feat: postgres

2025-07-03 16:46:47 -04:00
263 changed files with 2203 additions and 20083 deletions
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -9,7 +9,7 @@ jobs:
  check:
    runs-on: docker
    container:
-      image: hub.nationtech.io/harmony/harmony_composer:latest
+      image: hub.nationtech.io/harmony/harmony_composer:latest@sha256:eb0406fcb95c63df9b7c4b19bc50ad7914dd8232ce98e9c9abef628e07c69386
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
--- a/.gitea/workflows/harmony_composer.yaml
+++ b/.gitea/workflows/harmony_composer.yaml
@@ -7,7 +7,7 @@ on:
 jobs:
  package_harmony_composer:
    container:
-      image: hub.nationtech.io/harmony/harmony_composer:latest
+      image: hub.nationtech.io/harmony/harmony_composer:latest@sha256:eb0406fcb95c63df9b7c4b19bc50ad7914dd8232ce98e9c9abef628e07c69386
    runs-on: dind
    steps:
      - name: Checkout code
@@ -45,14 +45,14 @@ jobs:
            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/tags/snapshot-latest" \
            | jq -r '.id // empty')
-
+          
          if [ -n "$RELEASE_ID" ]; then
            # Delete existing release
            curl -X DELETE \
              -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
              "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/$RELEASE_ID"
          fi
-
+          
          # Create new release
          RESPONSE=$(curl -X POST \
            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
@@ -65,7 +65,7 @@ jobs:
              "prerelease": true
            }' \
            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases")
-
+          
          echo "RELEASE_ID=$(echo $RESPONSE | jq -r '.id')" >> $GITHUB_ENV

      - name: Upload Linux binary
--- a/.gitignore
+++ b/.gitignore
@@ -1,25 +1,3 @@
-### General ###
-private_repos/
-
-### Harmony ###
-harmony.log
-
-### Helm ###
-# Chart dependencies
-**/charts/*.tgz
-
-### Rust ###
-# Generated by Cargo
-# will have compiled files and executables
-debug/
-target/
-
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
-
-# These are backup files generated by rustfmt
-**/*.rs.bk
-
-# MSVC Windows builds of rustc generate these, which store debugging information
-*.pdb
+target
+private_repos
+log/
--- a/.sqlx/query-934035c7ca6e064815393e4e049a7934b0a7fac04a4fe4b2a354f0443d630990.json
+++ b/.sqlx/query-934035c7ca6e064815393e4e049a7934b0a7fac04a4fe4b2a354f0443d630990.json
@@ -1,32 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT id, version_id, data as \"data: Json<PhysicalHost>\" FROM physical_hosts WHERE id = ? ORDER BY version_id DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "id",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "version_id",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "data: Json<PhysicalHost>",
-        "ordinal": 2,
-        "type_info": "Null"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "934035c7ca6e064815393e4e049a7934b0a7fac04a4fe4b2a354f0443d630990"
-}
--- a/.sqlx/query-f10f615ee42129ffa293e46f2f893d65a237d31d24b74a29c6a8d8420d255ab8.json
+++ b/.sqlx/query-f10f615ee42129ffa293e46f2f893d65a237d31d24b74a29c6a8d8420d255ab8.json
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT INTO physical_hosts (id, version_id, data) VALUES (?, ?, ?)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "f10f615ee42129ffa293e46f2f893d65a237d31d24b74a29c6a8d8420d255ab8"
-}
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,9 +12,6 @@ members = [
  "harmony_cli",
  "k3d",
  "harmony_composer",
-  "harmony_inventory_agent",
-  "harmony_secret_derive",
-  "harmony_secret", "adr/agent_discovery/mdns",
 ]

 [workspace.package]
@@ -23,7 +20,7 @@ readme = "README.md"
 license = "GNU AGPL v3"

 [workspace.dependencies]
-log = { version = "0.4", features = ["kv"] }
+log = "0.4"
 env_logger = "0.11"
 derive-new = "0.7"
 async-trait = "0.1"
@@ -36,7 +33,7 @@ tokio = { version = "1.40", features = [
 cidr = { features = ["serde"], version = "0.2" }
 russh = "0.45"
 russh-keys = "0.45"
-rand = "0.9"
+rand = "0.8"
 url = "2.5"
 kube = { version = "1.1.0", features = [
  "config",
@@ -55,16 +52,3 @@ convert_case = "0.8"
 chrono = "0.4"
 similar = "2"
 uuid = { version = "1.11", features = ["v4", "fast-rng", "macro-diagnostics"] }
-pretty_assertions = "1.4.1"
-tempfile = "3.20.0"
-bollard = "0.19.1"
-base64 = "0.22.1"
-tar = "0.4.44"
-lazy_static = "1.5.0"
-directories = "6.0.0"
-thiserror = "2.0.14"
-serde = { version = "1.0.209", features = ["derive", "rc"] }
-serde_json = "1.0.127"
-askama = "0.14"
-sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite" ] }
-reqwest = { version = "0.12", features = ["blocking", "stream", "rustls-tls", "http2", "json"], default-features = false }
--- a/7
+++ b/7
@@ -1,4 +1,4 @@
-FROM docker.io/rust:1.89.0 AS build
+FROM docker.io/rust:1.87.0 AS build

 WORKDIR /app

@@ -6,14 +6,13 @@ COPY . .

 RUN cargo build --release --bin harmony_composer

-FROM docker.io/rust:1.89.0
+FROM docker.io/rust:1.87.0

 WORKDIR /app

 RUN rustup target add x86_64-pc-windows-gnu
 RUN rustup target add x86_64-unknown-linux-gnu
 RUN rustup component add rustfmt
-RUN rustup component add clippy

 RUN apt update

@@ -23,4 +22,4 @@ RUN apt install -y nodejs docker.io mingw-w64

 COPY --from=build /app/target/release/harmony_composer .

-ENTRYPOINT ["/app/harmony_composer"]
+ENTRYPOINT ["/app/harmony_composer"]
--- a/README.md
+++ b/README.md
@@ -1,6 +1,5 @@
-# Harmony : Open-source infrastructure orchestration that treats your platform like first-class code
-
-_By [NationTech](https://nationtech.io)_
+# Harmony : Open-source infrastructure orchestration that treats your platform like first-class code.
+*By [NationTech](https://nationtech.io)*

 [![Build](https://git.nationtech.io/NationTech/harmony/actions/workflows/check.yml/badge.svg)](https://git.nationtech.io/nationtech/harmony)
 [![License](https://img.shields.io/badge/license-AGPLv3-blue?style=flat-square)](LICENSE)
@@ -24,11 +23,11 @@ From a **developer laptop** to a **global production cluster**, a single **sourc

 Infrastructure is essential, but it shouldn’t be your core business. Harmony is built on three guiding principles that make modern platforms reliable, repeatable, and easy to reason about.

-| Principle                              | What it means for you                                                                                                                                                                |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Infrastructure as Resilient Code**   | Replace sprawling YAML and bash scripts with type-safe Rust. Test, refactor, and version your platform just like application code.                                                   |
-| **Prove It Works — Before You Deploy** | Harmony uses the compiler to verify that your application’s needs match the target environment’s capabilities at **compile-time**, eliminating an entire class of runtime outages.   |
-| **One Unified Model**                  | Software and infrastructure are a single system. Harmony models them together, enabling deep automation—from bare-metal servers to Kubernetes workloads—with zero context switching. |
+| Principle | What it means for you |
+|-----------|-----------------------|
+| **Infrastructure as Resilient Code** | Replace sprawling YAML and bash scripts with type-safe Rust. Test, refactor, and version your platform just like application code. |
+| **Prove It Works — Before You Deploy** | Harmony uses the compiler to verify that your application’s needs match the target environment’s capabilities at **compile-time**, eliminating an entire class of runtime outages. |
+| **One Unified Model** | Software and infrastructure are a single system. Harmony models them together, enabling deep automation—from bare-metal servers to Kubernetes workloads—with zero context switching. |

 These principles surface as simple, ergonomic Rust APIs that let teams focus on their product while trusting the platform underneath.

@@ -64,20 +63,22 @@ async fn main() {
        },
    };

-    // 2. Enhance with extra scores (monitoring, CI/CD, …)
+    // 2. Pick where it should run
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+        Inventory::autoload(),                // auto-detect hardware / kube-config
+        K8sAnywhereTopology::from_env(),      // local k3d, CI, staging, prod…
+    )
+    .await
+    .unwrap();
+
+    // 3. Enhance with extra scores (monitoring, CI/CD, …)
    let mut monitoring = MonitoringAlertingStackScore::new();
    monitoring.namespace = Some(lamp_stack.config.namespace.clone());

-    // 3. Run your scores on the desired topology & inventory
-    harmony_cli::run(
-        Inventory::autoload(),                // auto-detect hardware / kube-config
-        K8sAnywhereTopology::from_env(),      // local k3d, CI, staging, prod…
-        vec![
-          Box::new(lamp_stack),
-          Box::new(monitoring)
-        ],
-        None
-    ).await.unwrap();
+    maestro.register_all(vec![Box::new(lamp_stack), Box::new(monitoring)]);
+
+    // 4. Launch an interactive CLI / TUI
+    harmony_cli::init(maestro, None).await.unwrap();
 }
 ```

@@ -93,13 +94,13 @@ Harmony analyses the code, shows an execution plan in a TUI, and applies it once

 ## 3 · Core Concepts

-| Term             | One-liner                                                                                            |
-| ---------------- | ---------------------------------------------------------------------------------------------------- |
-| **Score<T>**     | Declarative description of the desired state (e.g., `LAMPScore`).                                    |
-| **Interpret<T>** | Imperative logic that realises a `Score` on a specific environment.                                  |
-| **Topology**     | An environment (local k3d, AWS, bare-metal) exposing verified _Capabilities_ (Kubernetes, DNS, …).   |
-| **Maestro**      | Orchestrator that compiles Scores + Topology, ensuring all capabilities line up **at compile-time**. |
-| **Inventory**    | Optional catalogue of physical assets for bare-metal and edge deployments.                           |
+| Term | One-liner |
+|------|-----------|
+| **Score<T>** | Declarative description of the desired state (e.g., `LAMPScore`). |
+| **Interpret<T>** | Imperative logic that realises a `Score` on a specific environment. |
+| **Topology** | An environment (local k3d, AWS, bare-metal) exposing verified *Capabilities* (Kubernetes, DNS, …). |
+| **Maestro** | Orchestrator that compiles Scores + Topology, ensuring all capabilities line up **at compile-time**. |
+| **Inventory** | Optional catalogue of physical assets for bare-metal and edge deployments. |

 A visual overview is in the diagram below.

@@ -111,9 +112,9 @@ A visual overview is in the diagram below.

 Prerequisites:

- Rust
- Docker (if you deploy locally)
- `kubectl` / `helm` for Kubernetes-based topologies
+* Rust 
+* Docker (if you deploy locally)
+* `kubectl` / `helm` for Kubernetes-based topologies

 ```bash
 git clone https://git.nationtech.io/nationtech/harmony
@@ -125,15 +126,15 @@ cargo build --release          # builds the CLI, TUI and libraries

 ## 5 · Learning More

- **Architectural Decision Records** – dive into the rationale
-  - [ADR-001 · Why Rust](adr/001-rust.md)
-  - [ADR-003 · Infrastructure Abstractions](adr/003-infrastructure-abstractions.md)
-  - [ADR-006 · Secret Management](adr/006-secret-management.md)
+* **Architectural Decision Records** – dive into the rationale  
+  - [ADR-001 · Why Rust](adr/001-rust.md)  
+  - [ADR-003 · Infrastructure Abstractions](adr/003-infrastructure-abstractions.md)  
+  - [ADR-006 · Secret Management](adr/006-secret-management.md)  
  - [ADR-011 · Multi-Tenant Cluster](adr/011-multi-tenant-cluster.md)

- **Extending Harmony** – write new Scores / Interprets, add hardware like OPNsense firewalls, or embed Harmony in your own tooling (`/docs`).
+* **Extending Harmony** – write new Scores / Interprets, add hardware like OPNsense firewalls, or embed Harmony in your own tooling (`/docs`).

- **Community** – discussions and roadmap live in [GitLab issues](https://git.nationtech.io/nationtech/harmony/-/issues). PRs, ideas, and feedback are welcome!
+* **Community** – discussions and roadmap live in [GitLab issues](https://git.nationtech.io/nationtech/harmony/-/issues). PRs, ideas, and feedback are welcome!

 ---

@@ -147,4 +148,4 @@ See [LICENSE](LICENSE) for the full text.

