-    case INTERNAL = 'internal'; // managed by keystone
-}

app/Enums/OperationKind.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum OperationKind: string
+{
+    use Arrayable;
+
+    case SERVER_PROVISION = 'server_provision';
+    case SERVICE_DEPLOY = 'service_deploy';
+    case REPLICA_DEPLOY = 'replica_deploy';
+    case SLICE_PROVISION = 'slice_provision';
+    case SLICE_CONFIGURE = 'slice_configure';
+    case ENVIRONMENT_DEPLOY = 'environment_deploy';
+    case GATEWAY_CUTOVER = 'gateway_cutover';
+    case CONFIG_CHANGE = 'config_change';
+    case CREDENTIAL_ROTATION = 'credential_rotation';
+}

app/Enums/OperationStatus.php

@@ -4,7 +4,7 @@ namespace App\Enums;
 
 use App\Enums\Concerns\Arrayable;
 
-enum DeploymentStatus: string
+enum OperationStatus: string
 {
     use Arrayable;
 

app/Enums/RegistryType.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum RegistryType: string
+{
+    use Arrayable;
+
+    case GENERIC = 'generic';
+    case GITEA = 'gitea';
+    case GHCR = 'ghcr';
+    case DOCKER_HUB = 'docker_hub';
+}

app/Enums/SchedulerMode.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum SchedulerMode: string
+{
+    use Arrayable;
+
+    case SINGLE = 'single';
+    case EVERY_REPLICA = 'every_replica';
+}

app/Enums/ServiceCategory.php

@@ -13,6 +13,7 @@ enum ServiceCategory: string
     case GATEWAY = 'gateway';
     case STORAGE = 'storage';
     case CACHE = 'cache';
+    case BUILDER = 'builder';
 
     public static function getDescription(ServiceCategory|string $category)
     {
@@ -25,10 +26,11 @@ enum ServiceCategory: string
 
         return match ($category) {
             self::APPLICATION => 'The base container image for your application',
-            self::DATABASE => 'Postgres or MySQL',
+            self::DATABASE => 'Postgres',
             self::GATEWAY => 'The first point of contact for your application',
             self::STORAGE => 'S3 or S3-compatible service',
-            self::CACHE => 'Redis, Memcached or similar',
+            self::CACHE => 'Valkey',
+            self::BUILDER => 'Build service for application artifacts',
         };
     }
 }

app/Enums/ServiceEndpointScope.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum ServiceEndpointScope: string
+{
+    use Arrayable;
+
+    case DOCKER_NETWORK = 'docker_network';
+    case PRIVATE_NETWORK = 'private_network';
+    case PUBLIC = 'public';
+}

app/Enums/ServiceType.php

@@ -8,14 +8,8 @@ enum ServiceType: string
 {
     use Arrayable;
 
-    case FRANKENPHP = 'frankenphp';
-    case PHP_FPM = 'php-fpm';
     case POSTGRES = 'postgres';
     case CADDY = 'caddy';
     case VALKEY = 'valkey';
-
-    // future?
-    case MYSQL = 'mysql';
-    case NGINX = 'nginx';
-    case REDIS = 'redis';
+    case LARAVEL = 'laravel';
 }

app/Enums/SourceProviderType.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Enums;
+
+use App\Enums\Concerns\Arrayable;
+
+enum SourceProviderType: string
+{
+    use Arrayable;
+
+    case GITEA = 'gitea';
+    case GITHUB = 'github';
+    case GENERIC_GIT = 'generic_git';
+}

app/Http/Controllers/ApplicationController.php

@@ -2,24 +2,167 @@
 
 namespace App\Http\Controllers;
 
+use App\Actions\Applications\CreateLaravelEnvironment;
+use App\Actions\Applications\GenerateDeployKey;
+use App\Actions\Applications\VerifyRepositoryAccess;
+use App\Enums\RepositoryType;
+use App\Enums\ServerStatus;
+use App\Http\Requests\StoreApplicationRequest;
+use App\Http\Requests\UpdateApplicationRequest;
+use App\Models\Application;
 use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Inertia\Response;
 
 class ApplicationController extends Controller
 {
-    public function index(Request $request)
+    public function index(Request $request): Response
     {
-        $organisation = Organisation::with('applications')->findOrFail($request->route('organisation'));
+        $organisation = Organisation::with('applications.environments.services')->findOrFail($request->route('organisation'));
 
         return inertia('applications/Index', [
             'applications' => $organisation->applications,
         ]);
     }
 
-    public function show(Request $request)
+    public function create(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('applications/Create', [
+            'sourceProviders' => $organisation->sourceProviders()->get(),
+            'repositoryTypes' => RepositoryType::toArray(),
+        ]);
+    }
+
+    public function store(StoreApplicationRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        $application = $organisation->applications()->create([
+            'name' => $request->string('name')->toString(),
+            'source_provider_id' => $this->sourceProviderIdFor($organisation, $request->integer('source_provider_id') ?: null),
+            'repository_url' => $request->string('repository_url')->toString(),
+            'repository_type' => $request->enum('repository_type', RepositoryType::class),
+            'default_branch' => $request->string('default_branch')->toString(),
+        ]);
+
+        app(GenerateDeployKey::class)->execute($application);
+        app(CreateLaravelEnvironment::class)->execute($application->refresh(), $request->string('environment_name')->toString());
+
+        return redirect()
+            ->route('applications.show', ['organisation' => $organisation->id, 'application' => $application->id])
+            ->with('success', 'Application created. Add the deploy key to your repository before verifying access.');
+    }
+
+    public function show(Request $request): Response
     {
         $id = $request->route('application');
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = Application::with([
+            'environments.buildArtifacts' => fn ($query) => $query->latest()->limit(5),
+            'environments.operations' => fn ($query) => $query->latest()->limit(1),
+            'environments.services.replicas',
+            'environments.services.endpoints',
+            'environments.services.slices',
+            'environments.attachments.service',
+            'environments.variables',
+            'organisation',
+            'sourceProvider',
+        ])->whereBelongsTo($organisation)->findOrFail($id);
 
-        return inertia('applications/Show');
+        return inertia('applications/Show', [
+            'application' => $application,
+            'deploymentRequirements' => [
+                'registryRequired' => $organisation->servers()->count() > 1 && $organisation->registries()->doesntExist(),
+                'registryCount' => $organisation->registries()->count(),
+                'serverCount' => $organisation->servers()->count(),
+            ],
+            'servers' => inertia()->optional(function () use ($application) {
+                return $application
+                    ->organisation
+                    ?->servers()
+                    ->where('status', ServerStatus::ACTIVE)
+                    ->with('services')
+                    ->get() ?? [];
+            }),
+        ]);
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        return inertia('applications/Edit', [
+            'application' => $application,
+            'repositoryTypes' => RepositoryType::toArray(),
+            'sourceProviders' => $organisation->sourceProviders()->get(),
+        ]);
+    }
+
+    public function update(UpdateApplicationRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        $application->update([
+            'name' => $request->string('name')->toString(),
+            'source_provider_id' => $this->sourceProviderIdFor($organisation, $request->integer('source_provider_id') ?: null),
+            'repository_type' => $request->enum('repository_type', RepositoryType::class),
+            'repository_url' => $request->string('repository_url')->toString(),
+            'default_branch' => $request->string('default_branch')->toString(),
+        ]);
+
+        return redirect()
+            ->route('applications.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+            ])
+            ->with('success', 'Application updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        $application->delete();
+
+        return redirect()
+            ->route('applications.index', ['organisation' => $organisation->id])
+            ->with('success', 'Application deleted.');
+    }
+
+    public function verifyRepository(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        if (! app(VerifyRepositoryAccess::class)->execute($application)) {
+            return back()->with('error', 'Repository access could not be verified.');
+        }
+
+        return back()->with('success', 'Repository access verified.');
+    }
+
+    public function rotateDeployKey(Request $request, GenerateDeployKey $generateDeployKey): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        $generateDeployKey->execute($application);
+
+        return back()->with('success', 'Deploy key rotated. Install the new public key before verifying access.');
+    }
+
+    private function sourceProviderIdFor(Organisation $organisation, ?int $sourceProviderId): ?int
+    {
+        if ($sourceProviderId === null) {
+            return null;
+        }
+
+        return $organisation->sourceProviders()->findOrFail($sourceProviderId)->id;
     }
 }

app/Http/Controllers/Auth/RegisteredUserController.php

@@ -3,13 +3,8 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
-use App\Models\User;
-use Illuminate\Auth\Events\Registered;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Validation\Rules;
 use Inertia\Inertia;
 use Inertia\Response;
 
@@ -23,31 +18,8 @@ class RegisteredUserController extends Controller
         return Inertia::render('auth/Register');
     }
 
