diff --git a/deploy.sh b/deploy.sh
index d28e088..5124943 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eux
 cd "$(dirname "$0")"
 
 check_dependencies () {
@@ -13,13 +13,13 @@ check_dependencies () {
 }
 
 # Check system's dependencies
-check_dependencies wait-for-it dig rsync sshfs lxc docker-machine
+check_dependencies wait-for-it dig rsync sshfs lxc docker-machine duplicity
 # TODO remove dependency on Docker-machine. That's what we use to provision VM on 3rd party vendors. Looking for LXD endpoint.
 
 
 MIGRATE_VPS=false
 DOMAIN_NAME=
-VPS_HOSTING_TARGET=
+VPS_HOSTING_TARGET=lxd
 RUN_CERT_RENEWAL=true
 USER_NO_BACKUP=false
 USER_RUN_RESTORE=false
@@ -32,7 +32,7 @@ DEPLOY_BTCPAY_SERVER=false
 REDEPLOY_STACK=false
 MACVLAN_INTERFACE=
 
-
+# grab any modifications from the command line.
 for i in "$@"; do
     case $i in
         --aws)
@@ -41,6 +41,8 @@ for i in "$@"; do
         ;;
         --restore)
             USER_RUN_RESTORE=true
+            RUN_CERT_RENEWAL=false
+            USER_NO_BACKUP=true
             shift
         ;;
         --update-btcpay)
@@ -55,10 +57,6 @@ for i in "$@"; do
             MIGRATE_VPS=true
             shift
         ;;
-        --storage-backend=*)
-            LXD_DISK_TO_USE="${i#*=}"
-            shift
-        ;;
         --no-cert-renew)
             RUN_CERT_RENEWAL=false
             shift
@@ -71,6 +69,10 @@ for i in "$@"; do
             BTC_CHAIN=testnet
             shift
         ;;
+        --regtest)
+            BTC_CHAIN=regtest
+            shift
+        ;;
         --reconfigure-btcpay)
             RECONFIGURE_BTCPAY_SERVER=true
             shift
@@ -81,146 +83,313 @@ for i in "$@"; do
     esac
 done
 