 ---

-_Made with ❤️ & 🦀 by the NationTech and the Harmony community_
+*Made with ❤️ & 🦀 by the NationTech and the Harmony community*
--- a/adr/agent_discovery/mdns/Cargo.toml
+++ b/adr/agent_discovery/mdns/Cargo.toml
@@ -1,17 +0,0 @@
-[package]
-name = "mdns"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-
-[dependencies]
-mdns-sd = "0.14"
-tokio = { version = "1", features = ["full"] }
-futures = "0.3"
-dmidecode = "0.2" # For getting the motherboard ID on the agent
-log.workspace=true
-env_logger.workspace=true
-clap = { version = "4.5.46", features = ["derive"] }
-get_if_addrs = "0.5.3"
-local-ip-address = "0.6.5"
--- a/adr/agent_discovery/mdns/src/advertise.rs
+++ b/adr/agent_discovery/mdns/src/advertise.rs
@@ -1,60 +0,0 @@
-// harmony-agent/src/main.rs
-
-use log::info;
-use mdns_sd::{ServiceDaemon, ServiceInfo};
-use std::collections::HashMap;
-
-use crate::SERVICE_TYPE;
-
-// The service we are advertising.
-const SERVICE_PORT: u16 = 43210; // A port for the service. It needs one, even if unused.
-
-pub async fn advertise() {
-    info!("Starting Harmony Agent...");
-
-    // Get a unique ID for this machine.
-    let motherboard_id = "some motherboard id";
-    let instance_name = format!("harmony-agent-{}", motherboard_id);
-    info!("This agent's instance name: {}", instance_name);
-    info!("Advertising with ID: {}", motherboard_id);
-
-    // Create a new mDNS daemon.
-    let mdns = ServiceDaemon::new().expect("Failed to create mDNS daemon");
-
-    // Create a TXT record HashMap to hold our metadata.
-    let mut properties = HashMap::new();
-    properties.insert("id".to_string(), motherboard_id.to_string());
-    properties.insert("version".to_string(), "1.0".to_string());
-
-    // Create the service information.
-    // The instance name should be unique on the network.
-    let local_ip = local_ip_address::local_ip().unwrap();
-    let service_info = ServiceInfo::new(
-        SERVICE_TYPE,
-        &instance_name,
-        "harmony-host.local.", // A hostname for the service
-        local_ip,
-        // "0.0.0.0",
-        SERVICE_PORT,
-        Some(properties),
-    )
-    .expect("Failed to create service info");
-
-    // Register our service with the daemon.
-    mdns.register(service_info)
-        .expect("Failed to register service");
-
-    info!(
-        "Service '{}' registered and now being advertised.",
-        instance_name
-    );
-    info!("Agent is running. Press Ctrl+C to exit.");
-
-    for iface in get_if_addrs::get_if_addrs().unwrap() {
-        println!("{:#?}", iface);
-    }
-
-    // Keep the agent running indefinitely.
-    tokio::signal::ctrl_c().await.unwrap();
-    info!("Shutting down agent.");
-}
--- a/adr/agent_discovery/mdns/src/discover.rs
+++ b/adr/agent_discovery/mdns/src/discover.rs
@@ -1,110 +0,0 @@
-use log::debug;
-use mdns_sd::{ServiceDaemon, ServiceEvent};
-
-use crate::SERVICE_TYPE;
-
-pub async fn discover() {
-    println!("Starting Harmony Master and browsing for agents...");
-
-    // Create a new mDNS daemon.
-    let mdns = ServiceDaemon::new().expect("Failed to create mDNS daemon");
-
-    // Start browsing for the service type.
-    // The receiver will be a stream of events.
-    let receiver = mdns.browse(SERVICE_TYPE).expect("Failed to browse");
-
-    println!(
-        "Listening for mDNS events for '{}'. Press Ctrl+C to exit.",
-        SERVICE_TYPE
-    );
-
-    std::thread::spawn(move || {
-        while let Ok(event) = receiver.recv() {
-            match event {
-                ServiceEvent::ServiceData(resolved) => {
-                    println!("Resolved a new service: {}", resolved.fullname);
-                }
-                other_event => {
-                    println!("Received other event: {:?}", &other_event);
-                }
-            }
-        }
-    });
-
-    // Gracefully shutdown the daemon.
-    std::thread::sleep(std::time::Duration::from_secs(1000000));
-    mdns.shutdown().unwrap();
-
-    // Process events as they come in.
-    // while let Ok(event) = receiver.recv_async().await {
-    //     debug!("Received event {event:?}");
-    //     // match event {
-    //     //     ServiceEvent::ServiceFound(svc_type, fullname) => {
-    //     //         println!("\n--- Agent Discovered ---");
-    //     //         println!("  Service Name: {}", fullname());
-    //     //         // You can now resolve this service to get its IP, port, and TXT records
-    //     //         // The resolve operation is a separate network call.
-    //     //         let receiver = mdns.browse(info.get_fullname()).unwrap();
-    //     //         if let Ok(resolve_event) = receiver.recv_timeout(Duration::from_secs(2)) {
-    //     //              if let ServiceEvent::ServiceResolved(info) = resolve_event {
-    //     //                 let ip = info.get_addresses().iter().next().unwrap();
-    //     //                 let port = info.get_port();
-    //     //                 let motherboard_id = info.get_property("id").map_or("N/A", |v| v.val_str());
-    //     //
-    //     //                 println!("  IP: {}:{}", ip, port);
-    //     //                 println!("  Motherboard ID: {}", motherboard_id);
-    //     //                 println!("------------------------");
-    //     //
-    //     //                 // TODO: Add this agent to your central list of discovered hosts.
-    //     //              }
-    //     //         } else {
-    //     //             println!("Could not resolve service '{}' in time.", info.get_fullname());
-    //     //         }
-    //     //     }
-    //     //     ServiceEvent::ServiceRemoved(info) => {
-    //     //         println!("\n--- Agent Removed ---");
-    //     //         println!("  Service Name: {}", info.get_fullname());
-    //     //         println!("---------------------");
-    //     //         // TODO: Remove this agent from your list.
-    //     //     }
-    //     //     _ => {
-    //     //         // We don't care about other event types for this example
-    //     //     }
-    //     // }
-    // }
-}
-
-async fn discover_example() {
-    use mdns_sd::{ServiceDaemon, ServiceEvent};
-
-    // Create a daemon
-    let mdns = ServiceDaemon::new().expect("Failed to create daemon");
-
-    // Use recently added `ServiceEvent::ServiceData`.
-    mdns.use_service_data(true)
-        .expect("Failed to use ServiceData");
-
-    // Browse for a service type.
-    let service_type = "_mdns-sd-my-test._udp.local.";
-    let receiver = mdns.browse(service_type).expect("Failed to browse");
-
-    // Receive the browse events in sync or async. Here is
-    // an example of using a thread. Users can call `receiver.recv_async().await`
-    // if running in async environment.
-    std::thread::spawn(move || {
-        while let Ok(event) = receiver.recv() {
-            match event {
-                ServiceEvent::ServiceData(resolved) => {
-                    println!("Resolved a new service: {}", resolved.fullname);
-                }
-                other_event => {
-                    println!("Received other event: {:?}", &other_event);
-                }
-            }
-        }
-    });
-
-    // Gracefully shutdown the daemon.
-    std::thread::sleep(std::time::Duration::from_secs(1));
-    mdns.shutdown().unwrap();
-}
--- a/adr/agent_discovery/mdns/src/main.rs
+++ b/adr/agent_discovery/mdns/src/main.rs
@@ -1,31 +0,0 @@
-use clap::{Parser, ValueEnum};
-
-mod advertise;
-mod discover;
-
-#[derive(Parser, Debug)]
-#[command(version, about, long_about = None)]
-struct Args {
-    #[arg(value_enum)]
-    profile: Profiles,
-}
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord, ValueEnum)]
-enum Profiles {
-    Advertise,
-    Discover,
-}
-
-// The service type we are looking for.
-const SERVICE_TYPE: &str = "_harmony._tcp.local.";
-
-#[tokio::main]
-async fn main() {
-    env_logger::init();
-    let args = Args::parse();
-
-    match args.profile {
-        Profiles::Advertise => advertise::advertise().await,
-        Profiles::Discover => discover::discover().await,
-    }
-}
--- a/check.sh
+++ b/check.sh
@@ -1,8 +1,5 @@
 #!/bin/sh
 set -e
-
-rustc --version
 cargo check --all-targets --all-features --keep-going
 cargo fmt --check
-cargo clippy
 cargo test
--- a/data/pxe/okd/README.md
+++ b/data/pxe/okd/README.md
@@ -1,8 +0,0 @@
-Here lies all the data files required for an OKD cluster PXE boot setup.
-
-This inclues ISO files, binary boot files, ipxe, etc.
-
-TODO as of august 2025 :
-
- `harmony_inventory_agent` should be downloaded from official releases, this embedded version is practical for now though
- The cluster ssh key should be generated and handled by harmony with the private key saved in a secret store
--- a/data/pxe/okd/http_files/.gitattributes
+++ b/data/pxe/okd/http_files/.gitattributes
@@ -1,9 +0,0 @@
-harmony_inventory_agent filter=lfs diff=lfs merge=lfs -text
-os filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9 filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/images filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/initrd.img filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/vmlinuz filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/images/efiboot.img filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/images/install.img filter=lfs diff=lfs merge=lfs -text
-os/centos-stream-9/images/pxeboot filter=lfs diff=lfs merge=lfs -text
--- a/data/pxe/okd/http_files/cluster_ssh_key.pub
+++ b/data/pxe/okd/http_files/cluster_ssh_key.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBx6bDylvC68cVpjKfEFtLQJ/dOFi6PVS2vsIOqPDJIc jeangab@liliane2
--- a/data/pxe/okd/http_files/harmony_inventory_agent
+++ b/data/pxe/okd/http_files/harmony_inventory_agent
--- a/data/pxe/okd/http_files/os/centos-stream-9/images/efiboot.img
+++ b/data/pxe/okd/http_files/os/centos-stream-9/images/efiboot.img
--- a/data/pxe/okd/http_files/os/centos-stream-9/images/install.img
+++ b/data/pxe/okd/http_files/os/centos-stream-9/images/install.img
--- a/data/pxe/okd/http_files/os/centos-stream-9/images/pxeboot/initrd.img
+++ b/data/pxe/okd/http_files/os/centos-stream-9/images/pxeboot/initrd.img
--- a/data/pxe/okd/http_files/os/centos-stream-9/images/pxeboot/vmlinuz
+++ b/data/pxe/okd/http_files/os/centos-stream-9/images/pxeboot/vmlinuz
--- a/data/pxe/okd/http_files/os/centos-stream-9/initrd.img
+++ b/data/pxe/okd/http_files/os/centos-stream-9/initrd.img
--- a/data/pxe/okd/http_files/os/centos-stream-9/vmlinuz
+++ b/data/pxe/okd/http_files/os/centos-stream-9/vmlinuz
--- a/data/pxe/okd/tftpboot/ipxe.efi
+++ b/data/pxe/okd/tftpboot/ipxe.efi
--- a/data/pxe/okd/tftpboot/undionly.kpxe
+++ b/data/pxe/okd/tftpboot/undionly.kpxe
--- a/demos/cncf-k8s-quebec-meetup-september-2025/storyline.md
+++ b/demos/cncf-k8s-quebec-meetup-september-2025/storyline.md
@@ -1,132 +0,0 @@
-# Harmony, Orchestrateur d'infrastructure open-source
-
-**Target Duration:** 25 minutes
-**Tone:** Friendly, expert-to-expert, inspiring.
-
---
-
-#### **Slide 1: Title Slide**
-
- **Visual:** Clean and simple. Your company logo (NationTech) and the Harmony logo.
-
---
-
-#### **Slide 2: The YAML Labyrinth**
-
-**Goal:** Get every head in the room nodding in agreement. Start with their world, not yours.
-
- **Visual:**
-  - Option A: "The Pull Request from Hell". A screenshot of a GitHub pull request for a seemingly minor change that touches dozens of YAML files across multiple directories. A sea of red and green diffs that is visually overwhelming.
-  - Option B: A complex flowchart connecting dozens of logos: Terraform, Ansible, K8s, Helm, etc.
- **Narration:**\
-  [...ADD SOMETHING FOR INTRODUCTION...]\
-  "We love the power that tools like Kubernetes and the CNCF landscape have given us. But let's be honest... when did our infrastructure code start looking like _this_?"\
-  "We have GitOps, which is great. But it often means we're managing this fragile cathedral of YAML, Helm charts, and brittle scripts. We spend more time debugging indentation and tracing variables than we do building truly resilient systems."
-
---
-
-#### **Slide 3: The Real Cost: Cognitive Fatigue**
-
- **Visual:** "The Jenga Tower of Tools". A tall, precarious Jenga tower where each block is the logo of a different tool (Terraform, K8s, Helm, Ansible, Prometheus, ArgoCD, etc.). One block near the bottom is being nervously pulled out.
- **Narration:**
-  "The real cost isn't just complexity; it's _cognitive fatigue_. The constant need to choose, learn, integrate, and operate a dozen different tools, each with its own syntax and failure modes. It's the nagging fear that a tiny typo in a config file could bring everything down. Click-ops isn't the answer, but the current state of IaC feels like we've traded one problem for another."
-
---
-
-#### **Slide 4: The Broken Promise of "Code"**
-
-**Goal:** Introduce the core idea before introducing the product. This makes the solution feel inevitable.
-
- **(Initial Visual):** A two-panel slide.
-  - **Left Panel Title: "The Plan"** - A terminal showing a green, successful `terraform plan` output.
-  - **Right Panel Title: "The Reality"** - The _next_ screen in the terminal, showing the `terraform apply` failing with a cascade of red error text.
- **Narration:**
-  "We call our discipline **Infrastructure as Code**. And we've all been here. Our 'compiler' is a `terraform plan` that says everything looks perfect. We get the green light."
-  (Pause for a beat)
-  "And then we `apply`, and reality hits. It fails halfway through, at runtime, when it's most expensive and painful to fix."
-
-**(Click to transition the slide)**
-
- **(New Visual):** The entire slide is replaced by a clean screenshot of a code editor (like VS Code) showing Harmony's Rust DSL. A red squiggly line is under a config line. The error message is clear in the "Problems" panel: `error: Incompatible deployment. Production target 'gcp-prod-cluster' requires a StorageClass with 'snapshots' capability, but 'standard-sc' does not provide it.`
- **Narration (continued):**
-  "In software development, we solved these problems years ago. We don't accept 'it compiled, but crashed on startup'. We have real tools, type systems, compilers, test frameworks, and IDEs that catch our mistakes before they ever reach production. **So, what if we could treat our entire infrastructure... like a modern, compiled application?**"
-  "What if your infrastructure code could get compile-time checks, straight into the editor... instead of runtime panics and failures at 3 AM in production?"
-
---
-
-#### **Slide 5: Introducing Harmony**
-
-**Goal:** Introduce Harmony as the answer to the "What If?" question.
-
- **Visual:** The Harmony logo, large and centered.
- **Tagline:** `Infrastructure in type-safe Rust. No YAML required.`
- **Narration:**
-  "This is Harmony. It's an open-source orchestrator that lets you define your entire stack — from a dev laptop to a multi-site bare-metal cluster—in a single, type-safe Rust codebase."
-
---
-
-#### **Slide 6: Before & After**
-
- **Visual:** A side-by-side comparison. Left side: A screen full of complex, nested YAML. Right side: 10-15 lines of clean, readable Harmony Rust DSL that accomplishes the same thing.
- **Narration:**
-  "This is the difference. On the left, the fragile world of strings and templates. On the right, a portable, verifiable program that describes your apps, your infra, and your operations. We unify scaffolding, provisioning, and Day-2 ops, all verified by the Rust compiler. But enough slides... let's see it in action."
-
---
-
-#### **Slide 7: Live Demo: Zero to Monitored App**
-
-**Goal:** Show, don't just tell. Make it look effortless. This is where you build the "dream."
-
- **Visual:** Your terminal/IDE, ready to go.
- **Narration Guide:**
-  "Okay, for this demo, we're going to take a standard web app from GitHub. Nothing special about it."
-  _(Show the repo)_
-  "Now, let's bring it into Harmony. This is the entire definition we need to describe the application and its needs."
-  _(Show the Rust DSL)_
-  "First, let's run it locally on k3d. The exact same definition for dev as for prod."
-  _(Deploy locally, show it works)_
-  "Cool. But a real app needs monitoring. In Harmony, that's just adding a feature to our code."
-  _(Uncomment one line: `.with_feature(Monitoring)` and redeploy)_
-  "And just like that, we have a fully configured Prometheus and Grafana stack, scraping our app. No YAML, no extra config."
-  "Finally, let's push this to our production staging cluster. We just change the target and specify our multi-site Ceph storage."
-  _(Deploy to the remote cluster)_
-  "And there it is. We've gone from a simple web app to a monitored, enterprise-grade service in minutes."
-
---
-
-#### **Slide 8: Live Demo: Embracing Chaos**
-
-**Goal:** Prove the "predictable" and "resilient" claims in the most dramatic way possible.
-
- **Visual:** A slide showing a map or diagram of your distributed infrastructure (the different data centers). Then switch back to your terminal.
- **Narration Guide:**
-  "This is great when things are sunny. But production is chaos. So... let's break things. On purpose."
-  "First, a network failure." _(Kill a switch/link, show app is still up)_
-  "Now, let's power off a storage server." _(Force off a server, show Ceph healing and the app is unaffected)_
-  "How about a control plane node?" _(Force off a k8s control plane, show the cluster is still running)_
-  "Okay, for the grand finale. What if we have a cascading failure? I'm going to kill _another_ storage server. This should cause a total failure in this data center."
-  _(Force off the second server, narrate what's happening)_
-  "And there it is... Ceph has lost quorum in this site... and Harmony has automatically failed everything over to our other datacenter. The app is still running."
-
---
-
-#### **Slide 9: The New Reality**
-
-**Goal:** Summarize the dream and tell the audience what you want them to do.
-
- **Visual:** The clean, simple Harmony Rust DSL code from Slide 6. A summary of what was just accomplished is listed next to it: `✓ GitHub to Prod in minutes`, `✓ Type-Safe Validation`, `✓ Built-in Monitoring`, `✓ Automated Multi-Site Failover`.
- **Narration:**
-  "So, in just a few minutes, we went from a simple web app to a multi-site, monitored, and chaos-proof production deployment. We did it with a small amount of code that is easy to read, easy to verify, and completely portable. This is our vision: to offload the complexity, eliminate cognitive fatigue, and make infrastructure simple, predictable, and even fun again."
-
---
-
-#### **Slide 10: Join Us**
-
- **Visual:** A clean, final slide with QR codes and links.
-  - GitHub Repo (`github.com/nation-tech/harmony`)
-  - Website (`harmony.sh` or similar)
-  - Your contact info (`jg@nation.tech` / LinkedIn / Twitter)
- **Narration:**
-  "Harmony is open-source, AGPLv3. We believe this is the future, but we're just getting started. We know this crowd has great infrastructure minds out there, and we need your feedback. Please, check out the project on GitHub. Star it if you like what you see. Tell us what's missing. Let's build this future together. Thank you."
-
-**(Open for Q&A)**
--- a/docs/pxe_test/README.md
+++ b/docs/pxe_test/README.md
@@ -1,108 +0,0 @@
-# OPNsense PXE Lab Environment
-
-This project contains a script to automatically set up a virtual lab environment for testing PXE boot services managed by an OPNsense firewall.
-
-## Overview
-
-The `pxe_vm_lab_setup.sh` script will create the following resources using libvirt/KVM:
-
-1.  **A Virtual Network**: An isolated network named `harmonylan` (`virbr1`) for the lab.
-2.  **Two Virtual Machines**:
-    *   `opnsense-pxe`: A firewall VM that will act as the gateway and PXE server.
-    *   `pxe-node-1`: A client VM configured to boot from the network.
-
-## Prerequisites
-
-Ensure you have the following software installed on your Arch Linux host:
-
-*   `libvirt`
-*   `qemu`
-*   `virt-install` (from the `virt-install` package)
-*   `curl`
-*   `bzip2`
-
-## Usage
-
-### 1. Create the Environment
-
-Run the `up` command to download the necessary images and create the network and VMs.
-
-```bash
-sudo ./pxe_vm_lab_setup.sh up
-```
-
-### 2. Install and Configure OPNsense
-
-The OPNsense VM is created but the OS needs to be installed manually via the console.
-
-1.  **Connect to the VM console**:
-    ```bash
-    sudo virsh console opnsense-pxe
-    ```
-
-2.  **Log in as the installer**:
-    *   Username: `installer`
-    *   Password: `opnsense`
-
-3.  **Follow the on-screen installation wizard**. When prompted to assign network interfaces (`WAN` and `LAN`):
-    *   Find the MAC address for the `harmonylan` interface by running this command in another terminal:
-        ```bash
-        virsh domiflist opnsense-pxe
-        # Example output:
-        # Interface   Type      Source       Model    MAC
-        # ---------------------------------------------------------
-        # vnet18      network   default      virtio   52:54:00:b5:c4:6d
-        # vnet19      network   harmonylan   virtio   52:54:00:21:f9:ba
-        ```
-    *   Assign the interface connected to `harmonylan` (e.g., `vtnet1` with MAC `52:54:00:21:f9:ba`) as your **LAN**.
-    *   Assign the other interface as your **WAN**.
-
-4.  After the installation is complete, **shut down** the VM from the console menu.
-
-5.  **Detach the installation media** by editing the VM's configuration:
-    ```bash
-    sudo virsh edit opnsense-pxe
-    ```
-    Find and **delete** the entire `<disk>` block corresponding to the `.img` file (the one with `<target ... bus='usb'/>`).
-
-6.  **Start the VM** to boot into the newly installed system:
-    ```bash
-    sudo virsh start opnsense-pxe
-    ```
-
-### 3. Connect to OPNsense from Your Host
-
-To configure OPNsense, you need to connect your host to the `harmonylan` network.
-
-1.  By default, OPNsense configures its LAN interface with the IP `192.168.1.1`.
-2.  Assign a compatible IP address to your host's `virbr1` bridge interface:
-    ```bash
-    sudo ip addr add 192.168.1.5/24 dev virbr1
-    ```
-3.  You can now access the OPNsense VM from your host:
-    *   **SSH**: `ssh root@192.168.1.1` (password: `opnsense`)
-    *   **Web UI**: `https://192.168.1.1`
-
-### 4. Configure PXE Services with Harmony
-
-With connectivity established, you can now use Harmony to configure the OPNsense firewall for PXE booting. Point your Harmony OPNsense scores to the firewall using these details:
-
-*   **Hostname/IP**: `192.168.1.1`
-*   **Credentials**: `root` / `opnsense`
-
-### 5. Boot the PXE Client
-
-Once your Harmony configuration has been applied and OPNsense is serving DHCP/TFTP, start the client VM. It will automatically attempt to boot from the network.
-
-```bash
-sudo virsh start pxe-node-1
-sudo virsh console pxe-node-1
-```
-
-## Cleanup
-
-To destroy all VMs and networks created by the script, run the `clean` command:
-
-```bash
-sudo ./pxe_vm_lab_setup.sh clean
-```
--- a/docs/pxe_test/pxe_vm_lab_setup.sh
+++ b/docs/pxe_test/pxe_vm_lab_setup.sh
@@ -1,191 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# --- Configuration ---
-LAB_DIR="/var/lib/harmony_pxe_test"
-IMG_DIR="${LAB_DIR}/images"
-STATE_DIR="${LAB_DIR}/state"
-VM_OPN="opnsense-pxe"
-VM_PXE="pxe-node-1"
-NET_HARMONYLAN="harmonylan"
-
-# Network settings for the isolated LAN
-VLAN_CIDR="192.168.150.0/24"
-VLAN_GW="192.168.150.1"
-VLAN_MASK="255.255.255.0"
-
-# VM Specifications
-RAM_OPN="2048"
-VCPUS_OPN="2"
-DISK_OPN_GB="10"
-OS_VARIANT_OPN="freebsd14.0" # Updated to a more recent FreeBSD variant
-
-RAM_PXE="4096"
-VCPUS_PXE="2"
-DISK_PXE_GB="40"
-OS_VARIANT_LINUX="centos-stream9"
-
-OPN_IMG_URL="https://mirror.ams1.nl.leaseweb.net/opnsense/releases/25.7/OPNsense-25.7-serial-amd64.img.bz2"
-OPN_IMG_PATH="${IMG_DIR}/OPNsense-25.7-serial-amd64.img"
-CENTOS_ISO_URL="https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os/images/boot.iso"
-CENTOS_ISO_PATH="${IMG_DIR}/CentOS-Stream-9-latest-boot.iso"
-
-CONNECT_URI="qemu:///system"
-
-download_if_missing() {
-  local url="$1"
-  local dest="$2"
-  if [[ ! -f "$dest" ]]; then
-    echo "Downloading $url to $dest"
-    mkdir -p "$(dirname "$dest")"
-    local tmp
-    tmp="$(mktemp)"
-    curl -L --progress-bar "$url" -o "$tmp"
-    case "$url" in
-      *.bz2) bunzip2 -c "$tmp" > "$dest" && rm -f "$tmp" ;;
-      *) mv "$tmp" "$dest" ;;
-    esac
-  else
-    echo "Already present: $dest"
-  fi
-}
-
-# Ensures a libvirt network is defined and active
-ensure_network() {
-  local net_name="$1"
-  local net_xml_path="$2"
-  if virsh --connect "${CONNECT_URI}" net-info "${net_name}" >/dev/null 2>&1; then
-    echo "Network ${net_name} already exists."
-  else
-    echo "Defining network ${net_name} from ${net_xml_path}"
-    virsh --connect "${CONNECT_URI}" net-define "${net_xml_path}"
-  fi
-
-  if ! virsh --connect "${CONNECT_URI}" net-info "${net_name}" | grep "Active: *yes"; then
-    echo "Starting network ${net_name}..."
-    virsh --connect "${CONNECT_URI}" net-start "${net_name}"
-    virsh --connect "${CONNECT_URI}" net-autostart "${net_name}"
-  fi
-}
-
-# Destroys a VM completely
-destroy_vm() {
-  local vm_name="$1"
-  if virsh --connect "${CONNECT_URI}" dominfo "$vm_name" >/dev/null 2>&1; then
-    echo "Destroying and undefining VM: ${vm_name}"
-    virsh --connect "${CONNECT_URI}" destroy "$vm_name" || true
-    virsh --connect "${CONNECT_URI}" undefine "$vm_name" --nvram
-  fi
-}
-
-# Destroys a libvirt network
-destroy_network() {
-  local net_name="$1"
-  if virsh --connect "${CONNECT_URI}" net-info "$net_name" >/dev/null 2>&1; then
-    echo "Destroying and undefining network: ${net_name}"
-    virsh --connect "${CONNECT_URI}" net-destroy "$net_name" || true
-    virsh --connect "${CONNECT_URI}" net-undefine "$net_name"
-  fi
-}
-
-# --- Main Logic ---
-create_lab_environment() {
-  # Create network definition files
-  cat > "${STATE_DIR}/default.xml" <<EOF
-<network>
-  <name>default</name>
-  <forward mode='nat'/>
-  <bridge name='virbr0' stp='on' delay='0'/>
-  <ip address='192.168.122.1' netmask='255.255.255.0'>
-    <dhcp>
-      <range start='192.168.122.100' end='192.168.122.200'/>
-    </dhcp>
-  </ip>
-</network>
-EOF
-
-  cat > "${STATE_DIR}/${NET_HARMONYLAN}.xml" <<EOF
-<network>
-  <name>${NET_HARMONYLAN}</name>
-  <bridge name='virbr1' stp='on' delay='0'/>
-</network>
-EOF
-
-  # Ensure both networks exist and are active
-  ensure_network "default" "${STATE_DIR}/default.xml"
-  ensure_network "${NET_HARMONYLAN}" "${STATE_DIR}/${NET_HARMONYLAN}.xml"
-
-  # --- Create OPNsense VM (MODIFIED SECTION) ---
-  local disk_opn="${IMG_DIR}/${VM_OPN}.qcow2"
-  if [[ ! -f "$disk_opn" ]]; then
-    qemu-img create -f qcow2 "$disk_opn" "${DISK_OPN_GB}G"
-  fi
-
-  echo "Creating OPNsense VM using serial image..."
-  virt-install \
-    --connect "${CONNECT_URI}" \
-    --name "${VM_OPN}" \
-    --ram "${RAM_OPN}" \
-    --vcpus "${VCPUS_OPN}" \
-    --cpu host-passthrough \
-    --os-variant "${OS_VARIANT_OPN}" \
-    --graphics none \
-    --noautoconsole \
-    --disk path="${disk_opn}",device=disk,bus=virtio,boot.order=1 \
-    --disk path="${OPN_IMG_PATH}",device=disk,bus=usb,readonly=on,boot.order=2 \
-    --network network=default,model=virtio \
-    --network network="${NET_HARMONYLAN}",model=virtio \
-    --boot uefi,menu=on
-
-  echo "OPNsense VM created. Connect with: sudo virsh console ${VM_OPN}"
-  echo "The VM will boot from the serial installation image."
-  echo "Login with user 'installer' and password 'opnsense' to start the installation."
-  echo "Install onto the VirtIO disk (vtbd0)."
-  echo "After installation, shutdown the VM, then run 'sudo virsh edit ${VM_OPN}' and remove the USB disk block to boot from the installed system."
-
-  # --- Create PXE Client VM ---
-  local disk_pxe="${IMG_DIR}/${VM_PXE}.qcow2"
-  if [[ ! -f "$disk_pxe" ]]; then
-    qemu-img create -f qcow2 "$disk_pxe" "${DISK_PXE_GB}G"
-  fi
-
-  echo "Creating PXE client VM..."
-  virt-install \
-    --connect "${CONNECT_URI}" \
-    --name "${VM_PXE}" \
-    --ram "${RAM_PXE}" \
-    --vcpus "${VCPUS_PXE}" \
-    --cpu host-passthrough \
-    --os-variant "${OS_VARIANT_LINUX}" \
-    --graphics none \
-    --noautoconsole \
-    --disk path="${disk_pxe}",format=qcow2,bus=virtio \
-    --network network="${NET_HARMONYLAN}",model=virtio \
-    --pxe \
-    --boot uefi,menu=on
-
-  echo "PXE VM created. It will attempt to netboot on ${NET_HARMONYLAN}."
-}
-
-# --- Script Entrypoint ---
-case "${1:-}" in
-  up)
-    mkdir -p "${IMG_DIR}" "${STATE_DIR}"
-    download_if_missing "$OPN_IMG_URL" "$OPN_IMG_PATH"
-    download_if_missing "$CENTOS_ISO_URL" "$CENTOS_ISO_PATH"
-    create_lab_environment
-    echo "Lab setup complete. Use 'sudo virsh list --all' to see VMs."
-    ;;
-  clean)
-    destroy_vm "${VM_PXE}"
-    destroy_vm "${VM_OPN}"
-    destroy_network "${NET_HARMONYLAN}"
-    # Optionally destroy the default network if you want a full reset
-    # destroy_network "default"
-    echo "Cleanup complete."
-    ;;
-  *)
-    echo "Usage: sudo $0 {up|clean}"
-    exit 1
-    ;;
-esac
--- a/examples/application_monitoring_with_tenant/Cargo.toml
+++ b/examples/application_monitoring_with_tenant/Cargo.toml
@@ -1,15 +0,0 @@
-[package]
-name = "example-application-monitoring-with-tenant"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-
-[dependencies]
-env_logger.workspace = true
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
-logging = "0.1.0"
-tokio.workspace = true
-url.workspace = true
--- a/examples/application_monitoring_with_tenant/harmony
+++ b/examples/application_monitoring_with_tenant/harmony
--- a/examples/application_monitoring_with_tenant/src/main.rs
+++ b/examples/application_monitoring_with_tenant/src/main.rs
@@ -1,56 +0,0 @@
-use std::{path::PathBuf, str::FromStr, sync::Arc};
-
-use harmony::{
-    inventory::Inventory,
-    modules::{
-        application::{ApplicationScore, RustWebFramework, RustWebapp, features::Monitoring},
-        monitoring::alert_channel::webhook_receiver::WebhookReceiver,
-        tenant::TenantScore,
-    },
-    topology::{K8sAnywhereTopology, tenant::TenantConfig},
-};
-use harmony_types::id::Id;
-use harmony_types::net::Url;
-
-#[tokio::main]
-async fn main() {
-    //TODO there is a bug where the application is deployed into the namespace matching the
-    //application name and the tenant is created in the namesapce matching the tenant name
-    //in order for the application to be deployed in the tenant namespace the application.name and
-    //the TenantConfig.name must match
-    let tenant = TenantScore {
-        config: TenantConfig {
-            id: Id::from_str("test-tenant-id").unwrap(),
-            name: "example-monitoring".to_string(),
-            ..Default::default()
-        },
-    };
-    let application = Arc::new(RustWebapp {
-        name: "example-monitoring".to_string(),
-        domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
-        project_root: PathBuf::from("./examples/rust/webapp"),
-        framework: Some(RustWebFramework::Leptos),
-    });
-
-    let webhook_receiver = WebhookReceiver {
-        name: "sample-webhook-receiver".to_string(),
-        url: Url::Url(url::Url::parse("https://webhook-doesnt-exist.com").unwrap()),
-    };
-
-    let app = ApplicationScore {
-        features: vec![Box::new(Monitoring {
-            alert_receiver: vec![Box::new(webhook_receiver)],
-            application: application.clone(),
-        })],
-        application,
-    };
-
-    harmony_cli::run(
-        Inventory::autoload(),
-        K8sAnywhereTopology::from_env(),
-        vec![Box::new(tenant), Box::new(app)],
-        None,
-    )
-    .await
-    .unwrap();
-}
--- a/examples/cli/src/main.rs
+++ b/examples/cli/src/main.rs
@@ -1,27 +1,20 @@
 use harmony::{
    inventory::Inventory,
-    modules::{
-        dummy::{ErrorScore, PanicScore, SuccessScore},
-        inventory::DiscoverInventoryAgentScore,
-    },
+    maestro::Maestro,
+    modules::dummy::{ErrorScore, PanicScore, SuccessScore},
    topology::LocalhostTopology,
 };

