diff --git a/.github/workflows/build-charm.yaml b/.github/workflows/build-charm.yaml
index ce1fdeb..9f55425 100644
--- a/.github/workflows/build-charm.yaml
+++ b/.github/workflows/build-charm.yaml
@@ -29,3 +29,43 @@ jobs:
         run: |
           cd vm_operator
           tox -e unit
+
+  functional-test:
+    name: Functional tests
+    runs-on: ubuntu-latest
+    needs:
+      - unit-test
+      - lint
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install dependencies
+        run: python -m pip install tox
+      - name: Setup LXD
+        uses: canonical/setup-lxd@4e959f8e0d9c5feb27d44c5e4d9a330a782edee0
+      - name: Run tests
+        run: |
+          cd vm_operator
+          tox -e functional
+
+  integration-test:
+    name: Integration tests
+    runs-on: ubuntu-22.04
+    needs:
+      - lint
+      - unit-test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup hosts for tests
+        run: |
+          echo "10.64.140.43 testing-ratings.foo.bar" | sudo tee -a /etc/hosts
+      - name: Setup operator environment
+        uses: charmed-kubernetes/actions-operator@main
+        with:
+          provider: lxd
+          juju-channel: 3.2/stable
+      - name: Run integration tests
+        run: |
+          cd vm_operator
+          tox -e integration -- --model=testing
diff --git a/snap/README.md b/snap/README.md
new file mode 100644
index 0000000..5c966cd
--- /dev/null
+++ b/snap/README.md
@@ -0,0 +1,35 @@
+# App Center Ratings Snap
+
+This directory contains files used to build the App Center Ratings snap.
+
+## Installation 
+
+The snap provides a wrapper used to collect environment variables via `snapctl` in order for them to be configurable post the snap being built.
+
+You can install the App Center Ratings snap manually like so:
+
+```bash
+# Install the snap 
+$ sudo snap install ratings --channel stable 
+
+# Update an environment variable
+sudo snap set ratings app-log-level=debug
+
+# Restart the service to reload environment variables into the service
+sudo snap restart ratings
+```
+
+## Configuration
+
+This Snap is intended to run within a charm where certain configuration settings are unknown until the charm installs the snap and establishes relations to a database.
+
+The list of config options are:
+
+| Name                        | Options                          | Default                                                        | Description             |
+|:----------------------------|:--------------------------------|:---------------------------------------------------------------|:------------------------|
+| `app-jwt-secret`            | Any string                      | `randomized`                                                     | JWT secret              |
+| `app-log-level`             | `error`, `warn`, `info`, `debug` | `info`                                                         | Log level               |
+| `app-postgres-uri`          | Any string                      | `` | Service connection     |
+| `app-migration-postgres-uri`| Any string                      | `` | Migrator connection    |
+
+Config options can be set using: `sudo snap set ratings <option>=<value>`
diff --git a/snap/hooks/configure b/snap/hooks/configure
new file mode 100755
index 0000000..0cf7470
--- /dev/null
+++ b/snap/hooks/configure
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -eu
+
+app_jwt_secret="$(snapctl get app-jwt-secret)"
+if [ -z "$app_jwt_secret" ]; then
+    snapctl set app-jwt-secret="$(head -c30 /dev/urandom | base64 -w0)"
+fi
+
+app_log_level="$(snapctl get app-log-level)"
+if [ -z "$app_log_level" ]; then
+    snapctl set app-log-level=info
+fi
+
+app_postgres_uri="$(snapctl get app-postgres-uri)"
+
+app_migration_postgres_uri="$(snapctl get app-migration-postgres-uri)"
+
+app_env="$(snapctl get app-env)"
+if [ -z "$app_env" ]; then
+    snapctl set app-env=dev
+fi
diff --git a/snap/local/ratings_wrapper b/snap/local/ratings_wrapper
new file mode 100755
index 0000000..89b9b1c
--- /dev/null
+++ b/snap/local/ratings_wrapper
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+export APP_JWT_SECRET="$(snapctl get app-jwt-secret)"
+export APP_LOG_LEVEL="$(snapctl get app-log-level)"
+export APP_POSTGRES_URI="$(snapctl get app-postgres-uri)"
+export APP_MIGRATION_POSTGRES_URI="$(snapctl get app-migration-postgres-uri)"
+export APP_ENV="$(snapctl get app-env)"
+
+exec $SNAP/bin/ratings
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
new file mode 100644
index 0000000..24a52ce
--- /dev/null
+++ b/snap/snapcraft.yaml
@@ -0,0 +1,53 @@
+name: ratings
+base: core22
+version: '1.6'
+license: GPL-3.0
+summary: Ubuntu App Ratings Service
+description: |
+  Backend service to support application ratings in the new Ubuntu Software Centre.
+issues: https://github.com/ubuntu/app-center-ratings/issues
+source-code: https://github.com/ubuntu/app-center-ratings/
+grade: stable
+confinement: strict
+
+apps:
+  ratings-svc:
+    command: bin/ratings_wrapper
+    daemon: simple
+    install_mode: disable
+    plugs:
+      - network
+      - network-bind
+
+environment:
+      APP_HOST: 0.0.0.0
+      APP_NAME: ratings
+      APP_PORT: 443
+
+parts:
+  rust-deps:
+    plugin: nil
+    override-pull: |
+      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
+
+  ratings:
+    after: [ rust-deps ]
+    plugin: rust
+    build-packages:
+      - libssl-dev
+      - pkg-config
+    build-snaps:
+      - protobuf
+    source: .
+
+  migrations:
+    plugin: dump
+    source: ./sql
+
+  wrapper:
+    plugin: dump
+    source: ./snap/local
+    source-type: local
+    override-build: |
+      # Copy the wrapper into place
+      install -Dm 0755 $SNAPCRAFT_PROJECT_DIR/snap/local/ratings_wrapper $SNAPCRAFT_PART_INSTALL/bin/ratings_wrapper
diff --git a/src/main.rs b/src/main.rs
index ba84b6a..f663f7c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,3 +1,7 @@
+use std::env;
+
+use tracing::info;
+
 mod app;
 mod features;
 mod utils;
@@ -11,7 +15,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .with_span_events(tracing_subscriber::fmt::format::FmtSpan::CLOSE)
         .init();
 
-    tracing::info!("Starting Ubuntu App Rating Service");
+    tracing::info!("Starting the Ubuntu App Rating Service");
 
     app::run(config).await?;
 
diff --git a/src/utils/migrator.rs b/src/utils/migrator.rs
index 4023de7..614a563 100644
--- a/src/utils/migrator.rs
+++ b/src/utils/migrator.rs
@@ -1,8 +1,10 @@
+use std::env;
 use std::error::Error;
 use std::fmt::{Debug, Formatter};
 use std::sync::Arc;
 
 use sqlx::{postgres::PgPoolOptions, PgPool};
+use tracing::info;
 
 const MIGRATIONS_PATH: &str = "./sql/migrations";
 