-    /**
-     * Handle an incoming registration request.
-     *
-     * @throws \Illuminate\Validation\ValidationException
-     */
     public function store(Request $request): RedirectResponse
     {
         abort(403, 'Registration is disabled.');
-
-        $request->validate([
-            'name' => 'required|string|max:255',
-            'email' => 'required|string|lowercase|email|max:255|unique:'.User::class,
-            'password' => ['required', 'confirmed', Rules\Password::defaults()],
-        ]);
-
-        $user = User::create([
-            'name' => $request->name,
-            'email' => $request->email,
-            'password' => Hash::make($request->password),
-        ]);
-
-        event(new Registered($user));
-
-        Auth::login($user);
-
-        return to_route('dashboard');
     }
 }

app/Http/Controllers/BuildArtifactController.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\BuildArtifact;
+use App\Models\Organisation;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class BuildArtifactController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        return inertia('build-artifacts/Index', [
+            'application' => $application,
+            'environment' => $environment,
+            'artifacts' => $environment->buildArtifacts()
+                ->with(['builtByOperation', 'builtByService'])
+                ->latest()
+                ->paginate(30),
+        ]);
+    }
+
+    public function show(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        /** @var BuildArtifact $artifact */
+        $artifact = $environment->buildArtifacts()
+            ->with(['builtByOperation.steps', 'builtByService'])
+            ->findOrFail($request->route('artifact'));
+
+        return inertia('build-artifacts/Show', [
+            'application' => $application,
+            'environment' => $environment,
+            'artifact' => $artifact,
+        ]);
+    }
+}

app/Http/Controllers/EnvironmentAttachmentController.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Environments\AttachManagedService;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\ServiceType;
+use App\Http\Requests\StoreEnvironmentAttachmentRequest;
+use App\Http\Requests\UpdateEnvironmentAttachmentRequest;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class EnvironmentAttachmentController extends Controller
+{
+    public function create(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        return inertia('environment-attachments/Create', [
+            'application' => $application,
+            'environment' => $environment,
+            'services' => $organisation->services()
+                ->whereIn('type', [ServiceType::POSTGRES->value, ServiceType::VALKEY->value, ServiceType::CADDY->value])
+                ->orderBy('name')
+                ->get(['id', 'name', 'type', 'category']),
+            'roles' => array_values(EnvironmentAttachmentRole::toArray()),
+            'compatibility' => [
+                EnvironmentAttachmentRole::DATABASE->value => [ServiceType::POSTGRES->value],
+                EnvironmentAttachmentRole::CACHE->value => [ServiceType::VALKEY->value],
+                EnvironmentAttachmentRole::QUEUE->value => [ServiceType::VALKEY->value],
+                EnvironmentAttachmentRole::GATEWAY->value => [ServiceType::CADDY->value],
+            ],
+        ]);
+    }
+
+    public function store(StoreEnvironmentAttachmentRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $service = $organisation->services()->findOrFail($request->integer('service_id'));
+
+        $attachment = app(AttachManagedService::class)->execute(
+            environment: $environment,
+            service: $service,
+            role: $request->enum('role', EnvironmentAttachmentRole::class),
+            name: $request->filled('name') ? $request->string('name')->toString() : null,
+            envPrefix: $request->filled('env_prefix') ? $request->string('env_prefix')->toString() : null,
+            isPrimary: $request->boolean('is_primary', true),
+        );
+
+        if ($request->enum('role', EnvironmentAttachmentRole::class) === EnvironmentAttachmentRole::GATEWAY && $attachment->serviceSlice) {
+            $attachment->serviceSlice->update([
+                'config' => [
+                    ...($attachment->serviceSlice->config ?? []),
+                    'domain' => $request->filled('domain') ? $request->string('domain')->toString() : null,
+                    'path_prefix' => $request->filled('path_prefix') ? $request->string('path_prefix')->toString() : '/',
+                    'tls_enabled' => $request->boolean('tls_enabled', true),
+                ],
+            ]);
+        }
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Managed service attached.');
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $attachment = $environment->attachments()
+            ->with(['service', 'serviceSlice'])
+            ->findOrFail($request->route('attachment'));
+
+        return inertia('environment-attachments/Edit', [
+            'application' => $application,
+            'environment' => $environment,
+            'attachment' => $attachment,
+            'roles' => array_values(EnvironmentAttachmentRole::toArray()),
+        ]);
+    }
+
+    public function update(UpdateEnvironmentAttachmentRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $attachment = $environment->attachments()->findOrFail($request->route('attachment'));
+
+        $attachment->update([
+            'role' => $request->enum('role', EnvironmentAttachmentRole::class),
+            'env_prefix' => $request->filled('env_prefix') ? $request->string('env_prefix')->toString() : null,
+            'is_primary' => $request->boolean('is_primary'),
+        ]);
+
+        if ($attachment->serviceSlice && $request->enum('role', EnvironmentAttachmentRole::class) === EnvironmentAttachmentRole::GATEWAY) {
+            $attachment->serviceSlice->update([
+                'config' => [
+                    ...($attachment->serviceSlice->config ?? []),
+                    'domain' => $request->filled('domain') ? $request->string('domain')->toString() : null,
+                    'path_prefix' => $request->filled('path_prefix') ? $request->string('path_prefix')->toString() : '/',
+                    'tls_enabled' => $request->boolean('tls_enabled', true),
+                    'certificate_status' => $request->filled('certificate_status') ? $request->string('certificate_status')->toString() : null,
+                ],
+            ]);
+        }
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Attachment updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $attachment = $environment->attachments()->findOrFail($request->route('attachment'));
+
+        $attachment->delete();
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Attachment detached.');
+    }
+}

app/Http/Controllers/EnvironmentController.php

@@ -2,28 +2,206 @@
 
 namespace App\Http\Controllers;
 
-use App\Enums\ServerStatus;
+use App\Actions\Applications\CreateLaravelEnvironment;
+use App\Enums\BuildStrategy;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\SchedulerMode;
+use App\Enums\ServiceType;
+use App\Http\Requests\StoreEnvironmentRequest;
+use App\Http\Requests\UpdateEnvironmentRequest;
 use App\Models\Environment;
+use App\Models\Organisation;
+use App\Support\CaddyRouteRenderer;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+use Inertia\Response;
 
 class EnvironmentController extends Controller
 {
-    public function show(Request $request)
+    public function create(Request $request): Response
     {
-        $id = $request->route('environment');
-        $environment = Environment::with('application')->findOrFail($id);
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
 
-        return inertia('environments/Show', [
-            'environment' => $environment,
-            'servers' => inertia()->optional(function () use ($environment) {
-                return $environment
-                    ->application
-                    ?->organisation
-                    ?->servers()
-                    ->where('status', ServerStatus::ACTIVE)
-                    ->with('services')
-                    ->get() ?? [];
-            }),
+        return inertia('environments/Create', [
+            'application' => $application,
         ]);
     }
+
+    public function store(StoreEnvironmentRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+
+        $environment = app(CreateLaravelEnvironment::class)->execute(
+            application: $application,
+            name: $request->string('name')->toString(),
+            branch: $request->string('branch')->toString(),
+            phpVersion: $request->string('php_version')->toString(),
+        );
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Environment created.');
+    }
+
+    public function show(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()
+            ->with([
+                'services.replicas',
+                'services.endpoints',
+                'services.slices',
+                'services.operations.steps',
+                'attachments.service',
+                'attachments.serviceSlice',
+                'variables',
+                'buildArtifacts.builtByService',
+                'operations.steps',
+                'operations.children.target',
+            ])
+            ->findOrFail($request->route('environment'));
+
+        $serverCount = $this->serverIdsFor($environment)->count();
+
+        return inertia('environments/Show', [
+            'application' => $application,
+            'environment' => $environment,
+            'deploymentRequirements' => [
+                'registryRequired' => $organisation->registries()->doesntExist() && $serverCount > 1,
+                'registryCount' => $organisation->registries()->count(),
+                'serverCount' => $serverCount,
+            ],
+            'gatewayRoutePreviews' => $this->gatewayRoutePreviews($environment),
+        ]);
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()
+            ->with('services')
+            ->findOrFail($request->route('environment'));
+
+        return inertia('environments/Edit', [
+            'application' => $application,
+            'environment' => $environment,
+            'schedulerModes' => array_values(SchedulerMode::toArray()),
+            'buildStrategies' => array_values(BuildStrategy::toArray()),
+        ]);
+    }
+
+    public function update(UpdateEnvironmentRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()
+            ->with('services')
+            ->findOrFail($request->route('environment'));
+
+        $schedulerTargetServiceId = $request->integer('scheduler_target_service_id') ?: null;
+
+        if ($schedulerTargetServiceId !== null) {
+            abort_unless($environment->services()->whereKey($schedulerTargetServiceId)->exists(), 422);
+        }
+
+        $environment->update([
+            'name' => $request->string('name')->toString(),
+            'branch' => $request->string('branch')->toString(),
+            'status' => $request->string('status')->toString(),
+            'scheduler_enabled' => $request->boolean('scheduler_enabled'),
+            'scheduler_target_service_id' => $schedulerTargetServiceId,
+            'scheduler_mode' => $request->enum('scheduler_mode', SchedulerMode::class),
+            'build_config' => [
+                ...($environment->build_config ?? []),
+                'build_strategy' => $request->enum('build_strategy', BuildStrategy::class)?->value,
+                'php_version' => $request->string('php_version')->toString(),
+                'document_root' => $request->string('document_root')->toString(),
+                'health_path' => $request->string('health_path')->toString(),
+                'js_package_manager' => $request->string('js_package_manager')->toString(),
+                'js_build_command' => $request->filled('js_build_command')
+                    ? $request->string('js_build_command')->toString()
+                    : null,
+            ],
+        ]);
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Environment updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        $environment->delete();
+
+        return redirect()
+            ->route('applications.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+            ])
+            ->with('success', 'Environment deleted.');
+    }
+
+    /**
+     * @return \Illuminate\Support\Collection<int, int>
+     */
+    private function serverIdsFor(Environment $environment): Collection
+    {
+        return $environment->services
+            ->flatMap(fn ($service) => [
+                $service->server_id,
+                ...$service->replicas->pluck('server_id')->all(),
+            ])
+            ->filter()
+            ->unique()
+            ->values();
+    }
+
+    /**
+     * @return Collection<int, array{attachment_id: int, caddyfile: string}>
+     */
+    private function gatewayRoutePreviews(Environment $environment): Collection
+    {
+        $upstreams = $this->previewGatewayUpstreams($environment);
+        $renderer = app(CaddyRouteRenderer::class);
+
+        return $environment->attachments
+            ->filter(fn ($attachment): bool => $attachment->role === EnvironmentAttachmentRole::GATEWAY)
+            ->map(fn ($attachment): array => [
+                'attachment_id' => $attachment->id,
+                'caddyfile' => $renderer->render($attachment, $upstreams),
+            ])
+            ->values();
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function previewGatewayUpstreams(Environment $environment): array
+    {
+        return $environment->services
+            ->filter(fn ($service): bool => $service->type === ServiceType::LARAVEL && in_array('web', $service->process_roles ?? [], true))
+            ->flatMap(fn ($service) => $service->replicas->map(
+                fn ($replica): string => ($replica->internal_host ?: $replica->container_name).':'.($replica->internal_port ?: 80)
+            ))
+            ->values()
+            ->whenEmpty(fn ($upstreams) => $upstreams->push('web:80'))
+            ->all();
+    }
 }