+# set up our default paths.
+export CLUSTERS_DIR="$HOME/ss-clusters"
+export CACHES_DIR="$HOME/ss-cache"
+export SSH_HOME="$HOME/.ssh"
+
+export REGISTRY_DOCKER_IMAGE="registry:2"
+CURRENT_REMOTE="$(lxc remote get-default)"
+export LXD_REMOTE_PATH="$CLUSTERS_DIR/$CURRENT_REMOTE"
+export CURRENT_REMOTE="$CURRENT_REMOTE"
+
+mkdir -p "$CACHES_DIR" "$LXD_REMOTE_PATH"
+
+CLUSTER_DEFINTION="$LXD_REMOTE_PATH/cluster_definition"
+export CLUSTER_DEFINTION="$CLUSTER_DEFINTION"
+if [ ! -f "$CLUSTER_DEFINTION" ]; then
+    # stub out a cluster_definition.
+    cat >"$CLUSTER_DEFINTION" <<EOL
+#!/bin/bash
+
+# Note: the path above ./ corresponds to your LXD Remote. If your remote is set to 'cluster1'
+# Then $HOME/clusters/cluster1 will be your cluster working path.
+
+# This is REQUIRED. A list of all sites in ~/sites/ that will be deployed. 
+# e.g., 'domain1.tld,domain2.tld,domain3.tld'
+SITE_LIST="domain1.tld"
+
+# REQUIRED - change the MACVLAN_INTERFACE to the host adapter that attaches to the SERVERS LAN segment/VLAN/subnet.
+MACVLAN_INTERFACE="REQUIRED_CHANGE_ME"
+#LXD_DISK_TO_USE=""
+
+# Deploy a registry cache on your management machine.
+DEPLOY_REGISTRY=true
+
+# only relevant
+export REGISTRY_URL="http://\$HOSTNAME:5000"
+export REGISTRY_USERNAME=<USERNAME TO DOCKERHUB.COM>
+export REGISTRY_PASSWORD=<PASSWORD TO DOCKERHUB.COM>
+
+export MACVLAN_INTERFACE="\$MACVLAN_INTERFACE"
+export LXD_DISK_TO_USE="\$LXD_DISK_TO_USE"
+export SITE_LIST="\$SITE_LIST"
+
+EOL
+
+    chmod 0744 "$CLUSTER_DEFINTION"
+    echo "We stubbed out a '$CLUSTER_DEFINTION' file for you."
+    echo "Use this file to customize your cluster deployment;"
+    echo "Check out 'https://www.sovereign-stack.org/cluster-definition' for an example."
+    exit 1
+fi
+
+
+# if an authorized_keys file does not exist, we'll stub one out with the current user.
+# add additional id_rsa.pub entries manually for more administrative logins.
+if [ ! -f "$LXD_REMOTE_PATH/authorized_keys" ]; then
+    cat "$SSH_HOME/id_rsa.pub" >> "$LXD_REMOTE_PATH/authorized_keys"
+    echo "INFO: Sovereign Stack just stubbed out '$LXD_REMOTE_PATH/authorized_keys'. Go update it."
+    echo "      Add ssh pubkeys for your various management machines, if any. We've stubbed it out"
+    echo "      with your ssh pubkey at '$HOME/.ssh/id_rsa.pub'."
+    exit 1
+fi
+
+
+#########################################
 # check for the env file. Source it if there.
-if [ -f "$(pwd)/env" ]; then
-    source "$(pwd)/env";
+if [ -f "$CLUSTER_DEFINTION" ]; then
+    source "$CLUSTER_DEFINTION"
+
+    ###########################3
+    # # This section is done to the management machine. We deploy a registry pull through cache on port 5000
+    # if ! docker volume list | grep -q registry_data; then
+    #     docker volume create registry_data
+    # fi
+
+    # if the registry URL isn't defined, then we just use the upstream dockerhub.
+    # recommended to run a registry cache on your management machine though.
+    if [ ! -z "$REGISTRY_URL" ]; then
+
+cat > "$LXD_REMOTE_PATH/registry.yml" <<EOL
+version: 0.1
+http:
+  addr: 0.0.0.0:5000
+  host: ${REGISTRY_URL}
+
+proxy:
+    remoteurl: ${REGISTRY_URL}
+    username: ${REGISTRY_USERNAME}
+    password: ${REGISTRY_PASSWORD}
+EOL
+
+        # enable docker swarm mode so we can support docker stacks.
+        if ! docker info | grep -q "Swarm: active"; then
+            docker swarm init
+        fi
+    
+        mkdir -p "${CACHES_DIR}/registry_images"
+
+        # run a docker reigstry pull through cache on the management 
+        if ! docker stack list | grep -q registry; then
+            docker stack deploy -c management/registry_mirror.yml registry
+        fi
+    fi
 else
-    echo "ERROR: '$(pwd)/env' does not exist. Please go run install.sh again."
+    echo "ERROR: CLUSTER DEFINITION NOT PRESENT."
     exit 1
 fi
 
-# ensure the VPS_HOSTING_TARGET
-if [ -z "$VPS_HOSTING_TARGET" ]; then
-    echo "ERROR: You MUST specicy --hosting-provider=[lxd|aws]"
-    exit 1
-fi
+# iterate through our site list as provided by operator from cluster_definition
+for i in ${SITE_LIST//,/ }; do
+    export DOMAIN_NAME="$i"
 
-if [ -z "$DOMAIN_NAME" ]; then
-    echo "ERROR: You MUST specify --domain=domain.tld"
-    exit 1
-fi
+    source ./defaults.sh
 
