1.16.8 (#170 )

* update configs * bump to 1.16.8
1.16.8 (#169 )
2026-03-13 11:26:09 -05:00 · 2024-11-01 14:35:12 -07:00 · 2024-11-01 14:33:41 -07:00 · 2024-11-01 15:57:36 -04:00 · 2024-10-31 21:06:01 -07:00 · 2024-10-30 02:58:27 -04:00
158 changed files with 14547 additions and 2852 deletions
--- a/.devcontainer/dev.compose.yaml
+++ b/.devcontainer/dev.compose.yaml
@@ -0,0 +1,33 @@
+services:
+  dev:
+    image: mcr.microsoft.com/devcontainers/rust:1-1-bullseye
+    volumes:
+      # Mount the root folder that contains .git
+      - ../:/workspace:cached
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /proc:/proc
+      - repos:/etc/komodo/repos
+      - stacks:/etc/komodo/stacks
+    command: sleep infinity
+    ports:
+      - "9121:9121"
+    environment:
+      KOMODO_FIRST_SERVER: http://localhost:8120
+      KOMODO_DATABASE_ADDRESS: db
+      KOMODO_ENABLE_NEW_USERS: true
+      KOMODO_LOCAL_AUTH: true
+      KOMODO_JWT_SECRET: a_random_secret
+    links:
+      - db
+    # ...
+
+  db:
+    extends:
+      file: ../test.compose.yaml
+      service: ferretdb
+
+volumes:
+  data:
+  repo-cache:
+  repos:
+  stacks:
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,46 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/rust
+{
+	"name": "Komodo",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	//"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+	"dockerComposeFile": ["dev.compose.yaml"],
+	"workspaceFolder": "/workspace",
+  	"service": "dev",
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	"features": {
+		"ghcr.io/devcontainers/features/node:1": {
+			"version": "18.18.0"
+		},
+		"ghcr.io/devcontainers-community/features/deno:1": {
+
+		}
+	},
+
+	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+	"mounts": [
+		{
+			"source": "devcontainer-cargo-cache-${devcontainerId}",
+			"target": "/usr/local/cargo",
+			"type": "volume"
+		}
+	],
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	"forwardPorts": [
+		9121
+	],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	"postCreateCommand": "./.devcontainer/postCreate.sh",
+
+	"runServices": [
+		"db"
+	]
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}
--- a/.devcontainer/postCreate.sh
+++ b/.devcontainer/postCreate.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+cargo install typeshare-cli
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -0,0 +1,8 @@
+{
+    "recommendations": [
+        "rust-lang.rust-analyzer",
+        "tamasfe.even-better-toml",
+        "vadimcn.vscode-lldb",
+        "denoland.vscode-deno"
+    ]
+}
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -0,0 +1,179 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "Run Core",
+            "command": "cargo",
+            "args": [
+                "run",
+                "-p",
+                "komodo_core",
+                "--release"
+            ],
+            "options": {
+                "cwd": "${workspaceFolder}",
+                "env": {
+                    "KOMODO_CONFIG_PATH": "test.core.config.toml"
+                }
+            },
+            "problemMatcher": [
+                "$rustc"
+            ]
+        },
+        {
+            "label": "Build Core",
+            "command": "cargo",
+            "args": [
+                "build",
+                "-p",
+                "komodo_core",
+                "--release"
+            ],
+            "options": {
+                "cwd": "${workspaceFolder}",
+                "env": {
+                    "KOMODO_CONFIG_PATH": "test.core.config.toml"
+                }
+            },
+            "problemMatcher": [
+                "$rustc"
+            ]
+        },
+        {
+            "label": "Run Periphery",
+            "command": "cargo",
+            "args": [
+                "run",
+                "-p",
+                "komodo_periphery",
+                "--release"
+            ],
+            "options": {
+                "cwd": "${workspaceFolder}",
+                "env": {
+                    "KOMODO_CONFIG_PATH": "test.periphery.config.toml"
+                }
+            },
+            "problemMatcher": [
+                "$rustc"
+            ]
+        },
+        {
+            "label": "Build Periphery",
+            "command": "cargo",
+            "args": [
+                "build",
+                "-p",
+                "komodo_periphery",
+                "--release"
+            ],
+            "options": {
+                "cwd": "${workspaceFolder}",
+                "env": {
+                    "KOMODO_CONFIG_PATH": "test.periphery.config.toml"
+                }
+            },
+            "problemMatcher": [
+                "$rustc"
+            ]
+        },
+        {
+            "label": "Run Backend",
+            "dependsOn": [
+                "Run Core",
+                "Run Periphery"
+            ],
+            "problemMatcher": [
+                "$rustc"
+            ]
+        },
+        {
+            "label": "Build TS Client Types",
+            "type": "process",
+            "command": "node",
+            "args": [
+                "./client/core/ts/generate_types.mjs"
+            ],
+            "problemMatcher": []
+        },
+        {
+            "label": "Init TS Client",
+            "type": "shell",
+            "command": "yarn && yarn build && yarn link",
+            "options": {
+                "cwd": "${workspaceFolder}/client/core/ts",
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Init Frontend Client",
+            "type": "shell",
+            "command": "yarn link komodo_client && yarn install",
+            "options": {
+                "cwd": "${workspaceFolder}/frontend",
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Init Frontend",
+            "dependsOn": [
+                "Build TS Client Types",
+                "Init TS Client",
+                "Init Frontend Client"
+            ],
+            "dependsOrder": "sequence",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build Frontend",
+            "type": "shell",
+            "command": "yarn build",
+            "options": {
+                "cwd": "${workspaceFolder}/frontend",
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Prepare Frontend For Run",
+            "type": "shell",
+            "command": "cp -r ./client/core/ts/dist/. frontend/public/client/.",
+            "options": {
+                "cwd": "${workspaceFolder}",
+            },
+            "dependsOn": [
+                "Build TS Client Types",
+                "Build Frontend"
+            ],
+            "dependsOrder": "sequence",
+            "problemMatcher": []
+        },
+        {
+            "label": "Run Frontend",
+            "type": "shell",
+            "command": "yarn dev",
+            "options": {
+                "cwd": "${workspaceFolder}/frontend",
+            },
+            "dependsOn": ["Prepare Frontend For Run"],
+            "problemMatcher": []
+        },
+        {
+            "label": "Init",
+            "dependsOn": [
+                "Build Backend",
+                "Init Frontend"
+            ],
+            "dependsOrder": "sequence",
+            "problemMatcher": []
+        },
+        {
+            "label": "Run Komodo",
+            "dependsOn": [
+                "Run Core",
+                "Run Periphery",
+                "Run Frontend"
+            ],
+            "problemMatcher": []
+        },
+    ]
+  }
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -41,7 +41,7 @@ dependencies = [

 [[package]]
 name = "alerter"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "axum",
@@ -120,9 +120,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.90"
+version = "1.0.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37bf3594c4c988a53154954629820791dde498571819ae4ca50ca811e060cc95"
+checksum = "c042108f3ed77fd83760a5fd79b53be043192bb3b9dba91d8c574c0ada7850c8"

 [[package]]
 name = "arc-swap"
@@ -201,9 +201,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

 [[package]]
 name = "aws-config"
-version = "1.5.8"
+version = "1.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7198e6f03240fdceba36656d8be440297b6b82270325908c7381f37d826a74f6"
+checksum = "2d6448cfb224dd6a9b9ac734f58622dd0d4751f3589f3b777345745f46b2eb14"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -268,9 +268,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-ec2"
-version = "1.79.0"
+version = "1.83.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95559916ae9d6ef69b104546098a4b4c57082db5d11571917916e9a69234c6ea"
+checksum = "59ef9cdd731373735434b79a33fd1049525d78674c49b1e278d56544e388fe01"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -292,9 +292,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sso"
-version = "1.46.0"
+version = "1.47.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc2faec3205d496c7e57eff685dd944203df7ce16a4116d0281c44021788a7b"
+checksum = "a8776850becacbd3a82a4737a9375ddb5c6832a51379f24443a98e61513f852c"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -314,9 +314,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.47.0"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c93c241f52bc5e0476e259c953234dab7e2a35ee207ee202e86c0095ec4951dc"
+checksum = "0007b5b8004547133319b6c4e87193eee2a0bcb3e4c18c75d09febe9dab7b383"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -336,9 +336,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sts"
-version = "1.46.0"
+version = "1.47.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b259429be94a3459fa1b00c5684faee118d74f9577cc50aebadc36e507c63b5f"
+checksum = "9fffaa356e7f1c725908b75136d53207fa714e348f365671df14e95a60530ad3"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -432,9 +432,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime"
-version = "1.7.2"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a065c0fe6fdbdf9f11817eb68582b2ab4aff9e9c39e986ae48f7ec576c6322db"
+checksum = "be28bd063fa91fd871d131fc8b68d7cd4c5fa0869bea68daca50dcb1cbd76be2"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -476,9 +476,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-types"
-version = "1.2.7"
+version = "1.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147100a7bea70fa20ef224a6bad700358305f5dc0f84649c53769761395b355b"
+checksum = "07c9cdc179e6afbf5d391ab08c85eac817b51c87e1892a5edb5f7bbdc64314b4"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -943,7 +943,7 @@ dependencies = [

 [[package]]
 name = "command"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "komodo_client",
 "run_command",
@@ -1355,7 +1355,7 @@ dependencies = [

 [[package]]
 name = "environment_file"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "thiserror",
 ]
@@ -1439,7 +1439,7 @@ dependencies = [

 [[package]]
 name = "formatting"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "serror",
 ]
@@ -1571,7 +1571,7 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"

 [[package]]
 name = "git"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "command",
@@ -2191,7 +2191,7 @@ dependencies = [

 [[package]]
 name = "komodo_cli"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "clap",
@@ -2207,7 +2207,7 @@ dependencies = [

 [[package]]
 name = "komodo_client"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "async_timing_util",
@@ -2238,7 +2238,7 @@ dependencies = [

 [[package]]
 name = "komodo_core"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "async_timing_util",
@@ -2292,11 +2292,12 @@ dependencies = [
 "typeshare",
 "urlencoding",
 "uuid",
+ "wildcard",
 ]

 [[package]]
 name = "komodo_periphery"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "async_timing_util",
@@ -2383,7 +2384,7 @@ dependencies = [

 [[package]]
 name = "logger"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "komodo_client",
@@ -3089,7 +3090,7 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"

 [[package]]
 name = "periphery_client"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "komodo_client",
@@ -3307,9 +3308,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -3391,6 +3392,7 @@ dependencies = [
 "base64 0.22.1",
 "bytes",
 "encoding_rs",
+ "futures-channel",
 "futures-core",
 "futures-util",
 "h2 0.4.6",
@@ -3992,9 +3994,9 @@ dependencies = [

 [[package]]
 name = "serror"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8f432d878d404110352cfbaa031d8a6878a166cb7f50e00ab87d0508f8f68a0"
+checksum = "715a997753611604c722411afbe11f83a89e00e39323dc9016db96a86cc04fc8"
 dependencies = [
 "anyhow",
 "axum",
@@ -4326,18 +4328,18 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.64"
+version = "1.0.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
+checksum = "5d11abd9594d9b38965ef50805c5e469ca9cc6f197f883f717e0269a3057b3d5"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.64"
+version = "1.0.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
+checksum = "ae71770322cbd277e69d762a16c444af02aa0575ac0d174f0b9562d3b37f8602"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4790,9 +4792,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "typeshare"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f17399b76c2e743d58eac0635d7686e9c00f48cd4776f00695d9882a7d3187"
+checksum = "19be0f411120091e76e13e5a0186d8e2bcc3e7e244afdb70152197f1a8486ceb"
 dependencies = [
 "chrono",
 "serde",
@@ -4863,7 +4865,7 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

 [[package]]
 name = "update_logger"
-version = "1.16.1"
+version = "1.16.8"
 dependencies = [
 "anyhow",
 "komodo_client",
@@ -5072,6 +5074,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311"

+[[package]]
+name = "wildcard"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36241ad0795516b55e3b60e55c7f979d4f324e4aaea4c70d56b548b9164ee4d2"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ members = [
 ]

 [workspace.package]
-version = "1.16.1"
+version = "1.16.8"
 edition = "2021"
 authors = ["mbecker20 <becker.maxh@gmail.com>"]
 license = "GPL-3.0-or-later"
@@ -32,7 +32,7 @@ git = { path = "lib/git" }

 # MOGH
 run_command = { version = "0.0.6", features = ["async_tokio"] }
-serror = { version = "0.4.6", default-features = false }
+serror = { version = "0.4.7", default-features = false }
 slack = { version = "0.2.0", package = "slack_client_rs" }
 derive_default_builder = "0.1.8"
 derive_empty_traits = "0.1.0"
@@ -69,8 +69,8 @@ serde_yaml = "0.9.34"
 toml = "0.8.19"

 # ERROR
-anyhow = "1.0.90"
-thiserror = "1.0.64"
+anyhow = "1.0.91"
+thiserror = "1.0.65"

 # LOGGING
 opentelemetry_sdk = { version = "0.25.0", features = ["rt-tokio"] }
@@ -104,14 +104,15 @@ bollard = "0.17.1"
 sysinfo = "0.32.0"

 # CLOUD
-aws-config = "1.5.8"
-aws-sdk-ec2 = "1.77.0"
+aws-config = "1.5.9"
+aws-sdk-ec2 = "1.83.0"

 # MISC
 derive_builder = "0.20.2"
-typeshare = "1.0.3"
+typeshare = "1.0.4"
 octorust = "0.7.0"
 dashmap = "6.1.0"
+wildcard = "0.2.0"
 colored = "2.1.0"
-regex = "1.11.0"
+regex = "1.11.1"
 bson = "2.13.0"
--- a/bin/cli/src/exec.rs
+++ b/bin/cli/src/exec.rs
@@ -1,13 +1,21 @@
 use std::time::Duration;

 use colored::Colorize;
-use komodo_client::api::execute::Execution;
+use komodo_client::{
+  api::execute::{BatchExecutionResponse, Execution},
+  entities::update::Update,
+};

 use crate::{
  helpers::wait_for_enter,
  state::{cli_args, komodo_client},
 };

+pub enum ExecutionResult {
+  Single(Update),
+  Batch(BatchExecutionResponse),
+}
+
 pub async fn run(execution: Execution) -> anyhow::Result<()> {
  if matches!(execution, Execution::None(_)) {
    println!("Got 'none' execution. Doing nothing...");
@@ -24,18 +32,30 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
    Execution::RunAction(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchRunAction(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::RunProcedure(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchRunProcedure(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::RunBuild(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchRunBuild(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::CancelBuild(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
    Execution::Deploy(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchDeploy(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::StartDeployment(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
@@ -54,15 +74,27 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
    Execution::DestroyDeployment(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchDestroyDeployment(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::CloneRepo(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchCloneRepo(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::PullRepo(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchPullRepo(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::BuildRepo(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchBuildRepo(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::CancelRepoBuild(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
@@ -138,9 +170,15 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
    Execution::DeployStack(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchDeployStack(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::DeployStackIfChanged(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchDeployStackIfChanged(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::StartStack(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
@@ -159,6 +197,9 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
    Execution::DestroyStack(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
+    Execution::BatchDestroyStack(data) => {
+      println!("{}: {data:?}", "Data".dimmed())
+    }
    Execution::Sleep(data) => {
      println!("{}: {data:?}", "Data".dimmed())
    }
@@ -171,144 +212,234 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
  info!("Running Execution...");

  let res = match execution {
-    Execution::RunAction(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RunProcedure(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RunBuild(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::CancelBuild(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::Deploy(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StartDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RestartDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PauseDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::UnpauseDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StopDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DestroyDeployment(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::CloneRepo(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PullRepo(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::BuildRepo(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::CancelRepoBuild(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StartContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RestartContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PauseContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::UnpauseContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StopContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DestroyContainer(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StartAllContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RestartAllContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PauseAllContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::UnpauseAllContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StopAllContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneContainers(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DeleteNetwork(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneNetworks(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DeleteImage(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneImages(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DeleteVolume(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneVolumes(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneDockerBuilders(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneBuildx(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PruneSystem(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RunSync(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::CommitSync(request) => {
-      komodo_client().write(request).await
-    }
-    Execution::DeployStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DeployStackIfChanged(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StartStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::RestartStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::PauseStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::UnpauseStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::StopStack(request) => {
-      komodo_client().execute(request).await
-    }
-    Execution::DestroyStack(request) => {
-      komodo_client().execute(request).await
-    }
+    Execution::RunAction(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchRunAction(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::RunProcedure(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchRunProcedure(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::RunBuild(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchRunBuild(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::CancelBuild(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::Deploy(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchDeploy(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::StartDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::RestartDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PauseDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::UnpauseDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StopDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DestroyDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchDestroyDeployment(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::CloneRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchCloneRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::PullRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchPullRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::BuildRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchBuildRepo(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::CancelRepoBuild(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StartContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::RestartContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PauseContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::UnpauseContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StopContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DestroyContainer(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StartAllContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::RestartAllContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PauseAllContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::UnpauseAllContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StopAllContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneContainers(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DeleteNetwork(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneNetworks(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DeleteImage(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneImages(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DeleteVolume(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneVolumes(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneDockerBuilders(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneBuildx(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PruneSystem(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::RunSync(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::CommitSync(request) => komodo_client()
+      .write(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DeployStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchDeployStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::DeployStackIfChanged(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchDeployStackIfChanged(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
+    Execution::StartStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::RestartStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::PauseStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::UnpauseStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::StopStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::DestroyStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Single(u)),
+    Execution::BatchDestroyStack(request) => komodo_client()
+      .execute(request)
+      .await
+      .map(|u| ExecutionResult::Batch(u)),
    Execution::Sleep(request) => {
      let duration =
        Duration::from_millis(request.duration_ms as u64);
@@ -320,7 +451,12 @@ pub async fn run(execution: Execution) -> anyhow::Result<()> {
  };

  match res {
-    Ok(update) => println!("\n{}: {update:#?}", "SUCCESS".green()),
+    Ok(ExecutionResult::Single(update)) => {
+      println!("\n{}: {update:#?}", "SUCCESS".green())
+    }
+    Ok(ExecutionResult::Batch(update)) => {
+      println!("\n{}: {update:#?}", "SUCCESS".green())
+    }
    Err(e) => println!("{}\n\n{e:#?}", "ERROR".red()),
  }

--- a/bin/cli/src/state.rs
+++ b/bin/cli/src/state.rs
@@ -40,7 +40,9 @@ pub fn komodo_client() -> &'static KomodoClient {
          creds
        }
      };
-    futures::executor::block_on(KomodoClient::new(url, key, secret))
-      .expect("failed to initialize Komodo client")
+    futures::executor::block_on(
+      KomodoClient::new(url, key, secret).with_healthcheck(),
+    )
+    .expect("failed to initialize Komodo client")
  })
 }
--- a/bin/core/Cargo.toml
+++ b/bin/core/Cargo.toml
@@ -48,13 +48,14 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 typeshare.workspace = true
 octorust.workspace = true
+wildcard.workspace = true
 dashmap.workspace = true
 tracing.workspace = true
 reqwest.workspace = true
 futures.workspace = true
 nom_pem.workspace = true
-anyhow.workspace = true
 dotenvy.workspace = true
+anyhow.workspace = true
 bcrypt.workspace = true
 base64.workspace = true
 tokio.workspace = true
--- a/bin/core/alpine.Dockerfile
+++ b/bin/core/alpine.Dockerfile
@@ -34,6 +34,12 @@ COPY --from=core-builder /builder/target/release/core /app
 COPY --from=frontend-builder /builder/frontend/dist /app/frontend
 COPY --from=denoland/deno:bin /deno /usr/local/bin/deno

+# Set $DENO_DIR and preload external Deno deps
+ENV DENO_DIR=/action-cache/deno
+RUN mkdir /action-cache && \
+	cd /action-cache && \
+	deno install jsr:@std/yaml jsr:@std/toml
+
 # Hint at the port
 EXPOSE 9120 

--- a/bin/core/debian.Dockerfile
+++ b/bin/core/debian.Dockerfile
@@ -29,6 +29,12 @@ COPY --from=core-builder /builder/target/release/core /app
 COPY --from=frontend-builder /builder/frontend/dist /app/frontend
 COPY --from=denoland/deno:bin /deno /usr/local/bin/deno

+# Set $DENO_DIR and preload external Deno deps
+ENV DENO_DIR=/action-cache/deno
+RUN mkdir /action-cache && \
+	cd /action-cache && \
+	deno install jsr:@std/yaml jsr:@std/toml
+
 # Hint at the port
 EXPOSE 9120

--- a/bin/core/src/api/execute/action.rs
+++ b/bin/core/src/api/execute/action.rs
@@ -1,10 +1,15 @@
-use std::collections::HashSet;
+use std::{
+  collections::HashSet,
+  path::{Path, PathBuf},
+  str::FromStr,
+  sync::OnceLock,
+};

 use anyhow::Context;
 use command::run_komodo_command;
 use komodo_client::{
  api::{
-    execute::RunAction,
+    execute::{BatchExecutionResponse, BatchRunAction, RunAction},
    user::{CreateApiKey, CreateApiKeyResponse, DeleteApiKey},
  },
  entities::{
@@ -20,6 +25,7 @@ use resolver_api::Resolve;
 use tokio::fs;

 use crate::{
+  api::execute::ExecuteRequest,
  config::core_config,
  helpers::{
    interpolate::{
@@ -34,7 +40,26 @@ use crate::{
  state::{action_states, db_client, State},
 };

+impl super::BatchExecute for BatchRunAction {
+  type Resource = Action;
+  fn single_request(action: String) -> ExecuteRequest {
+    ExecuteRequest::RunAction(RunAction { action })
+  }
+}
+
+impl Resolve<BatchRunAction, (User, Update)> for State {
+  #[instrument(name = "BatchRunAction", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchRunAction { pattern }: BatchRunAction,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchRunAction>(&pattern, &user).await
+  }
+}
+
 impl Resolve<RunAction, (User, Update)> for State {
+  #[instrument(name = "RunAction", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
    &self,
    RunAction { action }: RunAction,
@@ -81,23 +106,22 @@ impl Resolve<RunAction, (User, Update)> for State {
        .into_iter()
        .collect::<Vec<_>>();

-    let path = core_config()
-      .action_directory
-      .join(format!("{}.ts", random_string(10)));
+    let file = format!("{}.ts", random_string(10));
+    let path = core_config().action_directory.join(&file);

    if let Some(parent) = path.parent() {
      let _ = fs::create_dir_all(parent).await;
    }

    fs::write(&path, contents).await.with_context(|| {
-      format!("Faild to write action file to {path:?}")
+      format!("Failed to write action file to {path:?}")
    })?;

    let mut res = run_komodo_command(
      // Keep this stage name as is, the UI will find the latest update log by matching the stage name
      "Execute Action",
      None,
-      format!("deno run --allow-read --allow-net --allow-import {}", path.display()),
+      format!("deno run --allow-all {}", path.display()),
      false,
    )
    .await;
@@ -107,11 +131,7 @@ impl Resolve<RunAction, (User, Update)> for State {
    res.stderr = svi::replace_in_string(&res.stderr, &replacers)
      .replace(&secret, "<ACTION_API_SECRET>");

-    if let Err(e) = fs::remove_file(path).await {
-      warn!(
-        "Failed to delete action file after action execution | {e:#}"
-      );
-    }
+    cleanup_run(file + ".js", &path).await;

    if let Err(e) = State
      .resolve(DeleteApiKey { key }, action_user().to_owned())
@@ -184,6 +204,22 @@ fn full_contents(contents: &str, key: &str, secret: &str) -> String {
  let base_url = format!("{protocol}://localhost:{port}");
  format!(
    "import {{ KomodoClient }} from '{base_url}/client/lib.js';
+import * as __YAML__ from 'jsr:@std/yaml';
+import * as __TOML__ from 'jsr:@std/toml';
+
+const YAML = {{
+  stringify: __YAML__.stringify,
+  parse: __YAML__.parse,
+  parseAll: __YAML__.parseAll,
+  parseDockerCompose: __YAML__.parse,
+}}
+
+const TOML = {{
+  stringify: __TOML__.stringify,
+  parse: __TOML__.parse,
+  parseResourceToml: __TOML__.parse,
+  parseCargoToml: __TOML__.parse,
+}}

 const komodo = KomodoClient('{base_url}', {{
  type: 'api-key',
@@ -204,3 +240,84 @@ main().catch(error => {{
 }}).then(() => console.log('🦎 Action completed successfully 🦎'));"
  )
 }
+
+/// Cleans up file at given path.
+/// ALSO if $DENO_DIR is set,
+/// will clean up the generated file matching "file"
+async fn cleanup_run(file: String, path: &Path) {
+  if let Err(e) = fs::remove_file(path).await {
+    warn!(
+      "Failed to delete action file after action execution | {e:#}"
+    );
+  }
+  // If $DENO_DIR is set (will be in container),
+  // will clean up the generated file matching "file" (NOT under path)
+  let Some(deno_dir) = deno_dir() else {
+    return;
+  };
+  delete_file(deno_dir.join("gen/file"), file).await;
+}
+
+fn deno_dir() -> Option<&'static Path> {
+  static DENO_DIR: OnceLock<Option<PathBuf>> = OnceLock::new();
+  DENO_DIR
+    .get_or_init(|| {
+      let deno_dir = std::env::var("DENO_DIR").ok()?;
+      PathBuf::from_str(&deno_dir).ok()
+    })
+    .as_deref()
+}
+
+/// file is just the terminating file path,
+/// it may be nested multiple folder under path,
+/// this will find the nested file and delete it.
+/// Assumes the file is only there once.
+fn delete_file(
+  dir: PathBuf,
+  file: String,
+) -> std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>>
+{
+  Box::pin(async move {
+    let Ok(mut dir) = fs::read_dir(dir).await else {
+      return false;
+    };
+    // Collect the nested folders for recursing
+    // only after checking all the files in directory.
+    let mut folders = Vec::<PathBuf>::new();
+
+    while let Ok(Some(entry)) = dir.next_entry().await {
+      let Ok(meta) = entry.metadata().await else {
+        continue;
+      };
+      if meta.is_file() {
+        let Ok(name) = entry.file_name().into_string() else {
+          continue;
+        };
+        if name == file {
+          if let Err(e) = fs::remove_file(entry.path()).await {
+            warn!(
+            "Failed to clean up generated file after action execution | {e:#}"
+          );
+          };
+          return true;
+        }
+      } else {
+        folders.push(entry.path());
+      }
+    }
+
+    if folders.len() == 1 {
+      // unwrap ok, folders definitely is not empty
+      let folder = folders.pop().unwrap();
+      delete_file(folder, file).await
+    } else {
+      // Check folders with file.clone
+      for folder in folders {
+        if delete_file(folder, file.clone()).await {
+          return true;
+        }
+      }
+      false
+    }
+  })
+}
--- a/bin/core/src/api/execute/build.rs
+++ b/bin/core/src/api/execute/build.rs
@@ -4,7 +4,10 @@ use anyhow::{anyhow, Context};
 use formatting::format_serror;
 use futures::future::join_all;
 use komodo_client::{
-  api::execute::{CancelBuild, Deploy, RunBuild},
+  api::execute::{
+    BatchExecutionResponse, BatchRunBuild, CancelBuild, Deploy,
+    RunBuild,
+  },
  entities::{
    alert::{Alert, AlertData, SeverityLevel},
    all_logs_success,
@@ -51,6 +54,24 @@ use crate::{

 use super::ExecuteRequest;

+impl super::BatchExecute for BatchRunBuild {
+  type Resource = Build;
+  fn single_request(build: String) -> ExecuteRequest {
+    ExecuteRequest::RunBuild(RunBuild { build })
+  }
+}
+
+impl Resolve<BatchRunBuild, (User, Update)> for State {
+  #[instrument(name = "BatchRunBuild", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchRunBuild { pattern }: BatchRunBuild,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchRunBuild>(&pattern, &user).await
+  }
+}
+
 impl Resolve<RunBuild, (User, Update)> for State {
  #[instrument(name = "RunBuild", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
@@ -438,7 +459,6 @@ async fn handle_early_return(
  Ok(update)
 }

-#[instrument(skip_all)]
 pub async fn validate_cancel_build(
  request: &ExecuteRequest,
 ) -> anyhow::Result<()> {
--- a/bin/core/src/api/execute/deployment.rs
+++ b/bin/core/src/api/execute/deployment.rs
@@ -37,6 +37,30 @@ use crate::{
  state::{action_states, State},
 };