 #[tokio::main]
 async fn main() {
-    harmony_cli::run(
-        Inventory::autoload(),
-        LocalhostTopology::new(),
-        vec![
-            Box::new(SuccessScore {}),
-            Box::new(ErrorScore {}),
-            Box::new(PanicScore {}),
-            Box::new(DiscoverInventoryAgentScore {
-                discovery_timeout: Some(10),
-            }),
-        ],
-        None,
-    )
-    .await
-    .unwrap();
+    let inventory = Inventory::autoload();
+    let topology = LocalhostTopology::new();
+    let mut maestro = Maestro::initialize(inventory, topology).await.unwrap();
+
+    maestro.register_all(vec![
+        Box::new(SuccessScore {}),
+        Box::new(ErrorScore {}),
+        Box::new(PanicScore {}),
+    ]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/kube-rs/src/main.rs
+++ b/examples/kube-rs/src/main.rs
@@ -125,47 +125,40 @@ spec:
                  name: nginx"#,
    )
    .unwrap();
-    deployment
+    return deployment;
 }
 fn nginx_deployment_2() -> Deployment {
-    let pod_template = PodTemplateSpec {
-        metadata: Some(ObjectMeta {
-            labels: Some(BTreeMap::from([(
-                "app".to_string(),
-                "nginx-test".to_string(),
-            )])),
+    let mut pod_template = PodTemplateSpec::default();
+    pod_template.metadata = Some(ObjectMeta {
+        labels: Some(BTreeMap::from([(
+            "app".to_string(),
+            "nginx-test".to_string(),
+        )])),
+        ..Default::default()
+    });
+    pod_template.spec = Some(PodSpec {
+        containers: vec![Container {
+            name: "nginx".to_string(),
+            image: Some("nginx".to_string()),
            ..Default::default()
-        }),
-        spec: Some(PodSpec {
-            containers: vec![Container {
-                name: "nginx".to_string(),
-                image: Some("nginx".to_string()),
-                ..Default::default()
-            }],
-            ..Default::default()
-        }),
+        }],
+        ..Default::default()
+    });
+    let mut spec = DeploymentSpec::default();
+    spec.template = pod_template;
+    spec.selector = LabelSelector {
+        match_expressions: None,
+        match_labels: Some(BTreeMap::from([(
+            "app".to_string(),
+            "nginx-test".to_string(),
+        )])),
    };

-    let spec = DeploymentSpec {
-        template: pod_template,
-        selector: LabelSelector {
-            match_expressions: None,
-            match_labels: Some(BTreeMap::from([(
-                "app".to_string(),
-                "nginx-test".to_string(),
-            )])),
-        },
-        ..Default::default()
-    };
+    let mut deployment = Deployment::default();
+    deployment.spec = Some(spec);
+    deployment.metadata.name = Some("nginx-test".to_string());

-    Deployment {
-        spec: Some(spec),
-        metadata: ObjectMeta {
-            name: Some("nginx-test".to_string()),
-            ..Default::default()
-        },
-        ..Default::default()
-    }
+    deployment
 }

 fn nginx_deployment() -> Deployment {
--- a/examples/lamp/src/main.rs
+++ b/examples/lamp/src/main.rs
@@ -1,10 +1,10 @@
 use harmony::{
    data::Version,
    inventory::Inventory,
+    maestro::Maestro,
    modules::lamp::{LAMPConfig, LAMPScore},
-    topology::K8sAnywhereTopology,
+    topology::{K8sAnywhereTopology, Url},
 };
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
@@ -24,7 +24,7 @@ async fn main() {
        // This config can be extended as needed for more complicated configurations
        config: LAMPConfig {
            project_root: "./php".into(),
-            database_size: "4Gi".to_string().into(),
+            database_size: format!("4Gi").into(),
            ..Default::default()
        },
    };
@@ -43,13 +43,15 @@ async fn main() {
    // K8sAnywhereTopology as it is the most automatic one that enables you to easily deploy
    // locally, to development environment from a CI, to staging, and to production with settings
    // that automatically adapt to each environment grade.
-    harmony_cli::run(
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
-        vec![Box::new(lamp_stack)],
-        None,
    )
    .await
    .unwrap();
+
+    maestro.register_all(vec![Box::new(lamp_stack)]);
+    // Here we bootstrap the CLI, this gives some nice features if you need them
+    harmony_cli::init(maestro, None).await.unwrap();
 }
 // That's it, end of the infra as code.
--- a/examples/monitoring/Cargo.toml
+++ b/examples/monitoring/Cargo.toml
@@ -6,9 +6,8 @@ readme.workspace = true
 license.workspace = true

 [dependencies]
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_macros = { path = "../../harmony_macros" }
-harmony_types = { path = "../../harmony_types" }
+harmony = { version = "0.1.0", path = "../../harmony" }
+harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
+harmony_macros = { version = "0.1.0", path = "../../harmony_macros" }
 tokio.workspace = true
 url.workspace = true
--- a/examples/monitoring/src/main.rs
+++ b/examples/monitoring/src/main.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;

 use harmony::{
    inventory::Inventory,
+    maestro::Maestro,
    modules::{
        monitoring::{
            alert_channel::discord_alert_channel::DiscordWebhook,
@@ -22,9 +23,8 @@ use harmony::{
            k8s::pvc::high_pvc_fill_rate_over_two_days,
        },
    },
-    topology::K8sAnywhereTopology,
+    topology::{K8sAnywhereTopology, Url},
 };
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
@@ -51,8 +51,8 @@ async fn main() {

    let service_monitor_endpoint = ServiceMonitorEndpoint {
        port: Some("80".to_string()),
-        path: Some("/metrics".to_string()),
-        scheme: Some(HTTPScheme::HTTP),
+        path: "/metrics".to_string(),
+        scheme: HTTPScheme::HTTP,
        ..Default::default()
    };

@@ -74,13 +74,13 @@ async fn main() {
        rules: vec![Box::new(additional_rules), Box::new(additional_rules2)],
        service_monitors: vec![service_monitor],
    };
-
-    harmony_cli::run(
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
-        vec![Box::new(alerting_score)],
-        None,
    )
    .await
    .unwrap();
+
+    maestro.register_all(vec![Box::new(alerting_score)]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/monitoring_with_tenant/Cargo.toml
+++ b/examples/monitoring_with_tenant/Cargo.toml
@@ -7,8 +7,7 @@ license.workspace = true

 [dependencies]
 cidr.workspace = true
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
+harmony = { version = "0.1.0", path = "../../harmony" }
+harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
 tokio.workspace = true
 url.workspace = true
--- a/examples/monitoring_with_tenant/src/main.rs
+++ b/examples/monitoring_with_tenant/src/main.rs
@@ -1,7 +1,9 @@
-use std::{collections::HashMap, str::FromStr};
+use std::collections::HashMap;

 use harmony::{
+    data::Id,
    inventory::Inventory,
+    maestro::Maestro,
    modules::{
        monitoring::{
            alert_channel::discord_alert_channel::DiscordWebhook,
@@ -18,18 +20,16 @@ use harmony::{
        tenant::TenantScore,
    },
    topology::{
-        K8sAnywhereTopology,
+        K8sAnywhereTopology, Url,
        tenant::{ResourceLimits, TenantConfig, TenantNetworkPolicy},
    },
 };
-use harmony_types::id::Id;
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
    let tenant = TenantScore {
        config: TenantConfig {
-            id: Id::from_str("1234").unwrap(),
+            id: Id::from_string("1234".to_string()),
            name: "test-tenant".to_string(),
            resource_limits: ResourceLimits {
                cpu_request_cores: 6.0,
@@ -54,8 +54,8 @@ async fn main() {

    let service_monitor_endpoint = ServiceMonitorEndpoint {
        port: Some("80".to_string()),
-        path: Some("/metrics".to_string()),
-        scheme: Some(HTTPScheme::HTTP),
+        path: "/metrics".to_string(),
+        scheme: HTTPScheme::HTTP,
        ..Default::default()
    };

@@ -78,13 +78,13 @@ async fn main() {
        rules: vec![Box::new(additional_rules)],
        service_monitors: vec![service_monitor],
    };
-
-    harmony_cli::run(
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
-        vec![Box::new(tenant), Box::new(alerting_score)],
-        None,
    )
    .await
    .unwrap();
+
+    maestro.register_all(vec![Box::new(tenant), Box::new(alerting_score)]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/nanodc/src/main.rs
+++ b/examples/nanodc/src/main.rs
@@ -8,8 +8,9 @@ use harmony::{
    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
    infra::opnsense::OPNSenseManagementInterface,
    inventory::Inventory,
+    maestro::Maestro,
    modules::{
-        http::StaticFilesHttpScore,
+        http::HttpScore,
        ipxe::IpxeScore,
        okd::{
            bootstrap_dhcp::OKDBootstrapDhcpScore,
@@ -18,10 +19,9 @@ use harmony::{
        },
        tftp::TftpScore,
    },
-    topology::{LogicalHost, UnmanagedRouter},
+    topology::{LogicalHost, UnmanagedRouter, Url},
 };
 use harmony_macros::{ip, mac_address};
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
@@ -87,7 +87,8 @@ async fn main() {
    let inventory = Inventory {
        location: Location::new("I am mobile".to_string(), "earth".to_string()),
        switch: SwitchGroup::from([]),
-        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
+        firewall: FirewallGroup::from([PhysicalHost::empty(HostCategory::Firewall)
+            .management(Arc::new(OPNSenseManagementInterface::new()))]),
        storage_host: vec![],
        worker_host: vec![
            PhysicalHost::empty(HostCategory::Server)
@@ -125,28 +126,20 @@ async fn main() {
        harmony::modules::okd::load_balancer::OKDLoadBalancerScore::new(&topology);

    let tftp_score = TftpScore::new(Url::LocalFolder("./data/watchguard/tftpboot".to_string()));
-    let http_score = StaticFilesHttpScore {
-        folder_to_serve: Some(Url::LocalFolder(
-            "./data/watchguard/pxe-http-files".to_string(),
-        )),
-        files: vec![],
-    };
+    let http_score = HttpScore::new(Url::LocalFolder(
+        "./data/watchguard/pxe-http-files".to_string(),
+    ));
    let ipxe_score = IpxeScore::new();
-
-    harmony_tui::run(
-        inventory,
-        topology,
-        vec![
-            Box::new(dns_score),
-            Box::new(bootstrap_dhcp_score),
-            Box::new(bootstrap_load_balancer_score),
-            Box::new(load_balancer_score),
-            Box::new(tftp_score),
-            Box::new(http_score),
-            Box::new(ipxe_score),
-            Box::new(dhcp_score),
-        ],
-    )
-    .await
-    .unwrap();
+    let mut maestro = Maestro::initialize(inventory, topology).await.unwrap();
+    maestro.register_all(vec![
+        Box::new(dns_score),
+        Box::new(bootstrap_dhcp_score),
+        Box::new(bootstrap_load_balancer_score),
+        Box::new(load_balancer_score),
+        Box::new(tftp_score),
+        Box::new(http_score),
+        Box::new(ipxe_score),
+        Box::new(dhcp_score),
+    ]);
+    harmony_tui::init(maestro).await.unwrap();
 }
--- a/examples/ntfy/src/main.rs
+++ b/examples/ntfy/src/main.rs
@@ -1,18 +1,19 @@
 use harmony::{
-    inventory::Inventory, modules::monitoring::ntfy::ntfy::NtfyScore, topology::K8sAnywhereTopology,
+    inventory::Inventory, maestro::Maestro, modules::monitoring::ntfy::ntfy::NtfyScore,
+    topology::K8sAnywhereTopology,
 };

 #[tokio::main]
 async fn main() {
-    harmony_cli::run(
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
-        vec![Box::new(NtfyScore {
-            namespace: "monitoring".to_string(),
-            host: "localhost".to_string(),
-        })],
-        None,
    )
    .await
    .unwrap();
+
+    maestro.register_all(vec![Box::new(NtfyScore {
+        namespace: "monitoring".to_string(),
+    })]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/okd_pxe/Cargo.toml
+++ b/examples/okd_pxe/Cargo.toml
@@ -1,21 +0,0 @@
-[package]
-name = "example-pxe"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-publish = false
-
-[dependencies]
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
-harmony_secret = { path = "../../harmony_secret" }
-harmony_secret_derive = { path = "../../harmony_secret_derive" }
-cidr = { workspace = true }
-tokio = { workspace = true }
-harmony_macros = { path = "../../harmony_macros" }
-log = { workspace = true }
-env_logger = { workspace = true }
-url = { workspace = true }
-serde.workspace = true
--- a/examples/okd_pxe/src/main.rs
+++ b/examples/okd_pxe/src/main.rs
@@ -1,24 +0,0 @@
-mod topology;
-
-use crate::topology::{get_inventory, get_topology};
-use harmony::modules::okd::ipxe::OkdIpxeScore;
-
-#[tokio::main]
-async fn main() {
-    let inventory = get_inventory();
-    let topology = get_topology().await;
-
-    let kickstart_filename = "inventory.kickstart".to_string();
-    let cluster_pubkey_filename = "cluster_ssh_key.pub".to_string();
-    let harmony_inventory_agent = "harmony_inventory_agent".to_string();
-
-    let ipxe_score = OkdIpxeScore {
-        kickstart_filename,
-        harmony_inventory_agent,
-        cluster_pubkey_filename,
-    };
-
-    harmony_cli::run(inventory, topology, vec![Box::new(ipxe_score)], None)
-        .await
-        .unwrap();
-}
--- a/examples/okd_pxe/src/topology.rs
+++ b/examples/okd_pxe/src/topology.rs
@@ -1,77 +0,0 @@
-use cidr::Ipv4Cidr;
-use harmony::{
-    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
-    infra::opnsense::OPNSenseManagementInterface,
-    inventory::Inventory,
-    topology::{HAClusterTopology, LogicalHost, UnmanagedRouter},
-};
-use harmony_macros::{ip, ipv4};
-use harmony_secret::{Secret, SecretManager};
-use serde::{Deserialize, Serialize};
-use std::{net::IpAddr, sync::Arc};
-
-#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
-struct OPNSenseFirewallConfig {
-    username: String,
-    password: String,
-}
-
-pub async fn get_topology() -> HAClusterTopology {
-    let firewall = harmony::topology::LogicalHost {
-        ip: ip!("192.168.1.1"),
-        name: String::from("opnsense-1"),
-    };
-
-    let config = SecretManager::get::<OPNSenseFirewallConfig>().await;
-    let config = config.unwrap();
-
-    let opnsense = Arc::new(
-        harmony::infra::opnsense::OPNSenseFirewall::new(
-            firewall,
-            None,
-            &config.username,
-            &config.password,
-        )
-        .await,
-    );
-    let lan_subnet = ipv4!("192.168.1.0");
-    let gateway_ipv4 = ipv4!("192.168.1.1");
-    let gateway_ip = IpAddr::V4(gateway_ipv4);
-    harmony::topology::HAClusterTopology {
-        domain_name: "demo.harmony.mcd".to_string(),
-        router: Arc::new(UnmanagedRouter::new(
-            gateway_ip,
-            Ipv4Cidr::new(lan_subnet, 24).unwrap(),
-        )),
-        load_balancer: opnsense.clone(),
-        firewall: opnsense.clone(),
-        tftp_server: opnsense.clone(),
-        http_server: opnsense.clone(),
-        dhcp_server: opnsense.clone(),
-        dns_server: opnsense.clone(),
-        control_plane: vec![LogicalHost {
-            ip: ip!("10.100.8.20"),
-            name: "cp0".to_string(),
-        }],
-        bootstrap_host: LogicalHost {
-            ip: ip!("10.100.8.20"),
-            name: "cp0".to_string(),
-        },
-        workers: vec![],
-        switch: vec![],
-    }
-}
-
-pub fn get_inventory() -> Inventory {
-    Inventory {
-        location: Location::new(
-            "Some virtual machine or maybe a physical machine if you're cool".to_string(),
-            "testopnsense".to_string(),
-        ),
-        switch: SwitchGroup::from([]),
-        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
-        storage_host: vec![],
-        worker_host: vec![],
-        control_plane_host: vec![],
-    }
-}
--- a/examples/okd_pxe/ssh_example_key
+++ b/examples/okd_pxe/ssh_example_key
@@ -1,7 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACAcemw8pbwuvHFaYynxBbS0Cf3ThYuj1Utr7CDqjwySHAAAAJikacCNpGnA
-jQAAAAtzc2gtZWQyNTUxOQAAACAcemw8pbwuvHFaYynxBbS0Cf3ThYuj1Utr7CDqjwySHA
-AAAECiiKk4V6Q5cVs6axDM4sjAzZn/QCZLQekmYQXS9XbEYxx6bDylvC68cVpjKfEFtLQJ
-/dOFi6PVS2vsIOqPDJIcAAAAEGplYW5nYWJAbGlsaWFuZTIBAgMEBQ==
-----END OPENSSH PRIVATE KEY-----
--- a/examples/okd_pxe/ssh_example_key.pub
+++ b/examples/okd_pxe/ssh_example_key.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBx6bDylvC68cVpjKfEFtLQJ/dOFi6PVS2vsIOqPDJIc jeangab@liliane2
--- a/examples/opnsense/src/main.rs
+++ b/examples/opnsense/src/main.rs
@@ -8,17 +8,17 @@ use harmony::{
    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
    infra::opnsense::OPNSenseManagementInterface,
    inventory::Inventory,
+    maestro::Maestro,
    modules::{
        dummy::{ErrorScore, PanicScore, SuccessScore},
-        http::StaticFilesHttpScore,
+        http::HttpScore,
        okd::{dhcp::OKDDhcpScore, dns::OKDDnsScore, load_balancer::OKDLoadBalancerScore},
        opnsense::OPNsenseShellCommandScore,
        tftp::TftpScore,
    },
-    topology::{LogicalHost, UnmanagedRouter},
+    topology::{LogicalHost, UnmanagedRouter, Url},
 };
 use harmony_macros::{ip, mac_address};
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
@@ -63,7 +63,8 @@ async fn main() {
            "wk".to_string(),
        ),
        switch: SwitchGroup::from([]),
-        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
+        firewall: FirewallGroup::from([PhysicalHost::empty(HostCategory::Firewall)
+            .management(Arc::new(OPNSenseManagementInterface::new()))]),
        storage_host: vec![],
        worker_host: vec![],
        control_plane_host: vec![
@@ -80,31 +81,23 @@ async fn main() {
    let load_balancer_score = OKDLoadBalancerScore::new(&topology);

    let tftp_score = TftpScore::new(Url::LocalFolder("./data/watchguard/tftpboot".to_string()));
-    let http_score = StaticFilesHttpScore {
-        folder_to_serve: Some(Url::LocalFolder(
-            "./data/watchguard/pxe-http-files".to_string(),
-        )),
-        files: vec![],
-    };
-
-    harmony_tui::run(
-        inventory,
-        topology,
-        vec![
-            Box::new(dns_score),
-            Box::new(dhcp_score),
-            Box::new(load_balancer_score),
-            Box::new(tftp_score),
-            Box::new(http_score),
-            Box::new(OPNsenseShellCommandScore {
-                opnsense: opnsense.get_opnsense_config(),
-                command: "touch /tmp/helloharmonytouching".to_string(),
-            }),
-            Box::new(SuccessScore {}),
-            Box::new(ErrorScore {}),
-            Box::new(PanicScore {}),
-        ],
-    )
-    .await
-    .unwrap();
+    let http_score = HttpScore::new(Url::LocalFolder(
+        "./data/watchguard/pxe-http-files".to_string(),
+    ));
+    let mut maestro = Maestro::initialize(inventory, topology).await.unwrap();
+    maestro.register_all(vec![
+        Box::new(dns_score),
+        Box::new(dhcp_score),
+        Box::new(load_balancer_score),
+        Box::new(tftp_score),
+        Box::new(http_score),
+        Box::new(OPNsenseShellCommandScore {
+            opnsense: opnsense.get_opnsense_config(),
+            command: "touch /tmp/helloharmonytouching".to_string(),
+        }),
+        Box::new(SuccessScore {}),
+        Box::new(ErrorScore {}),
+        Box::new(PanicScore {}),
+    ]);
+    harmony_tui::init(maestro).await.unwrap();
 }
--- a/examples/postgres/Cargo.toml
+++ b/examples/postgres/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "example-postgres"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+harmony = { path = "../../harmony" }
+tokio = { version = "1", features = ["full"] }
+serde = { version = "1.0", features = ["derive"] }
+async-trait = "0.1.80"
--- a/examples/postgres/src/main.rs
+++ b/examples/postgres/src/main.rs
@@ -0,0 +1,84 @@
+use async_trait::async_trait;
+use harmony::{
+    data::{PostgresDatabase, PostgresUser},
+    interpret::InterpretError,
+    inventory::Inventory,
+    maestro::Maestro,
+    modules::postgres::PostgresScore,
+    topology::{PostgresServer, Topology},
+};
+use std::error::Error;
+
+#[derive(Debug, Clone)]
+struct MockTopology;
+
+#[async_trait]
+impl Topology for MockTopology {
+    fn name(&self) -> &str {
+        "MockTopology"
+    }
+
+    async fn ensure_ready(&self) -> Result<harmony::interpret::Outcome, InterpretError> {
+        Ok(harmony::interpret::Outcome::new(
+            harmony::interpret::InterpretStatus::SUCCESS,
+            "Mock topology is always ready".to_string(),
+        ))
+    }
+}
+
+#[async_trait]
+impl PostgresServer for MockTopology {
+    async fn ensure_users_exist(&self, users: Vec<PostgresUser>) -> Result<(), InterpretError> {
+        println!("Ensuring users exist:");
+        for user in users {
+            println!("  - {}: {}", user.name, user.password);
+        }
+        Ok(())
+    }
+
+    async fn ensure_databases_exist(
+        &self,
+        databases: Vec<PostgresDatabase>,
+    ) -> Result<(), InterpretError> {
+        println!("Ensuring databases exist:");
+        for db in databases {
+            println!("  - {}: owner={}", db.name, db.owner);
+        }
+        Ok(())
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn Error>> {
+    let users = vec![
+        PostgresUser {
+            name: "admin".to_string(),
+            password: "password".to_string(),
+        },
+        PostgresUser {
+            name: "user".to_string(),
+            password: "password".to_string(),
+        },
+    ];
+
+    let databases = vec![
+        PostgresDatabase {
+            name: "app_db".to_string(),
+            owner: "admin".to_string(),
+        },
+        PostgresDatabase {
+            name: "user_db".to_string(),
+            owner: "user".to_string(),
+        },
+    ];
+
+    let postgres_score = PostgresScore::new(users, databases);
+
+    let inventory = Inventory::empty();
+    let topology = MockTopology;
+    let maestro = Maestro::new(inventory, topology);
+
+    maestro.interpret(Box::new(postgres_score)).await?;
+
+    Ok(())
+}
--- a/examples/rust/.gitignore
+++ b/examples/rust/.gitignore
@@ -1,3 +0,0 @@
-Dockerfile.harmony
-.harmony_generated
-harmony
--- a/examples/rust/Cargo.toml
+++ b/examples/rust/Cargo.toml
@@ -12,4 +12,3 @@ tokio = { workspace = true }
 log = { workspace = true }
 env_logger = { workspace = true }
 url = { workspace = true }
-base64.workspace = true
--- a/examples/rust/src/main.rs
+++ b/examples/rust/src/main.rs
@@ -1,59 +1,20 @@
-use std::{path::PathBuf, sync::Arc};
-
 use harmony::{
    inventory::Inventory,
-    modules::{
-        application::{
-            ApplicationScore, RustWebFramework, RustWebapp,
-            features::{ContinuousDelivery, Monitoring},
-        },
-        monitoring::alert_channel::{
-            discord_alert_channel::DiscordWebhook, webhook_receiver::WebhookReceiver,
-        },
-    },
-    topology::K8sAnywhereTopology,
+    maestro::Maestro,
+    modules::application::{RustWebappScore, features::ContinuousDelivery},
+    topology::{K8sAnywhereTopology, Url},
 };
-use harmony_types::net::Url;