@@ -19,8 +21,18 @@ impl Migrator {
         Ok(Migrator { pool })
     }
 
+    fn migrations_path() -> String {
+        let snap_path = std::env::var("SNAP").unwrap_or("./sql".to_string());
+        format!("{}/migrations", snap_path)
+    }
+
     pub async fn run(&self) -> Result<(), sqlx::Error> {
-        let m = sqlx::migrate::Migrator::new(std::path::Path::new(MIGRATIONS_PATH)).await?;
+        match env::current_dir() {
+            Ok(cur_dir) => info!("Current directory: {}", cur_dir.display()),
+            Err(e) => info!("Error retrieving current directory: {:?}", e),
+        }
+        let m =
+            sqlx::migrate::Migrator::new(std::path::Path::new(&Self::migrations_path())).await?;
 
         m.run(&mut self.pool.acquire().await?).await?;
         Ok(())
diff --git a/vm_operator/charmcraft.yaml b/vm_operator/charmcraft.yaml
index 6c7da6b..d7d03e0 100644
--- a/vm_operator/charmcraft.yaml
+++ b/vm_operator/charmcraft.yaml
@@ -14,3 +14,4 @@ parts:
   charm:
     charm-binary-python-packages:
       - psycopg[binary]
+      - PyYAML
diff --git a/vm_operator/config.yaml b/vm_operator/config.yaml
index ec4af4b..3d8e881 100644
--- a/vm_operator/config.yaml
+++ b/vm_operator/config.yaml
@@ -1,14 +1,10 @@
 options:
-  app-env:
+  env:
     type: string
     default: "dev"
     description: "Application environment."
-  app-log-level:
+  log-level:
     type: string
     default: "info"
-  app-repo:
-    type: string
-    default: "https://github.com/matthew-hagemann/app-center-ratings"
-  squid-proxy-url:
-    type: string
-    default: "http://proxy.example.com"
+    description: |
+        Available log level settings are "info", "warning", "error" and "debug".
diff --git a/vm_operator/lib/charms/operator_libs_linux/v1/snap.py b/vm_operator/lib/charms/operator_libs_linux/v1/snap.py
new file mode 100644
index 0000000..71cdee3
--- /dev/null
+++ b/vm_operator/lib/charms/operator_libs_linux/v1/snap.py
@@ -0,0 +1,1065 @@
+# Copyright 2021 Canonical Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Representations of the system's Snaps, and abstractions around managing them.
+
+The `snap` module provides convenience methods for listing, installing, refreshing, and removing
+Snap packages, in addition to setting and getting configuration options for them.
+
+In the `snap` module, `SnapCache` creates a dict-like mapping of `Snap` objects at when
+instantiated. Installed snaps are fully populated, and available snaps are lazily-loaded upon
+request. This module relies on an installed and running `snapd` daemon to perform operations over
+the `snapd` HTTP API.
+
+`SnapCache` objects can be used to install or modify Snap packages by name in a manner similar to
+using the `snap` command from the commandline.
+
+An example of adding Juju to the system with `SnapCache` and setting a config value:
+
+```python
+try:
+    cache = snap.SnapCache()
+    juju = cache["juju"]
+
+    if not juju.present:
+        juju.ensure(snap.SnapState.Latest, channel="beta")
+        juju.set({"some.key": "value", "some.key2": "value2"})
+except snap.SnapError as e:
+    logger.error("An exception occurred when installing charmcraft. Reason: %s", e.message)
+```
+
+In addition, the `snap` module provides "bare" methods which can act on Snap packages as
+simple function calls. :meth:`add`, :meth:`remove`, and :meth:`ensure` are provided, as
+well as :meth:`add_local` for installing directly from a local `.snap` file. These return
+`Snap` objects.
+
+As an example of installing several Snaps and checking details:
+
+```python
+try:
+    nextcloud, charmcraft = snap.add(["nextcloud", "charmcraft"])
+    if nextcloud.get("mode") != "production":
+        nextcloud.set({"mode": "production"})
+except snap.SnapError as e:
+    logger.error("An exception occurred when installing snaps. Reason: %s" % e.message)
+```
+"""
+
+import http.client
+import json
+import logging
+import os
+import re
+import socket
+import subprocess
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from collections.abc import Mapping
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from subprocess import CalledProcessError, CompletedProcess
+from typing import Any, Dict, Iterable, List, Optional, Union
+
+logger = logging.getLogger(__name__)
+
+# The unique Charmhub library identifier, never change it
+LIBID = "05394e5893f94f2d90feb7cbe6b633cd"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 1
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 12
+
+
+# Regex to locate 7-bit C1 ANSI sequences
+ansi_filter = re.compile(r"\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])")
+
+
+def _cache_init(func):
+    def inner(*args, **kwargs):
+        if _Cache.cache is None:
+            _Cache.cache = SnapCache()
+        return func(*args, **kwargs)
+
+    return inner
+
+
+# recursive hints seems to error out pytest
+JSONType = Union[Dict[str, Any], List[Any], str, int, float]
+
+
+class SnapService:
+    """Data wrapper for snap services."""
+
+    def __init__(
+        self,
+        daemon: Optional[str] = None,
+        daemon_scope: Optional[str] = None,
+        enabled: bool = False,
+        active: bool = False,
+        activators: List[str] = [],
+        **kwargs,
+    ):
+        self.daemon = daemon
+        self.daemon_scope = kwargs.get("daemon-scope", None) or daemon_scope
+        self.enabled = enabled
+        self.active = active
+        self.activators = activators
+
+    def as_dict(self) -> Dict:
+        """Return instance representation as dict."""
+        return {
+            "daemon": self.daemon,
+            "daemon_scope": self.daemon_scope,
+            "enabled": self.enabled,
+            "active": self.active,
+            "activators": self.activators,
+        }
+
+
+class MetaCache(type):
+    """MetaCache class used for initialising the snap cache."""
+
+    @property
+    def cache(cls) -> "SnapCache":
+        """Property for returning the snap cache."""
+        return cls._cache
+
+    @cache.setter
+    def cache(cls, cache: "SnapCache") -> None:
+        """Setter for the snap cache."""
+        cls._cache = cache
+
+    def __getitem__(cls, name) -> "Snap":
+        """Snap cache getter."""
+        return cls._cache[name]
+
+
+class _Cache(object, metaclass=MetaCache):
+    _cache = None
+
+
+class Error(Exception):
+    """Base class of most errors raised by this library."""
+
+    def __repr__(self):
+        """Represent the Error class."""
+        return "<{}.{} {}>".format(type(self).__module__, type(self).__name__, self.args)
+
+    @property
+    def name(self):
+        """Return a string representation of the model plus class."""
+        return "<{}.{}>".format(type(self).__module__, type(self).__name__)
+
+    @property
+    def message(self):
+        """Return the message passed as an argument."""
+        return self.args[0]
+
+
+class SnapAPIError(Error):
+    """Raised when an HTTP API error occurs talking to the Snapd server."""
+
+    def __init__(self, body: Dict, code: int, status: str, message: str):
+        super().__init__(message)  # Makes str(e) return message
+        self.body = body
+        self.code = code
+        self.status = status
+        self._message = message
+
+    def __repr__(self):
+        """Represent the SnapAPIError class."""
+        return "APIError({!r}, {!r}, {!r}, {!r})".format(
+            self.body, self.code, self.status, self._message
+        )
+
+
+class SnapState(Enum):
+    """The state of a snap on the system or in the cache."""
+
+    Present = "present"
+    Absent = "absent"
+    Latest = "latest"
+    Available = "available"
+
+
+class SnapError(Error):
+    """Raised when there's an error running snap control commands."""
+
+
+class SnapNotFoundError(Error):
+    """Raised when a requested snap is not known to the system."""
+
+
+class Snap(object):
+    """Represents a snap package and its properties.
+
+    `Snap` exposes the following properties about a snap:
+      - name: the name of the snap
+      - state: a `SnapState` representation of its install status
+      - channel: "stable", "candidate", "beta", and "edge" are common
+      - revision: a string representing the snap's revision
+      - confinement: "classic" or "strict"
+    """
+
+    def __init__(
+        self,
+        name,
+        state: SnapState,
+        channel: str,
+        revision: int,
+        confinement: str,
+        apps: Optional[List[Dict[str, str]]] = None,
+        cohort: Optional[str] = "",
+    ) -> None:
+        self._name = name
+        self._state = state
+        self._channel = channel
+        self._revision = revision
+        self._confinement = confinement
+        self._cohort = cohort
+        self._apps = apps or []
+        self._snap_client = SnapClient()
+
+    def __eq__(self, other) -> bool:
+        """Equality for comparison."""
+        return isinstance(other, self.__class__) and (
+            self._name,
+            self._revision,
+        ) == (other._name, other._revision)
+
+    def __hash__(self):
+        """Calculate a hash for this snap."""
+        return hash((self._name, self._revision))
+
+    def __repr__(self):
+        """Represent the object such that it can be reconstructed."""
+        return "<{}.{}: {}>".format(self.__module__, self.__class__.__name__, self.__dict__)
+
+    def __str__(self):
+        """Represent the snap object as a string."""
+        return "<{}: {}-{}.{} -- {}>".format(