+use super::ExecuteRequest;
+
+impl super::BatchExecute for BatchDeploy {
+  type Resource = Deployment;
+  fn single_request(deployment: String) -> ExecuteRequest {
+    ExecuteRequest::Deploy(Deploy {
+      deployment,
+      stop_signal: None,
+      stop_time: None,
+    })
+  }
+}
+
+impl Resolve<BatchDeploy, (User, Update)> for State {
+  #[instrument(name = "BatchDeploy", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchDeploy { pattern }: BatchDeploy,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchDeploy>(&pattern, &user).await
+  }
+}
+
 async fn setup_deployment_execution(
  deployment: &str,
  user: &User,
--- a/bin/core/src/api/execute/mod.rs
+++ b/bin/core/src/api/execute/mod.rs
@@ -2,13 +2,16 @@ use std::time::Instant;

 use anyhow::{anyhow, Context};
 use axum::{middleware, routing::post, Extension, Router};
+use axum_extra::{headers::ContentType, TypedHeader};
 use derive_variants::{EnumVariants, ExtractVariant};
 use formatting::format_serror;
+use futures::future::join_all;
 use komodo_client::{
  api::execute::*,
  entities::{
    update::{Log, Update},
    user::User,
+    Operation,
  },
 };
 use mungos::by_id::find_one_by_id;
@@ -21,6 +24,7 @@ use uuid::Uuid;
 use crate::{
  auth::auth_request,
  helpers::update::{init_execution_update, update_update},
+  resource::{list_full_for_user_using_pattern, KomodoResource},
  state::{db_client, State},
 };

@@ -68,6 +72,7 @@ pub enum ExecuteRequest {

  // ==== DEPLOYMENT ====
  Deploy(Deploy),
+  BatchDeploy(BatchDeploy),
  StartDeployment(StartDeployment),
  RestartDeployment(RestartDeployment),
  PauseDeployment(PauseDeployment),
@@ -77,29 +82,38 @@ pub enum ExecuteRequest {

  // ==== STACK ====
  DeployStack(DeployStack),
+  BatchDeployStack(BatchDeployStack),
  DeployStackIfChanged(DeployStackIfChanged),
+  BatchDeployStackIfChanged(BatchDeployStackIfChanged),
  StartStack(StartStack),
  RestartStack(RestartStack),
  StopStack(StopStack),
  PauseStack(PauseStack),
  UnpauseStack(UnpauseStack),
  DestroyStack(DestroyStack),
+  BatchDestroyStack(BatchDestroyStack),

  // ==== BUILD ====
  RunBuild(RunBuild),
+  BatchRunBuild(BatchRunBuild),
  CancelBuild(CancelBuild),

  // ==== REPO ====
  CloneRepo(CloneRepo),
+  BatchCloneRepo(BatchCloneRepo),
  PullRepo(PullRepo),
+  BatchPullRepo(BatchPullRepo),
  BuildRepo(BuildRepo),
+  BatchBuildRepo(BatchBuildRepo),
  CancelRepoBuild(CancelRepoBuild),

  // ==== PROCEDURE ====
  RunProcedure(RunProcedure),
+  BatchRunProcedure(BatchRunProcedure),

  // ==== ACTION ====
  RunAction(RunAction),
+  BatchRunAction(BatchRunAction),

  // ==== SERVER TEMPLATE ====
  LaunchServer(LaunchServer),
@@ -117,7 +131,25 @@ pub fn router() -> Router {
 async fn handler(
  Extension(user): Extension<User>,
  Json(request): Json<ExecuteRequest>,
-) -> serror::Result<Json<Update>> {
+) -> serror::Result<(TypedHeader<ContentType>, String)> {
+  let res = match inner_handler(request, user).await? {
+    ExecutionResult::Single(update) => serde_json::to_string(&update)
+      .context("Failed to serialize Update")?,
+    ExecutionResult::Batch(res) => res,
+  };
+  Ok((TypedHeader(ContentType::json()), res))
+}
+
+enum ExecutionResult {
+  Single(Update),
+  /// The batch contents will be pre serialized here
+  Batch(String),
+}
+
+async fn inner_handler(
+  request: ExecuteRequest,
+  user: User,
+) -> anyhow::Result<ExecutionResult> {
  let req_id = Uuid::new_v4();

  // need to validate no cancel is active before any update is created.
@@ -125,6 +157,17 @@ async fn handler(

  let update = init_execution_update(&request, &user).await?;

+  // This will be the case for the Batch exections,
+  // they don't have their own updates.
+  // The batch calls also call "inner_handler" themselves,
+  // and in their case will spawn tasks, so that isn't necessary
+  // here either.
+  if update.operation == Operation::None {
+    return Ok(ExecutionResult::Batch(
+      task(req_id, request, user, update).await?,
+    ));
+  }
+
  let handle =
    tokio::spawn(task(req_id, request, user, update.clone()));

@@ -160,7 +203,7 @@ async fn handler(
    }
  });

-  Ok(Json(update))
+  Ok(ExecutionResult::Single(update))
 }

 #[instrument(
@@ -200,3 +243,40 @@ async fn task(

  res
 }
+
+trait BatchExecute {
+  type Resource: KomodoResource;
+  fn single_request(name: String) -> ExecuteRequest;
+}
+
+async fn batch_execute<E: BatchExecute>(
+  pattern: &str,
+  user: &User,
+) -> anyhow::Result<BatchExecutionResponse> {
+  let resources = list_full_for_user_using_pattern::<E::Resource>(
+    &pattern,
+    Default::default(),
+    &user,
+    &[],
+  )
+  .await?;
+  let futures = resources.into_iter().map(|resource| {
+    let user = user.clone();
+    async move {
+      inner_handler(E::single_request(resource.name.clone()), user)
+        .await
+        .map(|r| {
+          let ExecutionResult::Single(update) = r else {
+            unreachable!()
+          };
+          update
+        })
+        .map_err(|e| BatchExecutionResponseItemErr {
+          name: resource.name,
+          error: e.into(),
+        })
+        .into()
+    }
+  });
+  Ok(join_all(futures).await)
+}
--- a/bin/core/src/api/execute/procedure.rs
+++ b/bin/core/src/api/execute/procedure.rs
@@ -2,7 +2,9 @@ use std::pin::Pin;

 use formatting::{bold, colored, format_serror, muted, Color};
 use komodo_client::{
-  api::execute::RunProcedure,
+  api::execute::{
+    BatchExecutionResponse, BatchRunProcedure, RunProcedure,
+  },
  entities::{
    permission::PermissionLevel, procedure::Procedure,
    update::Update, user::User,
@@ -18,6 +20,26 @@ use crate::{
  state::{action_states, db_client, State},
 };

+use super::ExecuteRequest;
+
+impl super::BatchExecute for BatchRunProcedure {
+  type Resource = Procedure;
+  fn single_request(procedure: String) -> ExecuteRequest {
+    ExecuteRequest::RunProcedure(RunProcedure { procedure })
+  }
+}
+
+impl Resolve<BatchRunProcedure, (User, Update)> for State {
+  #[instrument(name = "BatchRunProcedure", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchRunProcedure { pattern }: BatchRunProcedure,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchRunProcedure>(&pattern, &user).await
+  }
+}
+
 impl Resolve<RunProcedure, (User, Update)> for State {
  #[instrument(name = "RunProcedure", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
--- a/bin/core/src/api/execute/repo.rs
+++ b/bin/core/src/api/execute/repo.rs
@@ -47,6 +47,24 @@ use crate::{

 use super::ExecuteRequest;

+impl super::BatchExecute for BatchCloneRepo {
+  type Resource = Repo;
+  fn single_request(repo: String) -> ExecuteRequest {
+    ExecuteRequest::CloneRepo(CloneRepo { repo })
+  }
+}
+
+impl Resolve<BatchCloneRepo, (User, Update)> for State {
+  #[instrument(name = "BatchCloneRepo", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchCloneRepo { pattern }: BatchCloneRepo,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchCloneRepo>(&pattern, &user).await
+  }
+}
+
 impl Resolve<CloneRepo, (User, Update)> for State {
  #[instrument(name = "CloneRepo", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
@@ -138,6 +156,24 @@ impl Resolve<CloneRepo, (User, Update)> for State {
  }
 }

+impl super::BatchExecute for BatchPullRepo {
+  type Resource = Repo;
+  fn single_request(repo: String) -> ExecuteRequest {
+    ExecuteRequest::CloneRepo(CloneRepo { repo })
+  }
+}
+
+impl Resolve<BatchPullRepo, (User, Update)> for State {
+  #[instrument(name = "BatchPullRepo", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchPullRepo { pattern }: BatchPullRepo,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchPullRepo>(&pattern, &user).await
+  }
+}
+
 impl Resolve<PullRepo, (User, Update)> for State {
  #[instrument(name = "PullRepo", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
@@ -271,6 +307,24 @@ async fn update_last_pulled_time(repo_name: &str) {
  }
 }

+impl super::BatchExecute for BatchBuildRepo {
+  type Resource = Repo;
+  fn single_request(repo: String) -> ExecuteRequest {
+    ExecuteRequest::CloneRepo(CloneRepo { repo })
+  }
+}
+
+impl Resolve<BatchBuildRepo, (User, Update)> for State {
+  #[instrument(name = "BatchBuildRepo", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchBuildRepo { pattern }: BatchBuildRepo,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchBuildRepo>(&pattern, &user).await
+  }
+}
+
 impl Resolve<BuildRepo, (User, Update)> for State {
  #[instrument(name = "BuildRepo", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
--- a/bin/core/src/api/execute/stack.rs
+++ b/bin/core/src/api/execute/stack.rs
@@ -36,6 +36,29 @@ use crate::{
  state::{action_states, db_client, State},
 };

+use super::ExecuteRequest;
+
+impl super::BatchExecute for BatchDeployStack {
+  type Resource = Stack;
+  fn single_request(stack: String) -> ExecuteRequest {
+    ExecuteRequest::DeployStack(DeployStack {
+      stack,
+      stop_time: None,
+    })
+  }
+}
+
+impl Resolve<BatchDeployStack, (User, Update)> for State {
+  #[instrument(name = "BatchDeployStack", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchDeployStack { pattern }: BatchDeployStack,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchDeployStack>(&pattern, &user).await
+  }
+}
+
 impl Resolve<DeployStack, (User, Update)> for State {
  #[instrument(name = "DeployStack", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
@@ -246,6 +269,28 @@ impl Resolve<DeployStack, (User, Update)> for State {
  }
 }

+impl super::BatchExecute for BatchDeployStackIfChanged {
+  type Resource = Stack;
+  fn single_request(stack: String) -> ExecuteRequest {
+    ExecuteRequest::DeployStackIfChanged(DeployStackIfChanged {
+      stack,
+      stop_time: None,
+    })
+  }
+}
+
+impl Resolve<BatchDeployStackIfChanged, (User, Update)> for State {
+  #[instrument(name = "BatchDeployStackIfChanged", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchDeployStackIfChanged { pattern }: BatchDeployStackIfChanged,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchDeployStackIfChanged>(&pattern, &user)
+      .await
+  }
+}
+
 impl Resolve<DeployStackIfChanged, (User, Update)> for State {
  async fn resolve(
    &self,
@@ -418,6 +463,28 @@ impl Resolve<StopStack, (User, Update)> for State {
  }
 }

+impl super::BatchExecute for BatchDestroyStack {
+  type Resource = Stack;
+  fn single_request(stack: String) -> ExecuteRequest {
+    ExecuteRequest::DestroyStack(DestroyStack {
+      stack,
+      remove_orphans: false,
+      stop_time: None,
+    })
+  }
+}
+
+impl Resolve<BatchDestroyStack, (User, Update)> for State {
+  #[instrument(name = "BatchDestroyStack", skip(self, user), fields(user_id = user.id))]
+  async fn resolve(
+    &self,
+    BatchDestroyStack { pattern }: BatchDestroyStack,
+    (user, _): (User, Update),
+  ) -> anyhow::Result<BatchExecutionResponse> {
+    super::batch_execute::<BatchDestroyStack>(&pattern, &user).await
+  }
+}
+
 impl Resolve<DestroyStack, (User, Update)> for State {
  #[instrument(name = "DestroyStack", skip(self, user, update), fields(user_id = user.id, update_id = update.id))]
  async fn resolve(
--- a/bin/core/src/api/read/alerter.rs
+++ b/bin/core/src/api/read/alerter.rs
@@ -69,15 +69,16 @@ impl Resolve<GetAlertersSummary, User> for State {
    GetAlertersSummary {}: GetAlertersSummary,
    user: User,
  ) -> anyhow::Result<GetAlertersSummaryResponse> {
-    let query =
-      match resource::get_resource_object_ids_for_user::<Alerter>(&user)
-        .await?
-      {
-        Some(ids) => doc! {
-          "_id": { "$in": ids }
-        },
-        None => Document::new(),
-      };
+    let query = match resource::get_resource_object_ids_for_user::<
+      Alerter,
+    >(&user)
+    .await?
+    {
+      Some(ids) => doc! {
+        "_id": { "$in": ids }
+      },
+      None => Document::new(),
+    };
    let total = db_client()
      .alerters
      .count_documents(query)
--- a/bin/core/src/api/read/builder.rs
+++ b/bin/core/src/api/read/builder.rs
@@ -69,15 +69,16 @@ impl Resolve<GetBuildersSummary, User> for State {
    GetBuildersSummary {}: GetBuildersSummary,
    user: User,
  ) -> anyhow::Result<GetBuildersSummaryResponse> {
-    let query =
-      match resource::get_resource_object_ids_for_user::<Builder>(&user)
-        .await?
-      {
-        Some(ids) => doc! {
-          "_id": { "$in": ids }
-        },
-        None => Document::new(),
-      };
+    let query = match resource::get_resource_object_ids_for_user::<
+      Builder,
+    >(&user)
+    .await?
+    {
+      Some(ids) => doc! {
+        "_id": { "$in": ids }
+      },
+      None => Document::new(),
+    };
    let total = db_client()
      .builders
      .count_documents(query)
--- a/bin/core/src/api/read/mod.rs
+++ b/bin/core/src/api/read/mod.rs
@@ -339,6 +339,7 @@ impl Resolve<ListSecrets, User> for State {
        ResourceTarget::Server(id) => Some(id),
        ResourceTarget::Builder(id) => {
          match resource::get::<Builder>(&id).await?.config {
+            BuilderConfig::Url(_) => None,
            BuilderConfig::Server(config) => Some(config.server_id),
            BuilderConfig::Aws(config) => {
              secrets.extend(config.secrets);
@@ -387,6 +388,7 @@ impl Resolve<ListGitProvidersFromConfig, User> for State {
        }
        ResourceTarget::Builder(id) => {
          match resource::get::<Builder>(&id).await?.config {
+            BuilderConfig::Url(_) => {}
            BuilderConfig::Server(config) => {
              merge_git_providers_for_server(
                &mut providers,
@@ -485,6 +487,7 @@ impl Resolve<ListDockerRegistriesFromConfig, User> for State {
        }
        ResourceTarget::Builder(id) => {
          match resource::get::<Builder>(&id).await?.config {
+            BuilderConfig::Url(_) => {}
            BuilderConfig::Server(config) => {
              merge_docker_registries_for_server(
                &mut registries,
--- a/bin/core/src/api/read/user.rs
+++ b/bin/core/src/api/read/user.rs
@@ -6,7 +6,7 @@ use komodo_client::{
    ListApiKeysForServiceUserResponse, ListApiKeysResponse,
    ListUsers, ListUsersResponse,
  },
-  entities::user::{User, UserConfig},
+  entities::user::{admin_service_user, User, UserConfig},
 };
 use mungos::{
  by_id::find_one_by_id,
@@ -26,6 +26,13 @@ impl Resolve<GetUsername, User> for State {
    GetUsername { user_id }: GetUsername,
    _: User,
  ) -> anyhow::Result<GetUsernameResponse> {
+    if let Some(user) = admin_service_user(&user_id) {
+      return Ok(GetUsernameResponse {
+        username: user.username,
+        avatar: None,
+      });
+    }
+
    let user = find_one_by_id(&db_client().users, &user_id)
      .await
      .context("failed at mongo query for user")?
--- a/bin/core/src/api/write/repo.rs
+++ b/bin/core/src/api/write/repo.rs
@@ -130,7 +130,7 @@ impl Resolve<RenameRepo, User> for State {

    let server =
      resource::get::<Server>(&repo.config.server_id).await?;
-      
+
    let log = match periphery_client(&server)?
      .request(api::git::RenameRepo {
        curr_name: to_komodo_name(&repo.name),
--- a/bin/core/src/auth/oidc/mod.rs
+++ b/bin/core/src/auth/oidc/mod.rs
@@ -92,13 +92,19 @@ async fn login(
  );

  let config = core_config();
-  let redirect = if !config.oidc_redirect.is_empty() {
-    Redirect::to(
-      auth_url
-        .as_str()
-        .replace(&config.oidc_provider, &config.oidc_redirect)
-        .as_str(),
-    )
+  let redirect = if !config.oidc_redirect_host.is_empty() {
+    let auth_url = auth_url.as_str();
+    let (protocol, rest) = auth_url
+      .split_once("://")
+      .context("Invalid URL: Missing protocol (eg 'https://')")?;
+    let host = rest
+      .split_once(['/', '?'])
+      .map(|(host, _)| host)
+      .unwrap_or(rest);
+    Redirect::to(&auth_url.replace(
+      &format!("{protocol}://{host}"),
+      &config.oidc_redirect_host,
+    ))
  } else {
    Redirect::to(auth_url.as_str())
  };
--- a/bin/core/src/config.rs
+++ b/bin/core/src/config.rs
@@ -78,7 +78,7 @@ pub fn core_config() -> &'static CoreConfig {
      },
      oidc_enabled: env.komodo_oidc_enabled.unwrap_or(config.oidc_enabled),
      oidc_provider: env.komodo_oidc_provider.unwrap_or(config.oidc_provider),
-      oidc_redirect: env.komodo_oidc_redirect.unwrap_or(config.oidc_redirect),
+      oidc_redirect_host: env.komodo_oidc_redirect_host.unwrap_or(config.oidc_redirect_host),
      oidc_client_id: maybe_read_item_from_file(env.komodo_oidc_client_id_file,env
        .komodo_oidc_client_id)
        .unwrap_or(config.oidc_client_id),
--- a/bin/core/src/helpers/builder.rs
+++ b/bin/core/src/helpers/builder.rs
@@ -31,7 +31,7 @@ use crate::{
 use super::periphery_client;

 const BUILDER_POLL_RATE_SECS: u64 = 2;
-const BUILDER_POLL_MAX_TRIES: usize = 30;
+const BUILDER_POLL_MAX_TRIES: usize = 60;

 #[instrument(skip_all, fields(builder_id = builder.id, update_id = update.id))]
 pub async fn get_builder_periphery(
@@ -42,9 +42,32 @@ pub async fn get_builder_periphery(
  update: &mut Update,
 ) -> anyhow::Result<(PeripheryClient, BuildCleanupData)> {
  match builder.config {
+    BuilderConfig::Url(config) => {
+      if config.address.is_empty() {
+        return Err(anyhow!("Builder has not yet configured an address"));
+      }
+      let periphery = PeripheryClient::new(
+        config.address,
+        if config.passkey.is_empty() {
+          core_config().passkey.clone()
+        } else {
+          config.passkey
+        },
+      );
+      periphery
+        .health_check()
+        .await
+        .context("Url Builder failed health check")?;
+      Ok((
+        periphery,
+        BuildCleanupData::Server {
+          repo_name: resource_name,
+        },
+      ))
+    }
    BuilderConfig::Server(config) => {
      if config.server_id.is_empty() {
-        return Err(anyhow!("builder has not configured a server"));
+        return Err(anyhow!("Builder has not configured a server"));
      }
      let server = resource::get::<Server>(&config.server_id).await?;
      let periphery = periphery_client(&server)?;
--- a/bin/core/src/helpers/mod.rs
+++ b/bin/core/src/helpers/mod.rs
@@ -1,4 +1,4 @@
-use std::{str::FromStr, time::Duration};
+use std::str::FromStr;

 use anyhow::{anyhow, Context};
 use futures::future::join_all;
@@ -54,10 +54,6 @@ pub fn empty_or_only_spaces(word: &str) -> bool {
  true
 }

-pub fn random_duration(min_ms: u64, max_ms: u64) -> Duration {
-  Duration::from_millis(thread_rng().gen_range(min_ms..max_ms))
-}
-
 pub fn random_string(length: usize) -> String {
  thread_rng()
    .sample_iter(&Alphanumeric)
--- a/bin/core/src/helpers/procedure.rs
+++ b/bin/core/src/helpers/procedure.rs
@@ -4,9 +4,14 @@ use anyhow::{anyhow, Context};
 use formatting::{bold, colored, format_serror, muted, Color};
 use futures::future::join_all;
 use komodo_client::{
-  api::execute::Execution,
+  api::execute::*,
  entities::{
+    action::Action,
+    build::Build,
+    deployment::Deployment,
    procedure::Procedure,
+    repo::Repo,
+    stack::Stack,
    update::{Log, Update},
    user::procedure_user,
  },
@@ -17,6 +22,7 @@ use tokio::sync::Mutex;

 use crate::{
  api::execute::ExecuteRequest,
+  resource::{list_full_for_user_using_pattern, KomodoResource},
  state::{db_client, State},
 };

@@ -79,11 +85,94 @@ pub async fn execute_procedure(
 #[allow(dependency_on_unit_never_type_fallback)]
 #[instrument(skip(update))]
 async fn execute_stage(
-  executions: Vec<Execution>,
+  _executions: Vec<Execution>,
  parent_id: &str,
  parent_name: &str,
  update: &Mutex<Update>,
 ) -> anyhow::Result<()> {
+  let mut executions = Vec::with_capacity(_executions.capacity());
+  for execution in _executions {
+    match execution {
+      Execution::BatchRunAction(exec) => {
+        extend_batch_exection::<BatchRunAction>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchRunProcedure(exec) => {
+        extend_batch_exection::<BatchRunProcedure>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchRunBuild(exec) => {
+        extend_batch_exection::<BatchRunBuild>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchCloneRepo(exec) => {
+        extend_batch_exection::<BatchCloneRepo>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchPullRepo(exec) => {
+        extend_batch_exection::<BatchPullRepo>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchBuildRepo(exec) => {
+        extend_batch_exection::<BatchBuildRepo>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchDeploy(exec) => {
+        extend_batch_exection::<BatchDeploy>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchDestroyDeployment(exec) => {
+        extend_batch_exection::<BatchDestroyDeployment>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchDeployStack(exec) => {
+        extend_batch_exection::<BatchDeployStack>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchDeployStackIfChanged(exec) => {
+        extend_batch_exection::<BatchDeployStackIfChanged>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      Execution::BatchDestroyStack(exec) => {
+        extend_batch_exection::<BatchDestroyStack>(
+          &exec.pattern,
+          &mut executions,
+        )
+        .await?;
+      }
+      execution => executions.push(execution),
+    }
+  }
  let futures = executions.into_iter().map(|execution| async move {
    let now = Instant::now();
    add_line_to_update(
@@ -146,6 +235,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchRunProcedure(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchRunProcedure not implemented correctly"
+      ));
+    }
    Execution::RunAction(req) => {
      let req = ExecuteRequest::RunAction(req);
      let update = init_execution_update(&req, &user).await?;
@@ -162,6 +257,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchRunAction(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchRunAction not implemented correctly"
+      ));
+    }
    Execution::RunBuild(req) => {
      let req = ExecuteRequest::RunBuild(req);
      let update = init_execution_update(&req, &user).await?;
@@ -178,6 +279,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchRunBuild(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchRunBuild not implemented correctly"
+      ));
+    }
    Execution::CancelBuild(req) => {
      let req = ExecuteRequest::CancelBuild(req);
      let update = init_execution_update(&req, &user).await?;
@@ -210,6 +317,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchDeploy(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchDeploy not implemented correctly"
+      ));
+    }
    Execution::StartDeployment(req) => {
      let req = ExecuteRequest::StartDeployment(req);
      let update = init_execution_update(&req, &user).await?;
@@ -306,6 +419,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchDestroyDeployment(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchDestroyDeployment not implemented correctly"
+      ));
+    }
    Execution::CloneRepo(req) => {
      let req = ExecuteRequest::CloneRepo(req);
      let update = init_execution_update(&req, &user).await?;
@@ -322,6 +441,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchCloneRepo(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchCloneRepo not implemented correctly"
+      ));
+    }
    Execution::PullRepo(req) => {
      let req = ExecuteRequest::PullRepo(req);
      let update = init_execution_update(&req, &user).await?;
@@ -338,6 +463,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchPullRepo(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchPullRepo not implemented correctly"
+      ));
+    }
    Execution::BuildRepo(req) => {
      let req = ExecuteRequest::BuildRepo(req);
      let update = init_execution_update(&req, &user).await?;
@@ -354,6 +485,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchBuildRepo(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchBuildRepo not implemented correctly"
+      ));
+    }
    Execution::CancelRepoBuild(req) => {
      let req = ExecuteRequest::CancelRepoBuild(req);
      let update = init_execution_update(&req, &user).await?;
@@ -743,6 +880,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchDeployStack(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchDeployStack not implemented correctly"
+      ));
+    }
    Execution::DeployStackIfChanged(req) => {
      let req = ExecuteRequest::DeployStackIfChanged(req);
      let update = init_execution_update(&req, &user).await?;
@@ -759,6 +902,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchDeployStackIfChanged(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchDeployStackIfChanged not implemented correctly"
+      ));
+    }
    Execution::StartStack(req) => {
      let req = ExecuteRequest::StartStack(req);
      let update = init_execution_update(&req, &user).await?;
@@ -855,6 +1004,12 @@ async fn execute_execution(
      )
      .await?
    }
+    Execution::BatchDestroyStack(_) => {
+      // All batch executions must be expanded in `execute_stage`
+      return Err(anyhow!(
+        "Batch method BatchDestroyStack not implemented correctly"
+      ));
+    }
    Execution::Sleep(req) => {
      let duration = Duration::from_millis(req.duration_ms as u64);
      tokio::time::sleep(duration).await;
@@ -912,3 +1067,120 @@ async fn add_line_to_update(update: &Mutex<Update>, line: &str) {
    error!("Failed to update an update during procedure | {e:#}");
  };
 }
+
+async fn extend_batch_exection<E: ExtendBatch>(
+  pattern: &str,
+  executions: &mut Vec<Execution>,
+) -> anyhow::Result<()> {
+  let more = list_full_for_user_using_pattern::<E::Resource>(
+    pattern,
+    Default::default(),
+    procedure_user(),
+    &[],
+  )
+  .await?
+  .into_iter()
+  .map(|resource| E::single_execution(resource.name));
+  executions.extend(more);
+  Ok(())
+}
+
+trait ExtendBatch {
+  type Resource: KomodoResource;
+  fn single_execution(name: String) -> Execution;
+}
+
+impl ExtendBatch for BatchRunProcedure {
+  type Resource = Procedure;
+  fn single_execution(procedure: String) -> Execution {
+    Execution::RunProcedure(RunProcedure { procedure })
+  }
+}
+
+impl ExtendBatch for BatchRunAction {
+  type Resource = Action;
+  fn single_execution(action: String) -> Execution {
+    Execution::RunAction(RunAction { action })
+  }
+}
+
+impl ExtendBatch for BatchRunBuild {
+  type Resource = Build;
+  fn single_execution(build: String) -> Execution {
+    Execution::RunBuild(RunBuild { build })
+  }
+}
+
+impl ExtendBatch for BatchCloneRepo {
+  type Resource = Repo;
+  fn single_execution(repo: String) -> Execution {
+    Execution::CloneRepo(CloneRepo { repo })
+  }
+}
+
+impl ExtendBatch for BatchPullRepo {
+  type Resource = Repo;
+  fn single_execution(repo: String) -> Execution {
+    Execution::PullRepo(PullRepo { repo })
+  }
+}
+
+impl ExtendBatch for BatchBuildRepo {
+  type Resource = Repo;
+  fn single_execution(repo: String) -> Execution {
+    Execution::BuildRepo(BuildRepo { repo })
+  }
+}
+
+impl ExtendBatch for BatchDeploy {
+  type Resource = Deployment;
+  fn single_execution(deployment: String) -> Execution {
+    Execution::Deploy(Deploy {
+      deployment,
+      stop_signal: None,
+      stop_time: None,
+    })
+  }
+}
+
+impl ExtendBatch for BatchDestroyDeployment {
+  type Resource = Deployment;
+  fn single_execution(deployment: String) -> Execution {
+    Execution::DestroyDeployment(DestroyDeployment {
+      deployment,
+      signal: None,
+      time: None,
+    })
+  }
+}
+
+impl ExtendBatch for BatchDeployStack {
+  type Resource = Stack;
+  fn single_execution(stack: String) -> Execution {
+    Execution::DeployStack(DeployStack {
+      stack,
+      stop_time: None,
+    })
+  }
+}
+
+impl ExtendBatch for BatchDeployStackIfChanged {
+  type Resource = Stack;
+  fn single_execution(stack: String) -> Execution {
+    Execution::DeployStackIfChanged(DeployStackIfChanged {
+      stack,
+      stop_time: None,
+    })
+  }
+}
+
+impl ExtendBatch for BatchDestroyStack {
+  type Resource = Stack;
+  fn single_execution(stack: String) -> Execution {
+    Execution::DestroyStack(DestroyStack {
+      stack,
+      remove_orphans: false,
+      stop_time: None,
+    })
+  }
+}
--- a/bin/core/src/helpers/query.rs
+++ b/bin/core/src/helpers/query.rs
@@ -118,7 +118,7 @@ pub fn get_stack_state_from_containers(
  if containers.is_empty() {
    return StackState::Down;
  }
-  if services.len() != containers.len() {
+  if services.len() > containers.len() {
    return StackState::Unhealthy;
  }
  let running = containers.iter().all(|container| {
--- a/bin/core/src/helpers/update.rs
+++ b/bin/core/src/helpers/update.rs
@@ -261,6 +261,9 @@ pub async fn init_execution_update(
        resource::get::<Deployment>(&data.deployment).await?.id,
      ),
    ),
+    ExecuteRequest::BatchDeploy(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::StartDeployment(data) => (
      Operation::StartDeployment,
      ResourceTarget::Deployment(
@@ -305,6 +308,9 @@ pub async fn init_execution_update(
        resource::get::<Build>(&data.build).await?.id,
      ),
    ),
+    ExecuteRequest::BatchRunBuild(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::CancelBuild(data) => (
      Operation::CancelBuild,
      ResourceTarget::Build(
@@ -319,18 +325,27 @@ pub async fn init_execution_update(
        resource::get::<Repo>(&data.repo).await?.id,
      ),
    ),
+    ExecuteRequest::BatchCloneRepo(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::PullRepo(data) => (
      Operation::PullRepo,
      ResourceTarget::Repo(
        resource::get::<Repo>(&data.repo).await?.id,
      ),
    ),
+    ExecuteRequest::BatchPullRepo(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::BuildRepo(data) => (
      Operation::BuildRepo,
      ResourceTarget::Repo(
        resource::get::<Repo>(&data.repo).await?.id,
      ),
    ),
+    ExecuteRequest::BatchBuildRepo(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::CancelRepoBuild(data) => (
      Operation::CancelRepoBuild,
      ResourceTarget::Repo(
@@ -345,6 +360,9 @@ pub async fn init_execution_update(
        resource::get::<Procedure>(&data.procedure).await?.id,
      ),
    ),
+    ExecuteRequest::BatchRunProcedure(_) => {
+      return Ok(Default::default())
+    }