 #[tokio::main]
 async fn main() {
-    let application = Arc::new(RustWebapp {
-        name: "harmony-example-rust-webapp".to_string(),
+    let app = RustWebappScore {
+        name: "Example Rust Webapp".to_string(),
        domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
-        project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
-        framework: Some(RustWebFramework::Leptos),
-    });
-
-    let discord_receiver = DiscordWebhook {
-        name: "test-discord".to_string(),
-        url: Url::Url(url::Url::parse("https://discord.doesnt.exist.com").unwrap()),
+        features: vec![Box::new(ContinuousDelivery {})],
    };

-    let webhook_receiver = WebhookReceiver {
-        name: "sample-webhook-receiver".to_string(),
-        url: Url::Url(url::Url::parse("https://webhook-doesnt-exist.com").unwrap()),
-    };
-
-    let app = ApplicationScore {
-        features: vec![
-            Box::new(ContinuousDelivery {
-                application: application.clone(),
-            }),
-            Box::new(Monitoring {
-                application: application.clone(),
-                alert_receiver: vec![Box::new(discord_receiver), Box::new(webhook_receiver)],
-            }),
-            // TODO add backups, multisite ha, etc
-        ],
-        application,
-    };
-
-    harmony_cli::run(
-        Inventory::autoload(),
-        K8sAnywhereTopology::from_env(),
-        vec![Box::new(app)],
-        None,
-    )
-    .await
-    .unwrap();
+    let topology = K8sAnywhereTopology::from_env();
+    let mut maestro = Maestro::new(Inventory::autoload(), topology);
+    maestro.register_all(vec![Box::new(app)]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/rust/webapp/.gitignore
+++ b/examples/rust/webapp/.gitignore
@@ -1,14 +0,0 @@
-# Generated by Cargo
-# will have compiled files and executables
-debug/
-target/
-
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
-
-# These are backup files generated by rustfmt
-**/*.rs.bk
-
-# MSVC Windows builds of rustc generate these, which store debugging information
-*.pdb
--- a/examples/rust/webapp/Cargo.toml
+++ b/examples/rust/webapp/Cargo.toml
@@ -1,93 +0,0 @@
-[package]
-name = "harmony-example-rust-webapp"
-version = "0.1.0"
-edition = "2021"
-
-[lib]
-crate-type = ["cdylib", "rlib"]
-
-[workspace]
-
-[dependencies]
-actix-files = { version = "0.6", optional = true }
-actix-web = { version = "4", optional = true, features = ["macros"] }
-console_error_panic_hook = "0.1"
-http = { version = "1.0.0", optional = true }
-leptos = { version = "0.7.0" }
-leptos_meta = { version = "0.7.0" }
-leptos_actix = { version = "0.7.0", optional = true }
-leptos_router = { version = "0.7.0" }
-wasm-bindgen = "=0.2.100"
-
-[features]
-csr = ["leptos/csr"]
-hydrate = ["leptos/hydrate"]
-ssr = [
-  "dep:actix-files",
-  "dep:actix-web",
-  "dep:leptos_actix",
-  "leptos/ssr",
-  "leptos_meta/ssr",
-  "leptos_router/ssr",
-]
-
-# Defines a size-optimized profile for the WASM bundle in release mode
-[profile.wasm-release]
-inherits = "release"
-opt-level = 'z'
-lto = true
-codegen-units = 1
-panic = "abort"
-
-[package.metadata.leptos]
-# The name used by wasm-bindgen/cargo-leptos for the JS/WASM bundle. Defaults to the crate name
-output-name = "harmony-example-rust-webapp"
-# The site root folder is where cargo-leptos generate all output. WARNING: all content of this folder will be erased on a rebuild. Use it in your server setup.
-site-root = "target/site"
-# The site-root relative folder where all compiled output (JS, WASM and CSS) is written
-# Defaults to pkg
-site-pkg-dir = "pkg"
-# [Optional] The source CSS file. If it ends with .sass or .scss then it will be compiled by dart-sass into CSS. The CSS is optimized by Lightning CSS before being written to <site-root>/<site-pkg>/app.css
-style-file = "style/main.scss"
-# Assets source dir. All files found here will be copied and synchronized to site-root.
-# The assets-dir cannot have a sub directory with the same name/path as site-pkg-dir.
-#
-# Optional. Env: LEPTOS_ASSETS_DIR.
-assets-dir = "assets"
-# The IP and port (ex: 127.0.0.1:3000) where the server serves the content. Use it in your server setup.
-site-addr = "0.0.0.0:3000"
-# The port to use for automatic reload monitoring
-reload-port = 3001
-# [Optional] Command to use when running end2end tests. It will run in the end2end dir.
-#   [Windows] for non-WSL use "npx.cmd playwright test"
-#   This binary name can be checked in Powershell with Get-Command npx
-end2end-cmd = "npx playwright test"
-end2end-dir = "end2end"
-#  The browserlist query used for optimizing the CSS.
-browserquery = "defaults"
-# The environment Leptos will run in, usually either "DEV" or "PROD"
-env = "DEV"
-# The features to use when compiling the bin target
-#
-# Optional. Can be over-ridden with the command line parameter --bin-features
-bin-features = ["ssr"]
-
-# If the --no-default-features flag should be used when compiling the bin target
-#
-# Optional. Defaults to false.
-bin-default-features = false
-
-# The features to use when compiling the lib target
-#
-# Optional. Can be over-ridden with the command line parameter --lib-features
-lib-features = ["hydrate"]
-
-# If the --no-default-features flag should be used when compiling the lib target
-#
-# Optional. Defaults to false.
-lib-default-features = false
-
-# The profile to use for the lib target when compiling for release
-#
-# Optional. Defaults to "release".
-lib-profile-release = "wasm-release"
--- a/examples/rust/webapp/LICENSE
+++ b/examples/rust/webapp/LICENSE
@@ -1,24 +0,0 @@
-This is free and unencumbered software released into the public domain.
-
-Anyone is free to copy, modify, publish, use, compile, sell, or
-distribute this software, either in source code form or as a compiled
-binary, for any purpose, commercial or non-commercial, and by any
-means.
-
-In jurisdictions that recognize copyright laws, the author or authors
-of this software dedicate any and all copyright interest in the
-software to the public domain. We make this dedication for the benefit
-of the public at large and to the detriment of our heirs and
-successors. We intend this dedication to be an overt act of
-relinquishment in perpetuity of all present and future rights to this
-software under copyright law.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
-
-For more information, please refer to <https://unlicense.org>
--- a/examples/rust/webapp/README.md
+++ b/examples/rust/webapp/README.md
@@ -1,72 +0,0 @@
-<picture>
-    <source srcset="https://raw.githubusercontent.com/leptos-rs/leptos/main/docs/logos/Leptos_logo_Solid_White.svg" media="(prefers-color-scheme: dark)">
-    <img src="https://raw.githubusercontent.com/leptos-rs/leptos/main/docs/logos/Leptos_logo_RGB.svg" alt="Leptos Logo">
-</picture>
-
-# Leptos Starter Template
-
-This is a template for use with the [Leptos](https://github.com/leptos-rs/leptos) web framework and the [cargo-leptos](https://github.com/akesson/cargo-leptos) tool.
-
-## Creating your template repo
-
-If you don't have `cargo-leptos` installed you can install it with
-
-`cargo install cargo-leptos --locked`
-
-Then run
-
-`cargo leptos new --git leptos-rs/start-actix`
-
-to generate a new project template (you will be prompted to enter a project name).
-
-`cd {projectname}`
-
-to go to your newly created project.
-
-Of course, you should explore around the project structure, but the best place to start with your application code is in `src/app.rs`.
-
-## Running your project
-
-`cargo leptos watch`  
-By default, you can access your local project at `http://localhost:3000`
-
-## Installing Additional Tools
-
-By default, `cargo-leptos` uses `nightly` Rust, `cargo-generate`, and `sass`. If you run into any trouble, you may need to install one or more of these tools.
-
-1. `rustup toolchain install nightly --allow-downgrade` - make sure you have Rust nightly
-2. `rustup target add wasm32-unknown-unknown` - add the ability to compile Rust to WebAssembly
-3. `cargo install cargo-generate` - install `cargo-generate` binary (should be installed automatically in future)
-4. `npm install -g sass` - install `dart-sass` (should be optional in future)
-
-## Executing a Server on a Remote Machine Without the Toolchain
-After running a `cargo leptos build --release` the minimum files needed are:
-
-1. The server binary located in `target/server/release`
-2. The `site` directory and all files within located in `target/site`
-
-Copy these files to your remote server. The directory structure should be:
-```text
-leptos_start
-site/
-```
-Set the following environment variables (updating for your project as needed):
-```sh
-export LEPTOS_OUTPUT_NAME="leptos_start"
-export LEPTOS_SITE_ROOT="site"
-export LEPTOS_SITE_PKG_DIR="pkg"
-export LEPTOS_SITE_ADDR="127.0.0.1:3000"
-export LEPTOS_RELOAD_PORT="3001"
-```
-Finally, run the server binary.
-
-## Notes about CSR and Trunk:
-Although it is not recommended, you can also run your project without server integration using the feature `csr` and `trunk serve`:
-
-`trunk serve --open --features csr`
-
-This may be useful for integrating external tools which require a static site, e.g. `tauri`.
-
-## Licensing
-
-This template itself is released under the Unlicense. You should replace the LICENSE for your own application with an appropriate license if you plan to release it publicly.
--- a/examples/rust/webapp/assets/favicon.ico
+++ b/examples/rust/webapp/assets/favicon.ico
--- a/examples/rust/webapp/end2end/package-lock.json
+++ b/examples/rust/webapp/end2end/package-lock.json
@@ -1,112 +0,0 @@
-{
-  "name": "end2end",
-  "version": "1.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "end2end",
-      "version": "1.0.0",
-      "license": "ISC",
-      "devDependencies": {
-        "@playwright/test": "^1.44.1",
-        "@types/node": "^20.12.12",
-        "typescript": "^5.4.5"
-      }
-    },
-    "node_modules/@playwright/test": {
-      "version": "1.44.1",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.44.1.tgz",
-      "integrity": "sha512-1hZ4TNvD5z9VuhNJ/walIjvMVvYkZKf71axoF/uiAqpntQJXpG64dlXhoDXE3OczPuTuvjf/M5KWFg5VAVUS3Q==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "playwright": "1.44.1"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "20.12.12",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.12.12.tgz",
-      "integrity": "sha512-eWLDGF/FOSPtAvEqeRAQ4C8LSA7M1I7i0ky1I8U7kD1J5ITyW3AsRhQrKVoWf5pFKZ2kILsEGJhsI9r93PYnOw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~5.26.4"
-      }
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/playwright": {
-      "version": "1.44.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.44.1.tgz",
-      "integrity": "sha512-qr/0UJ5CFAtloI3avF95Y0L1xQo6r3LQArLIg/z/PoGJ6xa+EwzrwO5lpNr/09STxdHuUoP2mvuELJS+hLdtgg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "playwright-core": "1.44.1"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
-      }
-    },
-    "node_modules/playwright-core": {
-      "version": "1.44.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.44.1.tgz",
-      "integrity": "sha512-wh0JWtYTrhv1+OSsLPgFzGzt67Y7BE/ZS3jEqgGBlp2ppp1ZDj8c+9IARNW4dwf1poq5MgHreEM2KV/GuR4cFA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.4.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
-      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
-      "dev": true,
-      "license": "MIT"
-    }
-  }
-}
--- a/examples/rust/webapp/end2end/package.json
+++ b/examples/rust/webapp/end2end/package.json
@@ -1,15 +0,0 @@
-{
-  "name": "end2end",
-  "version": "1.0.0",
-  "description": "",
-  "main": "index.js",
-  "scripts": {},
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "devDependencies": {
-    "@playwright/test": "^1.44.1",
-    "@types/node": "^20.12.12",
-    "typescript": "^5.4.5"
-  }
-}
--- a/examples/rust/webapp/end2end/playwright.config.ts
+++ b/examples/rust/webapp/end2end/playwright.config.ts
@@ -1,104 +0,0 @@
-import { devices, defineConfig } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  testDir: "./tests",
-  /* Maximum time one test can run for. */
-  timeout: 30 * 1000,
-  expect: {
-    /**
-     * Maximum time expect() should wait for the condition to be met.
-     * For example in `await expect(locator).toHaveText();`
-     */
-    timeout: 5000,
-  },
-  /* Run tests in files in parallel */
-  fullyParallel: true,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: !!process.env.CI,
-  /* Retry on CI only */
-  retries: process.env.CI ? 2 : 0,
-  /* Opt out of parallel tests on CI. */
-  workers: process.env.CI ? 1 : undefined,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "html",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    /* Maximum time each action such as `click()` can take. Defaults to 0 (no limit). */
-    actionTimeout: 0,
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    // baseURL: 'http://localhost:3000',
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "chromium",
-      use: {
-        ...devices["Desktop Chrome"],
-      },
-    },
-
-    {
-      name: "firefox",
-      use: {
-        ...devices["Desktop Firefox"],
-      },
-    },
-
-    {
-      name: "webkit",
-      use: {
-        ...devices["Desktop Safari"],
-      },
-    },
-
-    /* Test against mobile viewports. */
-    // {
-    //   name: 'Mobile Chrome',
-    //   use: {
-    //     ...devices['Pixel 5'],
-    //   },
-    // },
-    // {
-    //   name: 'Mobile Safari',
-    //   use: {
-    //     ...devices['iPhone 12'],
-    //   },
-    // },
-
-    /* Test against branded browsers. */
-    // {
-    //   name: 'Microsoft Edge',
-    //   use: {
-    //     channel: 'msedge',
-    //   },
-    // },
-    // {
-    //   name: 'Google Chrome',
-    //   use: {
-    //     channel: 'chrome',
-    //   },
-    // },
-  ],
-
-  /* Folder for test artifacts such as screenshots, videos, traces, etc. */
-  // outputDir: 'test-results/',
-
-  /* Run your local dev server before starting the tests */
-  // webServer: {
-  //   command: 'npm run start',
-  //   port: 3000,
-  // },
-});
--- a/examples/rust/webapp/end2end/tests/example.spec.ts
+++ b/examples/rust/webapp/end2end/tests/example.spec.ts
@@ -1,9 +0,0 @@
-import { test, expect } from "@playwright/test";
-
-test("homepage has title and links to intro page", async ({ page }) => {
-  await page.goto("http://localhost:3000/");
-
-  await expect(page).toHaveTitle("Welcome to Leptos");
-
-  await expect(page.locator("h1")).toHaveText("Welcome to Leptos!");
-});
--- a/examples/rust/webapp/end2end/tsconfig.json
+++ b/examples/rust/webapp/end2end/tsconfig.json
@@ -1,109 +0,0 @@
-{
-  "compilerOptions": {
-    /* Visit https://aka.ms/tsconfig to read more about this file */
-
-    /* Projects */
-    // "incremental": true,                              /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
-    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
-    // "tsBuildInfoFile": "./.tsbuildinfo",              /* Specify the path to .tsbuildinfo incremental compilation file. */
-    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects. */
-    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
-    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
-
-    /* Language and Environment */
-    "target": "es2016",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
-    // "lib": [],                                        /* Specify a set of bundled library declaration files that describe the target runtime environment. */
-    // "jsx": "preserve",                                /* Specify what JSX code is generated. */
-    // "experimentalDecorators": true,                   /* Enable experimental support for legacy experimental decorators. */
-    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
-    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
-    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
-    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
-    // "reactNamespace": "",                             /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
-    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
-    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
-    // "moduleDetection": "auto",                        /* Control what method is used to detect module-format JS files. */
-
-    /* Modules */
-    "module": "commonjs",                                /* Specify what module code is generated. */
-    // "rootDir": "./",                                  /* Specify the root folder within your source files. */
-    // "moduleResolution": "node10",                     /* Specify how TypeScript looks up a file from a given module specifier. */
-    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
-    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
-    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
-    // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
-    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
-    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
-    // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
-    // "allowImportingTsExtensions": true,               /* Allow imports to include TypeScript file extensions. Requires '--moduleResolution bundler' and either '--noEmit' or '--emitDeclarationOnly' to be set. */
-    // "resolvePackageJsonExports": true,                /* Use the package.json 'exports' field when resolving package imports. */
-    // "resolvePackageJsonImports": true,                /* Use the package.json 'imports' field when resolving imports. */
-    // "customConditions": [],                           /* Conditions to set in addition to the resolver-specific defaults when resolving imports. */
-    // "resolveJsonModule": true,                        /* Enable importing .json files. */
-    // "allowArbitraryExtensions": true,                 /* Enable importing files with any extension, provided a declaration file is present. */
-    // "noResolve": true,                                /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
-
-    /* JavaScript Support */
-    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
-    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
-    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
-
-    /* Emit */
-    // "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
-    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
-    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
-    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
-    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
-    // "outFile": "./",                                  /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
-    // "outDir": "./",                                   /* Specify an output folder for all emitted files. */
-    // "removeComments": true,                           /* Disable emitting comments. */
-    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
-    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
-    // "importsNotUsedAsValues": "remove",               /* Specify emit/checking behavior for imports that are only used for types. */
-    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
-    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
-    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
-    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
-    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
-    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
-    // "stripInternal": true,                            /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
-    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like '__extends' in compiled output. */
-    // "noEmitOnError": true,                            /* Disable emitting files if any type checking errors are reported. */
-    // "preserveConstEnums": true,                       /* Disable erasing 'const enum' declarations in generated code. */
-    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
-    // "preserveValueImports": true,                     /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
-
-    /* Interop Constraints */
-    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
-    // "verbatimModuleSyntax": true,                     /* Do not transform or elide any imports or exports not marked as type-only, ensuring they are written in the output file's format based on the 'module' setting. */
-    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
-    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
-    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
-    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
-
-    /* Type Checking */
-    "strict": true,                                      /* Enable all strict type-checking options. */
-    // "noImplicitAny": true,                            /* Enable error reporting for expressions and declarations with an implied 'any' type. */
-    // "strictNullChecks": true,                         /* When type checking, take into account 'null' and 'undefined'. */
-    // "strictFunctionTypes": true,                      /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
-    // "strictBindCallApply": true,                      /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
-    // "strictPropertyInitialization": true,             /* Check for class properties that are declared but not set in the constructor. */
-    // "noImplicitThis": true,                           /* Enable error reporting when 'this' is given the type 'any'. */
-    // "useUnknownInCatchVariables": true,               /* Default catch clause variables as 'unknown' instead of 'any'. */
-    // "alwaysStrict": true,                             /* Ensure 'use strict' is always emitted. */
-    // "noUnusedLocals": true,                           /* Enable error reporting when local variables aren't read. */
-    // "noUnusedParameters": true,                       /* Raise an error when a function parameter isn't read. */
-    // "exactOptionalPropertyTypes": true,               /* Interpret optional property types as written, rather than adding 'undefined'. */
-    // "noImplicitReturns": true,                        /* Enable error reporting for codepaths that do not explicitly return in a function. */
-    // "noFallthroughCasesInSwitch": true,               /* Enable error reporting for fallthrough cases in switch statements. */
-    // "noUncheckedIndexedAccess": true,                 /* Add 'undefined' to a type when accessed using an index. */
-    // "noImplicitOverride": true,                       /* Ensure overriding members in derived classes are marked with an override modifier. */
-    // "noPropertyAccessFromIndexSignature": true,       /* Enforces using indexed accessors for keys declared using an indexed type. */
-    // "allowUnusedLabels": true,                        /* Disable error reporting for unused labels. */
-    // "allowUnreachableCode": true,                     /* Disable error reporting for unreachable code. */
-
-    /* Completeness */
-    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
-    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
-  }
-}
--- a/examples/rust/webapp/src/app.rs
+++ b/examples/rust/webapp/src/app.rs
@@ -1,66 +0,0 @@
-use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, Stylesheet, Title};
-use leptos_router::{
-    components::{Route, Router, Routes},
-    StaticSegment, WildcardSegment,
-};
-
-#[component]
-pub fn App() -> impl IntoView {
-    // Provides context that manages stylesheets, titles, meta tags, etc.
-    provide_meta_context();
-
-    view! {
-        // injects a stylesheet into the document <head>
-        // id=leptos means cargo-leptos will hot-reload this stylesheet
-        <Stylesheet id="leptos" href="/pkg/harmony-example-rust-webapp.css"/>
-
-        // sets the document title
-        <Title text="Welcome to Leptos"/>
-
-        // content for this welcome page
-        <Router>
-            <main>
-                <Routes fallback=move || "Not found.">
-                    <Route path=StaticSegment("") view=HomePage/>
-                    <Route path=WildcardSegment("any") view=NotFound/>
-                </Routes>
-            </main>
-        </Router>
-    }
-}
-
-/// Renders the home page of your application.
-#[component]
-fn HomePage() -> impl IntoView {
-    // Creates a reactive value to update the button
-    let count = RwSignal::new(0);
-    let on_click = move |_| *count.write() += 1;
-
-    view! {
-        <h1>"Welcome to Leptos!"</h1>
-        <button on:click=on_click>"Click Me: " {count}</button>
-    }
-}
-
-/// 404 - Not Found
-#[component]
-fn NotFound() -> impl IntoView {
-    // set an HTTP status code 404
-    // this is feature gated because it can only be done during
-    // initial server-side rendering
-    // if you navigate to the 404 page subsequently, the status
-    // code will not be set because there is not a new HTTP request
-    // to the server
-    #[cfg(feature = "ssr")]
-    {
-        // this can be done inline because it's synchronous
-        // if it were async, we'd use a server function
-        let resp = expect_context::<leptos_actix::ResponseOptions>();
-        resp.set_status(actix_web::http::StatusCode::NOT_FOUND);
-    }
-
-    view! {
-        <h1>"Not Found"</h1>
-    }
-}
--- a/examples/rust/webapp/src/lib.rs
+++ b/examples/rust/webapp/src/lib.rs
@@ -1,9 +0,0 @@
-pub mod app;
-
-#[cfg(feature = "hydrate")]
-#[wasm_bindgen::prelude::wasm_bindgen]
-pub fn hydrate() {
-    use app::*;
-    console_error_panic_hook::set_once();
-    leptos::mount::hydrate_body(App);
-}
--- a/examples/rust/webapp/src/main.rs
+++ b/examples/rust/webapp/src/main.rs
@@ -1,88 +0,0 @@
-#[cfg(feature = "ssr")]
-#[actix_web::main]
-async fn main() -> std::io::Result<()> {
-    use actix_files::Files;
-    use actix_web::*;
-    use leptos::prelude::*;
-    use leptos::config::get_configuration;
-    use leptos_meta::MetaTags;
-    use leptos_actix::{generate_route_list, LeptosRoutes};
-    use harmony_example_rust_webapp::app::*;
-
-    let conf = get_configuration(None).unwrap();
-    let addr = conf.leptos_options.site_addr;
-
-    HttpServer::new(move || {
-        // Generate the list of routes in your Leptos App
-        let routes = generate_route_list(App);
-        let leptos_options = &conf.leptos_options;
-        let site_root = leptos_options.site_root.clone().to_string();
-
-        println!("listening on http://{}", &addr);
-
-        App::new()
-            // serve JS/WASM/CSS from `pkg`
-            .service(Files::new("/pkg", format!("{site_root}/pkg")))
-            // serve other assets from the `assets` directory
-            .service(Files::new("/assets", &site_root))
-            // serve the favicon from /favicon.ico
-            .service(favicon)
-            .leptos_routes(routes, {
-                let leptos_options = leptos_options.clone();
-                move || {
-                    view! {
-                        <!DOCTYPE html>
-                        <html lang="en">
-                            <head>
-                                <meta charset="utf-8"/>
-                                <meta name="viewport" content="width=device-width, initial-scale=1"/>
-                                <AutoReload options=leptos_options.clone() />
-                                <HydrationScripts options=leptos_options.clone()/>
-                                <MetaTags/>
-                            </head>
-                            <body>
-                                <App/>
-                            </body>
-                        </html>
-                    }
-                }
-            })
-            .app_data(web::Data::new(leptos_options.to_owned()))
-        //.wrap(middleware::Compress::default())
-    })
-    .bind(&addr)?
-    .run()
-    .await
-}
-
-#[cfg(feature = "ssr")]
-#[actix_web::get("favicon.ico")]
-async fn favicon(
-    leptos_options: actix_web::web::Data<leptos::config::LeptosOptions>,
-) -> actix_web::Result<actix_files::NamedFile> {
-    let leptos_options = leptos_options.into_inner();
-    let site_root = &leptos_options.site_root;
-    Ok(actix_files::NamedFile::open(format!(
-        "{site_root}/favicon.ico"
-    ))?)
-}
-
-#[cfg(not(any(feature = "ssr", feature = "csr")))]
-pub fn main() {
-    // no client-side main function
-    // unless we want this to work with e.g., Trunk for pure client-side testing
-    // see lib.rs for hydration function instead
-    // see optional feature `csr` instead
-}
-
-#[cfg(all(not(feature = "ssr"), feature = "csr"))]
-pub fn main() {
-    // a client-side main function is required for using `trunk serve`
-    // prefer using `cargo leptos serve` instead
-    // to run: `trunk serve --open --features csr`
-    use harmony_example_rust_webapp::app::*;
-
-    console_error_panic_hook::set_once();
-
-    leptos::mount_to_body(App);
-}
--- a/examples/rust/webapp/style/main.scss
+++ b/examples/rust/webapp/style/main.scss
@@ -1,4 +0,0 @@
-body {
-	font-family: sans-serif;
-	text-align: center;
-}
--- a/examples/tenant/src/main.rs
+++ b/examples/tenant/src/main.rs
@@ -1,30 +1,30 @@
-use std::str::FromStr;
-
 use harmony::{
+    data::Id,
    inventory::Inventory,
+    maestro::Maestro,
    modules::tenant::TenantScore,
    topology::{K8sAnywhereTopology, tenant::TenantConfig},
 };
-use harmony_types::id::Id;