+            self.__class__.__name__,
+            self._name,
+            self._revision,
+            self._channel,
+            str(self._state),
+        )
+
+    def _snap(self, command: str, optargs: Optional[Iterable[str]] = None) -> str:
+        """Perform a snap operation.
+
+        Args:
+          command: the snap command to execute
+          optargs: an (optional) list of additional arguments to pass,
+            commonly confinement or channel
+
+        Raises:
+          SnapError if there is a problem encountered
+        """
+        optargs = optargs or []
+        _cmd = ["snap", command, self._name, *optargs]
+        try:
+            return subprocess.check_output(_cmd, universal_newlines=True)
+        except CalledProcessError as e:
+            raise SnapError(
+                "Snap: {!r}; command {!r} failed with output = {!r}".format(
+                    self._name, _cmd, e.output
+                )
+            )
+
+    def _snap_daemons(
+        self,
+        command: List[str],
+        services: Optional[List[str]] = None,
+    ) -> CompletedProcess:
+        """Perform snap app commands.
+
+        Args:
+          command: the snap command to execute
+          services: the snap service to execute command on
+
+        Raises:
+          SnapError if there is a problem encountered
+        """
+        if services:
+            # an attempt to keep the command constrained to the snap instance's services
+            services = ["{}.{}".format(self._name, service) for service in services]
+        else:
+            services = [self._name]
+
+        _cmd = ["snap", *command, *services]
+
+        try:
+            return subprocess.run(_cmd, universal_newlines=True, check=True, capture_output=True)
+        except CalledProcessError as e:
+            raise SnapError("Could not {} for snap [{}]: {}".format(_cmd, self._name, e.stderr))
+
+    def get(self, key) -> str:
+        """Fetch a snap configuration value.
+
+        Args:
+            key: the key to retrieve
+        """
+        return self._snap("get", [key]).strip()
+
+    def set(self, config: Dict) -> str:
+        """Set a snap configuration value.
+
+        Args:
+           config: a dictionary containing keys and values specifying the config to set.
+        """
+        args = ['{}="{}"'.format(key, val) for key, val in config.items()]
+
+        return self._snap("set", [*args])
+
+    def unset(self, key) -> str:
+        """Unset a snap configuration value.
+
+        Args:
+            key: the key to unset
+        """
+        return self._snap("unset", [key])
+
+    def start(self, services: Optional[List[str]] = None, enable: Optional[bool] = False) -> None:
+        """Start a snap's services.
+
+        Args:
+            services (list): (optional) list of individual snap services to start (otherwise all)
+            enable (bool): (optional) flag to enable snap services on start. Default `false`
+        """
+        args = ["start", "--enable"] if enable else ["start"]
+        self._snap_daemons(args, services)
+
+    def stop(self, services: Optional[List[str]] = None, disable: Optional[bool] = False) -> None:
+        """Stop a snap's services.
+
+        Args:
+            services (list): (optional) list of individual snap services to stop (otherwise all)
+            disable (bool): (optional) flag to disable snap services on stop. Default `False`
+        """
+        args = ["stop", "--disable"] if disable else ["stop"]
+        self._snap_daemons(args, services)
+
+    def logs(self, services: Optional[List[str]] = None, num_lines: Optional[int] = 10) -> str:
+        """Fetch a snap services' logs.
+
+        Args:
+            services (list): (optional) list of individual snap services to show logs from
+                (otherwise all)
+            num_lines (int): (optional) integer number of log lines to return. Default `10`
+        """
+        args = ["logs", "-n={}".format(num_lines)] if num_lines else ["logs"]
+        return self._snap_daemons(args, services).stdout
+
+    def connect(
+        self, plug: str, service: Optional[str] = None, slot: Optional[str] = None
+    ) -> None:
+        """Connect a plug to a slot.
+
+        Args:
+            plug (str): the plug to connect
+            service (str): (optional) the snap service name to plug into
+            slot (str): (optional) the snap service slot to plug in to
+
+        Raises:
+            SnapError if there is a problem encountered
+        """
+        command = ["connect", "{}:{}".format(self._name, plug)]
+
+        if service and slot:
+            command = command + ["{}:{}".format(service, slot)]
+        elif slot:
+            command = command + [slot]
+
+        _cmd = ["snap", *command]
+        try:
+            subprocess.run(_cmd, universal_newlines=True, check=True, capture_output=True)
+        except CalledProcessError as e:
+            raise SnapError("Could not {} for snap [{}]: {}".format(_cmd, self._name, e.stderr))
+
+    def hold(self, duration: Optional[timedelta] = None) -> None:
+        """Add a refresh hold to a snap.
+
+        Args:
+            duration: duration for the hold, or None (the default) to hold this snap indefinitely.
+        """
+        hold_str = "forever"
+        if duration is not None:
+            seconds = round(duration.total_seconds())
+            hold_str = f"{seconds}s"
+        self._snap("refresh", [f"--hold={hold_str}"])
+
+    def unhold(self) -> None:
+        """Remove the refresh hold of a snap."""
+        self._snap("refresh", ["--unhold"])
+
+    def restart(
+        self, services: Optional[List[str]] = None, reload: Optional[bool] = False
+    ) -> None:
+        """Restarts a snap's services.
+
+        Args:
+            services (list): (optional) list of individual snap services to show logs from.
+                (otherwise all)
+            reload (bool): (optional) flag to use the service reload command, if available.
+                Default `False`
+        """
+        args = ["restart", "--reload"] if reload else ["restart"]
+        self._snap_daemons(args, services)
+
+    def _install(
+        self,
+        channel: Optional[str] = "",
+        cohort: Optional[str] = "",
+        revision: Optional[int] = None,
+    ) -> None:
+        """Add a snap to the system.
+
+        Args:
+          channel: the channel to install from
+          cohort: optional, the key of a cohort that this snap belongs to
+          revision: optional, the revision of the snap to install
+        """
+        cohort = cohort or self._cohort
+
+        args = []
+        if self.confinement == "classic":
+            args.append("--classic")
+        if channel:
+            args.append('--channel="{}"'.format(channel))
+        if revision:
+            args.append('--revision="{}"'.format(revision))
+        if cohort:
+            args.append('--cohort="{}"'.format(cohort))
+
+        self._snap("install", args)
+
+    def _refresh(
+        self,
+        channel: Optional[str] = "",
+        cohort: Optional[str] = "",
+        revision: Optional[int] = None,
+        leave_cohort: Optional[bool] = False,
+    ) -> None:
+        """Refresh a snap.
+
+        Args:
+          channel: the channel to install from
+          cohort: optionally, specify a cohort.
+          revision: optionally, specify the revision of the snap to refresh
+          leave_cohort: leave the current cohort.
+        """
+        args = []
+        if channel:
+            args.append('--channel="{}"'.format(channel))
+
+        if revision:
+            args.append('--revision="{}"'.format(revision))
+
+        if not cohort:
+            cohort = self._cohort
+
+        if leave_cohort:
+            self._cohort = ""
+            args.append("--leave-cohort")
+        elif cohort:
+            args.append('--cohort="{}"'.format(cohort))
+
+        self._snap("refresh", args)
+
+    def _remove(self) -> str:
+        """Remove a snap from the system."""
+        return self._snap("remove")
+
+    @property
+    def name(self) -> str:
+        """Returns the name of the snap."""
+        return self._name
+
+    def ensure(
+        self,
+        state: SnapState,
+        classic: Optional[bool] = False,
+        channel: Optional[str] = "",
+        cohort: Optional[str] = "",
+        revision: Optional[int] = None,
+    ):
+        """Ensure that a snap is in a given state.
+
+        Args:
+          state: a `SnapState` to reconcile to.
+          classic: an (Optional) boolean indicating whether classic confinement should be used
+          channel: the channel to install from
+          cohort: optional. Specify the key of a snap cohort.
+          revision: optional. the revision of the snap to install/refresh
+
+        While both channel and revision could be specified, the underlying snap install/refresh
+        command will determine which one takes precedence (revision at this time)
+
+        Raises:
+          SnapError if an error is encountered
+        """
+        self._confinement = "classic" if classic or self._confinement == "classic" else ""
+
+        if state not in (SnapState.Present, SnapState.Latest):
+            # We are attempting to remove this snap.
+            if self._state in (SnapState.Present, SnapState.Latest):
+                # The snap is installed, so we run _remove.
+                self._remove()
+            else:
