v0.14.6: changelog and README

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -1426,9 +1426,92 @@ console show and add them.
   `on_demand.evict_after_idle` / `min_lifetime` as live settings; an
   upgrade that leaves nodes behind says which; `ctl model serve` serves an
   embedding model for embedding; refreshes wait while a form is filled in.
-- Open: llmgw's `/mcp` with picture, 3D, VLM and workflow tools, so a
-  client needs no server of its own (asked by the game team); the shared
-  ComfyUI replica (H3's placement side).
+- Done 2026-10-15: llmgw's `/mcp` with picture, 3D, VLM and workflow tools,
+  so a client needs no server of its own (asked by the game team); the
+  shared ComfyUI replica (H3's placement side).
+
+## I. What other gateways do that llmgw does not (written 2026-10-16)
+
+From a comparison with Bifrost (maximhq/bifrost, Apache 2.0, Go), with
+LiteLLM and Portkey in mind. Bifrost routes to 23+ cloud providers and runs
+no model; llmgw runs the models, so most of Bifrost is either in llmgw
+already (keys, budgets, fallbacks, guardrails, tracing, SSO, HA — the last
+three paid in Bifrost) or does not apply. These four are worth taking for
+a site that runs its own models. Left until a customer asks: native
+Azure/Anthropic/Bedrock/Vertex adapters, request hooks a customer plugs in,
+routing by what a request holds. Not taken: a realtime (WebSocket audio)
+API, prompt management, an `npx` install.
+
+### I1. Answers to similar questions, not only the same one (M)
+The answer cache (`internal/router/cache.go`, C17) answers a request whose
+body is the same byte for byte. A help desk asked "how do I reset my
+password" in forty wordings asks the model forty times.
+- Per project, off by default, beside the exact cache: `llmgw keys cache
+  --project P --similar 0.95` (the cosine similarity a question must reach;
+  higher is stricter). The exact cache is asked first.
+- The question embedded by a model the operator names
+  (`router.cache.embedding_model`, an embedding model in the catalog), into a
+  pgvector table per project with the answer, the model and the TTL; the
+  store's halfvec and text index work from F applies. SQLite stores keep the
+  exact cache only.
+- What counts as the question: the last user turn, with the system prompt
+  and the earlier turns hashed and required to match exactly — a similar
+  question in another conversation is not the same question. Tools,
+  `response_format` and the sampling settings also exact.
+- Said: `x-llmgw-cache: similar` with the similarity, and the usage row
+  says so; guardrails judge the request before a hit, as for the exact
+  cache. A project with `no_store` gets neither.
+- Done when: forty rewordings of one question on the PoC cost one model call
+  and 39 lookups, and an eval suite run with the cache on scores within a
+  point of the run with it off.
+
+### I2. MCP gateway: the customer's tool servers behind llmgw (L)
+`/mcp` serves llmgw's own tools. An agent inside a company also wants Jira,
+the file server, a database — each an MCP server, each today configured
+in every client with its own credentials and nobody seeing what was called.
+- Servers registered once, by an administrator: `llmgw ctl mcp add jira
+  --url https://… --header-file /etc/llmgw/secrets/jira` (HTTP transport;
+  stdio servers run on the control plane under their own user, like an
+  engine). Their credentials stay on the control plane, never in a client.
+- `/mcp` lists every server's tools, prefixed by its name (`jira.search`),
+  filtered by what the key may use: an allowlist per org, team, project or
+  key, by server or by tool, in the tenancy tree as model allowlists are.
+- Each call goes to the audit log — who, which tool, the arguments' size,
+  the outcome and how long — and through the guardrails both ways (a tool's
+  answer is prompt input). A per-tool rate limit.
+- Later, if it earns it: Bifrost's "code mode" (the tools as one typed API
+  the model writes code against), which cuts the tokens of a long tool list.
+- Done when: Claude Code given only llmgw's `/mcp` reaches a test MCP server
+  through it, a key without the grant does not see the server's tools, and
+  every call is in `ctl audit`.
+
+### I3. What llmgw adds to a request, measured (S)
+Bifrost's headline is "11 µs at 5k RPS" (its own figure, and its own pages
+disagree with it). llmgw has none, so any question about its overhead is
+answered with a guess.
+- `llmgw ctl bench --overhead`: the same load through the gateway and straight
+  at a `sim-engine` (`internal/cli/simengine.go`) that answers at once, at
+  rising request rates, with auth, accounting and the guardrails' pattern
+  checks on and off. Reports the added latency at p50/p99 and the gateway's
+  CPU per thousand requests.
+- On the PoC the CPU is oversubscribed (pve1, 28 threads for ~125 vCPUs):
+  report it as a ratio and record the host's load beside it, and repeat on
+  an idle machine before a figure goes into the README.
+- Done when: the README states the overhead, with how it was measured, and
+  CI runs the short version so a change that doubles it is seen.
+
+### I4. Several keys for one outside provider (S)
+An external model has one `api_key_file` (`internal/control/control.go`,
+where external endpoints are made). A provider's limit is per key; one key
+answering 429 makes the whole fallback answer 429.
+- `api_key_files: [a, b, c]`, each with an optional `weight`: one endpoint
+  per key (`external:<model>#<n>`), so the router's scoring, retries and
+  breakers work per key as they already do per replica. A key answering 429
+  or 401 is passed over while its breaker is open; a 401 also notifies
+  (`external_key_refused`).
+- The usage row says which key answered (by its index, never the key).
+- Done when: with two keys and one returning 429, every request is answered
+  by the other, and the console shows the one breaker open.
 
 ## D. Facts worth knowing before starting
 

CHANGELOG.md

@@ -18,16 +18,60 @@ is only released once its **exit criterion** is met, not when its code lands.
 | v0.11.0 | — | High availability from setup, the setup and console screens, usage sums and per-tenant alerts | released |
 | v0.12.0 | — | The cluster's settings in the store, in force when changed; the firewall switch; wipe | released |
 | v0.13.0 | — | The whole system stopped and started from one command; Qwen3Guard judges, on a GPU and CPUs together | released |
-| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine; v0.14.2: pictures from ComfyUI; v0.14.3: 3D models as jobs) |
+| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine; v0.14.2: pictures from ComfyUI; v0.14.3: 3D models as jobs; v0.14.4: any ComfyUI workflow as a job, presets, licences; v0.14.5: picture and 3D models that add themselves; v0.14.6: setup that explains every part and lets it be chosen, the gateway on all three HA machines) |
 | v1.0.0 | 5 | What phase 5 has left: precise KV routing proven on vLLM, the block cost picker, defragmentation across NVLink domains, prefill/decode disaggregation | planned |
 
 Until v1.0.0 the minor version is the breaking one: configuration formats and Go
 APIs change between minors without a deprecation period.
 
-## Unreleased
+## v0.14.6 — 2026-10-16
+
+Setup that says what each part of an install is and lets every one be
+chosen and set; three machines that each run the gateway, so any one can
+be lost; a cluster that loses its store's primary without losing a
+request; one ComfyUI for an environment's models; pictures, 3D and
+workflows as MCP tools; alerts asked for at setup; extended thinking.
+
+**Upgrading.**
+- No migration.
+- **Control planes**: with `control.lease_ttl` unset the lease is now 10 s
+  (was 15). Upgrade the standbys first and the leader last; a mix of
+  versions meanwhile is fine.
+- **The store** (PostgreSQL): each member is dialled for 3 s before the
+  next is tried. A store so far away that connecting takes longer needs
+  `connect_timeout=10` in its address.
+- **Nodes** notice a control plane that died without closing its
+  connection in 8 s (was 15) once they run this release.
+- **Judges installed by an earlier `server init`** keep reserving no cores
+  and 2 GB. To give them their own:
+  `llmgw ctl model resources qwen3guard-0.6b --memory 4 --cores 2`, then
+  `llmgw ctl restart --model qwen3guard-0.6b`.
+- **Patroni** replaces a lost primary within 20 s on a new cluster. On an
+  existing one, run `server init --patroni ...` again from the machine with
+  the authority; it changes only that.
+- **A floating address** keeps VRRP router id 51 until `server add --vip`
+  runs again, which moves it to one of its own; run it for every standby.
+- A request whose judge is not there yet waits up to the policy's
+  `latency_budget` for one before `fail: closed` refuses it.
 
 ### Added
 
+- **Setup lets every part be chosen, each with its settings, and says what each is.** `sudo llmgw` on a new machine lists
+  the parts of an install: the control plane, the store, the model mirror, this machine as a node, the starter model,
+  pictures and 3D, the guardrails' judge, the firewall, notifications, limits and keys, on-demand turns, an offline
+  bundle. Beside each is what it will be or what is missing without it. Space turns a part on or off, and Enter opens
+  its settings in a dialog that explains it at more length. The settings are: which starter model (six Qwen sizes, or
+  any GGUF on Hugging Face) and its context; the mirror's directory or another machine's mirror; the judge's
+  categories, copies, wait and what happens when it does not answer; the portal's language; the sign-up form; the
+  default limits; the longest a key lives; the on-demand waits. A plan page then lists what is installed and what is
+  left out, with the same install as a command. Every setting is a `server init` flag too (`--starter`,
+  `--judge-fail`, `--media`, `--max-key-ttl`, ...).
+- **Three machines are high availability for the gateway, not only the store.** With three machines, setup makes the two
+  database machines control planes too, standing by while the first leads, with an optional floating address
+  (keepalived) that follows whichever leads. Any one machine can now be lost. By command: `server init --patroni ...
+  --standbys --vip 10.0.0.160/24`. The mirror's management API answers the three control planes, so a standby that
+  comes to lead can still fetch models.
+
 - **Pictures uploaded to work from**: `/v1/files` takes `purpose=vision` or
   `user_data` besides `batch`, kept as long as job results, so a picture is
   sent once and named by its `file-…` id in the MCP tools and a workflow's
@@ -71,6 +115,42 @@ APIs change between minors without a deprecation period.
 
 ### Fixed
 
+- **The judges and the starter model divide a machine's CPUs instead of each taking all of them.** `server init` gave the
+  judge and the starter no cores of their own, so every llama.cpp engine ran on every core: two judges and the starter
+  on a 4-core control plane competed, and under load 38 of 60 requests were refused for want of a judgment. Moved to a
+  node of their own with 2 cores each, the same test refused 2. When this machine is the node, init now gives each judge
+  replica 1 core (2 from 8 cores) and the starter what is left (at most 8); judges bound for other nodes get 2 each. A
+  judge also reserves 4 GB, not 2: it uses about 3.2.
+
+- **A lost store machine stops costing requests most of a minute.** The store's connections try each member for 3 seconds,
+  not until the kernel gives up, and a connection to a machine that is gone is closed within about 10 seconds (TCP
+  keepalive, and `TCP_USER_TIMEOUT` on Linux). Patroni replaces a lost primary within 20 seconds (`ttl` 20, `loop_wait`
+  5, `retry_timeout` 5). Running `server init --patroni` again applies this to an existing cluster. Measured on three
+  VMs with the primary's power cut: about 45 seconds of hanging requests before.
+- **Leadership stays put while the store's primary is replaced.** Replacing a lost primary takes longer than the
+  leadership lease lives, so the lease had lapsed for everyone by the time the store answered again. Whoever asked first
+  took it, as often a standby as the leader. A standby that saw the store out of reach now leaves the lease alone for one
+  round after it returns, so the leader renews it, and a leader that is truly gone is replaced a round later. With that,
+  the default lease is 10 seconds (was 15). A node notices a control plane that died without closing its connection in
+  8 seconds (was 15), so it is on its way to the new leader as that one takes over.
+- **A judge replica that hangs no longer costs the request.** All the tries of a judge request shared the policy's
+  budget, so a replica that hung used it all and the try on another replica had none left: under `fail: closed` the
+  request was refused while a judge stood idle. When the first replica has not answered by half the budget, the same
+  question now goes to a replica on another machine too, and the first answer is taken. The first replica is not cut
+  short, which on a slow machine would refuse answers it was about to give. Replicas on one machine whose CPUs are taken
+  are slow together, so asking both only doubles the work there: measured that way, as many requests failed as before.
+  On such a machine the remedy is room, not a second question: judges on more than one node, more cores, or the judge
+  on a GPU.
+- **A new leader waits for the judge instead of refusing at once.** The moment a control plane takes the lead it knows no
+  judge yet. When every judge fails at once, they are asked again every 250 ms while the policy's `latency_budget` lasts,
+  so `fail: closed` no longer answers every request in those seconds with 503 (about 17 seconds of them in the test). A
+  judge that is slow is not asked again, and an alarm is raised once per request, not once per try.
+
+- Node discovery for Prometheus listed only the control plane asked and the
+  store, so a machine that is both was a control plane to one and a store
+  member to the other — scraped twice — and a standby asked alone lost every
+  node. Every control plane lists all of them alike; deploy/monitoring's
+  prometheus.yml says to scrape and ask each.
 - A model whose weights and context pool did not fit its card was added
   and then failed to make its context on every start, taking the card from
   others each time (Apertus 70B with a 65536-token pool, 8B with 131072, on

README.md

@@ -40,7 +40,7 @@ Releases track the roadmap phases; see [CHANGELOG.md](CHANGELOG.md).
 | v0.11.0 | — | High availability from setup, the setup and console screens, usage sums and per-tenant alerts | released |
 | v0.12.0 | — | The cluster's settings in the store, in force when changed; the firewall switch; wipe | released |
 | v0.13.0 | — | The whole system stopped and started from one command; Qwen3Guard judges, on a GPU and CPUs together | released |
-| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine; v0.14.2: pictures from ComfyUI; v0.14.3: 3D models as jobs; v0.14.4: any ComfyUI workflow as a job, presets, licences; v0.14.5: picture and 3D models that add themselves) |
+| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine; v0.14.2: pictures from ComfyUI; v0.14.3: 3D models as jobs; v0.14.4: any ComfyUI workflow as a job, presets, licences; v0.14.5: picture and 3D models that add themselves; v0.14.6: setup that explains every part and lets it be chosen, the gateway on all three HA machines) |
 | v1.0.0 | 5 | What phase 5 has left: precise KV routing proven on vLLM, the block cost picker, defragmentation across NVLink domains, prefill/decode disaggregation | planned |
 
 As of v0.6.0 a cluster runs unattended: agents report their hardware, the
@@ -50,6 +50,17 @@ budgets and rate limits decide who may use any of it.
 
 Since v0.11.0 (each release's detail is in [CHANGELOG.md](CHANGELOG.md)):
 
+- **Setup that explains, and high availability that is whole** (v0.14.6).
+  `sudo llmgw` lists the parts of an install, each with what it is for and
+  what is missing without it, and every one can be turned off or set: the
+  starter model and its context, the mirror's directory, the judge's
+  categories and what it does when it does not answer, limits, the
+  portal's language, pictures and 3D. With three machines each runs the
+  control plane, with a floating address on the leader, and any one can
+  be lost: on three VMs, cutting the store primary's power lost no
+  request. One ComfyUI serves an environment's models, pictures, 3D and
+  workflows are MCP tools, and `/v1/messages` gives a model's reasoning as
+  thinking blocks.
 - **Picture and 3D models that add themselves** (v0.14.5). Where a node's
   card fits flux-schnell or triposr and the catalog makes nothing of that
   kind, the leader adds it on demand, so a new cluster's portal has its

deploy/ha/README.md

@@ -1,4 +1,4 @@
-# Two control planes
+# More than one control plane
 
 llmgw handles the hard half of this itself: only one control plane places work,
 and agents find whichever one is leading. What it does not do is move client
@@ -37,7 +37,7 @@ nothing in front of the two had moved.
 So something has to. The options, in the order most people should consider
 them:
 
-**A load balancer you already run.** Health-check `/ready` on each control
+**A load balancer you already run.** Health-check `/leader` on each control
 plane and send traffic to whichever answers. This is the right answer if you
 have one, and it needs nothing else from this directory.
 
@@ -50,25 +50,50 @@ in whatever your resolvers actually honour rather than what you set, which on
 a bad day is minutes. Fine for a cluster people use interactively, wrong for
 one an agent is driving.
 
-## Check `/ready`, not `/health`
+## Check `/leader`, not `/health`
 
 This is the one thing to get right, and the obvious choice is the wrong one.
 
-`/health` says the process is up. It says nothing about whether it can serve,
+`/health` says the process is up. It says nothing about whether it leads,
 and a standby is exactly that case: alive, answering, and holding no endpoints
 at all — its reconciler placed nothing and it has no agent streams to adopt
-from. A load balancer checking `/health` would send it half the traffic, and
-half the traffic would be a 503.
+from. A standby passes client requests on to the leader, so traffic sent to
+one still works — until the leader is the machine that was lost, and there
+is nobody to pass them to.
+
+`/leader` is 200 on the control plane that leads and 503 on a standby. It is
+what keepalived follows for the floating address, and what a load balancer
+should send traffic by: to the one machine that answers 200.
+
+`/ready` is narrower: 200 only when this process has somewhere to send a
+request, so 503 on a standby and also on a leader with no model running yet.
+Checking it takes the portal and the admin pages away with the models — on a
+new cluster with no node yet, nobody can sign in to add one. Use it to stop
+sending inference only, if your load balancer can tell the paths apart.
 
-`/ready` says this process has somewhere to send a request. It is 503 on a
-standby, 503 on a leader whose replicas have all failed, and 200 when there is
-something to serve — which is the question a load balancer is actually asking.
 Both are open, because a load balancer has no key.
 
-During a failover neither passes for about the length of the lease handover:
+During a failover nothing passes for about the length of the lease handover:
 three seconds when the leader is stopped cleanly, up to the lease TTL when it
-is not. That gap is real and there is no way to have it both ways — traffic
-cannot go to a control plane that has nothing to route to.
+is not. A proxy that waits that long for a healthy machine rather than
+failing at once (Caddy's `lb_try_duration`) hides it from clients.
+
+**Caddy**, in front of three control planes — the end of
+[deploy/proxy/Caddyfile](../proxy/Caddyfile) has it with the rest of the
+settings:
+
+```
+reverse_proxy 10.0.0.157:8080 10.0.0.158:8080 10.0.0.159:8080 {
+	lb_policy first
+	health_uri /leader
+	health_interval 2s
+	lb_try_duration 15s
+	flush_interval -1
+}
+```
+
+With a floating address the address already follows the leader: give Caddy
+that one address instead.
 
 Not the admin port, for a different reason: it serves pprof, and pprof can
 dump the process heap, where API keys sit in plaintext.

deploy/ha/keepalived.conf.example

@@ -41,7 +41,9 @@ vrrp_instance llmgw {
     # MASTER on the machine you would rather serve; BACKUP on the other.
     state MASTER
     interface eth0
-    # Any number both machines agree on and nothing else on the segment uses.
+    # Any number both machines agree on and nothing else on the segment uses:
+    # another cluster's keepalived with the same one reads as an invalid
+    # password. `llmgw server add --vip` derives one from the address.
     virtual_router_id 51
     # The higher one wins while both are healthy. The weight above is enough
     # to invert this when the preferred machine's gateway is not answering.

deploy/monitoring/prometheus.yml

@@ -21,11 +21,18 @@ scrape_configs:
   # The control plane's dedicated metrics port. Not its admin listener: that one
   # is loopback because it also serves pprof, and pprof can dump the heap where
   # API keys sit in plaintext.
+  #
+  # Every control plane, one line each: the leader moves on restarts and the
+  # router's metrics are the leading one's, so scraping one alone leaves gaps
+  # — and alerts on them — whenever another leads.
   - job_name: llmgw
     static_configs:
       - targets: ['10.0.0.140:9091']
         labels:
-          instance: control-plane
+          instance: control-plane-140
+      # - targets: ['10.0.0.150:9091']
+      #   labels:
+      #     instance: control-plane-150
 
   # Every machine of the cluster, for its node exporter: network and disk
   # traffic, filesystems, CPU time. The control plane lists them — nodes,
@@ -33,10 +40,15 @@ scrape_configs:
   # nothing edited here, and each carries its llmgw id as the node label.
   # `llmgw node add` installs the exporter; on a machine added before that,
   # apt-get install prometheus-node-exporter.
+  # Asked of every control plane too: a standby lists only the control
+  # planes and the store, and they label every machine alike, so the same
+  # target from two of them is scraped once.
   - job_name: nodes
     http_sd_configs:
       - url: http://10.0.0.140:9091/prometheus/targets
         refresh_interval: 1m
+      # - url: http://10.0.0.150:9091/prometheus/targets
+      #   refresh_interval: 1m
 
   - job_name: prometheus
     static_configs:

deploy/proxy/Caddyfile

@@ -14,6 +14,7 @@ llm.example.com {
 		max_size 32MB
 	}
 
+	# One control plane. With more than one, see the end of this file.
 	reverse_proxy 127.0.0.1:8080 {
 		# Tokens are written the moment they are generated. Without this a
 		# streamed reply can arrive in bursts, and a client measuring time to
@@ -39,3 +40,36 @@ llm.example.com {
 	# Access log to stderr, which under systemd is the journal.
 	log
 }
+
+# More than one control plane (server init --standbys, server add): one of
+# them leads, the others stand by. Name them all and send to the one that
+# leads — /leader is 200 there and 503 on a standby. Not /ready: that is 503
+# on a leader with no model running yet, and would take the portal away with
+# it. A standby would pass a request on to the leader anyway, but not while
+# there is none, and the hop is for nothing.
+#
+# With a floating address (--vip) the address already follows the leader:
+# give reverse_proxy that one address instead, and keep the rest as above.
+#
+# llm.example.com {
+# 	request_body {
+# 		max_size 32MB
+# 	}
+# 	reverse_proxy 10.0.0.157:8080 10.0.0.158:8080 10.0.0.159:8080 {
+# 		# The first that is healthy: the leader, whichever it is.
+# 		lb_policy first
+# 		health_uri /leader
+# 		health_interval 2s
+# 		health_timeout 2s
+# 		# While leadership moves — a few seconds when a leader is lost —
+# 		# none is healthy; a request waits that long for one rather than
+# 		# failing at once.
+# 		lb_try_duration 15s
+# 		lb_try_interval 250ms
+# 		flush_interval -1
+# 		transport http {
+# 			response_header_timeout 15m
+# 		}
+# 	}
+# 	log
+# }

docs/install.md

@@ -89,13 +89,36 @@ CGO_ENABLED=0 go build -o llmgw ./cmd/llmgw
 
 **The short way is the screens.** On the machine that will be the control
 plane, run `sudo llmgw` with nothing after it. With nothing installed it asks
-whether this is one machine or three for high availability; for three, it asks
-for the other two — address, user, and an ssh key, the ssh agent, or a
-password, and the sudo password if sudo asks for one; or, for a machine
-nothing may log into, a join code to run there with `sudo llmgw join <code>`,
-which dials out to this one on port 7444 — checks all three before
-installing anything (system, room, clock, ports, internet, whether they reach
-one another), shows the plan, and installs. Passwords are held in memory for
+whether this is one machine or three for high availability, then lists what
+an install is made of, each part with what it is for and what is missing
+without it:
+
+| Part | | Its settings (Enter) |
+|---|---|---|
+| Control plane | always | the administrator, other names for the certificate, the portal's language, the sign-up form |
+| Store | always | SQLite or PostgreSQL on this machine; with three machines, PostgreSQL under Patroni on the other two |
+| Control plane on all three | three machines, on | a floating address for whichever leads |
+| Model mirror | on | here, and in which directory, or on another machine |
+| This machine as a node | on for one machine | |
+| Starter model | on for one machine | which: Qwen2.5 0.5B, 1.5B or 3B, Qwen3 4B, 8B or 14B, or any GGUF on Hugging Face; its context |
+| Pictures and 3D | off | |
+| Guardrails' judge | on | refuse or serve flagged when it does not answer; copies; how long it is waited for; what it refuses |
+| Firewall | on | |
+| Notifications | off | the webhooks |
+| Limits and keys | always | requests and tokens a minute; the longest a key lives |
+| Taking turns on a card | always | how long an on-demand model goes unused, and is safe after loading |
+| Offline bundle | off | the bundle and its sha256 |
+
+Space turns a part on or off; Enter opens its settings, which say more. What
+cannot go together is said before anything is done — a starter model with no
+mirror to fetch it into — and closing the message opens the setting that is
+wrong. For three machines it then asks for the other two — address, user, and
+an ssh key, the ssh agent, or a password, and the sudo password if sudo asks
+for one; or, for a machine nothing may log into, a join code to run there
+with `sudo llmgw join <code>`, which dials out to this one on port 7444 —
+checks all three before installing anything (system, room, clock, ports,
+internet, whether they reach one another). Last it shows the plan, part by
+part, what is left out and what that costs, and installs. Passwords are held in memory for
 the run only; a sudo password lets the user sudo without one until the install
 finishes, and is then taken back. At the end it shows the administrator's
 password and the command that does the same from a script.
@@ -137,7 +160,16 @@ That is the whole step. In order, it:
     machine without room for it is told so within two minutes, and why.
 
 `--no-mirror` and `--no-node` leave out 7 and 8, `--no-firewall` 9,
-`--no-guard-model` 10 and `--no-model` 11. An NVIDIA card with no working
+`--no-guard-model` 10 and `--no-model` 11. Every setting the screens ask for
+is a flag too, and the plan shows the command with them: `--starter qwen3-8b`
+(or `hf:<owner>/<repo>/<file>.gguf`) and `--starter-context`, `--mirror-dir`,
+`--judge-fail open`, `--judge-categories`, `--judge-replicas`,
+`--judge-budget`, `--language tr`, `--signup-open`, `--default-rpm`,
+`--default-tpm`, `--max-key-ttl`, `--media` (pictures and 3D: ComfyUI on the
+nodes, and `presets.auto`), `--evict-after-idle` and `--min-lifetime`. They
+go into `server.yaml` as init writes it, and become the cluster's first
+settings when it starts; a `server.yaml` already there is never overwritten,
+so run again they change nothing — the settings page does. An NVIDIA card with no working
 driver is reported rather than silently ignored; install the driver and run
 init again to serve on it.
 
@@ -2319,6 +2351,33 @@ Without authentication, `threads.store` and `threads.retain_hours` in
 `server.yaml` keep both conversations and notes in one shared pool. That is for
 one trusted machine only; see [development.md](development.md).
 