 #[tokio::main]
 async fn main() {
    let tenant = TenantScore {
        config: TenantConfig {
-            id: Id::from_str("test-tenant-id").unwrap(),
+            id: Id::from_str("test-tenant-id"),
            name: "testtenant".to_string(),
            ..Default::default()
        },
    };

-    harmony_cli::run(
+    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
-        vec![Box::new(tenant)],
-        None,
    )
    .await
    .unwrap();
+
+    maestro.register_all(vec![Box::new(tenant)]);
+    harmony_cli::init(maestro, None).await.unwrap();
 }

 // TODO write tests
--- a/examples/tui/src/main.rs
+++ b/examples/tui/src/main.rs
@@ -2,6 +2,7 @@ use std::net::{SocketAddr, SocketAddrV4};

 use harmony::{
    inventory::Inventory,
+    maestro::Maestro,
    modules::{
        dns::DnsScore,
        dummy::{ErrorScore, PanicScore, SuccessScore},
@@ -15,19 +16,18 @@ use harmony_macros::ipv4;

 #[tokio::main]
 async fn main() {
-    harmony_tui::run(
-        Inventory::autoload(),
-        DummyInfra {},
-        vec![
-            Box::new(SuccessScore {}),
-            Box::new(ErrorScore {}),
-            Box::new(PanicScore {}),
-            Box::new(DnsScore::new(vec![], None)),
-            Box::new(build_large_score()),
-        ],
-    )
-    .await
-    .unwrap();
+    let inventory = Inventory::autoload();
+    let topology = DummyInfra {};
+    let mut maestro = Maestro::initialize(inventory, topology).await.unwrap();
+
+    maestro.register_all(vec![
+        Box::new(SuccessScore {}),
+        Box::new(ErrorScore {}),
+        Box::new(PanicScore {}),
+        Box::new(DnsScore::new(vec![], None)),
+        Box::new(build_large_score()),
+    ]);
+    harmony_tui::init(maestro).await.unwrap();
 }

 fn build_large_score() -> LoadBalancerScore {
--- a/examples/validate_ceph_cluster_health/Cargo.toml
+++ b/examples/validate_ceph_cluster_health/Cargo.toml
@@ -1,11 +0,0 @@
-[package]
-name = "example_validate_ceph_cluster_health"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-
-[dependencies]
-harmony = { version = "0.1.0", path = "../../harmony" }
-harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
-tokio.workspace = true
--- a/examples/validate_ceph_cluster_health/src/main.rs
+++ b/examples/validate_ceph_cluster_health/src/main.rs
@@ -1,18 +0,0 @@
-use harmony::{
-    inventory::Inventory,
-    modules::storage::ceph::ceph_validate_health_score::CephVerifyClusterHealth,
-    topology::K8sAnywhereTopology,
-};
-
-#[tokio::main]
-async fn main() {
-    let ceph_health_score = CephVerifyClusterHealth {
-        rook_ceph_namespace: "rook-ceph".to_string(),
-    };
-
-    let topology = K8sAnywhereTopology::from_env();
-    let inventory = Inventory::autoload();
-    harmony_cli::run(inventory, topology, vec![Box::new(ceph_health_score)], None)
-        .await
-        .unwrap();
-}
--- a/harmony/Cargo.toml
+++ b/harmony/Cargo.toml
@@ -5,17 +5,16 @@ version.workspace = true
 readme.workspace = true
 license.workspace = true

-[features]
-testing = []
-
 [dependencies]
+rand = "0.9"
 hex = "0.4"
-reqwest = { version = "0.11", features = ["blocking", "json", "rustls-tls"], default-features = false }
+libredfish = "0.1.1"
+reqwest = { version = "0.11", features = ["blocking", "json"] }
 russh = "0.45.0"
 rust-ipmi = "0.1.1"
 semver = "1.0.23"
-serde.workspace = true
-serde_json.workspace = true
+serde = { version = "1.0.209", features = ["derive"] }
+serde_json = "1.0.127"
 tokio.workspace = true
 derive-new.workspace = true
 log.workspace = true
@@ -28,28 +27,29 @@ harmony_macros = { path = "../harmony_macros" }
 harmony_types = { path = "../harmony_types" }
 uuid.workspace = true
 url.workspace = true
-kube = { workspace = true, features = ["derive"] }
+kube.workspace = true
 k8s-openapi.workspace = true
 serde_yaml.workspace = true
 http.workspace = true
 serde-value.workspace = true
+inquire.workspace = true
 helm-wrapper-rs = "0.4.0"
 non-blank-string-rs = "1.0.4"
 k3d-rs = { path = "../k3d" }
-directories.workspace = true
-lazy_static.workspace = true
+directories = "6.0.0"
+lazy_static = "1.5.0"
 dockerfile_builder = "0.1.5"
 temp-file = "0.1.9"
 convert_case.workspace = true
 email_address = "0.2.9"
 chrono.workspace = true
 fqdn = { version = "0.4.6", features = [
-  "domain-label-cannot-start-or-end-with-hyphen",
-  "domain-label-length-limited-to-63",
-  "domain-name-without-special-chars",
-  "domain-name-length-limited-to-255",
-  "punycode",
-  "serde",
+    "domain-label-cannot-start-or-end-with-hyphen",
+    "domain-label-length-limited-to-63",
+    "domain-name-without-special-chars",
+    "domain-name-length-limited-to-255",
+    "punycode",
+    "serde",
 ] }
 temp-dir = "0.1.14"
 dyn-clone = "1.0.19"
@@ -57,19 +57,3 @@ similar.workspace = true
 futures-util = "0.3.31"
 tokio-util = "0.7.15"
 strum = { version = "0.27.1", features = ["derive"] }
-tempfile.workspace = true
-serde_with = "3.14.0"
-schemars = "0.8.22"
-kube-derive = "1.1.0"
-bollard.workspace = true
-tar.workspace = true
-base64.workspace = true
-thiserror.workspace = true
-once_cell = "1.21.3"
-harmony_inventory_agent = { path = "../harmony_inventory_agent" }
-harmony_secret_derive = { version = "0.1.0", path = "../harmony_secret_derive" }
-askama.workspace = true
-sqlx.workspace = true
-
-[dev-dependencies]
-pretty_assertions.workspace = true
--- a/harmony/harmony.rlib
+++ b/harmony/harmony.rlib
--- a/harmony/src/domain/config.rs
+++ b/harmony/src/domain/config.rs
@@ -2,7 +2,7 @@ use lazy_static::lazy_static;
 use std::path::PathBuf;

 lazy_static! {
-    pub static ref HARMONY_DATA_DIR: PathBuf = directories::BaseDirs::new()
+    pub static ref HARMONY_CONFIG_DIR: PathBuf = directories::BaseDirs::new()
        .unwrap()
        .data_dir()
        .join("harmony");
@@ -11,13 +11,5 @@ lazy_static! {
    pub static ref REGISTRY_PROJECT: String =
        std::env::var("HARMONY_REGISTRY_PROJECT").unwrap_or_else(|_| "harmony".to_string());
    pub static ref DRY_RUN: bool =
-        std::env::var("HARMONY_DRY_RUN").is_ok_and(|value| value.parse().unwrap_or(false));
-    pub static ref DEFAULT_DATABASE_URL: String = "sqlite://harmony.sqlite".to_string();
-    pub static ref DATABASE_URL: String = std::env::var("HARMONY_DATABASE_URL")
-        .map(|value| if value.is_empty() {
-            (*DEFAULT_DATABASE_URL).clone()
-        } else {
-            value
-        })
-        .unwrap_or((*DEFAULT_DATABASE_URL).clone());
+        std::env::var("HARMONY_DRY_RUN").map_or(true, |value| value.parse().unwrap_or(true));
 }
--- a/harmony/src/domain/data/file.rs
+++ b/harmony/src/domain/data/file.rs
@@ -1,22 +0,0 @@
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct FileContent {
-    pub path: FilePath,
-    pub content: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub enum FilePath {
-    Relative(String),
-    Absolute(String),
-}
-
-impl std::fmt::Display for FilePath {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            FilePath::Relative(path) => f.write_fmt(format_args!("./{path}")),
-            FilePath::Absolute(path) => f.write_fmt(format_args!("/{path}")),
-        }
-    }
-}
--- a/harmony/src/domain/data/id.rs
+++ b/harmony/src/domain/data/id.rs
@@ -1,6 +1,5 @@
 use rand::distr::Alphanumeric;
 use rand::distr::SampleString;
-use std::str::FromStr;
 use std::time::SystemTime;
 use std::time::UNIX_EPOCH;

@@ -25,27 +24,13 @@ pub struct Id {
 }

 impl Id {
-    pub fn empty() -> Self {
-        Id {
-            value: String::new(),
-        }
-    }
-}
-
-impl FromStr for Id {
-    type Err = ();
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        Ok(Id {
-            value: s.to_string(),
-        })
-    }
-}
-
-impl From<String> for Id {
-    fn from(value: String) -> Self {
+    pub fn from_string(value: String) -> Self {
        Self { value }
    }
+
+    pub fn from_str(value: &str) -> Self {
+        Self::from_string(value.to_string())
+    }
 }

 impl std::fmt::Display for Id {
--- a/harmony/src/domain/data/mod.rs
+++ b/harmony/src/domain/data/mod.rs
@@ -1,4 +1,7 @@
-mod file;
+mod id;
 mod version;
-pub use file::*;
+pub use id::*;
 pub use version::*;
+
+mod postgres;
+pub use postgres::*;
--- a/harmony/src/domain/data/postgres.rs
+++ b/harmony/src/domain/data/postgres.rs
@@ -0,0 +1,13 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PostgresUser {
+    pub name: String,
+    pub password: String, // In a real scenario, this should be a secret type
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PostgresDatabase {
+    pub name: String,
+    pub owner: String,
+}
--- a/harmony/src/domain/data/version.rs
+++ b/harmony/src/domain/data/version.rs
@@ -47,7 +47,7 @@ impl serde::Serialize for Version {

 impl std::fmt::Display for Version {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        self.value.fmt(f)
+        return self.value.fmt(f);
    }
 }

--- a/harmony/src/domain/executors/mod.rs
+++ b/harmony/src/domain/executors/mod.rs
@@ -1,7 +1,8 @@
 use std::fmt;

 use async_trait::async_trait;
-use harmony_types::net::IpAddress;
+
+use super::topology::IpAddress;

 #[derive(Debug)]
 pub enum ExecutorError {
--- a/harmony/src/domain/hardware/mod.rs
+++ b/harmony/src/domain/hardware/mod.rs
@@ -1,174 +1,77 @@
 use std::sync::Arc;

 use derive_new::new;
-use harmony_inventory_agent::hwinfo::{CPU, MemoryModule, NetworkInterface, StorageDrive};
 use harmony_types::net::MacAddress;
-use serde::{Deserialize, Serialize};
+use serde::{Serialize, Serializer, ser::SerializeStruct};
 use serde_value::Value;

 pub type HostGroup = Vec<PhysicalHost>;
 pub type SwitchGroup = Vec<Switch>;
 pub type FirewallGroup = Vec<PhysicalHost>;

-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone)]
 pub struct PhysicalHost {
-    pub id: Id,
    pub category: HostCategory,
    pub network: Vec<NetworkInterface>,
-    pub storage: Vec<StorageDrive>,
+    pub management: Arc<dyn ManagementInterface>,
+    pub storage: Vec<Storage>,
    pub labels: Vec<Label>,
-    pub memory_modules: Vec<MemoryModule>,
-    pub cpus: Vec<CPU>,
+    pub memory_size: Option<u64>,
+    pub cpu_count: Option<u64>,
 }

 impl PhysicalHost {
    pub fn empty(category: HostCategory) -> Self {
        Self {
-            id: Id::empty(),
            category,
            network: vec![],
            storage: vec![],
            labels: vec![],
-            memory_modules: vec![],
-            cpus: vec![],
+            management: Arc::new(ManualManagementInterface {}),
+            memory_size: None,
+            cpu_count: None,
        }
    }

-    pub fn summary(&self) -> String {
-        let mut parts = Vec::new();
-
-        // Part 1: System Model (from labels) or Category as a fallback
-        let model = self
-            .labels
-            .iter()
-            .find(|l| l.name == "system-product-name" || l.name == "model")
-            .map(|l| l.value.clone())
-            .unwrap_or_else(|| self.category.to_string());
-        parts.push(model);
-
-        // Part 2: CPU Information
-        if !self.cpus.is_empty() {
-            let cpu_count = self.cpus.len();
-            let total_cores = self.cpus.iter().map(|c| c.cores).sum::<u32>();
-            let total_threads = self.cpus.iter().map(|c| c.threads).sum::<u32>();
-            let model_name = &self.cpus[0].model;
-
-            let cpu_summary = if cpu_count > 1 {
-                format!(
-                    "{}x {} ({}c/{}t)",
-                    cpu_count, model_name, total_cores, total_threads
-                )
-            } else {
-                format!("{} ({}c/{}t)", model_name, total_cores, total_threads)
-            };
-            parts.push(cpu_summary);
-        }
-
-        // Part 3: Memory Information
-        if !self.memory_modules.is_empty() {
-            let total_mem_bytes = self
-                .memory_modules
-                .iter()
-                .map(|m| m.size_bytes)
-                .sum::<u64>();
-            let total_mem_gb = (total_mem_bytes as f64 / (1024.0 * 1024.0 * 1024.0)).round() as u64;
-
-            // Find the most common speed among modules
-            let mut speeds = std::collections::HashMap::new();
-            for module in &self.memory_modules {
-                if let Some(speed) = module.speed_mhz {
-                    *speeds.entry(speed).or_insert(0) += 1;
-                }
-            }
-            let common_speed = speeds
-                .into_iter()
-                .max_by_key(|&(_, count)| count)
-                .map(|(speed, _)| speed);
-
-            if let Some(speed) = common_speed {
-                parts.push(format!("{} GB RAM @ {}MHz", total_mem_gb, speed));
-            } else {
-                parts.push(format!("{} GB RAM", total_mem_gb));
-            }
-        }
-
-        // Part 4: Storage Information
-        if !self.storage.is_empty() {
-            let total_storage_bytes = self.storage.iter().map(|d| d.size_bytes).sum::<u64>();
-            let drive_count = self.storage.len();
-            let first_drive_model = &self.storage[0].model;
-
-            // Helper to format bytes into TB or GB
-            let format_storage = |bytes: u64| {
-                let tb = bytes as f64 / (1024.0 * 1024.0 * 1024.0 * 1024.0);
-                if tb >= 1.0 {
-                    format!("{:.2} TB", tb)
-                } else {
-                    let gb = bytes as f64 / (1024.0 * 1024.0 * 1024.0);
-                    format!("{:.0} GB", gb)
-                }
-            };
-
-            let storage_summary = if drive_count > 1 {
-                format!(
-                    "{} Storage ({}x {})",
-                    format_storage(total_storage_bytes),
-                    drive_count,
-                    first_drive_model
-                )
-            } else {
-                format!(
-                    "{} Storage ({})",
-                    format_storage(total_storage_bytes),
-                    first_drive_model
-                )
-            };
-            parts.push(storage_summary);
-        }
-
-        // Part 5: Network Information
-        // Prioritize an "up" interface with an IPv4 address
-        let best_nic = self
-            .network
-            .iter()
-            .find(|n| n.is_up && !n.ipv4_addresses.is_empty())
-            .or_else(|| self.network.first());
-
-        if let Some(nic) = best_nic {
-            let speed = nic
-                .speed_mbps
-                .map(|s| format!("{}Gbps", s / 1000))
-                .unwrap_or_else(|| "N/A".to_string());
-            let mac = nic.mac_address.to_string();
-            let nic_summary = if let Some(ip) = nic.ipv4_addresses.first() {
-                format!("NIC: {} ({}, {})", speed, ip, mac)
-            } else {
-                format!("NIC: {} ({})", speed, mac)
-            };
-            parts.push(nic_summary);
-        }
-
-        parts.join(" | ")
-    }
-
    pub fn cluster_mac(&self) -> MacAddress {
        self.network
-            .first()
+            .get(0)
            .expect("Cluster physical host should have a network interface")
            .mac_address
+            .clone()
+    }
+
+    pub fn cpu(mut self, cpu_count: Option<u64>) -> Self {
+        self.cpu_count = cpu_count;
+        self
+    }
+
+    pub fn memory_size(mut self, memory_size: Option<u64>) -> Self {
+        self.memory_size = memory_size;
+        self
+    }
+
+    pub fn storage(
+        mut self,
+        connection: StorageConnectionType,
+        kind: StorageKind,
+        size: u64,
+        serial: String,
+    ) -> Self {
+        self.storage.push(Storage {
+            connection,
+            kind,
+            size,
+            serial,
+        });
+        self
    }

    pub fn mac_address(mut self, mac_address: MacAddress) -> Self {
        self.network.push(NetworkInterface {
-            name: String::new(),
+            name: None,
            mac_address,
-            speed_mbps: None,
-            is_up: false,
-            mtu: 0,
-            ipv4_addresses: vec![],
-            ipv6_addresses: vec![],
-            driver: String::new(),
-            firmware_version: None,
+            speed: None,
        });
        self
    }
@@ -177,56 +80,52 @@ impl PhysicalHost {
        self.labels.push(Label { name, value });
        self
    }
+
+    pub fn management(mut self, management: Arc<dyn ManagementInterface>) -> Self {
+        self.management = management;
+        self
+    }
 }

 // Custom Serialize implementation for PhysicalHost
-// impl Serialize for PhysicalHost {
-//     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-//     where
-//         S: Serializer,
-//     {
-//         // Determine the number of fields
-//         let mut num_fields = 5; // category, network, storage, labels, management
-//         if self.memory_modules.is_some() {
-//             num_fields += 1;
-//         }
-//         if self.cpus.is_some() {
-//             num_fields += 1;
-//         }
-//
-//         // Create a serialization structure
-//         let mut state = serializer.serialize_struct("PhysicalHost", num_fields)?;
-//
-//         // Serialize the standard fields
-//         state.serialize_field("category", &self.category)?;
-//         state.serialize_field("network", &self.network)?;
-//         state.serialize_field("storage", &self.storage)?;
-//         state.serialize_field("labels", &self.labels)?;
-//
-//         // Serialize optional fields
-//         if let Some(memory) = self.memory_modules {
-//             state.serialize_field("memory_size", &memory)?;
-//         }
-//         if let Some(cpu) = self.cpus {
-//             state.serialize_field("cpu_count", &cpu)?;
-//         }
-//
-//         let mgmt_data = self.management.serialize_management();
-//         // pub management: Arc<dyn ManagementInterface>,
-//
-//         // Handle management interface - either as a field or flattened
-//         state.serialize_field("management", &mgmt_data)?;
-//
-//         state.end()
-//     }
-// }
-
-impl<'de> Deserialize<'de> for PhysicalHost {
-    fn deserialize<D>(_deserializer: D) -> Result<Self, D::Error>
+impl Serialize for PhysicalHost {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
-        D: serde::Deserializer<'de>,
+        S: Serializer,
    {
-        todo!()
+        // Determine the number of fields
+        let mut num_fields = 5; // category, network, storage, labels, management
+        if self.memory_size.is_some() {
+            num_fields += 1;
+        }
+        if self.cpu_count.is_some() {
+            num_fields += 1;
+        }
+
+        // Create a serialization structure
+        let mut state = serializer.serialize_struct("PhysicalHost", num_fields)?;
+
+        // Serialize the standard fields
+        state.serialize_field("category", &self.category)?;
+        state.serialize_field("network", &self.network)?;
+        state.serialize_field("storage", &self.storage)?;
+        state.serialize_field("labels", &self.labels)?;
+
+        // Serialize optional fields
+        if let Some(memory) = self.memory_size {
+            state.serialize_field("memory_size", &memory)?;
+        }
+        if let Some(cpu) = self.cpu_count {
+            state.serialize_field("cpu_count", &cpu)?;
+        }
+
+        let mgmt_data = self.management.serialize_management();
+        // pub management: Arc<dyn ManagementInterface>,
+
+        // Handle management interface - either as a field or flattened
+        state.serialize_field("management", &mgmt_data)?;
+
+        state.end()
    }
 }

@@ -280,10 +179,59 @@ pub enum HostCategory {
    Switch,
 }

+#[derive(Debug, new, Clone, Serialize)]
+pub struct NetworkInterface {
+    pub name: Option<String>,
+    pub mac_address: MacAddress,
+    pub speed: Option<u64>,
+}
+
 #[cfg(test)]
 use harmony_macros::mac_address;
+#[cfg(test)]
+impl NetworkInterface {
+    pub fn dummy() -> Self {
+        Self {
+            name: Some(String::new()),
+            mac_address: mac_address!("00:00:00:00:00:00"),
+            speed: Some(0),
+        }
+    }
+}