+                # The snap is not installed -- no need to do anything.
+                pass
+        else:
+            # We are installing or refreshing a snap.
+            if self._state not in (SnapState.Present, SnapState.Latest):
+                # The snap is not installed, so we install it.
+                self._install(channel, cohort, revision)
+            else:
+                # The snap is installed, but we are changing it (e.g., switching channels).
+                self._refresh(channel, cohort, revision)
+
+        self._update_snap_apps()
+        self._state = state
+
+    def _update_snap_apps(self) -> None:
+        """Update a snap's apps after snap changes state."""
+        try:
+            self._apps = self._snap_client.get_installed_snap_apps(self._name)
+        except SnapAPIError:
+            logger.debug("Unable to retrieve snap apps for {}".format(self._name))
+            self._apps = []
+
+    @property
+    def present(self) -> bool:
+        """Report whether or not a snap is present."""
+        return self._state in (SnapState.Present, SnapState.Latest)
+
+    @property
+    def latest(self) -> bool:
+        """Report whether the snap is the most recent version."""
+        return self._state is SnapState.Latest
+
+    @property
+    def state(self) -> SnapState:
+        """Report the current snap state."""
+        return self._state
+
+    @state.setter
+    def state(self, state: SnapState) -> None:
+        """Set the snap state to a given value.
+
+        Args:
+          state: a `SnapState` to reconcile the snap to.
+
+        Raises:
+          SnapError if an error is encountered
+        """
+        if self._state is not state:
+            self.ensure(state)
+        self._state = state
+
+    @property
+    def revision(self) -> int:
+        """Returns the revision for a snap."""
+        return self._revision
+
+    @property
+    def channel(self) -> str:
+        """Returns the channel for a snap."""
+        return self._channel
+
+    @property
+    def confinement(self) -> str:
+        """Returns the confinement for a snap."""
+        return self._confinement
+
+    @property
+    def apps(self) -> List:
+        """Returns (if any) the installed apps of the snap."""
+        self._update_snap_apps()
+        return self._apps
+
+    @property
+    def services(self) -> Dict:
+        """Returns (if any) the installed services of the snap."""
+        self._update_snap_apps()
+        services = {}
+        for app in self._apps:
+            if "daemon" in app:
+                services[app["name"]] = SnapService(**app).as_dict()
+
+        return services
+
+    @property
+    def held(self) -> bool:
+        """Report whether the snap has a hold."""
+        info = self._snap("info")
+        return "hold:" in info
+
+
+class _UnixSocketConnection(http.client.HTTPConnection):
+    """Implementation of HTTPConnection that connects to a named Unix socket."""
+
+    def __init__(self, host, timeout=None, socket_path=None):
+        if timeout is None:
+            super().__init__(host)
+        else:
+            super().__init__(host, timeout=timeout)
+        self.socket_path = socket_path
+
+    def connect(self):
+        """Override connect to use Unix socket (instead of TCP socket)."""
+        if not hasattr(socket, "AF_UNIX"):
+            raise NotImplementedError("Unix sockets not supported on {}".format(sys.platform))
+        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.sock.connect(self.socket_path)
+        if self.timeout is not None:
+            self.sock.settimeout(self.timeout)
+
+
+class _UnixSocketHandler(urllib.request.AbstractHTTPHandler):
+    """Implementation of HTTPHandler that uses a named Unix socket."""
+
+    def __init__(self, socket_path: str):
+        super().__init__()
+        self.socket_path = socket_path
+
+    def http_open(self, req) -> http.client.HTTPResponse:
+        """Override http_open to use a Unix socket connection (instead of TCP)."""
+        return self.do_open(_UnixSocketConnection, req, socket_path=self.socket_path)
+
+
+class SnapClient:
+    """Snapd API client to talk to HTTP over UNIX sockets.
+
+    In order to avoid shelling out and/or involving sudo in calling the snapd API,
+    use a wrapper based on the Pebble Client, trimmed down to only the utility methods
+    needed for talking to snapd.
+    """
+
+    def __init__(
+        self,
+        socket_path: str = "/run/snapd.socket",
+        opener: Optional[urllib.request.OpenerDirector] = None,
+        base_url: str = "http://localhost/v2/",
+        timeout: float = 5.0,
+    ):
+        """Initialize a client instance.
+
+        Args:
+            socket_path: a path to the socket on the filesystem. Defaults to /run/snap/snapd.socket
+            opener: specifies an opener for unix socket, if unspecified a default is used
+            base_url: base url for making requests to the snap client. Defaults to
+                http://localhost/v2/
+            timeout: timeout in seconds to use when making requests to the API. Default is 5.0s.
+        """
+        if opener is None:
+            opener = self._get_default_opener(socket_path)
+        self.opener = opener
+        self.base_url = base_url
+        self.timeout = timeout
+
+    @classmethod
+    def _get_default_opener(cls, socket_path):
+        """Build the default opener to use for requests (HTTP over Unix socket)."""
+        opener = urllib.request.OpenerDirector()
+        opener.add_handler(_UnixSocketHandler(socket_path))
+        opener.add_handler(urllib.request.HTTPDefaultErrorHandler())
+        opener.add_handler(urllib.request.HTTPRedirectHandler())
+        opener.add_handler(urllib.request.HTTPErrorProcessor())
+        return opener
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        query: Dict = None,
+        body: Dict = None,
+    ) -> JSONType:
+        """Make a JSON request to the Snapd server with the given HTTP method and path.
+
+        If query dict is provided, it is encoded and appended as a query string
+        to the URL. If body dict is provided, it is serialied as JSON and used
+        as the HTTP body (with Content-Type: "application/json"). The resulting
+        body is decoded from JSON.
+        """
+        headers = {"Accept": "application/json"}
+        data = None
+        if body is not None:
+            data = json.dumps(body).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+
+        response = self._request_raw(method, path, query, headers, data)
+        return json.loads(response.read().decode())["result"]
+
+    def _request_raw(
+        self,
+        method: str,
+        path: str,
+        query: Dict = None,
+        headers: Dict = None,
+        data: bytes = None,
+    ) -> http.client.HTTPResponse:
+        """Make a request to the Snapd server; return the raw HTTPResponse object."""
+        url = self.base_url + path
+        if query:
+            url = url + "?" + urllib.parse.urlencode(query)
+
+        if headers is None:
+            headers = {}
+        request = urllib.request.Request(url, method=method, data=data, headers=headers)
+
+        try:
+            response = self.opener.open(request, timeout=self.timeout)
+        except urllib.error.HTTPError as e:
+            code = e.code
+            status = e.reason
+            message = ""
+            try:
+                body = json.loads(e.read().decode())["result"]
+            except (IOError, ValueError, KeyError) as e2:
+                # Will only happen on read error or if Pebble sends invalid JSON.
+                body = {}
+                message = "{} - {}".format(type(e2).__name__, e2)
+            raise SnapAPIError(body, code, status, message)
+        except urllib.error.URLError as e:
+            raise SnapAPIError({}, 500, "Not found", e.reason)
+        return response
+
+    def get_installed_snaps(self) -> Dict:
+        """Get information about currently installed snaps."""
+        return self._request("GET", "snaps")
+
+    def get_snap_information(self, name: str) -> Dict:
+        """Query the snap server for information about single snap."""
+        return self._request("GET", "find", {"name": name})[0]
+
+    def get_installed_snap_apps(self, name: str) -> List:
+        """Query the snap server for apps belonging to a named, currently installed snap."""
+        return self._request("GET", "apps", {"names": name, "select": "service"})
+
+
+class SnapCache(Mapping):
+    """An abstraction to represent installed/available packages.
+
+    When instantiated, `SnapCache` iterates through the list of installed
+    snaps using the `snapd` HTTP API, and a list of available snaps by reading
+    the filesystem to populate the cache. Information about available snaps is lazily-loaded
+    from the `snapd` API when requested.
+    """
+
+    def __init__(self):
+        if not self.snapd_installed:
+            raise SnapError("snapd is not installed or not in /usr/bin") from None
+        self._snap_client = SnapClient()
+        self._snap_map = {}
+        if self.snapd_installed:
+            self._load_available_snaps()
+            self._load_installed_snaps()
+
+    def __contains__(self, key: str) -> bool:
+        """Check if a given snap is in the cache."""
+        return key in self._snap_map
+
+    def __len__(self) -> int:
+        """Report number of items in the snap cache."""