    // Action
    ExecuteRequest::RunAction(data) => (
@@ -353,6 +371,9 @@ pub async fn init_execution_update(
        resource::get::<Action>(&data.action).await?.id,
      ),
    ),
+    ExecuteRequest::BatchRunAction(_) => {
+      return Ok(Default::default())
+    }

    // Server template
    ExecuteRequest::LaunchServer(data) => (
@@ -379,12 +400,18 @@ pub async fn init_execution_update(
        resource::get::<Stack>(&data.stack).await?.id,
      ),
    ),
+    ExecuteRequest::BatchDeployStack(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::DeployStackIfChanged(data) => (
      Operation::DeployStack,
      ResourceTarget::Stack(
        resource::get::<Stack>(&data.stack).await?.id,
      ),
    ),
+    ExecuteRequest::BatchDeployStackIfChanged(_data) => {
+      return Ok(Default::default())
+    }
    ExecuteRequest::StartStack(data) => (
      if data.service.is_some() {
        Operation::StartStackService
@@ -441,6 +468,9 @@ pub async fn init_execution_update(
        resource::get::<Stack>(&data.stack).await?.id,
      ),
    ),
+    ExecuteRequest::BatchDestroyStack(_data) => {
+      return Ok(Default::default())
+    }
  };
  let mut update = make_update(target, operation, user);
  update.in_progress();
--- a/bin/core/src/listener/github/build.rs
+++ b/bin/core/src/listener/github/build.rs
@@ -1,66 +0,0 @@
-use std::sync::OnceLock;
-
-use anyhow::anyhow;
-use axum::http::HeaderMap;
-use komodo_client::{
-  api::execute::RunBuild,
-  entities::{build::Build, user::git_webhook_user},
-};
-use reqwest::StatusCode;
-use resolver_api::Resolve;
-use serror::AddStatusCode;
-
-use crate::{
-  api::execute::ExecuteRequest,
-  helpers::update::init_execution_update, resource, state::State,
-};
-
-use super::{extract_branch, verify_gh_signature, ListenerLockCache};
-
-fn build_locks() -> &'static ListenerLockCache {
-  static BUILD_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
-  BUILD_LOCKS.get_or_init(Default::default)
-}
-
-pub async fn auth_build_webhook(
-  build_id: &str,
-  headers: HeaderMap,
-  body: &str,
-) -> serror::Result<Build> {
-  let build = resource::get::<Build>(build_id)
-    .await
-    .status_code(StatusCode::NOT_FOUND)?;
-  verify_gh_signature(headers, body, &build.config.webhook_secret)
-    .await
-    .status_code(StatusCode::UNAUTHORIZED)?;
-  Ok(build)
-}
-
-pub async fn handle_build_webhook(
-  build: Build,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = build_locks().get_or_insert_default(&build.id).await;
-  let _lock = lock.lock().await;
-
-  if !build.config.webhook_enabled {
-    return Err(anyhow!("build does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != build.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req = ExecuteRequest::RunBuild(RunBuild { build: build.id });
-  let update = init_execution_update(&req, &user).await?;
-  let ExecuteRequest::RunBuild(req) = req else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
--- a/bin/core/src/listener/github/mod.rs
+++ b/bin/core/src/listener/github/mod.rs
@@ -1,278 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::{anyhow, Context};
-use axum::{extract::Path, http::HeaderMap, routing::post, Router};
-use hex::ToHex;
-use hmac::{Hmac, Mac};
-use serde::Deserialize;
-use sha2::Sha256;
-use tokio::sync::Mutex;
-use tracing::Instrument;
-
-use crate::{
-  config::core_config,
-  helpers::{cache::Cache, random_duration},
-};
-
-mod build;
-mod procedure;
-mod repo;
-mod stack;
-mod sync;
-
-type HmacSha256 = Hmac<Sha256>;
-
-#[derive(Deserialize)]
-struct Id {
-  id: String,
-}
-
-#[derive(Deserialize)]
-struct IdBranch {
-  id: String,
-  branch: Option<String>,
-}
-
-pub fn router() -> Router {
-  Router::new()
-		.route(
-			"/build/:id",
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let build = build::auth_build_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("build_webhook", id);
-            async {
-              let res = build::handle_build_webhook(build, body).await;
-              if let Err(e) = res {
-                warn!("failed to run build webook for build {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			),
-		)
-		.route(
-			"/repo/:id/clone", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let repo = repo::auth_repo_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-						let span = info_span!("repo_clone_webhook", id);
-            async {
-              let res = repo::handle_repo_clone_webhook(repo, body).await;
-              if let Err(e) = res {
-                warn!("failed to run repo clone webook for repo {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-		.route(
-			"/repo/:id/pull", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let repo = repo::auth_repo_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("repo_pull_webhook", id);
-            async {
-              let res = repo::handle_repo_pull_webhook(repo, body).await;
-              if let Err(e) = res {
-                warn!("failed to run repo pull webook for repo {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-		.route(
-			"/repo/:id/build", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let repo = repo::auth_repo_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("repo_build_webhook", id);
-            async {
-              let res = repo::handle_repo_build_webhook(repo, body).await;
-              if let Err(e) = res {
-                warn!("failed to run repo build webook for repo {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-    .route(
-			"/stack/:id/refresh", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let stack = stack::auth_stack_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-						let span = info_span!("stack_clone_webhook", id);
-            async {
-              let res = stack::handle_stack_refresh_webhook(stack, body).await;
-              if let Err(e) = res {
-                warn!("failed to run stack clone webook for stack {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-		.route(
-			"/stack/:id/deploy", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let stack = stack::auth_stack_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("stack_pull_webhook", id);
-            async {
-              let res = stack::handle_stack_deploy_webhook(stack, body).await;
-              if let Err(e) = res {
-                warn!("failed to run stack pull webook for stack {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-    .route(
-			"/procedure/:id/:branch", 
-			post(
-				|Path(IdBranch { id, branch }), headers: HeaderMap, body: String| async move {
-          let procedure = procedure::auth_procedure_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("procedure_webhook", id, branch);
-            async {
-              let res = procedure::handle_procedure_webhook(
-                procedure,
-                branch.unwrap_or_else(|| String::from("main")),
-                body
-              ).await;
-              if let Err(e) = res {
-                warn!("failed to run procedure webook for procedure {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-    .route(
-			"/sync/:id/refresh", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let sync = sync::auth_sync_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("sync_refresh_webhook", id);
-            async {
-              let res = sync::handle_sync_refresh_webhook(
-                sync,
-                body
-              ).await;
-              if let Err(e) = res {
-                warn!("failed to run sync webook for sync {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-    .route(
-			"/sync/:id/sync", 
-			post(
-				|Path(Id { id }), headers: HeaderMap, body: String| async move {
-          let sync = sync::auth_sync_webhook(&id, headers, &body).await?;
-					tokio::spawn(async move {
-            let span = info_span!("sync_execute_webhook", id);
-            async {
-              let res = sync::handle_sync_execute_webhook(
-                sync,
-                body
-              ).await;
-              if let Err(e) = res {
-                warn!("failed to run sync webook for sync {id} | {e:#}");
-              }
-            }
-              .instrument(span)
-              .await
-					});
-          serror::Result::Ok(())
-				},
-			)
-		)
-}
-
-#[instrument(skip_all)]
-async fn verify_gh_signature(
-  headers: HeaderMap,
-  body: &str,
-  custom_secret: &str,
-) -> anyhow::Result<()> {
-  // wait random amount of time
-  tokio::time::sleep(random_duration(0, 500)).await;
-
-  let signature = headers.get("x-hub-signature-256");
-  if signature.is_none() {
-    return Err(anyhow!("no signature in headers"));
-  }
-  let signature = signature.unwrap().to_str();
-  if signature.is_err() {
-    return Err(anyhow!("failed to unwrap signature"));
-  }
-  let signature = signature.unwrap().replace("sha256=", "");
-  let secret_bytes = if custom_secret.is_empty() {
-    core_config().webhook_secret.as_bytes()
-  } else {
-    custom_secret.as_bytes()
-  };
-  let mut mac = HmacSha256::new_from_slice(secret_bytes)
-    .expect("github webhook | failed to create hmac sha256");
-  mac.update(body.as_bytes());
-  let expected = mac.finalize().into_bytes().encode_hex::<String>();
-  if signature == expected {
-    Ok(())
-  } else {
-    Err(anyhow!("signature does not equal expected"))
-  }
-}
-
-#[derive(Deserialize)]
-struct GithubWebhookBody {
-  #[serde(rename = "ref")]
-  branch: String,
-}
-
-fn extract_branch(body: &str) -> anyhow::Result<String> {
-  let branch = serde_json::from_str::<GithubWebhookBody>(body)
-    .context("failed to parse github request body")?
-    .branch
-    .replace("refs/heads/", "");
-  Ok(branch)
-}
-
-type ListenerLockCache = Cache<String, Arc<Mutex<()>>>;
--- a/bin/core/src/listener/github/procedure.rs
+++ b/bin/core/src/listener/github/procedure.rs
@@ -1,74 +0,0 @@
-use std::sync::OnceLock;
-
-use anyhow::anyhow;
-use axum::http::HeaderMap;
-use komodo_client::{
-  api::execute::RunProcedure,
-  entities::{procedure::Procedure, user::git_webhook_user},
-};
-use reqwest::StatusCode;
-use resolver_api::Resolve;
-use serror::AddStatusCode;
-
-use crate::{
-  api::execute::ExecuteRequest,
-  helpers::update::init_execution_update, resource, state::State,
-};
-
-use super::{extract_branch, verify_gh_signature, ListenerLockCache};
-
-fn procedure_locks() -> &'static ListenerLockCache {
-  static BUILD_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
-  BUILD_LOCKS.get_or_init(Default::default)
-}
-
-pub async fn auth_procedure_webhook(
-  procedure_id: &str,
-  headers: HeaderMap,
-  body: &str,
-) -> serror::Result<Procedure> {
-  let procedure = resource::get::<Procedure>(procedure_id)
-    .await
-    .status_code(StatusCode::NOT_FOUND)?;
-  verify_gh_signature(
-    headers,
-    body,
-    &procedure.config.webhook_secret,
-  )
-  .await
-  .status_code(StatusCode::UNAUTHORIZED)?;
-  Ok(procedure)
-}
-
-pub async fn handle_procedure_webhook(
-  procedure: Procedure,
-  target_branch: String,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock =
-    procedure_locks().get_or_insert_default(&procedure.id).await;
-  let _lock = lock.lock().await;
-
-  if !procedure.config.webhook_enabled {
-    return Err(anyhow!("procedure does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != target_branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req = ExecuteRequest::RunProcedure(RunProcedure {
-    procedure: procedure.id,
-  });
-  let update = init_execution_update(&req, &user).await?;
-  let ExecuteRequest::RunProcedure(req) = req else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
--- a/bin/core/src/listener/github/repo.rs
+++ b/bin/core/src/listener/github/repo.rs
@@ -1,133 +0,0 @@
-use std::sync::OnceLock;
-
-use anyhow::anyhow;
-use axum::http::HeaderMap;
-use komodo_client::{
-  api::execute::{BuildRepo, CloneRepo, PullRepo},
-  entities::{repo::Repo, user::git_webhook_user},
-};
-use reqwest::StatusCode;
-use resolver_api::Resolve;
-use serror::AddStatusCode;
-
-use crate::{
-  helpers::update::init_execution_update, resource, state::State,
-};
-
-use super::{extract_branch, verify_gh_signature, ListenerLockCache};
-
-fn repo_locks() -> &'static ListenerLockCache {
-  static REPO_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
-  REPO_LOCKS.get_or_init(Default::default)
-}
-
-pub async fn auth_repo_webhook(
-  repo_id: &str,
-  headers: HeaderMap,
-  body: &str,
-) -> serror::Result<Repo> {
-  let repo = resource::get::<Repo>(repo_id)
-    .await
-    .status_code(StatusCode::NOT_FOUND)?;
-  verify_gh_signature(headers, body, &repo.config.webhook_secret)
-    .await
-    .status_code(StatusCode::UNAUTHORIZED)?;
-  Ok(repo)
-}
-
-pub async fn handle_repo_clone_webhook(
-  repo: Repo,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = repo_locks().get_or_insert_default(&repo.id).await;
-  let _lock = lock.lock().await;
-
-  if !repo.config.webhook_enabled {
-    return Err(anyhow!("repo does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != repo.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req =
-    crate::api::execute::ExecuteRequest::CloneRepo(CloneRepo {
-      repo: repo.id,
-    });
-  let update = init_execution_update(&req, &user).await?;
-  let crate::api::execute::ExecuteRequest::CloneRepo(req) = req
-  else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
-
-pub async fn handle_repo_pull_webhook(
-  repo: Repo,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = repo_locks().get_or_insert_default(&repo.id).await;
-  let _lock = lock.lock().await;
-
-  if !repo.config.webhook_enabled {
-    return Err(anyhow!("repo does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != repo.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req = crate::api::execute::ExecuteRequest::PullRepo(PullRepo {
-    repo: repo.id,
-  });
-  let update = init_execution_update(&req, &user).await?;
-  let crate::api::execute::ExecuteRequest::PullRepo(req) = req else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
-
-pub async fn handle_repo_build_webhook(
-  repo: Repo,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = repo_locks().get_or_insert_default(&repo.id).await;
-  let _lock = lock.lock().await;
-
-  if !repo.config.webhook_enabled {
-    return Err(anyhow!("repo does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != repo.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req =
-    crate::api::execute::ExecuteRequest::BuildRepo(BuildRepo {
-      repo: repo.id,
-    });
-  let update = init_execution_update(&req, &user).await?;
-  let crate::api::execute::ExecuteRequest::BuildRepo(req) = req
-  else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
--- a/bin/core/src/listener/github/stack.rs
+++ b/bin/core/src/listener/github/stack.rs
@@ -1,112 +0,0 @@
-use std::sync::OnceLock;
-
-use anyhow::anyhow;
-use axum::http::HeaderMap;
-use komodo_client::{
-  api::{
-    execute::{DeployStack, DeployStackIfChanged},
-    write::RefreshStackCache,
-  },
-  entities::{stack::Stack, user::git_webhook_user},
-};
-use reqwest::StatusCode;
-use resolver_api::Resolve;
-use serror::AddStatusCode;
-
-use crate::{
-  api::execute::ExecuteRequest,
-  helpers::update::init_execution_update, resource, state::State,
-};
-
-use super::{extract_branch, verify_gh_signature, ListenerLockCache};
-
-fn stack_locks() -> &'static ListenerLockCache {
-  static STACK_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
-  STACK_LOCKS.get_or_init(Default::default)
-}
-
-pub async fn auth_stack_webhook(
-  stack_id: &str,
-  headers: HeaderMap,
-  body: &str,
-) -> serror::Result<Stack> {
-  let stack = resource::get::<Stack>(stack_id)
-    .await
-    .status_code(StatusCode::NOT_FOUND)?;
-  verify_gh_signature(headers, body, &stack.config.webhook_secret)
-    .await
-    .status_code(StatusCode::UNAUTHORIZED)?;
-  Ok(stack)
-}
-
-pub async fn handle_stack_refresh_webhook(
-  stack: Stack,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through, from "action state busy".
-  let lock = stack_locks().get_or_insert_default(&stack.id).await;
-  let _lock = lock.lock().await;
-
-  if !stack.config.webhook_enabled {
-    return Err(anyhow!("stack does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != stack.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  State
-    .resolve(RefreshStackCache { stack: stack.id }, user)
-    .await?;
-  Ok(())
-}
-
-pub async fn handle_stack_deploy_webhook(
-  stack: Stack,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = stack_locks().get_or_insert_default(&stack.id).await;
-  let _lock = lock.lock().await;
-
-  if !stack.config.webhook_enabled {
-    return Err(anyhow!("stack does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != stack.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  if stack.config.webhook_force_deploy {
-    let req = ExecuteRequest::DeployStack(DeployStack {
-      stack: stack.id,
-      stop_time: None,
-    });
-    let update = init_execution_update(&req, &user).await?;
-    let ExecuteRequest::DeployStack(req) = req else {
-      unreachable!()
-    };
-    State.resolve(req, (user, update)).await?;
-  } else {
-    let req =
-      ExecuteRequest::DeployStackIfChanged(DeployStackIfChanged {
-        stack: stack.id,
-        stop_time: None,
-      });
-    let update = init_execution_update(&req, &user).await?;
-    let ExecuteRequest::DeployStackIfChanged(req) = req else {
-      unreachable!()
-    };
-    State.resolve(req, (user, update)).await?;
-  }
-
-  Ok(())
-}
--- a/bin/core/src/listener/github/sync.rs
+++ b/bin/core/src/listener/github/sync.rs
@@ -1,96 +0,0 @@
-use std::sync::OnceLock;
-
-use anyhow::anyhow;
-use axum::http::HeaderMap;
-use komodo_client::{
-  api::{execute::RunSync, write::RefreshResourceSyncPending},
-  entities::{sync::ResourceSync, user::git_webhook_user},
-};
-use reqwest::StatusCode;
-use resolver_api::Resolve;
-use serror::AddStatusCode;
-
-use crate::{
-  api::execute::ExecuteRequest,
-  helpers::update::init_execution_update, resource, state::State,
-};
-
-use super::{extract_branch, verify_gh_signature, ListenerLockCache};
-
-fn sync_locks() -> &'static ListenerLockCache {
-  static SYNC_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
-  SYNC_LOCKS.get_or_init(Default::default)
-}
-
-pub async fn auth_sync_webhook(
-  sync_id: &str,
-  headers: HeaderMap,
-  body: &str,
-) -> serror::Result<ResourceSync> {
-  let sync = resource::get::<ResourceSync>(sync_id)
-    .await
-    .status_code(StatusCode::NOT_FOUND)?;
-  verify_gh_signature(headers, body, &sync.config.webhook_secret)
-    .await
-    .status_code(StatusCode::UNAUTHORIZED)?;
-  Ok(sync)
-}
-
-pub async fn handle_sync_refresh_webhook(
-  sync: ResourceSync,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = sync_locks().get_or_insert_default(&sync.id).await;
-  let _lock = lock.lock().await;
-
-  if !sync.config.webhook_enabled {
-    return Err(anyhow!("sync does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != sync.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  State
-    .resolve(RefreshResourceSyncPending { sync: sync.id }, user)
-    .await?;
-  Ok(())
-}
-
-pub async fn handle_sync_execute_webhook(
-  sync: ResourceSync,
-  body: String,
-) -> anyhow::Result<()> {
-  // Acquire and hold lock to make a task queue for
-  // subsequent listener calls on same resource.
-  // It would fail if we let it go through from action state busy.
-  let lock = sync_locks().get_or_insert_default(&sync.id).await;
-  let _lock = lock.lock().await;
-
-  if !sync.config.webhook_enabled {
-    return Err(anyhow!("sync does not have webhook enabled"));
-  }
-
-  let request_branch = extract_branch(&body)?;
-  if request_branch != sync.config.branch {
-    return Err(anyhow!("request branch does not match expected"));
-  }
-
-  let user = git_webhook_user().to_owned();
-  let req = ExecuteRequest::RunSync(RunSync {
-    sync: sync.id,
-    resource_type: None,
-    resources: None,
-  });
-  let update = init_execution_update(&req, &user).await?;
-  let ExecuteRequest::RunSync(req) = req else {
-    unreachable!()
-  };
-  State.resolve(req, (user, update)).await?;
-  Ok(())
-}
--- a/bin/core/src/listener/integrations/github.rs
+++ b/bin/core/src/listener/integrations/github.rs
@@ -0,0 +1,71 @@
+use anyhow::{anyhow, Context};
+use axum::http::HeaderMap;
+use hex::ToHex;
+use hmac::{Hmac, Mac};
+use serde::Deserialize;
+use sha2::Sha256;
+
+use crate::{
+  config::core_config,
+  listener::{VerifyBranch, VerifySecret},
+};
+
+type HmacSha256 = Hmac<Sha256>;
+
+/// Listener implementation for Github type API, including Gitea
+pub struct Github;
+
+impl VerifySecret for Github {
+  #[instrument("VerifyGithubSecret", skip_all)]
+  fn verify_secret(
+    headers: HeaderMap,
+    body: &str,
+    custom_secret: &str,
+  ) -> anyhow::Result<()> {
+    let signature = headers
+      .get("x-hub-signature-256")
+      .context("No github signature in headers")?;
+    let signature = signature
+      .to_str()
+      .context("Failed to get signature as string")?;
+    let signature =
+      signature.strip_prefix("sha256=").unwrap_or(signature);
+    let secret_bytes = if custom_secret.is_empty() {
+      core_config().webhook_secret.as_bytes()
+    } else {
+      custom_secret.as_bytes()
+    };
+    let mut mac = HmacSha256::new_from_slice(secret_bytes)
+      .context("Failed to create hmac sha256 from secret")?;
+    mac.update(body.as_bytes());
+    let expected = mac.finalize().into_bytes().encode_hex::<String>();
+    if signature == expected {
+      Ok(())
+    } else {
+      Err(anyhow!("Signature does not equal expected"))
+    }
+  }
+}
+
+#[derive(Deserialize)]
+struct GithubWebhookBody {
+  #[serde(rename = "ref")]
+  branch: String,
+}
+
+impl VerifyBranch for Github {
+  fn verify_branch(
+    body: &str,
+    expected_branch: &str,
+  ) -> anyhow::Result<()> {
+    let branch = serde_json::from_str::<GithubWebhookBody>(body)
+      .context("Failed to parse github request body")?
+      .branch
+      .replace("refs/heads/", "");
+    if branch == expected_branch {
+      Ok(())
+    } else {
+      Err(anyhow!("request branch does not match expected"))
+    }
+  }
+}
--- a/bin/core/src/listener/integrations/gitlab.rs
+++ b/bin/core/src/listener/integrations/gitlab.rs
@@ -0,0 +1,58 @@
+use anyhow::{anyhow, Context};
+use serde::Deserialize;
+
+use crate::{
+  config::core_config,
+  listener::{VerifyBranch, VerifySecret},
+};
+
+/// Listener implementation for Gitlab type API
+pub struct Gitlab;
+
+impl VerifySecret for Gitlab {
+  #[instrument("VerifyGitlabSecret", skip_all)]
+  fn verify_secret(
+    headers: axum::http::HeaderMap,
+    _body: &str,
+    custom_secret: &str,
+  ) -> anyhow::Result<()> {
+    let token = headers
+      .get("x-gitlab-token")
+      .context("No gitlab token in headers")?;
+    let token =
+      token.to_str().context("Failed to get token as string")?;
+    let secret = if custom_secret.is_empty() {
+      core_config().webhook_secret.as_str()
+    } else {
+      custom_secret
+    };
+    if token == secret {
+      Ok(())
+    } else {
+      Err(anyhow!("Webhook secret does not match expected."))
+    }
+  }
+}
+
+#[derive(Deserialize)]
+struct GitlabWebhookBody {
+  #[serde(rename = "ref")]
+  branch: String,
+}
+
+impl VerifyBranch for Gitlab {
+  fn verify_branch(
+    body: &str,
+    expected_branch: &str,
+  ) -> anyhow::Result<()> {
+    let branch = serde_json::from_str::<GitlabWebhookBody>(body)
+      .context("Failed to parse gitlab request body")?
+      .branch
+      .replace("refs/heads/", "");
+    if branch == expected_branch {
+      Ok(())
+    } else {
+      Err(anyhow!("request branch does not match expected"))
+    }
+  }
+}
--- a/bin/core/src/listener/integrations/mod.rs
+++ b/bin/core/src/listener/integrations/mod.rs
@@ -0,0 +1,2 @@
+pub mod github;
+pub mod gitlab;
--- a/bin/core/src/listener/mod.rs
+++ b/bin/core/src/listener/mod.rs
@@ -1,7 +1,52 @@
-use axum::Router;
+use std::sync::Arc;