+## Three machines, each a control plane
+
+The screens' three machines are high availability for the gateway as well as
+the store: the two database machines are made control planes too, standing
+by while the first leads — what `server add`, below, does for one machine.
+By command, `--standbys` with `--patroni`, and `--vip` for the floating
+address:
+
+```
+sudo --preserve-env=SSH_AUTH_SOCK llmgw server init --admin you@example.com \
+    --patroni ubuntu@10.0.0.6 --patroni ubuntu@10.0.0.7 \
+    --standbys --vip 10.0.0.160/24 --no-node --no-model
+```
+
+| Machine | Runs |
+|---|---|
+| the first | control plane, leading at first; model mirror; etcd |
+| the other two | control plane, standing by; PostgreSQL under Patroni; etcd |
+
+etcd votes on all three and PostgreSQL is on two, so any one machine can be
+lost: a standby leads within seconds, Patroni promotes the standby database
+if it was the primary, and the floating address follows whichever leads. The
+mirror's management API answers the three control planes' addresses, not
+only its own machine's, so a standby that comes to lead can still fetch and
+add models. The mirror itself stays on the first machine: while it is down,
+models the nodes already have keep serving, and new ones wait for it.
+
 ## Two control planes
 
 Once the store is replicated (`server init --patroni`, above), one command on
@@ -2335,8 +2394,12 @@ and lets it into the store; it starts there as a standby. Every node is told
 of it within half a minute and fails over to it without being touched.
 `--vip` keeps a floating address on whichever control plane leads, with
 keepalived on both: that is the address to give clients, or a proxy in front.
-Without it, put a load balancer in front that checks `/ready` — not
-`/health`, which is 200 on a standby that would refuse every request.
+Without it, put a proxy in front that sends to whichever answers `/leader`
+with 200 — not `/health`, which is 200 on a standby too, and not `/ready`,
+which is 503 on a leader with no model yet and would take the portal away
+with it. The end of [deploy/proxy/Caddyfile](../deploy/proxy/Caddyfile) has
+Caddy doing that for three control planes, and
+[deploy/ha/](../deploy/ha/README.md#check-leader-not-health) why.
 
 - **What a failover costs.** Measured on the reference cluster, stopping the
   leader: the standby led within five seconds, every node had moved to it

docs/reference.md

@@ -948,7 +948,7 @@ work stands without being renewed.
 Only meaningful with a shared store, where a second control plane can
 see the claim. Long enough to survive a slow query or a brief network
 stall, short enough that a standby takes over before anyone has finished
-reading the alert. Zero takes the default.
+reading the alert. Zero takes the default, 10s.
 
 ## CustomNode
 

go.mod

@@ -35,6 +35,7 @@ require (
 	golang.org/x/net v0.59.0
 	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
 	golang.org/x/text v0.42.0
 	google.golang.org/protobuf v1.36.12
@@ -88,7 +89,6 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
 	go.opentelemetry.io/otel/metric v1.46.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/grpc v1.83.1 // indirect

internal/agent/agent.go

@@ -1417,11 +1417,14 @@ func Client(cfg tlsconf.Config, timeout time.Duration) (*http.Client, error) {
 // off — is never closed: nothing sends the FIN, and the agent's heartbeats sit
 // in the socket's buffer until the kernel gives up retransmitting, fifteen
 // minutes later. Found by switching off a leader: the standby took over in 14
-// seconds and the node stayed with the dead one. An HTTP/2 ping after ten
-// quiet seconds, given five to answer, finds it in a quarter of a minute.
+// seconds and the node stayed with the dead one. An HTTP/2 ping after five
+// quiet seconds, given three to answer, finds it in eight: by the time the
+// standby leads, as it does within the lease's ten seconds, the node is on
+// its way to it. At fifteen, with the lease at fifteen too, the new leader
+// went without its nodes, and so its judges, for half a minute.
 const (
-	streamIdle = 10 * time.Second
-	streamPing = 5 * time.Second
+	streamIdle = 5 * time.Second
+	streamPing = 3 * time.Second
 )
 
 // localizeSpec fills in what only this node knows.

internal/cli/serveradd.go

@@ -9,6 +9,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"hash/fnv"
 	"io"
 	"net"
 	"os"
@@ -44,6 +45,11 @@ type serverAdd struct {
 	// addr is the machine's address as given; ip what the others reach it at.
 	addr, ip, name string
 	out            io.Writer
+	// priority is its keepalived priority, under this machine's 110; 0 is
+	// 100. Two standbys get two, so which takes the address is not a tie.
+	priority int
+	// quiet leaves out the closing sentence, for init, which says its own.
+	quiet bool
 }
 
 func newServerAddCmd() *cobra.Command {
@@ -148,7 +154,9 @@ func (sa *serverAdd) run(ctx context.Context) error {
 			return fmt.Errorf("%s: %w", s.name, err)
 		}
 	}
-	fmt.Fprintf(sa.out, "\n%s is a control plane of this cluster, standing by while this one leads.\n", sa.name)
+	if !sa.quiet {
+		fmt.Fprintf(sa.out, "\n%s is a control plane of this cluster, standing by while this one leads.\n", sa.name)
+	}
 	return nil
 }
 
@@ -511,18 +519,31 @@ func (sa *serverAdd) floating(ctx context.Context) error {
 		return err
 	}
 	here := pgha.Local{}
+	priority := sa.priority
+	if priority <= 0 {
+		priority = 100
+	}
 	for _, m := range []struct {
 		r        onboard.Remote
 		name     string
 		priority int
-	}{{here, "this machine", 110}, {sa.remote, sa.name, 100}} {
+	}{{here, "this machine", 110}, {sa.remote, sa.name, priority}} {
+		// The interface on the address's network, by its route: not the
+		// route to the address, which is lo on the machine holding it
+		// already, as a run after the first finds it.
 		out, err := m.r.Run(ctx, fmt.Sprintf(`set -e
 command -v keepalived >/dev/null 2>&1 || { sudo DEBIAN_FRONTEND=noninteractive apt-get -qq update >/dev/null; sudo DEBIAN_FRONTEND=noninteractive apt-get -qq install -y keepalived >/dev/null; }
-ip -o route get %s | awk '{for(i=1;i<=NF;i++) if($i=="dev") {print $(i+1); exit}}'`, vip), nil)
+dev() { awk '{for(i=1;i<=NF;i++) if($i=="dev") {print $(i+1); exit}}'; }
+d=$(ip -o -4 route show %s | dev)
+[ -n "$d" ] && [ "$d" != lo ] || d=$(ip -o route get %s | dev)
+echo "$d"`, nw.String(), vip), nil)
 		if err != nil {
 			return fmt.Errorf("on %s: %v: %s", m.name, err, strings.TrimSpace(string(out)))
 		}
 		iface := strings.TrimSpace(string(out))
+		if iface == "" || iface == "lo" {
+			return fmt.Errorf("on %s: no interface on %s's network", m.name, sa.vip)
+		}
 		conf := keepalivedConf(iface, vip.String(), prefix, m.priority, pass)
 		if out, err := m.r.Run(ctx, `set -e
 sudo install -d -m 0755 /etc/keepalived
@@ -560,6 +581,17 @@ func vrrpPassword(etcDir string) (string, error) {
 	return pass, nil
 }
 
+// vrrpRouterID is the VRRP router id for a floating address: from the
+// address, so two clusters on one network, each with its own address, do
+// not answer each other's adverts — with one id for all, each logged the
+// other's as an invalid password, and dropped its own address's
+// announcements with them.
+func vrrpRouterID(vip string) int {
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(vip))
+	return int(h.Sum32()%255) + 1
+}
+
 func keepalivedConf(iface, vip string, prefix, priority int, pass string) string {
 	return fmt.Sprintf(`# llmgw: the gateway's floating address, on whichever control plane leads.
 vrrp_script llmgw_leader {
@@ -572,7 +604,7 @@ vrrp_script llmgw_leader {
 vrrp_instance llmgw {
   state BACKUP
   interface %s
-  virtual_router_id 51
+  virtual_router_id %d
   priority %d
   advert_int 1
   authentication {
@@ -586,7 +618,7 @@ vrrp_instance llmgw {
     llmgw_leader
   }
 }
-`, iface, priority, pass, vip, prefix)
+`, iface, vrrpRouterID(vip), priority, pass, vip, prefix)
 }
 
 // clientCapable says a control plane's certificate can also present itself

internal/cli/serverinit.go

@@ -95,9 +95,34 @@ type serverInit struct {
 	// bundle is an offline bundle to install from, and bundleSHA its
 	// manifest's sha256: the cluster is then set up offline.
 	bundle, bundleSHA string
-	// mirrorPath is the mirror's directory here; "" is /srv/models. A seam
-	// for tests.
+	// mirrorPath is the mirror's directory here; "" is /srv/models.
 	mirrorPath string
+
+	// What setup lets a person choose besides the parts: zero is the
+	// default (serverinit_choices.go).
+	starter    starterSpec
+	starterCtx int
+	judge      judgeSpec
+	// language is the portal's for a browser that asks for neither of its
+	// own; "" leaves it English.
+	language               string
+	signupOpen             bool
+	defaultRPM, defaultTPM int
+	maxKeyTTL              time.Duration
+	// media has the nodes install ComfyUI and the leader add a picture model
+	// and a 3D model once a card fits one.
+	media bool
+	// evictAfterIdle and minLifetime are on_demand's; zero leaves its own.
+	evictAfterIdle, minLifetime time.Duration
+	// standbys makes each machine of the replicated store a control plane
+	// too, standing by while this one leads: three machines, each able to
+	// take over. vip is a floating address, as 10.0.0.160/24, kept on
+	// whichever leads.
+	standbys bool
+	vip      string
+	// cpus is this machine's CPU count for dividing it between init's
+	// models; zero asks the machine. A seam for tests.
+	cpus int
 	// pgSetup prepares PostgreSQL and returns the store address; a seam for
 	// tests. Nil does it for real.
 	pgSetup func(context.Context) (string, error)
@@ -122,7 +147,10 @@ func newDefaultServerInit() serverInit {
 
 func newServerInitCmd() *cobra.Command {
 	in := newDefaultServerInit()
-	var plain bool
+	var (
+		plain              bool
+		starter, judgeCats string
+	)
 	cmd := &cobra.Command{
 		Use:   "init",
 		Short: "Set this machine up as a control plane and start it",
@@ -158,6 +186,9 @@ func newServerInitCmd() *cobra.Command {
 			if os.Geteuid() != 0 {
 				return errors.New("init creates a user, writes /etc and starts a service: run it as root")
 			}
+			if err := in.readChoices(starter, judgeCats); err != nil {
+				return err
+			}
 			in.out = cmd.OutOrStdout()
 			if !plain && isTerminal(in.out) {
 				return in.runInitTUI(cmd.Context(), in.out)
@@ -191,6 +222,34 @@ func newServerInitCmd() *cobra.Command {
 	f.StringArrayVar(&in.patroni, "patroni", nil,
 		"user@host of a machine to keep the store on, replicated under Patroni; give two or more. "+
 			"Installs PostgreSQL, Patroni and etcd there over ssh, and moves the existing store in")
+
+	// What server.yaml is written with; each is in it only when init writes
+	// it, never into one already there.
+	f.StringVar(&in.mirrorPath, "mirror-dir", mirrorDir, "the directory the mirror on this machine keeps model files in")
+	f.StringVar(&starter, "starter", starterName,
+		"the starter model: "+strings.Join(starterNames(), ", ")+", or hf:<owner>/<repo>/<file>.gguf")
+	f.IntVar(&in.starterCtx, "starter-context", defaultContext, "the context, in tokens, a client may use of the starter model")
+	f.StringVar(&in.judge.Fail, "judge-fail", "closed",
+		"a request no judge read in time: closed refuses it, open serves it flagged")
+	f.StringVar(&judgeCats, "judge-categories", strings.Join(defaultJudgeCategories, ","),
+		"what the judge refuses, comma-separated, of: "+strings.Join(judgeCategories, ", "))
+	f.IntVar(&in.judge.Replicas, "judge-replicas", 2, "how many copies of the judge run, each on CPUs")
+	f.DurationVar(&in.judge.Budget, "judge-budget", 5*time.Second, "how long a request waits for the judge")
+	f.StringVar(&in.language, "language", "", "the portal's language for a browser that asks for neither: en or tr")
+	f.BoolVar(&in.signupOpen, "signup-open", false, "let anyone ask for an account on the portal, to be approved by an administrator")
+	f.IntVar(&in.defaultRPM, "default-rpm", defaultRPM, "requests a minute a key may make when nothing gives it a limit")
+	f.IntVar(&in.defaultTPM, "default-tpm", defaultTPM, "tokens a minute a key may use when nothing gives it a limit")
+	f.DurationVar(&in.maxKeyTTL, "max-key-ttl", defaultMaxKeyTTL, "the longest an API key lives")
+	f.BoolVar(&in.media, "media", false,
+		"pictures and 3D: the nodes install ComfyUI, and a picture model and a 3D model are added once a card fits one")
+	f.DurationVar(&in.evictAfterIdle, "evict-after-idle", 0,
+		"how long a model loaded on demand goes unasked-for before another may have its card (0: 2m)")
+	f.DurationVar(&in.minLifetime, "min-lifetime", 0,
+		"how long a model just loaded on demand is safe from that (0: 5m)")
+	f.BoolVar(&in.standbys, "standbys", false,
+		"with --patroni, make each of those machines a control plane too, standing by while this one leads")
+	f.StringVar(&in.vip, "vip", "",
+		"with --standbys, a floating address for whichever control plane leads, as 10.0.0.160/24 (keepalived on each)")
 	return cmd
 }
 
@@ -274,6 +333,11 @@ func (in *serverInit) run(ctx context.Context) error {
 			return fmt.Errorf("starter model: %w", err)
 		}
 	}
+	if in.standbys {
+		if err := in.ensureStandbys(ctx); err != nil {
+			return fmt.Errorf("standby control planes: %w", err)
+		}
+	}
 	in.nextSteps()
 	return nil
 }
@@ -310,29 +374,45 @@ func (in *serverInit) configJudgesWith(model string) bool {
 }
 
 // guardSection is server.yaml's guard: the baseline every request passes,
-// with the judge model when there is one.
+// with the judge model, as init sets it up unless told otherwise, when there
+// is one.
 func guardSection(judge bool) string {
-	j := `      # A judge model reads what patterns cannot: violence, weapons, abuse,
+	if !judge {
+		return guardSectionFor(nil)
+	}
+	j := (&serverInit{}).judgeFor()
+	return guardSectionFor(&j)
+}
+
+// guardSectionFor is server.yaml's guard with this judge, or none.
+func guardSectionFor(j *judgeSpec) string {
+	fail := "closed"
+	jb := `      # A judge model reads what patterns cannot: violence, weapons, abuse,
       # self-harm. Installed by init; --no-guard-model leaves it out.
       # judge: {model: ` + guardModelName + `, input: block, output: block, ...}
 `
-	if judge {
-		j = `      # A judge model reads what patterns cannot: violence, crime, sexual
-      # content, self-harm, jailbreaks. Two replicas run on CPUs, about two
+	if j != nil {
+		fail = j.Fail
+		copies := map[int]string{1: "One replica runs", 2: "Two replicas run", 3: "Three replicas run"}[j.Replicas]
+		if copies == "" {
+			copies = fmt.Sprintf("%d replicas run", j.Replicas)
+		}
+		jb = `      # A judge model reads what patterns cannot: violence, crime, sexual
+      # content, self-harm, jailbreaks. ` + copies + ` on CPUs, about two
       # seconds for a short text; an answer is read every 600 characters as
       # it streams. With fail: closed, a request no judge can read within
       # latency_budget is refused (503); open serves it, flagged, unjudged.
       # PII is the patterns' (above), and copyright, unethical acts and
-      # politically sensitive topics are left out: they refuse too much
-      # ordinary work. Controversial counts as safe; controversial: unsafe
-      # makes it count. With a GPU: llmgw ctl guard judge enable --gpu, then
-      # llmgw ctl guard judge use ` + defaultGPUJudge + ` ` + guardModelName + `.
+      # politically sensitive topics are left out unless chosen: they refuse
+      # too much ordinary work. Controversial counts as safe; controversial:
+      # unsafe makes it count. With a GPU: llmgw ctl guard judge enable --gpu,
+      # then llmgw ctl guard judge use ` + defaultGPUJudge + ` ` + guardModelName + `.
       judge:
         models: [` + guardModelName + `]
         input: block
         output: block
-        categories: [Violent, Non-violent Illegal Acts, Sexual Content or Sexual Acts, Suicide & Self-Harm, Jailbreak]
-        latency_budget: 5s
+        categories: [` + strings.Join(j.Categories, ", ") + `]
+        latency_budget: ` + durationYAML(j.Budget) + `
 `
 	}
 	return `# Guardrails (docs/guardrails.md). The baseline applies to every request;
@@ -342,13 +422,13 @@ guard:
   default: [baseline]
   policies:
     baseline:
-      fail: closed
+      fail: ` + fail + `
       input:
         pii: {secret: block, card: redact}
         injection: flag
       output:
         pii: {secret: block, card: redact}
-` + j
+` + jb
 }
 
 func (in *serverInit) done(format string, a ...any) {
@@ -527,6 +607,10 @@ func (in *serverInit) certHosts() []string {
 	for _, h := range in.hosts {
 		add(h)
 	}
+	// The floating address is this machine's whenever it leads.
+	if ip, _, err := net.ParseCIDR(in.vip); err == nil {
+		add(ip.String())
+	}
 	if name, err := os.Hostname(); err == nil {
 		add(name)
 	}
@@ -565,8 +649,13 @@ func (in *serverInit) ensureConfig(context.Context) error {
 		if contact == "" {
 			contact = "platform@example.com"
 		}
-		body := fmt.Sprintf(serverConfigTemplate, in.etcDir, in.etcDir, in.etcDir,
-			in.storeAddress(), contact, guardSection(in.judgeWanted()))
+		var judge *judgeSpec
+		if in.judgeWanted() {
+			j := in.judgeFor()
+			judge = &j
+		}
+		body := in.tuneConfig(fmt.Sprintf(serverConfigTemplate, in.etcDir, in.etcDir, in.etcDir,
+			in.storeAddress(), contact, guardSectionFor(judge)))
 		if err := os.WriteFile(path, []byte(body), 0o640); err != nil {
 			return err
 		}

internal/cli/serverinit_choices.go

@@ -0,0 +1,397 @@
+package cli
+
+import (
+	"fmt"
+	"math"
+	"net"
+	"path"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/provision"
+)
+
+// What a first install lets a person choose beyond which parts it has: which
+// starter model, how the judge decides, what the portal speaks, the limits a
+// key starts with, and whether pictures and 3D come by themselves. Each zero
+// value is what init did before it could be chosen, so `llmgw server init`
+// with no flags installs what it always did.
+//
+// All of it is written into server.yaml when init writes it, and the cluster's
+// keys among it become the cluster's first settings when the control plane
+// first starts. A server.yaml already there is never overwritten, so a second
+// run changes none of it: the settings page and `llmgw ctl config` do.
+
+// starterSpec is a model init can fetch and serve so there is something to ask.
+type starterSpec struct {
+	Name, Alias, Source string
+	// SizeGB is the weights' size, for the memory a node needs; 0 is not known.
+	SizeGB float64
+	About  string
+}
+
+// starterChoices are the starters offered, smallest first: the first is the
+// default. Each is a single GGUF file, Q4_K_M.
+var starterChoices = []starterSpec{
+	{starterName, starterAlias, starterSource, 0.5, "answers at once on any CPU; fast, not clever"},
+	{"qwen2.5-1.5b-instruct", "qwen-1.5b", "hf:Qwen/Qwen2.5-1.5B-Instruct-GGUF/qwen2.5-1.5b-instruct-q4_k_m.gguf", 1.1,
+		"still quick on a CPU, and noticeably better"},
+	{"qwen2.5-3b-instruct", "qwen-3b", "hf:Qwen/Qwen2.5-3B-Instruct-GGUF/qwen2.5-3b-instruct-q4_k_m.gguf", 2.1,
+		"slow on a CPU, quick on any GPU"},
+	{"qwen3-4b", "", "hf:Qwen/Qwen3-4B-GGUF/Qwen3-4B-Q4_K_M.gguf", 2.5,
+		"thinks before it answers; a GPU is worth having"},
+	{"qwen3-8b", "", "hf:Qwen/Qwen3-8B-GGUF/Qwen3-8B-Q4_K_M.gguf", 5.0,
+		"a real assistant; a GPU with 8 GB or more"},
+	{"qwen3-14b", "", "hf:Qwen/Qwen3-14B-GGUF/Qwen3-14B-Q4_K_M.gguf", 9.0,
+		"better still; a GPU with 16 GB or more"},
+}
+
+// starterFrom reads --starter: a name from starterChoices, or the hf: source
+// of any GGUF file, named after the file.
+func starterFrom(s string) (starterSpec, error) {
+	s = strings.TrimSpace(s)
+	for _, c := range starterChoices {
+		if s == c.Name || (c.Alias != "" && s == c.Alias) {
+			return c, nil
+		}
+	}
+	if rest, ok := strings.CutPrefix(s, "hf:"); ok && strings.Count(rest, "/") >= 2 && strings.HasSuffix(strings.ToLower(rest), ".gguf") {
+		name := strings.ToLower(strings.TrimSuffix(path.Base(rest), path.Ext(rest)))
+		return starterSpec{Name: name, Source: s, About: "chosen at install"}, nil
+	}
+	var names []string
+	for _, c := range starterChoices {
+		names = append(names, c.Name)
+	}
+	return starterSpec{}, fmt.Errorf("starter %q: one of %s, or hf:<owner>/<repo>/<file>.gguf", s, strings.Join(names, ", "))
+}
+
+func starterNames() []string {
+	var out []string
+	for _, c := range starterChoices {
+		out = append(out, c.Name)
+	}
+	return out
+}
+
+// readChoices takes the flags that are not read straight into init: the
+// starter by its name, the judge's categories by commas. Then it checks them
+// all.
+func (in *serverInit) readChoices(starter, categories string) error {
+	if strings.TrimSpace(starter) != "" {
+		s, err := starterFrom(starter)
+		if err != nil {
+			return err
+		}
+		in.starter = s
+	}
+	in.judge.Categories = nil
+	for _, c := range strings.Split(categories, ",") {
+		if c = strings.TrimSpace(c); c != "" {
+			in.judge.Categories = append(in.judge.Categories, c)
+		}
+	}
+	return in.checkChoices()
+}
+
+// checkChoices says what among the choices cannot be installed.
+func (in *serverInit) checkChoices() error {
+	switch in.language {
+	case "", "en", "tr":
+	default:
+		return fmt.Errorf("language %q: en or tr", in.language)
+	}
+	switch in.judge.Fail {
+	case "", "closed", "open":
+	default:
+		return fmt.Errorf("judge fail %q: closed or open", in.judge.Fail)
+	}
+	for _, c := range in.judge.Categories {
+		if !slices.Contains(judgeCategories, c) {
+			return fmt.Errorf("judge category %q: one of %s", c, strings.Join(judgeCategories, ", "))
+		}
+	}
+	switch {
+	case in.judge.Replicas < 0 || in.judge.Replicas > 8:
+		return fmt.Errorf("judge replicas %d: from 1 to 8", in.judge.Replicas)
+	case in.judge.Budget < 0 || in.judge.Budget > time.Minute:
+		return fmt.Errorf("judge budget %s: at most a minute", in.judge.Budget)
+	case in.starterCtx < 0 || in.starterCtx > 262144:
+		return fmt.Errorf("starter context %d: at most 262144 tokens", in.starterCtx)
+	case in.starterCtx > 0 && in.starterCtx < 512:
+		return fmt.Errorf("starter context %d: at least 512 tokens", in.starterCtx)
+	case in.defaultRPM < 0 || in.defaultTPM < 0:
+		return fmt.Errorf("default limits cannot be negative")
+	case in.maxKeyTTL < 0 || (in.maxKeyTTL > 0 && in.maxKeyTTL < time.Hour):
+		return fmt.Errorf("max key ttl %s: an hour at least", in.maxKeyTTL)
+	case in.evictAfterIdle < 0 || in.minLifetime < 0:
+		return fmt.Errorf("on-demand times cannot be negative")
+	case in.vip != "" && !in.standbys:
+		return fmt.Errorf("a floating address moves between control planes: it needs the standbys")
+	}
+	if in.vip != "" {
+		ip, _, err := net.ParseCIDR(in.vip)
+		if err != nil || ip.To4() == nil {
+			return fmt.Errorf("floating address %q: an IPv4 address with its prefix, as 10.0.0.160/24", in.vip)
+		}
+	}
+	return nil
+}
+
+// starterModelSpec is the starter this install serves.
+func (in *serverInit) starterModelSpec() starterSpec {
+	if in.starter.Source == "" {
+		return starterChoices[0]
+	}
+	return in.starter
+}
+
+// minMemoryGB is what a node needs free for the starter: its weights and
+// room for its context, never less than the 2 GB it always asked.
+func (s starterSpec) minMemoryGB() int {
+	return max(2, int(math.Ceil(s.SizeGB+1.5)))
+}
+
+// defaultContext is the context a client may use of the starter.
+const defaultContext = 4096
+
+// starterContext is the context a client may use of the starter.
+func (in *serverInit) starterContext() int {
+	if in.starterCtx > 0 {
+		return in.starterCtx
+	}
+	return defaultContext
+}
+
+// judgeSpec is how the guardrails' judge decides.
+type judgeSpec struct {
+	// Fail is what is done with a request no judge read in time: closed
+	// refuses it, open serves it flagged.
+	Fail       string
+	Categories []string
+	Replicas   int
+	Budget     time.Duration
+}
+
+// judgeCategories are the ones a judge can be asked about, as Qwen3Guard
+// names them; defaultJudgeCategories those it is asked about unless told.
+var (
+	judgeCategories = []string{"Violent", "Non-violent Illegal Acts", "Sexual Content or Sexual Acts",
+		"Suicide & Self-Harm", "Jailbreak", "PII", "Unethical Acts", "Politically Sensitive Topics", "Copyright Violation"}
+	defaultJudgeCategories = judgeCategories[:5]
+)
+
+// judgeFor is the judge as this install sets it up, the defaults filled in.
+func (in *serverInit) judgeFor() judgeSpec {
+	j := in.judge
+	if j.Fail == "" {
+		j.Fail = "closed"
+	}
+	if len(j.Categories) == 0 {
+		j.Categories = defaultJudgeCategories
+	}
+	if j.Replicas <= 0 {
+		j.Replicas = 2
+	}
+	if j.Budget <= 0 {
+		j.Budget = 5 * time.Second
+	}
+	return j
+}
+
+// The configuration's limits, as init writes them unless told otherwise.
+const (
+	defaultRPM       = 60
+	defaultTPM       = 200000
+	defaultMaxKeyTTL = 2160 * time.Hour
+)
+
+// tuneConfig writes this install's choices into the server.yaml template:
+// the lines the template has, changed, and the blocks it has not, added.
+// Unchosen, the template comes back as it was.
+func (in *serverInit) tuneConfig(body string) string {
+	set := func(old, now string) {
+		if old != now {
+			body = strings.Replace(body, old, now, 1)
+		}
+	}
+	if in.signupOpen {
+		set("  signup_open: false", "  signup_open: true")
+	}
+	if in.defaultRPM > 0 {
+		set("  default_rpm: 60", "  default_rpm: "+strconv.Itoa(in.defaultRPM))
+	}
+	if in.defaultTPM > 0 {
+		set("  default_tpm: 200000", "  default_tpm: "+strconv.Itoa(in.defaultTPM))
+	}
+	if in.maxKeyTTL > 0 && in.maxKeyTTL != defaultMaxKeyTTL {
+		set("  max_key_ttl: 2160h   # 90 days", fmt.Sprintf("  max_key_ttl: %s   # %s", durationYAML(in.maxKeyTTL), days(in.maxKeyTTL)))
+	}
+	if in.language != "" {
+		set("  # language: tr", "  language: "+in.language)
+	}
+	var extra []string
+	if in.media {
+		extra = append(extra, "# Pictures and 3D, chosen at install: the nodes install ComfyUI, and the\n"+
+			"# leader adds a picture model and a 3D model by itself once a card fits\n"+
+			"# one ('llmgw ctl model presets auto off' stops it).\n"+
+			"engines:\n  comfyui: "+provision.ComfyUIVersion()+"\npresets:\n  auto: true\n")
+	}
+	if in.evictAfterIdle > 0 || in.minLifetime > 0 {
+		b := "# How models that load when asked for take turns on a card, chosen at\n# install.\non_demand:\n"
+		if in.evictAfterIdle > 0 {
+			b += "  evict_after_idle: " + durationYAML(in.evictAfterIdle) + "\n"
+		}
+		if in.minLifetime > 0 {
+			b += "  min_lifetime: " + durationYAML(in.minLifetime) + "\n"
+		}
+		extra = append(extra, b)
+	}
+	if len(extra) > 0 {
+		body += "\n" + strings.Join(extra, "\n")
+	}
+	return body
+}
+
+// durationYAML is a duration as a person writes it: 2h, 90m, 1m30s.
+func durationYAML(d time.Duration) string {
+	switch {
+	case d == 0:
+		return "0s"
+	case d%time.Hour == 0:
+		return fmt.Sprintf("%dh", d/time.Hour)
+	case d%time.Minute == 0:
+		return fmt.Sprintf("%dm", d/time.Minute)
+	}
+	return d.String()
+}
+
+func days(d time.Duration) string {
+	n := int(d.Hours() / 24)
+	if n == 1 {
+		return "1 day"
+	}
+	return fmt.Sprintf("%d days", n)
+}
+
+// initFlags is this install as `llmgw server init`'s flags, for doing it
+// again from a script; what is left at its default is left out.
+func (in *serverInit) initFlags() []string {
+	var out []string
+	add := func(flag string, v ...string) {
+		if len(v) == 0 {
+			out = append(out, flag)
+			return
+		}
+		out = append(out, flag+" "+shellWord(v[0]))
+	}
+	if in.admin != "" {
+		add("--admin", in.admin)
+	}
+	for _, h := range in.hosts {
+		add("--host", h)
+	}
+	if in.language != "" {
+		add("--language", in.language)
+	}
+	if in.signupOpen {
+		add("--signup-open")
+	}
+	if in.defaultRPM > 0 && in.defaultRPM != defaultRPM {
+		add("--default-rpm", strconv.Itoa(in.defaultRPM))
+	}
+	if in.defaultTPM > 0 && in.defaultTPM != defaultTPM {
+		add("--default-tpm", strconv.Itoa(in.defaultTPM))
+	}
+	if in.maxKeyTTL > 0 && in.maxKeyTTL != defaultMaxKeyTTL {
+		add("--max-key-ttl", durationYAML(in.maxKeyTTL))
+	}
+	if in.postgres {
+		add("--postgres")
+	}
+	for _, t := range in.patroni {
+		add("--patroni", t)
+	}
+	switch {
+	case in.mirrorURL != "":
+		add("--mirror", in.mirrorURL)
+	case in.noMirror:
+		add("--no-mirror")
+	case in.mirrorPath != "" && in.mirrorPath != mirrorDir:
+		add("--mirror-dir", in.mirrorPath)
+	}
+	if in.bundle != "" {
+		add("--bundle", in.bundle)
+		add("--bundle-sha256", in.bundleSHA)
+	}
+	if in.noNode {
+		add("--no-node")
+	}
+	if in.noModel {
+		add("--no-model")
+	} else {
+		if s := in.starterModelSpec(); s.Name != starterName {
+			v := s.Name
+			if !slices.ContainsFunc(starterChoices, func(c starterSpec) bool { return c.Name == s.Name }) {
+				v = s.Source
+			}
+			add("--starter", v)
+		}
+		if in.starterCtx > 0 && in.starterCtx != defaultContext {
+			add("--starter-context", strconv.Itoa(in.starterCtx))
+		}
+	}
+	if in.noGuardModel {
+		add("--no-guard-model")
+	} else {
+		j, d := in.judgeFor(), (&serverInit{}).judgeFor()
+		if j.Fail != d.Fail {
+			add("--judge-fail", j.Fail)
+		}
+		if !slices.Equal(j.Categories, d.Categories) {
+			add("--judge-categories", strings.Join(j.Categories, ","))
+		}
+		if j.Replicas != d.Replicas {
+			add("--judge-replicas", strconv.Itoa(j.Replicas))
+		}
+		if j.Budget != d.Budget {
+			add("--judge-budget", durationYAML(j.Budget))
+		}
+	}
+	if in.noFirewall {
+		add("--no-firewall")
+	}
+	if in.standbys {
+		add("--standbys")
+	}
+	if in.vip != "" {
+		add("--vip", in.vip)
+	}
+	for _, w := range in.webhooks {
+		for _, s := range strings.Split(w, ",") {
+			if s = strings.TrimSpace(s); s != "" {
+				add("--webhook", s)
+			}
+		}
+	}
+	if in.media {
+		add("--media")
+	}
+	if in.evictAfterIdle > 0 {
+		add("--evict-after-idle", durationYAML(in.evictAfterIdle))
+	}
+	if in.minLifetime > 0 {
+		add("--min-lifetime", durationYAML(in.minLifetime))
+	}
+	return out
+}
+
+// shellWord quotes a word for a shell when it needs it.
+func shellWord(s string) string {
+	if s != "" && !strings.ContainsAny(s, " \t\n'\"\\$`&;|<>(){}*?[]#~!") {
+		return s
+	}
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}