+        return len(self._snap_map)
+
+    def __iter__(self) -> Iterable["Snap"]:
+        """Provide iterator for the snap cache."""
+        return iter(self._snap_map.values())
+
+    def __getitem__(self, snap_name: str) -> Snap:
+        """Return either the installed version or latest version for a given snap."""
+        snap = self._snap_map.get(snap_name, None)
+        if snap is None:
+            # The snapd cache file may not have existed when _snap_map was
+            # populated.  This is normal.
+            try:
+                self._snap_map[snap_name] = self._load_info(snap_name)
+            except SnapAPIError:
+                raise SnapNotFoundError("Snap '{}' not found!".format(snap_name))
+
+        return self._snap_map[snap_name]
+
+    @property
+    def snapd_installed(self) -> bool:
+        """Check whether snapd has been installled on the system."""
+        return os.path.isfile("/usr/bin/snap")
+
+    def _load_available_snaps(self) -> None:
+        """Load the list of available snaps from disk.
+
+        Leave them empty and lazily load later if asked for.
+        """
+        if not os.path.isfile("/var/cache/snapd/names"):
+            # The snap catalog may not be populated yet; this is normal.
+            # snapd updates the cache infrequently and the cache file may not
+            # currently exist.
+            return
+
+        with open("/var/cache/snapd/names", "r") as f:
+            for line in f:
+                if line.strip():
+                    self._snap_map[line.strip()] = None
+
+    def _load_installed_snaps(self) -> None:
+        """Load the installed snaps into the dict."""
+        installed = self._snap_client.get_installed_snaps()
+
+        for i in installed:
+            snap = Snap(
+                name=i["name"],
+                state=SnapState.Latest,
+                channel=i["channel"],
+                revision=int(i["revision"]),
+                confinement=i["confinement"],
+                apps=i.get("apps", None),
+            )
+            self._snap_map[snap.name] = snap
+
+    def _load_info(self, name) -> Snap:
+        """Load info for snaps which are not installed if requested.
+
+        Args:
+            name: a string representing the name of the snap
+        """
+        info = self._snap_client.get_snap_information(name)
+
+        return Snap(
+            name=info["name"],
+            state=SnapState.Available,
+            channel=info["channel"],
+            revision=int(info["revision"]),
+            confinement=info["confinement"],
+            apps=None,
+        )
+
+
+@_cache_init
+def add(
+    snap_names: Union[str, List[str]],
+    state: Union[str, SnapState] = SnapState.Latest,
+    channel: Optional[str] = "",
+    classic: Optional[bool] = False,
+    cohort: Optional[str] = "",
+    revision: Optional[int] = None,
+) -> Union[Snap, List[Snap]]:
+    """Add a snap to the system.
+
+    Args:
+        snap_names: the name or names of the snaps to install
+        state: a string or `SnapState` representation of the desired state, one of
+            [`Present` or `Latest`]
+        channel: an (Optional) channel as a string. Defaults to 'latest'
+        classic: an (Optional) boolean specifying whether it should be added with classic
+            confinement. Default `False`
+        cohort: an (Optional) string specifying the snap cohort to use
+        revision: an (Optional) integer specifying the snap revision to use
+
+    Raises:
+        SnapError if some snaps failed to install or were not found.
+    """
+    if not channel and not revision:
+        channel = "latest"
+
+    snap_names = [snap_names] if type(snap_names) is str else snap_names
+    if not snap_names:
+        raise TypeError("Expected at least one snap to add, received zero!")
+
+    if type(state) is str:
+        state = SnapState(state)
+
+    return _wrap_snap_operations(snap_names, state, channel, classic, cohort, revision)
+
+
+@_cache_init
+def remove(snap_names: Union[str, List[str]]) -> Union[Snap, List[Snap]]:
+    """Remove specified snap(s) from the system.
+
+    Args:
+        snap_names: the name or names of the snaps to install
+
+    Raises:
+        SnapError if some snaps failed to install.
+    """
+    snap_names = [snap_names] if type(snap_names) is str else snap_names
+    if not snap_names:
+        raise TypeError("Expected at least one snap to add, received zero!")
+
+    return _wrap_snap_operations(snap_names, SnapState.Absent, "", False)
+
+
+@_cache_init
+def ensure(
+    snap_names: Union[str, List[str]],
+    state: str,
+    channel: Optional[str] = "",
+    classic: Optional[bool] = False,
+    cohort: Optional[str] = "",
+    revision: Optional[int] = None,
+) -> Union[Snap, List[Snap]]:
+    """Ensure specified snaps are in a given state on the system.
+
+    Args:
+        snap_names: the name(s) of the snaps to operate on
+        state: a string representation of the desired state, from `SnapState`
+        channel: an (Optional) channel as a string. Defaults to 'latest'
+        classic: an (Optional) boolean specifying whether it should be added with classic
+            confinement. Default `False`
+        cohort: an (Optional) string specifying the snap cohort to use
+        revision: an (Optional) integer specifying the snap revision to use
+
+    When both channel and revision are specified, the underlying snap install/refresh
+    command will determine the precedence (revision at the time of adding this)
+
+    Raises:
+        SnapError if the snap is not in the cache.
+    """
+    if not revision and not channel:
+        channel = "latest"
+
+    if state in ("present", "latest") or revision:
+        return add(snap_names, SnapState(state), channel, classic, cohort, revision)
+    else:
+        return remove(snap_names)
+
+
+def _wrap_snap_operations(
+    snap_names: List[str],
+    state: SnapState,
+    channel: str,
+    classic: bool,
+    cohort: Optional[str] = "",
+    revision: Optional[int] = None,
+) -> Union[Snap, List[Snap]]:
+    """Wrap common operations for bare commands."""
+    snaps = {"success": [], "failed": []}
+
+    op = "remove" if state is SnapState.Absent else "install or refresh"
+
+    for s in snap_names:
+        try:
+            snap = _Cache[s]
+            if state is SnapState.Absent:
+                snap.ensure(state=SnapState.Absent)
+            else:
+                snap.ensure(
+                    state=state, classic=classic, channel=channel, cohort=cohort, revision=revision
+                )
+            snaps["success"].append(snap)
+        except SnapError as e:
+            logger.warning("Failed to {} snap {}: {}!".format(op, s, e.message))
+            snaps["failed"].append(s)
+        except SnapNotFoundError:
+            logger.warning("Snap '{}' not found in cache!".format(s))
+            snaps["failed"].append(s)
+
+    if len(snaps["failed"]):
+        raise SnapError(
+            "Failed to install or refresh snap(s): {}".format(", ".join(list(snaps["failed"])))
+        )
+
+    return snaps["success"] if len(snaps["success"]) > 1 else snaps["success"][0]
+
+
+def install_local(
+    filename: str, classic: Optional[bool] = False, dangerous: Optional[bool] = False
+) -> Snap:
+    """Perform a snap operation.
+
+    Args:
+        filename: the path to a local .snap file to install
+        classic: whether to use classic confinement
+        dangerous: whether --dangerous should be passed to install snaps without a signature
+
+    Raises:
+        SnapError if there is a problem encountered
+    """
+    _cmd = [
+        "snap",
+        "install",
+        filename,
+    ]
+    if classic:
+        _cmd.append("--classic")
+    if dangerous:
+        _cmd.append("--dangerous")
+    try:
+        result = subprocess.check_output(_cmd, universal_newlines=True).splitlines()[-1]
+        snap_name, _ = result.split(" ", 1)
+        snap_name = ansi_filter.sub("", snap_name)
+
+        c = SnapCache()
+
+        try:
+            return c[snap_name]
+        except SnapAPIError as e:
+            logger.error(
+                "Could not find snap {} when querying Snapd socket: {}".format(snap_name, e.body)
+            )
+            raise SnapError("Failed to find snap {} in Snap cache".format(snap_name))
+    except CalledProcessError as e:
+        raise SnapError("Could not install snap {}: {}".format(filename, e.output))
+
+
+def _system_set(config_item: str, value: str) -> None:
+    """Set system snapd config values.
+
+    Args:
+        config_item: name of snap system setting. E.g. 'refresh.hold'
+        value: value to assign
+    """
+    _cmd = ["snap", "set", "system", "{}={}".format(config_item, value)]
+    try:
+        subprocess.check_call(_cmd, universal_newlines=True)
+    except CalledProcessError:
+        raise SnapError("Failed setting system config '{}' to '{}'".format(config_item, value))
+
+
+def hold_refresh(days: int = 90, forever: bool = False) -> bool:
+    """Set the system-wide snap refresh hold.
+
+    Args:
+        days: number of days to hold system refreshes for. Maximum 90. Set to zero to remove hold.
+        forever: if True, will set a hold forever.
+    """
+    if not isinstance(forever, bool):
+        raise TypeError("forever must be a bool")
+    if not isinstance(days, int):
+        raise TypeError("days must be an int")
+    if forever:
+        _system_set("refresh.hold", "forever")