app/Http/Controllers/EnvironmentDeploymentController.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\StoreEnvironmentDeploymentRequest;
+use App\Jobs\Environments\DeployEnvironment;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Collection;
+
+class EnvironmentDeploymentController extends Controller
+{
+    public function store(StoreEnvironmentDeploymentRequest $request, Organisation $organisation, Application $application, Environment $environment): RedirectResponse
+    {
+        abort_unless(
+            (int) $application->organisation_id === (int) $organisation->id
+            && (int) $environment->application_id === (int) $application->id,
+            404,
+        );
+
+        $environment->loadMissing('services.replicas');
+
+        if ($organisation->registries()->doesntExist() && $this->serverIdsFor($environment)->count() > 1) {
+            return back()->with('error', 'Configure a registry before deploying this environment to multiple servers.');
+        }
+
+        dispatch(new DeployEnvironment(
+            environment: $environment,
+            targetCommit: $request->validated('target_commit') ?: null,
+        ));
+
+        return redirect()->route('environments.show', [
+            'organisation' => $organisation->id,
+            'application' => $application->id,
+            'environment' => $environment->id,
+        ]);
+    }
+
+    /**
+     * @return \Illuminate\Support\Collection<int, int>
+     */
+    private function serverIdsFor(Environment $environment): Collection
+    {
+        return $environment->services
+            ->flatMap(fn ($service) => [
+                $service->server_id,
+                ...$service->replicas->pluck('server_id')->all(),
+            ])
+            ->filter()
+            ->unique()
+            ->values();
+    }
+}

app/Http/Controllers/EnvironmentIndexController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Organisation;
+use Inertia\Response;
+
+class EnvironmentIndexController extends Controller
+{
+    public function __invoke(Organisation $organisation): Response
+    {
+        $applications = $organisation->applications()
+            ->with([
+                'environments' => fn ($query) => $query
+                    ->withCount(['services', 'attachments', 'variables', 'buildArtifacts'])
+                    ->latest(),
+            ])
+            ->get();
+
+        return inertia('environments/Index', [
+            'applications' => $applications,
+        ]);
+    }
+}

app/Http/Controllers/EnvironmentMigrationController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Environments\CreateMigrationOperation;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class EnvironmentMigrationController extends Controller
+{
+    public function store(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        app(CreateMigrationOperation::class)->execute($environment);
+
+        return redirect()
+            ->route('applications.show', ['organisation' => $organisation->id, 'application' => $application->id])
+            ->with('success', 'Migration operation created.');
+    }
+}

app/Http/Controllers/EnvironmentVariableController.php

@@ -0,0 +1,188 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\EnvironmentVariableSource;
+use App\Http\Requests\ImportEnvironmentVariablesRequest;
+use App\Http\Requests\StoreEnvironmentVariableRequest;
+use App\Http\Requests\UpdateEnvironmentVariableRequest;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class EnvironmentVariableController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        return inertia('environment-variables/Index', [
+            'application' => $application,
+            'environment' => $environment,
+            'variables' => $environment->variables()
+                ->with('serviceSlice')
+                ->orderBy('key')
+                ->get(),
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        return inertia('environment-variables/Create', [
+            'application' => $application,
+            'environment' => $environment,
+        ]);
+    }
+
+    public function store(StoreEnvironmentVariableRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        $environment->variables()->updateOrCreate([
+            'key' => $request->string('key')->toString(),
+        ], [
+            'value' => $request->string('value')->toString(),
+            'source' => EnvironmentVariableSource::USER,
+            'service_slice_id' => null,
+            'overridable' => $request->boolean('overridable', true),
+        ]);
+
+        return redirect()
+            ->route('environments.show', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Environment variable saved.');
+    }
+
+    public function import(ImportEnvironmentVariablesRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $count = 0;
+
+        foreach ($this->parseDotEnv($request->string('contents')->toString()) as $key => $value) {
+            $environment->variables()->updateOrCreate([
+                'key' => $key,
+            ], [
+                'value' => $value,
+                'source' => EnvironmentVariableSource::USER,
+                'service_slice_id' => null,
+                'overridable' => $request->boolean('overridable', true),
+            ]);
+
+            $count++;
+        }
+
+        return redirect()
+            ->route('environment-variables.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', "{$count} environment variables imported.");
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $variable = $environment->variables()->with('serviceSlice')->findOrFail($request->route('variable'));
+
+        return inertia('environment-variables/Edit', [
+            'application' => $application,
+            'environment' => $environment,
+            'variable' => $variable,
+        ]);
+    }
+
+    public function update(UpdateEnvironmentVariableRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $variable = $environment->variables()->findOrFail($request->route('variable'));
+
+        $variable->update([
+            'key' => $request->string('key')->toString(),
+            'value' => $request->string('value')->toString(),
+            'overridable' => $request->boolean('overridable'),
+        ]);
+
+        return redirect()
+            ->route('environment-variables.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Environment variable updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $variable = $environment->variables()->findOrFail($request->route('variable'));
+
+        $variable->delete();
+
+        return redirect()
+            ->route('environment-variables.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Environment variable deleted.');
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function parseDotEnv(string $contents): array
+    {
+        return collect(preg_split('/\R/', $contents) ?: [])
+            ->map(fn (string $line): string => trim($line))
+            ->reject(fn (string $line): bool => $line === '' || str_starts_with($line, '#'))
+            ->mapWithKeys(function (string $line): array {
+                if (str_starts_with($line, 'export ')) {
+                    $line = trim(substr($line, 7));
+                }
+
+                [$key, $value] = array_pad(explode('=', $line, 2), 2, '');
+                $key = trim($key);
+
+                if (! preg_match('/^[A-Z][A-Z0-9_]*$/', $key)) {
+                    return [];
+                }
+
+                return [$key => $this->unquoteDotEnvValue(trim($value))];
+            })
+            ->all();
+    }
+
+    private function unquoteDotEnvValue(string $value): string
+    {
+        if (str_starts_with($value, '"') && str_ends_with($value, '"')) {
+            return stripcslashes(substr($value, 1, -1));
+        }
+
+        if (str_starts_with($value, "'") && str_ends_with($value, "'")) {
+            return substr($value, 1, -1);
+        }
+
+        return $value;
+    }
+}

app/Http/Controllers/EnvironmentWorkerController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Environments\CreateLaravelWorkerService;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class EnvironmentWorkerController extends Controller
+{
+    public function store(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        app(CreateLaravelWorkerService::class)->execute($environment);
+
+        return redirect()
+            ->route('applications.show', ['organisation' => $organisation->id, 'application' => $application->id])
+            ->with('success', 'Worker service created.');
+    }
+}

app/Http/Controllers/GatewayRouteController.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Environments\AttachManagedService;
+use App\Enums\EnvironmentAttachmentRole;
+use App\Enums\ServiceType;
+use App\Http\Requests\StoreGatewayRouteRequest;
+use App\Http\Requests\UpdateGatewayRouteRequest;
+use App\Models\EnvironmentAttachment;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class GatewayRouteController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()
+            ->with(['attachments.service', 'attachments.serviceSlice'])
+            ->findOrFail($request->route('environment'));
+
+        return inertia('gateway-routes/Index', [
+            'application' => $application,
+            'environment' => $environment,
+            'routes' => $environment->attachments
+                ->filter(fn (EnvironmentAttachment $attachment): bool => $attachment->role === EnvironmentAttachmentRole::GATEWAY)
+                ->values(),
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+
+        return inertia('gateway-routes/Create', [
+            'application' => $application,
+            'environment' => $environment,
+            'services' => $organisation->services()
+                ->where('type', ServiceType::CADDY->value)
+                ->orderBy('name')
+                ->get(['id', 'name', 'type', 'category']),
+        ]);
+    }
+
+    public function store(StoreGatewayRouteRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $service = $organisation->services()
+            ->where('type', ServiceType::CADDY->value)
+            ->findOrFail($request->integer('service_id'));
+
+        $attachment = app(AttachManagedService::class)->execute(
+            environment: $environment,
+            service: $service,
+            role: EnvironmentAttachmentRole::GATEWAY,
+            name: $request->string('name')->toString(),
+            isPrimary: true,
+        );
+
+        $attachment->serviceSlice?->update([
+            'config' => [
+                ...($attachment->serviceSlice->config ?? []),
+                ...$this->routeConfig($request),
+                'certificate_status' => $request->boolean('tls_enabled', true) ? 'pending' : 'disabled',
+            ],
+        ]);
+
+        return redirect()
+            ->route('gateway.routes.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Gateway route created.');
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $route = $environment->attachments()
+            ->with(['service', 'serviceSlice'])
+            ->where('role', EnvironmentAttachmentRole::GATEWAY->value)
+            ->findOrFail($request->route('route'));
+
+        return inertia('gateway-routes/Edit', [
+            'application' => $application,
+            'environment' => $environment,
+            'routeAttachment' => $route,
+        ]);
+    }
+
+    public function update(UpdateGatewayRouteRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $route = $environment->attachments()
+            ->with('serviceSlice')
+            ->where('role', EnvironmentAttachmentRole::GATEWAY->value)
+            ->findOrFail($request->route('route'));
+
+        $route->serviceSlice?->update([
+            'config' => [
+                ...($route->serviceSlice->config ?? []),
+                ...$this->routeConfig($request),
+                'certificate_status' => $request->filled('certificate_status')
+                    ? $request->string('certificate_status')->toString()
+                    : ($request->boolean('tls_enabled', true) ? 'pending' : 'disabled'),
+            ],
+        ]);
+
+        return redirect()
+            ->route('gateway.routes.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Gateway route updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $route = $environment->attachments()
+            ->where('role', EnvironmentAttachmentRole::GATEWAY->value)
+            ->findOrFail($request->route('route'));
+
+        $route->delete();
+
+        return redirect()
+            ->route('gateway.routes.index', [
+                'organisation' => $organisation->id,
+                'application' => $application->id,
+                'environment' => $environment->id,
+            ])
+            ->with('success', 'Gateway route removed.');
+    }
+
+    /**
+     * @return array{domain: string, path_prefix: string, tls_enabled: bool}
+     */
+    private function routeConfig(StoreGatewayRouteRequest|UpdateGatewayRouteRequest $request): array
+    {
+        return [
+            'domain' => $request->string('domain')->toString(),
+            'path_prefix' => $request->string('path_prefix')->toString(),
+            'tls_enabled' => $request->boolean('tls_enabled', true),
+        ];
+    }
+}