internal/cli/serverinit_choices_test.go

@@ -0,0 +1,208 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/config"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/pgha"
+)
+
+func TestEveryChoiceIsInTheConfigurationWrittenAndItLoads(t *testing.T) {
+	in := &serverInit{
+		language: "tr", signupOpen: true, defaultRPM: 120, defaultTPM: 50000, maxKeyTTL: 30 * 24 * time.Hour,
+		media: true, evictAfterIdle: time.Minute, minLifetime: 90 * time.Second,
+		judge: judgeSpec{Fail: "open", Categories: []string{"Violent", "PII"}, Replicas: 3, Budget: 3 * time.Second},
+	}
+	j := in.judgeFor()
+	body := in.tuneConfig(fmt.Sprintf(serverConfigTemplate, "/etc/llmgw", "/etc/llmgw", "/etc/llmgw",
+		"/var/lib/llmgw/llmgw.db", "ops@example.com", guardSectionFor(&j)))
+	path := filepath.Join(t.TempDir(), "server.yaml")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := config.Load(path)
+	if err != nil {
+		t.Fatalf("%v\n%s", err, body)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatal(err)
+	}
+	switch {
+	case cfg.Landing.Language != "tr" || !cfg.Auth.SignupOpen:
+		t.Errorf("language %q signup %v", cfg.Landing.Language, cfg.Auth.SignupOpen)
+	case cfg.Auth.DefaultRPM != 120 || cfg.Auth.DefaultTPM != 50000 || cfg.Auth.MaxKeyTTL != 30*24*time.Hour:
+		t.Errorf("limits %d %d %s", cfg.Auth.DefaultRPM, cfg.Auth.DefaultTPM, cfg.Auth.MaxKeyTTL)
+	case !cfg.Presets.Auto || cfg.Engines["comfyui"] == "":
+		t.Errorf("pictures and 3D: presets %v comfyui %q", cfg.Presets.Auto, cfg.Engines["comfyui"])
+	case cfg.OnDemand.EvictAfterIdle != time.Minute || cfg.OnDemand.MinLifetime != 90*time.Second:
+		t.Errorf("on demand %+v", cfg.OnDemand)
+	}
+	base := cfg.Guard.Policies["baseline"]
+	if base.Fail != "open" || base.Judge == nil || !slices.Equal(base.Judge.Categories, []string{"Violent", "PII"}) ||
+		base.Judge.LatencyBudget != 3*time.Second {
+		t.Errorf("the judge as written: fail %q %+v", base.Fail, base.Judge)
+	}
+	if !strings.Contains(body, "Three replicas run on CPUs") {
+		t.Error("the comment says another number of judges than run")
+	}
+}
+
+func TestNothingChosenIsTheTemplateAsItWas(t *testing.T) {
+	body := fmt.Sprintf(serverConfigTemplate, "/e", "/e", "/e", "/s.db", "a@b", guardSection(true))
+	if got := (&serverInit{}).tuneConfig(body); got != body {
+		t.Error("an install with nothing chosen writes another configuration than before")
+	}
+	// Each line tuneConfig changes is in the template, or a choice would be
+	// lost without a word.
+	for _, line := range []string{"  signup_open: false", "  default_rpm: 60", "  default_tpm: 200000",
+		"  max_key_ttl: 2160h   # 90 days", "  # language: tr"} {
+		if !strings.Contains(serverConfigTemplate, line) {
+			t.Errorf("the template has no %q", line)
+		}
+	}
+}
+
+func TestAStarterIsChosenByNameOrByItsFile(t *testing.T) {
+	s, err := starterFrom("qwen3-8b")
+	if err != nil || s.SizeGB != 5.0 || !strings.HasPrefix(s.Source, "hf:Qwen/Qwen3-8B-GGUF/") {
+		t.Errorf("by name: %+v %v", s, err)
+	}
+	s, err = starterFrom("hf:bartowski/Phi-4-GGUF/Phi-4-Q4_K_M.gguf")
+	if err != nil || s.Name != "phi-4-q4_k_m" {
+		t.Errorf("by file: %+v %v", s, err)
+	}
+	if _, err := starterFrom("gpt-5"); err == nil {
+		t.Error("a model nobody offers was taken")
+	}
+	m := starterModel(s, 8192, 0, "http://x/p.gguf", []string{"6000-24g"}, true)
+	if m.Name != "phi-4-q4_k_m" || m.ContextLength != 8192 || len(m.Aliases) != 0 ||
+		!slices.Equal(m.Profiles[0].Args, []string{"--ctx-size", "32768"}) {
+		t.Errorf("entry %+v", m)
+	}
+	big, _ := starterFrom("qwen3-14b")
+	if m := starterModel(big, 16384, 0, "http://x/q.gguf", nil, true); m.Profiles[0].MinMemoryGB != 11 ||
+		!slices.Equal(m.Profiles[0].Args, []string{"--ctx-size", "65536"}) {
+		t.Errorf("a 9 GB starter asks for %d GB, %v", m.Profiles[0].MinMemoryGB, m.Profiles[0].Args)
+	}
+}
+
+func TestTheChoicesAreTheirFlagsAgain(t *testing.T) {
+	in := &serverInit{admin: "ops@example.com", hosts: []string{"llm.example.com"}, postgres: true,
+		mirrorPath: "/data/models", noNode: true, language: "tr", media: true,
+		webhooks: []string{"https://hooks.slack.com/services/T/B/x, json:https://a.example.com/in"},
+		judge:    judgeSpec{Categories: []string{"Violent", "Jailbreak"}}, maxKeyTTL: 7 * 24 * time.Hour}
+	in.starter, _ = starterFrom("qwen3-4b")
+	got := strings.Join(in.initFlags(), " ")
+	want := "--admin ops@example.com --host llm.example.com --language tr --max-key-ttl 168h --postgres " +
+		"--mirror-dir /data/models --no-node --starter qwen3-4b --judge-categories Violent,Jailbreak " +
+		"--webhook https://hooks.slack.com/services/T/B/x --webhook json:https://a.example.com/in --media"
+	if got != want {
+		t.Errorf("flags\n got %s\nwant %s", got, want)
+	}
+	if got := strings.Join((&serverInit{}).initFlags(), " "); got != "" {
+		t.Errorf("nothing chosen is %q", got)
+	}
+	if w := shellWord("Non-violent Illegal Acts,PII"); w != "'Non-violent Illegal Acts,PII'" {
+		t.Errorf("quoted %s", w)
+	}
+}
+
+func TestChoicesThatCannotBeInstalledAreRefused(t *testing.T) {
+	for _, in := range []serverInit{
+		{language: "de"},
+		{judge: judgeSpec{Fail: "maybe"}},
+		{judge: judgeSpec{Categories: []string{"Rudeness"}}},
+		{judge: judgeSpec{Replicas: 9}},
+		{starterCtx: 100},
+		{maxKeyTTL: time.Minute},
+		{vip: "10.0.0.160/24"},
+		{standbys: true, vip: "10.0.0.160"},
+	} {
+		if err := in.checkChoices(); err == nil {
+			t.Errorf("taken: %+v", in)
+		}
+	}
+	if err := (&serverInit{standbys: true, vip: "10.0.0.160/24"}).checkChoices(); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestWithStandbysTheMirrorAnswersEveryControlPlane(t *testing.T) {
+	in := &serverInit{hosts: []string{"10.0.0.5"}, patroniNodes: []pgha.Node{
+		{Member: pgha.Member{Name: "db1", IP: "10.0.0.6"}}, {Member: pgha.Member{Name: "db2", IP: "10.0.0.7"}},
+	}}
+	if u := in.mirrorUnit(); !strings.Contains(u, "--api-listen 127.0.0.1:8082") || strings.Contains(u, "--api-allow") {
+		t.Errorf("one control plane: the API is for this machine only:\n%s", u)
+	}
+	in.standbys = true
+	u := in.mirrorUnit()
+	for _, want := range []string{"--api-listen :8082", "--api-allow 10.0.0.5", "--api-allow 10.0.0.6", "--api-allow 10.0.0.7"} {
+		if !strings.Contains(u, want) {
+			t.Errorf("the unit lacks %q:\n%s", want, u)
+		}
+	}
+	if got := in.mirrorAPIURL(); got != "http://10.0.0.5:8082" {
+		t.Errorf("the control planes reach the mirror at %s", got)
+	}
+}
+
+func TestTheFloatingAddressIsInTheCertificate(t *testing.T) {
+	in := &serverInit{vip: "10.0.0.160/24"}
+	if !slices.Contains(in.certHosts(), "10.0.0.160") {
+		t.Errorf("hosts %v", in.certHosts())
+	}
+}
+
+func TestStandbysWantTheStoresMachines(t *testing.T) {
+	in := &serverInit{standbys: true, out: &strings.Builder{}}
+	if err := in.ensureStandbys(context.Background()); err == nil || !strings.Contains(err.Error(), "--patroni") {
+		t.Errorf("standbys with nowhere to go: %v", err)
+	}
+}
+
+func TestTwoClustersOnOneNetworkKeepApartFloatingAddresses(t *testing.T) {
+	a, b := vrrpRouterID("10.0.0.161"), vrrpRouterID("10.0.0.164")
+	if a == b || a < 1 || a > 255 || b < 1 || b > 255 {
+		t.Errorf("router ids %d and %d", a, b)
+	}
+	conf := keepalivedConf("ens18", "10.0.0.164", 24, 100, "secret12")
+	if !strings.Contains(conf, fmt.Sprintf("virtual_router_id %d\n", b)) || !strings.Contains(conf, "interface ens18") {
+		t.Errorf("conf:\n%s", conf)
+	}
+}
+
+func TestTheJudgesAndTheStarterShareTheCPUsRatherThanEachTakingAll(t *testing.T) {
+	for _, c := range []struct {
+		in             serverInit
+		judge, starter int
+	}{
+		{serverInit{cpus: 4}, 1, 2},
+		{serverInit{cpus: 8}, 2, 4},
+		{serverInit{cpus: 32}, 2, 8},
+		{serverInit{cpus: 2}, 1, 0}, // nothing left: the starter shares rather than fits nowhere
+		{serverInit{cpus: 1}, 0, 0},
+		{serverInit{cpus: 4, noGuardModel: true}, 1, 4},
+		{serverInit{cpus: 8, judge: judgeSpec{Replicas: 3}}, 2, 2},
+		{serverInit{cpus: 4, noNode: true}, 2, 0}, // on nodes not known yet
+	} {
+		got := c.in.cpuPlan()
+		if got.judge != c.judge || got.starter != c.starter {
+			t.Errorf("%+v: judge %d starter %d, want %d %d", c.in, got.judge, got.starter, c.judge, c.starter)
+		}
+	}
+	m := guardModel("http://x/g.gguf", 2, 1)
+	if p := m.Profiles[0]; p.CPUCores != 1 || p.MinMemoryGB != 4 {
+		t.Errorf("judge profile: %d cores, %d GB", p.CPUCores, p.MinMemoryGB)
+	}
+	s := starterModel(starterChoices[0], defaultContext, 2, "http://x/q.gguf", []string{"6000-24g"}, true)
+	if cpu := s.Profiles[len(s.Profiles)-1]; cpu.Name != "cpu" || cpu.CPUCores != 2 || s.Profiles[0].CPUCores != 0 {
+		t.Errorf("starter: GPU profile %d cores, CPU %+v", s.Profiles[0].CPUCores, cpu)
+	}
+}

internal/cli/serverinit_cluster.go

@@ -9,7 +9,9 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -120,10 +122,36 @@ func (in *serverInit) writeUnit(path, body string) (bool, error) {
 
 func (in *serverInit) mirrorUnit() string {
 	base := "http://" + net.JoinHostPort(in.reachableAddr(), "8081")
-	return mirrorUnitFor(mirrorDir, mirrorAPI, base, nil,
+	if in.standbys {
+		return mirrorUnitFor(in.mirrorRoot(), ":8082", base, in.mirrorAllow(),
+			"'llmgw server init'. Bytes on :8081 for every node; the\n# management API for the control planes only, whichever leads.")
+	}
+	return mirrorUnitFor(in.mirrorRoot(), mirrorAPI, base, nil,
 		"'llmgw server init'. Bytes on :8081 for every node; the\n# management API on loopback only, for the control plane beside it.")
 }
 
+// localMirrorAPI is the management API of the mirror beside this control
+// plane: on loopback, or, with standbys that may lead instead, on an address
+// they reach.
+func (in *serverInit) localMirrorAPI() string {
+	if in.standbys {
+		return "http://" + net.JoinHostPort(in.reachableAddr(), "8082")
+	}
+	return "http://" + mirrorAPI
+}
+
+// mirrorAllow are the control planes the mirror's management API answers
+// besides loopback: this one by its own address, and each standby.
+func (in *serverInit) mirrorAllow() []string {
+	out := []string{in.reachableAddr()}
+	for _, n := range in.patroniNodes {
+		if !slices.Contains(out, n.IP) {
+			out = append(out, n.IP)
+		}
+	}
+	return out
+}
+
 // mirrorUnitFor is a mirror's systemd unit. allow is who, besides the
 // machine itself, may use the management API.
 func mirrorUnitFor(dir, apiListen, base string, allow []string, about string) string {
@@ -160,7 +188,7 @@ func (in *serverInit) mirrorAPIURL() string {
 	if in.mirrorURL != "" {
 		return in.mirrorURL
 	}
-	return "http://" + mirrorAPI
+	return in.localMirrorAPI()
 }
 
 // useMirror points the control plane at a mirror on another machine, set up
@@ -202,15 +230,16 @@ func (in *serverInit) ensureMirror(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	if cfg.Mirror.API != "" && cfg.Mirror.API != "http://"+mirrorAPI {
+	if cfg.Mirror.API != "" && cfg.Mirror.API != "http://"+mirrorAPI && cfg.Mirror.API != in.localMirrorAPI() {
 		in.kept("mirror at %s, as server.yaml says", cfg.Mirror.API)
 		return nil
 	}
 
-	if err := os.MkdirAll(mirrorDir, 0o755); err != nil {
+	dir := in.mirrorRoot()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return err
 	}
-	if err := in.chown(mirrorDir, true); err != nil {
+	if err := in.chown(dir, true); err != nil {
 		return err
 	}
 	changed, err := in.writeUnit(mirrorUnitPath, in.mirrorUnit())
@@ -227,21 +256,25 @@ func (in *serverInit) ensureMirror(ctx context.Context) error {
 		if err := in.systemctl(ctx, "restart", "llmgw-mirror"); err != nil {
 			return err
 		}
-		in.done("model mirror in %s, serving on :8081", mirrorDir)
+		in.done("model mirror in %s, serving on :8081", dir)
 	} else {
-		in.kept("model mirror in %s", mirrorDir)
+		in.kept("model mirror in %s", dir)
 	}
 
 	if cfg.Mirror.API == "" {
-		if err := appendMirrorBlockFor(in.configPath(), "http://"+mirrorAPI,
-			"# The model mirror on this machine, added by 'llmgw server init'. Its\n"+
-				"# management API is on loopback, so it needs no certificate."); err != nil {
+		comment := "# The model mirror on this machine, added by 'llmgw server init'. Its\n" +
+			"# management API is on loopback, so it needs no certificate."
+		if in.standbys {
+			comment = "# The model mirror on this machine, added by 'llmgw server init'. Its\n" +
+				"# management API answers the control planes' addresses only."
+		}
+		if err := appendMirrorBlockFor(in.configPath(), in.localMirrorAPI(), comment); err != nil {
 			return err
 		}
 		in.done("server.yaml points at the mirror")
 	}
 
-	m, err := mirror.NewClient("http://"+mirrorAPI, tlsconf.Config{}, 5*time.Second)
+	m, err := mirror.NewClient(in.localMirrorAPI(), tlsconf.Config{}, 5*time.Second)
 	if err != nil {
 		return err
 	}
@@ -414,8 +447,9 @@ func hasNVIDIADevice() bool {
 // --- the starter model ---
 
 // starterModel is the catalog entry: a GPU profile first when there is a card,
-// and a CPU profile always, both pinned to this machine.
-func starterModel(source string, gpuClasses []string, pinned bool) catalog.Model {
+// and a CPU profile always, both pinned to this machine. ctx is the context a
+// client may use; each engine holds four times that, for four at once.
+func starterModel(spec starterSpec, ctx, cores int, source string, gpuClasses []string, pinned bool) catalog.Model {
 	var pin map[string]string
 	if pinned {
 		pin = map[string]string{localLabelKey: localLabelValue}
@@ -424,21 +458,25 @@ func starterModel(source string, gpuClasses []string, pinned bool) catalog.Model
 	for _, class := range gpuClasses {
 		profiles = append(profiles, catalog.Profile{
 			Name: "gpu-" + class, Engine: "llamacpp", GPUClass: class,
-			Priority: 200, MinMemoryGB: 2, NodeSelector: pin,
-			Args: []string{"--ctx-size", "32768"},
+			Priority: 200, MinMemoryGB: spec.minMemoryGB(), NodeSelector: pin,
+			Args: []string{"--ctx-size", strconv.Itoa(max(32768, 4*ctx))},
 		})
 	}
 	profiles = append(profiles, catalog.Profile{
-		Name: "cpu", Engine: "llamacpp", Priority: 100, MinMemoryGB: 2, NodeSelector: pin,
-		Args: []string{"--ctx-size", "16384"},
+		Name: "cpu", Engine: "llamacpp", Priority: 100, MinMemoryGB: spec.minMemoryGB(), CPUCores: cores, NodeSelector: pin,
+		Args: []string{"--ctx-size", strconv.Itoa(max(16384, 4*ctx))},
 	})
+	var aliases []string
+	if spec.Alias != "" {
+		aliases = []string{spec.Alias}
+	}
 	return catalog.Model{
-		Name:           starterName,
-		Aliases:        []string{starterAlias},
-		Description:    "A small model init put here so there is something to try; fast, not clever.",
+		Name:           spec.Name,
+		Aliases:        aliases,
+		Description:    "The model init put here so there is something to try: " + spec.About + ".",
 		Source:         source,
 		RoutingProfile: "chat",
-		ContextLength:  4096,
+		ContextLength:  ctx,
 		MaxOutput:      1024,
 		Scaling:        catalog.Scaling{Min: 1, Max: 1},
 		Profiles:       profiles,
@@ -446,8 +484,8 @@ func starterModel(source string, gpuClasses []string, pinned bool) catalog.Model
 }
 
 // guardModel is the judge's catalog entry: CPU only, so it takes no card from
-// the models people use, on whichever node has room.
-func guardModel(source string) catalog.Model {
+// the models people use, on whichever node has room; replicas copies of it.
+func guardModel(source string, replicas, cores int) catalog.Model {
 	return catalog.Model{
 		Name:        guardModelName,
 		Description: "The guardrails' judge: reads prompts and answers for unsafe content. Not offered to clients.",
@@ -456,9 +494,11 @@ func guardModel(source string) catalog.Model {
 		Guard:       &catalog.GuardModel{Format: "qwen3guard"},
 		// Two: every judged request waits on it, and with fail: closed a
 		// judge that is not there refuses everything.
-		Scaling: catalog.Scaling{Min: 2, Max: 2},
+		Scaling: catalog.Scaling{Min: replicas, Max: replicas},
 		Profiles: []catalog.Profile{{
-			Name: "cpu", Engine: "llamacpp", Priority: 100, MinMemoryGB: 2,
+			// It uses about 3.2 GB with its context: reserving 2 filled nodes
+			// past their memory.
+			Name: "cpu", Engine: "llamacpp", Priority: 100, MinMemoryGB: 4, CPUCores: cores,
 			Args: []string{"--ctx-size", "8192"},
 		}},
 	}
@@ -469,15 +509,20 @@ func (in *serverInit) ensureStarter(ctx context.Context) error {
 	// Served here when this machine is a node, pinned so it does not wander
 	// to the first GPU node that joins; otherwise on whichever node joins.
 	pinned := !in.noNode
-	return in.ensureServed(ctx, starterName, starterSource, starterVersion, pinned,
-		func(url string, classes []string) catalog.Model { return starterModel(url, classes, pinned) })
+	spec, n := in.starterModelSpec(), in.starterContext()
+	return in.ensureServed(ctx, spec.Name, spec.Source, starterVersion, pinned,
+		func(url string, classes []string) catalog.Model {
+			return starterModel(spec, n, in.cpuPlan().starter, url, classes, pinned)
+		})
 }
 
 // ensureGuardModel fetches the guardrails' judge model into the mirror and
 // adds it to the catalog, to run on any node with room.
 func (in *serverInit) ensureGuardModel(ctx context.Context) error {
 	return in.ensureServed(ctx, guardModelName, guardModelSource, guardModelVersion, false,
-		func(url string, _ []string) catalog.Model { return guardModel(url) })
+		func(url string, _ []string) catalog.Model {
+			return guardModel(url, in.judgeFor().Replicas, in.cpuPlan().judge)
+		})
 }
 