+        logger.info("Set system-wide snap refresh hold to: forever")
+    elif days == 0:
+        _system_set("refresh.hold", "")
+        logger.info("Removed system-wide snap refresh hold")
+    else:
+        # Currently the snap daemon can only hold for a maximum of 90 days
+        if not 1 <= days <= 90:
+            raise ValueError("days must be between 1 and 90")
+        # Add the number of days to current time
+        target_date = datetime.now(timezone.utc).astimezone() + timedelta(days=days)
+        # Format for the correct datetime format
+        hold_date = target_date.strftime("%Y-%m-%dT%H:%M:%S%z")
+        # Python dumps the offset in format '+0100', we need '+01:00'
+        hold_date = "{0}:{1}".format(hold_date[:-2], hold_date[-2:])
+        # Actually set the hold date
+        _system_set("refresh.hold", hold_date)
+        logger.info("Set system-wide snap refresh hold to: %s", hold_date)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
new file mode 100644
index 0000000..8e25b6c
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
@@ -0,0 +1,43 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: ratings_features_user.proto
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
+from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1bratings_features_user.proto\x12\x15ratings.features.user\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"!\n\x13\x41uthenticateRequest\x12\n\n\x02id\x18\x01 \x01(\t\"%\n\x14\x41uthenticateResponse\x12\r\n\x05token\x18\x01 \x01(\t\",\n\x12ListMyVotesRequest\x12\x16\n\x0esnap_id_filter\x18\x01 \x01(\t\"A\n\x13ListMyVotesResponse\x12*\n\x05votes\x18\x01 \x03(\x0b\x32\x1b.ratings.features.user.Vote\"&\n\x13GetSnapVotesRequest\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\"B\n\x14GetSnapVotesResponse\x12*\n\x05votes\x18\x01 \x03(\x0b\x32\x1b.ratings.features.user.Vote\"n\n\x04Vote\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\x05\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x12-\n\ttimestamp\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"F\n\x0bVoteRequest\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\x05\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x32\xc6\x03\n\x04User\x12i\n\x0c\x41uthenticate\x12*.ratings.features.user.AuthenticateRequest\x1a+.ratings.features.user.AuthenticateResponse\"\x00\x12:\n\x06\x44\x65lete\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\"\x00\x12\x44\n\x04Vote\x12\".ratings.features.user.VoteRequest\x1a\x16.google.protobuf.Empty\"\x00\x12\x66\n\x0bListMyVotes\x12).ratings.features.user.ListMyVotesRequest\x1a*.ratings.features.user.ListMyVotesResponse\"\x00\x12i\n\x0cGetSnapVotes\x12*.ratings.features.user.GetSnapVotesRequest\x1a+.ratings.features.user.GetSnapVotesResponse\"\x00\x62\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_user_pb2', _globals)
+if _descriptor._USE_C_DESCRIPTORS == False:
+  DESCRIPTOR._options = None
+  _globals['_AUTHENTICATEREQUEST']._serialized_start=116
+  _globals['_AUTHENTICATEREQUEST']._serialized_end=149
+  _globals['_AUTHENTICATERESPONSE']._serialized_start=151
+  _globals['_AUTHENTICATERESPONSE']._serialized_end=188
+  _globals['_LISTMYVOTESREQUEST']._serialized_start=190
+  _globals['_LISTMYVOTESREQUEST']._serialized_end=234
+  _globals['_LISTMYVOTESRESPONSE']._serialized_start=236
+  _globals['_LISTMYVOTESRESPONSE']._serialized_end=301
+  _globals['_GETSNAPVOTESREQUEST']._serialized_start=303
+  _globals['_GETSNAPVOTESREQUEST']._serialized_end=341
+  _globals['_GETSNAPVOTESRESPONSE']._serialized_start=343
+  _globals['_GETSNAPVOTESRESPONSE']._serialized_end=409
+  _globals['_VOTE']._serialized_start=411
+  _globals['_VOTE']._serialized_end=521
+  _globals['_VOTEREQUEST']._serialized_start=523
+  _globals['_VOTEREQUEST']._serialized_end=593
+  _globals['_USER']._serialized_start=596
+  _globals['_USER']._serialized_end=1050
+# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
new file mode 100644
index 0000000..71217b9
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
@@ -0,0 +1,199 @@
+# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
+"""Client and server classes corresponding to protobuf-defined services."""
+import grpc
+
+from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
+import ratings_features_user_pb2 as ratings__features__user__pb2
+
+
+class UserStub(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def __init__(self, channel):
+        """Constructor.
+
+        Args:
+            channel: A grpc.Channel.
+        """
+        self.Authenticate = channel.unary_unary(
+                '/ratings.features.user.User/Authenticate',
+                request_serializer=ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.AuthenticateResponse.FromString,
+                )
+        self.Delete = channel.unary_unary(
+                '/ratings.features.user.User/Delete',
+                request_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                )
+        self.Vote = channel.unary_unary(
+                '/ratings.features.user.User/Vote',
+                request_serializer=ratings__features__user__pb2.VoteRequest.SerializeToString,
+                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                )
+        self.ListMyVotes = channel.unary_unary(
+                '/ratings.features.user.User/ListMyVotes',
+                request_serializer=ratings__features__user__pb2.ListMyVotesRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.ListMyVotesResponse.FromString,
+                )
+        self.GetSnapVotes = channel.unary_unary(
+                '/ratings.features.user.User/GetSnapVotes',
+                request_serializer=ratings__features__user__pb2.GetSnapVotesRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.GetSnapVotesResponse.FromString,
+                )
+
+
+class UserServicer(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def Authenticate(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def Delete(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def Vote(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def ListMyVotes(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def GetSnapVotes(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+
+def add_UserServicer_to_server(servicer, server):
+    rpc_method_handlers = {
+            'Authenticate': grpc.unary_unary_rpc_method_handler(
+                    servicer.Authenticate,
+                    request_deserializer=ratings__features__user__pb2.AuthenticateRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.AuthenticateResponse.SerializeToString,
+            ),
+            'Delete': grpc.unary_unary_rpc_method_handler(
+                    servicer.Delete,
+                    request_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            ),
+            'Vote': grpc.unary_unary_rpc_method_handler(
+                    servicer.Vote,
+                    request_deserializer=ratings__features__user__pb2.VoteRequest.FromString,
+                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            ),
+            'ListMyVotes': grpc.unary_unary_rpc_method_handler(
+                    servicer.ListMyVotes,
+                    request_deserializer=ratings__features__user__pb2.ListMyVotesRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.ListMyVotesResponse.SerializeToString,
+            ),
+            'GetSnapVotes': grpc.unary_unary_rpc_method_handler(
+                    servicer.GetSnapVotes,
+                    request_deserializer=ratings__features__user__pb2.GetSnapVotesRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.GetSnapVotesResponse.SerializeToString,
+            ),
+    }
+    generic_handler = grpc.method_handlers_generic_handler(
+            'ratings.features.user.User', rpc_method_handlers)
+    server.add_generic_rpc_handlers((generic_handler,))
+
+
+ # This class is part of an EXPERIMENTAL API.
+class User(object):
+    """Missing associated documentation comment in .proto file."""
+
+    @staticmethod
+    def Authenticate(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Authenticate',
+            ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
+            ratings__features__user__pb2.AuthenticateResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def Delete(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Delete',
+            google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def Vote(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Vote',
+            ratings__features__user__pb2.VoteRequest.SerializeToString,
+            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def ListMyVotes(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/ListMyVotes',
+            ratings__features__user__pb2.ListMyVotesRequest.SerializeToString,
+            ratings__features__user__pb2.ListMyVotesResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def GetSnapVotes(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/GetSnapVotes',
+            ratings__features__user__pb2.GetSnapVotesRequest.SerializeToString,
+            ratings__features__user__pb2.GetSnapVotesResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index d7cd399..208f433 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -10,163 +10,105 @@
 import logging
 import os
 import secrets
-import shutil
 from os import environ
 from pathlib import Path
-from subprocess import CalledProcessError, check_output
 