app/Http/Controllers/OnboardingController.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Organisation;
+use Inertia\Response;
+
+class OnboardingController extends Controller
+{
+    public function show(Organisation $organisation): Response
+    {
+        $organisation->loadCount(['providers', 'sourceProviders', 'registries', 'servers', 'applications']);
+
+        $applicationNeedingDeployKey = $organisation->applications()
+            ->whereNull('deploy_key_installed_at')
+            ->first();
+
+        $steps = [
+            [
+                'key' => 'organisation',
+                'label' => 'Organisation',
+                'complete' => true,
+                'href' => route('organisations.show', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'provider',
+                'label' => 'Provider',
+                'complete' => $organisation->providers_count > 0,
+                'href' => route('organisations.show', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'source',
+                'label' => 'Source',
+                'complete' => $organisation->source_providers_count > 0,
+                'href' => route('source-providers.create', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'registry',
+                'label' => 'Registry',
+                'complete' => $organisation->registries_count > 0,
+                'href' => route('registries.create', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'server',
+                'label' => 'Server',
+                'complete' => $organisation->servers_count > 0,
+                'href' => route('servers.create', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'application',
+                'label' => 'Application',
+                'complete' => $organisation->applications_count > 0,
+                'href' => route('applications.create', ['organisation' => $organisation->id]),
+            ],
+            [
+                'key' => 'deploy-key',
+                'label' => 'Deploy key',
+                'complete' => $organisation->applications_count === 0 || $applicationNeedingDeployKey === null,
+                'href' => $applicationNeedingDeployKey
+                    ? route('applications.show', [
+                        'organisation' => $organisation->id,
+                        'application' => $applicationNeedingDeployKey->id,
+                    ])
+                    : route('applications.index', ['organisation' => $organisation->id]),
+            ],
+        ];
+
+        $next = collect($steps)->firstWhere('complete', false) ?? $steps[array_key_last($steps)];
+
+        return inertia('onboarding/Show', [
+            'organisation' => $organisation,
+            'steps' => $steps,
+            'nextStep' => $next,
+        ]);
+    }
+}

app/Http/Controllers/OperationController.php

@@ -0,0 +1,171 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Operation;
+use App\Models\Organisation;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceReplica;
+use App\Models\ServiceSlice;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class OperationController extends Controller
+{
+    public function index(Request $request, Organisation $organisation): Response
+    {
+        $applicationIds = $organisation->applications()->pluck('id');
+        $environmentIds = Environment::query()
+            ->whereIn('application_id', $applicationIds)
+            ->pluck('id');
+        $serverIds = $organisation->servers()->pluck('id');
+        $serviceIds = $organisation->services()->pluck('id');
+        $replicaIds = ServiceReplica::query()
+            ->whereIn('service_id', $serviceIds)
+            ->pluck('id');
+        $sliceIds = ServiceSlice::query()
+            ->whereIn('service_id', $serviceIds)
+            ->pluck('id');
+
+        $operations = Operation::query()
+            ->with(['target', 'parent', 'children.target'])
+            ->withCount('steps', 'children')
+            ->where(function (Builder $query) use ($applicationIds, $environmentIds, $serverIds, $serviceIds, $replicaIds, $sliceIds): void {
+                $query
+                    ->where(function (Builder $query) use ($applicationIds): void {
+                        $query->where('target_type', (new Application)->getMorphClass())
+                            ->whereIn('target_id', $applicationIds);
+                    })
+                    ->orWhere(function (Builder $query) use ($environmentIds): void {
+                        $query->where('target_type', (new Environment)->getMorphClass())
+                            ->whereIn('target_id', $environmentIds);
+                    })
+                    ->orWhere(function (Builder $query) use ($serverIds): void {
+                        $query->where('target_type', (new Server)->getMorphClass())
+                            ->whereIn('target_id', $serverIds);
+                    })
+                    ->orWhere(function (Builder $query) use ($serviceIds): void {
+                        $query->where('target_type', (new Service)->getMorphClass())
+                            ->whereIn('target_id', $serviceIds);
+                    })
+                    ->orWhere(function (Builder $query) use ($replicaIds): void {
+                        $query->where('target_type', (new ServiceReplica)->getMorphClass())
+                            ->whereIn('target_id', $replicaIds);
+                    })
+                    ->orWhere(function (Builder $query) use ($sliceIds): void {
+                        $query->where('target_type', (new ServiceSlice)->getMorphClass())
+                            ->whereIn('target_id', $sliceIds);
+                    });
+            })
+            ->when($request->filled('kind'), fn (Builder $query) => $query->where('kind', $request->string('kind')->toString()))
+            ->when($request->filled('status'), fn (Builder $query) => $query->where('status', $request->string('status')->toString()))
+            ->latest()
+            ->paginate(30)
+            ->withQueryString();
+
+        return inertia('operations/Index', [
+            'operations' => $operations,
+            'filters' => $request->only(['kind', 'status']),
+            'operationKinds' => OperationKind::toArray(),
+            'operationStatuses' => OperationStatus::toArray(),
+        ]);
+    }
+
+    public function show(Organisation $organisation, Operation $operation): Response
+    {
+        abort_unless($this->operationBelongsToOrganisation($operation, $organisation), 404);
+
+        $operation->load([
+            'target',
+            'parent.target',
+            'children.target',
+            'children.steps',
+            'steps',
+        ]);
+
+        return inertia('operations/Show', [
+            'operation' => $operation,
+        ]);
+    }
+
+    public function retry(Organisation $organisation, Operation $operation): RedirectResponse
+    {
+        abort_unless($this->operationBelongsToOrganisation($operation, $organisation), 404);
+
+        $operation->update([
+            'status' => OperationStatus::PENDING,
+            'started_at' => null,
+            'finished_at' => null,
+        ]);
+
+        return redirect()
+            ->route('operations.show', [
+                'organisation' => $organisation->id,
+                'operation' => $operation->id,
+            ])
+            ->with('success', 'Operation queued to run again.');
+    }
+
+    public function cancel(Organisation $organisation, Operation $operation): RedirectResponse
+    {
+        abort_unless($this->operationBelongsToOrganisation($operation, $organisation), 404);
+
+        $operation->update([
+            'status' => OperationStatus::CANCELLED,
+            'finished_at' => now(),
+        ]);
+
+        return redirect()
+            ->route('operations.show', [
+                'organisation' => $organisation->id,
+                'operation' => $operation->id,
+            ])
+            ->with('success', 'Operation cancelled.');
+    }
+
+    public function downloadLogs(Organisation $organisation, Operation $operation): StreamedResponse
+    {
+        abort_unless($this->operationBelongsToOrganisation($operation, $organisation), 404);
+
+        $operation->load('steps');
+
+        return response()->streamDownload(function () use ($operation): void {
+            foreach ($operation->steps as $step) {
+                echo "# {$step->name}\n\n";
+
+                if ($step->logs) {
+                    echo "## Logs\n{$step->logs}\n\n";
+                }
+
+                if ($step->error_logs) {
+                    echo "## Error Logs\n{$step->error_logs}\n\n";
+                }
+            }
+        }, "operation-{$operation->hash}.log", [
+            'Content-Type' => 'text/plain',
+        ]);
+    }
+
+    private function operationBelongsToOrganisation(Operation $operation, Organisation $organisation): bool
+    {
+        $target = $operation->target;
+
+        return match (true) {
+            $target instanceof Application => $target->organisation_id === $organisation->id,
+            $target instanceof Environment => $target->application()->where('organisation_id', $organisation->id)->exists(),
+            $target instanceof Server => $target->organisation_id === $organisation->id,
+            $target instanceof Service => $target->organisation_id === $organisation->id,
+            $target instanceof ServiceReplica => $target->service()->where('organisation_id', $organisation->id)->exists(),
+            $target instanceof ServiceSlice => $target->service()->where('organisation_id', $organisation->id)->exists(),
+            default => false,
+        };
+    }
+}

app/Http/Controllers/OrganisationController.php

@@ -2,8 +2,11 @@
 
 namespace App\Http\Controllers;
 
+use App\Enums\ServiceStatus;
+use App\Models\Operation;
 use App\Models\Organisation;
 use App\Models\Provider;
+use App\Models\Service;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
 