-export DOMAIN_NAME="$DOMAIN_NAME"
-export VPS_HOSTING_TARGET="$VPS_HOSTING_TARGET"
-export LXD_DISK_TO_USE="$LXD_DISK_TO_USE"
-export RUN_CERT_RENEWAL="$RUN_CERT_RENEWAL"
-
-export BTC_CHAIN="$BTC_CHAIN"
-export UPDATE_BTCPAY="$UPDATE_BTCPAY"
-export MIGRATE_VPS="$MIGRATE_VPS"
-export RECONFIGURE_BTCPAY_SERVER="$RECONFIGURE_BTCPAY_SERVER"
-export MACVLAN_INTERFACE="$MACVLAN_INTERFACE"
-
-# # first of all, if there are uncommited changes, we quit. You better stash your work yo!
-# if git update-index --refresh| grep -q "needs update"; then
-#     echo "ERROR: You have uncommited changes! Better stash your work with 'git stash'."
-#     exit 1
-# fi
-
-# shellcheck disable=SC1091
-source "$(pwd)/deployment/defaults.sh"
-
-# iterate over all our server endpoints and provision them if needed.
-# www
-VPS_HOSTNAME=
-for APP_TO_DEPLOY in btcpay www umbrel; do
-    FQDN=
-    export APP_TO_DEPLOY="$APP_TO_DEPLOY"
-    # shellcheck disable=SC1091
-    source "$(pwd)/deployment/shared.sh"
-
-    # skip this iteration if the site_definition says not to deploy btcpay server.
-    if [ "$APP_TO_DEPLOY" = btcpay ]; then
-        VPS_HOSTNAME="$BTCPAY_HOSTNAME"
-        MAC_ADDRESS_TO_PROVISION="$BTCPAY_MAC_ADDRESS"
-        if [ "$DEPLOY_BTCPAY_SERVER" = false ]; then
-            continue
-        fi
-    fi
-
-    # skip if the server config is set to not deploy.
-    if [ "$APP_TO_DEPLOY" = www ]; then
-        VPS_HOSTNAME="$WWW_HOSTNAME"
-        MAC_ADDRESS_TO_PROVISION="$WWW_MAC_ADDRESS"
-        if [ "$DEPLOY_WWW_SERVER" = false ]; then
-            continue
-        fi
-    fi
-
-    # skip umbrel if 
-    if [ "$APP_TO_DEPLOY" = umbrel ]; then
-        VPS_HOSTNAME="$UMBREL_HOSTNAME"
-        MAC_ADDRESS_TO_PROVISION="$UMBREL_MAC_ADDRESS"
-        if [ "$DEPLOY_UMBREL_VPS" = false ]; then
-            continue
-        fi
-    fi
-
-    export MAC_ADDRESS_TO_PROVISION="$MAC_ADDRESS_TO_PROVISION"
-    export VPS_HOSTNAME="$VPS_HOSTNAME"
-    export FQDN="$VPS_HOSTNAME.$DOMAIN_NAME"
-
-    # generate the docker yaml and nginx configs.
-    bash -c "$(pwd)/deployment/stub_docker_yml.sh"
-    bash -c "$(pwd)/deployment/stub_nginxconf.sh"
-
-    MACHINE_EXISTS=false
-    if [ "$VPS_HOSTING_TARGET" = aws ] && docker-machine ls -q | grep -q "$FQDN"; then
-        MACHINE_EXISTS=true
-    fi
-
-    if [ "$VPS_HOSTING_TARGET" = lxd ] && lxc list --format csv | grep -q "$FQDN"; then
-        MACHINE_EXISTS=true
-    fi
-
-    if [ "$USER_NO_BACKUP" = true ]; then
-        RUN_BACKUP=true
-    fi
-
-    if [ "$MACHINE_EXISTS"  = true ]; then
-        # we delete the machine if the user has directed us to
-        if [ "$MIGRATE_VPS" = true ]; then
-            # run the domain_init based on user input.
-            if [ "$USER_NO_BACKUP"  = true ]; then
-                echo "Machine exists. We don't need to back it up because the user has directed --no-backup."
-            else
-                echo "Machine exists.  Since we're going to delete it, let's grab a backup. We don't need to restore services since we're deleting it."
-                RUN_RESTORE=false RUN_BACKUP=true RUN_SERVICES=false "$(pwd)/deployment/domain_init.sh"
-            fi
-
-            # delete the remote VPS.
-            if [ "$VPS_HOSTING_TARGET" = aws ]; then
-                if [ "$APP_TO_DEPLOY" != btcpay ]; then
-                   # docker-machine rm -f "$FQDN"
-                   echo "ERROR: NOT IMPLEMENTED"
-                fi
-            elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
-                lxc delete --force "$LXD_VM_NAME"
-                USER_RUN_RESTORE=true
-            fi
-
-            # Then we run the script again to re-instantiate a new VPS, restoring all user data 
-            # if restore directory doesn't exist, then we end up with a new site.
-            echo "INFO: Recreating the remote VPS then restoring user data."
-            RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP=false RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