-mod github;
+use axum::{http::HeaderMap, Router};
+use komodo_client::entities::resource::Resource;
+use tokio::sync::Mutex;
+
+use crate::{helpers::cache::Cache, resource::KomodoResource};
+
+mod integrations;
+mod resources;
+mod router;
+
+use integrations::*;

 pub fn router() -> Router {
-  Router::new().nest("/github", github::router())
+  Router::new()
+    .nest("/github", router::router::<github::Github>())
+    .nest("/gitlab", router::router::<gitlab::Gitlab>())
 }
+
+type ListenerLockCache = Cache<String, Arc<Mutex<()>>>;
+
+/// Implemented for all resources which can recieve webhook.
+trait CustomSecret: KomodoResource {
+  fn custom_secret(
+    resource: &Resource<Self::Config, Self::Info>,
+  ) -> &str;
+}
+
+/// Implemented on the integration struct, eg [integrations::github::Github]
+trait VerifySecret {
+  fn verify_secret(
+    headers: HeaderMap,
+    body: &str,
+    custom_secret: &str,
+  ) -> anyhow::Result<()>;
+}
+
+/// Implemented on the integration struct, eg [integrations::github::Github]
+trait VerifyBranch {
+  /// Returns Err if the branch extracted from request
+  /// body does not match the expected branch.
+  fn verify_branch(
+    body: &str,
+    expected_branch: &str,
+  ) -> anyhow::Result<()>;
+}
+
+/// For Procedures and Actions, incoming webhook
+/// can be triggered by any branch by using `__ANY__`
+/// as the branch in the webhook URL.
+const ANY_BRANCH: &str = "__ANY__";
--- a/bin/core/src/listener/resources.rs
+++ b/bin/core/src/listener/resources.rs
@@ -0,0 +1,471 @@
+use std::sync::OnceLock;
+
+use anyhow::anyhow;
+use komodo_client::{
+  api::{
+    execute::*,
+    write::{RefreshResourceSyncPending, RefreshStackCache},
+  },
+  entities::{
+    action::Action, build::Build, procedure::Procedure, repo::Repo,
+    stack::Stack, sync::ResourceSync, user::git_webhook_user,
+  },
+};
+use resolver_api::Resolve;
+use serde::Deserialize;
+
+use crate::{
+  api::execute::ExecuteRequest,
+  helpers::update::init_execution_update, state::State,
+};
+
+use super::{ListenerLockCache, ANY_BRANCH};
+
+// =======
+//  BUILD
+// =======
+
+impl super::CustomSecret for Build {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn build_locks() -> &'static ListenerLockCache {
+  static BUILD_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
+  BUILD_LOCKS.get_or_init(Default::default)
+}
+
+pub async fn handle_build_webhook<B: super::VerifyBranch>(
+  build: Build,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through from action state busy.
+  let lock = build_locks().get_or_insert_default(&build.id).await;
+  let _lock = lock.lock().await;
+
+  if !build.config.webhook_enabled {
+    return Err(anyhow!("build does not have webhook enabled"));
+  }
+
+  B::verify_branch(&body, &build.config.branch)?;
+
+  let user = git_webhook_user().to_owned();
+  let req = ExecuteRequest::RunBuild(RunBuild { build: build.id });
+  let update = init_execution_update(&req, &user).await?;
+  let ExecuteRequest::RunBuild(req) = req else {
+    unreachable!()
+  };
+  State.resolve(req, (user, update)).await?;
+  Ok(())
+}
+
+// ======
+//  REPO
+// ======
+
+impl super::CustomSecret for Repo {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn repo_locks() -> &'static ListenerLockCache {
+  static REPO_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
+  REPO_LOCKS.get_or_init(Default::default)
+}
+
+pub trait RepoExecution {
+  async fn resolve(repo: Repo) -> anyhow::Result<()>;
+}
+
+impl RepoExecution for CloneRepo {
+  async fn resolve(repo: Repo) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    let req =
+      crate::api::execute::ExecuteRequest::CloneRepo(CloneRepo {
+        repo: repo.id,
+      });
+    let update = init_execution_update(&req, &user).await?;
+    let crate::api::execute::ExecuteRequest::CloneRepo(req) = req
+    else {
+      unreachable!()
+    };
+    State.resolve(req, (user, update)).await?;
+    Ok(())
+  }
+}
+
+impl RepoExecution for PullRepo {
+  async fn resolve(repo: Repo) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    let req =
+      crate::api::execute::ExecuteRequest::PullRepo(PullRepo {
+        repo: repo.id,
+      });
+    let update = init_execution_update(&req, &user).await?;
+    let crate::api::execute::ExecuteRequest::PullRepo(req) = req
+    else {
+      unreachable!()
+    };
+    State.resolve(req, (user, update)).await?;
+    Ok(())
+  }
+}
+
+impl RepoExecution for BuildRepo {
+  async fn resolve(repo: Repo) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    let req =
+      crate::api::execute::ExecuteRequest::BuildRepo(BuildRepo {
+        repo: repo.id,
+      });
+    let update = init_execution_update(&req, &user).await?;
+    let crate::api::execute::ExecuteRequest::BuildRepo(req) = req
+    else {
+      unreachable!()
+    };
+    State.resolve(req, (user, update)).await?;
+    Ok(())
+  }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RepoWebhookOption {
+  Clone,
+  Pull,
+  Build,
+}
+
+pub async fn handle_repo_webhook<B: super::VerifyBranch>(
+  option: RepoWebhookOption,
+  repo: Repo,
+  body: String,
+) -> anyhow::Result<()> {
+  match option {
+    RepoWebhookOption::Clone => {
+      handle_repo_webhook_inner::<B, CloneRepo>(repo, body).await
+    }
+    RepoWebhookOption::Pull => {
+      handle_repo_webhook_inner::<B, PullRepo>(repo, body).await
+    }
+    RepoWebhookOption::Build => {
+      handle_repo_webhook_inner::<B, BuildRepo>(repo, body).await
+    }
+  }
+}
+
+async fn handle_repo_webhook_inner<
+  B: super::VerifyBranch,
+  E: RepoExecution,
+>(
+  repo: Repo,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through from action state busy.
+  let lock = repo_locks().get_or_insert_default(&repo.id).await;
+  let _lock = lock.lock().await;
+
+  if !repo.config.webhook_enabled {
+    return Err(anyhow!("repo does not have webhook enabled"));
+  }
+
+  B::verify_branch(&body, &repo.config.branch)?;
+
+  E::resolve(repo).await
+}
+
+// =======
+//  STACK
+// =======
+
+impl super::CustomSecret for Stack {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn stack_locks() -> &'static ListenerLockCache {
+  static STACK_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
+  STACK_LOCKS.get_or_init(Default::default)
+}
+
+pub trait StackExecution {
+  async fn resolve(stack: Stack) -> anyhow::Result<()>;
+}
+
+impl StackExecution for RefreshStackCache {
+  async fn resolve(stack: Stack) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    State
+      .resolve(RefreshStackCache { stack: stack.id }, user)
+      .await?;
+    Ok(())
+  }
+}
+
+impl StackExecution for DeployStack {
+  async fn resolve(stack: Stack) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    if stack.config.webhook_force_deploy {
+      let req = ExecuteRequest::DeployStack(DeployStack {
+        stack: stack.id,
+        stop_time: None,
+      });
+      let update = init_execution_update(&req, &user).await?;
+      let ExecuteRequest::DeployStack(req) = req else {
+        unreachable!()
+      };
+      State.resolve(req, (user, update)).await?;
+    } else {
+      let req =
+        ExecuteRequest::DeployStackIfChanged(DeployStackIfChanged {
+          stack: stack.id,
+          stop_time: None,
+        });
+      let update = init_execution_update(&req, &user).await?;
+      let ExecuteRequest::DeployStackIfChanged(req) = req else {
+        unreachable!()
+      };
+      State.resolve(req, (user, update)).await?;
+    }
+
+    Ok(())
+  }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum StackWebhookOption {
+  Refresh,
+  Deploy,
+}
+
+pub async fn handle_stack_webhook<B: super::VerifyBranch>(
+  option: StackWebhookOption,
+  stack: Stack,
+  body: String,
+) -> anyhow::Result<()> {
+  match option {
+    StackWebhookOption::Refresh => {
+      handle_stack_webhook_inner::<B, RefreshStackCache>(stack, body)
+        .await
+    }
+    StackWebhookOption::Deploy => {
+      handle_stack_webhook_inner::<B, DeployStack>(stack, body).await
+    }
+  }
+}
+
+pub async fn handle_stack_webhook_inner<
+  B: super::VerifyBranch,
+  E: StackExecution,
+>(
+  stack: Stack,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through, from "action state busy".
+  let lock = stack_locks().get_or_insert_default(&stack.id).await;
+  let _lock = lock.lock().await;
+
+  if !stack.config.webhook_enabled {
+    return Err(anyhow!("stack does not have webhook enabled"));
+  }
+
+  B::verify_branch(&body, &stack.config.branch)?;
+
+  E::resolve(stack).await
+}
+
+// ======
+//  SYNC
+// ======
+
+impl super::CustomSecret for ResourceSync {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn sync_locks() -> &'static ListenerLockCache {
+  static SYNC_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
+  SYNC_LOCKS.get_or_init(Default::default)
+}
+
+pub trait SyncExecution {
+  async fn resolve(sync: ResourceSync) -> anyhow::Result<()>;
+}
+
+impl SyncExecution for RefreshResourceSyncPending {
+  async fn resolve(sync: ResourceSync) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    State
+      .resolve(RefreshResourceSyncPending { sync: sync.id }, user)
+      .await?;
+    Ok(())
+  }
+}
+
+impl SyncExecution for RunSync {
+  async fn resolve(sync: ResourceSync) -> anyhow::Result<()> {
+    let user = git_webhook_user().to_owned();
+    let req = ExecuteRequest::RunSync(RunSync {
+      sync: sync.id,
+      resource_type: None,
+      resources: None,
+    });
+    let update = init_execution_update(&req, &user).await?;
+    let ExecuteRequest::RunSync(req) = req else {
+      unreachable!()
+    };
+    State.resolve(req, (user, update)).await?;
+    Ok(())
+  }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SyncWebhookOption {
+  Refresh,
+  Sync,
+}
+
+pub async fn handle_sync_webhook<B: super::VerifyBranch>(
+  option: SyncWebhookOption,
+  sync: ResourceSync,
+  body: String,
+) -> anyhow::Result<()> {
+  match option {
+    SyncWebhookOption::Refresh => {
+      handle_sync_webhook_inner::<B, RefreshResourceSyncPending>(
+        sync, body,
+      )
+      .await
+    }
+    SyncWebhookOption::Sync => {
+      handle_sync_webhook_inner::<B, RunSync>(sync, body).await
+    }
+  }
+}
+
+async fn handle_sync_webhook_inner<
+  B: super::VerifyBranch,
+  E: SyncExecution,
+>(
+  sync: ResourceSync,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through from action state busy.
+  let lock = sync_locks().get_or_insert_default(&sync.id).await;
+  let _lock = lock.lock().await;
+
+  if !sync.config.webhook_enabled {
+    return Err(anyhow!("sync does not have webhook enabled"));
+  }
+
+  B::verify_branch(&body, &sync.config.branch)?;
+
+  E::resolve(sync).await
+}
+
+// ===========
+//  PROCEDURE
+// ===========
+
+impl super::CustomSecret for Procedure {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn procedure_locks() -> &'static ListenerLockCache {
+  static PROCEDURE_LOCKS: OnceLock<ListenerLockCache> =
+    OnceLock::new();
+  PROCEDURE_LOCKS.get_or_init(Default::default)
+}
+
+pub async fn handle_procedure_webhook<B: super::VerifyBranch>(
+  procedure: Procedure,
+  target_branch: &str,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through from action state busy.
+  let lock =
+    procedure_locks().get_or_insert_default(&procedure.id).await;
+  let _lock = lock.lock().await;
+
+  if !procedure.config.webhook_enabled {
+    return Err(anyhow!("procedure does not have webhook enabled"));
+  }
+
+  if target_branch != ANY_BRANCH {
+    B::verify_branch(&body, &target_branch)?;
+  }
+
+  let user = git_webhook_user().to_owned();
+  let req = ExecuteRequest::RunProcedure(RunProcedure {
+    procedure: procedure.id,
+  });
+  let update = init_execution_update(&req, &user).await?;
+  let ExecuteRequest::RunProcedure(req) = req else {
+    unreachable!()
+  };
+  State.resolve(req, (user, update)).await?;
+  Ok(())
+}
+
+// ========
+//  ACTION
+// ========
+
+impl super::CustomSecret for Action {
+  fn custom_secret(resource: &Self) -> &str {
+    &resource.config.webhook_secret
+  }
+}
+
+fn action_locks() -> &'static ListenerLockCache {
+  static ACTION_LOCKS: OnceLock<ListenerLockCache> = OnceLock::new();
+  ACTION_LOCKS.get_or_init(Default::default)
+}
+
+pub async fn handle_action_webhook<B: super::VerifyBranch>(
+  action: Action,
+  target_branch: &str,
+  body: String,
+) -> anyhow::Result<()> {
+  // Acquire and hold lock to make a task queue for
+  // subsequent listener calls on same resource.
+  // It would fail if we let it go through from action state busy.
+  let lock = action_locks().get_or_insert_default(&action.id).await;
+  let _lock = lock.lock().await;
+
+  if !action.config.webhook_enabled {
+    return Err(anyhow!("action does not have webhook enabled"));
+  }
+
+  if target_branch != ANY_BRANCH {
+    B::verify_branch(&body, &target_branch)?;
+  }
+
+  let user = git_webhook_user().to_owned();
+  let req =
+    ExecuteRequest::RunAction(RunAction { action: action.id });
+  let update = init_execution_update(&req, &user).await?;
+  let ExecuteRequest::RunAction(req) = req else {
+    unreachable!()
+  };
+  State.resolve(req, (user, update)).await?;
+  Ok(())
+}
--- a/bin/core/src/listener/router.rs
+++ b/bin/core/src/listener/router.rs
@@ -0,0 +1,220 @@
+use axum::{extract::Path, http::HeaderMap, routing::post, Router};
+use komodo_client::entities::{
+  action::Action, build::Build, procedure::Procedure, repo::Repo,
+  resource::Resource, stack::Stack, sync::ResourceSync,
+};
+use reqwest::StatusCode;
+use serde::Deserialize;
+use serror::AddStatusCode;
+use tracing::Instrument;
+
+use crate::resource::KomodoResource;
+
+use super::{
+  resources::{
+    handle_action_webhook, handle_build_webhook,
+    handle_procedure_webhook, handle_repo_webhook,
+    handle_stack_webhook, handle_sync_webhook, RepoWebhookOption,
+    StackWebhookOption, SyncWebhookOption,
+  },
+  CustomSecret, VerifyBranch, VerifySecret,
+};
+
+#[derive(Deserialize)]
+struct Id {
+  id: String,
+}
+
+#[derive(Deserialize)]
+struct IdAndOption<T> {
+  id: String,
+  option: T,
+}
+
+#[derive(Deserialize)]
+struct IdAndBranch {
+  id: String,
+  #[serde(default = "default_branch")]
+  branch: String,
+}
+
+fn default_branch() -> String {
+  String::from("main")
+}
+
+pub fn router<P: VerifySecret + VerifyBranch>() -> Router {
+  Router::new()
+  .route(
+    "/build/:id",
+    post(
+      |Path(Id { id }), headers: HeaderMap, body: String| async move {
+        let build =
+          auth_webhook::<P, Build>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("BuildWebhook", id);
+          async {
+            let res = handle_build_webhook::<P>(
+              build, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for build {id} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+  .route(
+    "/repo/:id/:option",
+    post(
+      |Path(IdAndOption::<RepoWebhookOption> { id, option }), headers: HeaderMap, body: String| async move {
+        let repo =
+          auth_webhook::<P, Repo>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("RepoWebhook", id);
+          async {
+            let res = handle_repo_webhook::<P>(
+              option, repo, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for repo {id} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+  .route(
+    "/stack/:id/:option",
+    post(
+      |Path(IdAndOption::<StackWebhookOption> { id, option }), headers: HeaderMap, body: String| async move {
+        let stack =
+          auth_webhook::<P, Stack>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("StackWebhook", id);
+          async {
+            let res = handle_stack_webhook::<P>(
+              option, stack, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for stack {id} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+  .route(
+    "/sync/:id/:option",
+    post(
+      |Path(IdAndOption::<SyncWebhookOption> { id, option }), headers: HeaderMap, body: String| async move {
+        let sync =
+          auth_webhook::<P, ResourceSync>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("ResourceSyncWebhook", id);
+          async {
+            let res = handle_sync_webhook::<P>(
+              option, sync, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for resource sync {id} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+  .route(
+    "/procedure/:id/:branch",
+    post(
+      |Path(IdAndBranch { id, branch }), headers: HeaderMap, body: String| async move {
+        let procedure =
+          auth_webhook::<P, Procedure>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("ProcedureWebhook", id);
+          async {
+            let res = handle_procedure_webhook::<P>(
+              procedure, &branch, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for procedure {id} | target branch: {branch} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+  .route(
+    "/action/:id/:branch",
+    post(
+      |Path(IdAndBranch { id, branch }), headers: HeaderMap, body: String| async move {
+        let action =
+          auth_webhook::<P, Action>(&id, headers, &body).await?;
+        tokio::spawn(async move {
+          let span = info_span!("ActionWebhook", id);
+          async {
+            let res = handle_action_webhook::<P>(
+              action, &branch, body,
+            )
+            .await;
+            if let Err(e) = res {
+              warn!(
+                "Failed at running webhook for action {id} | target branch: {branch} | {e:#}"
+              );
+            }
+          }
+          .instrument(span)
+          .await
+        });
+        serror::Result::Ok(())
+      },
+    ),
+  )
+}
+
+async fn auth_webhook<P, R>(
+  id: &str,
+  headers: HeaderMap,
+  body: &str,
+) -> serror::Result<Resource<R::Config, R::Info>>
+where
+  P: VerifySecret,
+  R: KomodoResource + CustomSecret,
+{
+  let resource = crate::resource::get::<R>(id)
+    .await
+    .status_code(StatusCode::BAD_REQUEST)?;
+  P::verify_secret(headers, body, R::custom_secret(&resource))
+    .status_code(StatusCode::UNAUTHORIZED)?;
+  Ok(resource)
+}
--- a/bin/core/src/resource/builder.rs
+++ b/bin/core/src/resource/builder.rs
@@ -40,6 +40,9 @@ impl super::KomodoResource for Builder {
    builder: Resource<Self::Config, Self::Info>,
  ) -> Self::ListItem {
    let (builder_type, instance_type) = match builder.config {
+      BuilderConfig::Url(_) => {
+        (BuilderConfigVariant::Url.to_string(), None)
+      }
      BuilderConfig::Server(config) => (
        BuilderConfigVariant::Server.to_string(),
        Some(config.server_id),
@@ -134,17 +137,22 @@ impl super::KomodoResource for Builder {
    resource: &Resource<Self::Config, Self::Info>,
    _update: &mut Update,
  ) -> anyhow::Result<()> {
-    // remove the builder from any attached builds
    db_client()
      .builds
      .update_many(
-        doc! { "config.builder.params.builder_id": &resource.id },
-        mungos::update::Update::Set(
-          doc! { "config.builder.params.builder_id": "" },
-        ),
+        doc! { "config.builder_id": &resource.id },
+        mungos::update::Update::Set(doc! { "config.builder_id": "" }),
      )
      .await
      .context("failed to update_many builds on database")?;
+    db_client()
+      .repos
+      .update_many(
+        doc! { "config.builder_id": &resource.id },
+        mungos::update::Update::Set(doc! { "config.builder_id": "" }),
+      )
+      .await
+      .context("failed to update_many repos on database")?;
    Ok(())
  }

--- a/bin/core/src/resource/mod.rs
+++ b/bin/core/src/resource/mod.rs
@@ -7,7 +7,7 @@ use anyhow::{anyhow, Context};
 use formatting::format_serror;
 use futures::{future::join_all, FutureExt};
 use komodo_client::{
-  api::write::CreateTag,
+  api::{read::ExportResourcesToToml, write::CreateTag},
  entities::{
    komodo_timestamp,
    permission::PermissionLevel,
@@ -18,6 +18,7 @@ use komodo_client::{
    user::{system_user, User},
    Operation, ResourceTarget, ResourceTargetVariant,
  },
+  parsers::parse_string_list,
 };
 use mungos::{
  by_id::{delete_one_by_id, update_one_by_id},
@@ -242,6 +243,79 @@ pub async fn get_check_permissions<T: KomodoResource>(
  }
 }

+#[instrument(level = "debug")]
+pub async fn get_user_permission_on_resource<T: KomodoResource>(
+  user: &User,
+  resource_id: &str,
+) -> anyhow::Result<PermissionLevel> {
+  if user.admin {
+    return Ok(PermissionLevel::Write);
+  }
+
+  let resource_type = T::resource_type();
+
+  // Start with base of Read or None
+  let mut base = if core_config().transparent_mode {
+    PermissionLevel::Read
+  } else {
+    PermissionLevel::None
+  };
+
+  // Add in the resource level global base permission
+  let resource_base = get::<T>(resource_id).await?.base_permission;
+  if resource_base > base {
+    base = resource_base;
+  }
+
+  // Overlay users base on resource variant
+  if let Some(level) = user.all.get(&resource_type).cloned() {
+    if level > base {
+      base = level;
+    }
+  }
+  if base == PermissionLevel::Write {
+    // No reason to keep going if already Write at this point.
+    return Ok(PermissionLevel::Write);
+  }
+
+  // Overlay any user groups base on resource variant
+  let groups = get_user_user_groups(&user.id).await?;
+  for group in &groups {
+    if let Some(level) = group.all.get(&resource_type).cloned() {
+      if level > base {
+        base = level;
+      }
+    }
+  }
+  if base == PermissionLevel::Write {
+    // No reason to keep going if already Write at this point.
+    return Ok(PermissionLevel::Write);
+  }
+
+  // Overlay any specific permissions
+  let permission = find_collect(
+    &db_client().permissions,
+    doc! {
+      "$or": user_target_query(&user.id, &groups)?,
+      "resource_target.type": resource_type.as_ref(),
+      "resource_target.id": resource_id
+    },
+    None,
+  )
+  .await
+  .context("failed to query db for permissions")?
+  .into_iter()
+  // get the max permission user has between personal / any user groups
+  .fold(base, |level, permission| {
+    if permission.level > level {
+      permission.level
+    } else {
+      level
+    }
+  });
+  Ok(permission)
+}
+
 // ======
 // LIST
 // ======
@@ -325,79 +399,6 @@ pub async fn get_resource_ids_for_user<T: KomodoResource>(
  Ok(Some(ids.into_iter().collect()))
 }

-#[instrument(level = "debug")]
-pub async fn get_user_permission_on_resource<T: KomodoResource>(
-  user: &User,
-  resource_id: &str,
-) -> anyhow::Result<PermissionLevel> {
-  if user.admin {
-    return Ok(PermissionLevel::Write);
-  }
-
-  let resource_type = T::resource_type();
-
-  // Start with base of Read or None
-  let mut base = if core_config().transparent_mode {
-    PermissionLevel::Read
-  } else {
-    PermissionLevel::None
-  };
-
-  // Add in the resource level global base permission
-  let resource_base = get::<T>(resource_id).await?.base_permission;
-  if resource_base > base {
-    base = resource_base;
-  }
-
-  // Overlay users base on resource variant
-  if let Some(level) = user.all.get(&resource_type).cloned() {
-    if level > base {
-      base = level;
-    }
-  }
-  if base == PermissionLevel::Write {
-    // No reason to keep going if already Write at this point.
-    return Ok(PermissionLevel::Write);
-  }
-
-  // Overlay any user groups base on resource variant
-  let groups = get_user_user_groups(&user.id).await?;
-  for group in &groups {
-    if let Some(level) = group.all.get(&resource_type).cloned() {
-      if level > base {
-        base = level;
-      }
-    }
-  }
-  if base == PermissionLevel::Write {
-    // No reason to keep going if already Write at this point.
-    return Ok(PermissionLevel::Write);
-  }
-
-  // Overlay any specific permissions
-  let permission = find_collect(
-    &db_client().permissions,
-    doc! {
-      "$or": user_target_query(&user.id, &groups)?,
-      "resource_target.type": resource_type.as_ref(),
-      "resource_target.id": resource_id
-    },
-    None,
-  )
-  .await
-  .context("failed to query db for permissions")?
-  .into_iter()
-  // get the max permission user has between personal / any user groups
-  .fold(base, |level, permission| {
-    if permission.level > level {
-      permission.level
-    } else {
-      level
-    }
-  });
-  Ok(permission)
-}
-
 #[instrument(level = "debug")]
 pub async fn list_for_user<T: KomodoResource>(
  mut query: ResourceQuery<T::QuerySpecifics>,
@@ -410,6 +411,23 @@ pub async fn list_for_user<T: KomodoResource>(
  list_for_user_using_document::<T>(filters, user).await
 }

+#[instrument(level = "debug")]
+pub async fn list_for_user_using_pattern<T: KomodoResource>(
+  pattern: &str,
+  query: ResourceQuery<T::QuerySpecifics>,
+  user: &User,
+  all_tags: &[Tag],
+) -> anyhow::Result<Vec<T::ListItem>> {
+  let list = list_full_for_user_using_pattern::<T>(
+    pattern, query, user, all_tags,
+  )
+  .await?
+  .into_iter()
+  .map(|resource| T::to_list_item(resource));
+  Ok(join_all(list).await)
+}
+
+#[instrument(level = "debug")]
 pub async fn list_for_user_using_document<T: KomodoResource>(
  filters: Document,
  user: &User,
@@ -421,6 +439,55 @@ pub async fn list_for_user_using_document<T: KomodoResource>(
  Ok(join_all(list).await)
 }

+/// Lists full resource matching wildcard syntax,
+/// or regex if wrapped with "\\"
+///
+/// ## Example
+/// ```
+/// let items = list_full_for_user_using_match_string::<Build>("foo-*", Default::default(), user, all_tags).await?;
+/// let items = list_full_for_user_using_match_string::<Build>("\\^foo-.*$\\", Default::default(), user, all_tags).await?;
+/// ```
+#[instrument(level = "debug")]
+pub async fn list_full_for_user_using_pattern<T: KomodoResource>(
+  pattern: &str,
+  query: ResourceQuery<T::QuerySpecifics>,
+  user: &User,
+  all_tags: &[Tag],
+) -> anyhow::Result<Vec<Resource<T::Config, T::Info>>> {
+  let resources =
+    list_full_for_user::<T>(query, user, all_tags).await?;
+
+  let patterns = parse_string_list(pattern);
+  let mut names = HashSet::<String>::new();
+
+  for pattern in patterns {
+    if pattern.starts_with('\\') && pattern.ends_with('\\') {
+      let regex = regex::Regex::new(&pattern[1..(pattern.len() - 1)])
+        .context("Regex matching string invalid")?;
+      for resource in &resources {
+        if regex.is_match(&resource.name) {
+          names.insert(resource.name.clone());
+        }
+      }
+    } else {
+      let wildcard = wildcard::Wildcard::new(pattern.as_bytes())
+        .context("Wildcard matching string invalid")?;
+      for resource in &resources {
+        if wildcard.is_match(resource.name.as_bytes()) {
+          names.insert(resource.name.clone());
+        }
+      }
+    };
+  }
+
+  Ok(
+    resources
+      .into_iter()
+      .filter(|resource| names.contains(resource.name.as_str()))
+      .collect(),
+  )
+}
+
 #[instrument(level = "debug")]
 pub async fn list_full_for_user<T: KomodoResource>(
  mut query: ResourceQuery<T::QuerySpecifics>,
@@ -831,6 +898,16 @@ pub async fn delete<T: KomodoResource>(
  }

  let target = resource_target::<T>(resource.id.clone());
+  let toml = State
+    .resolve(
+      ExportResourcesToToml {
+        targets: vec![target.clone()],
+        ..Default::default()
+      },
+      user.clone(),
+    )
+    .await?
+    .toml;

  let mut update =
    make_update(target.clone(), T::delete_operation(), user);
@@ -843,13 +920,14 @@ pub async fn delete<T: KomodoResource>(
  delete_one_by_id(T::coll(), &resource.id, None)
    .await
    .with_context(|| {
-      format!("failed to delete {} from database", T::resource_type())
+      format!("Failed to delete {} from database", T::resource_type())
    })?;

  update.push_simple_log(
-    &format!("delete {}", T::resource_type()),
-    format!("deleted {} {}", T::resource_type(), resource.name),
+    &format!("Delete {}", T::resource_type()),
+    format!("Deleted {} {}", T::resource_type(), resource.name),
  );
+  update.push_simple_log("Deleted Toml", toml);

  if let Err(e) = T::post_delete(&resource, &mut update).await {
    update.push_error_log("post delete", format_serror(&e.into()));
--- a/bin/core/src/resource/procedure.rs
+++ b/bin/core/src/resource/procedure.rs
@@ -178,6 +178,13 @@ async fn validate_config(
          }
          params.procedure = procedure.id;
        }
+        Execution::BatchRunProcedure(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::RunAction(params) => {
          let action = super::get_check_permissions::<Action>(
            &params.action,
@@ -187,6 +194,13 @@ async fn validate_config(
          .await?;
          params.action = action.id;
        }
+        Execution::BatchRunAction(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::RunBuild(params) => {
          let build = super::get_check_permissions::<Build>(
            &params.build,
@@ -196,6 +210,13 @@ async fn validate_config(
          .await?;
          params.build = build.id;
        }
+        Execution::BatchRunBuild(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::CancelBuild(params) => {
          let build = super::get_check_permissions::<Build>(
            &params.build,
@@ -215,6 +236,13 @@ async fn validate_config(
            .await?;
          params.deployment = deployment.id;
        }
+        Execution::BatchDeploy(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::StartDeployment(params) => {
          let deployment =
            super::get_check_permissions::<Deployment>(
@@ -275,6 +303,13 @@ async fn validate_config(
            .await?;
          params.deployment = deployment.id;
        }
+        Execution::BatchDestroyDeployment(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::CloneRepo(params) => {
          let repo = super::get_check_permissions::<Repo>(
            &params.repo,
@@ -284,6 +319,13 @@ async fn validate_config(
          .await?;
          params.repo = repo.id;
        }
+        Execution::BatchCloneRepo(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::PullRepo(params) => {
          let repo = super::get_check_permissions::<Repo>(
            &params.repo,
@@ -293,6 +335,13 @@ async fn validate_config(
          .await?;
          params.repo = repo.id;
        }
+        Execution::BatchPullRepo(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::BuildRepo(params) => {
          let repo = super::get_check_permissions::<Repo>(
            &params.repo,
@@ -302,6 +351,13 @@ async fn validate_config(
          .await?;
          params.repo = repo.id;
        }
+        Execution::BatchBuildRepo(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::CancelRepoBuild(params) => {
          let repo = super::get_check_permissions::<Repo>(
            &params.repo,
@@ -528,6 +584,13 @@ async fn validate_config(
          .await?;
          params.stack = stack.id;
        }
+        Execution::BatchDeployStack(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::DeployStackIfChanged(params) => {
          let stack = super::get_check_permissions::<Stack>(
            &params.stack,
@@ -537,6 +600,13 @@ async fn validate_config(
          .await?;
          params.stack = stack.id;
        }
+        Execution::BatchDeployStackIfChanged(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::StartStack(params) => {
          let stack = super::get_check_permissions::<Stack>(
            &params.stack,
@@ -591,6 +661,13 @@ async fn validate_config(
          .await?;
          params.stack = stack.id;
        }
+        Execution::BatchDestroyStack(_params) => {
+          if !user.admin {
+            return Err(anyhow!(
+              "Non admin user cannot configure Batch executions"
+            ));
+          }
+        }
        Execution::Sleep(_) => {}
      }
    }
--- a/bin/core/src/resource/server.rs
+++ b/bin/core/src/resource/server.rs
@@ -47,6 +47,7 @@ impl super::KomodoResource for Server {
      info: ServerListItemInfo {
        state: status.map(|s| s.state).unwrap_or_default(),
        region: server.config.region,
+        address: server.config.address,
        send_unreachable_alerts: server
          .config
          .send_unreachable_alerts,
--- a/bin/core/src/stack/services.rs
+++ b/bin/core/src/stack/services.rs
@@ -1,6 +1,9 @@
 use anyhow::Context;
 use komodo_client::entities::{
-  stack::{ComposeFile, ComposeService, Stack, StackServiceNames},
+  stack::{
+    ComposeFile, ComposeService, ComposeServiceDeploy, Stack,
+    StackServiceNames,
+  },
  FileContents,
 };