@@ -13,7 +16,25 @@ class OrganisationController extends Controller
     {
         return inertia('organisations/Show', [
             'providers' => Inertia::lazy(fn () => Provider::whereOrganisationId($request->route('organisation'))->get()),
-            'organisation' => Organisation::withCount('servers', 'applications', 'members')->findOrFail($request->route('organisation')),
+            'registries' => Inertia::lazy(fn () => Organisation::findOrFail($request->route('organisation'))->registries()->get()),
+            'sourceProviders' => Inertia::lazy(fn () => Organisation::findOrFail($request->route('organisation'))->sourceProviders()->get()),
+            'organisation' => Organisation::with('members')
+                ->withCount('servers', 'applications', 'members', 'providers', 'sourceProviders', 'registries')
+                ->findOrFail($request->route('organisation')),
+            'health' => [
+                'unhealthy_services' => Service::query()
+                    ->where('organisation_id', $request->route('organisation'))
+                    ->whereNot('status', ServiceStatus::RUNNING)
+                    ->count(),
+                'failed_operations' => Operation::query()
+                    ->whereHasMorph('target', [Service::class], fn ($query) => $query->where('organisation_id', $request->route('organisation')))
+                    ->where('status', 'failed')
+                    ->count(),
+                'locked_variables' => Organisation::findOrFail($request->route('organisation'))
+                    ->applications()
+                    ->whereHas('environments.variables', fn ($query) => $query->where('overridable', false))
+                    ->count(),
+            ],
         ]);
     }
 }

app/Http/Controllers/OrganisationMemberController.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\OrganisationRole;
+use App\Http\Requests\StoreOrganisationMemberRequest;
+use App\Http\Requests\UpdateOrganisationInvitationRequest;
+use App\Http\Requests\UpdateOrganisationMemberRequest;
+use App\Models\Organisation;
+use App\Models\OrganisationInvitation;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Inertia\Response;
+
+class OrganisationMemberController extends Controller
+{
+    public function index(Organisation $organisation): Response
+    {
+        return inertia('organisation-members/Index', [
+            'organisation' => $organisation->load(['members', 'invitations.invitedBy']),
+            'roles' => array_values(OrganisationRole::toArray()),
+        ]);
+    }
+
+    public function store(StoreOrganisationMemberRequest $request, Organisation $organisation): RedirectResponse
+    {
+        $email = Str::lower($request->string('email')->toString());
+        $user = User::query()
+            ->where('email', $email)
+            ->first();
+
+        if ($user === null) {
+            abort_if(
+                $organisation->invitations()->where('email', $email)->whereNull('accepted_at')->exists(),
+                422,
+                'This email already has a pending invitation.'
+            );
+
+            $organisation->invitations()->create([
+                'email' => $email,
+                'role' => $request->enum('role', OrganisationRole::class),
+                'token' => Str::random(40),
+                'invited_by_user_id' => $request->user()?->id,
+                'expires_at' => now()->addDays(14),
+            ]);
+
+            return redirect()
+                ->route('organisation-members.index', ['organisation' => $organisation->id])
+                ->with('success', 'Invitation created.');
+        }
+
+        $organisation->members()->syncWithoutDetaching([
+            $user->id => ['role' => $request->enum('role', OrganisationRole::class)],
+        ]);
+
+        $organisation->invitations()
+            ->where('email', $email)
+            ->delete();
+
+        return redirect()
+            ->route('organisation-members.index', ['organisation' => $organisation->id])
+            ->with('success', 'Member added.');
+    }
+
+    public function update(UpdateOrganisationMemberRequest $request, Organisation $organisation, User $member): RedirectResponse
+    {
+        abort_unless($organisation->members()->whereKey($member->id)->exists(), 404);
+
+        $organisation->members()->updateExistingPivot($member->id, [
+            'role' => $request->enum('role', OrganisationRole::class),
+        ]);
+
+        return redirect()
+            ->route('organisation-members.index', ['organisation' => $organisation->id])
+            ->with('success', 'Member role updated.');
+    }
+
+    public function updateInvitation(
+        UpdateOrganisationInvitationRequest $request,
+        Organisation $organisation,
+        OrganisationInvitation $invitation
+    ): RedirectResponse {
+        abort_unless($invitation->organisation_id === $organisation->id, 404);
+
+        $invitation->update([
+            'role' => $request->enum('role', OrganisationRole::class),
+        ]);
+
+        return redirect()
+            ->route('organisation-members.index', ['organisation' => $organisation->id])
+            ->with('success', 'Invitation role updated.');
+    }
+
+    public function destroy(Request $request, Organisation $organisation, User $member): RedirectResponse
+    {
+        abort_if($organisation->owner_id === $member->id, 422, 'The organisation owner cannot be removed.');
+
+        $organisation->members()->detach($member->id);
+
+        return redirect()
+            ->route('organisation-members.index', ['organisation' => $organisation->id])
+            ->with('success', 'Member removed.');
+    }
+
+    public function destroyInvitation(
+        Request $request,
+        Organisation $organisation,
+        OrganisationInvitation $invitation
+    ): RedirectResponse {
+        abort_unless($invitation->organisation_id === $organisation->id, 404);
+
+        $invitation->delete();
+
+        return redirect()
+            ->route('organisation-members.index', ['organisation' => $organisation->id])
+            ->with('success', 'Invitation cancelled.');
+    }
+}

app/Http/Controllers/ProviderController.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\ProviderType;
+use App\Http\Requests\StoreProviderRequest;
+use App\Models\Organisation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class ProviderController extends Controller
+{
+    public function create(Request $request): Response
+    {
+        Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('providers/Create', [
+            'providerTypes' => array_values(ProviderType::toArray()),
+        ]);
+    }
+
+    public function store(StoreProviderRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        $organisation->providers()->create([
+            'name' => $request->string('name')->toString(),
+            'type' => $request->enum('type', ProviderType::class),
+            'token' => $request->string('token')->toString(),
+        ]);
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Server provider created.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $provider = $organisation->providers()->findOrFail($request->route('provider'));
+
+        $provider->delete();
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Server provider deleted.');
+    }
+}

app/Http/Controllers/ProvisionCallback.php

@@ -2,7 +2,6 @@
 
 namespace App\Http\Controllers;
 
-use App\Actions\Servers\SyncWireguardRules;
 use App\Enums\ServerStatus;
 use App\Events\Servers\ServerProvisioned;
 use App\Models\Server;
@@ -15,7 +14,6 @@ class ProvisionCallback extends Controller
     {
         $validated = $request->validate([
             'server_id' => ['required', 'integer', 'exists:servers,id'],
-            'internal_public_key' => ['required', 'string'],
         ]);
 
         $server = Server::find($validated['server_id']);
@@ -41,11 +39,11 @@ class ProvisionCallback extends Controller
 
         $server->update([
             'status' => ServerStatus::ACTIVE,
-            'internal_public_key' => $validated['internal_public_key'],
         ]);
 
         $server->organisation->servers()->each(function ($s) {
-            app(SyncWireguardRules::class)->onQueue()->execute($s);
+            // app(SyncWireguardRules::class)->onQueue()->execute($s);
+            // @todo change this to a sync ufw rules class
         });
 
         event(new ServerProvisioned($server));

app/Http/Controllers/RegistryController.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\RegistryType;
+use App\Http\Requests\StoreRegistryRequest;
+use App\Http\Requests\UpdateRegistryRequest;
+use App\Models\BuildArtifact;
+use App\Models\Organisation;
+use App\Models\Registry;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class RegistryController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('registries/Index', [
+            'registries' => $organisation->registries()
+                ->latest()
+                ->get(),
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('registries/Create', [
+            'registryTypes' => array_values(RegistryType::toArray()),
+        ]);
+    }
+
+    public function store(StoreRegistryRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        $organisation->registries()->create([
+            'name' => $request->string('name')->toString(),
+            'type' => $request->enum('type', RegistryType::class),
+            'url' => rtrim($request->string('url')->toString(), '/'),
+            'credentials' => [
+                'username' => $request->string('username')->toString(),
+                'password' => $request->string('password')->toString(),
+            ],
+        ]);
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Registry created.');
+    }
+
+    public function show(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        /** @var Registry $registry */
+        $registry = $organisation->registries()->findOrFail($request->route('registry'));
+        $registryUrl = rtrim((string) $registry->url, '/');
+        $artifacts = BuildArtifact::query()
+            ->with(['environment.application', 'builtByService'])
+            ->whereHas('environment.application', fn ($query) => $query->where('organisation_id', $organisation->id))
+            ->when($registryUrl !== '', fn ($query) => $query->where('registry_ref', 'like', $registryUrl.'%'));
+
+        return inertia('registries/Show', [
+            'registry' => $registry,
+            'artifactCount' => (clone $artifacts)->count(),
+            'environmentCount' => (clone $artifacts)->distinct('environment_id')->count('environment_id'),
+            'artifacts' => $artifacts
+                ->latest()
+                ->paginate(20),
+        ]);
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $registry = $organisation->registries()->findOrFail($request->route('registry'));
+
+        return inertia('registries/Edit', [
+            'registry' => $registry,
+            'registryTypes' => array_values(RegistryType::toArray()),
+        ]);
+    }
+
+    public function update(UpdateRegistryRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        /** @var Registry $registry */
+        $registry = $organisation->registries()->findOrFail($request->route('registry'));
+
+        $credentials = $registry->credentials ?? [];
+        $username = $request->string('username')->toString();
+
+        if ($request->filled('password')) {
+            $credentials['password'] = $request->string('password')->toString();
+        }
+
+        $credentials['username'] = $username;
+
+        $registry->update([
+            'name' => $request->string('name')->toString(),
+            'type' => $request->enum('type', RegistryType::class),
+            'url' => rtrim($request->string('url')->toString(), '/'),
+            'credentials' => $credentials,
+        ]);
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Registry updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $registry = $organisation->registries()->findOrFail($request->route('registry'));
+
+        $registry->delete();
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Registry deleted.');
+    }
+}

app/Http/Controllers/ServerController.php

@@ -3,27 +3,33 @@
 namespace App\Http\Controllers;
 
 use App\Actions\GenerateRandomSlug;
-use App\Enums\NetworkType;
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
 use App\Enums\ServerStatus;
 use App\Jobs\Servers\WaitForServerToConnect;
 use App\Models\Organisation;
 use App\Models\Provider;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Str;
+use Inertia\Response;
 
 class ServerController extends Controller
 {
-    public function index(Request $request)
+    public function index(Request $request): Response
     {
         $organisation = Organisation::findOrFail($request->route('organisation'));
 
         return inertia('servers/Index', [
             'servers' => $organisation->servers()->paginate(30),
+            'networks' => $organisation->networks()
+                ->with(['servers' => fn ($query) => $query->select('id', 'network_id', 'name', 'private_ip', 'status')])
+                ->get(),
         ]);
     }
 