-        else
-            if [ "$USER_NO_BACKUP"  = true ]; then
-                RUN_BACKUP=false
-                echo "INFO: Maintaining existing VPS. RUN_BACKUP=$RUN_BACKUP RUN_RESTORE=$USER_RUN_RESTORE"
-            else
-                RUN_BACKUP=true
-                echo "INFO: Maintaining existing VPS. RUN_BACKUP=$RUN_BACKUP RUN_RESTORE=$USER_RUN_RESTORE"
-            fi
-
-            RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP="$RUN_BACKUP" RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
-        fi
+    if [ -f "$SITE_PATH/site_definition" ]; then
+        source "$SITE_PATH/site_definition"
     else
-        if [ "$MIGRATE_VPS" = true ]; then
-            echo "INFO: User has indicated to delete the machine, but it doesn't exist. Going to create it anyway."
+
+        # check to see if the enf file exists. exist if not.
+        SITE_DEFINITION_PATH="$SITE_PATH/site_definition"
+        if [ ! -f "$SITE_DEFINITION_PATH" ]; then
+        
+function new_pass {
+    apg -a 1 -M nc -n 3 -m 26 -E GHIJKLMNOPQRSTUVWXYZ | head -n1 | awk '{print $1;}'
+} 
+
+# stub out a site_definition with new passwords.
+cat >"$SITE_DEFINITION_PATH" <<EOL
+#!/bin/bash
+
+#export SITE_TITLE="Short Title of Project"
+export DOMAIN_NAME="domain.tld"
+
+# duplicitiy backup archive password
+export DUPLICITY_BACKUP_PASSPHRASE="$(new_pass)"
+
+# AWS only
+#export DDNS_PASSWORD=
+#export SMTP_PASSWORD=
+
+## WWW
+export DEPLOY_WWW_SERVER=true
+
+# REQUIRED - CHANGE ME - RESERVE ME IN DHCP
+export WWW_MAC_ADDRESS="CHANGE_ME"
+
+# Deploy APPS to www
+export DEPLOY_GHOST=true
+export DEPLOY_NOSTR=false
+export DEPLOY_NEXTCLOUD=true
+export DEPLOY_ONION_SITE=false
+export NOSTR_ACCOUNT_PUBKEY="CHANGE_ME"
+
+# passwords for WWW apps
+export GHOST_MYSQL_PASSWORD="$(new_pass)"
+export GHOST_MYSQL_ROOT_PASSWORD="$(new_pass)"
+export NEXTCLOUD_MYSQL_PASSWORD="$(new_pass)"
+export GITEA_MYSQL_PASSWORD="$(new_pass)"
+export NEXTCLOUD_MYSQL_ROOT_PASSWORD="$(new_pass)"
+export GITEA_MYSQL_ROOT_PASSWORD="$(new_pass)"
+
+
+## BTCPAY SERVER
+export DEPLOY_BTCPAY_SERVER=false
+
+# REQUIRED if DEPLOY_BTCPAY_SERVER=true
+#export BTCPAY_MAC_ADDRESS="CHANGE_ME"
+
+## BTCPAY Server
+export DEPLOY_UMBREL_VPS=false
+
+# REQUIRED if DEPLOY_UMBREL_VPS=true
+#export UMBREL_MAC_ADDRESS="CHANGE_ME"
+
+# CHAIN to DEPLOY; valid are 'testnet' and 'mainnet'
+export BTC_CHAIN=regtest
+
+EOL
+
+            chmod 0744 "$SITE_DEFINITION_PATH"
+            echo "INFO: we stubbed a new site_defintion for you at '$SITE_DEFINITION_PATH'. Go update it yo!"
+            exit 1
+
+fi
+
+        exit 1
+    fi
+
+    export VPS_HOSTING_TARGET="$VPS_HOSTING_TARGET"
+    export LXD_DISK_TO_USE="$LXD_DISK_TO_USE"
+    export RUN_CERT_RENEWAL="$RUN_CERT_RENEWAL"
+
+    export BTC_CHAIN="$BTC_CHAIN"
+    export UPDATE_BTCPAY="$UPDATE_BTCPAY"
+    export MIGRATE_VPS="$MIGRATE_VPS"
+    export RECONFIGURE_BTCPAY_SERVER="$RECONFIGURE_BTCPAY_SERVER"
+    export MACVLAN_INTERFACE="$MACVLAN_INTERFACE"
+
+    # # first of all, if there are uncommited changes, we quit. You better stash your work yo!
+    # if git update-index --refresh| grep -q "needs update"; then
+    #     echo "ERROR: You have uncommited changes! Better stash your work with 'git stash'."
+    #     exit 1
+    # fi
+
+    # iterate over all our server endpoints and provision them if needed.
+    # www
+    VPS_HOSTNAME=
+    for APP_TO_DEPLOY in btcpay www umbrel; do
+        FQDN=
+        export APP_TO_DEPLOY="$APP_TO_DEPLOY"
+        # shellcheck disable=SC1091
+        source ./shared.sh
+
+        # skip this iteration if the site_definition says not to deploy btcpay server.
+        if [ "$APP_TO_DEPLOY" = btcpay ]; then
+            VPS_HOSTNAME="$BTCPAY_HOSTNAME"
+            MAC_ADDRESS_TO_PROVISION="$BTCPAY_MAC_ADDRESS"
+            if [ "$DEPLOY_BTCPAY_SERVER" = false ]; then
+                continue
+            fi
         fi
 