 import ops
 from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent, DatabaseRequires
-from charms.operator_libs_linux.v0 import apt, systemd
-from git import Repo
-from jinja2 import Template
-from ops.framework import StoredState
-from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus
+from charms.operator_libs_linux.v1 import snap
+from ops.model import ActiveStatus, MaintenanceStatus
+from ratings import Ratings
 
 logger = logging.getLogger(__name__)
 
 
-APP_PATH = Path("/srv/app")
+PATH = Path("/srv/app")
 UNIT_PATH = Path("/etc/systemd/system/ratings.service")
 CARGO_PATH = Path(environ.get("HOME", "/root")) / ".cargo/bin/cargo"
-APP_PORT = 443
+PORT = 443
+NAME = "ratings"
+HOST = "0.0.0.0"
 
 
 class RatingsCharm(ops.CharmBase):
     """Main operator class for ratings service."""
 
-    _stored = StoredState()
-
     def __init__(self, *args):
         super().__init__(*args)
-        self._ratings_svc = None
+        self._ratings = Ratings()
 
         # Initialise the integration with PostgreSQL
         self._database = DatabaseRequires(self, relation_name="database", database_name="ratings")
+
+        # Observe common Juju events
         self.framework.observe(self._database.on.database_created, self._on_database_created)
         self.framework.observe(self.on.install, self._on_install)
-        self._stored.set_default(repo="", port="", conn_str="", install_completed=False)
         self.framework.observe(self.on.start, self._on_start)
-        self.framework.observe(self.on.pull_and_rebuild_action, self._on_pull_and_rebuild)
+        self.framework.observe(self.on.upgrade_charm, self._on_upgrade_charm)
 
     def _on_start(self, _):
-        """Start the workload."""
-        # Enable and start the "ratings" systemd unit
-        systemd.service_resume("ratings")
+        """Start Ratings."""
+        self._ratings.start()
         self.unit.status = ActiveStatus()
 
+    def _on_upgrade_charm(self, _):
+        """Ensure the snap is refreshed (in channel) if there are new revisions."""
+        self.unit.status = ops.MaintenanceStatus("refreshing Ratings")
+        try:
+            self._ratings.refresh()
+        except snap.SnapError as e:
+            self.unit.status = ops.BlockedStatus(str(e))
+
     def _on_install(self, _):
         """Install prerequisites for the application."""
-        self.unit.status = MaintenanceStatus("Installing rustc, cargo and other dependencies")
-
-        # Install via apt
-        self._install_apt_packages(
-            ["curl", "git", "gcc", "libssl-dev", "pkg-config", "protobuf-compiler"]
-        )
-
-        # Ensure squid proxy, done after apt to not interfere
-        self._set_squid_proxy()
+        self.unit.status = MaintenanceStatus("Installing Ratings")
 
-        # Curl minial rust toolchain
         try:
-            check_output(
-                "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal",
-                shell=True,
-            )
-            self._stored.install_completed = True
+            self._ratings.install()
             self.unit.status = MaintenanceStatus("Installation complete, waiting for database.")
-
-        except CalledProcessError as e:
-            logger.error(f"Curl command failed with error code {e.returncode}")
-            self.unit.status = BlockedStatus("Curl command failed")
-            return
-
-    def _render_systemd_unit(self):
-        """Render the systemd unit file for the application."""
-        with open("templates/ratings-service.j2", "r") as t:
-            template = Template(t.read())
-
-        # Get connection string from Juju relation to db
-        connection_string = self._db_connection_string()
-
-        # Generate jwt secret
-        jwt_secret = self._jwt_secret()
-        rendered = template.render(
-            project_root=APP_PATH,
-            app_env=self.config["app-env"],
-            app_jwt_secret=jwt_secret,
-            app_log_level=self.config["app-log-level"],
-            app_postgres_uri=connection_string,
-            app_migration_postgres_uri=connection_string,
-        )
-        with open(UNIT_PATH, "w+") as t:
-            t.write(rendered)
-        os.chmod(UNIT_PATH, 0o755)
-        systemd.daemon_reload()
-
-    def _setup_application(self, _=None):
-        """Clone Rust application into place and setup its dependencies."""
-        self.unit.status = MaintenanceStatus("Preparing to fetch application code")
-
-        # Delete the application directory if it exists already
-        if Path(APP_PATH).is_dir():
-            shutil.rmtree("/srv/app")
-
-        # If this is the first time, set the repo in the stored state
-        if not self._stored.repo:
-            self._stored.repo = self.config["app-repo"]
-
-        # Ensure squid proxy
-        self._set_squid_proxy()
-
-        # Fetch the code using git
-        try:
-            Repo.clone_from(self._stored.repo, APP_PATH, branch="vm-charm")
-            self.unit.status = MaintenanceStatus("Code fetched, building now.")
-        except Exception as e:
-            logger.error(f"Git clone failed: {str(e)}")
-            self.unit.status = BlockedStatus("Git clone failed")
-            return
-
-        # Build the binary
-        try:
-            check_output([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH)
-        except CalledProcessError as e:
-            logger.error(f"Cargo build failed with error code {e.returncode}")
-            self.unit.status = BlockedStatus("Cargo build failed")
-            return
+        except snap.SnapError as e:
+            logger.error(f"Failed to install Ratings via snap: {e}")
+            self.unit.status = ops.BlockedStatus(str(e))
 