@@ -69,16 +72,40 @@ pub fn extract_services_into_res(
  let compose = serde_yaml::from_str::<ComposeFile>(compose_contents)
    .context("failed to parse service names from compose contents")?;

-  let services = compose.services.into_iter().map(
-    |(service_name, ComposeService { container_name, .. })| {
-      StackServiceNames {
-        container_name: container_name.unwrap_or_else(|| {
-          format!("{project_name}-{service_name}")
-        }),
-        service_name,
-      }
+  let mut services = Vec::with_capacity(compose.services.capacity());
+
+  for (
+    service_name,
+    ComposeService {
+      container_name,
+      deploy,
+      ..
    },
-  );
+  ) in compose.services
+  {
+    match deploy {
+      Some(ComposeServiceDeploy {
+        replicas: Some(replicas),
+      }) if replicas > 1 => {
+        for i in 1..1 + replicas {
+          services.push(StackServiceNames {
+            container_name: format!(
+              "{project_name}-{service_name}-{i}"
+            ),
+            service_name: format!("{service_name}-{i}"),
+          });
+        }
+      }
+      _ => {
+        services.push(StackServiceNames {
+          container_name: container_name.unwrap_or_else(|| {
+            format!("{project_name}-{service_name}")
+          }),
+          service_name,
+        });
+      }
+    }
+  }

  res.extend(services);

--- a/bin/core/src/sync/mod.rs
+++ b/bin/core/src/sync/mod.rs
@@ -182,11 +182,10 @@ impl AllResourcesById {
          id_to_tags, match_tags,
        )
        .await?,
-      actions:
-        crate::resource::get_id_to_resource_map::<Action>(
-          id_to_tags, match_tags,
-        )
-        .await?,
+      actions: crate::resource::get_id_to_resource_map::<Action>(
+        id_to_tags, match_tags,
+      )
+      .await?,
      builders: crate::resource::get_id_to_resource_map::<Builder>(
        id_to_tags, match_tags,
      )
--- a/bin/core/src/sync/resources.rs
+++ b/bin/core/src/sync/resources.rs
@@ -360,6 +360,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|p| p.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchRunProcedure(_config) => {}
          Execution::RunAction(config) => {
            config.action = resources
              .actions
@@ -367,6 +368,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|p| p.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchRunAction(_config) => {}
          Execution::RunBuild(config) => {
            config.build = resources
              .builds
@@ -374,6 +376,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|b| b.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchRunBuild(_config) => {}
          Execution::CancelBuild(config) => {
            config.build = resources
              .builds
@@ -388,6 +391,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|d| d.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchDeploy(_config) => {}
          Execution::StartDeployment(config) => {
            config.deployment = resources
              .deployments
@@ -430,6 +434,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|d| d.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchDestroyDeployment(_config) => {}
          Execution::CloneRepo(config) => {
            config.repo = resources
              .repos
@@ -437,6 +442,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|d| d.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchCloneRepo(_config) => {}
          Execution::PullRepo(config) => {
            config.repo = resources
              .repos
@@ -444,6 +450,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|d| d.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchPullRepo(_config) => {}
          Execution::BuildRepo(config) => {
            config.repo = resources
              .repos
@@ -451,6 +458,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|d| d.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchBuildRepo(_config) => {}
          Execution::CancelRepoBuild(config) => {
            config.repo = resources
              .repos
@@ -626,6 +634,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|s| s.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchDeployStack(_config) => {}
          Execution::DeployStackIfChanged(config) => {
            config.stack = resources
              .stacks
@@ -633,6 +642,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|s| s.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchDeployStackIfChanged(_config) => {}
          Execution::StartStack(config) => {
            config.stack = resources
              .stacks
@@ -675,6 +685,7 @@ impl ResourceSyncTrait for Procedure {
              .map(|s| s.name.clone())
              .unwrap_or_default();
          }
+          Execution::BatchDestroyStack(_config) => {}
          Execution::Sleep(_) => {}
        }
      }
--- a/bin/core/src/sync/toml.rs
+++ b/bin/core/src/sync/toml.rs
@@ -390,6 +390,7 @@ impl ToToml for Builder {
    let empty_params = match resource.config {
      PartialBuilderConfig::Aws(config) => config.is_none(),
      PartialBuilderConfig::Server(config) => config.is_none(),
+      PartialBuilderConfig::Url(config) => config.is_none(),
    };
    if empty_params {
      // toml_pretty will remove empty map
@@ -414,6 +415,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchRunProcedure(_exec) => {}
          Execution::RunAction(exec) => exec.action.clone_from(
            all
              .actions
@@ -421,6 +423,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchRunAction(_exec) => {}
          Execution::RunBuild(exec) => exec.build.clone_from(
            all
              .builds
@@ -428,6 +431,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchRunBuild(_exec) => {}
          Execution::CancelBuild(exec) => exec.build.clone_from(
            all
              .builds
@@ -442,6 +446,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchDeploy(_exec) => {}
          Execution::StartDeployment(exec) => {
            exec.deployment.clone_from(
              all
@@ -496,6 +501,7 @@ impl ToToml for Procedure {
                .unwrap_or(&String::new()),
            )
          }
+          Execution::BatchDestroyDeployment(_exec) => {}
          Execution::CloneRepo(exec) => exec.repo.clone_from(
            all
              .repos
@@ -503,6 +509,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchCloneRepo(_exec) => {}
          Execution::PullRepo(exec) => exec.repo.clone_from(
            all
              .repos
@@ -510,6 +517,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchPullRepo(_exec) => {}
          Execution::BuildRepo(exec) => exec.repo.clone_from(
            all
              .repos
@@ -517,6 +525,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchBuildRepo(_exec) => {}
          Execution::CancelRepoBuild(exec) => exec.repo.clone_from(
            all
              .repos
@@ -710,6 +719,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchDeployStack(_exec) => {}
          Execution::DeployStackIfChanged(exec) => {
            exec.stack.clone_from(
              all
@@ -719,6 +729,7 @@ impl ToToml for Procedure {
                .unwrap_or(&String::new()),
            )
          }
+          Execution::BatchDeployStackIfChanged(_exec) => {}
          Execution::StartStack(exec) => exec.stack.clone_from(
            all
              .stacks
@@ -761,6 +772,7 @@ impl ToToml for Procedure {
              .map(|r| &r.name)
              .unwrap_or(&String::new()),
          ),
+          Execution::BatchDestroyStack(_exec) => {}
          Execution::Sleep(_) | Execution::None(_) => {}
        }
      }
--- a/bin/periphery/src/api/build.rs
+++ b/bin/periphery/src/api/build.rs
@@ -1,12 +1,15 @@
 use anyhow::{anyhow, Context};
 use command::run_komodo_command;
 use formatting::format_serror;
-use komodo_client::entities::{
-  build::{Build, BuildConfig},
-  environment_vars_from_str, get_image_name, optional_string,
-  to_komodo_name,
-  update::Log,
-  EnvironmentVar, Version,
+use komodo_client::{
+  entities::{
+    build::{Build, BuildConfig},
+    environment_vars_from_str, get_image_name, optional_string,
+    to_komodo_name,
+    update::Log,
+    EnvironmentVar, Version,
+  },
+  parsers::QUOTE_PATTERN,
 };
 use periphery_client::api::build::{
  self, PruneBuilders, PruneBuildx,
@@ -101,8 +104,9 @@ impl Resolve<build::Build> for State {

    let secret_args = environment_vars_from_str(secret_args)
      .context("Invalid secret_args")?;
-    let _secret_args =
+    let command_secret_args =
      parse_secret_args(&secret_args, *skip_secret_interp)?;
+
    let labels = parse_labels(
      &environment_vars_from_str(labels).context("Invalid labels")?,
    );
@@ -118,7 +122,7 @@ impl Resolve<build::Build> for State {

    // Construct command
    let command = format!(
-      "docker{buildx} build{build_args}{_secret_args}{extra_args}{labels}{image_tags} -f {dockerfile_path} .{push_command}",
+      "docker{buildx} build{build_args}{command_secret_args}{extra_args}{labels}{image_tags} -f {dockerfile_path} .{push_command}",
    );

    if *skip_secret_interp {
@@ -190,7 +194,16 @@ fn image_tags(
 fn parse_build_args(build_args: &[EnvironmentVar]) -> String {
  build_args
    .iter()
-    .map(|p| format!(" --build-arg {}=\"{}\"", p.variable, p.value))
+    .map(|p| {
+      if p.value.starts_with(QUOTE_PATTERN)
+        && p.value.ends_with(QUOTE_PATTERN)
+      {
+        // If the value already wrapped in quotes, don't wrap it again
+        format!(" --build-arg {}={}", p.variable, p.value)
+      } else {
+        format!(" --build-arg {}=\"{}\"", p.variable, p.value)
+      }
+    })
    .collect::<Vec<_>>()
    .join("")
 }
--- a/bin/periphery/src/api/deploy.rs
+++ b/bin/periphery/src/api/deploy.rs
@@ -1,14 +1,17 @@
 use anyhow::Context;
 use command::run_komodo_command;
 use formatting::format_serror;
-use komodo_client::entities::{
-  deployment::{
-    conversions_from_str, extract_registry_domain, Conversion,
-    Deployment, DeploymentConfig, DeploymentImage, RestartMode,
+use komodo_client::{
+  entities::{
+    deployment::{
+      conversions_from_str, extract_registry_domain, Conversion,
+      Deployment, DeploymentConfig, DeploymentImage, RestartMode,
+    },
+    environment_vars_from_str, to_komodo_name,
+    update::Log,
+    EnvironmentVar,
  },
-  environment_vars_from_str, to_komodo_name,
-  update::Log,
-  EnvironmentVar,
+  parsers::QUOTE_PATTERN,
 };
 use periphery_client::api::container::{Deploy, RemoveContainer};
 use resolver_api::Resolve;
@@ -175,7 +178,16 @@ fn parse_conversions(
 fn parse_environment(environment: &[EnvironmentVar]) -> String {
  environment
    .iter()
-    .map(|p| format!(" --env {}=\"{}\"", p.variable, p.value))
+    .map(|p| {
+      if p.value.starts_with(QUOTE_PATTERN)
+        && p.value.ends_with(QUOTE_PATTERN)
+      {
+        // If the value already wrapped in quotes, don't wrap it again
+        format!(" --env {}={}", p.variable, p.value)
+      } else {
+        format!(" --env {}=\"{}\"", p.variable, p.value)
+      }
+    })
    .collect::<Vec<_>>()
    .join("")
 }
--- a/bin/periphery/src/api/git.rs
+++ b/bin/periphery/src/api/git.rs
@@ -222,7 +222,7 @@ impl Resolve<RenameRepo> for State {
    )
    .await;
    let msg = match renamed {
-      Ok(_) => format!("Renamed Repo directory on Server"),
+      Ok(_) => String::from("Renamed Repo directory on Server"),
      Err(_) => format!("No Repo cloned at {curr_name} to rename"),
    };
    Ok(Log::simple("Rename Repo on Server", msg))
--- a/bin/periphery/src/compose.rs
+++ b/bin/periphery/src/compose.rs
@@ -1,4 +1,4 @@
-use std::path::PathBuf;
+use std::{fmt::Write, path::PathBuf};

 use anyhow::{anyhow, Context};
 use command::run_komodo_command;
@@ -145,8 +145,10 @@ pub async fn compose_up(
    .config
    .additional_env_files
    .iter()
-    .map(|file| format!(" --env-file {file}"))
-    .collect::<String>();
+    .fold(String::new(), |mut output, file| {
+      let _ = write!(output, " --env-file {file}");
+      output
+    });

  // Build images before destroying to minimize downtime.
  // If this fails, do not continue.
--- a/bin/periphery/src/docker.rs
+++ b/bin/periphery/src/docker.rs
@@ -1,4 +1,4 @@
-use std::sync::OnceLock;
+use std::{collections::HashMap, sync::OnceLock};

 use anyhow::{anyhow, Context};
 use bollard::{
@@ -40,7 +40,7 @@ impl DockerClient {
  pub async fn list_containers(
    &self,
  ) -> anyhow::Result<Vec<ContainerListItem>> {
-    self
+    let mut containers = self
      .docker
      .list_containers(Some(ListContainersOptions::<String> {
        all: true,
@@ -48,8 +48,8 @@ impl DockerClient {
      }))
      .await?
      .into_iter()
-      .map(|container| {
-        Ok(ContainerListItem {
+      .flat_map(|container| {
+        anyhow::Ok(ContainerListItem {
          server_id: None,
          name: container
            .names
@@ -75,9 +75,12 @@ impl DockerClient {
          networks: container
            .network_settings
            .and_then(|settings| {
-              settings
-                .networks
-                .map(|networks| networks.into_keys().collect())
+              settings.networks.map(|networks| {
+                let mut keys =
+                  networks.into_keys().collect::<Vec<_>>();
+                keys.sort();
+                keys
+              })
            })
            .unwrap_or_default(),
          volumes: container
@@ -92,7 +95,26 @@ impl DockerClient {
          labels: container.labels.unwrap_or_default(),
        })
      })
-      .collect()
+      .collect::<Vec<_>>();
+    let container_id_to_network = containers
+      .iter()
+      .filter_map(|c| Some((c.id.clone()?, c.network_mode.clone()?)))
+      .collect::<HashMap<_, _>>();
+    // Fix containers which use `container:container_id` network_mode,
+    // by replacing with the referenced network mode.
+    containers.iter_mut().for_each(|container| {
+      let Some(network_name) = &container.network_mode else {
+        return;
+      };
+      let Some(container_id) =
+        network_name.strip_prefix("container:")
+      else {
+        return;
+      };
+      container.network_mode =
+        container_id_to_network.get(container_id).cloned();
+    });
+    Ok(containers)
  }

  pub async fn inspect_container(
@@ -519,7 +541,7 @@ impl DockerClient {
    &self,
    containers: &[ContainerListItem],
  ) -> anyhow::Result<Vec<NetworkListItem>> {
-    self
+    let networks = self
      .docker
      .list_networks::<String>(None)
      .await?
@@ -545,7 +567,7 @@ impl DockerClient {
          }),
          None => false,
        };
-        Ok(NetworkListItem {
+        NetworkListItem {
          name: network.name,
          id: network.id,
          created: network.created,
@@ -559,9 +581,10 @@ impl DockerClient {
          attachable: network.attachable,
          ingress: network.ingress,
          in_use,
-        })
+        }
      })
-      .collect()
+      .collect();
+    Ok(networks)
  }

  pub async fn inspect_network(
@@ -628,7 +651,7 @@ impl DockerClient {
    &self,
    containers: &[ContainerListItem],
  ) -> anyhow::Result<Vec<ImageListItem>> {
-    self
+    let images = self
      .docker
      .list_images::<String>(None)
      .await?
@@ -641,7 +664,7 @@ impl DockerClient {
            .map(|id| id == &image.id)
            .unwrap_or_default()
        });
-        Ok(ImageListItem {
+        ImageListItem {
          name: image
            .repo_tags
            .into_iter()
@@ -652,9 +675,10 @@ impl DockerClient {
          created: image.created,
          size: image.size,
          in_use,
-        })
+        }
      })
-      .collect()
+      .collect();
+    Ok(images)
  }

  pub async fn inspect_image(
@@ -761,7 +785,7 @@ impl DockerClient {
    &self,
    containers: &[ContainerListItem],
  ) -> anyhow::Result<Vec<VolumeListItem>> {
-    self
+    let volumes = self
      .docker
      .list_volumes::<String>(None)
      .await?
@@ -786,7 +810,7 @@ impl DockerClient {
        let in_use = containers.iter().any(|container| {
          container.volumes.iter().any(|name| &volume.name == name)
        });
-        Ok(VolumeListItem {
+        VolumeListItem {
          name: volume.name,
          driver: volume.driver,
          mountpoint: volume.mountpoint,
@@ -794,9 +818,10 @@ impl DockerClient {
          size: volume.usage_data.map(|data| data.size),
          scope,
          in_use,
-        })
+        }
      })
-      .collect()
+      .collect();
+    Ok(volumes)
  }

  pub async fn inspect_volume(
--- a/bin/periphery/src/helpers.rs
+++ b/bin/periphery/src/helpers.rs
@@ -1,5 +1,8 @@
 use anyhow::Context;
-use komodo_client::entities::{EnvironmentVar, SearchCombinator};
+use komodo_client::{
+  entities::{EnvironmentVar, SearchCombinator},
+  parsers::QUOTE_PATTERN,
+};

 use crate::config::periphery_config;

@@ -43,7 +46,16 @@ pub fn parse_extra_args(extra_args: &[String]) -> String {
 pub fn parse_labels(labels: &[EnvironmentVar]) -> String {
  labels
    .iter()
-    .map(|p| format!(" --label {}=\"{}\"", p.variable, p.value))
+    .map(|p| {
+      if p.value.starts_with(QUOTE_PATTERN)
+        && p.value.ends_with(QUOTE_PATTERN)
+      {
+        // If the value already wrapped in quotes, don't wrap it again
+        format!(" --label {}={}", p.variable, p.value)
+      } else {
+        format!(" --label {}=\"{}\"", p.variable, p.value)
+      }
+    })
    .collect::<Vec<_>>()
    .join("")
 }
--- a/bin/periphery/src/router.rs
+++ b/bin/periphery/src/router.rs
@@ -46,7 +46,7 @@ async fn task(
  request: crate::api::PeripheryRequest,
 ) -> anyhow::Result<String> {
  let variant = request.extract_variant();
-  
+
  let res =
    State
      .resolve_request(request, ())
--- a/client/core/rs/Cargo.toml
+++ b/client/core/rs/Cargo.toml
@@ -11,7 +11,9 @@ repository.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [features]
+# default = ["blocking"] # use to dev client blocking mode
 mongo = ["dep:mongo_indexed"]
+blocking = ["reqwest/blocking"]

 [dependencies]
 # mogh
--- a/client/core/rs/README.md
+++ b/client/core/rs/README.md
@@ -1,4 +1,35 @@
 # Komodo
 *A system to build and deploy software across many servers*

-Docs: [https://docs.rs/komodo_client/latest/komodo_client](https://docs.rs/komodo_client/latest/komodo_client)
+Full Docs: [https://docs.rs/komodo_client/latest/komodo_client](https://docs.rs/komodo_client/latest/komodo_client).
+
+This is a client library for the Komodo Core API.
+It contains:
+- Definitions for the application [api](https://docs.rs/komodo_client/latest/komodo_client/api/index.html)
+	and [entities](https://docs.rs/komodo_client/latest/komodo_client/entities/index.html).
+- A [client](https://docs.rs/komodo_client/latest/komodo_client/struct.KomodoClient.html)
+	to interact with the Komodo Core API.
+- Information on configuring Komodo
+	[Core](https://docs.rs/komodo_client/latest/komodo_client/entities/config/core/index.html) and
+	[Periphery](https://docs.rs/komodo_client/latest/komodo_client/entities/config/periphery/index.html).
+
+## Client Configuration
+
+The client includes a convenenience method to parse the Komodo API url and credentials from the environment:
+- `KOMODO_ADDRESS`
+- `KOMODO_API_KEY`
+- `KOMODO_API_SECRET`
+
+## Client Example
+```rust
+dotenvy::dotenv().ok();
+
+let client = KomodoClient::new_from_env()?;
+
+// Get all the deployments
+let deployments = client.read(ListDeployments::default()).await?;
+
+println!("{deployments:#?}");
+
+let update = client.execute(RunBuild { build: "test-build".to_string() }).await?:
+```
--- a/client/core/rs/src/api/execute/action.rs
+++ b/client/core/rs/src/api/execute/action.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::update::Update;

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 /// Runs the target Action. Response: [Update]
 #[typeshare]
@@ -26,3 +26,31 @@ pub struct RunAction {
  /// Id or name
  pub action: String,
 }
+
+/// Runs multiple Actions in parallel that match pattern. Response: [BatchExecutionResult]
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchRunAction {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* actions
+  /// foo-*
+  /// # add some more
+  /// extra-action-1, extra-action-2
+  /// ```
+  pub pattern: String,
+}
--- a/client/core/rs/src/api/execute/build.rs
+++ b/client/core/rs/src/api/execute/build.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::update::Update;

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 //

@@ -36,6 +36,36 @@ pub struct RunBuild {

 //

+/// Runs multiple builds in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchRunBuild {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* builds
+  /// foo-*
+  /// # add some more
+  /// extra-build-1, extra-build-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Cancels the target build.
 /// Only does anything if the build is `building` when called.
 /// Response: [Update]
--- a/client/core/rs/src/api/execute/deployment.rs
+++ b/client/core/rs/src/api/execute/deployment.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::{update::Update, TerminationSignal};

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 /// Deploys the container for the target deployment. Response: [Update].
 ///
@@ -41,6 +41,36 @@ pub struct Deploy {

 //

+/// Deploys multiple Deployments in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Serialize,
+  Deserialize,
+  Debug,
+  Clone,
+  PartialEq,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchDeploy {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* deployments
+  /// foo-*
+  /// # add some more
+  /// extra-deployment-1, extra-deployment-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Starts the container for the target deployment. Response: [Update]
 ///
 /// 1. Runs `docker start ${container_name}`.
@@ -187,3 +217,33 @@ pub struct DestroyDeployment {
  /// Override the default termination max time.
  pub time: Option<i32>,
 }
+
+//
+
+/// Destroys multiple Deployments in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Serialize,
+  Deserialize,
+  Debug,
+  Clone,
+  PartialEq,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchDestroyDeployment {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* deployments
+  /// foo-*
+  /// # add some more
+  /// extra-deployment-1, extra-deployment-2
+  /// ```
+  pub pattern: String,
+}
--- a/client/core/rs/src/api/execute/mod.rs
+++ b/client/core/rs/src/api/execute/mod.rs
@@ -27,7 +27,7 @@ pub use sync::*;

 use crate::{
  api::write::CommitSync,
-  entities::{NoData, I64},
+  entities::{update::Update, NoData, _Serror, I64},
 };

 pub trait KomodoExecuteRequest: HasResponse {}
@@ -59,27 +59,35 @@ pub enum Execution {

  // ACTION
  RunAction(RunAction),
+  BatchRunAction(BatchRunAction),

  // PROCEDURE
  RunProcedure(RunProcedure),
+  BatchRunProcedure(BatchRunProcedure),

  // BUILD
  RunBuild(RunBuild),
+  BatchRunBuild(BatchRunBuild),
  CancelBuild(CancelBuild),

  // DEPLOYMENT
  Deploy(Deploy),
+  BatchDeploy(BatchDeploy),
  StartDeployment(StartDeployment),
  RestartDeployment(RestartDeployment),
  PauseDeployment(PauseDeployment),
  UnpauseDeployment(UnpauseDeployment),
  StopDeployment(StopDeployment),
  DestroyDeployment(DestroyDeployment),
+  BatchDestroyDeployment(BatchDestroyDeployment),

  // REPO
  CloneRepo(CloneRepo),
+  BatchCloneRepo(BatchCloneRepo),
  PullRepo(PullRepo),
+  BatchPullRepo(BatchPullRepo),
  BuildRepo(BuildRepo),
+  BatchBuildRepo(BatchBuildRepo),
  CancelRepoBuild(CancelRepoBuild),

  // SERVER (Container)
@@ -113,13 +121,16 @@ pub enum Execution {

  // STACK
  DeployStack(DeployStack),
+  BatchDeployStack(BatchDeployStack),
  DeployStackIfChanged(DeployStackIfChanged),
+  BatchDeployStackIfChanged(BatchDeployStackIfChanged),
  StartStack(StartStack),
  RestartStack(RestartStack),
  PauseStack(PauseStack),
  UnpauseStack(UnpauseStack),
  StopStack(StopStack),
  DestroyStack(DestroyStack),
+  BatchDestroyStack(BatchDestroyStack),

  // SLEEP
  Sleep(Sleep),
@@ -131,3 +142,34 @@ pub struct Sleep {
  #[serde(default)]
  pub duration_ms: I64,
 }
+
+#[typeshare]
+pub type BatchExecutionResponse = Vec<BatchExecutionResponseItem>;
+
+#[typeshare]
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "status", content = "data")]
+pub enum BatchExecutionResponseItem {
+  Ok(Update),
+  Err(BatchExecutionResponseItemErr),
+}
+
+impl From<Result<Update, BatchExecutionResponseItemErr>>
+  for BatchExecutionResponseItem
+{
+  fn from(
+    value: Result<Update, BatchExecutionResponseItemErr>,
+  ) -> Self {
+    match value {
+      Ok(update) => Self::Ok(update),
+      Err(e) => Self::Err(e),
+    }
+  }
+}
+
+#[typeshare]
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BatchExecutionResponseItemErr {
+  pub name: String,
+  pub error: _Serror,
+}
--- a/client/core/rs/src/api/execute/procedure.rs
+++ b/client/core/rs/src/api/execute/procedure.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::update::Update;

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 /// Runs the target Procedure. Response: [Update]
 #[typeshare]
@@ -26,3 +26,31 @@ pub struct RunProcedure {
  /// Id or name
  pub procedure: String,
 }
+
+/// Runs multiple Procedures in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchRunProcedure {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* procedures
+  /// foo-*
+  /// # add some more
+  /// extra-procedure-1, extra-procedure-2
+  /// ```
+  pub pattern: String,
+}
--- a/client/core/rs/src/api/execute/repo.rs
+++ b/client/core/rs/src/api/execute/repo.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::update::Update;

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 //

@@ -39,6 +39,36 @@ pub struct CloneRepo {

 //

+/// Clones multiple Repos in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchCloneRepo {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* repos
+  /// foo-*
+  /// # add some more
+  /// extra-repo-1, extra-repo-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Pulls the target repo. Response: [Update].
 ///
 /// Note. Repo must have server attached at `server_id`.
@@ -65,6 +95,36 @@ pub struct PullRepo {

 //

+/// Pulls multiple Repos in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchPullRepo {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* repos
+  /// foo-*
+  /// # add some more
+  /// extra-repo-1, extra-repo-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Builds the target repo, using the attached builder. Response: [Update].
 ///
 /// Note. Repo must have builder attached at `builder_id`.
@@ -95,6 +155,36 @@ pub struct BuildRepo {

 //

+/// Builds multiple Repos in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Debug,
+  Clone,
+  PartialEq,
+  Serialize,
+  Deserialize,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchBuildRepo {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* repos
+  /// foo-*
+  /// # add some more
+  /// extra-repo-1, extra-repo-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Cancels the target repo build.
 /// Only does anything if the repo build is `building` when called.
 /// Response: [Update]
--- a/client/core/rs/src/api/execute/stack.rs
+++ b/client/core/rs/src/api/execute/stack.rs
@@ -6,7 +6,7 @@ use typeshare::typeshare;

 use crate::entities::update::Update;

-use super::KomodoExecuteRequest;
+use super::{BatchExecutionResponse, KomodoExecuteRequest};

 /// Deploys the target stack. `docker compose up`. Response: [Update]
 #[typeshare]
@@ -30,6 +30,38 @@ pub struct DeployStack {
  pub stop_time: Option<i32>,
 }

+//
+
+/// Deploys multiple Stacks in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Serialize,
+  Deserialize,
+  Debug,
+  Clone,
+  PartialEq,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchDeployStack {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* stacks
+  /// foo-*
+  /// # add some more
+  /// extra-stack-1, extra-stack-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Checks deployed contents vs latest contents,
 /// and only if any changes found
 /// will `docker compose up`. Response: [Update]
@@ -56,6 +88,36 @@ pub struct DeployStackIfChanged {