-        # The machine does not exist. Let's bring it into existence, restoring from latest backup.
-        echo "Machine does not exist. RUN_RESTORE=$USER_RUN_RESTORE RUN_BACKUP=false" 
-        RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP=false RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
-    fi
+        # skip if the server config is set to not deploy.
+        if [ "$APP_TO_DEPLOY" = www ]; then
+            VPS_HOSTNAME="$WWW_HOSTNAME"
+            MAC_ADDRESS_TO_PROVISION="$WWW_MAC_ADDRESS"
+            if [ "$DEPLOY_WWW_SERVER" = false ]; then
+                continue
+            fi
+        fi
+
+        # skip umbrel if 
+        if [ "$APP_TO_DEPLOY" = umbrel ]; then
+            VPS_HOSTNAME="$UMBREL_HOSTNAME"
+            MAC_ADDRESS_TO_PROVISION="$UMBREL_MAC_ADDRESS"
+            if [ "$DEPLOY_UMBREL_VPS" = false ]; then
+                continue
+            fi
+        fi
+
+        export MAC_ADDRESS_TO_PROVISION="$MAC_ADDRESS_TO_PROVISION"
+        export VPS_HOSTNAME="$VPS_HOSTNAME"
+        export FQDN="$VPS_HOSTNAME.$DOMAIN_NAME"
+
+        # generate the docker yaml and nginx configs.
+        bash -c ./deployment/stub_docker_yml.sh
+        bash -c ./deployment/stub_nginxconf.sh
+
+        MACHINE_EXISTS=false
+        if [ "$VPS_HOSTING_TARGET" = aws ] && docker-machine ls -q | grep -q "$FQDN"; then
+            MACHINE_EXISTS=true
+        fi
+
+        if [ "$VPS_HOSTING_TARGET" = lxd ] && lxc list --format csv | grep -q "$FQDN"; then
+            MACHINE_EXISTS=true
+        fi
+
+        if [ "$USER_NO_BACKUP" = true ]; then
+            RUN_BACKUP=true
+        fi
+
+        if [ "$MACHINE_EXISTS"  = true ]; then
+            # we delete the machine if the user has directed us to
+            if [ "$MIGRATE_VPS" = true ]; then
+                # run the domain_init based on user input.
+                if [ "$USER_NO_BACKUP"  = true ]; then
+                    echo "Machine exists. We don't need to back it up because the user has directed --no-backup."
+                else
+                    echo "Machine exists.  Since we're going to delete it, let's grab a backup. We don't need to restore services since we're deleting it."
+                    RUN_RESTORE=false RUN_BACKUP=true RUN_SERVICES=false "$(pwd)/deployment/domain_init.sh"
+                fi
+
+                # delete the remote VPS.
+                if [ "$VPS_HOSTING_TARGET" = aws ]; then
+                    if [ "$APP_TO_DEPLOY" != btcpay ]; then
+                    # docker-machine rm -f "$FQDN"
+                    echo "ERROR: NOT IMPLEMENTED"
+                    fi
+                elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
+                    lxc delete --force "$LXD_VM_NAME"
+                    USER_RUN_RESTORE=true
+                fi
+
+                # Then we run the script again to re-instantiate a new VPS, restoring all user data 
+                # if restore directory doesn't exist, then we end up with a new site.
+                echo "INFO: Recreating the remote VPS then restoring user data."
+                RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP=false RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
+            else
+                if [ "$USER_NO_BACKUP"  = true ]; then
+                    RUN_BACKUP=false
+                    echo "INFO: Maintaining existing VPS. RUN_BACKUP=$RUN_BACKUP RUN_RESTORE=$USER_RUN_RESTORE"
+                else
+                    RUN_BACKUP=true
+                    echo "INFO: Maintaining existing VPS. RUN_BACKUP=$RUN_BACKUP RUN_RESTORE=$USER_RUN_RESTORE"
+                fi
+
+                RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP="$RUN_BACKUP" RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
+            fi
+        else
+            if [ "$MIGRATE_VPS" = true ]; then
+                echo "INFO: User has indicated to delete the machine, but it doesn't exist. Going to create it anyway."
+            fi
+
+            # The machine does not exist. Let's bring it into existence, restoring from latest backup.
+            echo "Machine does not exist. RUN_RESTORE=$USER_RUN_RESTORE RUN_BACKUP=false" 
+            RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP=false RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
+        fi
+    done
+
 done
+
diff --git a/deployment/backup_btcpay.sh b/deployment/backup_btcpay.sh
index c7f43dd..567c345 100755
--- a/deployment/backup_btcpay.sh
+++ b/deployment/backup_btcpay.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -ex
+set -e
 