 // ensureServed fetches a model into the mirror, adds it to the catalog, and
@@ -661,3 +706,43 @@ func waitFor(ctx context.Context, limit time.Duration, what string, done func()
 		}
 	}
 }
+
+// cpuSplit is the cores init's models reserve: each judge replica's, and
+// the starter's on CPU.
+type cpuSplit struct{ judge, starter int }
+
+// cpuPlan divides the CPUs between the judges and the starter, so that the
+// engines do not each take every core. Without it, two judge replicas and
+// the starter on one 4-core control plane all ran on all four: under load
+// most judgments missed their budget and the requests were refused.
+//
+// When this machine is the node, by its own CPUs: a core a judge under 8,
+// two from 8, and the starter what is left, up to 8, or no reservation at
+// all when nothing is, rather than a starter that fits nowhere. Otherwise
+// two a judge, on whichever node takes it, and the starter, on a node not
+// known yet, none.
+func (in *serverInit) cpuPlan() cpuSplit {
+	if in.noNode {
+		return cpuSplit{judge: 2}
+	}
+	n := in.cpus
+	if n <= 0 {
+		n = runtime.NumCPU()
+	}
+	if n < 2 {
+		return cpuSplit{}
+	}
+	judges := 0
+	if !in.noGuardModel {
+		judges = in.judgeFor().Replicas
+	}
+	judge := 1
+	if n >= 8 {
+		judge = 2
+	}
+	left := n - judges*judge
+	if left < 1 {
+		left = 0
+	}
+	return cpuSplit{judge: judge, starter: min(left, 8)}
+}

internal/cli/serverinit_cluster_test.go

@@ -28,7 +28,7 @@ func TestTheInitAgentUnitIsTheShippedUnit(t *testing.T) {
 }
 
 func TestTheStarterUsesTheGPUAndFallsBackToCPUOnThisMachine(t *testing.T) {
-	m := starterModel("http://10.0.0.5:8081/qwen2.5-0.5b-instruct/starter/q.gguf", []string{"4090-24g"}, true)
+	m := starterModel(starterChoices[0], defaultContext, 0, "http://10.0.0.5:8081/qwen2.5-0.5b-instruct/starter/q.gguf", []string{"4090-24g"}, true)
 	c, err := catalog.New([]catalog.Model{m})
 	if err != nil {
 		t.Fatalf("the starter is not a valid catalog entry: %v", err)
@@ -53,7 +53,7 @@ func TestTheStarterUsesTheGPUAndFallsBackToCPUOnThisMachine(t *testing.T) {
 		t.Error("the starter should be running, not waiting to be asked for")
 	}
 
-	if m := starterModel("http://x/q.gguf", nil, true); len(m.Profiles) != 1 || m.Profiles[0].Name != "cpu" {
+	if m := starterModel(starterChoices[0], defaultContext, 0, "http://x/q.gguf", nil, true); len(m.Profiles) != 1 || m.Profiles[0].Name != "cpu" {
 		t.Errorf("without a GPU only the CPU profile: %+v", m.Profiles)
 	}
 }
@@ -96,7 +96,7 @@ func TestTheMirrorUnitAdvertisesAnAddressNodesCanReach(t *testing.T) {
 }
 
 func TestWithNoNodeHereTheStarterGoesToTheFirstNodeThatJoins(t *testing.T) {
-	m := starterModel("http://x/q.gguf", nil, false)
+	m := starterModel(starterChoices[0], defaultContext, 0, "http://x/q.gguf", nil, false)
 	for _, p := range m.Profiles {
 		if len(p.NodeSelector) > 0 {
 			t.Errorf("profile %s is pinned to a machine that is not a node: %v", p.Name, p.NodeSelector)
@@ -171,7 +171,7 @@ func TestTheInstalledConfigurationIsHardenedAndLoads(t *testing.T) {
 }
 
 func TestTheGuardModelIsAValidJudge(t *testing.T) {
-	m := guardModel("http://10.0.0.5:8081/qwen3guard-0.6b/guard/g.gguf")
+	m := guardModel("http://10.0.0.5:8081/qwen3guard-0.6b/guard/g.gguf", 2, 2)
 	c, err := catalog.New([]catalog.Model{m})
 	if err != nil {
 		t.Fatalf("not a valid catalog entry: %v", err)

internal/cli/serverinit_patroni.go

@@ -51,6 +51,8 @@ func (in *serverInit) ensurePatroni(ctx context.Context) (err error) {
 			Remote: remote,
 		})
 	}
+	// Kept: the standbys are made control planes on the same machines.
+	in.patroniNodes = setup.DB
 	self, err := sourceIPToward(setup.DB[0].IP)
 	if err != nil {
 		return err

internal/cli/serverinit_standby.go

@@ -0,0 +1,39 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+)
+
+// Three machines, each able to take over: the store's two machines are made
+// control planes too, standing by while this one leads, as 'llmgw server add'
+// makes any machine one. With the store replicated across them and etcd's
+// three votes on the three, losing any one machine loses neither the store
+// nor the gateway. With a floating address, clients keep the one address.
+
+// ensureStandbys makes each machine of the replicated store a control plane,
+// one after the other.
+func (in *serverInit) ensureStandbys(ctx context.Context) error {
+	if len(in.patroniNodes) == 0 {
+		return errors.New("the standbys go on the store's machines: give them with --patroni")
+	}
+	var hosts []string
+	if ip, _, err := net.ParseCIDR(in.vip); err == nil {
+		hosts = []string{ip.String()}
+	}
+	for i, n := range in.patroniNodes {
+		fmt.Fprintf(in.out, "  ..    making %s a control plane too\n", n.Name)
+		sa := serverAdd{
+			etcDir: in.etcDir, pkiDir: in.pkiDir, hosts: hosts, vip: in.vip,
+			remote: n.Remote, noFirewall: in.noFirewall, addr: n.IP, ip: n.IP,
+			out: in.out, priority: 100 - 10*i, quiet: true,
+		}
+		if err := sa.run(ctx); err != nil {
+			return fmt.Errorf("%s: %w", n.Name, err)
+		}
+		in.done("%s (%s) is a control plane too, standing by while this one leads", n.Name, n.IP)
+	}
+	return nil
+}

internal/cli/tui_choices.go

@@ -0,0 +1,751 @@
+package cli
+
+import (
+	"fmt"
+	"net/mail"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/notify"
+)
+
+// The parts of an install, each chosen and each with its settings: what the
+// setup screens show before anything is installed, for one machine and for
+// three alike. Beside each part is what it is for and what is missing
+// without it; Enter opens its settings, which say the same at more length.
+
+type installPart struct {
+	title string
+	// about is what the part is, at the length its dialog has room for.
+	about string
+	// fixed parts are always installed: they have settings, not a box.
+	fixed bool
+	on    bool
+	// fields are its settings; none is a part only to tick.
+	fields []*setupField
+	// summary is a line of what it will be; off what is missing without it.
+	summary func() string
+	off     string
+	// needs, when set, says why the part cannot be had with the rest as
+	// chosen: a starter model with no mirror to fetch it into.
+	needs func() string
+}
+
+type installForm struct {
+	ha    bool
+	host  string
+	found []string
+	parts []*installPart
+	// focus is a part, or len(parts) for the button that goes on.
+	focus int
+	// open is the part whose settings are open in a dialog.
+	open   *installPart
+	dialog *setupDialog
+	// err is said in a dialog of its own; when errField is set, closing it
+	// opens that field's part with the focus on it.
+	err      string
+	errPart  *installPart
+	errField *setupField
+	height   int
+
+	standby *installPart
+	vipF    *setupField
+
+	control, store, mirror, node, starter, media, judge, firewall, alerts, limits, turns, bundle *installPart
+
+	admin, hosts, language, signup         *setupField
+	storeKind                              *setupField
+	mirrorWhere, mirrorDirF, mirrorURL     *setupField
+	starterPick, starterSource, starterCtx *setupField
+	judgeFail, judgeCopies, judgeBudget    *setupField
+	judgeCats                              []*setupField
+	webhooks                               *setupField
+	rpm, tpm, keyDays                      *setupField
+	idle, safe                             *setupField
+	bundlePath, bundleSHA                  *setupField
+}
+
+// newInstallForm is the parts as in has them: its flags, or the defaults.
+func newInstallForm(in *serverInit, host string, found []string, ha bool) *installForm {
+	f := &installForm{ha: ha, host: host, found: found, height: 24}
+
+	// --- the control plane ---
+	f.admin = textSetupField("Administrator's email", in.admin, "you@example.com",
+		"A password is made for this account and shown once, at the end.")
+	if !ha {
+		f.admin.Hint += " Leave it empty to make accounts later with 'llmgw users create'."
+	}
+	known := "none found"
+	if len(found) > 0 {
+		known = strings.Join(found, ", ")
+	}
+	f.hosts = textSetupField("Other names nodes reach this machine by", strings.Join(in.hosts, ", "),
+		"llm.example.com, 203.0.113.10",
+		"Already in its certificate: "+known+". Add a DNS name, a NAT address or a floating address, comma-separated.")
+	lang := 0
+	if in.language == "tr" {
+		lang = 1
+	}
+	f.language = choiceField("The portal speaks", []string{"English", "Türkçe"}, lang,
+		"To a browser that asks for neither. Each person can switch at the foot of any page.")
+	f.signup = choiceField("Sign-up form", []string{"closed", "open"}, map[bool]int{false: 0, true: 1}[in.signupOpen], "")
+	f.signup.Notes = []string{
+		"Accounts are made by an administrator, or come from single sign-on.",
+		"Anyone who reaches the portal can ask for an account; it waits for an administrator's approval.",
+	}
+	f.control = &installPart{
+		title: "Control plane", fixed: true, on: true,
+		about: "The gateway every request comes through, the admin API, the web portal on port 8080, and the " +
+			"certificate authority that signs every node's identity. Always installed: it is what llmgw is.\n\n" +
+			"Its authority's key stays in " + orText(in.pkiDir, defaultPKIDir) + " on this machine. Back it up: nothing recovers it.",
+		fields: []*setupField{f.admin, f.hosts, f.language, f.signup},
+		summary: func() string {
+			s := []string{}
+			if a := f.admin.Value(); a != "" {
+				s = append(s, "administrator "+a)
+			} else {
+				s = append(s, "no administrator")
+			}
+			s = append(s, f.language.Options[f.language.Choice], "sign-up "+f.signup.Options[f.signup.Choice])
+			return strings.Join(s, " · ")
+		},
+	}
+
+	// --- the store ---
+	f.storeKind = choiceField("Kept in", []string{"SQLite", "PostgreSQL"}, map[bool]int{false: 0, true: 1}[in.postgres], "")
+	f.storeKind.Notes = []string{
+		"A file on this machine. Nothing to look after; enough for one control plane and a team's traffic.",
+		"Installed here, with its own role and a generated password. For a larger store, or before adding a second control plane.",
+	}
+	f.store = &installPart{
+		title: "Store", fixed: true, on: true,
+		about: "Accounts, API keys, the catalog of models, usage and the cluster's settings live here.",
+		summary: func() string {
+			if ha {
+				return "PostgreSQL under Patroni, on the other two"
+			}
+			return f.storeKind.Options[f.storeKind.Choice] + " on this machine"
+		},
+	}
+	if ha {
+		f.store.about += "\n\nWith three machines it is PostgreSQL on the other two, replicated under Patroni: " +
+			"if the primary is lost the standby takes over in about thirty seconds, and the control plane follows. " +
+			"The machines are asked for on the next page."
+	} else {
+		f.store.fields = []*setupField{f.storeKind}
+	}
+
+	// --- control planes on all three ---
+	if ha {
+		f.vipF = textSetupField("Floating address", in.vip, "10.0.0.160/24",
+			"Optional. An unused address on these machines' network, with its prefix: keepalived keeps it on "+
+				"whichever control plane leads, and clients use it. Without one, put a load balancer in front, "+
+				"or give clients the three addresses.")
+		f.standby = &installPart{
+			title: "Control plane on all three", on: in.standbys,
+			about: "The two database machines become control planes too, standing by while this one leads. " +
+				"If the leader is lost, one of them takes over within seconds: it places models, and every node " +
+				"is told of it and fails over without being touched. With the store on two machines and etcd's " +
+				"three votes on the three, losing any one machine loses neither the store nor the gateway.\n\n" +
+				"The model mirror stays on this machine: while it is down, models the nodes already have keep " +
+				"serving, and new ones wait for it.",
+			fields: []*setupField{f.vipF},
+			off:    "the gateway runs on this machine only: if it is lost, the store survives but nothing is served until it is back",
+			summary: func() string {
+				if v := f.vipF.Value(); v != "" {
+					return "two standbys; " + v + " follows whichever leads"
+				}
+				return "two standbys; no floating address"
+			},
+		}
+	}
+
+	// --- the mirror ---
+	where := 0
+	if in.mirrorURL != "" {
+		where = 1
+	}
+	f.mirrorWhere = choiceField("Where", []string{"on this machine", "on another machine"}, where, "")
+	f.mirrorWhere.Notes = []string{
+		"Serves model files on port 8081 to every node; its management API is on loopback only.",
+		"Set up there first with 'llmgw mirror init --control-plane <this machine>'.",
+	}
+	f.mirrorDirF = textSetupField("Directory", orText(in.mirrorPath, mirrorDir), mirrorDir,
+		"Models are large: a 7B model is about 5 GB, a 70B about 40 GB. Put it on the biggest disk.")
+	f.mirrorDirF.Show = func() bool { return f.mirrorWhere.Choice == 0 }
+	f.mirrorURL = textSetupField("Its management API", in.mirrorURL, "http://10.0.0.20:8082", "")
+	f.mirrorURL.Show = func() bool { return f.mirrorWhere.Choice == 1 }
+	f.mirror = &installPart{
+		title: "Model mirror", on: !in.noMirror || in.mirrorURL != "",
+		about: "Downloads each model once, from Hugging Face or wherever it comes from, and serves the files to " +
+			"every node on the network, so ten nodes do not download the same 40 GB ten times. " +
+			"The starter model, the judge and an offline bundle go into it.",
+		fields: []*setupField{f.mirrorWhere, f.mirrorDirF, f.mirrorURL},
+		off:    "each model's files must already be on a mirror somewhere; no starter model, no judge",
+		summary: func() string {
+			if f.mirrorWhere.Choice == 1 {
+				return "at " + orText(f.mirrorURL.Value(), "(an address)")
+			}
+			return "on this machine, in " + orText(f.mirrorDirF.Value(), mirrorDir)
+		},
+	}
+
+	// --- this machine as a node ---
+	f.node = &installPart{
+		title: "This machine as a node", on: !in.noNode,
+		about: "Runs models here as well, on this machine's NVIDIA GPUs when it has them and on its CPU otherwise. " +
+			"The node installs its own engines (llama.cpp first, vLLM after where the card can run it).\n\n" +
+			"Leave it off when this machine has neither the memory nor the cards to spare: models then run on " +
+			"the nodes added later with 'llmgw node add'.",
+		off:     "models run only on nodes added later",
+		summary: func() string { return "serves models here, on its GPUs or its CPU" },
+	}
+	if ha {
+		f.node.about += " With three machines the control plane usually serves none."
+	}
+
+	// --- the starter model ---
+	var opts, notes []string
+	pick := 0
+	cur := in.starterModelSpec()
+	for i, c := range starterChoices {
+		opts = append(opts, strings.TrimSuffix(c.Name, "-instruct"))
+		notes = append(notes, fmt.Sprintf("%s, about %.1f GB: %s.", c.Name, c.SizeGB, c.About))
+		if c.Name == cur.Name {
+			pick = i
+		}
+	}
+	opts = append(opts, "other")
+	notes = append(notes, "Any single GGUF file on Hugging Face.")
+	custom := ""
+	if in.starter.Source != "" && !slices.ContainsFunc(starterChoices, func(c starterSpec) bool { return c.Name == in.starter.Name }) {
+		pick, custom = len(starterChoices), in.starter.Source
+	}
+	f.starterPick = choiceField("Model", opts, pick, "")
+	f.starterPick.Notes = notes
+	f.starterSource = textSetupField("Its file", custom, "hf:owner/repo/file.gguf", "")
+	f.starterSource.Show = func() bool { return f.starterPick.Choice == len(starterChoices) }
+	f.starterCtx = textSetupField("Context a client may use, in tokens", strconv.Itoa(in.starterContext()), "4096",
+		"The engine holds four times this, for four requests at once; more context takes more memory.")
+	f.starter = &installPart{
+		title: "Starter model", on: !in.noModel,
+		about: "A model fetched into the mirror and served on this machine, so there is something to ask the " +
+			"moment the install finishes. Small ones answer on any CPU; the larger want a GPU. More models are " +
+			"added later from /admin/mirror or with 'llmgw ctl model add'.",
+		fields: []*setupField{f.starterPick, f.starterSource, f.starterCtx},
+		off:    "nothing to ask until a model is added",
+		summary: func() string {
+			name := opts[f.starterPick.Choice]
+			if f.starterPick.Choice == len(starterChoices) {
+				name = orText(f.starterSource.Value(), "(a file)")
+			} else {
+				name = fmt.Sprintf("%s (%.1f GB)", starterChoices[f.starterPick.Choice].Name, starterChoices[f.starterPick.Choice].SizeGB)
+			}
+			return name + ", " + f.starterCtx.Value() + " tokens"
+		},
+		needs: func() string {
+			if !f.mirror.on {
+				return "the starter model is fetched into the mirror: turn the mirror on, or the starter model off"
+			}
+			return ""
+		},
+	}
+	if ha {
+		f.starter.about += " Unless this machine is a node, it runs on the first node that joins with room for it."
+	}
+
+	// --- pictures and 3D ---
+	f.media = &installPart{
+		title: "Pictures and 3D", on: in.media,
+		about: "The nodes install ComfyUI, and once a node has a card that fits one the control plane adds a " +
+			"picture model (FLUX.1 schnell) and a 3D model (TripoSR) by itself, so the portal's pictures and 3D " +
+			"pages and their APIs work without anybody writing a definition. They load when asked for and give " +
+			"their card back when idle.\n\n" +
+			"Each comes under its own licence, kept with every file it makes. A preset someone removes is not " +
+			"added again. Later: 'llmgw ctl model presets auto off|on'.",
+		off:     "no pictures or 3D until a preset is added from the console or /admin",
+		summary: func() string { return "ComfyUI; a picture model and a 3D model once a card fits" },
+	}
+
+	// --- the guardrails' judge ---
+	j := in.judgeFor()
+	f.judgeFail = choiceField("When no judge answers in time", []string{"refuse", "serve flagged"},
+		map[string]int{"closed": 0, "open": 1}[j.Fail], "")
+	f.judgeFail.Notes = []string{
+		"The request is refused (503). Safe, and why the judge runs twice.",
+		"The request is served unjudged and marked so in the logs. Nothing is refused for the judge's sake.",
+	}
+	f.judgeCopies = textSetupField("Copies", strconv.Itoa(j.Replicas), "2",
+		"Each takes about 1 GB and two CPU threads on whichever node has room.")
+	f.judgeBudget = textSetupField("Waits at most", durationYAML(j.Budget), "5s",
+		"A short text is judged in about two seconds on CPUs.")
+	judgeFields := []*setupField{f.judgeFail, f.judgeCopies, f.judgeBudget, headingField("Refuses")}
+	catNotes := map[string]string{
+		"PII":                          "the patterns already catch secrets and card numbers",
+		"Unethical Acts":               "refuses much ordinary work",
+		"Politically Sensitive Topics": "refuses much ordinary work",
+		"Copyright Violation":          "refuses much ordinary work",
+	}
+	for _, c := range judgeCategories {
+		t := toggleField(c, slices.Contains(j.Categories, c), catNotes[c])
+		f.judgeCats = append(f.judgeCats, t)
+		judgeFields = append(judgeFields, t)
+	}
+	f.judge = &installPart{
+		title: "Guardrails' judge", on: !in.noGuardModel,
+		about: "Qwen3Guard 0.6B reads every prompt and every answer for what patterns cannot see: violence, " +
+			"crime, sexual content, self-harm, jailbreaks. It runs on CPUs and takes no card. Without it the " +
+			"baseline still blocks secrets and card numbers and flags prompt injection.",
+		fields: judgeFields,
+		off:    "requests are checked by patterns only: secrets, card numbers, injection",
+		summary: func() string {
+			n := 0
+			for _, c := range f.judgeCats {
+				if c.On {
+					n++
+				}
+			}
+			return fmt.Sprintf("Qwen3Guard ×%s on CPUs, %d categories, unanswered: %s",
+				f.judgeCopies.Value(), n, f.judgeFail.Options[f.judgeFail.Choice])
+		},
+		needs: func() string {
+			if !f.mirror.on {
+				return "the judge's model is fetched into the mirror: turn the mirror on, or the judge off"
+			}
+			return ""
+		},
+	}
+
+	// --- the firewall ---
+	f.firewall = &installPart{
+		title: "Firewall", on: !in.noFirewall,
+		about: "An nftables table of llmgw's own keeps its internal ports — the agents' 7443, the mirror's 8081, " +
+			"the store's — to the networks the cluster is on. The portal and API on 8080 stay open. " +
+			"Other rules on the machine are left as they are.",
+		off:     "llmgw's internal ports answer every network this machine is on",
+		summary: func() string { return "internal ports to the cluster's networks only" },
+	}
+
+	// --- notifications ---
+	f.webhooks = textSetupField("Webhooks", strings.Join(in.webhooks, ", "), "https://hooks.slack.com/services/…",
+		"Slack, Mattermost, Rocket.Chat, or any address taking JSON; comma-separated. slack: or json: in front says which. A test is sent to each.")
+	f.alerts = &installPart{
+		title: "Notifications", on: len(in.webhooks) > 0,
+		about: "Where the cluster says what went wrong: a model parked because it fits nowhere, a node lost, " +
+			"a judge not answering, a budget spent.",
+		fields: []*setupField{f.webhooks},
+		off:    "nothing is said outside the dashboards",
+		summary: func() string {
+			hooks, err := parseWebhooks([]string{f.webhooks.Value()})
+			if err != nil || len(hooks) == 0 {
+				return "(no webhook yet)"
+			}
+			var where []string
+			for _, h := range hooks {
+				where = append(where, notify.Redact(h.URL))
+			}
+			return strings.Join(where, ", ")
+		},
+	}
+
+	// --- limits ---
+	f.rpm = textSetupField("Requests a minute", strconv.Itoa(orInt(in.defaultRPM, defaultRPM)), "60", "")
+	f.tpm = textSetupField("Tokens a minute", strconv.Itoa(orInt(in.defaultTPM, defaultTPM)), "200000", "")
+	ttl := in.maxKeyTTL
+	if ttl <= 0 {
+		ttl = defaultMaxKeyTTL
+	}
+	f.keyDays = textSetupField("The longest a key lives, in days", strconv.Itoa(int(ttl.Hours()/24)), "90",
+		"A key made without an expiry gets this. Shorter per organization, team or project later.")
+	f.limits = &installPart{
+		title: "Limits and keys", fixed: true, on: true,
+		about: "What a key may use when nothing more particular gives it a limit: a project made without limits " +
+			"would otherwise be metered by nothing. Organizations, teams and projects get their own later.",
+		fields: []*setupField{f.rpm, f.tpm, f.keyDays},
+		summary: func() string {
+			return fmt.Sprintf("%s requests and %s tokens a minute; keys live %s days", f.rpm.Value(), f.tpm.Value(), f.keyDays.Value())
+		},
+	}
+
+	// --- on-demand turns ---
+	f.idle = textSetupField("Unused for", durationYAML(orDur(in.evictAfterIdle, 2*time.Minute)), "2m",
+		"before a model loaded on demand gives its card to another that wants it.")
+	f.safe = textSetupField("Safe after loading for", durationYAML(orDur(in.minLifetime, 5*time.Minute)), "5m",
+		"so two models do not take turns paying for loads. 1m each suits one card shared by a picture model and a 3D model.")
+	f.turns = &installPart{
+		title: "Taking turns on a card", fixed: true, on: true,
+		about: "Models that load when asked for share the cards: on a site with fewer cards than such models, " +
+			"one waits for another to go idle. These are the waits.",
+		fields: []*setupField{f.idle, f.safe},
+		summary: func() string {
+			return "after " + f.idle.Value() + " unused; safe for " + f.safe.Value() + " after loading"
+		},
+	}
+
+	// --- offline bundle ---
+	f.bundlePath = textSetupField("Bundle", in.bundle, "/media/usb/llmgw-bundle.tar",
+		"Made on a machine with internet by 'llmgw bundle create'.")
+	f.bundleSHA = textSetupField("Its sha256", in.bundleSHA, "the sha256 'llmgw bundle create' printed", "")
+	f.bundleSHA.Text.Width = 64
+	f.bundle = &installPart{
+		title: "Offline bundle", on: in.bundle != "",
+		about: "For a site with no internet: engines, releases and models carried in on a disk. They go into the " +
+			"mirror, and the cluster is set to reach nothing outside.",
+		fields:  []*setupField{f.bundlePath, f.bundleSHA},
+		off:     "engines and models are downloaded from the internet",
+		summary: func() string { return orText(f.bundlePath.Value(), "(a file)") },
+		needs: func() string {
+			if !f.mirror.on {
+				return "an offline bundle goes into the model mirror: turn the mirror on"
+			}
+			return ""
+		},
+	}
+
+	f.parts = []*installPart{f.control, f.store}
+	if ha {
+		f.parts = append(f.parts, f.standby)
+	}
+	f.parts = append(f.parts, f.mirror, f.node, f.starter, f.media, f.judge, f.firewall,
+		f.alerts, f.limits, f.turns, f.bundle)
+	return f
+}
+
+func orText(s, d string) string {
+	if strings.TrimSpace(s) == "" {
+		return d
+	}
+	return s
+}
+
+func orInt(n, d int) int {
+	if n <= 0 {
+		return d
+	}
+	return n
+}
+
+func orDur(v, d time.Duration) time.Duration {
+	if v <= 0 {
+		return d
+	}
+	return v
+}
+
+// openPart opens a part's settings.
+func (f *installForm) openPart(p *installPart) {
+	f.open = p
+	f.dialog = &setupDialog{Title: p.title, About: p.about, Fields: p.fields}
+	f.dialog.first()
+}
+
+// fail says what is wrong, and with what, so that closing the message opens it.
+func (f *installForm) fail(p *installPart, field *setupField, msg string) error {
+	f.err, f.errPart, f.errField = msg, p, field
+	return fmt.Errorf("%s", msg)
+}
+
+// key takes a key; next is whether the person asked to go on, the choices
+// already put into in.
+func (f *installForm) key(k tea.KeyMsg, in *serverInit) (next bool) {
+	if f.err != "" {
+		p, field := f.errPart, f.errField
+		f.err, f.errPart, f.errField = "", nil, nil
+		if p != nil {
+			f.openPart(p)
+			if field != nil {
+				f.dialog.focusOn(field)
+			}
+		}
+		return false
+	}
+	if f.dialog != nil {
+		if f.dialog.key(k) {
+			f.dialog, f.open = nil, nil
+		}
+		return false
+	}
+	n := len(f.parts) + 1
+	switch k.String() {
+	case "down", "tab", "j":
+		f.focus = (f.focus + 1) % n
+	case "up", "shift+tab", "k":
+		f.focus = (f.focus + n - 1) % n
+	case " ", "x":
+		if f.focus < len(f.parts) {
+			p := f.parts[f.focus]
+			if p.fixed {
+				break
+			}
+			p.on = !p.on
+			// A part that is nothing until it is told something is told
+			// at once.
+			if p.on && (p == f.alerts && f.webhooks.Value() == "" || p == f.bundle && f.bundlePath.Value() == "") {
+				f.openPart(p)
+			}
+		}
+	case "enter":
+		if f.focus < len(f.parts) {
+			f.openPart(f.parts[f.focus])
+			return false
+		}
+		return f.apply(in) == nil
+	}
+	return false
+}
+
+// apply checks the choices and puts them into in; what is wrong is kept to
+// be said.
+func (f *installForm) apply(in *serverInit) error {
+	for _, p := range f.parts {
+		if p.on && p.needs != nil {
+			if why := p.needs(); why != "" {
+				return f.fail(nil, nil, why)
+			}
+		}
+	}
+	admin := f.admin.Value()
+	if admin != "" || f.ha {
+		if _, err := mail.ParseAddress(admin); err != nil {
+			msg := "the administrator's email is not an address"
+			if admin == "" {
+				msg = "the administrator's email is needed"
+			}
+			return f.fail(f.control, f.admin, msg)
+		}
+	}
+	var hosts []string
+	for _, h := range strings.Split(f.hosts.Value(), ",") {
+		if h = strings.TrimSpace(h); h != "" {
+			hosts = append(hosts, h)
+		}
+	}
+
+	mirrorURL := ""
+	if f.mirror.on && f.mirrorWhere.Choice == 1 {
+		u, err := url.Parse(f.mirrorURL.Value())
+		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+			return f.fail(f.mirror, f.mirrorURL, "the other machine's mirror: its management API, as http://host:8082")
+		}
+		mirrorURL = f.mirrorURL.Value()
+	}
+	mirrorPath := ""
+	if f.mirror.on && f.mirrorWhere.Choice == 0 {
+		mirrorPath = f.mirrorDirF.Value()
+		if !strings.HasPrefix(mirrorPath, "/") {
+			return f.fail(f.mirror, f.mirrorDirF, "the mirror's directory: a path from /")
+		}
+	}
+
+	var starter starterSpec
+	ctx := 0
+	if f.starter.on {
+		if f.starterPick.Choice < len(starterChoices) {
+			starter = starterChoices[f.starterPick.Choice]
+		} else {
+			s, err := starterFrom(f.starterSource.Value())
+			if err != nil || !strings.HasPrefix(s.Source, "hf:") {
+				return f.fail(f.starter, f.starterSource, "the starter model's file: hf:<owner>/<repo>/<file>.gguf")
+			}
+			starter = s
+		}
+		n, err := strconv.Atoi(f.starterCtx.Value())
+		if err != nil || n < 512 || n > 262144 {
+			return f.fail(f.starter, f.starterCtx, "the starter's context: a number of tokens from 512 to 262144")
+		}
+		ctx = n
+	}
+
+	var judge judgeSpec
+	if f.judge.on {
+		judge.Fail = []string{"closed", "open"}[f.judgeFail.Choice]
+		n, err := strconv.Atoi(f.judgeCopies.Value())
+		if err != nil || n < 1 || n > 8 {
+			return f.fail(f.judge, f.judgeCopies, "the judge's copies: from 1 to 8")
+		}
+		judge.Replicas = n
+		d, err := time.ParseDuration(f.judgeBudget.Value())
+		if err != nil || d < 500*time.Millisecond || d > time.Minute {
+			return f.fail(f.judge, f.judgeBudget, "how long the judge is waited for: a duration such as 5s, at most 1m")
+		}
+		judge.Budget = d
+		for i, c := range f.judgeCats {
+			if c.On {
+				judge.Categories = append(judge.Categories, judgeCategories[i])
+			}
+		}
+		if len(judge.Categories) == 0 {
+			return f.fail(f.judge, f.judgeCats[0], "the judge refuses nothing: tick a category, or turn the judge off")
+		}
+	}
+
+	var hooks []string
+	if f.alerts.on {
+		h := f.webhooks.Value()
+		parsed, err := parseWebhooks([]string{h})
+		if err != nil {
+			return f.fail(f.alerts, f.webhooks, err.Error())
+		}
+		if len(parsed) == 0 {
+			return f.fail(f.alerts, f.webhooks, "give a webhook, or turn notifications off")
+		}
+		hooks = []string{h}
+	}
+
+	rpm, err := strconv.Atoi(f.rpm.Value())
+	if err != nil || rpm < 1 {
+		return f.fail(f.limits, f.rpm, "requests a minute: a whole number, 1 or more")
+	}
+	tpm, err := strconv.Atoi(f.tpm.Value())
+	if err != nil || tpm < 1 {
+		return f.fail(f.limits, f.tpm, "tokens a minute: a whole number, 1 or more")
+	}
+	keyDays, err := strconv.Atoi(f.keyDays.Value())
+	if err != nil || keyDays < 1 || keyDays > 3650 {
+		return f.fail(f.limits, f.keyDays, "the longest a key lives: days, from 1 to 3650")
+	}
+	idle, err := time.ParseDuration(f.idle.Value())
+	if err != nil || idle < 0 {
+		return f.fail(f.turns, f.idle, "a duration such as 2m or 90s")
+	}
+	safe, err := time.ParseDuration(f.safe.Value())
+	if err != nil || safe < 0 {
+		return f.fail(f.turns, f.safe, "a duration such as 5m or 90s")
+	}
+
+	bundle, sum := "", ""
+	if f.bundle.on {
+		bundle, sum = f.bundlePath.Value(), strings.ToLower(f.bundleSHA.Value())
+		switch {
+		case bundle == "":
+			return f.fail(f.bundle, f.bundlePath, "give the bundle's path, or turn the offline bundle off")
+		case sum == "":
+			return f.fail(f.bundle, f.bundleSHA, "give the bundle's sha256, as 'llmgw bundle create' printed it")
+		}
+	}
+
+	in.admin, in.hosts = admin, hosts
+	in.language = map[int]string{0: "", 1: "tr"}[f.language.Choice]
+	in.signupOpen = f.signup.Choice == 1
+	in.postgres = !f.ha && f.storeKind.Choice == 1
+	in.noMirror = !f.mirror.on || mirrorURL != ""
+	in.mirrorURL, in.mirrorPath = mirrorURL, mirrorPath
+	in.noNode = !f.node.on
+	in.noModel = !f.starter.on
+	in.starter, in.starterCtx = starter, ctx
+	in.media = f.media.on
+	in.noGuardModel = !f.judge.on
+	in.judge = judge
+	in.noFirewall = !f.firewall.on
+	in.webhooks = hooks
+	in.defaultRPM, in.defaultTPM = rpm, tpm
+	in.maxKeyTTL = time.Duration(keyDays) * 24 * time.Hour
+	in.evictAfterIdle, in.minLifetime = 0, 0
+	if idle != 2*time.Minute {
+		in.evictAfterIdle = idle
+	}
+	if safe != 5*time.Minute {
+		in.minLifetime = safe
+	}
+	in.bundle, in.bundleSHA = bundle, sum
+	in.standbys, in.vip = false, ""
+	if f.standby != nil && f.standby.on {
+		in.standbys, in.vip = true, f.vipF.Value()
+	}
+	if err := in.checkChoices(); err != nil {
+		if strings.HasPrefix(err.Error(), "floating address") {
+			return f.fail(f.standby, f.vipF, err.Error())
+		}
+		return f.fail(nil, nil, err.Error())
+	}
+	return nil
+}
+
+// view is the list of parts, and what the focused one is, under it.
+func (f *installForm) view(width int) string {
+	var b strings.Builder
+	b.WriteString("\n  " + sDim.Render("Space turns a part on or off · Enter opens its settings and says more") + "\n\n")
+	titleW := 0
+	for _, p := range f.parts {
+		titleW = max(titleW, len(p.title))
+	}
+	for i, p := range f.parts {
+		box := "[ ]"
+		switch {
+		case p.fixed:
+			box = " • "
+		case p.on:
+			box = "[" + sOK.Render("x") + "]"
+		}
+		title := fmt.Sprintf("%-*s", titleW, p.title)
+		line := ""
+		if p.on {
+			line = p.summary()
+		} else {
+			line = sDim.Render(p.off)
+		}
+		if i == f.focus {
+			title = fSelected.Render(title)
+			b.WriteString(fSelected.Render("› ") + box + " " + title + "  " + truncateWidth(line, max(20, width-titleW-8)) + "\n")
+		} else {
+			b.WriteString("  " + box + " " + title + "  " + truncateWidth(line, max(20, width-titleW-8)) + "\n")
+		}
+	}
+	b.WriteString("\n" + button(f.focus == len(f.parts), "Next") + "\n")
+	if f.focus < len(f.parts) {
+		p := f.parts[f.focus]
+		b.WriteString("\n  " + lipgloss.NewStyle().Bold(true).Render(p.title) + "\n")
+		b.WriteString(paragraphs(p.about, max(40, width-6), "  ") + "\n")
+	}
+	return b.String()
+}
+
+// overlay is the dialog over the list, if one is open: its title and body.
+func (f *installForm) overlay() (string, string) {
+	if f.err != "" {
+		return "Not yet", f.err + "\n\n" + sDim.Render("any key to go back")
+	}
+	if f.dialog != nil {
+		return f.dialog.Title, f.dialog.view(max(8, f.height-8))
+	}
+	return "", ""
+}
+
+// keys is the key bar for the list or its dialog.
+func (f *installForm) keys() string {
+	switch {
+	case f.err != "":
+		return "any key back"
+	case f.dialog != nil:
+		return setupDialogKeys(f.dialog)
+	}
+	return "↑↓ move · Space on/off · Enter settings, or on Next go on · Ctrl+C leave"
+}
+
+// planView says what will be installed and what will not, part by part, in
+// words: the last look before anything is done.
+func (f *installForm) planView(width int) string {
+	var b strings.Builder
+	b.WriteString("\n  " + lipgloss.NewStyle().Bold(true).Render("Installed on "+f.host) + "\n\n")
+	var left []*installPart
+	for _, p := range f.parts {
+		if !p.on {
+			left = append(left, p)
+			continue
+		}
+		fmt.Fprintf(&b, "  %s %s\n      %s\n", sOK.Render("✓"), p.title, wrap(p.summary(), max(40, width-8), "      "))
+	}
+	if len(left) > 0 {
+		b.WriteString("\n  " + lipgloss.NewStyle().Bold(true).Render("Left out") + "\n\n")
+		for _, p := range left {
+			fmt.Fprintf(&b, "  %s %s\n      %s\n", sDim.Render("-"), p.title, sDim.Render(wrap(p.off, max(40, width-8), "      ")))
+		}
+	}
+	return b.String()
+}