-    public function create(Request $request)
+    public function create(Request $request): Response
     {
         $organisation = Organisation::findOrFail($request->route('organisation'));
 
@@ -56,7 +62,7 @@ class ServerController extends Controller
         ]);
     }
 
-    public function store(Request $request)
+    public function store(Request $request): RedirectResponse
     {
         $request->validate([
             'provider' => ['required', 'exists:providers,id'],
@@ -76,12 +82,12 @@ class ServerController extends Controller
         }
 
         $networkZone = $request->network_zone ?? 'global';
-        
+
         // Look for an existing network with the same network_zone
         $network = $provider->networks()
             ->where('network_zone', $networkZone)
             ->first();
-            
+
         if (! $network) {
             // We need to create a network with the correct network zone
             $networkName = "keystone-{$networkZone}";
@@ -93,7 +99,6 @@ class ServerController extends Controller
             $network = $provider->networks()->create([
                 'organisation_id' => $provider->organisation_id,
                 'external_id' => $createdNetwork->id,
-                'type' => NetworkType::EXTERNAL,
                 'name' => $createdNetwork->name,
                 'ip_range' => $createdNetwork->ipRange,
                 'network_zone' => $networkZone,
@@ -123,7 +128,7 @@ class ServerController extends Controller
             'os' => $request->image,
             'plan' => $request->server_type,
             'user' => 'keystone',
-            'external_network_id' => $network->id,
+            'network_id' => $network->id,
         ]);
 
         dispatch(new WaitForServerToConnect(
@@ -137,13 +142,63 @@ class ServerController extends Controller
         return redirect()->route('servers.show', ['organisation' => $organisation->id, 'server' => $server->id]);
     }
 
-    public function show(Request $request)
+    public function show(Request $request): Response
     {
         $organisation = Organisation::findOrFail($request->route('organisation'));
         $server = $organisation->servers()->findOrFail($request->route('server'));
 
         return inertia('servers/Show', [
-            'server' => $server->load('services.slices'),
+            'server' => $server->load(
+                'firewallRules',
+                'network',
+                'operations.steps',
+                'operations.children.target',
+                'services.slices',
+                'services.endpoints',
+                'serviceOperations.steps',
+                'serviceOperations.children.target',
+                'serviceOperations.target',
+            ),
         ]);
     }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+
+        $server->delete();
+
+        return redirect()
+            ->route('servers.index', ['organisation' => $organisation->id])
+            ->with('success', 'Server deleted.');
+    }
+
+    public function heal(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+
+        $operation = $server->operations()->create([
+            'kind' => OperationKind::SERVER_PROVISION,
+            'status' => OperationStatus::PENDING,
+        ]);
+
+        foreach ([
+            'Check server shell' => 'true',
+            'Check Docker' => 'docker --version && docker compose version',
+            'Check Keystone directories' => 'test -d /home/keystone && test -d /home/keystone/services',
+        ] as $order => $script) {
+            $operation->steps()->create([
+                'name' => $order,
+                'order' => $operation->steps()->count() + 1,
+                'status' => OperationStatus::PENDING,
+                'script' => $script,
+            ]);
+        }
+
+        return redirect()
+            ->route('servers.show', ['organisation' => $organisation->id, 'server' => $server->id])
+            ->with('success', 'Server heal operation queued.');
+    }
 }

app/Http/Controllers/ServerFirewallRuleController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\FirewallRules\UninstallFirewallRule;
+use App\Http\Requests\StoreServerFirewallRuleRequest;
+use App\Models\FirewallRule;
+use App\Models\Organisation;
+use App\Models\Server;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class ServerFirewallRuleController extends Controller
+{
+    public function store(StoreServerFirewallRuleRequest $request, Organisation $organisation, Server $server): RedirectResponse
+    {
+        abort_unless((int) $server->organisation_id === (int) $organisation->id, 404);
+
+        $server->firewallRules()->create($request->validated());
+
+        return redirect()
+            ->route('servers.show', [$organisation, $server])
+            ->with('success', 'Firewall rule queued for installation.');
+    }
+
+    public function destroy(Request $request, Organisation $organisation, Server $server, FirewallRule $firewallRule, UninstallFirewallRule $uninstallFirewallRule): RedirectResponse
+    {
+        abort_unless(
+            (int) $server->organisation_id === (int) $organisation->id
+            && (int) $firewallRule->server_id === (int) $server->id,
+            404,
+        );
+
+        $uninstallFirewallRule->execute($firewallRule);
+        $firewallRule->delete();
+
+        return redirect()
+            ->route('servers.show', [$organisation, $server])
+            ->with('success', 'Firewall rule removed.');
+    }
+}

app/Http/Controllers/ServiceController.php

@@ -3,15 +3,20 @@
 namespace App\Http\Controllers;
 
 use App\Actions\Services\CreateService;
+use App\Enums\DeployPolicy;
 use App\Enums\ServiceCategory;
 use App\Enums\ServiceType;
+use App\Http\Requests\StoreServiceRequest;
+use App\Http\Requests\UpdateServiceRequest;
+use App\Models\Organisation;
 use App\Models\Server;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
-use Illuminate\Validation\Rule;
+use Inertia\Response;
 
 class ServiceController extends Controller
 {
-    public function create(Request $request)
+    public function create(Request $request): Response
     {
         $server = Server::findOrFail($request->route('server'));
 
@@ -21,19 +26,8 @@ class ServiceController extends Controller
         ]);
     }
 
-    public function store(Request $request)
+    public function store(StoreServiceRequest $request): RedirectResponse
     {
-        $request->validate([
-            'name' => ['required', 'string', 'max:255'],
-            'category' => ['required', Rule::enum(ServiceCategory::class)],
-            'type' => ['required', Rule::enum(ServiceType::class)],
-            'version' => ['required', 'string', function ($key, $value, $fail) use ($request) {
-                if (!isset(config('keystone.services')[$request->category][$request->type]['versions'][$value])) {
-                    $fail('The selected version is invalid.');
-                }
-            }],
-        ]);
-
         $server = Server::findOrFail($request->route('server'));
 
         $service = app(CreateService::class)->execute(
@@ -52,4 +46,101 @@ class ServiceController extends Controller
             'service' => $service,
         ]);
     }
+
+    public function show(Request $request): Response
+    {
+        $server = Server::findOrFail($request->route('server'));
+        $service = $server->services()
+            ->with(['replicas', 'slices', 'endpoints', 'operations.steps', 'operations.children.target', 'environment.application'])
+            ->findOrFail($request->route('service'));
+
+        return inertia('services/Show', [
+            'server' => $server,
+            'service' => $service,
+        ]);
+    }
+
+    public function showForEnvironment(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $application = $organisation->applications()->findOrFail($request->route('application'));
+        $environment = $application->environments()->findOrFail($request->route('environment'));
+        $service = $environment->services()
+            ->with(['server', 'replicas', 'slices', 'endpoints', 'operations.steps', 'operations.children.target', 'environment.application'])
+            ->findOrFail($request->route('service'));
+
+        return inertia('services/Show', [
+            'server' => $service->server,
+            'service' => $service,
+            'environment' => $environment,
+            'application' => $application,
+        ]);
+    }
+
+    public function edit(Request $request): Response
+    {
+        $server = Server::findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+
+        return inertia('services/Edit', [
+            'server' => $server,
+            'service' => $service,
+            'deployPolicies' => array_values(DeployPolicy::toArray()),
+        ]);
+    }
+
+    public function update(UpdateServiceRequest $request): RedirectResponse
+    {
+        $server = Server::findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+
+        $validated = $request->validated();
+
+        $service->update([
+            'name' => $validated['name'],
+            'desired_replicas' => $validated['desired_replicas'],
+            'default_cpu_limit' => $validated['default_cpu_limit'] ?? null,
+            'default_memory_limit_mb' => $validated['default_memory_limit_mb'] ?? null,
+            'deploy_policy' => $request->enum('deploy_policy', DeployPolicy::class) ?? $service->deploy_policy,
+            'version_track' => $validated['version_track'] ?? $service->version_track,
+            'available_image_digest' => $validated['available_image_digest'] ?? null,
+            'process_roles' => collect(explode(',', $validated['process_roles'] ?? ''))
+                ->map(fn (string $role): string => trim($role))
+                ->filter()
+                ->values()
+                ->all(),
+            'config' => [
+                ...($service->config ?? []),
+                'migration_mode' => $validated['migration_mode'] ?? null,
+                'migration_timing' => $validated['migration_timing'] ?? null,
+                'migration_command' => $validated['migration_command'] ?? null,
+                'health_path' => $validated['health_path'] ?? null,
+                'backup_enabled' => $request->boolean('backup_enabled'),
+                'backup_command' => $validated['backup_command'] ?? null,
+            ],
+        ]);
+
+        return redirect()
+            ->route('services.show', [
+                'organisation' => $server->organisation_id,
+                'server' => $server->id,
+                'service' => $service->id,
+            ])
+            ->with('success', 'Service updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $server = Server::findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+
+        $service->delete();
+
+        return redirect()
+            ->route('servers.show', [
+                'organisation' => $server->organisation_id,
+                'server' => $server->id,
+            ])
+            ->with('success', 'Service deleted.');
+    }
 }