 # take the services down, create a backup archive, then pull it down.
 ssh "$FQDN" "cd $REMOTE_HOME/btcpayserver-docker/; sudo bash -c ./backup.sh"
diff --git a/deployment/backup_www.sh b/deployment/backup_www.sh
index d56d1c2..e1f2634 100755
--- a/deployment/backup_www.sh
+++ b/deployment/backup_www.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 # TODO: We are using extra space on the remote VPS at the moment for the duplicity backup files.
diff --git a/deployment/domain_init.sh b/deployment/domain_init.sh
index a2bf3a3..c489db3 100755
--- a/deployment/domain_init.sh
+++ b/deployment/domain_init.sh
@@ -9,12 +9,6 @@ if [ ! -f "$SSH_HOME/id_rsa" ]; then
     ssh-keygen -f "$SSH_HOME/id_rsa" -t ecdsa -b 521 -N ""
 fi
 
-# if an authorized_keys file does not exist, we'll stub one out with the current user.
-# add additional id_rsa.pub entries manually for more administrative logins.
-if [ ! -f "$SITE_PATH/authorized_keys" ]; then
-    cat "$SSH_HOME/id_rsa.pub" >> "$SITE_PATH/authorized_keys"
-fi
-
 ## This is a weird if clause since we need to LEFT-ALIGN the statement below.
 SSH_STRING="Host ${FQDN}"
 if ! grep -q "$SSH_STRING" "$SSH_HOME/config"; then
@@ -43,25 +37,14 @@ if [ "$VPS_HOSTING_TARGET" = aws ]; then
 elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
     ssh-keygen -f "$SSH_HOME/known_hosts" -R "$FQDN"
 