 //

+/// Deploys multiple Stacks if changed in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Serialize,
+  Deserialize,
+  Debug,
+  Clone,
+  PartialEq,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchDeployStackIfChanged {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///
+  /// Example:
+  /// ```
+  /// # match all foo-* stacks
+  /// foo-*
+  /// # add some more
+  /// extra-stack-1, extra-stack-2
+  /// ```
+  pub pattern: String,
+}
+
+//
+
 /// Starts the target stack. `docker compose start`. Response: [Update]
 #[typeshare]
 #[derive(
@@ -198,3 +260,33 @@ pub struct DestroyStack {
  /// Override the default termination max time.
  pub stop_time: Option<i32>,
 }
+
+//
+
+/// Destroys multiple Stacks in parallel that match pattern. Response: [BatchExecutionResult].
+#[typeshare]
+#[derive(
+  Serialize,
+  Deserialize,
+  Debug,
+  Clone,
+  PartialEq,
+  Request,
+  EmptyTraits,
+  Parser,
+)]
+#[empty_traits(KomodoExecuteRequest)]
+#[response(BatchExecutionResponse)]
+pub struct BatchDestroyStack {
+  /// Id or name or wildcard pattern or regex.
+  /// Supports multiline and comma delineated combinations of the above.
+  ///d
+  /// Example:
+  /// ```
+  /// # match all foo-* stacks
+  /// foo-*
+  /// # add some more
+  /// extra-stack-1, extra-stack-2
+  /// ```
+  pub pattern: String,
+}
--- a/client/core/rs/src/api/mod.rs
+++ b/client/core/rs/src/api/mod.rs
@@ -12,7 +12,7 @@
 //!   - X-Api-Secret: `your_api_secret`
 //!   - Use either Authorization *or* X-Api-Key and X-Api-Secret to authenticate requests.
 //! - Body: JSON specifying the request type (`type`) and the parameters (`params`).
-//! 
+//!
 //! You can create API keys for your user, or for a Service User with limited permissions,
 //! from the Komodo UI Settings page.
 //!
@@ -31,17 +31,17 @@
 //!
 //! The request's parent module (eg. [read], [mod@write]) determines the http path which
 //! must be used for the requests. For example, requests under [read] are made using http path `/read`.
-//! 
+//!
 //! ## Curl Example
-//! 
+//!
 //! Putting it all together, here is an example `curl` for [write::UpdateBuild], to update the version:
-//! 
+//!
 //! ```text
 //! curl --header "Content-Type: application/json" \
-//! 	  --header "X-Api-Key: your_api_key" \
-//! 	  --header "X-Api-Secret: your_api_secret" \
-//! 	  --data '{ "type": "UpdateBuild", "params": { "id": "67076689ed600cfdd52ac637", "config": { "version": "1.15.9" } } }' \
-//! 	  https://komodo.example.com/write
+//!     --header "X-Api-Key: your_api_key" \
+//!     --header "X-Api-Secret: your_api_secret" \
+//!     --data '{ "type": "UpdateBuild", "params": { "id": "67076689ed600cfdd52ac637", "config": { "version": "1.15.9" } } }' \
+//!     https://komodo.example.com/write
 //! ```
 //!
 //! ## Modules
--- a/client/core/rs/src/api/write/builder.rs
+++ b/client/core/rs/src/api/write/builder.rs
@@ -3,7 +3,10 @@ use resolver_api::derive::Request;
 use serde::{Deserialize, Serialize};
 use typeshare::typeshare;

-use crate::entities::{builder::{Builder, PartialBuilderConfig}, update::Update};
+use crate::entities::{
+  builder::{Builder, PartialBuilderConfig},
+  update::Update,
+};

 use super::KomodoWriteRequest;

@@ -94,4 +97,4 @@ pub struct RenameBuilder {
  pub id: String,
  /// The new name.
  pub name: String,
-}
+}
--- a/client/core/rs/src/api/write/procedure.rs
+++ b/client/core/rs/src/api/write/procedure.rs
@@ -3,9 +3,10 @@ use resolver_api::derive::Request;
 use serde::{Deserialize, Serialize};
 use typeshare::typeshare;

-use crate::entities::{procedure::{
-  Procedure, _PartialProcedureConfig,
-}, update::Update};
+use crate::entities::{
+  procedure::{Procedure, _PartialProcedureConfig},
+  update::Update,
+};

 use super::KomodoWriteRequest;

@@ -108,4 +109,4 @@ pub struct RenameProcedure {
  pub id: String,
  /// The new name.
  pub name: String,
-}
+}
--- a/client/core/rs/src/api/write/repo.rs
+++ b/client/core/rs/src/api/write/repo.rs
@@ -4,7 +4,9 @@ use serde::{Deserialize, Serialize};
 use typeshare::typeshare;

 use crate::entities::{
-  repo::{Repo, _PartialRepoConfig}, update::Update, NoData
+  repo::{Repo, _PartialRepoConfig},
+  update::Update,
+  NoData,
 };

 use super::KomodoWriteRequest;
--- a/client/core/rs/src/api/write/server_template.rs
+++ b/client/core/rs/src/api/write/server_template.rs
@@ -3,9 +3,10 @@ use resolver_api::derive::Request;
 use serde::{Deserialize, Serialize};
 use typeshare::typeshare;

-use crate::entities::{server_template::{
-  PartialServerTemplateConfig, ServerTemplate,
-}, update::Update};
+use crate::entities::{
+  server_template::{PartialServerTemplateConfig, ServerTemplate},
+  update::Update,
+};

 use super::KomodoWriteRequest;

@@ -96,4 +97,4 @@ pub struct RenameServerTemplate {
  pub id: String,
  /// The new name.
  pub name: String,
-}
+}
--- a/client/core/rs/src/api/write/user.rs
+++ b/client/core/rs/src/api/write/user.rs
@@ -46,7 +46,7 @@ pub type UpdateUserPasswordResponse = NoData;
 /// **Admin only**. Delete a user.
 /// Admins can delete any non-admin user.
 /// Only Super Admin can delete an admin.
-/// No users can delete a Super Admin user. 
+/// No users can delete a Super Admin user.
 /// User cannot delete themselves.
 /// Response: [NoData].
 #[typeshare]
--- a/client/core/rs/src/deserializers/maybe_string_i64.rs
+++ b/client/core/rs/src/deserializers/maybe_string_i64.rs
@@ -0,0 +1,213 @@
+use serde::{de::Visitor, Deserializer};
+
+pub fn maybe_string_i64_deserializer<'de, D>(
+  deserializer: D,
+) -> Result<i64, D::Error>
+where
+  D: Deserializer<'de>,
+{
+  deserializer.deserialize_any(MaybeStringI64Visitor)
+}
+
+pub fn option_maybe_string_i64_deserializer<'de, D>(
+  deserializer: D,
+) -> Result<Option<i64>, D::Error>
+where
+  D: Deserializer<'de>,
+{
+  deserializer.deserialize_any(OptionMaybeStringI64Visitor)
+}
+
+struct MaybeStringI64Visitor;
+
+impl<'de> Visitor<'de> for MaybeStringI64Visitor {
+  type Value = i64;
+
+  fn expecting(
+    &self,
+    formatter: &mut std::fmt::Formatter,
+  ) -> std::fmt::Result {
+    write!(formatter, "number or string number")
+  }
+
+  fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    v.parse::<i64>().map_err(E::custom)
+  }
+
+  fn visit_f32<E>(self, v: f32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_f64<E>(self, v: f64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_i8<E>(self, v: i8) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_i16<E>(self, v: i16) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_i32<E>(self, v: i32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_i64<E>(self, v: i64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v)
+  }
+
+  fn visit_u8<E>(self, v: u8) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_u16<E>(self, v: u16) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_u32<E>(self, v: u32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+
+  fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(v as i64)
+  }
+}
+
+struct OptionMaybeStringI64Visitor;
+
+impl<'de> Visitor<'de> for OptionMaybeStringI64Visitor {
+  type Value = Option<i64>;
+
+  fn expecting(
+    &self,
+    formatter: &mut std::fmt::Formatter,
+  ) -> std::fmt::Result {
+    write!(formatter, "null or number or string number")
+  }
+
+  fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    MaybeStringI64Visitor.visit_str(v).map(Some)
+  }
+
+  fn visit_f32<E>(self, v: f32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_f64<E>(self, v: f64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_i8<E>(self, v: i8) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_i16<E>(self, v: i16) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_i32<E>(self, v: i32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_i64<E>(self, v: i64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v))
+  }
+
+  fn visit_u8<E>(self, v: u8) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_u16<E>(self, v: u16) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_u32<E>(self, v: u32) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(Some(v as i64))
+  }
+
+  fn visit_none<E>(self) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(None)
+  }
+
+  fn visit_unit<E>(self) -> Result<Self::Value, E>
+  where
+    E: serde::de::Error,
+  {
+    Ok(None)
+  }
+}
--- a/client/core/rs/src/deserializers/mod.rs
+++ b/client/core/rs/src/deserializers/mod.rs
@@ -6,6 +6,7 @@ mod file_contents;
 mod labels;
 mod string_list;
 mod term_signal_labels;
+mod maybe_string_i64;

 pub use conversion::*;
 pub use environment::*;
@@ -13,3 +14,4 @@ pub use file_contents::*;
 pub use labels::*;
 pub use string_list::*;
 pub use term_signal_labels::*;
+pub use maybe_string_i64::*;
--- a/client/core/rs/src/entities/action.rs
+++ b/client/core/rs/src/entities/action.rs
@@ -70,6 +70,22 @@ pub struct ActionConfig {
  ))]
  #[builder(default)]
  pub file_contents: String,
+
+  /// Whether incoming webhooks actually trigger action.
+  #[serde(default = "default_webhook_enabled")]
+  #[builder(default = "default_webhook_enabled()")]
+  #[partial_default(default_webhook_enabled())]
+  pub webhook_enabled: bool,
+
+  /// Optionally provide an alternate webhook secret for this procedure.
+  /// If its an empty string, use the default secret from the config.
+  #[serde(default)]
+  #[builder(default)]
+  pub webhook_secret: String,
+}
+
+fn default_webhook_enabled() -> bool {
+  true
 }

 impl ActionConfig {
@@ -82,6 +98,8 @@ impl Default for ActionConfig {
  fn default() -> Self {
    Self {
      file_contents: Default::default(),
+      webhook_enabled: default_webhook_enabled(),
+      webhook_secret: Default::default(),
    }
  }
 }
--- a/client/core/rs/src/entities/builder.rs
+++ b/client/core/rs/src/entities/builder.rs
@@ -48,10 +48,13 @@ pub struct BuilderListItemInfo {
 #[serde(tag = "type", content = "params")]
 #[allow(clippy::large_enum_variant)]
 pub enum BuilderConfig {
-  /// Use a connected server an image builder.
+  /// Use a Periphery address as a Builder.
+  Url(UrlBuilderConfig),
+
+  /// Use a connected server as a Builder.
  Server(ServerBuilderConfig),

-  /// Use EC2 instances spawned on demand as an image builder.
+  /// Use EC2 instances spawned on demand as a Builder.
  Aws(AwsBuilderConfig),
 }

@@ -76,19 +79,21 @@ impl Default for BuilderConfig {
 #[serde(tag = "type", content = "params")]
 #[allow(clippy::large_enum_variant)]
 pub enum PartialBuilderConfig {
+  Url(#[serde(default)] _PartialUrlBuilderConfig),
  Server(#[serde(default)] _PartialServerBuilderConfig),
  Aws(#[serde(default)] _PartialAwsBuilderConfig),
 }

 impl Default for PartialBuilderConfig {
  fn default() -> Self {
-    Self::Aws(Default::default())
+    Self::Url(Default::default())
  }
 }

 impl MaybeNone for PartialBuilderConfig {
  fn is_none(&self) -> bool {
    match self {
+      PartialBuilderConfig::Url(config) => config.is_none(),
      PartialBuilderConfig::Server(config) => config.is_none(),
      PartialBuilderConfig::Aws(config) => config.is_none(),
    }
@@ -98,6 +103,7 @@ impl MaybeNone for PartialBuilderConfig {
 #[allow(clippy::large_enum_variant)]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum BuilderConfigDiff {
+  Url(UrlBuilderConfigDiff),
  Server(ServerBuilderConfigDiff),
  Aws(AwsBuilderConfigDiff),
 }
@@ -105,6 +111,9 @@ pub enum BuilderConfigDiff {
 impl From<BuilderConfigDiff> for PartialBuilderConfig {
  fn from(value: BuilderConfigDiff) -> Self {
    match value {
+      BuilderConfigDiff::Url(diff) => {
+        PartialBuilderConfig::Url(diff.into())
+      }
      BuilderConfigDiff::Server(diff) => {
        PartialBuilderConfig::Server(diff.into())
      }
@@ -120,6 +129,9 @@ impl Diff for BuilderConfigDiff {
    &self,
  ) -> impl Iterator<Item = partial_derive2::FieldDiff> {
    match self {
+      BuilderConfigDiff::Url(diff) => {
+        diff.iter_field_diffs().collect::<Vec<_>>().into_iter()
+      }
      BuilderConfigDiff::Server(diff) => {
        diff.iter_field_diffs().collect::<Vec<_>>().into_iter()
      }
@@ -138,10 +150,27 @@ impl PartialDiff<PartialBuilderConfig, BuilderConfigDiff>
    partial: PartialBuilderConfig,
  ) -> BuilderConfigDiff {
    match self {
+      BuilderConfig::Url(original) => match partial {
+        PartialBuilderConfig::Url(partial) => {
+          BuilderConfigDiff::Url(original.partial_diff(partial))
+        }
+        PartialBuilderConfig::Server(partial) => {
+          let default = ServerBuilderConfig::default();
+          BuilderConfigDiff::Server(default.partial_diff(partial))
+        }
+        PartialBuilderConfig::Aws(partial) => {
+          let default = AwsBuilderConfig::default();
+          BuilderConfigDiff::Aws(default.partial_diff(partial))
+        }
+      },
      BuilderConfig::Server(original) => match partial {
        PartialBuilderConfig::Server(partial) => {
          BuilderConfigDiff::Server(original.partial_diff(partial))
        }
+        PartialBuilderConfig::Url(partial) => {
+          let default = UrlBuilderConfig::default();
+          BuilderConfigDiff::Url(default.partial_diff(partial))
+        }
        PartialBuilderConfig::Aws(partial) => {
          let default = AwsBuilderConfig::default();
          BuilderConfigDiff::Aws(default.partial_diff(partial))
@@ -151,6 +180,10 @@ impl PartialDiff<PartialBuilderConfig, BuilderConfigDiff>
        PartialBuilderConfig::Aws(partial) => {
          BuilderConfigDiff::Aws(original.partial_diff(partial))
        }
+        PartialBuilderConfig::Url(partial) => {
+          let default = UrlBuilderConfig::default();
+          BuilderConfigDiff::Url(default.partial_diff(partial))
+        }
        PartialBuilderConfig::Server(partial) => {
          let default = ServerBuilderConfig::default();
          BuilderConfigDiff::Server(default.partial_diff(partial))
@@ -163,6 +196,7 @@ impl PartialDiff<PartialBuilderConfig, BuilderConfigDiff>
 impl MaybeNone for BuilderConfigDiff {
  fn is_none(&self) -> bool {
    match self {
+      BuilderConfigDiff::Url(config) => config.is_none(),
      BuilderConfigDiff::Server(config) => config.is_none(),
      BuilderConfigDiff::Aws(config) => config.is_none(),
    }
@@ -172,6 +206,9 @@ impl MaybeNone for BuilderConfigDiff {
 impl From<PartialBuilderConfig> for BuilderConfig {
  fn from(value: PartialBuilderConfig) -> BuilderConfig {
    match value {
+      PartialBuilderConfig::Url(server) => {
+        BuilderConfig::Url(server.into())
+      }
      PartialBuilderConfig::Server(server) => {
        BuilderConfig::Server(server.into())
      }
@@ -185,6 +222,9 @@ impl From<PartialBuilderConfig> for BuilderConfig {
 impl From<BuilderConfig> for PartialBuilderConfig {
  fn from(value: BuilderConfig) -> Self {
    match value {
+      BuilderConfig::Url(config) => {
+        PartialBuilderConfig::Url(config.into())
+      }
      BuilderConfig::Server(config) => {
        PartialBuilderConfig::Server(config.into())
      }
@@ -202,6 +242,16 @@ impl MergePartial for BuilderConfig {
    partial: PartialBuilderConfig,
  ) -> BuilderConfig {
    match partial {
+      PartialBuilderConfig::Url(partial) => match self {
+        BuilderConfig::Url(config) => {
+          let config = UrlBuilderConfig {
+            address: partial.address.unwrap_or(config.address),
+            passkey: partial.passkey.unwrap_or(config.passkey),
+          };
+          BuilderConfig::Url(config)
+        }
+        _ => BuilderConfig::Url(partial.into()),
+      },
      PartialBuilderConfig::Server(partial) => match self {
        BuilderConfig::Server(config) => {
          let config = ServerBuilderConfig {
@@ -252,6 +302,42 @@ impl MergePartial for BuilderConfig {
  }
 }

+#[typeshare(serialized_as = "Partial<UrlBuilderConfig>")]
+pub type _PartialUrlBuilderConfig = PartialUrlBuilderConfig;
+
+/// Configuration for a Komodo Url Builder.
+#[typeshare]
+#[derive(Serialize, Deserialize, Debug, Clone, Builder, Partial)]
+#[partial_derive(Serialize, Deserialize, Debug, Clone, Default)]
+#[partial(skip_serializing_none, from, diff)]
+pub struct UrlBuilderConfig {
+  /// The address of the Periphery agent
+  #[serde(default = "default_address")]
+  pub address: String,
+  /// A custom passkey to use. Otherwise, use the default passkey.
+  #[serde(default)]
+  pub passkey: String,
+}
+
+fn default_address() -> String {
+  String::from("https://periphery:8120")
+}
+
+impl Default for UrlBuilderConfig {
+  fn default() -> Self {
+    Self {
+      address: default_address(),
+      passkey: Default::default(),
+    }
+  }
+}
+
+impl UrlBuilderConfig {
+  pub fn builder() -> UrlBuilderConfigBuilder {
+    UrlBuilderConfigBuilder::default()
+  }
+}
+
 #[typeshare(serialized_as = "Partial<ServerBuilderConfig>")]
 pub type _PartialServerBuilderConfig = PartialServerBuilderConfig;

@@ -264,11 +350,17 @@ pub type _PartialServerBuilderConfig = PartialServerBuilderConfig;
 #[partial(skip_serializing_none, from, diff)]
 pub struct ServerBuilderConfig {
  /// The server id of the builder
-  #[serde(alias = "server")]
+  #[serde(default, alias = "server")]
  #[partial_attr(serde(alias = "server"))]
  pub server_id: String,
 }

+impl ServerBuilderConfig {
+  pub fn builder() -> ServerBuilderConfigBuilder {
+    ServerBuilderConfigBuilder::default()
+  }
+}
+
 #[typeshare(serialized_as = "Partial<AwsBuilderConfig>")]
 pub type _PartialAwsBuilderConfig = PartialAwsBuilderConfig;

--- a/client/core/rs/src/entities/config/core.rs
+++ b/client/core/rs/src/entities/config/core.rs
@@ -108,8 +108,8 @@ pub struct Env {
  pub komodo_oidc_enabled: Option<bool>,
  /// Override `oidc_provider`
  pub komodo_oidc_provider: Option<String>,
-  /// Override `oidc_redirect`
-  pub komodo_oidc_redirect: Option<String>,
+  /// Override `oidc_redirect_host`
+  pub komodo_oidc_redirect_host: Option<String>,
  /// Override `oidc_client_id`
  pub komodo_oidc_client_id: Option<String>,
  /// Override `oidc_client_id` from file
@@ -325,18 +325,22 @@ pub struct CoreConfig {

  /// Configure OIDC provider address for
  /// communcation directly with Komodo Core.
+  ///
  /// Note. Needs to be reachable from Komodo Core.
-  /// Eg. `https://accounts.example.internal/application/o/komodo`
+  ///
+  /// `https://accounts.example.internal/application/o/komodo`
  #[serde(default)]
  pub oidc_provider: String,

-  /// Configure OIDC user redirect address.
-  /// This is the address users are redirected to in their browser,
-  /// and may be different from `oidc_provider`.
-  /// If not provided, the `oidc_provider` will be used.
-  /// Eg. `https://accounts.example.external/application/o/komodo`
+  /// Configure OIDC user redirect host.
+  ///
+  /// This is the host address users are redirected to in their browser,
+  /// and may be different from `oidc_provider` host.
+  /// DO NOT include the `path` part, this must be inferred.
+  /// If not provided, the host will be the same as `oidc_provider`.
+  /// Eg. `https://accounts.example.external`
  #[serde(default)]
-  pub oidc_redirect: String,
+  pub oidc_redirect_host: String,

  /// Set OIDC client id
  #[serde(default)]
@@ -580,7 +584,7 @@ impl CoreConfig {
      local_auth: config.local_auth,
      oidc_enabled: config.oidc_enabled,
      oidc_provider: config.oidc_provider,
-      oidc_redirect: config.oidc_redirect,
+      oidc_redirect_host: config.oidc_redirect_host,
      oidc_client_id: empty_or_redacted(&config.oidc_client_id),
      oidc_client_secret: empty_or_redacted(
        &config.oidc_client_secret,
--- a/client/core/rs/src/entities/mod.rs
+++ b/client/core/rs/src/entities/mod.rs
@@ -168,7 +168,7 @@ pub fn get_image_name(
 pub fn to_komodo_name(name: &str) -> String {
  name
    .to_lowercase()
-    .replace([' ', '.'], "_")
+    .replace([' ', '.', ',', '\n'], "_")
    .trim()
    .to_string()
 }
--- a/client/core/rs/src/entities/server.rs
+++ b/client/core/rs/src/entities/server.rs
@@ -27,6 +27,8 @@ pub struct ServerListItemInfo {
  pub state: ServerState,
  /// Region of the server.
  pub region: String,
+  /// Address of the server.
+  pub address: String,
  /// Whether server is configured to send unreachable alerts.
  pub send_unreachable_alerts: bool,
  /// Whether server is configured to send cpu alerts.
--- a/client/core/rs/src/entities/server_template/aws.rs
+++ b/client/core/rs/src/entities/server_template/aws.rs
@@ -127,7 +127,7 @@ apt upgrade -y
 curl -fsSL https://get.docker.com | sh
 systemctl enable docker.service
 systemctl enable containerd.service
-curl -sSL https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py | python3
+curl -sSL https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py | HOME=/root python3
 systemctl enable periphery.service")
 }

--- a/client/core/rs/src/entities/server_template/hetzner.rs
+++ b/client/core/rs/src/entities/server_template/hetzner.rs
@@ -121,7 +121,7 @@ runcmd:
  - curl -fsSL https://get.docker.com | sh
  - systemctl enable docker.service
  - systemctl enable containerd.service
-  - curl -sSL 'https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py' | python3
+  - curl -sSL 'https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py' | HOME=/root python3
  - systemctl enable periphery.service")
 }

--- a/client/core/rs/src/entities/stack.rs
+++ b/client/core/rs/src/entities/stack.rs
@@ -11,6 +11,7 @@ use typeshare::typeshare;
 use crate::deserializers::{
  env_vars_deserializer, file_contents_deserializer,
  option_env_vars_deserializer, option_file_contents_deserializer,
+  option_maybe_string_i64_deserializer,
  option_string_list_deserializer, string_list_deserializer,
 };

@@ -563,8 +564,8 @@ impl super::resource::AddFilters for StackQuerySpecifics {
  }
 }

-/// Keeping this minimal for now as its only needed to parse the service names / container names
-#[typeshare]
+/// Keeping this minimal for now as its only needed to parse the service names / container names,
+/// and replica count. Not a typeshared type.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ComposeFile {
  /// If not provided, will default to the parent folder holding the compose file.
@@ -573,9 +574,18 @@ pub struct ComposeFile {
  pub services: HashMap<String, ComposeService>,
 }

-#[typeshare]
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ComposeService {
  pub image: Option<String>,
  pub container_name: Option<String>,
+  pub deploy: Option<ComposeServiceDeploy>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ComposeServiceDeploy {
+  #[serde(
+    default,
+    deserialize_with = "option_maybe_string_i64_deserializer"
+  )]
+  pub replicas: Option<i64>,
 }
--- a/client/core/rs/src/entities/toml.rs
+++ b/client/core/rs/src/entities/toml.rs
@@ -1,87 +1,89 @@
 use std::collections::HashMap;

 use serde::{Deserialize, Serialize};
+use typeshare::typeshare;

 use super::{
-  action::PartialActionConfig, alerter::PartialAlerterConfig,
-  build::PartialBuildConfig, builder::PartialBuilderConfig,
-  deployment::PartialDeploymentConfig, permission::PermissionLevel,
-  procedure::PartialProcedureConfig, repo::PartialRepoConfig,
-  server::PartialServerConfig,
+  action::_PartialActionConfig, alerter::_PartialAlerterConfig,
+  build::_PartialBuildConfig, builder::_PartialBuilderConfig,
+  deployment::_PartialDeploymentConfig, permission::PermissionLevel,
+  procedure::_PartialProcedureConfig, repo::_PartialRepoConfig,
+  server::_PartialServerConfig,
  server_template::PartialServerTemplateConfig,
-  stack::PartialStackConfig, sync::PartialResourceSyncConfig,
+  stack::_PartialStackConfig, sync::_PartialResourceSyncConfig,
  variable::Variable, ResourceTarget, ResourceTargetVariant,
 };

 /// Specifies resources to sync on Komodo
+#[typeshare]
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ResourcesToml {
  #[serde(
    default,
-    rename = "server",
+    alias = "server",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub servers: Vec<ResourceToml<PartialServerConfig>>,
+  pub servers: Vec<ResourceToml<_PartialServerConfig>>,

  #[serde(
    default,
-    rename = "deployment",
+    alias = "deployment",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub deployments: Vec<ResourceToml<PartialDeploymentConfig>>,
+  pub deployments: Vec<ResourceToml<_PartialDeploymentConfig>>,

  #[serde(
    default,
-    rename = "stack",
+    alias = "stack",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub stacks: Vec<ResourceToml<PartialStackConfig>>,
+  pub stacks: Vec<ResourceToml<_PartialStackConfig>>,

  #[serde(
    default,
-    rename = "build",
+    alias = "build",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub builds: Vec<ResourceToml<PartialBuildConfig>>,
+  pub builds: Vec<ResourceToml<_PartialBuildConfig>>,

  #[serde(
    default,
-    rename = "repo",
+    alias = "repo",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub repos: Vec<ResourceToml<PartialRepoConfig>>,
+  pub repos: Vec<ResourceToml<_PartialRepoConfig>>,

  #[serde(
    default,
-    rename = "procedure",
+    alias = "procedure",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub procedures: Vec<ResourceToml<PartialProcedureConfig>>,
+  pub procedures: Vec<ResourceToml<_PartialProcedureConfig>>,

  #[serde(
    default,
-    rename = "action",
+    alias = "action",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub actions: Vec<ResourceToml<PartialActionConfig>>,
+  pub actions: Vec<ResourceToml<_PartialActionConfig>>,

  #[serde(
    default,
-    rename = "alerter",
+    alias = "alerter",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub alerters: Vec<ResourceToml<PartialAlerterConfig>>,
+  pub alerters: Vec<ResourceToml<_PartialAlerterConfig>>,

  #[serde(
    default,
-    rename = "builder",
+    alias = "builder",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub builders: Vec<ResourceToml<PartialBuilderConfig>>,
+  pub builders: Vec<ResourceToml<_PartialBuilderConfig>>,

  #[serde(
    default,
-    rename = "server_template",
+    alias = "server_template",
    skip_serializing_if = "Vec::is_empty"
  )]
  pub server_templates:
@@ -89,26 +91,27 @@ pub struct ResourcesToml {

  #[serde(
    default,
-    rename = "resource_sync",
+    alias = "resource_sync",
    skip_serializing_if = "Vec::is_empty"
  )]
-  pub resource_syncs: Vec<ResourceToml<PartialResourceSyncConfig>>,
+  pub resource_syncs: Vec<ResourceToml<_PartialResourceSyncConfig>>,

  #[serde(
    default,
-    rename = "user_group",
+    alias = "user_group",
    skip_serializing_if = "Vec::is_empty"
  )]
  pub user_groups: Vec<UserGroupToml>,

  #[serde(
    default,
-    rename = "variable",
+    alias = "variable",
    skip_serializing_if = "Vec::is_empty"
  )]
  pub variables: Vec<Variable>,
 }

+#[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ResourceToml<PartialConfig: Default> {
  /// The resource name. Required
@@ -146,6 +149,7 @@ fn is_false(b: &bool) -> bool {
  !b
 }

+#[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct UserGroupToml {
  /// User group name
@@ -164,6 +168,7 @@ pub struct UserGroupToml {
  pub permissions: Vec<PermissionToml>,
 }

+#[typeshare]
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct PermissionToml {
  /// Id can be:
--- a/client/core/rs/src/lib.rs
+++ b/client/core/rs/src/lib.rs
@@ -5,14 +5,14 @@
 //! It contains:
 //! - Definitions for the application [api] and [entities].
 //! - A [client][KomodoClient] to interact with the Komodo Core API.
-//! - Information on configuring Komodo [core][entities::config::core] and [periphery][entities::config::periphery].
+//! - Information on configuring Komodo [Core][entities::config::core] and [Periphery][entities::config::periphery].
 //!
 //! ## Client Configuration
 //!
 //! The client includes a convenenience method to parse the Komodo API url and credentials from the environment:
-//! - KOMODO_ADDRESS
-//! - KOMODO_API_KEY
-//! - KOMODO_API_SECRET
+//! - `KOMODO_ADDRESS`
+//! - `KOMODO_API_KEY`
+//! - `KOMODO_API_SECRET`
 //!
 //! ## Client Example
 //! ```
@@ -28,64 +28,146 @@
 //! let update = client.execute(RunBuild { build: "test-build".to_string() }).await?:
 //! ```