app/Http/Controllers/ServiceReplicaController.php

@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\OperationKind;
+use App\Enums\OperationStatus;
+use App\Models\Organisation;
+use App\Models\ServiceReplica;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class ServiceReplicaController extends Controller
+{
+    public function show(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->with('environment.application')->findOrFail($request->route('service'));
+        $replica = $service->replicas()
+            ->with(['server', 'operation.steps', 'operations.steps', 'operations.children.target'])
+            ->findOrFail($request->route('replica'));
+
+        return inertia('service-replicas/Show', [
+            'server' => $server,
+            'service' => $service,
+            'replica' => $replica,
+        ]);
+    }
+
+    public function restart(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+        $replica = $service->replicas()->findOrFail($request->route('replica'));
+
+        $this->queueLifecycleOperation($replica, 'Restart replica', "docker restart {$replica->container_name}");
+
+        return redirect()
+            ->route('service-replicas.show', [
+                'organisation' => $organisation->id,
+                'server' => $server->id,
+                'service' => $service->id,
+                'replica' => $replica->id,
+            ])
+            ->with('success', 'Replica restart queued.');
+    }
+
+    public function start(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+        $replica = $service->replicas()->findOrFail($request->route('replica'));
+
+        $this->queueLifecycleOperation($replica, 'Start replica', "docker start {$replica->container_name}");
+
+        return redirect()
+            ->route('service-replicas.show', [
+                'organisation' => $organisation->id,
+                'server' => $server->id,
+                'service' => $service->id,
+                'replica' => $replica->id,
+            ])
+            ->with('success', 'Replica start queued.');
+    }
+
+    public function stop(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+        $replica = $service->replicas()->findOrFail($request->route('replica'));
+
+        $this->queueLifecycleOperation($replica, 'Stop replica', "docker stop {$replica->container_name}");
+
+        return redirect()
+            ->route('service-replicas.show', [
+                'organisation' => $organisation->id,
+                'server' => $server->id,
+                'service' => $service->id,
+                'replica' => $replica->id,
+            ])
+            ->with('success', 'Replica stop queued.');
+    }
+
+    private function queueLifecycleOperation(ServiceReplica $replica, string $name, string $script): void
+    {
+        $operation = $replica->operations()->create([
+            'kind' => OperationKind::REPLICA_DEPLOY,
+            'status' => OperationStatus::PENDING,
+        ]);
+
+        $operation->steps()->create([
+            'name' => $name,
+            'order' => 1,
+            'status' => OperationStatus::PENDING,
+            'script' => $script,
+        ]);
+    }
+}

app/Http/Controllers/ServiceSliceController.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\StoreServiceSliceRequest;
+use App\Models\Organisation;
+use App\Models\ServiceSlice;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class ServiceSliceController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()
+            ->with('environment.application')
+            ->findOrFail($request->route('service'));
+
+        return inertia('service-slices/Index', [
+            'server' => $server,
+            'service' => $service,
+            'slices' => $service->slices()
+                ->with(['environment.application', 'attachments', 'operations.steps', 'operations.children.target'])
+                ->latest()
+                ->get(),
+        ]);
+    }
+
+    public function show(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->with('environment.application')->findOrFail($request->route('service'));
+        $slice = $service->slices()
+            ->with(['environment.application', 'attachments.environment.application', 'operations.steps', 'operations.children.target'])
+            ->findOrFail($request->route('slice'));
+
+        return inertia('service-slices/Show', [
+            'server' => $server,
+            'service' => $service,
+            'slice' => $slice,
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+
+        return inertia('service-slices/Create', [
+            'server' => $server,
+            'service' => $service,
+            'environments' => $organisation->applications()
+                ->with('environments')
+                ->get()
+                ->pluck('environments')
+                ->flatten()
+                ->values(),
+        ]);
+    }
+
+    public function store(StoreServiceSliceRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $server = $organisation->servers()->findOrFail($request->route('server'));
+        $service = $server->services()->findOrFail($request->route('service'));
+        $environmentId = $request->integer('environment_id') ?: null;
+
+        if ($environmentId !== null) {
+            $belongsToOrganisation = $organisation->applications()
+                ->whereHas('environments', fn ($query) => $query->whereKey($environmentId))
+                ->exists();
+
+            abort_unless($belongsToOrganisation, 422);
+        }
+
+        $config = $request->filled('config')
+            ? json_decode($request->string('config')->toString(), true, flags: JSON_THROW_ON_ERROR)
+            : [];
+
+        /** @var ServiceSlice $slice */
+        $slice = $service->slices()->create([
+            'environment_id' => $environmentId,
+            'name' => $request->string('name')->toString(),
+            'type' => $request->string('type')->toString(),
+            'status' => $request->string('status')->toString(),
+            'config' => $config,
+            'credentials' => [],
+        ]);
+
+        return redirect()
+            ->route('service-slices.show', [
+                'organisation' => $organisation->id,
+                'server' => $server->id,
+                'service' => $service->id,
+                'slice' => $slice->id,
+            ])
+            ->with('success', 'Slice created.');
+    }
+}

app/Http/Controllers/ServiceUpdateController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Services\CreateStatefulServiceUpdateOperation;
+use App\Actions\Services\ResolveServiceImageDigest;
+use App\Enums\ServiceType;
+use App\Http\Requests\StoreServiceUpdateRequest;
+use App\Models\Organisation;
+use App\Models\Server;
+use App\Models\Service;
+use Illuminate\Http\RedirectResponse;
+use Inertia\Response;
+
+class ServiceUpdateController extends Controller
+{
+    public function create(Organisation $organisation, Server $server, Service $service): Response
+    {
+        abort_unless((int) $server->organisation_id === (int) $organisation->id && (int) $service->server_id === (int) $server->id, 404);
+        abort_unless(in_array($service->type, [ServiceType::POSTGRES, ServiceType::VALKEY], true), 404);
+
+        return inertia('services/updates/Create', [
+            'server' => $server,
+            'service' => $service,
+            'backupAvailable' => (bool) ($service->config['backup_enabled'] ?? false),
+        ]);
+    }
+
+    public function store(
+        StoreServiceUpdateRequest $request,
+        Organisation $organisation,
+        Server $server,
+        Service $service,
+        CreateStatefulServiceUpdateOperation $createStatefulServiceUpdateOperation,
+    ): RedirectResponse {
+        abort_unless((int) $server->organisation_id === (int) $organisation->id && (int) $service->server_id === (int) $server->id, 404);
+        abort_unless($request->string('confirmation')->toString() === $service->name, 422);
+
+        $createStatefulServiceUpdateOperation->execute(
+            service: $service,
+            imageDigest: $request->string('image_digest')->toString(),
+            backupRequested: $request->boolean('backup_requested'),
+        );
+
+        return redirect()->route('servers.show', [
+            'organisation' => $organisation->id,
+            'server' => $server->id,
+        ]);
+    }
+
+    public function resolve(
+        Organisation $organisation,
+        Server $server,
+        Service $service,
+        ResolveServiceImageDigest $resolveServiceImageDigest,
+    ): RedirectResponse {
+        abort_unless((int) $server->organisation_id === (int) $organisation->id && (int) $service->server_id === (int) $server->id, 404);
+        abort_unless(in_array($service->type, [ServiceType::POSTGRES, ServiceType::VALKEY], true), 404);
+
+        $service->update([
+            'available_image_digest' => $resolveServiceImageDigest->execute($service),
+        ]);
+
+        return redirect()
+            ->route('service-updates.create', [
+                'organisation' => $organisation->id,
+                'server' => $server->id,
+                'service' => $service->id,
+            ])
+            ->with('success', 'Latest image digest resolved.');
+    }
+}

app/Http/Controllers/SourceProviderController.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\SourceProviderType;
+use App\Http\Requests\StoreSourceProviderRequest;
+use App\Http\Requests\UpdateSourceProviderRequest;
+use App\Models\Organisation;
+use App\Models\SourceProvider;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Response;
+
+class SourceProviderController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('source-providers/Index', [
+            'sourceProviders' => $organisation->sourceProviders()
+                ->latest()
+                ->get(),
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        Organisation::findOrFail($request->route('organisation'));
+
+        return inertia('source-providers/Create', [
+            'sourceProviderTypes' => array_values(SourceProviderType::toArray()),
+        ]);
+    }
+
+    public function store(StoreSourceProviderRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+
+        $organisation->sourceProviders()->create([
+            'name' => $request->string('name')->toString(),
+            'type' => $request->enum('type', SourceProviderType::class),
+            'url' => $request->filled('url') ? rtrim($request->string('url')->toString(), '/') : null,
+            'config' => [],
+        ]);
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Source provider created.');
+    }
+
+    public function edit(Request $request): Response
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $sourceProvider = $organisation->sourceProviders()->findOrFail($request->route('source_provider'));
+
+        return inertia('source-providers/Edit', [
+            'sourceProvider' => $sourceProvider,
+            'sourceProviderTypes' => array_values(SourceProviderType::toArray()),
+        ]);
+    }
+
+    public function update(UpdateSourceProviderRequest $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        /** @var SourceProvider $sourceProvider */
+        $sourceProvider = $organisation->sourceProviders()->findOrFail($request->route('source_provider'));
+
+        $sourceProvider->update([
+            'name' => $request->string('name')->toString(),
+            'type' => $request->enum('type', SourceProviderType::class),
+            'url' => $request->filled('url') ? rtrim($request->string('url')->toString(), '/') : null,
+        ]);
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Source provider updated.');
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        $organisation = Organisation::findOrFail($request->route('organisation'));
+        $sourceProvider = $organisation->sourceProviders()->findOrFail($request->route('source_provider'));
+
+        $sourceProvider->delete();
+
+        return redirect()
+            ->route('organisations.show', ['organisation' => $organisation->id])
+            ->with('success', 'Source provider deleted.');
+    }
+}

app/Http/Integrations/Requests/Hetzner/Networks/CreateNetworkRequest.php

@@ -24,17 +24,17 @@ class CreateNetworkRequest extends Request implements HasBody
             'name' => $this->name,
             'ip_range' => '10.0.0.0/16',
         ];
-        
+
         if ($this->networkZone) {
             $body['subnets'] = [
                 [
                     'type' => 'cloud',
                     'ip_range' => '10.0.1.0/24',
-                    'network_zone' => $this->networkZone
-                ]
+                    'network_zone' => $this->networkZone,
+                ],
             ];
         }
-        
+
         return $body;
     }
 