-    #check to ensure the MACVLAN interface has been set by the user
-    if [ -z "$MACVLAN_INTERFACE" ]; then
-        echo "ERROR: MACVLAN_INTERFACE has not been defined. Use '--macvlan-interface=eno1' for example."
-        exit 1
-    fi
-
-    # let's first check to ensure there's a cert.tar.gz. We need a valid cert for testing.
-    if [ ! -f "$SITE_PATH/certs.tar.gz" ]; then
-        echo "ERROR: We need a valid cert for testing."
-        exit 1
-    fi
-
     # if the machine doesn't exist, we create it.
     if ! lxc list --format csv | grep -q "$LXD_VM_NAME"; then
         export RUN_BACKUP=false
 
         # create a base image if needed and instantiate a VM.
         if [ -z "$MAC_ADDRESS_TO_PROVISION" ]; then
-            echo "ERROR: You MUST define a MAC Address for all your machines."
+            echo "ERROR: You MUST define a MAC Address for all your machines by setting WWW_MAC_ADDRESS, BTCPAY_MAC_ADDRESS, UMBREL_MAC_ADDRESS, in your site defintion."
+            echo "INFO: IMPORTANT! You MUST have DHCP Reservations for these MAC addresses. You also need static DNS entries."
             exit 1
         fi
 
@@ -72,10 +55,16 @@ elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
     ./prepare_vps_host.sh
 fi
 
+# if the local docker client isn't logged in, do so;
+# this helps prevent docker pull errors since they throttle.
+if [ ! -f "$HOME/.docker/config.json" ]; then
+    echo "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USERNAME" --password-stdin
+fi
 
 # this tells our local docker client to target the remote endpoint via SSH
 export DOCKER_HOST="ssh://ubuntu@$FQDN"    
 
+
 # the following scripts take responsibility for the rest of the provisioning depending on the app you're deploying.
 if [ "$APP_TO_DEPLOY" = www ]; then
     ./go_www.sh
diff --git a/deployment/generate_certs.sh b/deployment/generate_certs.sh
index d1ad1cd..fcc256c 100755
--- a/deployment/generate_certs.sh
+++ b/deployment/generate_certs.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 
-set -exu
-cd "$(dirname "$0")"
+set -e
 
 
 if [ "$VPS_HOSTING_TARGET" = aws ]; then
diff --git a/deployment/go_btcpay.sh b/deployment/go_btcpay.sh
index 3c8bd6c..c6c4d9f 100755
--- a/deployment/go_btcpay.sh
+++ b/deployment/go_btcpay.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 if [ "$RUN_BACKUP"  = true ]; then
diff --git a/deployment/go_umbrel.sh b/deployment/go_umbrel.sh
index 7c2af8d..b66faa3 100755
--- a/deployment/go_umbrel.sh
+++ b/deployment/go_umbrel.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 
 ssh "$FQDN" "
   set -x
@@ -32,7 +32,7 @@ ssh "$FQDN" "
 
 # Start services back up.
 ssh "$FQDN" "
-  set -ex
+  set -e
   cd /home/ubuntu/umbrel
 
   git config pull.rebase true
diff --git a/deployment/prepare_vps_host.sh b/deployment/prepare_vps_host.sh
index d05c763..df3c2c7 100755
--- a/deployment/prepare_vps_host.sh
+++ b/deployment/prepare_vps_host.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 
 # scan the remote machine and install it's identity in our SSH known_hosts file.
 ssh-keyscan -H -t ecdsa "$FQDN" >> "$SSH_HOME/known_hosts"
diff --git a/deployment/provision_lxc.sh b/deployment/provision_lxc.sh
index 75b64f1..8eb73aa 100755
--- a/deployment/provision_lxc.sh
+++ b/deployment/provision_lxc.sh
@@ -148,4 +148,4 @@ wait_for_lxc_ip "$LXD_VM_NAME"
 run_ddns
 