internal/cli/tui_form.go

@@ -0,0 +1,322 @@
+package cli
+
+import (
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+)
+
+// A form in a dialog: text to type, one of a few choices, a thing on or off,
+// and headings between them. The setup's settings for each part are one of
+// these, opened over the list of parts.
+
+type fieldKind int
+
+const (
+	fkText fieldKind = iota
+	// fkChoice is one of Options, changed with ← →.
+	fkChoice
+	// fkToggle is on or off, changed with Space.
+	fkToggle
+	// fkHeading is a title between fields; it takes no focus.
+	fkHeading
+)
+
+type setupField struct {
+	Label string
+	// Hint is said under the field; Notes, for a choice, under each option
+	// as it is chosen.
+	Hint  string
+	Notes []string
+	Kind  fieldKind
+
+	Text    textField
+	Options []string
+	Choice  int
+	On      bool
+	// Show, when set, says whether the field is shown, and so whether it
+	// counts: a directory for a mirror kept elsewhere is neither.
+	Show func() bool
+}
+
+func textSetupField(label, value, placeholder, hint string) *setupField {
+	t := newTextField()
+	t.SetValue(value)
+	t.Placeholder, t.CharLimit, t.Width = placeholder, 800, 40
+	return &setupField{Label: label, Hint: hint, Kind: fkText, Text: t}
+}
+
+func choiceField(label string, options []string, choice int, hint string) *setupField {
+	return &setupField{Label: label, Hint: hint, Kind: fkChoice, Options: options, Choice: choice}
+}
+
+func toggleField(label string, on bool, hint string) *setupField {
+	return &setupField{Label: label, Hint: hint, Kind: fkToggle, On: on}
+}
+
+func headingField(label string) *setupField {
+	return &setupField{Label: label, Kind: fkHeading}
+}
+
+func (f *setupField) shown() bool { return f.Show == nil || f.Show() }
+
+func (f *setupField) Value() string { return strings.TrimSpace(f.Text.Value()) }
+
+// setupDialog is a form over the screen, with what it is for above it.
+type setupDialog struct {
+	Title  string
+	About  string
+	Fields []*setupField
+	focus  int
+}
+
+// focusable is whether a field can have the focus now.
+func (d *setupDialog) focusable(i int) bool {
+	f := d.Fields[i]
+	return f.Kind != fkHeading && f.shown()
+}
+
+// first puts the focus on the first field that takes it.
+func (d *setupDialog) first() {
+	d.focus = -1
+	d.move(1)
+}
+
+// focusOn puts the focus on a field, as when it is what is wrong.
+func (d *setupDialog) focusOn(f *setupField) {
+	for i, x := range d.Fields {
+		if x == f {
+			d.focus = i
+		}
+	}
+	d.blurAll()
+}
+
+func (d *setupDialog) move(dir int) {
+	n := len(d.Fields)
+	for range n {
+		d.focus = (d.focus + dir + n) % n
+		if d.focusable(d.focus) {
+			break
+		}
+	}
+	d.blurAll()
+}
+
+// blurAll leaves only the focused text field with a cursor.
+func (d *setupDialog) blurAll() {
+	for i, f := range d.Fields {
+		if f.Kind != fkText {
+			continue
+		}
+		if i == d.focus {
+			f.Text.Focus()
+		} else {
+			f.Text.Blur()
+		}
+	}
+}
+
+// hasFields is whether there is anything to set, rather than only to read.
+func (d *setupDialog) hasFields() bool {
+	for i := range d.Fields {
+		if d.focusable(i) {
+			return true
+		}
+	}
+	return false
+}
+
+// lastFocusable is the last field that takes the focus now.
+func (d *setupDialog) lastFocusable() int {
+	for i := len(d.Fields) - 1; i >= 0; i-- {
+		if d.focusable(i) {
+			return i
+		}
+	}
+	return -1
+}
+
+// key takes a key and says whether the dialog is done: Esc, or Enter on
+// the last field.
+func (d *setupDialog) key(k tea.KeyMsg) (done bool) {
+	switch k.Type {
+	case tea.KeyEsc:
+		return true
+	case tea.KeyEnter:
+		if !d.hasFields() || d.focus == d.lastFocusable() {
+			return true
+		}
+		d.move(1)
+		return false
+	case tea.KeyTab, tea.KeyDown:
+		if d.hasFields() {
+			d.move(1)
+		}
+		return false
+	case tea.KeyShiftTab, tea.KeyUp:
+		if d.hasFields() {
+			d.move(-1)
+		}
+		return false
+	}
+	if d.focus < 0 || d.focus >= len(d.Fields) || !d.focusable(d.focus) {
+		return false
+	}
+	f := d.Fields[d.focus]
+	switch f.Kind {
+	case fkText:
+		f.Text, _ = f.Text.Update(k)
+	case fkChoice:
+		switch k.String() {
+		case "left", "h":
+			f.Choice = (f.Choice + len(f.Options) - 1) % len(f.Options)
+		case "right", "l", " ":
+			f.Choice = (f.Choice + 1) % len(f.Options)
+		}
+	case fkToggle:
+		if k.String() == " " || k.String() == "x" {
+			f.On = !f.On
+		}
+	}
+	return false
+}
+
+// dialogWidth is how wide the text in a dialog is wrapped.
+const dialogWidth = 66
+
+// view draws the form in at most maxLines lines, the part around the focus
+// when it is longer: a long form scrolls as the focus moves.
+func (d *setupDialog) view(maxLines int) string {
+	var lines []string
+	add := func(s string) { lines = append(lines, strings.Split(s, "\n")...) }
+	if d.About != "" {
+		add(paragraphs(d.About, dialogWidth, ""))
+	}
+	if !d.hasFields() {
+		add("")
+		add(sDim.Render("Nothing to set for this part. Esc or Enter to go back."))
+		return clipLines(lines, 0, 0, maxLines)
+	}
+	add("")
+	focusStart, focusEnd := 0, 0
+	for i, f := range d.Fields {
+		if !f.shown() {
+			continue
+		}
+		focused := i == d.focus
+		if focused {
+			focusStart = len(lines)
+		}
+		label := func(s string) string {
+			if focused {
+				return fSelected.Render("› " + s)
+			}
+			return "  " + s
+		}
+		switch f.Kind {
+		case fkHeading:
+			add("")
+			add("  " + lipgloss.NewStyle().Bold(true).Render(f.Label))
+			continue
+		case fkText:
+			add(label(f.Label))
+			add("    " + f.Text.View())
+		case fkChoice:
+			var opts []string
+			for j, o := range f.Options {
+				if j == f.Choice {
+					opts = append(opts, "("+sOK.Render("•")+") "+o)
+				} else {
+					opts = append(opts, "( ) "+sDim.Render(o))
+				}
+			}
+			add(label(f.Label))
+			// Side by side while they fit, else one a line.
+			if row := strings.Join(opts, "  "); ansi.StringWidth(row) <= dialogWidth-4 {
+				add("    " + row)
+			} else {
+				for _, o := range opts {
+					add("    " + o)
+				}
+			}
+			if f.Choice < len(f.Notes) && f.Notes[f.Choice] != "" {
+				add("    " + sDim.Render(wrap(f.Notes[f.Choice], dialogWidth-4, "    ")))
+			}
+		case fkToggle:
+			box := "[ ]"
+			if f.On {
+				box = "[" + sOK.Render("x") + "]"
+			}
+			add(label(box) + " " + f.Label)
+		}
+		if f.Hint != "" {
+			add("    " + sDim.Render(wrap(f.Hint, dialogWidth-4, "    ")))
+		}
+		if focused {
+			focusEnd = len(lines) - 1
+		}
+		if f.Kind != fkToggle {
+			add("")
+		}
+	}
+	for len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return clipLines(lines, focusStart, focusEnd, maxLines)
+}
+
+// clipLines is at most n of lines, keeping lines from to through in sight
+// as far as they fit, with a mark at an edge that has more beyond it.
+func clipLines(lines []string, from, through, n int) string {
+	if n <= 2 || len(lines) <= n {
+		return strings.Join(lines, "\n")
+	}
+	top := 0
+	// The last line shown is a mark when there is more below: the focus
+	// ends a line above it.
+	if through > n-2 {
+		top = through - (n - 2)
+	}
+	// Its first line wins over its last, under the mark above.
+	if from > 0 && top > from-1 {
+		top = from - 1
+	}
+	top = max(0, min(top, len(lines)-n))
+	out := append([]string{}, lines[top:top+n]...)
+	if top > 0 {
+		out[0] = sDim.Render("  ↑ more")
+	}
+	if top+n < len(lines) {
+		out[n-1] = sDim.Render("  ↓ more")
+	}
+	return strings.Join(out, "\n")
+}
+
+// paragraphs wraps text paragraph by paragraph, blank lines kept between.
+func paragraphs(s string, width int, indent string) string {
+	var out []string
+	for _, p := range strings.Split(s, "\n\n") {
+		out = append(out, indent+wrap(p, width, indent))
+	}
+	return strings.Join(out, "\n\n")
+}
+
+// setupDialogKeys is the key bar under a dialog.
+func setupDialogKeys(d *setupDialog) string {
+	if !d.hasFields() {
+		return "Esc or Enter back"
+	}
+	keys := "Tab/↑↓ move"
+	if d.focus >= 0 && d.focus < len(d.Fields) {
+		switch d.Fields[d.focus].Kind {
+		case fkChoice:
+			keys += " · ←→ choose"
+		case fkToggle:
+			keys += " · Space tick"
+		}
+	}
+	return keys + " · Esc done"
+}

internal/cli/tui_init.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net/mail"
 	"os"
 	"path/filepath"
 	"strings"
@@ -47,35 +46,16 @@ func (w *lineWriter) Write(p []byte) (int, error) {
 }
 
 // Form fields, in order.
-const (
-	fAdmin = iota
-	fHosts
-	fWebhooks
-	fPostgres
-	fMirror
-	fNode
-	fModel
-	fGuard
-	fBundle
-	fBundleSHA
-	fStart
-	fCount
-)
-
 type initModel struct {
 	in    *serverInit
 	found []string // this machine's addresses
 
-	// The form, until it is submitted.
-	form      bool
-	focus     int
-	admin     textField
-	hosts     textField
-	webhooks  textField
-	bundle    textField
-	bundleSHA textField
-	toggles   [fCount]bool
-	formError string
+	// The parts to install, until they are chosen and the plan agreed to.
+	form    bool
+	plan    bool
+	choices *installForm
+	// scroll is how far the panel is scrolled, back to the top on each page.
+	scroll int
 
 	// Then the run.
 	running  bool
@@ -95,43 +75,9 @@ type initModel struct {
 }
 
 func newInitModel(in *serverInit, found []string, askForm bool) initModel {
-	admin := newTextField()
-	admin.Placeholder = "you@example.com"
-	admin.SetValue(in.admin)
-	admin.CharLimit = 200
-	admin.Width = 40
-	hosts := newTextField()
-	hosts.Placeholder = "llm.example.com, 203.0.113.10"
-	hosts.SetValue(strings.Join(in.hosts, ", "))
-	hosts.CharLimit = 400
-	hosts.Width = 40
-	webhooks := newTextField()
-	webhooks.Placeholder = "https://hooks.slack.com/services/…"
-	webhooks.SetValue(strings.Join(in.webhooks, ", "))
-	webhooks.CharLimit = 800
-	webhooks.Width = 40
-	bundle := newTextField()
-	bundle.Placeholder = "/media/usb/llmgw-bundle.tar"
-	bundle.SetValue(in.bundle)
-	bundle.CharLimit = 400
-	bundle.Width = 40
-	bundleSHA := newTextField()
-	bundleSHA.Placeholder = "the sha256 'llmgw bundle create' printed"
-	bundleSHA.SetValue(in.bundleSHA)
-	bundleSHA.CharLimit = 64
-	bundleSHA.Width = 64
-	sp := newSpinner()
-	m := initModel{in: in, found: found, form: askForm, admin: admin, hosts: hosts, webhooks: webhooks,
-		bundle: bundle, bundleSHA: bundleSHA, spin: sp, width: 100}
-	m.toggles[fPostgres] = in.postgres
-	m.toggles[fMirror] = !in.noMirror
-	m.toggles[fNode] = !in.noNode
-	m.toggles[fModel] = !in.noModel
-	m.toggles[fGuard] = !in.noGuardModel
-	if askForm {
-		m.admin.Focus()
-	}
-	return m
+	host, _ := os.Hostname()
+	return initModel{in: in, found: found, form: askForm, choices: newInstallForm(in, host, found, false),
+		spin: newSpinner(), width: 100, height: 30}
 }
 
 func (m initModel) Init() tea.Cmd {
@@ -147,6 +93,7 @@ func (m initModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		m.width, m.height = msg.Width, msg.Height
+		m.choices.height = msg.Height
 		if m.framed {
 			m.width = msg.Width - navWidth - 6
 		}
@@ -209,118 +156,32 @@ func (m *initModel) addLine(l string) {
 
 func (m initModel) formKey(k tea.KeyMsg) (tea.Model, tea.Cmd) {
 	switch k.Type {
-	case tea.KeyTab, tea.KeyDown:
-		m.moveFocus(1)
+	case tea.KeyPgDown:
+		m.scroll += max(1, m.height-8)
 		return m, nil
-	case tea.KeyShiftTab, tea.KeyUp:
-		m.moveFocus(-1)
+	case tea.KeyPgUp:
+		m.scroll = max(0, m.scroll-max(1, m.height-8))
 		return m, nil
-	case tea.KeyEnter:
-		if m.focus != fStart {
-			m.moveFocus(1)
-			return m, nil
-		}
-		admin := strings.TrimSpace(m.admin.Value())
-		if admin != "" {
-			if _, err := mail.ParseAddress(admin); err != nil {
-				m.formError = "the administrator's email is not an address"
-				m.focus = fAdmin
-				m.admin.Focus()
-				return m, nil
-			}
-		}
-		bundle, sum := strings.TrimSpace(m.bundle.Value()), strings.ToLower(strings.TrimSpace(m.bundleSHA.Value()))
-		switch {
-		case bundle != "" && sum == "":
-			m.formError = "give the bundle's sha256, as 'llmgw bundle create' printed it"
-			m.focus = fBundleSHA
-			m.moveFocus(0)
-			return m, nil
-		case bundle != "" && !m.toggles[fMirror] && m.in.mirrorURL == "":
-			m.formError = "an offline bundle goes into the model mirror: tick it"
-			m.focus = fMirror
-			m.moveFocus(0)
-			return m, nil
-		}
-		hooks := strings.TrimSpace(m.webhooks.Value())
-		if _, err := parseWebhooks([]string{hooks}); err != nil {
-			m.formError = err.Error()
-			m.focus = fWebhooks
-			m.moveFocus(0)
-			return m, nil
-		}
-		m.in.webhooks = nil
-		if hooks != "" {
-			m.in.webhooks = []string{hooks}
-		}
-		m.in.bundle, m.in.bundleSHA = bundle, sum
-		m.in.admin = admin
-		m.in.hosts = nil
-		for _, h := range strings.Split(m.hosts.Value(), ",") {
-			if h = strings.TrimSpace(h); h != "" {
-				m.in.hosts = append(m.in.hosts, h)
-			}
-		}
-		m.in.postgres = m.toggles[fPostgres]
-		m.in.noMirror = !m.toggles[fMirror]
-		m.in.noNode = !m.toggles[fNode]
-		m.in.noModel = !m.toggles[fModel]
-		m.in.noGuardModel = !m.toggles[fGuard]
-		m.form = false
-		return m, tea.Batch(m.spin.Tick, func() tea.Msg { return startInitMsg{} })
 	}
-	switch m.focus {
-	case fAdmin:
-		var cmd tea.Cmd
-		m.admin, cmd = m.admin.Update(k)
-		return m, cmd
-	case fHosts:
-		var cmd tea.Cmd
-		m.hosts, cmd = m.hosts.Update(k)
-		return m, cmd
-	case fWebhooks:
-		var cmd tea.Cmd
-		m.webhooks, cmd = m.webhooks.Update(k)
-		return m, cmd
-	case fBundle:
-		var cmd tea.Cmd
-		m.bundle, cmd = m.bundle.Update(k)
-		return m, cmd
-	case fBundleSHA:
-		var cmd tea.Cmd
-		m.bundleSHA, cmd = m.bundleSHA.Update(k)
-		return m, cmd
-	case fPostgres, fMirror, fNode, fModel, fGuard:
-		if k.String() == " " || k.String() == "x" {
-			m.toggles[m.focus] = !m.toggles[m.focus]
+	if m.plan {
+		switch k.Type {
+		case tea.KeyEsc:
+			m.plan, m.scroll = false, 0
+		case tea.KeyEnter:
+			m.form, m.plan, m.scroll = false, false, 0
+			return m, tea.Batch(m.spin.Tick, func() tea.Msg { return startInitMsg{} })
 		}
+		return m, nil
+	}
+	if m.choices.key(k, m.in) {
+		m.plan, m.scroll = true, 0
 	}
 	return m, nil
 }
 