+use std::sync::OnceLock;
+
 use anyhow::Context;
 use api::read::GetVersion;
 use serde::Deserialize;

 pub mod api;
 pub mod busy;
+pub mod deserializers;
 pub mod entities;
 pub mod parsers;
 pub mod ws;
-pub mod deserializers;

 mod request;

+/// &'static KomodoClient initialized from environment.
+pub fn komodo_client() -> &'static KomodoClient {
+  static KOMODO_CLIENT: OnceLock<KomodoClient> = OnceLock::new();
+  KOMODO_CLIENT.get_or_init(|| {
+    KomodoClient::new_from_env()
+      .context("Missing KOMODO_ADDRESS, KOMODO_API_KEY, KOMODO_API_SECRET from env")
+      .unwrap()
+  })
+}
+
+/// Default environment variables for the [KomodoClient].
 #[derive(Deserialize)]
 struct KomodoEnv {
+  /// KOMODO_ADDRESS
  komodo_address: String,
+  /// KOMODO_API_KEY
  komodo_api_key: String,
+  /// KOMODO_API_SECRET
  komodo_api_secret: String,
 }

+/// Client to interface with [Komodo](https://komo.do/docs/api#rust-client)
 #[derive(Clone)]
 pub struct KomodoClient {
+  #[cfg(not(feature = "blocking"))]
  reqwest: reqwest::Client,
+  #[cfg(feature = "blocking")]
+  reqwest: reqwest::blocking::Client,
  address: String,
  key: String,
  secret: String,
 }

 impl KomodoClient {
-  #[tracing::instrument(skip_all)]
-  pub async fn new(
+  /// Initializes KomodoClient, including a health check.
+  pub fn new(
    address: impl Into<String>,
    key: impl Into<String>,
    secret: impl Into<String>,
-  ) -> anyhow::Result<KomodoClient> {
-    let client = KomodoClient {
+  ) -> KomodoClient {
+    KomodoClient {
      reqwest: Default::default(),
      address: address.into(),
      key: key.into(),
      secret: secret.into(),
-    };
-    client.read(GetVersion {}).await?;
-    Ok(client)
+    }
  }

-  #[tracing::instrument]
-  pub async fn new_from_env() -> anyhow::Result<KomodoClient> {
+  /// Initializes KomodoClient from environment: [KomodoEnv]
+  pub fn new_from_env() -> anyhow::Result<KomodoClient> {
    let KomodoEnv {
      komodo_address,
      komodo_api_key,
      komodo_api_secret,
    } = envy::from_env()
      .context("failed to parse environment for komodo client")?;
-    KomodoClient::new(
+    Ok(KomodoClient::new(
      komodo_address,
      komodo_api_key,
      komodo_api_secret,
-    )
-    .await
+    ))
+  }
+
+  /// Add a healthcheck in the initialization pipeline:
+  ///
+  /// ```rust
+  /// let komodo = KomodoClient::new_from_env()?
+  ///   .with_healthcheck().await?;
+  /// ```
+  #[cfg(not(feature = "blocking"))]
+  pub async fn with_healthcheck(self) -> anyhow::Result<Self> {
+    self.health_check().await?;
+    Ok(self)
+  }
+
+  /// Add a healthcheck in the initialization pipeline:
+  ///
+  /// ```rust
+  /// let komodo = KomodoClient::new_from_env()?
+  ///   .with_healthcheck().await?;
+  /// ```
+  #[cfg(feature = "blocking")]
+  pub fn with_healthcheck(self) -> anyhow::Result<Self> {
+    self.health_check()?;
+    Ok(self)
+  }
+
+  /// Get the Core version.
+  #[cfg(not(feature = "blocking"))]
+  pub async fn core_version(&self) -> anyhow::Result<String> {
+    self.read(GetVersion {}).await.map(|r| r.version)
+  }
+
+  /// Get the Core version.
+  #[cfg(feature = "blocking")]
+  pub fn core_version(&self) -> anyhow::Result<String> {
+    self.read(GetVersion {}).map(|r| r.version)
+  }
+
+  /// Send a health check.
+  #[cfg(not(feature = "blocking"))]
+  pub async fn health_check(&self) -> anyhow::Result<()> {
+    self.read(GetVersion {}).await.map(|_| ())
+  }
+
+  /// Send a health check.
+  #[cfg(feature = "blocking")]
+  pub fn health_check(&self) -> anyhow::Result<()> {
+    self.read(GetVersion {}).map(|_| ())
+  }
+
+  /// Use a custom reqwest client.
+  #[cfg(not(feature = "blocking"))]
+  pub fn set_reqwest(mut self, reqwest: reqwest::Client) -> Self {
+    self.reqwest = reqwest;
+    self
+  }
+
+  /// Use a custom reqwest client.
+  #[cfg(feature = "blocking")]
+  pub fn set_reqwest(
+    mut self,
+    reqwest: reqwest::blocking::Client,
+  ) -> Self {
+    self.reqwest = reqwest;
+    self
  }
 }
--- a/client/core/rs/src/parsers.rs
+++ b/client/core/rs/src/parsers.rs
@@ -1,24 +1,40 @@
 use anyhow::Context;

+pub const QUOTE_PATTERN: &[char] = &['"', '\''];
+
 /// Parses a list of key value pairs from a multiline string
 ///
 /// Example source:
 /// ```text
 /// # Supports comments
 /// KEY_1 = value_1 # end of line comments
-/// 
+///
 /// # Supports string wrapped values
 /// KEY_2="value_2"
 /// 'KEY_3 = value_3'
-/// 
+///
 /// # Also supports yaml list formats
 /// - KEY_4: 'value_4'
 /// - "KEY_5=value_5"
+///
+/// # Wrapping outer quotes are removed while inner quotes are preserved
+/// "KEY_6 = 'value_6'"
 /// ```
 ///
+/// Note this preserves the wrapping string around value.
+/// Writing environment file should format the value exactly as it comes in,
+/// including the given wrapping quotes.
+///
 /// Returns:
 /// ```text
-/// [("KEY_1", "value_1"), ("KEY_2", "value_2"), ("KEY_3", "value_3"), ("KEY_4", "value_4"), ("KEY_5", "value_5")]
+/// [
+///   ("KEY_1", "value_1"),
+///   ("KEY_2", "\"value_2\""),
+///   ("KEY_3", "value_3"),
+///   ("KEY_4", "'value_4'"),
+///   ("KEY_5", "value_5"),
+///   ("KEY_6", "'value_6'"),
+/// ]
 /// ```
 pub fn parse_key_value_list(
  input: &str,
@@ -46,13 +62,6 @@ pub fn parse_key_value_list(
        // Remove preceding '-' (yaml list)
        .trim_start_matches('-')
        .trim();
-      // Remove wrapping quotes (from yaml list)
-      let line = if let Some(line) = line.strip_prefix(['"', '\'']) {
-        line.strip_suffix(['"', '\'']).unwrap_or(line)
-      } else {
-        line
-      };
-      // Remove any preceding '"' (from yaml list) (wrapping quotes open)
      let (key, value) = line
        .split_once(['=', ':'])
        .with_context(|| {
@@ -61,15 +70,23 @@ pub fn parse_key_value_list(
          )
        })
        .map(|(key, value)| {
+          let key = key.trim();
          let value = value.trim();
-          // Remove wrapping quotes around value
-          let value =
-            if let Some(value) = value.strip_prefix(['"', '\'']) {
-              value.strip_suffix(['"', '\'']).unwrap_or(value)
-            } else {
-              value
-            };
-          (key.trim().to_string(), value.trim().to_string())
+
+          // Remove wrapping quotes when around key AND value
+          let (key, value) = if key.starts_with(QUOTE_PATTERN)
+            && !key.ends_with(QUOTE_PATTERN)
+            && value.ends_with(QUOTE_PATTERN)
+          {
+            (
+              key.strip_prefix(QUOTE_PATTERN).unwrap().trim(),
+              value.strip_suffix(QUOTE_PATTERN).unwrap().trim(),
+            )
+          } else {
+            (key, value)
+          };
+
+          (key.to_string(), value.to_string())
        })?;
      anyhow::Ok((key, value))
    })
--- a/client/core/rs/src/request.rs
+++ b/client/core/rs/src/request.rs
@@ -14,7 +14,7 @@ use crate::{
 };

 impl KomodoClient {
-  #[tracing::instrument(skip(self))]
+  #[cfg(not(feature = "blocking"))]
  pub async fn auth<T: KomodoAuthRequest>(
    &self,
    request: T,
@@ -30,7 +30,21 @@ impl KomodoClient {
      .await
  }

-  #[tracing::instrument(skip(self))]
+  #[cfg(feature = "blocking")]
+  pub fn auth<T: KomodoAuthRequest>(
+    &self,
+    request: T,
+  ) -> anyhow::Result<T::Response> {
+    self.post(
+      "/auth",
+      json!({
+        "type": T::req_type(),
+        "params": request
+      }),
+    )
+  }
+
+  #[cfg(not(feature = "blocking"))]
  pub async fn user<T: KomodoUserRequest>(
    &self,
    request: T,
@@ -46,7 +60,21 @@ impl KomodoClient {
      .await
  }

-  #[tracing::instrument(skip(self))]
+  #[cfg(feature = "blocking")]
+  pub fn user<T: KomodoUserRequest>(
+    &self,
+    request: T,
+  ) -> anyhow::Result<T::Response> {
+    self.post(
+      "/auth",
+      json!({
+        "type": T::req_type(),
+        "params": request
+      }),
+    )
+  }
+
+  #[cfg(not(feature = "blocking"))]
  pub async fn read<T: KomodoReadRequest>(
    &self,
    request: T,
@@ -62,7 +90,21 @@ impl KomodoClient {
      .await
  }

-  #[tracing::instrument(skip(self))]
+  #[cfg(feature = "blocking")]
+  pub fn read<T: KomodoReadRequest>(
+    &self,
+    request: T,
+  ) -> anyhow::Result<T::Response> {
+    self.post(
+      "/read",
+      json!({
+        "type": T::req_type(),
+        "params": request
+      }),
+    )
+  }
+
+  #[cfg(not(feature = "blocking"))]
  pub async fn write<T: KomodoWriteRequest>(
    &self,
    request: T,
@@ -78,7 +120,21 @@ impl KomodoClient {
      .await
  }

-  #[tracing::instrument(skip(self))]
+  #[cfg(feature = "blocking")]
+  pub fn write<T: KomodoWriteRequest>(
+    &self,
+    request: T,
+  ) -> anyhow::Result<T::Response> {
+    self.post(
+      "/write",
+      json!({
+        "type": T::req_type(),
+        "params": request
+      }),
+    )
+  }
+
+  #[cfg(not(feature = "blocking"))]
  pub async fn execute<T: KomodoExecuteRequest>(
    &self,
    request: T,
@@ -94,7 +150,21 @@ impl KomodoClient {
      .await
  }

-  #[tracing::instrument(skip(self))]
+  #[cfg(feature = "blocking")]
+  pub fn execute<T: KomodoExecuteRequest>(
+    &self,
+    request: T,
+  ) -> anyhow::Result<T::Response> {
+    self.post(
+      "/execute",
+      json!({
+        "type": T::req_type(),
+        "params": request
+      }),
+    )
+  }
+
+  #[cfg(not(feature = "blocking"))]
  async fn post<
    B: Serialize + std::fmt::Debug,
    R: DeserializeOwned,
@@ -108,29 +178,48 @@ impl KomodoClient {
      .post(format!("{}{endpoint}", self.address))
      .header("x-api-key", &self.key)
      .header("x-api-secret", &self.secret)
-      .header("Content-Type", "application/json")
+      .header("content-type", "application/json")
      .json(&body);
    let res =
      req.send().await.context("failed to reach Komodo API")?;
-    tracing::debug!("got response");
    let status = res.status();
    if status == StatusCode::OK {
-      tracing::debug!("response is OK");
      match res.json().await {
        Ok(res) => Ok(res),
-        Err(e) => Err(anyhow!("{status} | {e:#?}")),
+        Err(e) => Err(anyhow!("{e:#?}").context(status)),
      }
    } else {
-      tracing::debug!("response is non-OK");
      match res.text().await {
-        Ok(res) => Err(
-          deserialize_error(res)
-            .context(format!("request failed with status {status}")),
-        ),
-        Err(e) => Err(
-          anyhow!("{e:?}")
-            .context(format!("request failed with status {status}")),
-        ),
+        Ok(res) => Err(deserialize_error(res).context(status)),
+        Err(e) => Err(anyhow!("{e:?}").context(status)),
+      }
+    }
+  }
+
+  #[cfg(feature = "blocking")]
+  fn post<B: Serialize + std::fmt::Debug, R: DeserializeOwned>(
+    &self,
+    endpoint: &str,
+    body: B,
+  ) -> anyhow::Result<R> {
+    let req = self
+      .reqwest
+      .post(format!("{}{endpoint}", self.address))
+      .header("x-api-key", &self.key)
+      .header("x-api-secret", &self.secret)
+      .header("content-type", "application/json")
+      .json(&body);
+    let res = req.send().context("failed to reach Komodo API")?;
+    let status = res.status();
+    if status == StatusCode::OK {
+      match res.json() {
+        Ok(res) => Ok(res),
+        Err(e) => Err(anyhow!("{e:#?}").context(status)),
+      }
+    } else {
+      match res.text() {
+        Ok(res) => Err(deserialize_error(res).context(status)),
+        Err(e) => Err(anyhow!("{e:?}").context(status)),
      }
    }
  }
--- a/client/core/rs/src/ws.rs
+++ b/client/core/rs/src/ws.rs
@@ -8,7 +8,7 @@ use thiserror::Error;
 use tokio::sync::broadcast;
 use tokio_tungstenite::{connect_async, tungstenite::Message};
 use tokio_util::sync::CancellationToken;
-use tracing::{info, info_span, warn, Instrument};
+use tracing::{debug, info, info_span, warn, Instrument};
 use typeshare::typeshare;
 use uuid::Uuid;

@@ -92,7 +92,7 @@ impl KomodoClient {
        );

        async {
-          info!("Entering inner (connection) loop | outer uuid {outer_uuid} | master uuid {master_uuid}");
+          debug!("Entering inner (connection) loop | outer uuid {outer_uuid} | master uuid {master_uuid}");
          let mut retry = 0;
          loop {
            // INNER LOOP (SHORT RECONNECT)
@@ -112,7 +112,7 @@ impl KomodoClient {
            );

            async {
-              info!("Connecting to websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");
+              debug!("Connecting to websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");

              let mut ws =
                match connect_async(&address).await.with_context(|| {
@@ -131,7 +131,7 @@ impl KomodoClient {
                  }
                };

-              info!("Connected to websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");
+              debug!("Connected to websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");

              // ==================
              // SEND LOGIN MSG
@@ -200,7 +200,7 @@ impl KomodoClient {

              let _ = tx.send(UpdateWsMessage::Reconnected);

-              info!("logged into websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");
+              info!("Logged into websocket | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}");

              // If we get to this point (connected / logged in) reset the short retry counter
              retry = 0;
@@ -217,13 +217,13 @@ impl KomodoClient {
                  Ok(Some(Message::Text(msg))) => {
                    match serde_json::from_str::<UpdateListItem>(&msg) {
                      Ok(msg) => {
-                        tracing::debug!(
+                        debug!(
                          "got recognized message: {msg:?} | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}"
                        );
                        let _ = tx.send(UpdateWsMessage::Update(msg));
                      }
                      Err(_) => {
-                        tracing::warn!(
+                        warn!(
                          "got unrecognized message: {msg:?} | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}"
                        );
                        let _ = tx.send(UpdateWsMessage::Error(
@@ -235,7 +235,7 @@ impl KomodoClient {
                  Ok(Some(Message::Close(_))) => {
                    let _ = tx.send(UpdateWsMessage::Disconnected);
                    let _ = ws.close(None).await;
-                    tracing::warn!(
+                    warn!(
                      "breaking inner loop | got close message | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}"
                    );
                    break;
@@ -246,7 +246,7 @@ impl KomodoClient {
                    ));
                    let _ = tx.send(UpdateWsMessage::Disconnected);
                    let _ = ws.close(None).await;
-                    tracing::warn!(
+                    warn!(
                      "breaking inner loop | got error message | {e:#} | inner uuid {inner_uuid} | outer uuid {outer_uuid} | master uuid {master_uuid}"
                    );
                    break;
--- a/client/core/ts/README.md
+++ b/client/core/ts/README.md
@@ -23,15 +23,11 @@ const komodo = KomodoClient("https://demo.komo.do", {
  },
 });

-const stacks: Types.StackListItem[] = await komodo.read({
-  type: "ListStacks",
-  params: {},
-});
+// Inferred as Types.StackListItem[]
+const stacks = await komodo.read("ListStacks", {});

-const stack: Types.Stack = await komodo.read({
-  type: "GetStack",
-  params: {
-    stack: stacks[0].name,
-  }
+// Inferred as Types.Stack
+const stack = await komodo.read("GetStack", {
+  stack: stacks[0].name,
 });
 ```
--- a/client/core/ts/package.json
+++ b/client/core/ts/package.json
@@ -1,6 +1,6 @@
 {
  "name": "komodo_client",
-  "version": "1.16.0",
+  "version": "1.16.8",
  "description": "Komodo client package",
  "homepage": "https://komo.do",
  "main": "dist/lib.js",
--- a/client/core/ts/src/responses.ts
+++ b/client/core/ts/src/responses.ts
@@ -349,28 +349,36 @@ export type ExecuteResponses = {

  // ==== DEPLOYMENT ====
  Deploy: Types.Update;
+  BatchDeploy: Types.BatchExecutionResponse;
  StartDeployment: Types.Update;
  RestartDeployment: Types.Update;
  PauseDeployment: Types.Update;
  UnpauseDeployment: Types.Update;
  StopDeployment: Types.Update;
  DestroyDeployment: Types.Update;
+  BatchDestroyDeployment: Types.BatchExecutionResponse;

  // ==== BUILD ====
  RunBuild: Types.Update;
+  BatchRunBuild: Types.BatchExecutionResponse;
  CancelBuild: Types.Update;

  // ==== REPO ====
  CloneRepo: Types.Update;
+  BatchCloneRepo: Types.BatchExecutionResponse;
  PullRepo: Types.Update;
+  BatchPullRepo: Types.BatchExecutionResponse;
  BuildRepo: Types.Update;
+  BatchBuildRepo: Types.BatchExecutionResponse;
  CancelRepoBuild: Types.Update;

  // ==== PROCEDURE ====
  RunProcedure: Types.Update;
-  
+  BatchRunProcedure: Types.BatchExecutionResponse;
+
  // ==== ACTION ====
  RunAction: Types.Update;
+  BatchRunAction: Types.BatchExecutionResponse;

  // ==== SERVER TEMPLATE ====
  LaunchServer: Types.Update;
@@ -380,13 +388,16 @@ export type ExecuteResponses = {

  // ==== STACK ====
  DeployStack: Types.Update;
+  BatchDeployStack: Types.BatchExecutionResponse;
  DeployStackIfChanged: Types.Update;
+  BatchDeployStackIfChanged: Types.BatchExecutionResponse;
  StartStack: Types.Update;
  RestartStack: Types.Update;
  StopStack: Types.Update;
  PauseStack: Types.Update;
  UnpauseStack: Types.Update;
  DestroyStack: Types.Update;
+  BatchDestroyStack: Types.BatchExecutionResponse;

  // ==== STACK Service ====
  DeployStackService: Types.Update;
--- a/client/core/ts/src/types.ts
+++ b/client/core/ts/src/types.ts
@@ -1,5 +1,5 @@
 /*
- Generated by typeshare 1.11.0
+ Generated by typeshare 1.12.0
 */

 export interface MongoIdObj {
@@ -54,6 +54,13 @@ export interface Resource<Config, Info> {
 export interface ActionConfig {
 	/** Typescript file contents using pre-initialized `komodo` client. */
 	file_contents?: string;
+	/** Whether incoming webhooks actually trigger action. */
+	webhook_enabled: boolean;
+	/**
+	 * Optionally provide an alternate webhook secret for this procedure.
+	 * If its an empty string, use the default secret from the config.
+	 */
+	webhook_secret?: string;
 }

 export interface ActionInfo {
@@ -191,6 +198,12 @@ export interface AlerterQuerySpecifics {

 export type AlerterQuery = ResourceQuery<AlerterQuerySpecifics>;

+export type BatchExecutionResponseItem = 
+	| { status: "Ok", data: Update }
+	| { status: "Err", data: BatchExecutionResponseItemErr };
+
+export type BatchExecutionResponse = BatchExecutionResponseItem[];
+
 export interface Version {
 	major: number;
 	minor: number;
@@ -382,9 +395,11 @@ export interface BuildQuerySpecifics {
 export type BuildQuery = ResourceQuery<BuildQuerySpecifics>;

 export type BuilderConfig = 
-	/** Use a connected server an image builder. */
+	/** Use a Periphery address as a Builder. */
+	| { type: "Url", params: UrlBuilderConfig }
+	/** Use a connected server as a Builder. */
 	| { type: "Server", params: ServerBuilderConfig }
-	/** Use EC2 instances spawned on demand as an image builder. */
+	/** Use EC2 instances spawned on demand as a Builder. */
 	| { type: "Aws", params: AwsBuilderConfig };

 export type Builder = Resource<BuilderConfig, undefined>;
@@ -411,19 +426,27 @@ export type Execution =
 	/** The "null" execution. Does nothing. */
 	| { type: "None", params: NoData }
 	| { type: "RunAction", params: RunAction }
+	| { type: "BatchRunAction", params: BatchRunAction }
 	| { type: "RunProcedure", params: RunProcedure }
+	| { type: "BatchRunProcedure", params: BatchRunProcedure }
 	| { type: "RunBuild", params: RunBuild }
+	| { type: "BatchRunBuild", params: BatchRunBuild }
 	| { type: "CancelBuild", params: CancelBuild }
 	| { type: "Deploy", params: Deploy }
+	| { type: "BatchDeploy", params: BatchDeploy }
 	| { type: "StartDeployment", params: StartDeployment }
 	| { type: "RestartDeployment", params: RestartDeployment }
 	| { type: "PauseDeployment", params: PauseDeployment }
 	| { type: "UnpauseDeployment", params: UnpauseDeployment }
 	| { type: "StopDeployment", params: StopDeployment }
 	| { type: "DestroyDeployment", params: DestroyDeployment }
+	| { type: "BatchDestroyDeployment", params: BatchDestroyDeployment }
 	| { type: "CloneRepo", params: CloneRepo }
+	| { type: "BatchCloneRepo", params: BatchCloneRepo }
 	| { type: "PullRepo", params: PullRepo }
+	| { type: "BatchPullRepo", params: BatchPullRepo }
 	| { type: "BuildRepo", params: BuildRepo }
+	| { type: "BatchBuildRepo", params: BatchBuildRepo }
 	| { type: "CancelRepoBuild", params: CancelRepoBuild }
 	| { type: "StartContainer", params: StartContainer }
 	| { type: "RestartContainer", params: RestartContainer }
@@ -449,13 +472,16 @@ export type Execution =
 	| { type: "RunSync", params: RunSync }
 	| { type: "CommitSync", params: CommitSync }
 	| { type: "DeployStack", params: DeployStack }
+	| { type: "BatchDeployStack", params: BatchDeployStack }
 	| { type: "DeployStackIfChanged", params: DeployStackIfChanged }
+	| { type: "BatchDeployStackIfChanged", params: BatchDeployStackIfChanged }
 	| { type: "StartStack", params: StartStack }
 	| { type: "RestartStack", params: RestartStack }
 	| { type: "PauseStack", params: PauseStack }
 	| { type: "UnpauseStack", params: UnpauseStack }
 	| { type: "StopStack", params: StopStack }
 	| { type: "DestroyStack", params: DestroyStack }
+	| { type: "BatchDestroyStack", params: BatchDestroyStack }
 	| { type: "Sleep", params: Sleep };

 /** Allows to enable / disabled procedures in the sequence / parallel vec on the fly */
@@ -3135,6 +3161,8 @@ export interface ServerListItemInfo {
 	state: ServerState;
 	/** Region of the server. */
 	region: string;
+	/** Address of the server. */
+	address: string;
 	/** Whether server is configured to send unreachable alerts. */
 	send_unreachable_alerts: boolean;
 	/** Whether server is configured to send cpu alerts. */
@@ -3380,6 +3408,8 @@ export type _PartialStackConfig = Partial<StackConfig>;

 export type _PartialTag = Partial<Tag>;

+export type _PartialUrlBuilderConfig = Partial<UrlBuilderConfig>;
+
 export interface __Serror {
 	error: string;
 	trace: string[];
@@ -3505,6 +3535,198 @@ export interface AwsServerTemplateConfig {
 	user_data: string;
 }

+/** Builds multiple Repos in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchBuildRepo {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* repos
+	 * foo-*
+	 * # add some more
+	 * extra-repo-1, extra-repo-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Clones multiple Repos in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchCloneRepo {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* repos
+	 * foo-*
+	 * # add some more
+	 * extra-repo-1, extra-repo-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Deploys multiple Deployments in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchDeploy {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* deployments
+	 * foo-*
+	 * # add some more
+	 * extra-deployment-1, extra-deployment-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Deploys multiple Stacks in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchDeployStack {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* stacks
+	 * foo-*
+	 * # add some more
+	 * extra-stack-1, extra-stack-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Deploys multiple Stacks if changed in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchDeployStackIfChanged {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* stacks
+	 * foo-*
+	 * # add some more
+	 * extra-stack-1, extra-stack-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Destroys multiple Deployments in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchDestroyDeployment {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* deployments
+	 * foo-*
+	 * # add some more
+	 * extra-deployment-1, extra-deployment-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Destroys multiple Stacks in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchDestroyStack {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * d
+	 * Example:
+	 * ```
+	 * # match all foo-* stacks
+	 * foo-*
+	 * # add some more
+	 * extra-stack-1, extra-stack-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+export interface BatchExecutionResponseItemErr {
+	name: string;
+	error: _Serror;
+}
+
+/** Pulls multiple Repos in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchPullRepo {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* repos
+	 * foo-*
+	 * # add some more
+	 * extra-repo-1, extra-repo-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Runs multiple Actions in parallel that match pattern. Response: [BatchExecutionResult] */
+export interface BatchRunAction {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* actions
+	 * foo-*
+	 * # add some more
+	 * extra-action-1, extra-action-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Runs multiple builds in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchRunBuild {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* builds
+	 * foo-*
+	 * # add some more
+	 * extra-build-1, extra-build-2
+	 * ```
+	 */
+	pattern: string;
+}
+
+/** Runs multiple Procedures in parallel that match pattern. Response: [BatchExecutionResult]. */
+export interface BatchRunProcedure {
+	/**
+	 * Id or name or wildcard pattern or regex.
+	 * Supports multiline and comma delineated combinations of the above.
+	 * 
+	 * Example:
+	 * ```
+	 * # match all foo-* procedures
+	 * foo-*
+	 * # add some more
+	 * extra-procedure-1, extra-procedure-2
+	 * ```
+	 */
+	pattern: string;
+}
+
 /**
 * Builds the target repo, using the attached builder. Response: [Update].
 * 
@@ -3598,18 +3820,6 @@ export interface CommitSync {
 	sync: string;
 }

-export interface ComposeService {
-	image?: string;
-	container_name?: string;
-}
-
-/** Keeping this minimal for now as its only needed to parse the service names / container names */
-export interface ComposeFile {
-	/** If not provided, will default to the parent folder holding the compose file. */
-	name?: string;
-	services?: Record<string, ComposeService>;
-}
-
 export interface Conversion {
 	/** reference on the server. */
 	local: string;
@@ -3804,6 +4014,7 @@ export interface CreateBuildWebhook {

 /** Partial representation of [BuilderConfig] */
 export type PartialBuilderConfig = 
+	| { type: "Url", params: _PartialUrlBuilderConfig }
 	| { type: "Server", params: _PartialServerBuilderConfig }
 	| { type: "Aws", params: _PartialAwsBuilderConfig };

@@ -5929,6 +6140,23 @@ export interface PauseStack {
 	service?: string;
 }

+export interface PermissionToml {
+	/**
+	 * Id can be:
+	 * - resource name. `id = "abcd-build"`
+	 * - regex matching resource names. `id = "\^(.+)-build-([0-9]+)$\"`
+	 */
+	target: ResourceTarget;
+	/**
+	 * The permission level:
+	 * - None
+	 * - Read
+	 * - Execute
+	 * - Write
+	 */
+	level: PermissionLevel;
+}
+
 export enum PortTypeEnum {
 	EMPTY = "",
 	TCP = "tcp",
@@ -6212,6 +6440,60 @@ export interface RenameUserGroup {
 	name: string;
 }

+export interface ResourceToml<PartialConfig> {
+	/** The resource name. Required */
+	name: string;
+	/** The resource description. Optional. */
+	description?: string;
+	/** Tag ids or names. Optional */
+	tags?: string[];
+	/**
+	 * Optional. Only relevant for deployments / stacks.
+	 * 
+	 * Will ensure deployment / stack is running with the latest configuration.
+	 * Deploy actions to achieve this will be included in the sync.
+	 * Default is false.
+	 */
+	deploy?: boolean;
+	/**
+	 * Optional. Only relevant for deployments / stacks using the 'deploy' sync feature.
+	 * 
+	 * Specify other deployments / stacks by name as dependencies.
+	 * The sync will ensure the deployment / stack will only be deployed 'after' its dependencies.
+	 */
+	after?: string[];
+	/** Resource specific configuration. */
+	config?: PartialConfig;
+}
+
+export interface UserGroupToml {
+	/** User group name */
+	name: string;
+	/** Users in the group */
+	users?: string[];
+	/** Give the user group elevated permissions on all resources of a certain type */
+	all?: Record<ResourceTarget["type"], PermissionLevel>;
+	/** Permissions given to the group */
+	permissions?: PermissionToml[];
+}
+
+/** Specifies resources to sync on Komodo */
+export interface ResourcesToml {
+	servers?: ResourceToml<_PartialServerConfig>[];
+	deployments?: ResourceToml<_PartialDeploymentConfig>[];
+	stacks?: ResourceToml<_PartialStackConfig>[];
+	builds?: ResourceToml<_PartialBuildConfig>[];
+	repos?: ResourceToml<_PartialRepoConfig>[];
+	procedures?: ResourceToml<_PartialProcedureConfig>[];
+	actions?: ResourceToml<_PartialActionConfig>[];
+	alerters?: ResourceToml<_PartialAlerterConfig>[];
+	builders?: ResourceToml<_PartialBuilderConfig>[];
+	server_templates?: ResourceToml<PartialServerTemplateConfig>[];
+	resource_syncs?: ResourceToml<_PartialResourceSyncConfig>[];
+	user_groups?: UserGroupToml[];
+	variables?: Variable[];
+}
+
 /** Restarts all containers on the target server. Response: [Update] */
 export interface RestartAllContainers {
 	/** Name or id */
@@ -6374,7 +6656,7 @@ export interface SearchStackServiceLog {
 /** Configuration for a Komodo Server Builder. */
 export interface ServerBuilderConfig {
 	/** The server id of the builder */
-	server_id: string;
+	server_id?: string;
 }

 /** The health of a part of the server. */
@@ -6899,6 +7181,14 @@ export interface UpdateVariableValue {
 	value: string;
 }

+/** Configuration for a Komodo Url Builder. */
+export interface UrlBuilderConfig {
+	/** The address of the Periphery agent */
+	address: string;
+	/** A custom passkey to use. Otherwise, use the default passkey. */
+	passkey?: string;
+}
+
 /** Update file contents in Files on Server or Git Repo mode. Response: [Update]. */
 export interface WriteStackFileContents {
 	/** The name or id of the target Stack. */
@@ -6957,6 +7247,7 @@ export type ExecuteRequest =
 	| { type: "PruneBuildx", params: PruneBuildx }
 	| { type: "PruneSystem", params: PruneSystem }
 	| { type: "Deploy", params: Deploy }
+	| { type: "BatchDeploy", params: BatchDeploy }
 	| { type: "StartDeployment", params: StartDeployment }
 	| { type: "RestartDeployment", params: RestartDeployment }
 	| { type: "PauseDeployment", params: PauseDeployment }
@@ -6964,21 +7255,30 @@ export type ExecuteRequest =
 	| { type: "StopDeployment", params: StopDeployment }
 	| { type: "DestroyDeployment", params: DestroyDeployment }
 	| { type: "DeployStack", params: DeployStack }
+	| { type: "BatchDeployStack", params: BatchDeployStack }
 	| { type: "DeployStackIfChanged", params: DeployStackIfChanged }
+	| { type: "BatchDeployStackIfChanged", params: BatchDeployStackIfChanged }
 	| { type: "StartStack", params: StartStack }
 	| { type: "RestartStack", params: RestartStack }
 	| { type: "StopStack", params: StopStack }
 	| { type: "PauseStack", params: PauseStack }
 	| { type: "UnpauseStack", params: UnpauseStack }
 	| { type: "DestroyStack", params: DestroyStack }
+	| { type: "BatchDestroyStack", params: BatchDestroyStack }
 	| { type: "RunBuild", params: RunBuild }
+	| { type: "BatchRunBuild", params: BatchRunBuild }
 	| { type: "CancelBuild", params: CancelBuild }
 	| { type: "CloneRepo", params: CloneRepo }
+	| { type: "BatchCloneRepo", params: BatchCloneRepo }
 	| { type: "PullRepo", params: PullRepo }
+	| { type: "BatchPullRepo", params: BatchPullRepo }
 	| { type: "BuildRepo", params: BuildRepo }
+	| { type: "BatchBuildRepo", params: BatchBuildRepo }
 	| { type: "CancelRepoBuild", params: CancelRepoBuild }
 	| { type: "RunProcedure", params: RunProcedure }
+	| { type: "BatchRunProcedure", params: BatchRunProcedure }
 	| { type: "RunAction", params: RunAction }
+	| { type: "BatchRunAction", params: BatchRunAction }
 	| { type: "LaunchServer", params: LaunchServer }
 	| { type: "RunSync", params: RunSync };

--- a/compose/compose.env
+++ b/compose/compose.env
@@ -78,8 +78,9 @@ KOMODO_JWT_TTL="1-day"
 KOMODO_OIDC_ENABLED=false
 ## Must reachable from Komodo Core container
 # KOMODO_OIDC_PROVIDER=https://oidc.provider.internal/application/o/komodo
-## Must be reachable by users (optional if it is the same as above).
-# KOMODO_OIDC_REDIRECT=https://oidc.provider.external/application/o/komodo
+## Change the host to one reachable be reachable by users (optional if it is the same as above).
+## DO NOT include the `path` part of the URL.
+# KOMODO_OIDC_REDIRECT_HOST=https://oidc.provider.external
 ## Your client credentials
 # KOMODO_OIDC_CLIENT_ID= # Alt: KOMODO_OIDC_CLIENT_ID_FILE
 # KOMODO_OIDC_CLIENT_SECRET= # Alt: KOMODO_OIDC_CLIENT_SECRET_FILE
--- a/config/core.config.toml
+++ b/config/core.config.toml
@@ -152,15 +152,18 @@ oidc_enabled = false
 ## Optional, no default.
 oidc_provider = "https://oidc.provider.internal/application/o/komodo"

-## Configure OIDC user redirect address.
+## Configure OIDC user redirect host.
 ##
-## This is the address users are redirected to in their browser,
-## and may be different from `oidc_provider` depending on your networking.
+## This is the host address users are redirected to in their browser,
+## and may be different from `oidc_provider` host depending on your networking.
 ## If not provided (or empty string ""), the `oidc_provider` will be used.
 ##
-## Env: KOMODO_OIDC_REDIRECT
+## Note. DO NOT include the `path` part of the URL.
+## Example: `https://oidc.provider.external`
+##
+## Env: KOMODO_OIDC_REDIRECT_HOST
 ## Optional, no default.
-oidc_redirect = ""
+oidc_redirect_host = ""

 ## Give the OIDC Client ID.
 ## Env: KOMODO_OIDC_CLIENT_ID or KOMODO_OIDC_CLIENT_ID_FILE
--- a/docsite/docs/api.md
+++ b/docsite/docs/api.md
@@ -1,6 +1,50 @@
-# API
+# API and Clients

-Komodo Core exposes an http API to read data, write configuration, and execute actions. The API documentation is generated from the code and is [available here](https://docs.rs/komodo_client/latest/komodo_client/api/index.html).
+Komodo Core exposes an RPC-like HTTP API to read data, write configuration, and execute actions.
+There are typesafe clients available in
+[**Rust**](/docs/api#rust-client) and [**Typescript**](/docs/api#typescript-client).

-You can also install the [Komodo CLI](https://crates.io/crates/komodo_cli) to execute actions like RunBuild or DeployStack from the command line.
-This can be coupled with scripts in Komodo Repos to achieve unlimited automation.
+The full API documentation is [**available here**](https://docs.rs/komodo_client/latest/komodo_client/api/index.html).
+
+## Rust Client
+
+The Rust client is published to crates.io at [komodo_client](https://crates.io/crates/komodo_client).
+
+```rust
+let komodo = KomodoClient::new("https://demo.komo.do", "your_key", "your_secret")
+  .with_healthcheck()
+  .await?;
+
+let stacks = komodo.read(ListStacks::default()).await?;
+
+let update = komodo
+  .execute(DeployStack {
+    stack: stacks[0].name.clone(),
+    stop_time: None
+  })
+  .await?;
+```
+
+## Typescript Client
+
+The Typescript client is published to NPM at [komodo_client](https://www.npmjs.com/package/komodo_client).
+
+```ts
+import { KomodoClient, Types } from "komodo_client";
+
+const komodo = KomodoClient("https://demo.komo.do", {
+  type: "api-key",
+  params: {
+    api_key: "your_key",
+    secret: "your secret",
+  },
+});
+
+// Inferred as Types.StackListItem[]
+const stacks = await komodo.read("ListStacks", {});
+
+// Inferred as Types.Update
+const update = await komodo.execute("DeployStack", {
+  stack: stacks[0].name,
+});
+```
--- a/docsite/docs/build-images/builders.md
+++ b/docsite/docs/build-images/builders.md
@@ -22,7 +22,7 @@ apt upgrade -y
 curl -fsSL https://get.docker.com | sh
 systemctl enable docker.service
 systemctl enable containerd.service
-curl -sSL https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py | python3
+curl -sSL https://raw.githubusercontent.com/mbecker20/komodo/main/scripts/setup-periphery.py | HOME=/root python3
 systemctl enable periphery.service
 ```