 # remove any existing SSH identities for the host, then add it back.
-ssh-keygen -R "$IP_V4_ADDRESS"
\ No newline at end of file
+ssh-keygen -R "$IP_V4_ADDRESS"
diff --git a/deployment/restore_btcpay.sh b/deployment/restore_btcpay.sh
index 74e5d29..c04c514 100755
--- a/deployment/restore_btcpay.sh
+++ b/deployment/restore_btcpay.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+u
 
 # this scripts ASSUMES services have already been taken down.
 
diff --git a/deployment/run_btcpay_setup.sh b/deployment/run_btcpay_setup.sh
index ec71977..0a956f6 100755
--- a/deployment/run_btcpay_setup.sh
+++ b/deployment/run_btcpay_setup.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -ex
+set -e
 
 
 # export BTCPAY_FASTSYNC_ARCHIVE_FILENAME="utxo-snapshot-bitcoin-testnet-1445586.tar"
@@ -11,7 +11,7 @@ set -ex
 cat > "$SITE_PATH/btcpay.sh" <<EOL
 #!/bin/bash
 
-set -ex
+set -e
 
 # wait for cloud-init to complete yo
 while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
diff --git a/deployment/stub_docker_yml.sh b/deployment/stub_docker_yml.sh
index 3ceec6c..c3a0516 100755
--- a/deployment/stub_docker_yml.sh
+++ b/deployment/stub_docker_yml.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 
@@ -269,6 +269,7 @@ cat >>"$DOCKER_YAML_PATH" <<EOL
     deploy:
       restart_policy:
         condition: on-failure
+        
 EOL
 
 if [ "$DEPLOY_ONION_SITE" = true ]; then
diff --git a/deployment/stub_nginxconf.sh b/deployment/stub_nginxconf.sh
index 3a2e388..0862612 100755
--- a/deployment/stub_nginxconf.sh
+++ b/deployment/stub_nginxconf.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 
@@ -104,6 +104,7 @@ cat >>"$NGINX_CONF_PATH" <<EOL
     ssl_stapling on;
     ssl_stapling_verify on;
     resolver 198.54.117.10;
+    # TODO change resolver to local DNS resolver, or inherit from system.
 
 
     # default server if hostname not specified.
diff --git a/management/registry_mirror.yml b/management/registry_mirror.yml
new file mode 100644
index 0000000..f6c39c6
--- /dev/null
+++ b/management/registry_mirror.yml
@@ -0,0 +1,54 @@
+version: '3.8'
+services:
+  registry-mirror:
+    image: ${REGISTRY_DOCKER_IMAGE}
+    ports:
+      - 5000:5000
+    volumes:
+      - ${CACHES_DIR}/registry_images:/data
+    environment:
+      REGISTRY_HTTP_ADDR: :5000
+      REGISTRY_HTTP_HOST: http://0.0.0.0:5000
+      REGISTRY_HTTP_SECRET: ${REGISTRY_HTTP_SECRET:-CHANGEME}
+      REGISTRY_PROXY_REMOTEURL: ${REGISTRY_PROXY_REMOTEURL:-https://registry-1.docker.io}
+      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
+    configs:
+      - source: registry-config
+        target: /etc/docker/registry/config.yml
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+    # secrets:
+    #   - source: regmirror_tls_cert
+    #     target: /var/lib/registry/regmirror:5000.cert
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+    #   - source: regmirror_tls_key
+    #     target: /var/lib/registry/regmirror:5000.key
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+    #   - source: regmirror_ca_crt
+    #     target: /var/lib/registry/ca.crt
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+
+
+# secrets:
+#   regmirror_tls_cert:
+#     file: regmirror.cert
+#   regmirror_tls_key:
+#     file: regmirror.key
+#   regmirror_ca_crt:
+#     file: ca.crt
+
+configs:
+  registry-config:
+    file: ${LXD_REMOTE_PATH}/registry.yml
+
+volumes:
+  registry_data:
\ No newline at end of file