-func (m *initModel) moveFocus(d int) {
-	m.focus = (m.focus + d + fCount) % fCount
-	// With --mirror there is no mirror to run here, so nothing to tick.
-	if m.focus == fMirror && m.in.mirrorURL != "" {
-		m.focus = (m.focus + d + fCount) % fCount
-	}
-	m.admin.Blur()
-	m.hosts.Blur()
-	m.webhooks.Blur()
-	m.bundle.Blur()
-	m.bundleSHA.Blur()
-	switch m.focus {
-	case fAdmin:
-		m.admin.Focus()
-	case fHosts:
-		m.hosts.Focus()
-	case fWebhooks:
-		m.webhooks.Focus()
-	case fBundle:
-		m.bundle.Focus()
-	case fBundleSHA:
-		m.bundleSHA.Focus()
-	}
+// command is this install as a command line, for doing it again from a script.
+func (in *serverInit) command() string {
+	return strings.Join(append([]string{"sudo llmgw server init"}, in.initFlags()...), " \\\n    ")
 }
 
 func (m initModel) View() string {
@@ -331,27 +192,50 @@ func (m initModel) View() string {
 	if i := strings.Index(body, "\n\n"); i >= 0 {
 		body = body[i+1:]
 	}
-	steps := []navItem{{Label: "Start", State: "done"}, {Label: "Settings", State: "current"}, {Label: "Install", State: "todo"}}
-	keys := "Tab/↑↓ move · Space tick · Enter on Set up · Ctrl+C leave"
-	if !m.form {
+	steps := []navItem{{Label: "Start", State: "done"}, {Label: "Choices", State: "current"},
+		{Label: "Plan", State: "todo"}, {Label: "Install", State: "todo"}}
+	keys := m.choices.keys()
+	title := "What to install"
+	switch {
+	case m.form && m.plan:
 		steps[1].State, steps[2].State = "done", "current"
-		keys = "Ctrl+C stop"
+		keys, title = "Enter install · Esc back to the choices · PgUp/PgDn scroll · Ctrl+C leave", "Plan"
+	case !m.form:
+		steps[1].State, steps[2].State, steps[3].State = "done", "done", "current"
+		keys, title = "Ctrl+C stop", "Installing"
 		if m.done {
-			steps[2].State = "done"
+			steps[3].State = "done"
 			keys = "Enter close"
 		}
 	}
-	host, _ := os.Hostname()
-	return frame{Width: m.width + navWidth + 6, Height: m.height, Title: "llmgw setup", Where: host,
-		NavTitle: "Steps", Nav: steps, PanelTitle: "This machine as a control plane", Body: body, Keys: keys}.render()
+	f := frame{Width: m.width + navWidth + 6, Height: m.height, Title: "llmgw setup",
+		NavTitle: "Steps", Nav: steps, PanelTitle: title, Body: body, Keys: keys, Scroll: m.scroll}
+	if m.form && !m.plan {
+		f.DialogTitle, f.Dialog = m.choices.overlay()
+	}
+	f.Where, _ = os.Hostname()
+	return f.render()
 }
 
 // plainView is the screen as text, for a panel or a terminal that is not one.
 func (m initModel) plainView() string {
 	var b strings.Builder
 	b.WriteString(sTitle.Render("llmgw · setting up this machine as a control plane") + "\n\n")
+	if m.form && m.plan {
+		b.WriteString(m.choices.planView(m.width))
+		b.WriteString("\n  " + sDim.Render("The same from a script:") + "\n")
+		for _, l := range strings.Split(m.in.command(), "\n") {
+			b.WriteString("  " + l + "\n")
+		}
+		b.WriteString("\n" + button(true, "Enter to install") + "\n")
+		return b.String()
+	}
 	if m.form {
-		return b.String() + m.formView()
+		b.WriteString(m.choices.view(m.width))
+		if title, d := m.choices.overlay(); d != "" && !m.framed {
+			b.WriteString("\n" + sTitle.Render(title) + "\n" + d + "\n")
+		}
+		return b.String()
 	}
 	for _, l := range m.visibleLines() {
 		b.WriteString(m.lineView(l) + "\n")
@@ -411,53 +295,6 @@ func (m initModel) lineView(l string) string {
 	return "    " + t
 }
 
-func (m initModel) formView() string {
-	var b strings.Builder
-	label := func(i int, s string) string {
-		if m.focus == i {
-			return sTitle.Render("› " + s)
-		}
-		return "  " + s
-	}
-	check := func(i int, s, hint string) string {
-		box := "[ ]"
-		if m.toggles[i] {
-			box = "[" + sOK.Render("x") + "]"
-		}
-		return fmt.Sprintf("%s %s %s\n", label(i, box), s, sDim.Render(hint))
-	}
-	fmt.Fprintf(&b, "%s\n    %s\n", label(fAdmin, "Administrator's email"), m.admin.View())
-	b.WriteString("    " + sDim.Render("A password is generated and shown once. Leave empty to create accounts later.") + "\n\n")
-	fmt.Fprintf(&b, "%s\n    %s\n", label(fHosts, "Other names nodes will reach this machine by"), m.hosts.View())
-	found := "none found"
-	if len(m.found) > 0 {
-		found = strings.Join(m.found, ", ")
-	}
-	b.WriteString("    " + sDim.Render("Already in the certificate: "+found+". Add a DNS name or NAT address here.") + "\n\n")
-	fmt.Fprintf(&b, "%s\n    %s\n", label(fWebhooks, "Notification webhooks"), m.webhooks.View())
-	b.WriteString("    " + sDim.Render("Where a parked model, a lost node or a spent budget is said: Slack, Mattermost, or any URL taking JSON. Comma-separated; a test is sent.") + "\n\n")
-	b.WriteString(check(fPostgres, "PostgreSQL", "rather than SQLite; installed here, for several control planes or a larger store"))
-	if m.in.mirrorURL != "" {
-		b.WriteString("  Model mirror " + sDim.Render("at "+m.in.mirrorURL+", from --mirror") + "\n")
-	} else {
-		b.WriteString(check(fMirror, "Model mirror", "downloads model files once for every node"))
-	}
-	b.WriteString(check(fNode, "This machine as a node", "serves models here too, on its GPUs or CPU"))
-	b.WriteString(check(fModel, "Starter model", "a small Qwen, so there is something to ask at once"))
-	b.WriteString(check(fGuard, "Guardrails' judge", "Llama Guard 3 1B on a CPU, refusing violent, criminal and abusive requests"))
-	fmt.Fprintf(&b, "\n%s\n    %s\n", label(fBundle, "Offline bundle"), m.bundle.View())
-	b.WriteString("    " + sDim.Render("For a site with no internet: engines, releases and models from 'llmgw bundle create'. Empty downloads them.") + "\n")
-	fmt.Fprintf(&b, "%s\n    %s\n", label(fBundleSHA, "Its sha256"), m.bundleSHA.View())
-	b.WriteString("\n" + label(fStart, lipgloss.NewStyle().Bold(true).Render("Set up")) + "\n")
-	if m.formError != "" {
-		b.WriteString("\n" + sBad.Render(m.formError) + "\n")
-	}
-	if !m.framed { // the frame's key bar says it
-		b.WriteString("\n" + sDim.Render("tab or ↑↓ to move · space to tick · enter on Set up to start · ctrl+c to leave") + "\n")
-	}
-	return b.String()
-}
-
 // runInitTUI runs init with the screen above, asking the form first when
 // the flags left the administrator unset.
 func (in *serverInit) runInitTUI(ctx context.Context, out io.Writer) error {

internal/cli/tui_init_test.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"strings"
 	"testing"
+	"time"
 
 	tea "github.com/charmbracelet/bubbletea"
 )
@@ -11,23 +12,54 @@ func typeIn(m tea.Model, s string) tea.Model {
 	return send(m, tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)})
 }
 
+// toPart moves the focus in the list of parts to the one titled so.
+func toPart(t *testing.T, m tea.Model, title string) tea.Model {
+	t.Helper()
+	f := m.(initModel).choices
+	for i := 0; i <= len(f.parts); i++ {
+		if f.focus < len(f.parts) && f.parts[f.focus].title == title {
+			return m
+		}
+		m = press(m, "down")
+	}
+	t.Fatalf("no part %q", title)
+	return m
+}
+
+// toNext moves the focus to the button that goes on, and presses it.
+func toNext(m tea.Model) tea.Model {
+	f := m.(initModel).choices
+	for f.focus != len(f.parts) {
+		m = press(m, "down")
+	}
+	return press(m, "enter")
+}
+
 func TestTheInitFormBecomesInitsSettings(t *testing.T) {
 	in := &serverInit{pkiDir: "/etc/llmgw/pki"}
 	var m tea.Model = newInitModel(in, []string{"10.0.0.140"}, true)
-	if v := m.View(); !strings.Contains(v, "Already in the certificate: 10.0.0.140") {
+	m = press(toPart(t, m, "Control plane"), "enter")
+	m = typeIn(m, "ops@example.com")
+	m = press(m, "tab")
+	if v := m.View(); !strings.Contains(v, "Already in its certificate: 10.0.0.140") {
 		t.Fatalf("the addresses found are not shown:\n%s", v)
 	}
-	m = typeIn(m, "ops@example.com")
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab})
 	m = typeIn(m, "llm.example.com, 203.0.113.10")
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab})
+	m = press(m, "esc")
+	m = press(toPart(t, m, "Store"), "enter", "right", "esc") // PostgreSQL
+	// Turning notifications on asks for the webhook at once.
+	m = press(toPart(t, m, "Notifications"), "space")
+	if m.(initModel).choices.dialog == nil {
+		t.Fatal("notifications turned on without asking where")
+	}
 	m = typeIn(m, "https://hooks.slack.com/services/T1/B2/x, json:https://alerts.example.com/in")
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(" ")}) // PostgreSQL on
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab},
-		tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(" ")}) // starter model off
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(" ")})         // judge off
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab}) // no bundle
-	m = send(m, tea.KeyMsg{Type: tea.KeyEnter})
+	m = press(m, "esc")
+	m = press(toPart(t, m, "Starter model"), "space")     // off
+	m = press(toPart(t, m, "Guardrails' judge"), "space") // off
+	m = toNext(m)
+	if !m.(initModel).plan {
+		t.Fatalf("Next did not lead to the plan: %s", m.(initModel).choices.err)
+	}
 
 	if in.admin != "ops@example.com" || strings.Join(in.hosts, "|") != "llm.example.com|203.0.113.10" {
 		t.Errorf("admin %q hosts %q", in.admin, in.hosts)
@@ -38,24 +70,33 @@ func TestTheInitFormBecomesInitsSettings(t *testing.T) {
 	if hooks, err := parseWebhooks(in.webhooks); err != nil || len(hooks) != 2 || hooks[0].Format != "slack" || hooks[1].Format != "json" {
 		t.Errorf("webhooks %q: %+v %v", in.webhooks, hooks, err)
 	}
+	v := m.View()
+	for _, want := range []string{"✓ Store", "PostgreSQL on this machine", "Left out", "Starter model", "--postgres", "--no-model"} {
+		if !strings.Contains(v, want) {
+			t.Errorf("the plan lacks %q:\n%s", want, v)
+		}
+	}
+	m = press(m, "enter")
 	if m.(initModel).form {
-		t.Error("the form stayed up after Set up")
+		t.Error("the form stayed up after the plan was agreed to")
 	}
 }
 
 func TestAWebhookThatIsNoAddressKeepsTheFormUp(t *testing.T) {
 	in := &serverInit{}
 	var m tea.Model = newInitModel(in, nil, true)
-	for range fWebhooks {
-		m = send(m, tea.KeyMsg{Type: tea.KeyTab})
-	}
+	m = press(toPart(t, m, "Notifications"), "space")
 	m = typeIn(m, "hooks.slack.com/services/x")
-	for range fStart - fWebhooks {
-		m = send(m, tea.KeyMsg{Type: tea.KeyTab})
+	m = toNext(press(m, "esc"))
+	im := m.(initModel)
+	if !im.form || im.plan || !strings.Contains(m.View(), "http(s) address") {
+		t.Fatalf("an address without its scheme was taken:\n%s", m.View())
 	}
-	m = send(m, tea.KeyMsg{Type: tea.KeyEnter})
-	if !m.(initModel).form || m.(initModel).focus != fWebhooks || !strings.Contains(m.View(), "http(s) address") {
-		t.Errorf("an address without its scheme was taken:\n%s", m.View())
+	// Closing the message opens the field that is wrong.
+	m = press(m, "q")
+	d := m.(initModel).choices.dialog
+	if d == nil || d.Fields[d.focus] != m.(initModel).choices.webhooks {
+		t.Errorf("the webhook was not given the cursor")
 	}
 }
 
@@ -65,34 +106,119 @@ func TestAnOfflineBundleIsGivenInTheFormWithItsDigest(t *testing.T) {
 	if v := m.View(); !strings.Contains(v, "Offline bundle") {
 		t.Fatalf("the form offers no bundle:\n%s", v)
 	}
-	for range fBundle {
-		m = send(m, tea.KeyMsg{Type: tea.KeyTab})
-	}
+	m = press(toPart(t, m, "Offline bundle"), "space")
 	m = typeIn(m, "/media/usb/b.tar")
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyEnter})
-	if !m.(initModel).form || !strings.Contains(m.View(), "sha256") || m.(initModel).focus != fBundleSHA {
+	m = toNext(press(m, "esc"))
+	if m.(initModel).plan || !strings.Contains(m.View(), "sha256") {
 		t.Fatalf("a bundle without its digest was accepted:\n%s", m.View())
 	}
+	m = press(m, "q") // the message closed, the digest has the cursor
 	m = typeIn(m, strings.Repeat("AB", 32))
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyEnter})
-	if m.(initModel).form || in.bundle != "/media/usb/b.tar" || in.bundleSHA != strings.Repeat("ab", 32) {
-		t.Errorf("bundle %q sha %q, form up %v", in.bundle, in.bundleSHA, m.(initModel).form)
+	m = toNext(press(m, "esc"))
+	if !m.(initModel).plan || in.bundle != "/media/usb/b.tar" || in.bundleSHA != strings.Repeat("ab", 32) {
+		t.Errorf("bundle %q sha %q, plan %v: %s", in.bundle, in.bundleSHA, m.(initModel).plan, m.(initModel).choices.err)
 	}
 }
 
 func TestAnEmailThatIsNotOneIsSaidSo(t *testing.T) {
 	in := &serverInit{}
 	var m tea.Model = newInitModel(in, nil, true)
+	m = press(m, "enter") // the control plane, first
 	m = typeIn(m, "not an address")
-	for range fStart {
-		m = send(m, tea.KeyMsg{Type: tea.KeyTab})
-	}
-	m = send(m, tea.KeyMsg{Type: tea.KeyEnter})
-	if !m.(initModel).form || !strings.Contains(m.View(), "not an address") {
+	m = toNext(press(m, "esc"))
+	if m.(initModel).plan || !strings.Contains(m.View(), "not an address") {
 		t.Errorf("a bad email was accepted:\n%s", m.View())
 	}
 }
 
+func TestEachPartsSettingsReachInit(t *testing.T) {
+	in := &serverInit{}
+	var m tea.Model = newInitModel(in, nil, true)
+	m = press(toPart(t, m, "Control plane"), "enter", "tab", "tab", "right", "tab", "right", "esc") // Türkçe, sign-up open
+	// The starter: qwen3-8b, the fifth, with 8192 tokens.
+	m = press(toPart(t, m, "Starter model"), "enter", "right", "right", "right", "right", "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "8192"), "esc")
+	// The judge: serving flagged, three copies, 3s, and PII too.
+	m = press(toPart(t, m, "Guardrails' judge"), "enter", "right", "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "3"), "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = typeIn(m, "3s")
+	for range 6 { // past the five ticked, to PII
+		m = press(m, "tab")
+	}
+	m = press(m, "space", "esc")
+	m = press(toPart(t, m, "Pictures and 3D"), "space")
+	m = press(toPart(t, m, "Limits and keys"), "enter")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "120"), "tab", "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "30"), "esc")
+	m = press(toPart(t, m, "Taking turns on a card"), "enter")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "1m"), "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "1m"), "esc")
+	m = press(toPart(t, m, "Model mirror"), "enter", "tab")
+	m = send(m, tea.KeyMsg{Type: tea.KeyCtrlU})
+	m = press(typeIn(m, "/data/models"), "esc")
+	m = toNext(m)
+	if !m.(initModel).plan {
+		t.Fatalf("not taken: %s", m.(initModel).choices.err)
+	}
+	switch {
+	case in.language != "tr" || !in.signupOpen:
+		t.Errorf("language %q signup %v", in.language, in.signupOpen)
+	case in.starter.Name != "qwen3-8b" || in.starterCtx != 8192:
+		t.Errorf("starter %q ctx %d", in.starter.Name, in.starterCtx)
+	case in.judge.Fail != "open" || in.judge.Replicas != 3 || in.judge.Budget != 3*time.Second ||
+		len(in.judge.Categories) != 6 || in.judge.Categories[5] != "PII":
+		t.Errorf("judge %+v", in.judge)
+	case !in.media:
+		t.Error("pictures and 3D not taken")
+	case in.defaultRPM != 120 || in.defaultTPM != defaultTPM || in.maxKeyTTL != 30*24*time.Hour:
+		t.Errorf("limits %d %d %s", in.defaultRPM, in.defaultTPM, in.maxKeyTTL)
+	case in.evictAfterIdle != time.Minute || in.minLifetime != time.Minute:
+		t.Errorf("turns %s %s", in.evictAfterIdle, in.minLifetime)
+	case in.mirrorPath != "/data/models":
+		t.Errorf("mirror %q", in.mirrorPath)
+	}
+	v := m.View()
+	for _, want := range []string{"--starter qwen3-8b", "--starter-context 8192", "--judge-fail open", "--judge-replicas 3",
+		"--language tr", "--media", "--mirror-dir /data/models", "--evict-after-idle 1m", "--max-key-ttl 720h"} {
+		if !strings.Contains(v, want) {
+			t.Errorf("the command lacks %q:\n%s", want, v)
+		}
+	}
+}
+
+func TestAStarterModelWantsTheMirror(t *testing.T) {
+	in := &serverInit{}
+	var m tea.Model = newInitModel(in, nil, true)
+	m = toNext(press(toPart(t, m, "Model mirror"), "space"))
+	if m.(initModel).plan || !strings.Contains(m.View(), "turn the mirror on") {
+		t.Errorf("a starter model with no mirror to fetch it into was taken:\n%s", m.View())
+	}
+}
+
+func TestALongDialogScrollsWithItsFocus(t *testing.T) {
+	in := &serverInit{}
+	m := newInitModel(in, nil, true)
+	m.choices.height = 24
+	var tm tea.Model = press(toPart(t, m, "Guardrails' judge"), "enter")
+	_, top := tm.(initModel).choices.overlay()
+	if !strings.Contains(top, "↓ more") || strings.Contains(top, "Copyright Violation") {
+		t.Fatalf("a dialog taller than the screen is not cut:\n%s", top)
+	}
+	for range 11 {
+		tm = press(tm, "tab")
+	}
+	if _, bottom := tm.(initModel).choices.overlay(); !strings.Contains(bottom, "Copyright Violation") {
+		t.Errorf("the focus went where it cannot be seen:\n%s", bottom)
+	}
+}
+
 func TestInitsLinesAreFiledAndThePasswordKeptInView(t *testing.T) {
 	in := &serverInit{admin: "ops@example.com", pkiDir: "/etc/llmgw/pki"}
 	var m tea.Model = newInitModel(in, nil, false)
@@ -132,17 +258,14 @@ func TestInitsLinesAreFiledAndThePasswordKeptInView(t *testing.T) {
 	}
 }
 
-func TestWithAMirrorElsewhereTheFormDoesNotOfferOne(t *testing.T) {
+func TestWithAMirrorElsewhereTheFormSaysSo(t *testing.T) {
 	in := &serverInit{mirrorURL: "http://10.0.0.150:8082"}
 	var m tea.Model = newInitModel(in, nil, true)
-	if v := m.View(); !strings.Contains(v, "at http://10.0.0.150:8082, from --mirror") {
+	if v := m.View(); !strings.Contains(v, "at http://10.0.0.150:8082") {
 		t.Errorf("the mirror in use is not shown:\n%s", v)
 	}
-	// Tab from the addresses goes to the webhooks, past the mirror line to
-	// PostgreSQL, then the node.
-	m = send(m, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab}, tea.KeyMsg{Type: tea.KeyTab},
-		tea.KeyMsg{Type: tea.KeyTab})
-	if f := m.(initModel).focus; f != fNode {
-		t.Errorf("focus %d, want the node toggle %d", f, fNode)
+	m = toNext(m)
+	if !m.(initModel).plan || in.mirrorURL != "http://10.0.0.150:8082" || !in.noMirror {
+		t.Errorf("mirror %q noMirror %v: %s", in.mirrorURL, in.noMirror, m.(initModel).choices.err)
 	}
 }

internal/cli/tui_setup.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"net"
-	"net/mail"
 	"os"
 	"strings"
 	"sync"
@@ -15,7 +14,6 @@ import (
 	"github.com/charmbracelet/lipgloss"
 
 	joinpkg "gitea.mynodes.xyz/ilker/llmgw/internal/join"
-	"gitea.mynodes.xyz/ilker/llmgw/internal/notify"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/onboard"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/pgha"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/preflight"
@@ -36,7 +34,8 @@ type setupPage int
 
 const (
 	pWelcome setupPage = iota
-	pAdmin
+	// pChoices is what is installed, part by part, each with its settings.
+	pChoices
 	pMachines
 	// pWait shows the codes for machines joining rather than logged into,
 	// until they have all dialled in.
@@ -113,6 +112,10 @@ func newDBMachine(n int) dbMachine {
 	if os.Getenv("SSH_AUTH_SOCK") == "" {
 		m.auth = authKey
 	}
+	// As choosing the way to log in sets them: a key file's path is not a
+	// secret to hide.
+	m.secret.Mask = m.auth == authPassword
+	m.secret.Placeholder = map[int]string{authKey: "/root/.ssh/id_ed25519", authPassword: "the user's ssh password"}[m.auth]
 	return m
 }
 
@@ -151,8 +154,7 @@ type setupModel struct {
 	ips    []string
 	choice int // 0 one machine, 1 high availability
 
-	admin, names, webhooks textField
-	afocus                 int // admin, names, webhooks, next
+	choices *installForm
 
 	db     [2]dbMachine
 	mfocus int // over both machines' fields, then the check button
@@ -181,14 +183,13 @@ type setupModel struct {
 }
 
 func newSetupModel(host string, ips []string) setupModel {
-	admin := newTextField()
-	admin.Placeholder, admin.CharLimit, admin.Width = "you@example.com", 200, 40
-	names := newTextField()
-	names.Placeholder, names.CharLimit, names.Width = "llm.example.com, 203.0.113.10", 400, 40
-	webhooks := newTextField()
-	webhooks.Placeholder, webhooks.CharLimit, webhooks.Width = "https://hooks.slack.com/services/…", 800, 40
+	in := newDefaultServerInit()
+	// The control plane of a replicated setup is not where models run;
+	// nodes are added once it is up. Either can still be chosen.
+	in.noNode, in.noModel = true, true
+	in.standbys = true
 	return setupModel{
-		ref: &progRef{}, host: host, ips: ips, admin: admin, names: names, webhooks: webhooks,
+		ref: &progRef{}, host: host, ips: ips, in: &in, choices: newInstallForm(&in, host, ips, true),
 		db: [2]dbMachine{newDBMachine(1), newDBMachine(2)}, spin: newSpinner(), width: 100, height: 30,
 		log: &[]string{}, logMu: &sync.Mutex{},
 	}
@@ -207,6 +208,7 @@ func (m setupModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		m.width, m.height = msg.Width, msg.Height
+		m.choices.height = msg.Height
 		m.run.width = msg.Width - navWidth - 6
 	case spinTickMsg:
 		var cmd tea.Cmd
@@ -244,6 +246,11 @@ func (m setupModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 }
 
 func (m setupModel) key(k tea.KeyMsg) (tea.Model, tea.Cmd) {
+	// The choices' own dialogs take their keys, Esc among them.
+	if m.page == pChoices && (m.choices.dialog != nil || m.choices.err != "") {
+		m.choices.key(k, m.in)
+		return m, nil
+	}
 	// A dialog open takes the next key, whatever it is, to close it.
 	if m.formErr != "" {
 		m.formErr = ""
@@ -275,12 +282,13 @@ func (m setupModel) key(k tea.KeyMsg) (tea.Model, tea.Cmd) {
 				m.single = true
 				return m, tea.Quit
 			}
-			m.page = pAdmin
-			m.afocus = 0
-			m.admin.Focus()
+			m.page = pChoices
+		}
+	case pChoices:
+		if m.choices.key(k, m.in) {
+			m.page, m.mfocus = pMachines, 0
+			m.focusMachine()
 		}
-	case pAdmin:
-		return m.adminKey(k)
 	case pMachines:
 		return m.machinesKey(k)
 	case pCheck:
@@ -309,73 +317,6 @@ func (m setupModel) key(k tea.KeyMsg) (tea.Model, tea.Cmd) {
 	return m, nil
 }
 
