chore: remove old protos

deployment/docker-compose.yaml

@@ -69,26 +69,6 @@ services:
       OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
       # UNKEY_PROMETHEUS_PORT: 2112
 
-  ctrl:
-    container_name: ctrl
-    command: ["run", "ctrl"]
-    build:
-      context: ../go
-      dockerfile: ./Dockerfile
-    depends_on:
-      - mysql
-      - otel
-    ports:
-      - "7091:7091"
-    environment:
-      UNKEY_HTTP_PORT: 7091
-      UNKEY_DATABASE_PRIMARY: "unkey:password@tcp(mysql:3306)/unkey?parseTime=true"
-      UNKEY_DATABASE_HYDRA: "unkey:password@tcp(mysql:3306)/hydra?parseTime=true"
-      UNKEY_OTEL: true
-      OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel:4318"
-      OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
-      UNKEY_AUTH_TOKEN: "ctrl-secret-token"
-
   redis:
     container_name: redis
     image: redis:latest
@@ -201,6 +181,29 @@ services:
       - clickhouse
       - chproxy
 
+  ctrl:
+    build:
+      context: ../go
+      dockerfile: Dockerfile
+      args:
+        VERSION: "latest"
+    container_name: unkey-ctrl
+    command: ["run", "ctrl"]
+    ports:
+      - "7091:7091"
+    depends_on:
+      - mysql
+    environment:
+      # Database configuration - use existing mysql service
+      UNKEY_DATABASE_PRIMARY: "unkey:password@tcp(mysql:3306)/unkey?parseTime=true"
+      UNKEY_DATABASE_HYDRA: "unkey:password@tcp(mysql:3306)/hydra?parseTime=true"
+
+      # Control plane configuration
+      UNKEY_HTTP_PORT: "7091"
+      UNKEY_METALD_ADDRESS: "http://localhost:8080"
+
+    # Override the entrypoint to run ctrl command
+
   otel:
     image: grafana/otel-lgtm:latest
     container_name: otel

go/Dockerfile

@@ -1,10 +1,10 @@
 FROM golang:1.24 AS builder
 
 WORKDIR /go/src/github.com/unkeyed/unkey/go
-COPY go.sum go.mod ./
-RUN go mod download
-
+# Copy everything first because go.mod has replace directives pointing to ./deploy/pkg/ modules
+# This ensures all local dependencies are available before go mod download
 COPY . .
+RUN go mod download
 ARG VERSION
 ENV CGO_ENABLED=0
 RUN go build -o bin/unkey -ldflags="-X 'github.com/unkeyed/unkey/go/pkg/version.Version=${VERSION}'" ./main.go

go/apps/ctrl/run.go

@@ -8,10 +8,12 @@ import (
 
 	"log/slog"
 
+	"connectrpc.com/connect"
 	"github.com/unkeyed/unkey/go/apps/ctrl/services/ctrl"
 	"github.com/unkeyed/unkey/go/apps/ctrl/services/version"
+	deployTLS "github.com/unkeyed/unkey/go/deploy/pkg/tls"
 	"github.com/unkeyed/unkey/go/gen/proto/ctrl/v1/ctrlv1connect"
-	"github.com/unkeyed/unkey/go/pkg/builder"
+	"github.com/unkeyed/unkey/go/gen/proto/metal/vmprovisioner/v1/vmprovisionerv1connect"
 	"github.com/unkeyed/unkey/go/pkg/db"
 	"github.com/unkeyed/unkey/go/pkg/hydra"
 	"github.com/unkeyed/unkey/go/pkg/otel"
@@ -99,20 +101,56 @@ func Run(ctx context.Context, cfg Config) error {
 		return fmt.Errorf("unable to create hydra worker: %w", err)
 	}
 
-	// Create the mock builder service for demo
-	builderService := builder.NewMockService()
+	// Create metald client for VM operations
+	var httpClient *http.Client
+	var authMode string
+
+	if cfg.SPIFFESocketPath != "" {
+		// Use SPIRE authentication when socket path is provided
+		tlsConfig := deployTLS.Config{
+			Mode:             deployTLS.ModeSPIFFE,
+			SPIFFESocketPath: cfg.SPIFFESocketPath,
+		}
+
+		tlsProvider, err := deployTLS.NewProvider(ctx, tlsConfig)
+		if err != nil {
+			return fmt.Errorf("failed to create TLS provider for metald: %w", err)
+		}
+
+		httpClient = tlsProvider.HTTPClient()
+		authMode = "SPIRE"
+	} else {
+		// Fall back to plain HTTP for local development
+		httpClient = &http.Client{}
+		authMode = "plain HTTP"
+	}
+
+	httpClient.Timeout = 30 * time.Second
+
+	metaldClient := vmprovisionerv1connect.NewVmServiceClient(
+		httpClient,
+		cfg.MetaldAddress,
+		connect.WithInterceptors(connect.UnaryInterceptorFunc(func(next connect.UnaryFunc) connect.UnaryFunc {
+			return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) {
+				logger.Info("Adding auth headers to metald request", "procedure", req.Spec().Procedure)
+				req.Header().Set("Authorization", "Bearer dev_user_ctrl")
+				req.Header().Set("X-Tenant-ID", "ctrl-tenant")
+				return next(ctx, req)
+			}
+		})),
+	)
+	logger.Info("metald client configured", "address", cfg.MetaldAddress, "auth_mode", authMode)
 
 	// Register deployment workflow with Hydra worker
-	// TODO: Replace nil with actual metald client when available
-	deployWorkflow := version.NewDeployWorkflow(database, logger, builderService, nil)
+	deployWorkflow := version.NewDeployWorkflow(database, logger, metaldClient)
 	err = hydra.RegisterWorkflow(hydraWorker, deployWorkflow)
 	if err != nil {
 		return fmt.Errorf("unable to register deployment workflow: %w", err)
 	}
 
 	// Create the service implementations
 	ctrlSvc := ctrl.New(cfg.InstanceID, database)
-	versionSvc := version.New(database, hydraEngine, builderService, logger)
+	versionSvc := version.New(database, hydraEngine, logger)
 
 	// Create the connect handler
 	mux := http.NewServeMux()