-use harmony_types::id::Id;
+#[derive(Debug, new, Clone, Serialize)]
+pub enum StorageConnectionType {
+    Sata3g,
+    Sata6g,
+    Sas6g,
+    Sas12g,
+    PCIE,
+}
+#[derive(Debug, Clone, Serialize)]
+pub enum StorageKind {
+    SSD,
+    NVME,
+    HDD,
+}
+#[derive(Debug, new, Clone, Serialize)]
+pub struct Storage {
+    pub connection: StorageConnectionType,
+    pub kind: StorageKind,
+    pub size: u64,
+    pub serial: String,
+}
+
+#[cfg(test)]
+impl Storage {
+    pub fn dummy() -> Self {
+        Self {
+            connection: StorageConnectionType::Sata3g,
+            kind: StorageKind::SSD,
+            size: 0,
+            serial: String::new(),
+        }
+    }
+}

 #[derive(Debug, Clone, Serialize)]
 pub struct Switch {
@@ -314,65 +262,146 @@ impl Location {
    }
 }

-impl std::fmt::Display for HostCategory {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            HostCategory::Server => write!(f, "Server"),
-            HostCategory::Firewall => write!(f, "Firewall"),
-            HostCategory::Switch => write!(f, "Switch"),
-        }
-    }
-}
-
-impl std::fmt::Display for Label {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}: {}", self.name, self.value)
-    }
-}
-
-impl std::fmt::Display for Location {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Address: {}, Name: {}", self.address, self.name)
-    }
-}
-
-impl std::fmt::Display for PhysicalHost {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}", self.summary())
-    }
-}
-
-impl std::fmt::Display for Switch {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Switch with {} interfaces", self._interface.len())
-    }
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
+    use serde::{Deserialize, Serialize};
+    use std::sync::Arc;
+
+    // Mock implementation of ManagementInterface
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    struct MockHPIlo {
+        ip: String,
+        username: String,
+        password: String,
+        firmware_version: String,
+    }
+
+    impl ManagementInterface for MockHPIlo {
+        fn boot_to_pxe(&self) {}
+
+        fn get_supported_protocol_names(&self) -> String {
+            String::new()
+        }
+    }
+
+    // Another mock implementation
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    struct MockDellIdrac {
+        hostname: String,
+        port: u16,
+        api_token: String,
+    }
+
+    impl ManagementInterface for MockDellIdrac {
+        fn boot_to_pxe(&self) {}
+
+        fn get_supported_protocol_names(&self) -> String {
+            String::new()
+        }
+    }
+
+    #[test]
+    fn test_serialize_physical_host_with_hp_ilo() {
+        // Create a PhysicalHost with HP iLO management
+        let host = PhysicalHost {
+            category: HostCategory::Server,
+            network: vec![NetworkInterface::dummy()],
+            management: Arc::new(MockHPIlo {
+                ip: "192.168.1.100".to_string(),
+                username: "admin".to_string(),
+                password: "password123".to_string(),
+                firmware_version: "2.5.0".to_string(),
+            }),
+            storage: vec![Storage::dummy()],
+            labels: vec![Label::new("datacenter".to_string(), "us-east".to_string())],
+            memory_size: Some(64_000_000),
+            cpu_count: Some(16),
+        };
+
+        // Serialize to JSON
+        let json = serde_json::to_string(&host).expect("Failed to serialize host");
+
+        // Check that the serialized JSON contains the HP iLO details
+        assert!(json.contains("192.168.1.100"));
+        assert!(json.contains("admin"));
+        assert!(json.contains("password123"));
+        assert!(json.contains("firmware_version"));
+        assert!(json.contains("2.5.0"));
+
+        // Parse back to verify structure (not the exact management interface)
+        let parsed: serde_json::Value = serde_json::from_str(&json).expect("Failed to parse JSON");
+
+        // Verify basic structure
+        assert_eq!(parsed["cpu_count"], 16);
+        assert_eq!(parsed["memory_size"], 64_000_000);
+        assert_eq!(parsed["network"][0]["name"], "");
+    }
+
+    #[test]
+    fn test_serialize_physical_host_with_dell_idrac() {
+        // Create a PhysicalHost with Dell iDRAC management
+        let host = PhysicalHost {
+            category: HostCategory::Server,
+            network: vec![NetworkInterface::dummy()],
+            management: Arc::new(MockDellIdrac {
+                hostname: "idrac-server01".to_string(),
+                port: 443,
+                api_token: "abcdef123456".to_string(),
+            }),
+            storage: vec![Storage::dummy()],
+            labels: vec![Label::new("env".to_string(), "production".to_string())],
+            memory_size: Some(128_000_000),
+            cpu_count: Some(32),
+        };
+
+        // Serialize to JSON
+        let json = serde_json::to_string(&host).expect("Failed to serialize host");
+
+        // Check that the serialized JSON contains the Dell iDRAC details
+        assert!(json.contains("idrac-server01"));
+        assert!(json.contains("443"));
+        assert!(json.contains("abcdef123456"));
+
+        // Parse back to verify structure
+        let parsed: serde_json::Value = serde_json::from_str(&json).expect("Failed to parse JSON");
+
+        // Verify basic structure
+        assert_eq!(parsed["cpu_count"], 32);
+        assert_eq!(parsed["memory_size"], 128_000_000);
+        assert_eq!(parsed["storage"][0]["path"], serde_json::Value::Null);
+    }

    #[test]
    fn test_different_management_implementations_produce_valid_json() {
        // Create hosts with different management implementations
        let host1 = PhysicalHost {
-            id: Id::empty(),
            category: HostCategory::Server,
            network: vec![],
+            management: Arc::new(MockHPIlo {
+                ip: "10.0.0.1".to_string(),
+                username: "root".to_string(),
+                password: "secret".to_string(),
+                firmware_version: "3.0.0".to_string(),
+            }),
            storage: vec![],
            labels: vec![],
-            memory_modules: vec![],
-            cpus: vec![],
+            memory_size: None,
+            cpu_count: None,
        };

        let host2 = PhysicalHost {
-            id: Id::empty(),
            category: HostCategory::Server,
            network: vec![],
+            management: Arc::new(MockDellIdrac {
+                hostname: "server02-idrac".to_string(),
+                port: 8443,
+                api_token: "token123".to_string(),
+            }),
            storage: vec![],
            labels: vec![],
-            memory_modules: vec![],
-            cpus: vec![],
+            memory_size: None,
+            cpu_count: None,
        };

        // Both should serialize successfully
@@ -382,5 +411,8 @@ mod tests {
        // Both JSONs should be valid and parseable
        let _: serde_json::Value = serde_json::from_str(&json1).expect("Invalid JSON for host1");
        let _: serde_json::Value = serde_json::from_str(&json2).expect("Invalid JSON for host2");
+
+        // The JSONs should be different because they contain different management interfaces
+        assert_ne!(json1, json2);
    }
 }
--- a/harmony/src/domain/instrumentation.rs
+++ b/harmony/src/domain/instrumentation.rs
@@ -1,84 +0,0 @@
-use once_cell::sync::Lazy;
-use std::{collections::HashMap, sync::Mutex};
-
-use crate::modules::application::ApplicationFeatureStatus;
-
-use super::{
-    interpret::{InterpretError, Outcome},
-    topology::TopologyStatus,
-};
-
-#[derive(Debug, Clone)]
-pub enum HarmonyEvent {
-    HarmonyStarted,
-    HarmonyFinished,
-    InterpretExecutionStarted {
-        execution_id: String,
-        topology: String,
-        interpret: String,
-        score: String,
-        message: String,
-    },
-    InterpretExecutionFinished {
-        execution_id: String,
-        topology: String,
-        interpret: String,
-        score: String,
-        outcome: Result<Outcome, InterpretError>,
-    },
-    TopologyStateChanged {
-        topology: String,
-        status: TopologyStatus,
-        message: Option<String>,
-    },
-    ApplicationFeatureStateChanged {
-        topology: String,
-        application: String,
-        feature: String,
-        status: ApplicationFeatureStatus,
-    },
-}
-
-type Subscriber = Box<dyn Fn(&HarmonyEvent) + Send + Sync>;
-
-static SUBSCRIBERS: Lazy<Mutex<HashMap<String, Subscriber>>> =
-    Lazy::new(|| Mutex::new(HashMap::new()));
-
-/// Subscribes a listener to all instrumentation events.
-///
-/// Simply provide a unique name and a closure to run when an event happens.
-///
-/// # Example
-/// ```
-/// use harmony::instrumentation;
-/// instrumentation::subscribe("my_logger", |event| {
-///   println!("Event occurred: {:?}", event);
-/// });
-/// ```
-pub fn subscribe<F>(name: &str, callback: F)
-where
-    F: Fn(&HarmonyEvent) + Send + Sync + 'static,
-{
-    let mut subs = SUBSCRIBERS.lock().unwrap();
-    subs.insert(name.to_string(), Box::new(callback));
-}
-
-/// Instruments an event, notifying all subscribers.
-///
-/// This will call every closure that was registered with `subscribe`.
-///
-/// # Example
-/// ```
-/// use harmony::instrumentation;
-/// use harmony::instrumentation::HarmonyEvent;
-/// instrumentation::instrument(HarmonyEvent::HarmonyStarted);
-/// ```
-pub fn instrument(event: HarmonyEvent) -> Result<(), &'static str> {
-    let subs = SUBSCRIBERS.lock().unwrap();
-
-    for callback in subs.values() {
-        callback(&event);
-    }
-
-    Ok(())
-}
--- a/harmony/src/domain/interpret/mod.rs
+++ b/harmony/src/domain/interpret/mod.rs
@@ -1,11 +1,12 @@
-use harmony_types::id::Id;
 use std::error::Error;

 use async_trait::async_trait;
 use derive_new::new;

 use super::{
-    data::Version, executors::ExecutorError, inventory::Inventory, topology::PreparationError,
+    data::{Id, Version},
+    executors::ExecutorError,
+    inventory::Inventory,
 };

 pub enum InterpretName {
@@ -21,17 +22,7 @@ pub enum InterpretName {
    K3dInstallation,
    TenantInterpret,
    Application,
-    ArgoCD,
-    Alerting,
-    Ntfy,
-    HelmChart,
-    HelmCommand,
-    K8sResource,
-    Lamp,
-    ApplicationMonitoring,
-    K8sPrometheusCrdAlerting,
-    DiscoverInventoryAgent,
-    CephClusterHealth,
+    Postgres,
 }

 impl std::fmt::Display for InterpretName {
@@ -49,17 +40,7 @@ impl std::fmt::Display for InterpretName {
            InterpretName::K3dInstallation => f.write_str("K3dInstallation"),
            InterpretName::TenantInterpret => f.write_str("Tenant"),
            InterpretName::Application => f.write_str("Application"),
-            InterpretName::ArgoCD => f.write_str("ArgoCD"),
-            InterpretName::Alerting => f.write_str("Alerting"),
-            InterpretName::Ntfy => f.write_str("Ntfy"),
-            InterpretName::HelmChart => f.write_str("HelmChart"),
-            InterpretName::HelmCommand => f.write_str("HelmCommand"),
-            InterpretName::K8sResource => f.write_str("K8sResource"),
-            InterpretName::Lamp => f.write_str("LAMP"),
-            InterpretName::ApplicationMonitoring => f.write_str("ApplicationMonitoring"),
-            InterpretName::K8sPrometheusCrdAlerting => f.write_str("K8sPrometheusCrdAlerting"),
-            InterpretName::DiscoverInventoryAgent => f.write_str("DiscoverInventoryAgent"),
-            InterpretName::CephClusterHealth => f.write_str("CephClusterHealth"),
+            InterpretName::Postgres => f.write_str("Postgres"),
        }
    }
 }
@@ -132,14 +113,6 @@ impl std::fmt::Display for InterpretError {
 }
 impl Error for InterpretError {}

-impl From<PreparationError> for InterpretError {
-    fn from(value: PreparationError) -> Self {
-        Self {
-            msg: format!("InterpretError : {value}"),
-        }
-    }
-}
-
 impl From<ExecutorError> for InterpretError {
    fn from(value: ExecutorError) -> Self {
        Self {
--- a/harmony/src/domain/inventory/mod.rs
+++ b/harmony/src/domain/inventory/mod.rs
@@ -1,6 +1,3 @@
-mod repository;
-pub use repository::*;
-
 #[derive(Debug, new, Clone)]
 pub struct InventoryFilter {
    target: Vec<Filter>,
@@ -18,8 +15,6 @@ impl InventoryFilter {
 use derive_new::new;
 use log::info;

-use crate::hardware::{ManagementInterface, ManualManagementInterface};
-
 use super::{
    filter::Filter,
    hardware::{FirewallGroup, HostGroup, Location, SwitchGroup},
@@ -32,7 +27,7 @@ pub struct Inventory {
    // Firewall is really just a host but with somewhat specialized hardware
    // I'm not entirely sure it belongs to its own category but it helps make things easier and
    // clearer for now so let's try it this way.
-    pub firewall_mgmt: Box<dyn ManagementInterface>,
+    pub firewall: FirewallGroup,
    pub worker_host: HostGroup,
    pub storage_host: HostGroup,
    pub control_plane_host: HostGroup,
@@ -43,7 +38,7 @@ impl Inventory {
        Self {
            location: Location::new("Empty".to_string(), "location".to_string()),
            switch: vec![],
-            firewall_mgmt: Box::new(ManualManagementInterface {}),
+            firewall: vec![],
            worker_host: vec![],
            storage_host: vec![],
            control_plane_host: vec![],
@@ -54,7 +49,7 @@ impl Inventory {
        Self {
            location: Location::test_building(),
            switch: SwitchGroup::new(),
-            firewall_mgmt: Box::new(ManualManagementInterface {}),
+            firewall: FirewallGroup::new(),
            worker_host: HostGroup::new(),
            storage_host: HostGroup::new(),
            control_plane_host: HostGroup::new(),
--- a/harmony/src/domain/inventory/repository.rs
+++ b/harmony/src/domain/inventory/repository.rs
@@ -1,25 +0,0 @@
-use async_trait::async_trait;
-
-use crate::hardware::PhysicalHost;
-
-/// Errors that can occur within the repository layer.
-#[derive(thiserror::Error, Debug)]
-pub enum RepoError {
-    #[error("Database query failed: {0}")]
-    QueryFailed(String),
-    #[error("Data serialization failed: {0}")]
-    Serialization(String),
-    #[error("Data deserialization failed: {0}")]
-    Deserialization(String),
-    #[error("Could not connect to the database: {0}")]
-    ConnectionFailed(String),
-}
-
-// --- Trait and Implementation ---
-
-/// Defines the contract for inventory persistence.
-#[async_trait]
-pub trait InventoryRepository: Send + Sync + 'static {
-    async fn save(&self, host: &PhysicalHost) -> Result<(), RepoError>;
-    async fn get_latest_by_id(&self, host_id: &str) -> Result<Option<PhysicalHost>, RepoError>;
-}
--- a/harmony/src/domain/maestro/mod.rs
+++ b/harmony/src/domain/maestro/mod.rs
@@ -1,14 +1,12 @@
-use std::sync::{Arc, RwLock};
+use std::sync::{Arc, Mutex, RwLock};

-use log::{debug, warn};
-
-use crate::topology::TopologyStatus;
+use log::{info, warn};

 use super::{
-    interpret::{InterpretError, Outcome},
+    interpret::{InterpretError, InterpretStatus, Outcome},
    inventory::Inventory,
    score::Score,
-    topology::{PreparationError, PreparationOutcome, Topology, TopologyState},
+    topology::Topology,
 };

 type ScoreVec<T> = Vec<Box<dyn Score<T>>>;
@@ -17,54 +15,41 @@ pub struct Maestro<T: Topology> {
    inventory: Inventory,
    topology: T,
    scores: Arc<RwLock<ScoreVec<T>>>,
-    topology_state: TopologyState,
+    topology_preparation_result: Mutex<Option<Outcome>>,
 }

 impl<T: Topology> Maestro<T> {
-    /// Creates a bare maestro without initialization.
-    ///
-    /// This should rarely be used. Most of the time Maestro::initialize should be used instead.
-    pub fn new_without_initialization(inventory: Inventory, topology: T) -> Self {
-        let topology_name = topology.name().to_string();
-
+    pub fn new(inventory: Inventory, topology: T) -> Self {
        Self {
            inventory,
            topology,
            scores: Arc::new(RwLock::new(Vec::new())),
-            topology_state: TopologyState::new(topology_name),
+            topology_preparation_result: None.into(),
        }
    }

-    pub async fn initialize(inventory: Inventory, topology: T) -> Result<Self, PreparationError> {
-        let mut instance = Self::new_without_initialization(inventory, topology);
+    pub async fn initialize(inventory: Inventory, topology: T) -> Result<Self, InterpretError> {
+        let instance = Self::new(inventory, topology);
        instance.prepare_topology().await?;
        Ok(instance)
    }

    /// Ensures the associated Topology is ready for operations.
    /// Delegates the readiness check and potential setup actions to the Topology.
-    async fn prepare_topology(&mut self) -> Result<PreparationOutcome, PreparationError> {
-        self.topology_state.prepare();
+    pub async fn prepare_topology(&self) -> Result<Outcome, InterpretError> {
+        info!("Ensuring topology '{}' is ready...", self.topology.name());
+        let outcome = self.topology.ensure_ready().await?;
+        info!(
+            "Topology '{}' readiness check complete: {}",
+            self.topology.name(),
+            outcome.status
+        );

-        let result = self.topology.ensure_ready().await;
-
-        match result {
-            Ok(outcome) => {
-                match outcome.clone() {
-                    PreparationOutcome::Success { details } => {
-                        self.topology_state.success(details);
-                    }
-                    PreparationOutcome::Noop => {
-                        self.topology_state.noop();
-                    }
-                };
-                Ok(outcome)
-            }
-            Err(err) => {
-                self.topology_state.error(err.to_string());
-                Err(err)
-            }
-        }
+        self.topology_preparation_result
+            .lock()
+            .unwrap()
+            .replace(outcome.clone());
+        Ok(outcome)
    }

    pub fn register_all(&mut self, mut scores: ScoreVec<T>) {
@@ -73,8 +58,15 @@ impl<T: Topology> Maestro<T> {
    }

    fn is_topology_initialized(&self) -> bool {
-        self.topology_state.status == TopologyStatus::Success
-            || self.topology_state.status == TopologyStatus::Noop
+        let result = self.topology_preparation_result.lock().unwrap();
+        if let Some(outcome) = result.as_ref() {
+            match outcome.status {
+                InterpretStatus::SUCCESS => return true,
+                _ => return false,
+            }
+        } else {
+            false
+        }
    }

    pub async fn interpret(&self, score: Box<dyn Score<T>>) -> Result<Outcome, InterpretError> {
@@ -85,9 +77,11 @@ impl<T: Topology> Maestro<T> {
                self.topology.name(),
            );
        }
-        debug!("Interpreting score {score:?}");
-        let result = score.interpret(&self.inventory, &self.topology).await;
-        debug!("Got result {result:?}");
+        info!("Running score {score:?}");
+        let interpret = score.create_interpret();
+        info!("Launching interpret {interpret:?}");
+        let result = interpret.execute(&self.inventory, &self.topology).await;
+        info!("Got result {result:?}");
        result
    }

--- a/harmony/src/domain/mod.rs
+++ b/harmony/src/domain/mod.rs
@@ -3,7 +3,6 @@ pub mod data;
 pub mod executors;
 pub mod filter;
 pub mod hardware;
-pub mod instrumentation;
 pub mod interpret;
 pub mod inventory;
 pub mod maestro;
--- a/harmony/src/domain/score.rs
+++ b/harmony/src/domain/score.rs
@@ -1,62 +1,22 @@
-use harmony_types::id::Id;
 use std::collections::BTreeMap;

-use async_trait::async_trait;
 use serde::Serialize;
 use serde_value::Value;

-use super::{
-    instrumentation::{self, HarmonyEvent},
-    interpret::{Interpret, InterpretError, Outcome},
-    inventory::Inventory,
-    topology::Topology,
-};
+use super::{interpret::Interpret, topology::Topology};

-#[async_trait]
 pub trait Score<T: Topology>:
    std::fmt::Debug + ScoreToString<T> + Send + Sync + CloneBoxScore<T> + SerializeScore<T>
 {
-    async fn interpret(
-        &self,
-        inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        let id = Id::default();
-        let interpret = self.create_interpret();
-
-        instrumentation::instrument(HarmonyEvent::InterpretExecutionStarted {
-            execution_id: id.clone().to_string(),
-            topology: topology.name().into(),
-            interpret: interpret.get_name().to_string(),
-            score: self.name(),
-            message: format!("{} running...", interpret.get_name()),
-        })
-        .unwrap();
-        let result = interpret.execute(inventory, topology).await;
-
-        instrumentation::instrument(HarmonyEvent::InterpretExecutionFinished {
-            execution_id: id.clone().to_string(),
-            topology: topology.name().into(),
-            interpret: interpret.get_name().to_string(),
-            score: self.name(),
-            outcome: result.clone(),
-        })
-        .unwrap();
-
-        result
-    }
-
-    fn name(&self) -> String;
-
-    #[doc(hidden)]
    fn create_interpret(&self) -> Box<dyn Interpret<T>>;
+    fn name(&self) -> String;
 }

 pub trait SerializeScore<T: Topology> {
    fn serialize(&self) -> Value;
 }

-impl<S, T> SerializeScore<T> for S
+impl<'de, S, T> SerializeScore<T> for S
 where
    T: Topology,
    S: Score<T> + Serialize,
@@ -64,7 +24,7 @@ where
    fn serialize(&self) -> Value {
        // TODO not sure if this is the right place to handle the error or it should bubble
        // up?
-        serde_value::to_value(self).expect("Score should serialize successfully")
+        serde_value::to_value(&self).expect("Score should serialize successfully")
    }
 }

--- a/harmony/src/domain/score_with_dep.rs
+++ b/harmony/src/domain/score_with_dep.rs
@@ -1,59 +0,0 @@
-////////////////////
-/// Working idea 
-///
-///
-trait ScoreWithDep<T> {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>>;
-    fn name(&self) -> String;
-    fn get_dependencies(&self) -> Vec<TypeId>; // Force T to impl Installer<TypeId> or something
-                                               // like that
-}
-
-struct PrometheusAlertScore;
-
-impl <T> ScoreWithDep<T> for PrometheusAlertScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        todo!()
-    }
-
-    fn name(&self) -> String {
-        todo!()
-    }
-
-    fn get_dependencies(&self) -> Vec<TypeId> {
-        // We have to find a way to constrait here so at compile time we are only allowed to return
-        // TypeId for types which can be installed by T 
-        //
-        // This means, for example that T must implement HelmCommand if the impl <T: HelmCommand> Installable<T> for
-        // KubePrometheus calls for HelmCommand.
-        vec![TypeId::of::<KubePrometheus>()]
-    }
-}
-
-trait Installable{}
-
-struct KubePrometheus;
-
-impl Installable for KubePrometheus;
- 
-
-struct Maestro<T> {
-    topology: T
-}
-
-impl <T>Maestro<T> {
-  fn execute_store(&self, score: ScoreWithDep<T>) {
-      score.get_dependencies().iter().for_each(|dep| {
-          self.topology.ensure_dependency_ready(dep);
-      });
-  }
-}
-
-struct TopologyWithDep {
-}
-
-impl TopologyWithDep {
-    fn ensure_dependency_ready(&self, type_id: TypeId) -> Result<(), String> {
-        self.installer
-    }
-}
--- a/harmony/src/domain/topology/ha_cluster.rs
+++ b/harmony/src/domain/topology/ha_cluster.rs
@@ -1,13 +1,11 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::net::MacAddress;
-use harmony_types::net::Url;
-use log::debug;
 use log::info;