-func (m setupModel) adminKey(k tea.KeyMsg) (tea.Model, tea.Cmd) {
-	move := func(d int) {
-		m.afocus = (m.afocus + d + 4) % 4
-		m.admin.Blur()
-		m.names.Blur()
-		m.webhooks.Blur()
-		switch m.afocus {
-		case 0:
-			m.admin.Focus()
-		case 1:
-			m.names.Focus()
-		case 2:
-			m.webhooks.Focus()
-		}
-	}
-	switch k.Type {
-	case tea.KeyTab, tea.KeyDown:
-		move(1)
-		return m, nil
-	case tea.KeyShiftTab, tea.KeyUp:
-		move(-1)
-		return m, nil
-	case tea.KeyEnter:
-		if m.afocus < 3 {
-			move(1)
-			return m, nil
-		}
-		if _, err := mail.ParseAddress(strings.TrimSpace(m.admin.Value())); err != nil {
-			m.formErr = "the administrator's email is needed, and that is not one"
-			m.afocus = 0
-			move(0)
-			return m, nil
-		}
-		if _, err := parseWebhooks(m.webhookList()); err != nil {
-			m.formErr = err.Error()
-			m.afocus = 2
-			move(0)
-			return m, nil
-		}
-		m.formErr = ""
-		m.page, m.mfocus = pMachines, 0
-		m.db[0].addr.Focus()
-		return m, nil
-	}
-	var cmd tea.Cmd
-	switch m.afocus {
-	case 0:
-		m.admin, cmd = m.admin.Update(k)
-	case 1:
-		m.names, cmd = m.names.Update(k)
-	case 2:
-		m.webhooks, cmd = m.webhooks.Update(k)
-	}
-	return m, cmd
-}
-
-// webhookList is the webhooks asked for, one an item.
-func (m setupModel) webhookList() []string {
-	var out []string
-	for _, s := range strings.Split(m.webhooks.Value(), ",") {
-		if s = strings.TrimSpace(s); s != "" {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
 func (m *setupModel) focusMachine() {
 	for i := range m.db {
 		for f := 0; f < mfCount; f++ {
@@ -534,7 +475,7 @@ func (m *setupModel) startCheck() tea.Cmd {
 		if d.auth == authJoin {
 			m.conns = append(m.conns, dbConn{remote: d.joined, addr: d.joined.Addr, joined: d.joined})
 			machines = append(machines, preflight.Machine{Name: d.joined.Hostname + " (" + d.joined.Addr + ", joined)",
-				Addr: d.joined.Addr, Roles: []preflight.Role{preflight.RoleDatabase}, Remote: d.joined})
+				Addr: d.joined.Addr, Roles: m.dbRoles(), Remote: d.joined})
 			continue
 		}
 		g := &onboard.GoSSH{
@@ -549,7 +490,7 @@ func (m *setupModel) startCheck() tea.Cmd {
 		}
 		m.conns = append(m.conns, dbConn{remote: g, addr: g.Addr, ssh: g})
 		machines = append(machines, preflight.Machine{Name: g.Addr, Addr: g.Addr,
-			Roles: []preflight.Role{preflight.RoleDatabase}, Remote: g})
+			Roles: m.dbRoles(), Remote: g})
 	}
 	m.checking = true
 	m.report = preflight.Report{}
@@ -580,6 +521,15 @@ func (m *setupModel) startCheck() tea.Cmd {
 	}
 }
 
+// dbRoles are what the other two machines are to be: the store, and a
+// control plane too when they stand by.
+func (m setupModel) dbRoles() []preflight.Role {
+	if m.in.standbys {
+		return []preflight.Role{preflight.RoleDatabase, preflight.RoleControl}
+	}
+	return []preflight.Role{preflight.RoleDatabase}
+}
+
 // targets are the database machines as user@address, for the command line.
 func (m setupModel) targets() []string {
 	var out []string
@@ -593,47 +543,20 @@ func (m setupModel) targets() []string {
 	return out
 }
 
-func (m setupModel) namesList() []string {
-	var out []string
-	for _, h := range strings.Split(m.names.Value(), ",") {
-		if h = strings.TrimSpace(h); h != "" {
-			out = append(out, h)
-		}
-	}
-	return out
-}
-
 // command is what this setup is on the command line, for doing it again
 // from a script — with keys in place, since a password cannot be given there.
 func (m setupModel) command() string {
-	parts := []string{"sudo --preserve-env=SSH_AUTH_SOCK llmgw server init",
-		"--admin " + strings.TrimSpace(m.admin.Value())}
-	for _, h := range m.namesList() {
-		parts = append(parts, "--host "+h)
-	}
-	for _, t := range m.targets() {
-		parts = append(parts, "--patroni "+t)
-	}
-	for _, w := range m.webhookList() {
-		parts = append(parts, "--webhook "+w)
-	}
-	parts = append(parts, "--no-node", "--no-model")
-	return strings.Join(parts, " \\\n    ")
+	in := *m.in
+	in.patroni = m.targets()
+	return strings.Join(append([]string{"sudo --preserve-env=SSH_AUTH_SOCK llmgw server init"}, in.initFlags()...), " \\\n    ")
 }
 
 // startRun installs: sudo granted where it asks for a password, the control
 // plane here, the store on the other two, then sudo taken back.
 func (m *setupModel) startRun() tea.Cmd {
-	in := newDefaultServerInit()
-	in.admin = strings.TrimSpace(m.admin.Value())
-	in.hosts = m.namesList()
+	in := m.in
 	in.patroni = m.targets()
-	in.webhooks = m.webhookList()
-	// The control plane of a replicated setup is not where models run;
-	// nodes are added once it is up.
-	in.noNode, in.noModel = true, true
-	m.in = &in
-	m.run = newInitModel(&in, nil, false)
+	m.run = newInitModel(in, nil, false)
 	m.run.running, m.run.width, m.run.spin = true, m.width, m.spin
 	ref, conns, logp, mu, listener := m.ref, m.conns, m.log, m.logMu, m.listener
 	return func() tea.Msg {
@@ -688,7 +611,7 @@ var setupSteps = []struct {
 	label string
 	page  setupPage
 }{
-	{"Start", pWelcome}, {"Administrator", pAdmin}, {"Machines", pMachines},
+	{"Start", pWelcome}, {"Choices", pChoices}, {"Machines", pMachines},
 	{"Checks", pCheck}, {"Plan", pPlan}, {"Install", pRun},
 }
 
@@ -721,6 +644,9 @@ func (m setupModel) View() string {
 	if m.formErr != "" {
 		f.DialogTitle, f.Dialog = "Not yet", m.formErr+"\n\n"+sDim.Render("any key to go back")
 	}
+	if m.page == pChoices {
+		f.DialogTitle, f.Dialog = m.choices.overlay()
+	}
 	return f.render()
 }
 
@@ -729,8 +655,12 @@ func (m setupModel) pageView() (string, string, string) {
 	switch m.page {
 	case pWelcome:
 		return "Start", m.welcomeView(), "↑↓ choose · Enter go on · Ctrl+C leave"
-	case pAdmin:
-		return "Administrator", m.adminView(), "Tab/↑↓ move · Enter next · Esc back · Ctrl+C leave"
+	case pChoices:
+		keys := m.choices.keys()
+		if m.choices.dialog == nil && m.choices.err == "" {
+			keys = strings.Replace(keys, " · Ctrl+C", " · Esc back · Ctrl+C", 1)
+		}
+		return "What to install", m.choices.view(m.width - navWidth - 6), keys
 	case pMachines:
 		return "Database machines", m.machinesView(), "Tab/↑↓ move · ←→ how to log in · Enter next · Esc back · PgUp/PgDn scroll"
 	case pWait:
@@ -771,26 +701,8 @@ func (m setupModel) welcomeView() string {
 	}
 	opt(0, "One machine", "This machine runs everything: control plane, model mirror,\n      and models if it has room.")
 	opt(1, "High availability — three machines",
-		"This one is the control plane; two more keep the store, replicated,\n      so losing any one machine loses nothing.")
-	return b.String()
-}
-
-func (m setupModel) adminView() string {
-	var b strings.Builder
-	label := func(i int, s string) string {
-		if m.afocus == i {
-			return fSelected.Render("› " + s)
-		}
-		return "  " + s
-	}
-	b.WriteString("\n")
-	fmt.Fprintf(&b, "%s\n    %s\n    %s\n\n", label(0, "Administrator's email"), m.admin.View(),
-		sDim.Render("A password is generated and shown once, at the end."))
-	fmt.Fprintf(&b, "%s\n    %s\n    %s\n\n", label(1, "Other names nodes will reach this machine by"), m.names.View(),
-		sDim.Render("Known: "+strings.Join(append([]string{m.host}, m.ips...), ", ")+". Add a DNS name or a floating address."))
-	fmt.Fprintf(&b, "%s\n    %s\n    %s\n\n", label(2, "Notification webhooks"), m.webhooks.View(),
-		sDim.Render("Where a parked model, a lost node or a spent budget is said: Slack, Mattermost, or any URL taking JSON. Optional; a test is sent."))
-	b.WriteString(button(m.afocus == 3, "Next") + "\n")
+		"Each of the three can run the gateway; two keep the store, replicated,\n"+
+			"      and etcd votes on all three, so losing any one machine loses nothing.")
 	return b.String()
 }
 
@@ -907,24 +819,25 @@ func (m setupModel) checkView() string {
 
 func (m setupModel) planView() string {
 	var b strings.Builder
-	b.WriteString("\n  What will be installed:\n\n")
-	fmt.Fprintf(&b, "  %s  %s\n      %s\n", lipgloss.NewStyle().Bold(true).Render(m.host), sDim.Render(m.thisAddr()),
-		"control plane and gateway, model mirror, etcd (the third vote)")
-	fmt.Fprintf(&b, "      administrator %s\n", strings.TrimSpace(m.admin.Value()))
-	if hooks, _ := parseWebhooks(m.webhookList()); len(hooks) > 0 {
-		var where []string
-		for _, h := range hooks {
-			where = append(where, notify.Redact(h.URL)+" ("+h.Format+")")
-		}
-		fmt.Fprintf(&b, "      alerts to %s\n", strings.Join(where, ", "))
+	b.WriteString(m.choices.planView(m.width - navWidth - 6))
+	b.WriteString("\n  " + lipgloss.NewStyle().Bold(true).Render("The three machines") + "\n")
+	here := "control plane, leading at first; model mirror; etcd"
+	there := "PostgreSQL under Patroni, etcd"
+	if m.in.standbys {
+		there = "control plane, standing by; " + there
 	}
+	if m.in.vip != "" {
+		here += "; keepalived"
+		there += "; keepalived"
+	}
+	fmt.Fprintf(&b, "  %s  %s\n      %s\n", lipgloss.NewStyle().Bold(true).Render(m.host), sDim.Render(m.thisAddr()), here)
 	granted := false
 	for _, d := range m.db {
 		addr := strings.TrimSpace(d.addr.Value())
 		if d.joined != nil {
 			addr = d.joined.Hostname + "  " + sDim.Render(d.joined.Addr+", joined")
 		}
-		fmt.Fprintf(&b, "  %s\n      PostgreSQL under Patroni, etcd\n", lipgloss.NewStyle().Bold(true).Render(addr))
+		fmt.Fprintf(&b, "  %s\n      %s\n", lipgloss.NewStyle().Bold(true).Render(addr), there)
 		granted = granted || d.sudo.Value() != ""
 	}
 	b.WriteString("\n  The store is replicated from the first to the second; if the primary is lost\n" +

internal/cli/tui_setup_test.go

@@ -26,6 +26,12 @@ func press(m tea.Model, keys ...string) tea.Model {
 			msg = tea.KeyMsg{Type: tea.KeyTab}
 		case "down":
 			msg = tea.KeyMsg{Type: tea.KeyDown}
+		case "up":
+			msg = tea.KeyMsg{Type: tea.KeyUp}
+		case "space":
+			msg = tea.KeyMsg{Type: tea.KeySpace, Runes: []rune(" ")}
+		case "left":
+			msg = tea.KeyMsg{Type: tea.KeyLeft}
 		case "esc":
 			msg = tea.KeyMsg{Type: tea.KeyEsc}
 		case "right":
@@ -41,20 +47,28 @@ func press(m tea.Model, keys ...string) tea.Model {
 func TestTheSetupAsksForWhatHighAvailabilityNeedsAndRefusesWhatWillNotDo(t *testing.T) {
 	m := tea.Model(newSetupModel("ctl", []string{"10.0.0.5"}))
 	m = press(m, "down", "enter")
-	if s := m.(setupModel); s.page != pAdmin {
-		t.Fatalf("high availability did not lead to the administrator: page %d", s.page)
+	if s := m.(setupModel); s.page != pChoices {
+		t.Fatalf("high availability did not lead to the choices: page %d", s.page)
+	}
+	// Three machines, each a control plane, unless told otherwise.
+	if v := m.View(); !strings.Contains(v, "Control plane on all three") || !strings.Contains(v, "two standbys") {
+		t.Errorf("the standbys are not offered, ticked:\n%s", v)
 	}
 	// No email: refused, with a reason.
-	m = press(m, "tab", "tab", "tab", "enter")
-	if s := m.(setupModel); s.page != pAdmin || !strings.Contains(s.formErr, "email") {
-		t.Fatalf("went on without an administrator: %+v", s.formErr)
+	m = press(m, "up", "enter")
+	if s := m.(setupModel); s.page != pChoices || !strings.Contains(s.choices.err, "email") {
+		t.Fatalf("went on without an administrator: %+v", s.choices.err)
 	}
-	// The refusal is a dialog; a key closes it, and the cursor is back on
-	// the email.
+	// The refusal is a dialog; a key closes it, and the control plane's
+	// settings open with the cursor on the email.
 	if !strings.Contains(m.View(), "Not yet") {
 		t.Error("the refusal was not shown as a dialog")
 	}
-	m = press(m, "x", "a@example.com", "tab", "tab", "tab", "enter")
+	m = press(m, "q")
+	if s := m.(setupModel); s.choices.dialog == nil || s.choices.dialog.Fields[s.choices.dialog.focus] != s.choices.admin {
+		t.Fatal("the email was not given the cursor")
+	}
+	m = press(m, "a@example.com", "esc", "enter")
 	s := m.(setupModel)
 	if s.page != pMachines {
 		t.Fatalf("page %d: %s", s.page, s.formErr)
@@ -78,7 +92,7 @@ func TestTheSetupAsksForWhatHighAvailabilityNeedsAndRefusesWhatWillNotDo(t *test
 		t.Errorf("a valid pair refused: %s", err)
 	}
 	cmd := s.command()
-	for _, want := range []string{"--admin a@example.com", "--patroni ubuntu@10.0.0.6", "--patroni ubuntu@10.0.0.7", "--no-node"} {
+	for _, want := range []string{"--admin a@example.com", "--patroni ubuntu@10.0.0.6", "--patroni ubuntu@10.0.0.7", "--no-node", "--standbys"} {
 		if !strings.Contains(cmd, want) {
 			t.Errorf("command lacks %q:\n%s", want, cmd)
 		}

internal/config/config.go

@@ -550,7 +550,7 @@ type Control struct {
 	// Only meaningful with a shared store, where a second control plane can
 	// see the claim. Long enough to survive a slow query or a brief network
 	// stall, short enough that a standby takes over before anyone has finished
-	// reading the alert. Zero takes the default.
+	// reading the alert. Zero takes the default, 10s.
 	LeaseTTL time.Duration `koanf:"lease_ttl"`
 }
 

internal/control/adminapi/promsd.go

@@ -45,6 +45,19 @@ func (a *API) nodeExporterTargetsWith(r *http.Request, nodes []NodeView) []SDGro
 		name, _ := os.Hostname()
 		add(host, name, "control-plane")
 	}
+	// Every control plane, not this one only, before the store's members:
+	// Prometheus asks each of them, and a machine that one called a control
+	// plane and another a store member was two targets, its every series
+	// counted twice.
+	if a.controlPlanes != nil {
+		for _, cp := range a.controlPlanes().Members {
+			host := cp.Address
+			if h, _, err := net.SplitHostPort(host); err == nil {
+				host = h
+			}
+			add(strings.TrimSpace(host), cp.Name, "control-plane")
+		}
+	}
 	for _, n := range nodes {
 		host := n.MgmtAddr
 		if h, _, err := net.SplitHostPort(host); err == nil {

internal/control/adminapi/promsd_test.go

@@ -21,3 +21,29 @@ func TestNodeExporterTargetsAreTheControlPlaneAndTheStore(t *testing.T) {
 		}
 	}
 }
+
+func TestEveryControlPlaneListsTheOthersAlike(t *testing.T) {
+	// 140 called 150 a store member and 150 called itself a control plane:
+	// Prometheus, asking both, scraped 150 twice and counted it twice.
+	targets := func(self string) map[string]string {
+		a := &API{}
+		a.SetStoreStatus(func() ([]StoreMember, error) {
+			return []StoreMember{{Name: "llmgw-pg01", Host: "10.0.0.149"}, {Name: "llmgw-ctl02", Host: "10.0.0.150"}}, nil
+		})
+		a.SetControlPlanes(func() ControlPlanes {
+			return ControlPlanes{Members: []ControlPlane{{Name: "llmgw-ctl", Address: "10.0.0.140:7443"},
+				{Name: "llmgw-ctl02", Address: "10.0.0.150:7443"}}}
+		})
+		r := httptest.NewRequest("GET", "http://"+self+":9091/prometheus/targets", nil)
+		out := map[string]string{}
+		for _, g := range a.nodeExporterTargetsWith(r, nil) {
+			out[g.Targets[0]] = g.Labels["role"]
+		}
+		return out
+	}
+	from140, from150 := targets("10.0.0.140"), targets("10.0.0.150")
+	if from140["10.0.0.150:9100"] != "control-plane" || from150["10.0.0.140:9100"] != "control-plane" ||
+		from140["10.0.0.149:9100"] != "store" {
+		t.Errorf("from 140 %v, from 150 %v", from140, from150)
+	}
+}

internal/control/leadership.go

@@ -3,6 +3,7 @@ package control
 import (
 	"context"
 	"crypto/rand"
+	"database/sql"
 	"encoding/hex"
 	"errors"
 	"log/slog"
@@ -59,6 +60,17 @@ type Leadership struct {
 
 	hookMu sync.Mutex
 	onLead []func()
+
+	// cut is a store this process could not reach, and back when it was
+	// reached again: Run's alone, so unlocked.
+	cut  bool
+	back time.Time
+}
+
+// LeaseReader reads who holds a lease without competing for it: a store
+// that has it lets a standby hold back after the store returns.
+type LeaseReader interface {
+	Leadership(ctx context.Context, role string) (store.Lease, error)
 }
 
 // OnLead is called each time this process becomes the leader, after
@@ -91,8 +103,9 @@ func NewLeadership(st LeaseStore, ttl time.Duration, log *slog.Logger) *Leadersh
 	if ttl <= 0 {
 		// Long enough to survive a slow database or a brief network stall,
 		// short enough that a standby takes over before anyone has finished
-		// reading the alert.
-		ttl = 15 * time.Second
+		// reading the alert. A store out of reach for longer — its primary
+		// being replaced — does not move it: see holdBack.
+		ttl = 10 * time.Second
 	}
 	l := &Leadership{
 		store: st,
@@ -146,6 +159,9 @@ func (l *Leadership) attempt(ctx context.Context) {
 	if l.stopped.Load() {
 		return
 	}
+	if l.holdBack(ctx) {
+		return
+	}
 	lease, err := l.store.AcquireLeadership(ctx, controlRole, l.owner, l.ttl)
 	switch {
 	case err == nil && l.stopped.Load():
@@ -177,9 +193,47 @@ func (l *Leadership) attempt(ctx context.Context) {
 		// stop a cluster from healing itself.
 		l.log.Warn("could not reach the store to renew leadership; keeping it for now",
 			"err", err)
+		l.cut, l.back = true, time.Time{}
 	}
 }
 
+// holdBack is a standby leaving a lapsed lease alone for one round after the
+// store returns from being out of reach.
+//
+// A store's primary that is lost takes longer to replace than the lease
+// lives, so the lease has lapsed by the time the store answers again — for
+// the leader as for the standbys, which all failed to reach it alike. The
+// first to ask then took it, and it was as often a standby as the leader:
+// leadership moved for nothing, and the new leader spent half a minute
+// learning from the agents where the judges were, refusing requests
+// meanwhile. The leader renews within a round of the store's return, so a
+// standby that waits that round takes the lease only from a leader that is
+// gone.
+func (l *Leadership) holdBack(ctx context.Context) bool {
+	if l.leader.Load() || !l.cut {
+		return false
+	}
+	r, ok := l.store.(LeaseReader)
+	if !ok {
+		l.cut = false
+		return false
+	}
+	if _, err := r.Leadership(ctx, controlRole); err != nil && !errors.Is(err, sql.ErrNoRows) {
+		l.back = time.Time{}
+		return true
+	}
+	if l.back.IsZero() {
+		l.back = time.Now()
+		l.log.Info("the store answers again; leaving the lease to its holder for a round", "owner", l.owner)
+	}
+	// A round less a tenth, for the ticker's own jitter.
+	if time.Since(l.back) < l.renew-l.renew/10 {
+		return true
+	}
+	l.cut, l.back = false, time.Time{}
+	return false
+}
+
 // StepDown gives the lease up now, for a process on its way out: called
 // before the agents are let go, so the standby they move to is already the
 // leader, and before the process exits, which would otherwise race the

internal/control/leadership_test.go

@@ -1,6 +1,8 @@
 package control
 
 import (
+	"context"
+	"errors"
 	"log/slog"
 	"path/filepath"
 	"testing"
@@ -75,3 +77,80 @@ func TestAStandbyIsToldWhenItBecomesTheLeader(t *testing.T) {
 		t.Fatal("b became the leader and was not told")
 	}
 }
+
+// cuttable is a store that can be out of reach, as one whose primary was lost.
+type cuttable struct {
+	*store.DB
+	down bool
+}
+
+func (c *cuttable) AcquireLeadership(ctx context.Context, role, owner string, ttl time.Duration) (store.Lease, error) {
+	if c.down {
+		return store.Lease{}, errors.New("dial error: timeout")
+	}
+	return c.DB.AcquireLeadership(ctx, role, owner, ttl)
+}
+
+func (c *cuttable) Leadership(ctx context.Context, role string) (store.Lease, error) {
+	if c.down {
+		return store.Lease{}, errors.New("dial error: timeout")
+	}
+	return c.DB.Leadership(ctx, role)
+}
+
+// The store out of reach for longer than the lease lives, as while Patroni
+// promotes a standby: when it answers again the lease has lapsed for all,
+// and the leader keeps it rather than a standby taking it for nothing. A
+// leader that is truly gone is still replaced, a round later.
+func TestAStoreThatReturnsLeavesTheLeaderLeading(t *testing.T) {
+	st, err := store.Open(t.Context(), filepath.Join(t.TempDir(), "s.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	c := &cuttable{DB: st}
+	log := slog.New(slog.DiscardHandler)
+	ctx := t.Context()
+	const ttl = 150 * time.Millisecond
+	a, b := NewLeadership(c, ttl, log), NewLeadership(c, ttl, log)
+	a.attempt(ctx)
+	b.attempt(ctx)
+	if !a.IsLeader() || b.IsLeader() {
+		t.Fatal("a should lead, b stand by")
+	}
+
+	c.down = true
+	a.attempt(ctx)
+	b.attempt(ctx)
+	time.Sleep(ttl + 20*time.Millisecond) // the lease lapses while nobody reaches the store
+	c.down = false
+
+	b.attempt(ctx) // the standby is first to ask
+	if b.IsLeader() {
+		t.Fatal("a standby took the lease the moment the store came back")
+	}
+	a.attempt(ctx)
+	if !a.IsLeader() {
+		t.Fatal("the leader did not keep the lease")
+	}
+	time.Sleep(a.renew)
+	b.attempt(ctx)
+	if b.IsLeader() {
+		t.Error("the standby took the lease from a leader renewing it")
+	}
+
+	// Now the leader is gone: the standby takes over after its round.
+	c.down = true
+	b.attempt(ctx)
+	time.Sleep(ttl + 20*time.Millisecond)
+	c.down = false
+	b.attempt(ctx)
+	if b.IsLeader() {
+		t.Fatal("took it at once")
+	}
+	time.Sleep(b.renew)
+	b.attempt(ctx)
+	if !b.IsLeader() {
+		t.Error("a leader that was gone was not replaced")
+	}
+}

internal/docgen/reference_gen.go

@@ -91,7 +91,7 @@ var Reference = []Block{
 		{Key: "timezone", Type: "string", Doc: "Timezone is where models' scaling schedules are read, an IANA name\nlike Europe/Istanbul; empty is the control plane's own.", Nested: ""},
 		{Key: "eval_dir", Type: "string", Doc: "EvalDir is where quality suites are read from by name, for `llmgw ctl\neval MODEL --suite NAME`, a model's eval gate and the console. The\nsuites the binary carries (arithmetic, json-format) are found when it\nhas none of the name; a suite here of the same name replaces one.", Nested: ""},
 		{Key: "enabled", Type: "bool", Doc: "Enabled runs the control plane even when configuration declares no\nmodels.\n\nWithout it, a deployment whose catalog lives entirely in the database\ncannot start: control plane mode is inferred from the config file, so an\nempty models block means \"router only\", the process refuses to start for\nwant of anything to serve, and the models it would have loaded are never\nread. That is a cluster that cannot be managed at runtime because it is\nmanaged at runtime. AgentListen cannot carry this signal — it has a\ndefault, so every deployment would become a control plane.", Nested: ""},
-		{Key: "lease_ttl", Type: "time.Duration", Doc: "LeaseTTL is how long this control plane's claim to be the one placing\nwork stands without being renewed.\n\nOnly meaningful with a shared store, where a second control plane can\nsee the claim. Long enough to survive a slow query or a brief network\nstall, short enough that a standby takes over before anyone has finished\nreading the alert. Zero takes the default.", Nested: ""},
+		{Key: "lease_ttl", Type: "time.Duration", Doc: "LeaseTTL is how long this control plane's claim to be the one placing\nwork stands without being renewed.\n\nOnly meaningful with a shared store, where a second control plane can\nsee the claim. Long enough to survive a slow query or a brief network\nstall, short enough that a standby takes over before anyone has finished\nreading the alert. Zero takes the default, 10s.", Nested: ""},
 	}},
 	{Package: "catalog", Name: "CustomNode", Title: "CustomNode", Doc: "", Fields: []Field{
 		{Key: "repo", Type: "string", Doc: "Repo is the repository, https only.", Nested: ""},

internal/guard/judge.go

@@ -198,25 +198,70 @@ func (j *judge) ask(ctx context.Context, jp *JudgePolicy, user, answer string) (
 	}
 	j.mu.Unlock()
 