--- a/docsite/docs/development.md
+++ b/docsite/docs/development.md
@@ -0,0 +1,54 @@
+# Development
+
+If you are looking to contribute to Komodo, this page is a launching point for setting up your Komodo development environment.
+
+## Dependencies
+
+Running Komodo from [source](https://github.com/mbecker20/komodo) requires either [Docker](https://www.docker.com/) (and can use the included [devcontainer](https://code.visualstudio.com/docs/devcontainers/containers)), or can have the development dependencies installed locally:
+
+* Backend (Core / Periphery APIs)
+    * [Rust](https://www.rust-lang.org/) stable via [rustup installer](https://rustup.rs/)
+    * [MongoDB](https://www.mongodb.com/) or [FerretDB](https://www.ferretdb.com/) available locally.
+    * On Debian/Ubuntu: `apt install build-essential pkg-config libssl-dev` required to build the rust source.
+* Frontend (Web UI)
+    * [Node](https://nodejs.org/en) >= 18.18 + NPM
+        * [Yarn](https://yarnpkg.com/) - (Tip: use `corepack enable` after installing `node` to use `yarn`)
+    * [typeshare](https://github.com/1password/typeshare)
+    * [Deno](https://deno.com/) >= 2.0.2
+
+### runnables-cli
+
+[mbecker20/runnables-cli](https://github.com/mbecker20/runnables-cli) can be used as a convience CLI for running common project tasks found in `runfile.toml`. Otherwise, you can create your own project tasks by references the `cmd`s found in `runfile.toml`. All instructions below will use runnables-cli v1.3.7+.
+
+## Docker
+
+After making changes to the project, run `run -r test-compose-build` to rebuild Komodo and then `run -r test-compose-exposed` to start a Komodo container with the UI accessible at `localhost:9120`. Any changes made to source files will require re-running the `test-compose-build` and `test-compose-exposed` commands.
+
+## Devcontainer
+
+Use the included `.devcontainer.json` with VSCode or other compatible IDE to stand-up a full environment, including database, with one click.
+
+[VSCode Tasks](https://code.visualstudio.com/Docs/editor/tasks) are provided for building and running Komodo. 
+
+After opening the repository with the devcontainer run the task `Init` to build the frontend/backend. Then, the task `Run Komodo` can be used to run frontend/backend. Other tasks for rebuilding/running just one component of the stack (Core API, Periphery API, Frontend) are also provided.
+
+## Local
+
+To run a full Komodo instance from a non-container environment run commands in this order:
+
+* Ensure dependencies are up to date
+    * `rustup update` -- ensure rust toolchain is up to date
+* Build and Run backend
+    * `run -r test-core` -- Build and run Core API
+    * `run -r test-periphery` -- Build and run Periphery API
+* Build Frontend
+    * **Run this once** -- `run -r link-client` -- generates TS client and links to the frontend
+    * After running the above once:
+        * `run -r gen-client` -- Rebuild client 
+        * `run -r start-frontend` -- Start in dev (watch) mode
+        * `run -r build-frontend` -- Typecheck and build
+            
+
+## Docsite Development
+
+Use `run -r docsite-start` to start the [Docusaurus](https://docusaurus.io/) Komodo docs site in development mode. Changes made to files in `./docsite` will be automatically reloaded by the server.
--- a/docsite/docs/permissioning.md
+++ b/docsite/docs/permissioning.md
@@ -1,29 +1,57 @@
-# Permissioning Resources
+# Permissioning

-All Komodo resources (servers, builds, deployment) have independant permission tables to allow for users to have granular access to these resources. By default, users do not see any resources until they are given at least read permissions.
-
-## Permission Levels
-
-There are 4 levels of permissions a user can have on a resource:
-
- 1. **None**. This is the lowest permission level, and means the user will not have any access to this resource. They will not see it in the GUI, and it will not show up if the user queries the core API directly. All attempts to view or update the resource will be blocked.
-
- 2. **Read**. This is the first permission level that grants any access. It will enable the user to see the resource in the GUI, read the configuration, and see any logs. Any attempts to update configuration or trigger any action will be blocked.
-
- 3. **Execute**. This level will allow the user to execute actions on the resource, like send a build command or trigger a redeploy. The user will still be blocked from updating configuration on the resource.
-
- 4. **Write**. The user has full access to the resource, they can execute any actions, update the configuration, and delete the resource.
+Komodo has a granular, layer-based permissioning system to provide non-admin users access only to intended Resources.

 ## User Groups

-In addition to assigning permissions to users directly, admins can create User Groups and **assign permissions to them**, as if they were a user.
-Users can then be **added to multiple User Groups** and they **inherit the group's permissions**.
+While Komodo can assign permissions to specific users directly, it is recommended to instead **create User Groups and assign permissions to them**, as if they were a user.
+
+Users can then be **added to multiple User Groups** and they **inherit the group's permissions**, similar to linux permissions.
+
+For permissioning at scale, users can define [**User Groups in Resource Syncs**](/docs/sync-resources#user-group).
+
+## Permission Levels
+
+There are 4 permission levels a user / group can be given on a Resource:
+
+ 1. **None**. The user will not have any access to the resource. The user **will not see it in the GUI, and it will not show up if the user queries the Komodo API directly**. All attempts to view or update the resource will be blocked. This is the default for non-admins, unless using `KOMODO_TRANSPARENT_MODE=true`.
+
+ 2. **Read**. This is the first permission level that grants any access. It will enable the user to **see the resource in the GUI, read the configuration, and see any logs**. Any attempts to update configuration or trigger any action **will be blocked**.  Using `KOMODO_TRANSPARENT_MODE=true` will make this level the base level on all resources, for all users.
+
+ 3. **Execute**. This level will allow the user to execute actions on the resource, **like send a build command** or **trigger a redeploy**. The user will still be blocked from updating configuration on the resource.
+
+ 4. **Write**. The user has full access to the resource, **they can execute any actions, update the configuration, and delete the resource**.
+
+## Global permissions
+
+Users or User Groups can be given a base permission level on all Resources of a particular type, such as Stack.
+In TOML form, this looks like:
+
+```toml
+[[user_group]]
+name = "groupo"
+users = ["mbecker20", "karamvirsingh98"]
+all.Build = "Execute" # <- Group members can run all builds (but not update config),
+all.Stack = "Read"    # <- And see all Stacks / logs (not deploy / update).
+```
+
+A user / group can still be given a greater permission level on select resources:
+
+```toml
+permissions = [
+  { target.type = "Stack", target.id = "my-stack", level = "Execute" },
+  # Use regex to match multiple resources, for example give john execute on all of their Stacks
+  { target.type = "Stack", target.id = "\\^john-(.+)$\\", level = "Execute" },
+]
+```

 ## Administration

-Users can be given admin priviledges by accessing the Komodo MongoDB and setting ```admin: true``` on the intended user document. These users have unrestricted access to all Komodo resources, like servers, builds, and deployments. Additionally, only these users can update other (non-admin) user's permissions on resources, an action not available to regular users even with **Update** level permissions.
+Users can be given Admin priviledges by a `Super Admin` (only the first user is given this status, set with `super_admin: true` on a User document in database). Super admins will see the "Make Admin" button when on a User page `/users/${user_id}`.

-Komodo admins are responsible for managing user accounts as well. When a user logs into Komodo for the first time, they will not immediately be granted access. An admin must first **enable** the user, which can be done from the 'manage users' page (found in the user dropdown menu in the topbar). Users can also be **disabled** by an admin at any time, which blocks all their access to the GUI and API. 
+These users have unrestricted access to all Komodo Resources. Additionally, these users can update other (non-admin) user's permissions on resources.
+
+Komodo admins are responsible for managing user accounts as well. When a user logs into Komodo for the first time, they will not immediately be granted access (this can changed with `KOMODO_ENABLE_NEW_USERS=true`). An admin must first **enable** the user, which can be done from the `Users` tab on `Settings` page. Users can also be **disabled** by an admin at any time, which blocks all their access to the GUI and API. 

 Users also have some configurable global permissions, these are:

--- a/docsite/docs/procedures.md
+++ b/docsite/docs/procedures.md
@@ -0,0 +1,86 @@
+# Procedures and Actions
+
+For orchestrations involving multiple Resources, Komodo offers the `Procedure` and `Action` resource types.
+
+## Procedures
+
+`Procedures` are compositions of many executions, such as `RunBuild` and `DeployStack`.
+The executions are grouped into a series of `Stages`, where each `Stage` contains one or more executions
+to run **_all at once_**. The Procedure will wait until all of the executions in a `Stage` are complete before moving
+on to the next stage. In short, the executions in a `Stage` are run **_in parallel_**, and the stages themselves are
+executed **_sequentially_**.
+
+### Batch Executions
+
+Many executions have a `Batch` version you can select, for example [**BatchDeployStackIfChanged**](https://docs.rs/komodo_client/latest/komodo_client/api/execute/struct.BatchDeployStackIfChanged.html). With this, you can match multiple Stacks by name
+using [**wildcard syntax**](https://docs.rs/wildcard/latest/wildcard) and [**regex**](https://docs.rs/regex/latest/regex).
+
+### TOML Example
+
+Like all Resources, `Procedures` have a TOML representation, and can be managed in `ResourceSyncs`.
+
+```toml
+[[procedure]]
+name = "pull-deploy"
+description = "Pulls stack-repo, deploys stacks"
+
+[[procedure.config.stage]]
+name = "Pull Repo"
+executions = [
+  { execution.type = "PullRepo", execution.params.pattern = "stack-repo" },
+]
+
+[[procedure.config.stage]]
+name = "Deploy if changed"
+executions = [
+  # Uses the Batch version, witch matches many stacks by pattern
+  # This one matches all stacks prefixed with `foo-` (wildcard) and `bar-` (regex).
+  { execution.type = "BatchDeployStackIfChanged", execution.params.pattern = "foo-* , \\^bar-.*$\\" },
+]
+```
+
+## Actions
+
+`Actions` give users the power of Typescript to write calls to the Komodo API.
+
+For example, an `Action` script like this will align the versions and branches of many `Builds`.
+
+```ts
+const VERSION = "1.16.5";
+const BRANCH = "dev/" + VERSION;
+const APPS = ["core", "periphery"];
+const ARCHS = ["x86", "aarch64"];
+
+await komodo.write("UpdateVariableValue", {
+  name: "KOMODO_DEV_VERSION",
+  value: VERSION,
+});
+console.log("Updated KOMODO_DEV_VERSION to " + VERSION);
+
+for (const app of APPS) {
+  for (const arch of ARCHS) {
+    const name = `komodo-${app}-${arch}-dev`;
+    await komodo.write("UpdateBuild", {
+      id: name,
+      config: {
+        version: VERSION as any,
+        branch: BRANCH,
+      },
+    });
+    console.log(
+      `Updated Build ${name} to version ${VERSION} and branch ${BRANCH}`,
+    );
+  }
+}
+
+for (const arch of ARCHS) {
+  const name = `periphery-bin-${arch}-dev`;
+  await komodo.write("UpdateRepo", {
+    id: name,
+    config: {
+      branch: BRANCH,
+    },
+  });
+  console.log(`Updated Repo ${name} to branch ${BRANCH}`);
+}
+```
--- a/docsite/docs/resources.md
+++ b/docsite/docs/resources.md
@@ -12,54 +12,62 @@ All resources which depend on git repos / docker registries are able to use thes

 ## Server

-- Configure the connection to periphery agents.<br></br>
-- Set alerting thresholds.<br></br>
-- Can be attached to **Deployments**, **Stacks**, **Repos**, and **Builders**.
+- Configure the connection to periphery agents.
+- Set alerting thresholds.
+- Can be attached to by **Deployments**, **Stacks**, **Repos**, and **Builders**.

 ## Deployment

-- Deploy a docker container on the attached Server.<br></br>
-- Manage services at the container level, perform orchestration using **Procedures** and **ResourceSyncs**.
+- Deploy a docker container on the attached Server.
+- Manage services at the container level, perform orchestration using **Procedures** and **ResourceSyncs**.

 ## Stack

-- Deploy with docker compose.<br></br>
-- Provide the compose file in UI, or move the files to a git repo and use a webhook for auto redeploy on push.<br></br>
-- Supports composing multiple compose files using `docker compose -f ... -f ...`.<br></br>
-- Pass environment variables usable within the compose file. Interpolate in app-wide variables / secrets.
+- Deploy with docker compose.
+- Provide the compose file in UI, or move the files to a git repo and use a webhook for auto redeploy on push.
+- Supports composing multiple compose files using `docker compose -f ... -f ...`.
+- Pass environment variables usable within the compose file. Interpolate in app-wide variables / secrets.

 ## Repo

-- Put scripts in git repos, and run them on a Server, or using a Builder.<br></br>
-- Can build binaries, perform automation, really whatever you can think of.
+- Put scripts in git repos, and run them on a Server, or using a Builder.
+- Can build binaries, perform automation, really whatever you can think of.

 ## Build

-- Build application source into docker images, and push them to the configured registry.<br></br>
-- The source can be any git repo containing a Dockerfile.
+- Build application source into docker images, and push them to the configured registry.
+- The source can be any git repo containing a Dockerfile.

 ## Builder

-- Either points to a connected server, or holds configuration to launch a single-use AWS instance to build the image.<br></br>
-- Can be attached to **Builds** and **Repos**.
+- Either points to a connected server, or holds configuration to launch a single-use AWS instance to build the image.
+- Can be attached to **Builds** and **Repos**.

 ## Procedure

-- Compose many actions on other resource type, like `RunBuild` or `DeployStack`, and run it on button push (or with a webhook).<br></br>
-- Can run one or more actions in parallel "stages", and compose a series of parallel stages to run sequentially.
+- Compose many actions on other resource type, like `RunBuild` or `DeployStack`, and run it on button push (or with a webhook).
+- Can run one or more actions in parallel "stages", and compose a series of parallel stages to run sequentially.
+
+## Action
+
+- Write scripts calling the Komodo API in Typescript
+- Use a pre-initialized Komodo client within the script, no api keys necessary.
+- Type aware in UI editor. Get suggestions and see in depth docs as you type.
+- The Typescript client is also [published on NPM](https://www.npmjs.com/package/komodo_client).

 ## ResourceSync

-- Orchestrate all your configuration declaratively by defining it in `toml` files, which are checked into a git repo.<br></br>
-- Can deploy **Deployments** and **Stacks** if changes are suggested.<br></br>
-- Specify deploy ordering with `after` array. (like docker compose `depends_on` but can span across servers.).
+- Orchestrate all your configuration declaratively by defining it in `toml` files, which are checked into a git repo.
+- Can deploy **Deployments** and **Stacks** if changes are suggested.
+- Specify deploy ordering with `after` array. (like docker compose `depends_on` but can span across servers.).

 ## Alerter

-- Route alerts to various endpoints.<br></br>
-- Can configure rules on each Alerter, such as resource whitelist, blacklist, or alert type filter.
+- Route alerts to various endpoints.
+- Can configure rules on each Alerter, such as resource whitelist, blacklist, or alert type filter.

 ## ServerTemplate

-- Easily expand your cloud network by storing cloud server lauch templates on various providers.<br></br>
-- Auto connect the server to Komodo on launch, using `User Data` launch scripts.
+- Easily expand your cloud network by storing cloud server lauch templates on various providers.
+- Auto connect the server to Komodo on launch, using `User Data` launch scripts.
+- Currently supports **AWS EC2** and **Hetzner**
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Maxwell Becker	1f79987c58	1.16.8 (#170 ) * update configs * bump to 1.16.8	2024-11-01 14:35:12 -07:00
Maxwell Becker	e859a919c5	1.16.8 (#169 ) * use this to extract from path * Fix references to __ALL__	2024-11-01 14:33:41 -07:00
mbecker20	2a1270dd74	webhook check will return better status codex	2024-11-01 15:57:36 -04:00
Maxwell Becker	f5a59b0333	1.16.7 (#167 ) * 1.16.7 * increase builder max poll to allow User Data more time to setup periphery * rework to KOMODO_OIDC_REDIRECT_HOST	2024-10-31 21:06:01 -07:00
mbecker20	cacea235f9	replace networks empty with network_mode, replace container: network mode	2024-10-30 02:58:27 -04:00
mbecker20	54ba31dca9	gen ts types	2024-10-30 02:18:57 -04:00
Maxwell Becker	17d7ecb419	1.16.6 (#163 ) * remove instrument from validate_cancel_build * use type safe AllResources map - Action not showing omnisearch * Stack support replicated services * server docker nested tables * fix container networks which use network of another container * bump version * add 'address' to ServerListItemInfo * secrets list on variables page wraps * fix user data script * update default template user data * improve sidebar layout styling * fix network names shown on containers * improve stack service / container page * deleted resource log records Toml backup for later reference * align all the tables * add Url Builder type	2024-10-29 23:17:10 -07:00
mbecker20	38f3448790	add Procedures and Actions page	2024-10-28 00:57:42 -04:00
Maxwell Becker	ec88a6fa5a	1.16.5 (#159 ) * repo pull lock * implement BatchRunAction * other batch methods	2024-10-27 20:56:56 -07:00
mbecker20	3820cd0ca2	make Build Organization configurable with custom value	2024-10-27 14:42:06 -04:00
mbecker20	419aa87bbb	update resource toml examples to latest standard	2024-10-26 16:22:12 -04:00
Maxwell Becker	7a9ad42203	1.16.4 (#151 ) * rust client improvements and docs * sync rust client * version 1.16.4 * UI support YAML / TOML utils, typed Deno namespace * add ResourcesToml to typeshare * add YAML and TOML convenience * make the types available globally * preload container with @std/yaml and @std/toml, clean up genned files * add deno setup to alpine dockerfile	2024-10-26 12:15:34 -07:00
mbecker20	3f1cfa9064	update docs. Add Variables / Secrets docs	2024-10-25 00:02:12 -04:00
Maxwell Becker	d05c81864e	1.16.3 (#150 ) * refactor listener api implementation for Gitlab integration * version 1.16.3 * builder delete id link cleanup * refactor and add "__ALL__" branch to avoid branch filtering * frontend config the webhook url * action webhook config * clean up webhook url copy * add __ALL__ branch switch for Actions / Procedures	2024-10-24 16:03:00 -07:00
mbecker20	f1a09f34ab	tweak dev docs and runfile	2024-10-22 17:04:49 -04:00
mbecker20	23c6e6306d	fix usage of runnables-cli in dev docs	2024-10-22 16:36:25 -04:00
mbecker20	800da90561	tweaks to dev docs	2024-10-22 15:25:33 -04:00
mbecker20	b24bf6ed89	fix docsite broken links	2024-10-22 15:17:10 -04:00
Matt Foxx	d66a781a13	docs: Add development docs (#136 ) * docs: Add development POC * docs: Flesh out full build/run steps * feat: Add mergeable compose file to expose port and internal periphery url * feat: Add .devcontainer and VSCode Tasks for developing Komodo * Make cargo cache persistent in devcontainer * Add deno to devcontainer * Update tasks to include TS client copy to frontend before run * Recommend extensions for used dependencies in vscode workspace All extensions recommended are included in the devcontainer. This makes it easier for users not using devcontainer to get lang support. * Update local `run` sequence for development docs	2024-10-22 12:09:26 -07:00
Maxwell Becker	f9b2994d44	1.16.2 (#145 ) * Env vars written using same quotes (single vs double) as the user passes * fmt * trim start matches '-' * ts client version	2024-10-22 11:41:17 -07:00
mbecker20	c0d6d96b64	get username works for service users	2024-10-22 03:36:20 -04:00
mbecker20	34496b948a	bump ts client to 1.16.1	2024-10-22 02:58:42 -04:00
mbecker20	90c6adf923	fix periphery installer force file recreation command	2024-10-22 02:55:39 -04:00