-use crate::data::FileContent;
 use crate::executors::ExecutorError;
-use crate::topology::PxeOptions;
+use crate::interpret::InterpretError;
+use crate::interpret::Outcome;

 use super::DHCPStaticEntry;
 use super::DhcpServer;
@@ -21,12 +19,11 @@ use super::K8sclient;
 use super::LoadBalancer;
 use super::LoadBalancerService;
 use super::LogicalHost;
-use super::PreparationError;
-use super::PreparationOutcome;
 use super::Router;
 use super::TftpServer;

 use super::Topology;
+use super::Url;
 use super::k8s::K8sClient;
 use std::sync::Arc;

@@ -51,11 +48,10 @@ impl Topology for HAClusterTopology {
    fn name(&self) -> &str {
        "HAClusterTopology"
    }
-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        debug!(
+    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
+        todo!(
            "ensure_ready, not entirely sure what it should do here, probably something like verify that the hosts are reachable and all services are up and ready."
-        );
-        Ok(PreparationOutcome::Noop)
+        )
    }
 }

@@ -157,10 +153,12 @@ impl DhcpServer for HAClusterTopology {
    async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)> {
        self.dhcp_server.list_static_mappings().await
    }
-    async fn set_pxe_options(&self, options: PxeOptions) -> Result<(), ExecutorError> {
-        self.dhcp_server.set_pxe_options(options).await
+    async fn set_next_server(&self, ip: IpAddress) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_next_server(ip).await
+    }
+    async fn set_boot_filename(&self, boot_filename: &str) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_boot_filename(boot_filename).await
    }
-
    fn get_ip(&self) -> IpAddress {
        self.dhcp_server.get_ip()
    }
@@ -170,6 +168,16 @@ impl DhcpServer for HAClusterTopology {
    async fn commit_config(&self) -> Result<(), ExecutorError> {
        self.dhcp_server.commit_config().await
    }
+
+    async fn set_filename(&self, filename: &str) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_filename(filename).await
+    }
+    async fn set_filename64(&self, filename64: &str) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_filename64(filename64).await
+    }
+    async fn set_filenameipxe(&self, filenameipxe: &str) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_filenameipxe(filenameipxe).await
+    }
 }

 #[async_trait]
@@ -213,21 +221,17 @@ impl HttpServer for HAClusterTopology {
        self.http_server.serve_files(url).await
    }

-    async fn serve_file_content(&self, file: &FileContent) -> Result<(), ExecutorError> {
-        self.http_server.serve_file_content(file).await
-    }
-
    fn get_ip(&self) -> IpAddress {
-        self.http_server.get_ip()
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
-        self.http_server.ensure_initialized().await
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
    async fn commit_config(&self) -> Result<(), ExecutorError> {
-        self.http_server.commit_config().await
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
    async fn reload_restart(&self) -> Result<(), ExecutorError> {
-        self.http_server.reload_restart().await
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
 }

@@ -237,15 +241,13 @@ pub struct DummyInfra;
 #[async_trait]
 impl Topology for DummyInfra {
    fn name(&self) -> &str {
-        "DummyInfra"
+        todo!()
    }

-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
        let dummy_msg = "This is a dummy infrastructure that does nothing";
        info!("{dummy_msg}");
-        Ok(PreparationOutcome::Success {
-            details: dummy_msg.into(),
-        })
+        Ok(Outcome::success(dummy_msg.to_string()))
    }
 }

@@ -295,7 +297,19 @@ impl DhcpServer for DummyInfra {
    async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)> {
        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
-    async fn set_pxe_options(&self, _options: PxeOptions) -> Result<(), ExecutorError> {
+    async fn set_next_server(&self, _ip: IpAddress) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+    async fn set_boot_filename(&self, _boot_filename: &str) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+    async fn set_filename(&self, _filename: &str) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+    async fn set_filename64(&self, _filename: &str) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+    async fn set_filenameipxe(&self, _filenameipxe: &str) -> Result<(), ExecutorError> {
        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
    fn get_ip(&self) -> IpAddress {
@@ -365,9 +379,6 @@ impl HttpServer for DummyInfra {
    async fn serve_files(&self, _url: &Url) -> Result<(), ExecutorError> {
        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
-    async fn serve_file_content(&self, _file: &FileContent) -> Result<(), ExecutorError> {
-        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
-    }
    fn get_ip(&self) -> IpAddress {
        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
--- a/harmony/src/domain/topology/http.rs
+++ b/harmony/src/domain/topology/http.rs
@@ -1,12 +1,11 @@
-use crate::{data::FileContent, executors::ExecutorError};
+use crate::executors::ExecutorError;
 use async_trait::async_trait;

-use harmony_types::net::IpAddress;
-use harmony_types::net::Url;
+use super::{IpAddress, Url};
+
 #[async_trait]
 pub trait HttpServer: Send + Sync {
    async fn serve_files(&self, url: &Url) -> Result<(), ExecutorError>;
-    async fn serve_file_content(&self, file: &FileContent) -> Result<(), ExecutorError>;
    fn get_ip(&self) -> IpAddress;

    // async fn set_ip(&self, ip: IpAddress) -> Result<(), ExecutorError>;
--- a/harmony/src/domain/topology/k8s.rs
+++ b/harmony/src/domain/topology/k8s.rs
@@ -1,40 +1,27 @@
 use derive_new::new;
+use futures_util::StreamExt;
 use k8s_openapi::{
    ClusterResourceScope, NamespaceResourceScope,
    api::{apps::v1::Deployment, core::v1::Pod},
 };
+use kube::runtime::conditions;
+use kube::runtime::wait::await_condition;
 use kube::{
    Client, Config, Error, Resource,
-    api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
+    api::{Api, AttachParams, ListParams, Patch, PatchParams, ResourceExt},
    config::{KubeConfigOptions, Kubeconfig},
    core::ErrorResponse,
    runtime::reflector::Lookup,
 };
-use kube::{api::DynamicObject, runtime::conditions};
-use kube::{
-    api::{ApiResource, GroupVersionKind},
-    runtime::wait::await_condition,
-};
 use log::{debug, error, trace};
-use serde::{Serialize, de::DeserializeOwned};
-use serde_json::json;
-use similar::TextDiff;
-use tokio::io::AsyncReadExt;
+use serde::de::DeserializeOwned;
+use similar::{DiffableStr, TextDiff};

 #[derive(new, Clone)]
 pub struct K8sClient {
    client: Client,
 }

-impl Serialize for K8sClient {
-    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        todo!()
-    }
-}
-
 impl std::fmt::Debug for K8sClient {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        // This is a poor man's debug implementation for now as kube::Client does not provide much
@@ -53,66 +40,6 @@ impl K8sClient {
        })
    }

-    pub async fn get_deployment(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-    ) -> Result<Option<Deployment>, Error> {
-        let deps: Api<Deployment> = if let Some(ns) = namespace {
-            Api::namespaced(self.client.clone(), ns)
-        } else {
-            Api::default_namespaced(self.client.clone())
-        };
-        Ok(deps.get_opt(name).await?)
-    }
-
-    pub async fn get_pod(&self, name: &str, namespace: Option<&str>) -> Result<Option<Pod>, Error> {
-        let pods: Api<Pod> = if let Some(ns) = namespace {
-            Api::namespaced(self.client.clone(), ns)
-        } else {
-            Api::default_namespaced(self.client.clone())
-        };
-        Ok(pods.get_opt(name).await?)
-    }
-
-    pub async fn scale_deployment(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-        replicas: u32,
-    ) -> Result<(), Error> {
-        let deployments: Api<Deployment> = if let Some(ns) = namespace {
-            Api::namespaced(self.client.clone(), ns)
-        } else {
-            Api::default_namespaced(self.client.clone())
-        };
-
-        let patch = json!({
-            "spec": {
-                "replicas": replicas
-            }
-        });
-        let pp = PatchParams::default();
-        let scale = Patch::Apply(&patch);
-        deployments.patch_scale(name, &pp, &scale).await?;
-        Ok(())
-    }
-
-    pub async fn delete_deployment(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-    ) -> Result<(), Error> {
-        let deployments: Api<Deployment> = if let Some(ns) = namespace {
-            Api::namespaced(self.client.clone(), ns)
-        } else {
-            Api::default_namespaced(self.client.clone())
-        };
-        let delete_params = DeleteParams::default();
-        deployments.delete(name, &delete_params).await?;
-        Ok(())
-    }
-
    pub async fn wait_until_deployment_ready(
        &self,
        name: String,
@@ -128,78 +55,13 @@ impl K8sClient {
        }

        let establish = await_condition(api, name.as_str(), conditions::is_deployment_completed());
-        let t = timeout.unwrap_or(300);
+        let t = if let Some(t) = timeout { t } else { 300 };
        let res = tokio::time::timeout(std::time::Duration::from_secs(t), establish).await;

-        if res.is_ok() {
-            Ok(())
+        if let Ok(r) = res {
+            return Ok(());
        } else {
-            Err("timed out while waiting for deployment".to_string())
-        }
-    }
-
-    /// Will execute a commond in the first pod found that matches the specified label
-    /// '{label}={name}'
-    pub async fn exec_app_capture_output(
-        &self,
-        name: String,
-        label: String,
-        namespace: Option<&str>,
-        command: Vec<&str>,
-    ) -> Result<String, String> {
-        let api: Api<Pod>;
-
-        if let Some(ns) = namespace {
-            api = Api::namespaced(self.client.clone(), ns);
-        } else {
-            api = Api::default_namespaced(self.client.clone());
-        }
-        let pod_list = api
-            .list(&ListParams::default().labels(format!("{label}={name}").as_str()))
-            .await
-            .expect("couldn't get list of pods");
-
-        let res = api
-            .exec(
-                pod_list
-                    .items
-                    .first()
-                    .expect("couldn't get pod")
-                    .name()
-                    .expect("couldn't get pod name")
-                    .into_owned()
-                    .as_str(),
-                command,
-                &AttachParams::default().stdout(true).stderr(true),
-            )
-            .await;
-        match res {
-            Err(e) => Err(e.to_string()),
-            Ok(mut process) => {
-                let status = process
-                    .take_status()
-                    .expect("Couldn't get status")
-                    .await
-                    .expect("Couldn't unwrap status");
-
-                if let Some(s) = status.status {
-                    let mut stdout_buf = String::new();
-                    if let Some(mut stdout) = process.stdout().take() {
-                        stdout
-                            .read_to_string(&mut stdout_buf)
-                            .await
-                            .map_err(|e| format!("Failed to get status stdout {e}"))?;
-                    }
-                    debug!("Status: {} - {:?}", s, status.details);
-                    if s == "Success" {
-                        Ok(stdout_buf)
-                    } else {
-                        Err(s)
-                    }
-                } else {
-                    Err("Couldn't get inner status of pod exec".to_string())
-                }
-            }
+            return Err("timed out while waiting for deployment".to_string());
        }
    }

@@ -238,7 +100,7 @@ impl K8sClient {
            .await;

        match res {
-            Err(e) => Err(e.to_string()),
+            Err(e) => return Err(e.to_string()),
            Ok(mut process) => {
                let status = process
                    .take_status()
@@ -247,10 +109,14 @@ impl K8sClient {
                    .expect("Couldn't unwrap status");

                if let Some(s) = status.status {
-                    debug!("Status: {} - {:?}", s, status.details);
-                    if s == "Success" { Ok(()) } else { Err(s) }
+                    debug!("Status: {}", s);
+                    if s == "Success" {
+                        return Ok(());
+                    } else {
+                        return Err(s);
+                    }
                } else {
-                    Err("Couldn't get inner status of pod exec".to_string())
+                    return Err("Couldn't get inner status of pod exec".to_string());
                }
            }
        }
@@ -291,9 +157,8 @@ impl K8sClient {
                    trace!("Received current value {current:#?}");
                    // The resource exists, so we calculate and display a diff.
                    println!("\nPerforming dry-run for resource: '{}'", name);
-                    let mut current_yaml = serde_yaml::to_value(&current).unwrap_or_else(|_| {
-                        panic!("Could not serialize current value : {current:#?}")
-                    });
+                    let mut current_yaml = serde_yaml::to_value(&current)
+                        .expect(&format!("Could not serialize current value : {current:#?}"));
                    if current_yaml.is_mapping() && current_yaml.get("status").is_some() {
                        let map = current_yaml.as_mapping_mut().unwrap();
                        let removed = map.remove_entry("status");
@@ -360,7 +225,7 @@ impl K8sClient {
        }
    }

-    pub async fn apply_many<K>(&self, resource: &[K], ns: Option<&str>) -> Result<Vec<K>, Error>
+    pub async fn apply_many<K>(&self, resource: &Vec<K>, ns: Option<&str>) -> Result<Vec<K>, Error>
    where
        K: Resource + Clone + std::fmt::Debug + DeserializeOwned + serde::Serialize,
        <K as Resource>::Scope: ApplyStrategy<K>,
@@ -374,70 +239,6 @@ impl K8sClient {
        Ok(result)
    }

-    pub async fn apply_yaml_many(
-        &self,
-        #[allow(clippy::ptr_arg)] yaml: &Vec<serde_yaml::Value>,
-        ns: Option<&str>,
-    ) -> Result<(), Error> {
-        for y in yaml.iter() {
-            self.apply_yaml(y, ns).await?;
-        }
-        Ok(())
-    }
-
-    pub async fn apply_yaml(
-        &self,
-        yaml: &serde_yaml::Value,
-        ns: Option<&str>,
-    ) -> Result<(), Error> {
-        let obj: DynamicObject = serde_yaml::from_value(yaml.clone()).expect("TODO do not unwrap");
-        let name = obj.metadata.name.as_ref().expect("YAML must have a name");
-
-        let api_version = yaml
-            .get("apiVersion")
-            .expect("couldn't get apiVersion from YAML")
-            .as_str()
-            .expect("couldn't get apiVersion as str");
-        let kind = yaml
-            .get("kind")
-            .expect("couldn't get kind from YAML")
-            .as_str()
-            .expect("couldn't get kind as str");
-
-        let split: Vec<&str> = api_version.splitn(2, "/").collect();
-        let g = split[0];
-        let v = split[1];
-
-        let gvk = GroupVersionKind::gvk(g, v, kind);
-        let api_resource = ApiResource::from_gvk(&gvk);
-
-        let namespace = match ns {
-            Some(n) => n,
-            None => obj
-                .metadata
-                .namespace
-                .as_ref()
-                .expect("YAML must have a namespace"),
-        };
-
-        // 5. Create a dynamic API client for this resource type.
-        let api: Api<DynamicObject> =
-            Api::namespaced_with(self.client.clone(), namespace, &api_resource);
-
-        // 6. Apply the object to the cluster using Server-Side Apply.
-        //    This will create the resource if it doesn't exist, or update it if it does.
-        println!(
-            "Applying Argo Application '{}' in namespace '{}'...",
-            name, namespace
-        );
-        let patch_params = PatchParams::apply("harmony"); // Use a unique field manager name
-        let result = api.patch(name, &patch_params, &Patch::Apply(&obj)).await?;
-
-        println!("Successfully applied '{}'.", result.name_any());
-
-        Ok(())
-    }
-
    pub(crate) async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
        let k = match Kubeconfig::read_from(path) {
            Ok(k) => k,
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere.rs
@@ -1,46 +1,30 @@
 use std::{process::Command, sync::Arc};

 use async_trait::async_trait;
+use inquire::Confirm;
 use log::{debug, info, warn};
 use serde::Serialize;
 use tokio::sync::OnceCell;

 use crate::{
    executors::ExecutorError,
-    interpret::InterpretStatus,
+    interpret::{InterpretError, Outcome},
    inventory::Inventory,
-    modules::{
-        k3d::K3DInstallationScore,
-        monitoring::kube_prometheus::crd::{
-            crd_alertmanager_config::CRDPrometheus,
-            prometheus_operator::prometheus_operator_helm_chart_score,
-        },
-        prometheus::{
-            k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
-            prometheus::PrometheusApplicationMonitoring,
-        },
-    },
-    score::Score,
+    maestro::Maestro,
+    modules::k3d::K3DInstallationScore,
+    topology::LocalhostTopology,
 };

 use super::{
-    DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, PreparationError,
-    PreparationOutcome, Topology,
+    HelmCommand, K8sclient, Topology,
    k8s::K8sClient,
-    oberservability::monitoring::AlertReceiver,
-    tenant::{
-        TenantConfig, TenantManager,
-        k8s::K8sTenantManager,
-        network_policy::{
-            K3dNetworkPolicyStrategy, NetworkPolicyStrategy, NoopNetworkPolicyStrategy,
-        },
-    },
+    tenant::{TenantConfig, TenantManager, k8s::K8sTenantManager},
 };

 #[derive(Clone, Debug)]
 struct K8sState {
    client: Arc<K8sClient>,
-    source: K8sSource,
+    _source: K8sSource,
    message: String,
 }

@@ -74,42 +58,8 @@ impl K8sclient for K8sAnywhereTopology {
    }
 }

-#[async_trait]
-impl PrometheusApplicationMonitoring<CRDPrometheus> for K8sAnywhereTopology {
-    async fn install_prometheus(
-        &self,
-        sender: &CRDPrometheus,
-        inventory: &Inventory,
-        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        let po_result = self.ensure_prometheus_operator(sender).await?;
-
-        if po_result == PreparationOutcome::Noop {
-            debug!("Skipping Prometheus CR installation due to missing operator.");
-            return Ok(po_result);
-        }
-
-        let result = self
-            .get_k8s_prometheus_application_score(sender.clone(), receivers)
-            .await
-            .interpret(inventory, self)
-            .await;
-
-        match result {
-            Ok(outcome) => match outcome.status {
-                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
-                    details: outcome.message,
-                }),
-                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
-                _ => Err(PreparationError::new(outcome.message)),
-            },
-            Err(err) => Err(PreparationError::new(err.to_string())),
-        }
-    }
-}
-
 impl Serialize for K8sAnywhereTopology {
-    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
@@ -134,19 +84,6 @@ impl K8sAnywhereTopology {
        }
    }

-    async fn get_k8s_prometheus_application_score(
-        &self,
-        sender: CRDPrometheus,
-        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
-    ) -> K8sPrometheusCRDAlertingScore {
-        K8sPrometheusCRDAlertingScore {
-            sender,
-            receivers: receivers.unwrap_or_default(),
-            service_monitors: vec![],
-            prometheus_rules: vec![],
-        }
-    }
-
    fn is_helm_available(&self) -> Result<(), String> {
        let version_result = Command::new("helm")
            .arg("version")
@@ -157,8 +94,9 @@ impl K8sAnywhereTopology {
            return Err("Failed to run 'helm -version'".to_string());
        }

+        // Print the version output
        let version_output = String::from_utf8_lossy(&version_result.stdout);
-        debug!("Helm version: {}", version_output.trim());
+        println!("Helm version: {}", version_output.trim());

        Ok(())
    }
@@ -175,67 +113,59 @@ impl K8sAnywhereTopology {
        K3DInstallationScore::default()
    }

-    async fn try_install_k3d(&self) -> Result<(), PreparationError> {
-        let result = self
-            .get_k3d_installation_score()
-            .interpret(&Inventory::empty(), self)
-            .await;
-
-        match result {
-            Ok(outcome) => match outcome.status {
-                InterpretStatus::SUCCESS => Ok(()),
-                InterpretStatus::NOOP => Ok(()),
-                _ => Err(PreparationError::new(outcome.message)),
-            },
-            Err(err) => Err(PreparationError::new(err.to_string())),
-        }
+    async fn try_install_k3d(&self) -> Result<(), InterpretError> {
+        let maestro = Maestro::initialize(Inventory::autoload(), LocalhostTopology::new()).await?;
+        let k3d_score = self.get_k3d_installation_score();
+        maestro.interpret(Box::new(k3d_score)).await?;
+        Ok(())
    }

-    async fn try_get_or_install_k8s_client(&self) -> Result<Option<K8sState>, PreparationError> {
+    async fn try_get_or_install_k8s_client(&self) -> Result<Option<K8sState>, InterpretError> {
        let k8s_anywhere_config = &self.config;

-        // TODO this deserves some refactoring, it is becoming a bit hard to figure out
-        // be careful when making modifications here
-        if k8s_anywhere_config.use_local_k3d {
-            debug!("Using local k3d cluster because of use_local_k3d set to true");
-        } else {
-            if let Some(kubeconfig) = &k8s_anywhere_config.kubeconfig {
-                debug!("Loading kubeconfig {kubeconfig}");
-                match self.try_load_kubeconfig(kubeconfig).await {
-                    Some(client) => {
-                        return Ok(Some(K8sState {
-                            client: Arc::new(client),
-                            source: K8sSource::Kubeconfig,
-                            message: format!("Loaded k8s client from kubeconfig {kubeconfig}"),
-                        }));
-                    }
-                    None => {
-                        return Err(PreparationError::new(format!(
-                            "Failed to load kubeconfig from {kubeconfig}"
-                        )));
-                    }
+        if let Some(kubeconfig) = &k8s_anywhere_config.kubeconfig {
+            debug!("Loading kubeconfig {kubeconfig}");
+            match self.try_load_kubeconfig(&kubeconfig).await {
+                Some(client) => {
+                    return Ok(Some(K8sState {
+                        client: Arc::new(client),
+                        _source: K8sSource::Kubeconfig,
+                        message: format!("Loaded k8s client from kubeconfig {kubeconfig}"),
+                    }));
+                }
+                None => {
+                    return Err(InterpretError::new(format!(
+                        "Failed to load kubeconfig from {kubeconfig}"
+                    )));
                }
            }
-
-            if k8s_anywhere_config.use_system_kubeconfig {
-                debug!("Loading system kubeconfig");
-                match self.try_load_system_kubeconfig().await {
-                    Some(_client) => todo!(),
-                    None => todo!(),
-                }
-            }
-
-            info!("No kubernetes configuration found");
        }

+        if k8s_anywhere_config.use_system_kubeconfig {
+            debug!("Loading system kubeconfig");
+            match self.try_load_system_kubeconfig().await {
+                Some(_client) => todo!(),
+                None => todo!(),
+            }
+        }
+
+        info!("No kubernetes configuration found");
+
        if !k8s_anywhere_config.autoinstall {
-            warn!(
-                "Installation cancelled, K8sAnywhere could not initialize a valid Kubernetes client"
-            );
-            return Ok(None);
+            let confirmation = Confirm::new( "Harmony autoinstallation is not activated, do you wish to launch autoinstallation? : ")
+                .with_default(false)
+                .prompt()
+                .expect("Unexpected prompt error");
+
+            if !confirmation {
+                warn!(
+                    "Installation cancelled, K8sAnywhere could not initialize a valid Kubernetes client"
+                );
+                return Ok(None);
+            }
        }

-        debug!("Starting K8sAnywhere installation");
+        info!("Starting K8sAnywhere installation");
        self.try_install_k3d().await?;
        let k3d_score = self.get_k3d_installation_score();
        // I feel like having to rely on the k3d_rs crate here is a smell
@@ -247,8 +177,8 @@ impl K8sAnywhereTopology {
        let state = match k3d.get_client().await {
            Ok(client) => K8sState {
                client: Arc::new(K8sClient::new(client)),
-                source: K8sSource::LocalK3d,
-                message: "K8s client ready".to_string(),
+                _source: K8sSource::LocalK3d,
+                message: "Successfully installed K3D cluster and acquired client".to_string(),
            },
            Err(_) => todo!(),
        };
@@ -256,21 +186,15 @@ impl K8sAnywhereTopology {
        Ok(Some(state))
    }