app/Http/Middleware/HandleInertiaRequests.php

@@ -4,6 +4,7 @@ namespace App\Http\Middleware;
 
 use App\Models\Application;
 use App\Models\Organisation;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Request;
 use Inertia\Middleware;
 use Tighten\Ziggy\Ziggy;
@@ -29,8 +30,14 @@ class HandleInertiaRequests extends Middleware
         return [
             ...parent::share($request),
             'name' => config('app.name'),
-            'organisation' => $request->route('organisation') ? Organisation::with('applications')->findOrFail($request->route('organisation')) : null,
-            'application' => $request->route('application') ? Application::with('environments')->findOrFail($request->route('application')) : null,
+            'organisation' => $request->route('organisation')
+                ? Organisation::with('applications.environments')
+                    ->withCount(['providers', 'sourceProviders', 'registries', 'servers', 'applications'])
+                    ->findOrFail($this->routeKey($request->route('organisation')))
+                : null,
+            'application' => $request->route('application')
+                ? Application::with('environments')->findOrFail($this->routeKey($request->route('application')))
+                : null,
             'flash' => [
                 'server_credentials' => $request->session()->has('sudo_password') ? [
                     'sudo_password' => $request->session()->get('sudo_password'),
@@ -45,4 +52,9 @@ class HandleInertiaRequests extends Middleware
             ],
         ];
     }
+
+    private function routeKey(mixed $routeValue): mixed
+    {
+        return $routeValue instanceof Model ? $routeValue->getKey() : $routeValue;
+    }
 }

app/Http/Requests/ImportEnvironmentVariablesRequest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ImportEnvironmentVariablesRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'contents' => ['required', 'string', 'max:20000'],
+            'overridable' => ['sometimes', 'boolean'],
+        ];
+    }
+}

app/Http/Requests/StoreApplicationRequest.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\RepositoryType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreApplicationRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'source_provider_id' => ['nullable', 'integer', 'exists:source_providers,id'],
+            'repository_type' => ['required', Rule::enum(RepositoryType::class)],
+            'repository_url' => ['required', 'string', 'max:255', 'regex:/^(git@[^:]+:.+|ssh:\/\/.+)$/i'],
+            'default_branch' => ['required', 'string', 'max:255', 'regex:/^[A-Za-z0-9._\/-]+$/'],
+            'environment_name' => ['required', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/StoreEnvironmentAttachmentRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\EnvironmentAttachmentRole;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreEnvironmentAttachmentRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'service_id' => ['required', 'integer', 'exists:services,id'],
+            'role' => ['required', Rule::enum(EnvironmentAttachmentRole::class)],
+            'name' => ['nullable', 'string', 'max:255'],
+            'env_prefix' => ['nullable', 'string', 'max:32', 'regex:/^[A-Z][A-Z0-9_]*$/'],
+            'is_primary' => ['boolean'],
+            'domain' => ['nullable', 'string', 'max:255'],
+            'path_prefix' => ['nullable', 'string', 'max:255'],
+            'tls_enabled' => ['boolean'],
+        ];
+    }
+}

app/Http/Requests/StoreEnvironmentDeploymentRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreEnvironmentDeploymentRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'target_commit' => ['nullable', 'string', 'size:40', 'regex:/^[a-fA-F0-9]{40}$/'],
+        ];
+    }
+}

app/Http/Requests/StoreEnvironmentRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreEnvironmentRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'branch' => ['required', 'string', 'max:255', 'regex:/^[A-Za-z0-9._\/-]+$/'],
+            'php_version' => ['required', 'string', 'max:20'],
+        ];
+    }
+}

app/Http/Requests/StoreEnvironmentVariableRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreEnvironmentVariableRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'key' => ['required', 'string', 'max:255', 'regex:/^[A-Z][A-Z0-9_]*$/'],
+            'value' => ['nullable', 'string'],
+            'overridable' => ['boolean'],
+        ];
+    }
+}

app/Http/Requests/StoreGatewayRouteRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreGatewayRouteRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'service_id' => ['required', 'integer', 'exists:services,id'],
+            'name' => ['required', 'string', 'max:255'],
+            'domain' => ['required', 'string', 'max:255'],
+            'path_prefix' => ['required', 'string', 'max:255', 'regex:/^\//'],
+            'tls_enabled' => ['boolean'],
+        ];
+    }
+}

app/Http/Requests/StoreOrganisationMemberRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\OrganisationRole;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreOrganisationMemberRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'email', 'max:255'],
+            'role' => ['required', Rule::enum(OrganisationRole::class)],
+        ];
+    }
+}

app/Http/Requests/StoreProviderRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\ProviderType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreProviderRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', Rule::enum(ProviderType::class)],
+            'token' => ['required', 'string', 'max:2000'],
+        ];
+    }
+}

app/Http/Requests/StoreRegistryRequest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\RegistryType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreRegistryRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', Rule::enum(RegistryType::class)],
+            'url' => ['required', 'string', 'max:255'],
+            'username' => ['nullable', 'string', 'max:255'],
+            'password' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/StoreServerFirewallRuleRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\FirewallRuleType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreServerFirewallRuleRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'type' => ['required', Rule::enum(FirewallRuleType::class)],
+            'ports' => ['required', 'string', 'max:50', 'regex:/^[A-Za-z0-9:\/,-]+$/'],
+            'from' => ['nullable', 'string', 'max:255', 'regex:/^[A-Fa-f0-9:.\/-]+$/'],
+        ];
+    }
+}

app/Http/Requests/StoreServiceRequest.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\ServiceCategory;
+use App\Enums\ServiceType;
+use App\Models\Server;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreServiceRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'category' => ['required', Rule::enum(ServiceCategory::class)],
+            'type' => ['required', Rule::enum(ServiceType::class)],
+            'version' => ['required', 'string', function (string $attribute, mixed $value, \Closure $fail): void {
+                if (! isset(config('keystone.services')[$this->category][$this->type]['versions'][$value])) {
+                    $fail('The selected version is invalid.');
+                }
+            }],
+        ];
+    }
+
+    public function after(): array
+    {
+        return [
+            function ($validator): void {
+                if ($this->category !== ServiceCategory::GATEWAY->value) {
+                    return;
+                }
+
+                $server = Server::find($this->route('server'));
+
+                if ($server?->services()->where('category', ServiceCategory::GATEWAY)->exists()) {
+                    $validator->errors()->add('category', 'This server already has a gateway service.');
+                }
+            },
+        ];
+    }
+}

app/Http/Requests/StoreServiceSliceRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreServiceSliceRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'string', 'max:255'],
+            'environment_id' => ['nullable', 'integer'],
+            'status' => ['required', 'string', 'max:255'],
+            'config' => ['nullable', 'string'],
+        ];
+    }
+}

app/Http/Requests/StoreServiceUpdateRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreServiceUpdateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'image_digest' => ['required', 'string', 'starts_with:sha256:'],
+            'backup_requested' => ['sometimes', 'boolean'],
+            'confirmation' => ['required', 'string'],
+        ];
+    }
+}

app/Http/Requests/StoreSourceProviderRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\SourceProviderType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreSourceProviderRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', Rule::enum(SourceProviderType::class)],
+            'url' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/UpdateApplicationRequest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\RepositoryType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateApplicationRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'source_provider_id' => ['nullable', 'integer', 'exists:source_providers,id'],
+            'repository_type' => ['required', Rule::enum(RepositoryType::class)],
+            'repository_url' => ['required', 'string', 'max:255', 'regex:/^(git@[^:]+:.+|ssh:\/\/.+)$/i'],
+            'default_branch' => ['required', 'string', 'max:255', 'regex:/^[A-Za-z0-9._\/-]+$/'],
+        ];
+    }
+}

app/Http/Requests/UpdateEnvironmentAttachmentRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\EnvironmentAttachmentRole;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateEnvironmentAttachmentRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'role' => ['required', Rule::enum(EnvironmentAttachmentRole::class)],
+            'env_prefix' => ['nullable', 'string', 'max:255', 'regex:/^[A-Z][A-Z0-9_]*$/'],
+            'is_primary' => ['boolean'],
+            'domain' => ['nullable', 'string', 'max:255'],
+            'path_prefix' => ['nullable', 'string', 'max:255'],
+            'tls_enabled' => ['boolean'],
+            'certificate_status' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/UpdateEnvironmentRequest.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\BuildStrategy;
+use App\Enums\SchedulerMode;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateEnvironmentRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'branch' => ['required', 'string', 'max:255', 'regex:/^[A-Za-z0-9._\/-]+$/'],
+            'status' => ['required', 'string', 'max:255'],
+            'scheduler_enabled' => ['boolean'],
+            'scheduler_target_service_id' => ['nullable', 'integer'],
+            'scheduler_mode' => ['required', Rule::enum(SchedulerMode::class)],
+            'build_strategy' => ['required', Rule::enum(BuildStrategy::class)],
+            'php_version' => ['nullable', 'string', 'max:20'],
+            'document_root' => ['nullable', 'string', 'max:255'],
+            'health_path' => ['nullable', 'string', 'max:255'],
+            'js_package_manager' => ['nullable', 'string', 'max:50'],
+            'js_build_command' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/UpdateEnvironmentVariableRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateEnvironmentVariableRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'key' => ['required', 'string', 'max:255', 'regex:/^[A-Z][A-Z0-9_]*$/'],
+            'value' => ['nullable', 'string'],
+            'overridable' => ['boolean'],
+        ];
+    }
+}

app/Http/Requests/UpdateGatewayRouteRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateGatewayRouteRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'domain' => ['required', 'string', 'max:255'],
+            'path_prefix' => ['required', 'string', 'max:255', 'regex:/^\//'],
+            'tls_enabled' => ['boolean'],
+            'certificate_status' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}