-	err := errNoJudge
-	for _, model := range models {
-		var res judgment
-		res, err = j.askOne(ctx, jp, model, user, answer)
-		if err == nil {
-			j.remember(key, res)
-			return res, nil
+	start := time.Now()
+	for {
+		err := errNoJudge
+		var failed []string
+		var errs []error
+		// fast is every judge failing at once, as one does that is not
+		// there yet: the moment a control plane takes the lead, before
+		// the agents have told it where the judges are.
+		fast := true
+		for _, model := range models {
+			var res judgment
+			t := time.Now()
+			res, err = j.askOne(ctx, jp, model, user, answer)
+			if err == nil {
+				// The judges before it that failed are said to have, as
+				// one on a GPU that is down while the CPUs' answers.
+				j.report(failed, errs)
+				j.remember(key, res)
+				return res, nil
+			}
+			failed, errs = append(failed, model), append(errs, err)
+			if time.Since(t) > judgeFastFailure || errors.Is(err, errJudgeFormat) {
+				fast = false
+			}
+			if ctx.Err() != nil {
+				// The request itself is gone: no judge after this one is wanted.
+				break
+			}
 		}
-		if j.failed != nil {
-			j.failed(model, err)
-		}
-		if ctx.Err() != nil {
-			// The request itself is gone: no judge after this one is wanted.
-			break
+		// Asked again while the budget lasts, rather than refused at once:
+		// with fail: closed, every request in those seconds was a 503.
+		if fast && ctx.Err() == nil && time.Since(start)+judgeRetryEvery < jp.budget() {
+			select {
+			case <-ctx.Done():
+			case <-time.After(judgeRetryEvery):
+			}
+			if ctx.Err() == nil {
+				continue
+			}
 		}
+		// Told once, for the last round: not twenty times in five seconds.
+		j.report(failed, errs)
+		return judgment{}, err
 	}
-	return judgment{}, err
 }
 
+// report tells of each judge that gave no verdict.
+func (j *judge) report(models []string, errs []error) {
+	if j.failed == nil {
+		return
+	}
+	for i, model := range models {
+		j.failed(model, errs[i])
+	}
+}
+
+// A judge that fails within judgeFastFailure is one that is not there, and
+// is asked again every judgeRetryEvery while the policy's budget lasts. One
+// that is slow, or answers what cannot be read, is not.
+const (
+	judgeFastFailure = time.Second
+	judgeRetryEvery  = 250 * time.Millisecond
+)
+
 // askOne asks one judge, waiting the policy's budget for it.
 func (j *judge) askOne(ctx context.Context, jp *JudgePolicy, model, user, answer string) (res judgment, err error) {
 	start := time.Now()

internal/guard/judge_test.go

@@ -222,7 +222,7 @@ func TestJudgesAreAskedInTurn(t *testing.T) {
 	var asked []string
 	gpuDown := errors.New("no replica of gpu-judge is serving")
 	g := gate(t, lib(map[string]Policy{"p": {Fail: "closed",
-		Judge: &JudgePolicy{Models: []string{"gpu-judge", "cpu-judge"}, Input: "block"}}}, "p"))
+		Judge: &JudgePolicy{Models: []string{"gpu-judge", "cpu-judge"}, Input: "block", LatencyBudget: 600 * time.Millisecond}}}, "p"))
 	g.SetJudge(func(_ context.Context, model, _ string, body []byte) ([]byte, error) {
 		asked = append(asked, model)
 		if model == "gpu-judge" {
@@ -317,3 +317,44 @@ func TestALongTextIsJudgedByItsEnds(t *testing.T) {
 		t.Errorf("a short text was cut: %q", got)
 	}
 }
+
+// The moment a control plane takes the lead it knows no judge yet; one that
+// arrives within the budget judges the request, instead of fail: closed
+// refusing it at once. One that is slow is not asked again.
+func TestAJudgeNotThereYetIsWaitedForWithinTheBudget(t *testing.T) {
+	ctx := context.Background()
+	g := gate(t, lib(map[string]Policy{"p": {Fail: "closed",
+		Judge: &JudgePolicy{Model: "guard", Input: "block", LatencyBudget: 2 * time.Second}}}, "p"))
+	arrives := time.Now().Add(400 * time.Millisecond)
+	calls := 0
+	g.SetJudge(func(context.Context, string, string, []byte) ([]byte, error) {
+		calls++
+		if time.Now().Before(arrives) {
+			return nil, errors.New("no replica of guard is serving")
+		}
+		return json.Marshal(map[string]any{"choices": []any{map[string]any{"text": "Safety: Safe\nCategories: None"}}})
+	}, func(string) (string, []string, bool) { return "qwen3guard", nil, true })
+	var alarmed []string
+	g.SetJudgeAlarm(func(model string, _ error) { alarmed = append(alarmed, model) })
+	if v, err := g.Input(ctx, Subject{}, chat("user", "hello")); err != nil || v.Action != Allow {
+		t.Fatalf("refused while the judge was on its way: %+v %v", v, err)
+	}
+	if calls < 2 || len(alarmed) != 0 {
+		t.Errorf("asked %d times, alarms %v", calls, alarmed)
+	}
+
+	// Slow, and failing: given up on after one try, not the whole budget again.
+	calls = 0
+	g.SetJudge(func(ctx context.Context, _, _ string, _ []byte) ([]byte, error) {
+		calls++
+		time.Sleep(1100 * time.Millisecond)
+		return nil, errors.New("overloaded")
+	}, func(string) (string, []string, bool) { return "qwen3guard", nil, true })
+	start := time.Now()
+	if _, err := g.Input(ctx, Subject{}, chat("user", "hello again")); err == nil {
+		t.Error("fail closed served what no judge read")
+	}
+	if calls != 1 || time.Since(start) > 1800*time.Millisecond {
+		t.Errorf("a slow judge was asked %d times over %s", calls, time.Since(start))
+	}
+}

internal/pgha/config.go

@@ -169,9 +169,9 @@ etcd3:
 %[14]s
 bootstrap:
   dcs:
-    ttl: 30
-    loop_wait: 10
-    retry_timeout: 10
+    ttl: %[15]d
+    loop_wait: %[16]d
+    retry_timeout: %[17]d
     maximum_lag_on_failover: 1048576
     postgresql:
       use_pg_rewind: true
@@ -211,7 +211,7 @@ postgresql:
   parameters:
     unix_socket_directories: /var/run/postgresql
 `, Scope, m.Name, m.IP, PatroniPort, strings.Join(hosts, ","), version, s.Superuser, s.Replicator, hbaLines,
-		s.RestAPI, RestUser, sslLines, restTLSLines(tls), etcdTLSLines(tls))
+		s.RestAPI, RestUser, sslLines, restTLSLines(tls), etcdTLSLines(tls), leaderTTL, loopWait, retryTimeout)
 	b.WriteString(`
 tags:
   nofailover: false

internal/pgha/pgha_test.go

@@ -559,3 +559,42 @@ func TestAMemberLeftPendingARestartIsRestartedOnTheNextRun(t *testing.T) {
 		t.Errorf("restarted %v; only the member pending", restarted)
 	}
 }
+
+func TestALostPrimaryIsReplacedWithinTwentySeconds(t *testing.T) {
+	cfg := map[string]any{"ttl": 30, "loop_wait": 10, "retry_timeout": 10}
+	patches := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			_ = json.NewEncoder(w).Encode(cfg)
+		case http.MethodPatch:
+			patches++
+			_ = json.NewDecoder(r.Body).Decode(&cfg)
+		}
+	}))
+	defer srv.Close()
+	u, _ := url.Parse(srv.URL)
+	old := restPort
+	restPort, _ = strconv.Atoi(u.Port())
+	defer func() { restPort = old }()
+	ca, err := tlsconf.NewCA("test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := Setup{DB: []Node{{Member{"m", "127.0.0.1"}, &machine{}}}, CA: ca}
+	for range 2 {
+		if err := s.timings(context.Background(), Secrets{RestAPI: "pw"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if patches != 1 || cfg["ttl"].(float64) != 20 || cfg["loop_wait"].(float64) != 5 || cfg["retry_timeout"].(float64) != 5 {
+		t.Errorf("patched %d times to %v", patches, cfg)
+	}
+	// Patroni's own rule, or it refuses them.
+	if loopWait+2*retryTimeout > leaderTTL {
+		t.Error("loop_wait + 2*retry_timeout is more than ttl")
+	}
+	if c := Patroni(pg01, []Member{pg01, ctl02}, []Member{pg01, ctl02, ctl}, nil, "16", Secrets{}, false); !strings.Contains(c, "ttl: 20\n    loop_wait: 5\n    retry_timeout: 5\n") {
+		t.Errorf("a new cluster bootstraps with others:\n%s", c)
+	}
+}

internal/pgha/setup.go

@@ -131,6 +131,9 @@ func (s *Setup) Run(ctx context.Context) (string, error) {
 	if err := s.memory(ctx, sec); err != nil {
 		return "", fmt.Errorf("memory: %w", err)
 	}
+	if err := s.timings(ctx, sec); err != nil {
+		return "", fmt.Errorf("failover: %w", err)
+	}
 	if err := s.database(ctx); err != nil {
 		return "", fmt.Errorf("database: %w", err)
 	}

internal/pgha/timings.go

@@ -0,0 +1,60 @@
+package pgha
+
+import (
+	"context"
+	"fmt"
+)
+
+// How soon a lost primary is replaced. Patroni's own defaults — the leader
+// key lives 30 seconds, checked every 10 — had the control planes wait the
+// better part of a minute for a store after a database machine lost its
+// power. Patroni asks that loop_wait + 2*retry_timeout <= ttl, so a lost
+// primary is replaced within ttl and a slow etcd round is not mistaken for
+// one.
+const (
+	leaderTTL    = 20
+	loopWait     = 5
+	retryTimeout = 5
+)
+
+// timingSettings are the shared configuration's keys for them.
+func timingSettings() map[string]any {
+	return map[string]any{"ttl": leaderTTL, "loop_wait": loopWait, "retry_timeout": retryTimeout}
+}
+
+// timings puts them in the cluster's shared configuration, through
+// Patroni's API: a cluster set up with the old ones gets these in place.
+func (s *Setup) timings(ctx context.Context, sec Secrets) error {
+	// As with TLS, changed in place by the machine with the authority: init
+	// has it, and a new cluster has these from its bootstrap already.
+	if s.CA == nil {
+		return nil
+	}
+	var lastErr error
+	for _, d := range s.DB {
+		cfg, err := getConfig(ctx, d.IP)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		want := timingSettings()
+		same := true
+		for k, v := range want {
+			// JSON numbers come back as float64.
+			if n, ok := cfg[k].(float64); !ok || int(n) != v.(int) {
+				same = false
+			}
+		}
+		if same {
+			s.emit("failover", false, "a lost primary is replaced within %d seconds", leaderTTL)
+			return nil
+		}
+		if err := patchConfig(ctx, d.IP, sec.RestAPI, want); err != nil {
+			return fmt.Errorf("Patroni on %s: %w", d.IP, err)
+		}
+		s.emit("failover", true, "a lost primary is replaced within %d seconds (ttl %d, loop_wait %d, retry_timeout %d)",
+			leaderTTL, leaderTTL, loopWait, retryTimeout)
+		return nil
+	}
+	return fmt.Errorf("no member's Patroni answered: %w", lastErr)
+}

internal/router/guard_test.go

@@ -269,3 +269,53 @@ func TestSignInThroughAProviderNeedsNoAPIKey(t *testing.T) {
 		t.Errorf("%d %s", rec.Code, rec.Body.String())
 	}
 }
+
+// One replica of the judge hangs: the other, on another machine, is asked
+// at half the budget and answers within it, rather than the hung one taking
+// the whole budget and the request being refused. Two on one machine are
+// not both asked: they are slow together.
+func TestAJudgeThatHangsIsOvertakenByAnother(t *testing.T) {
+	for _, apart := range []bool{true, false} {
+		hung, quick := newFakeEngine(t, "judge"), newFakeEngine(t, "judge")
+		hung.hang.Store(true)
+		quickURL := quick.srv.URL
+		if apart {
+			// Another host name for the same server: another machine, to
+			// the router.
+			quickURL = strings.Replace(quickURL, "127.0.0.1", "localhost", 1)
+		}
+		cfg := baseConfig(config.Endpoint{ID: "hung", URL: hung.srv.URL, Models: []string{"judge"}},
+			config.Endpoint{ID: "quick", URL: quickURL, Models: []string{"judge"}})
+		judge := catModel("judge", nil)
+		judge.Role, judge.Guard = catalog.RoleGuard, &catalog.GuardModel{Format: "qwen3guard"}
+		cfg.Models = []catalog.Model{judge}
+		rt := newTestRouter(t, cfg)
+		deadline := time.Now().Add(3 * time.Second)
+		for len(rt.reg.Snapshots("judge")) < 2 && time.Now().Before(deadline) {
+			time.Sleep(20 * time.Millisecond)
+		}
+		if n := len(rt.reg.Snapshots("judge")); n != 2 {
+			t.Fatalf("%d replicas of the judge", n)
+		}
+		body := []byte(`{"model":"judge","messages":[{"role":"user","content":"x"}]}`)
+		for i := 0; i < 12 && hung.calls.Load() == 0; i++ {
+			before := quick.calls.Load()
+			ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+			start := time.Now()
+			out, err := rt.Judge(ctx, "judge", "/v1/chat/completions", body)
+			cancel()
+			if hung.calls.Load() == 0 {
+				continue // the quick one was asked first
+			}
+			if apart && (err != nil || !strings.Contains(string(out), `"hi"`) || time.Since(start) > 900*time.Millisecond) {
+				t.Fatalf("apart: no verdict in time (%s): %v", time.Since(start), err)
+			}
+			if !apart && quick.calls.Load() != before {
+				t.Error("together: the other replica on the same machine was asked as well")
+			}
+		}
+		if hung.calls.Load() == 0 {
+			t.Fatal("the hung replica was never asked first")
+		}
+	}
+}

internal/router/handlers.go

@@ -474,6 +474,11 @@ type parsedRequest struct {
 	// internal is a request the gateway makes of itself — a judge's — which
 	// no guard filters.
 	internal bool
+	// avoid are endpoints this request is not sent to while another will do,
+	// and picked is told the endpoint it is sent to: a judge asked twice
+	// asks two replicas.
+	avoid  []string
+	picked func(endpointID string)
 	// cache is where its answer is kept, when its project reuses answers
 	// and this one may be.
 	cache cacheState

internal/router/judge.go

@@ -5,6 +5,9 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"net/url"
+	"sync"
+	"time"
 
 	"gitea.mynodes.xyz/ilker/llmgw/internal/guard"
 )
@@ -18,6 +21,70 @@ func (r *Router) Judge(ctx context.Context, model, path string, body []byte) ([]
 	if path != "/v1/chat/completions" && path != "/v1/completions" {
 		return nil, fmt.Errorf("a judge is asked at /v1/chat/completions or /v1/completions, not %s", path)
 	}
+	deadline, ok := ctx.Deadline()
+	canonical, _ := r.resolve(model)
+	if !ok || len(r.reg.Snapshots(canonical)) < 2 {
+		return r.judgeOnce(ctx, path, body, nil, nil)
+	}
+
+	// Asked of a second replica too when the first has not answered by half
+	// the budget, and the first answer taken. One replica that hung — busy,
+	// or on a machine that is going — took the whole budget, and the retry
+	// on the other found none left: the request was refused (fail: closed)
+	// though a judge stood idle. The first is not cut short, which on a slow
+	// machine would refuse what it was about to answer.
+	//
+	// Only of a replica on another machine. Two on one machine whose CPUs
+	// are taken are slow together, and asking both doubled the work there:
+	// measured, as many requests failed as before, more of them refused.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	type answer struct {
+		out []byte
+		err error
+	}
+	answers := make(chan answer, 2)
+	var mu sync.Mutex
+	var first string
+	go func() {
+		out, err := r.judgeOnce(ctx, path, body, nil, func(id string) {
+			mu.Lock()
+			first = id
+			mu.Unlock()
+		})
+		answers <- answer{out, err}
+	}()
+	hedge := time.NewTimer(time.Until(deadline) / 2)
+	defer hedge.Stop()
+	asking := 1
+	var lastErr error
+	for asking > 0 {
+		select {
+		case a := <-answers:
+			asking--
+			if a.err == nil {
+				return a.out, nil
+			}
+			lastErr = a.err
+		case <-hedge.C:
+			mu.Lock()
+			avoid := []string{first}
+			mu.Unlock()
+			if !r.elsewhere(canonical, first) {
+				continue
+			}
+			asking++
+			go func() {
+				out, err := r.judgeOnce(ctx, path, body, avoid, nil)
+				answers <- answer{out, err}
+			}()
+		}
+	}
+	return nil, lastErr
+}
+
+// judgeOnce asks one judge request of the router, as it would a client's.
+func (r *Router) judgeOnce(ctx context.Context, path string, body []byte, avoid []string, picked func(string)) ([]byte, error) {
 	hreq, err := http.NewRequestWithContext(ctx, http.MethodPost, path, bytes.NewReader(body))
 	if err != nil {
 		return nil, err
@@ -30,13 +97,14 @@ func (r *Router) Judge(ctx context.Context, model, path string, body []byte) ([]
 	req.Stream = false
 	req.RequestID = requestID("")
 	req.Header = http.Header{"X-Request-Id": []string{req.RequestID}}
+	req.avoid, req.picked = avoid, picked
 	w := &bufferWriter{header: http.Header{}}
 	res := r.dispatch(ctx, w, req)
 	if res.err != nil {
 		return nil, res.err
 	}
 	if w.status != 0 && w.status != http.StatusOK {
-		return nil, fmt.Errorf("the judge %s answered %d", model, w.status)
+		return nil, fmt.Errorf("the judge %s answered %d", req.Model, w.status)
 	}
 	return w.buf.Bytes(), nil
 }
@@ -84,3 +152,33 @@ func (b *bufferWriter) Write(p []byte) (int, error) {
 	return b.buf.Write(p)
 }
 func (b *bufferWriter) Flush() {}
+
+// elsewhere is whether a model has a replica on another machine than this
+// endpoint's, by the host of its address.
+func (r *Router) elsewhere(model, endpointID string) bool {
+	snaps := r.reg.Snapshots(model)
+	host := ""
+	for _, e := range snaps {
+		if e.ID == endpointID {
+			host = hostOfURL(e.URL)
+		}
+	}
+	if host == "" {
+		return false
+	}
+	for _, e := range snaps {
+		if e.ID != endpointID && hostOfURL(e.URL) != host {
+			return true
+		}
+	}
+	return false
+}
+
+// hostOfURL is an address's host, without its port.
+func hostOfURL(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return ""
+	}
+	return u.Hostname()
+}

internal/router/router.go

@@ -1022,6 +1022,13 @@ func (r *Router) dispatchOne(ctx context.Context, w http.ResponseWriter, req *pa
 		}
 		candidates = visited
 	}
+	if len(req.avoid) > 0 {
+		if rest := slices.DeleteFunc(slices.Clone(candidates), func(e endpoint.Snapshot) bool {
+			return slices.Contains(req.avoid, e.ID)
+		}); len(rest) > 0 {
+			candidates = rest
+		}
+	}
 	if len(candidates) == 0 {
 		// Nothing is serving it. That may be because nothing ever will, or
 		// because it loads when asked and nobody has asked yet — and the second
@@ -1106,6 +1113,9 @@ func (r *Router) dispatchOne(ctx context.Context, w http.ResponseWriter, req *pa
 			candidates = without(candidates, dec.Endpoint.ID)
 			continue
 		}
+		if req.picked != nil {
+			req.picked(dec.Endpoint.ID)
+		}
 
 		// The replica loads the adapter first if it does not hold it.
 		// Counted against its inflight while it does, so the requests

internal/router/router_test.go

@@ -42,6 +42,8 @@ type fakeEngine struct {
 	last atomic.Value
 	// traceparent is the one the last completion came with.
 	traceparent atomic.Value
+	// hang, when set, has a completion wait until its request is given up.
+	hang atomic.Bool
 }
 
 func newFakeEngine(t *testing.T, model string) *fakeEngine {
@@ -63,6 +65,10 @@ func newFakeEngine(t *testing.T, model string) *fakeEngine {
 			http.Error(w, "unavailable", code)
 			return
 		}
+		if f.hang.Load() {
+			<-r.Context().Done()
+			return
+		}
 		w.Header().Set("Content-Type", "application/json")
 		fmt.Fprintf(w, `{"model":%q,"choices":[{"message":{"content":"hi"}}],"usage":{"prompt_tokens":4,"completion_tokens":2}}`, model)
 	})

internal/store/postgres.go

@@ -2,17 +2,46 @@ package store
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
+	"net"
 	"time"
 
 	// The pure-Go PostgreSQL driver. Pure-Go is not a preference here: the
 	// whole binary is built with CGO_ENABLED=0 so that it runs on a node whose
 	// libc is older than the builder's, and a cgo driver would take that away
 	// from every deployment, including the ones still on SQLite.
-	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/stdlib"
 )
 
+// How soon a store machine that is gone is given up on. A replicated store's
+// address names every member, and a new connection tries them in order: with
+// no timeout, one to a machine that had lost its power waited for the
+// kernel's own — half a minute and more — before the next member was asked,
+// and every request whose key was not cached waited with it.
+const (
+	// storeConnectTimeout is per member: the next is tried after it.
+	storeConnectTimeout = 3 * time.Second
+	// storeDeadAfter is how long a connection's sent data may go unanswered,
+	// or an idle one's probes, before it is closed: a connection to the
+	// primary that was lost fails, and the next opens to the new one.
+	storeDeadAfter = 10 * time.Second
+)
+
+// failFast gives a connection configuration those limits, where its address
+// gave none of its own.
+func failFast(cfg *pgx.ConnConfig) {
+	if cfg.ConnectTimeout == 0 {
+		cfg.ConnectTimeout = storeConnectTimeout
+	}
+	d := &net.Dialer{
+		KeepAliveConfig: net.KeepAliveConfig{Enable: true, Idle: 5 * time.Second, Interval: time.Second,
+			Count: int((storeDeadAfter - 5*time.Second) / time.Second)},
+		Control: userTimeout(storeDeadAfter),
+	}
+	cfg.DialFunc = d.DialContext
+}
+
 // OpenPostgres opens the store against PostgreSQL.
 //
 // The same queries run here as on SQLite; only the placeholders differ, and
@@ -29,12 +58,14 @@ func OpenPostgres(ctx context.Context, dsn string) (*DB, error) {
 	if dsn == "" {
 		return nil, fmt.Errorf("store: no PostgreSQL address configured")
 	}
-	db, err := sql.Open("pgx", dsn)
+	cfg, err := pgx.ParseConfig(dsn)
 	if err != nil {
 		// Deliberately not wrapped with the DSN: it holds a password, and an
 		// error string ends up in logs, tickets and screenshots.
 		return nil, fmt.Errorf("opening the PostgreSQL store: %w", err)
 	}
+	failFast(cfg)
+	db := stdlib.OpenDB(*cfg)
 
 	// Sized for a control plane rather than for a fleet of application
 	// servers. The request path barely touches the store — usage is batched,

internal/store/postgres_failfast_test.go

@@ -0,0 +1,25 @@
+package store
+
+import (
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+)
+
+func TestAStoreMachineThatIsGoneIsGivenUpOnInSeconds(t *testing.T) {
+	cfg, err := pgx.ParseConfig("postgres://u:p@10.0.0.158:5432,10.0.0.159:5432/llmgw?sslmode=disable&target_session_attrs=read-write")
+	if err != nil {
+		t.Fatal(err)
+	}
+	failFast(cfg)
+	if cfg.ConnectTimeout != storeConnectTimeout || cfg.DialFunc == nil {
+		t.Errorf("timeout %s, dialer set %v", cfg.ConnectTimeout, cfg.DialFunc != nil)
+	}
+	// One the address asks for is its own.
+	cfg, _ = pgx.ParseConfig("postgres://u:p@h:5432/llmgw?sslmode=disable&connect_timeout=12")
+	failFast(cfg)
+	if cfg.ConnectTimeout != 12*time.Second {
+		t.Errorf("the address's own timeout was replaced: %s", cfg.ConnectTimeout)
+	}
+}

internal/store/usertimeout_linux.go

@@ -0,0 +1,23 @@
+package store
+
+import (
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// userTimeout sets TCP_USER_TIMEOUT: data sent and not acknowledged for that
+// long closes the connection, where keepalive probes wait for it to go idle.
+func userTimeout(d time.Duration) func(network, address string, c syscall.RawConn) error {
+	return func(_, _ string, c syscall.RawConn) error {
+		var serr error
+		err := c.Control(func(fd uintptr) {
+			serr = unix.SetsockoptInt(int(fd), unix.IPPROTO_TCP, unix.TCP_USER_TIMEOUT, int(d.Milliseconds()))
+		})
+		if err != nil {
+			return err
+		}
+		return serr
+	}
+}

internal/store/usertimeout_other.go

@@ -0,0 +1,13 @@
+//go:build !linux
+
+package store
+
+import (
+	"syscall"
+	"time"
+)
+
+// userTimeout is Linux's alone; elsewhere the keepalive probes do it, later.
+func userTimeout(time.Duration) func(network, address string, c syscall.RawConn) error {
+	return nil
+}

internal/web/proxy/Caddyfile

@@ -14,6 +14,7 @@ llm.example.com {
 		max_size 32MB
 	}
 
+	# One control plane. With more than one, see the end of this file.
 	reverse_proxy 127.0.0.1:8080 {
 		# Tokens are written the moment they are generated. Without this a
 		# streamed reply can arrive in bursts, and a client measuring time to
@@ -39,3 +40,36 @@ llm.example.com {
 	# Access log to stderr, which under systemd is the journal.
 	log
 }
+
+# More than one control plane (server init --standbys, server add): one of
+# them leads, the others stand by. Name them all and send to the one that
+# leads — /leader is 200 there and 503 on a standby. Not /ready: that is 503
+# on a leader with no model running yet, and would take the portal away with
+# it. A standby would pass a request on to the leader anyway, but not while
+# there is none, and the hop is for nothing.
+#
+# With a floating address (--vip) the address already follows the leader:
+# give reverse_proxy that one address instead, and keep the rest as above.
+#
+# llm.example.com {
+# 	request_body {
+# 		max_size 32MB
+# 	}
+# 	reverse_proxy 10.0.0.157:8080 10.0.0.158:8080 10.0.0.159:8080 {
+# 		# The first that is healthy: the leader, whichever it is.
+# 		lb_policy first
+# 		health_uri /leader
+# 		health_interval 2s
+# 		health_timeout 2s
+# 		# While leadership moves — a few seconds when a leader is lost —
+# 		# none is healthy; a request waits that long for one rather than
+# 		# failing at once.
+# 		lb_try_duration 15s
+# 		lb_try_interval 250ms
+# 		flush_interval -1
+# 		transport http {
+# 			response_header_timeout 15m
+# 		}
+# 	}
+# 	log
+# }