-    async fn ensure_k8s_tenant_manager(&self, k8s_state: &K8sState) -> Result<(), String> {
-        if self.tenant_manager.get().is_some() {
+    async fn ensure_k8s_tenant_manager(&self) -> Result<(), String> {
+        if let Some(_) = self.tenant_manager.get() {
            return Ok(());
        }

        self.tenant_manager
            .get_or_try_init(async || -> Result<K8sTenantManager, String> {
                let k8s_client = self.k8s_client().await?;
-                let network_policy_strategy: Box<dyn NetworkPolicyStrategy> = match k8s_state.source
-                {
-                    K8sSource::LocalK3d => Box::new(K3dNetworkPolicyStrategy::new()),
-                    K8sSource::Kubeconfig => Box::new(NoopNetworkPolicyStrategy::new()),
-                };
-
-                Ok(K8sTenantManager::new(k8s_client, network_policy_strategy))
+                Ok(K8sTenantManager::new(k8s_client))
            })
            .await?;

@@ -285,55 +209,6 @@ impl K8sAnywhereTopology {
            )),
        }
    }
-
-    async fn ensure_prometheus_operator(
-        &self,
-        sender: &CRDPrometheus,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        let status = Command::new("sh")
-            .args(["-c", "kubectl get crd -A | grep -i prometheuses"])
-            .status()
-            .map_err(|e| PreparationError::new(format!("could not connect to cluster: {}", e)))?;
-
-        if !status.success() {
-            if let Some(Some(k8s_state)) = self.k8s_state.get() {
-                match k8s_state.source {
-                    K8sSource::LocalK3d => {
-                        debug!("installing prometheus operator");
-                        let op_score =
-                            prometheus_operator_helm_chart_score(sender.namespace.clone());
-                        let result = op_score.interpret(&Inventory::empty(), self).await;
-
-                        return match result {
-                            Ok(outcome) => match outcome.status {
-                                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
-                                    details: "installed prometheus operator".into(),
-                                }),
-                                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
-                                _ => Err(PreparationError::new(
-                                    "failed to install prometheus operator (unknown error)".into(),
-                                )),
-                            },
-                            Err(err) => Err(PreparationError::new(err.to_string())),
-                        };
-                    }
-                    K8sSource::Kubeconfig => {
-                        debug!("unable to install prometheus operator, contact cluster admin");
-                        return Ok(PreparationOutcome::Noop);
-                    }
-                }
-            } else {
-                warn!("Unable to detect k8s_state. Skipping Prometheus Operator install.");
-                return Ok(PreparationOutcome::Noop);
-            }
-        }
-
-        debug!("Prometheus operator is already present, skipping install");
-
-        Ok(PreparationOutcome::Success {
-            details: "prometheus operator present in cluster".into(),
-        })
-    }
 }

 #[derive(Clone, Debug)]
@@ -356,14 +231,6 @@ pub struct K8sAnywhereConfig {
    ///
    /// Default: true
    pub autoinstall: bool,
-
-    /// Whether to use local k3d cluster.
-    ///
-    /// Takes precedence over other options, useful to avoid messing up a remote cluster by mistake
-    ///
-    /// default: true
-    pub use_local_k3d: bool,
-    pub harmony_profile: String,
 }

 impl K8sAnywhereConfig {
@@ -373,14 +240,7 @@ impl K8sAnywhereConfig {
            use_system_kubeconfig: std::env::var("HARMONY_USE_SYSTEM_KUBECONFIG")
                .map_or_else(|_| false, |v| v.parse().ok().unwrap_or(false)),
            autoinstall: std::env::var("HARMONY_AUTOINSTALL")
-                .map_or_else(|_| true, |v| v.parse().ok().unwrap_or(false)),
-            // TODO harmony_profile should be managed at a more core level than this
-            harmony_profile: std::env::var("HARMONY_PROFILE").map_or_else(
-                |_| "dev".to_string(),
-                |v| v.parse().ok().unwrap_or("dev".to_string()),
-            ),
-            use_local_k3d: std::env::var("HARMONY_USE_LOCAL_K3D")
-                .map_or_else(|_| true, |v| v.parse().ok().unwrap_or(true)),
+                .map_or_else(|_| false, |v| v.parse().ok().unwrap_or(false)),
        }
    }
 }
@@ -391,39 +251,26 @@ impl Topology for K8sAnywhereTopology {
        "K8sAnywhereTopology"
    }

-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
        let k8s_state = self
            .k8s_state
            .get_or_try_init(|| self.try_get_or_install_k8s_client())
            .await?;

-        let k8s_state: &K8sState = k8s_state.as_ref().ok_or(PreparationError::new(
-            "no K8s client could be found or installed".to_string(),
+        let k8s_state: &K8sState = k8s_state.as_ref().ok_or(InterpretError::new(
+            "No K8s client could be found or installed".to_string(),
        ))?;

-        self.ensure_k8s_tenant_manager(k8s_state)
+        self.ensure_k8s_tenant_manager()
            .await
-            .map_err(PreparationError::new)?;
+            .map_err(|e| InterpretError::new(e))?;

        match self.is_helm_available() {
-            Ok(()) => Ok(PreparationOutcome::Success {
-                details: format!("{} + helm available", k8s_state.message.clone()),
-            }),
-            Err(e) => Err(PreparationError::new(format!("helm unavailable: {}", e))),
-        }
-    }
-}
-
-impl MultiTargetTopology for K8sAnywhereTopology {
-    fn current_target(&self) -> DeploymentTarget {
-        if self.config.use_local_k3d {
-            return DeploymentTarget::LocalDev;
-        }
-
-        match self.config.harmony_profile.to_lowercase().as_str() {
-            "staging" => DeploymentTarget::Staging,
-            "production" => DeploymentTarget::Production,
-            _ => todo!("HARMONY_PROFILE must be set when use_local_k3d is not set"),
+            Ok(()) => Ok(Outcome::success(format!(
+                "{} + helm available",
+                k8s_state.message.clone()
+            ))),
+            Err(e) => Err(InterpretError::new(format!("helm unavailable: {}", e))),
        }
    }
 }
--- a/harmony/src/domain/topology/load_balancer.rs
+++ b/harmony/src/domain/topology/load_balancer.rs
@@ -4,9 +4,8 @@ use async_trait::async_trait;
 use log::debug;
 use serde::Serialize;

-use super::LogicalHost;
+use super::{IpAddress, LogicalHost};
 use crate::executors::ExecutorError;
-use harmony_types::net::IpAddress;

 impl std::fmt::Debug for dyn LoadBalancer {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
--- a/harmony/src/domain/topology/localhost.rs
+++ b/harmony/src/domain/topology/localhost.rs
@@ -1,7 +1,9 @@
 use async_trait::async_trait;
 use derive_new::new;

-use super::{HelmCommand, PreparationError, PreparationOutcome, Topology};
+use crate::interpret::{InterpretError, Outcome};
+
+use super::{HelmCommand, Topology};

 #[derive(new)]
 pub struct LocalhostTopology;
@@ -12,10 +14,10 @@ impl Topology for LocalhostTopology {
        "LocalHostTopology"
    }

-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        Ok(PreparationOutcome::Success {
-            details: "Localhost is Chuck Norris, always ready.".into(),
-        })
+    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
+        Ok(Outcome::success(
+            "Localhost is Chuck Norris, always ready.".to_string(),
+        ))
    }
 }

--- a/harmony/src/domain/topology/mod.rs
+++ b/harmony/src/domain/topology/mod.rs
@@ -1,5 +1,4 @@
 mod ha_cluster;
-use harmony_types::net::IpAddress;
 mod host_binding;
 mod http;
 pub mod installable;
@@ -7,7 +6,6 @@ mod k8s_anywhere;
 mod localhost;
 pub mod oberservability;
 pub mod tenant;
-use derive_new::new;
 pub use k8s_anywhere::*;
 pub use localhost::*;
 pub mod k8s;
@@ -25,14 +23,15 @@ pub use network::*;
 use serde::Serialize;
 pub use tftp::*;

+mod postgres;
+pub use postgres::*;
+
 mod helm_command;
 pub use helm_command::*;

-use super::{
-    executors::ExecutorError,
-    instrumentation::{self, HarmonyEvent},
-};
-use std::error::Error;
+use std::net::IpAddr;
+
+use super::interpret::{InterpretError, Outcome};

 /// Represents a logical view of an infrastructure environment providing specific capabilities.
 ///
@@ -61,141 +60,40 @@ pub trait Topology: Send + Sync {
    ///     *   **Internal Orchestration:** For complex topologies, this method might manage dependencies on other sub-topologies, ensuring *their* `ensure_ready` is called first. Using nested `Maestros` to run setup `Scores` against these sub-topologies is the recommended pattern for non-trivial bootstrapping, allowing reuse of Harmony's core orchestration logic.
    ///
    /// # Returns
-    /// - `Ok(PreparationOutcome)`: Indicates the topology is now ready. The `Outcome` status might be `SUCCESS` if actions were taken, or `NOOP` if it was already ready. The message should provide context.
-    /// - `Err(PreparationError)`: Indicates the topology could not reach a ready state due to configuration issues, discovery failures, bootstrap errors, or unsupported environments.
-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError>;
+    /// - `Ok(Outcome)`: Indicates the topology is now ready. The `Outcome` status might be `SUCCESS` if actions were taken, or `NOOP` if it was already ready. The message should provide context.
+    /// - `Err(TopologyError)`: Indicates the topology could not reach a ready state due to configuration issues, discovery failures, bootstrap errors, or unsupported environments.
+    async fn ensure_ready(&self) -> Result<Outcome, InterpretError>;
 }

-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum PreparationOutcome {
-    Success { details: String },
-    Noop,
+pub type IpAddress = IpAddr;
+
+#[derive(Debug, Clone)]
+pub enum Url {
+    LocalFolder(String),
+    Url(url::Url),
 }

-#[derive(Debug, Clone, new)]
-pub struct PreparationError {
-    msg: String,
+impl Serialize for Url {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        match self {
+            Url::LocalFolder(path) => serializer.serialize_str(path),
+            Url::Url(url) => serializer.serialize_str(&url.as_str()),
+        }
+    }
 }

-impl std::fmt::Display for PreparationError {
+impl std::fmt::Display for Url {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(&self.msg)
-    }
-}
-
-impl Error for PreparationError {}
-
-impl From<ExecutorError> for PreparationError {
-    fn from(value: ExecutorError) -> Self {
-        Self {
-            msg: format!("InterpretError : {value}"),
+        match self {
+            Url::LocalFolder(path) => write!(f, "{}", path),
+            Url::Url(url) => write!(f, "{}", url),
        }
    }
 }

-impl From<kube::Error> for PreparationError {
-    fn from(value: kube::Error) -> Self {
-        Self {
-            msg: format!("PreparationError : {value}"),
-        }
-    }
-}
-
-impl From<String> for PreparationError {
-    fn from(value: String) -> Self {
-        Self {
-            msg: format!("PreparationError : {value}"),
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub enum TopologyStatus {
-    Queued,
-    Preparing,
-    Success,
-    Noop,
-    Error,
-}
-
-pub struct TopologyState {
-    pub topology: String,
-    pub status: TopologyStatus,
-}
-
-impl TopologyState {
-    pub fn new(topology: String) -> Self {
-        let instance = Self {
-            topology,
-            status: TopologyStatus::Queued,
-        };
-
-        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
-            topology: instance.topology.clone(),
-            status: instance.status.clone(),
-            message: None,
-        })
-        .unwrap();
-
-        instance
-    }
-
-    pub fn prepare(&mut self) {
-        self.status = TopologyStatus::Preparing;
-
-        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
-            topology: self.topology.clone(),
-            status: self.status.clone(),
-            message: None,
-        })
-        .unwrap();
-    }
-
-    pub fn success(&mut self, message: String) {
-        self.status = TopologyStatus::Success;
-
-        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
-            topology: self.topology.clone(),
-            status: self.status.clone(),
-            message: Some(message),
-        })
-        .unwrap();
-    }
-
-    pub fn noop(&mut self) {
-        self.status = TopologyStatus::Noop;
-
-        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
-            topology: self.topology.clone(),
-            status: self.status.clone(),
-            message: None,
-        })
-        .unwrap();
-    }
-
-    pub fn error(&mut self, message: String) {
-        self.status = TopologyStatus::Error;
-
-        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
-            topology: self.topology.clone(),
-            status: self.status.clone(),
-            message: Some(message),
-        })
-        .unwrap();
-    }
-}
-
-#[derive(Debug)]
-pub enum DeploymentTarget {
-    LocalDev,
-    Staging,
-    Production,
-}
-
-pub trait MultiTargetTopology: Topology {
-    fn current_target(&self) -> DeploymentTarget;
-}
-
 /// Represents a logical member of a cluster that provides one or more services.
 ///
 /// A LogicalHost can represent various roles within the infrastructure, such as:
@@ -234,8 +132,7 @@ impl LogicalHost {
    ///
    /// ```
    /// use std::str::FromStr;
-    /// use harmony::topology::{LogicalHost};
-    /// use harmony_types::net::IpAddress;
+    /// use harmony::topology::{IpAddress, LogicalHost};
    ///
    /// let start_ip = IpAddress::from_str("192.168.0.20").unwrap();
    /// let hosts = LogicalHost::create_hosts(3, start_ip, "worker");
@@ -291,7 +188,7 @@ fn increment_ip(ip: IpAddress, increment: u32) -> Option<IpAddress> {

 #[cfg(test)]
 mod tests {
-    use harmony_types::net::Url;
+    use super::*;
    use serde_json;

    #[test]
--- a/harmony/src/domain/topology/network.rs
+++ b/harmony/src/domain/topology/network.rs
@@ -1,12 +1,12 @@
 use std::{net::Ipv4Addr, str::FromStr, sync::Arc};

 use async_trait::async_trait;
-use harmony_types::net::{IpAddress, MacAddress};
+use harmony_types::net::MacAddress;
 use serde::Serialize;

 use crate::executors::ExecutorError;

-use super::{LogicalHost, k8s::K8sClient};
+use super::{IpAddress, LogicalHost, k8s::K8sClient};

 #[derive(Debug)]
 pub struct DHCPStaticEntry {
@@ -46,19 +46,16 @@ pub trait K8sclient: Send + Sync {
    async fn k8s_client(&self) -> Result<Arc<K8sClient>, String>;
 }

-pub struct PxeOptions {
-    pub ipxe_filename: String,
-    pub bios_filename: String,
-    pub efi_filename: String,
-    pub tftp_ip: Option<IpAddress>,
-}
-
 #[async_trait]
 pub trait DhcpServer: Send + Sync + std::fmt::Debug {
    async fn add_static_mapping(&self, entry: &DHCPStaticEntry) -> Result<(), ExecutorError>;
    async fn remove_static_mapping(&self, mac: &MacAddress) -> Result<(), ExecutorError>;
    async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)>;
-    async fn set_pxe_options(&self, pxe_options: PxeOptions) -> Result<(), ExecutorError>;
+    async fn set_next_server(&self, ip: IpAddress) -> Result<(), ExecutorError>;
+    async fn set_boot_filename(&self, boot_filename: &str) -> Result<(), ExecutorError>;
+    async fn set_filename(&self, filename: &str) -> Result<(), ExecutorError>;
+    async fn set_filename64(&self, filename64: &str) -> Result<(), ExecutorError>;
+    async fn set_filenameipxe(&self, filenameipxe: &str) -> Result<(), ExecutorError>;
    fn get_ip(&self) -> IpAddress;
    fn get_host(&self) -> LogicalHost;
    async fn commit_config(&self) -> Result<(), ExecutorError>;
--- a/harmony/src/domain/topology/oberservability/monitoring.rs
+++ b/harmony/src/domain/topology/oberservability/monitoring.rs
@@ -1,15 +1,12 @@
-use std::any::Any;
-
 use async_trait::async_trait;
 use log::debug;

 use crate::{
-    data::Version,
+    data::{Id, Version},
    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
    inventory::Inventory,
    topology::{Topology, installable::Installable},
 };
-use harmony_types::id::Id;

 #[async_trait]
 pub trait AlertSender: Send + Sync + std::fmt::Debug {
@@ -46,7 +43,7 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
    }

    fn get_name(&self) -> InterpretName {
-        InterpretName::Alerting
+        todo!()
    }

    fn get_version(&self) -> Version {
@@ -65,9 +62,7 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
 #[async_trait]
 pub trait AlertReceiver<S: AlertSender>: std::fmt::Debug + Send + Sync {
    async fn install(&self, sender: &S) -> Result<Outcome, InterpretError>;
-    fn name(&self) -> String;
    fn clone_box(&self) -> Box<dyn AlertReceiver<S>>;
-    fn as_any(&self) -> &dyn Any;
 }

 #[async_trait]
@@ -77,6 +72,6 @@ pub trait AlertRule<S: AlertSender>: std::fmt::Debug + Send + Sync {
 }

 #[async_trait]
-pub trait ScrapeTarget<S: AlertSender> {
+pub trait ScrapeTarger<S: AlertSender> {
    async fn install(&self, sender: &S) -> Result<(), InterpretError>;
 }
--- a/harmony/src/domain/topology/postgres.rs
+++ b/harmony/src/domain/topology/postgres.rs
@@ -0,0 +1,14 @@
+use crate::{
+    data::{PostgresDatabase, PostgresUser},
+    interpret::InterpretError,
+};
+use async_trait::async_trait;
+
+#[async_trait]
+pub trait PostgresServer {
+    async fn ensure_users_exist(&self, users: Vec<PostgresUser>) -> Result<(), InterpretError>;
+    async fn ensure_databases_exist(
+        &self,
+        databases: Vec<PostgresDatabase>,
+    ) -> Result<(), InterpretError>;
+}
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -27,11 +27,11 @@ pub struct UnmanagedRouter {

 impl Router for UnmanagedRouter {
    fn get_gateway(&self) -> IpAddress {
-        self.gateway
+        self.gateway.clone()
    }

    fn get_cidr(&self) -> Ipv4Cidr {
-        self.cidr
+        self.cidr.clone()
    }

    fn get_host(&self) -> LogicalHost {
--- a/harmony/src/domain/topology/tenant/k8s.rs
+++ b/harmony/src/domain/topology/tenant/k8s.rs
@@ -15,38 +15,36 @@ use k8s_openapi::{
    apimachinery::pkg::util::intstr::IntOrString,
 };
 use kube::Resource;
-use log::debug;
+use log::{debug, info, warn};
 use serde::de::DeserializeOwned;
 use serde_json::json;
 use tokio::sync::OnceCell;

-use super::{TenantConfig, TenantManager, network_policy::NetworkPolicyStrategy};
+use super::{TenantConfig, TenantManager};

-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct K8sTenantManager {
    k8s_client: Arc<K8sClient>,
    k8s_tenant_config: Arc<OnceCell<TenantConfig>>,
-    network_policy_strategy: Box<dyn NetworkPolicyStrategy>,
 }

 impl K8sTenantManager {
-    pub fn new(
-        client: Arc<K8sClient>,
-        network_policy_strategy: Box<dyn NetworkPolicyStrategy>,
-    ) -> Self {
+    pub fn new(client: Arc<K8sClient>) -> Self {
        Self {
            k8s_client: client,
            k8s_tenant_config: Arc::new(OnceCell::new()),
-            network_policy_strategy,
        }
    }
+}

+impl K8sTenantManager {
    fn get_namespace_name(&self, config: &TenantConfig) -> String {
        config.name.clone()
    }

    fn ensure_constraints(&self, _namespace: &Namespace) -> Result<(), ExecutorError> {
-        // TODO: Ensure constraints are applied to namespace (https://git.nationtech.io/NationTech/harmony/issues/98)
+        warn!("Validate that when tenant already exists (by id) that name has not changed");
+        warn!("Make sure other Tenant constraints are respected by this k8s implementation");
        Ok(())
    }

@@ -221,6 +219,24 @@ impl K8sTenantManager {
                  }
                ]
              },
+              {
+                "to": [
+                  {
+                "ipBlock": {
+                    "cidr": "10.43.0.1/32",
+                    }
+                  }
+                ]
+              },
+              {
+                "to": [
+                  {
+                "ipBlock": {
+                    "cidr": "172.23.0.0/16",
+                    }
+                  }
+                ]
+              },
              {
                "to": [
                  {
@@ -288,19 +304,19 @@ impl K8sTenantManager {
                let ports: Option<Vec<NetworkPolicyPort>> =
                    c.1.as_ref().map(|spec| match &spec.data {
                        super::PortSpecData::SinglePort(port) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int((*port).into())),
+                            port: Some(IntOrString::Int(port.clone().into())),
                            ..Default::default()
                        }],
                        super::PortSpecData::PortRange(start, end) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int((*start).into())),
-                            end_port: Some((*end).into()),
+                            port: Some(IntOrString::Int(start.clone().into())),
+                            end_port: Some(end.clone().into()),
                            protocol: None, // Not currently supported by Harmony
                        }],

                        super::PortSpecData::ListOfPorts(items) => items
                            .iter()
                            .map(|i| NetworkPolicyPort {
-                                port: Some(IntOrString::Int((*i).into())),
+                                port: Some(IntOrString::Int(i.clone().into())),
                                ..Default::default()
                            })
                            .collect(),
@@ -345,19 +361,19 @@ impl K8sTenantManager {
                let ports: Option<Vec<NetworkPolicyPort>> =
                    c.1.as_ref().map(|spec| match &spec.data {
                        super::PortSpecData::SinglePort(port) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int((*port).into())),
+                            port: Some(IntOrString::Int(port.clone().into())),
                            ..Default::default()
                        }],
                        super::PortSpecData::PortRange(start, end) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int((*start).into())),
-                            end_port: Some((*end).into()),
+                            port: Some(IntOrString::Int(start.clone().into())),
+                            end_port: Some(end.clone().into()),
                            protocol: None, // Not currently supported by Harmony
                        }],

                        super::PortSpecData::ListOfPorts(items) => items
                            .iter()
                            .map(|i| NetworkPolicyPort {
-                                port: Some(IntOrString::Int((*i).into())),
+                                port: Some(IntOrString::Int(i.clone().into())),
                                ..Default::default()
                            })
                            .collect(),
@@ -390,27 +406,12 @@ impl K8sTenantManager {
    }
 }

-impl Clone for K8sTenantManager {
-    fn clone(&self) -> Self {
-        Self {
-            k8s_client: self.k8s_client.clone(),
-            k8s_tenant_config: self.k8s_tenant_config.clone(),
-            network_policy_strategy: self.network_policy_strategy.clone_box(),
-        }
-    }
-}
-
 #[async_trait]
 impl TenantManager for K8sTenantManager {
    async fn provision_tenant(&self, config: &TenantConfig) -> Result<(), ExecutorError> {
        let namespace = self.build_namespace(config)?;
        let resource_quota = self.build_resource_quota(config)?;
-
        let network_policy = self.build_network_policy(config)?;
-        let network_policy = self
-            .network_policy_strategy
-            .adjust_policy(network_policy, config);
-
        let resource_limit_range = self.build_limit_range(config)?;

        self.ensure_constraints(&namespace)?;
@@ -427,14 +428,13 @@ impl TenantManager for K8sTenantManager {
        debug!("Creating network_policy for tenant {}", config.name);
        self.apply_resource(network_policy, config).await?;

-        debug!(
+        info!(
            "Success provisionning K8s tenant id {} name {}",
            config.id, config.name
        );
        self.store_config(config);
        Ok(())
    }
-
    async fn get_tenant_config(&self) -> Option<TenantConfig> {
        self.k8s_tenant_config.get().cloned()
    }
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBx6bDylvC68cVpjKfEFtLQJ/dOFi6PVS2vsIOqPDJIc jeangab@liliane2`