     def _on_database_created(self, _: DatabaseCreatedEvent):
         """Handle the database creation event."""
         logger.info("Database created event triggered.")
-        if not self._stored.install_completed:
-            logger.warning("Skipping _on_database_created, install not completed yet.")
-            self.unit.status = ops.WaitingStatus("Waiting for install to complete.")
-            return
-        self._setup_application()
-        self._render_systemd_unit()
-        self._start_ratings()
+        self._update_service_config()
 
-    def _start_ratings(self):
-        """Start the ratings service using systemd."""
-        logger.info("Attempting to start ratings service.")
+    def _update_service_config(self):
+        """Update the service config and restart Ratings."""
+        logger.info("Updating config and resterting Ratings.")
 
         if self.model.get_relation("database") is None:
             logger.warning("No database relation found. Waiting.")
             self.unit.status = ops.WaitingStatus("Waiting for database relation")
             return
 
-        self.unit.status = ops.MaintenanceStatus("Attempting to start ratings service.")
+        self.unit.status = ops.MaintenanceStatus("Attempting to update Ratings config.")
+        # Get connection string from Juju relation to db
+        connection_string = self._db_connection_string()
+
+        # Generate jwt secret
+        jwt_secret = self._jwt_secret()
+
+        # Ensure squid proxy
+        self._set_proxy()
 
         try:
-            logger.info("Resuming systemd service for ratings.")
-            systemd.service_resume("ratings")
-            self.unit.open_port(protocol="tcp", port=APP_PORT)
+            logger.info("Updating and resuming snap service for Ratings.")
+            self._ratings.configure(
+                jwt_secret=jwt_secret,
+                postgres_uri=connection_string,
+                migration_postgres_uri=connection_string,
+                log_level=self.config["log-level"],
+                env=self.config["env"],
+            )
+            self.unit.open_port(protocol="tcp", port=PORT)
             self.unit.status = ops.ActiveStatus()
             logger.info("Ratings service started successfully.")
         except Exception as e:
-            logger.error(f"Failed to start ratings service: {str(e)}")
-            self.unit.status = ops.BlockedStatus(f"Failed to start ratings service: {str(e)}")
+            logger.error(f"Failed to start Ratings service: {str(e)}")
+            self.unit.status = ops.BlockedStatus(f"Failed to start Ratings service: {str(e)}")
 
     def _db_connection_string(self) -> str:
         """Report database connection string using info from relation databag."""
@@ -214,43 +156,9 @@ def _jwt_secret(self) -> str:
         else:
             return ""
 
-    def _install_apt_packages(self, packages: list):
-        """Install the specified apt packages."""
-        self.unit.status = MaintenanceStatus("Installing apt packages.")
-        try:
-            apt.update()
-            apt.add_package(packages)
-        except apt.PackageNotFoundError:
-            logger.error("a specified package not found in package cache or on system")
-            self.unit.status = BlockedStatus("Failed to install packages")
-        except apt.PackageError:
-            logger.error("could not install package")
-            self.unit.status = BlockedStatus("Failed to install packages")
-
-    def _on_pull_and_rebuild(self, event):
-        """Pull new code and rebuild the application."""
-        event.set_results({"status": "pulling and rebuilding"})
-        try:
-            self._set_squid_proxy()
-
-            # Pull new code
-            repo = Repo(APP_PATH)
-            repo.remotes.origin.pull()
-
-            # Rebuild the application
-            check_output([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH)
-            systemd.service_restart("ratings")
-
-            event.set_results({"status": "successful"})
-            self.unit.status = ActiveStatus("Successfully pulled and rebuilt.")
-
-        except Exception as e:
-            event.fail(f"Failed: {str(e)}")
-            self.unit.status = BlockedStatus(f"Pull and rebuild failed: {str(e)}")
-
-    def _set_squid_proxy(self):
+    def _set_proxy(self):
         """Set Squid proxy environment variables if configured."""
-        proxy_url = self.config["squid-proxy-url"]
+        proxy_url = os.environ.get("JUJU_CHARM_HTTP_PROXY")
         if proxy_url:
             os.environ["HTTP_PROXY"] = proxy_url
             os.environ["HTTPS_PROXY"] = proxy_url
diff --git a/vm_operator/src/ratings.py b/vm_operator/src/ratings.py
new file mode 100644
index 0000000..54be936
--- /dev/null
+++ b/vm_operator/src/ratings.py
@@ -0,0 +1,81 @@
+"""Control App Center Ratings on a host system. Provides a Ratings class."""
+
+import logging
+
+from charms.operator_libs_linux.v1 import snap
+
+logger = logging.getLogger(__name__)
+
+
+class Ratings:
+    """Class representing Ratings on a host system."""
+
+    def install(self):
+        """Install the Ratings snap package."""
+        try:
+            self._snap.ensure(snap.SnapState.Latest, channel="edge")
+            snap.hold_refresh()
+        except snap.SnapError as e:
+            logger.error("could not install ratings. Reason: %s", e.message)
+            logger.debug(e, exc_info=True)
+            raise e
+
+    def refresh(self):
+        """Refresh the Ratings snap if there is a new revision."""
+        # The operation here is exactly the same, so just call the install method
+        self.install()
+
+    def start(self):
+        """Start and enable Ratings using the snap service."""
+        self._snap.start(enable=True)
+
+    def stop(self):
+        """Stop Ratings using the snap service."""
+        self._snap.stop(disable=True)
+
+    def remove(self):
+        """Remove the Ratings snap."""
+        self._snap.ensure(snap.SnapState.Absent)
+
+    def configure(
+        self,
+        jwt_secret=None,
+        log_level=None,
+        postgres_uri=None,
+        migration_postgres_uri=None,
+        env=None,
+    ):
+        """Configure Ratings on the host system."""
+        if jwt_secret:
+            self._snap.set({"app-jwt-secret": jwt_secret})
+
+        if log_level:
+            self._snap.set({"app-log-level": log_level})
+
+        if postgres_uri:
+            self._snap.set({"app-postgres-uri": postgres_uri})
+
+        if migration_postgres_uri:
+            self._snap.set({"app-migration-postgres-uri": migration_postgres_uri})
+
+        if env:
+            self._snap.set({"app-env": env})
+
+        # Restart the snap service
+        self._snap.restart()
+
+    @property
+    def installed(self):
+        """Report if the Ratings snap is installed."""
+        return self._snap.present
+
+    @property
+    def running(self):
+        """Report if the 'ratings-svc' snap service is running."""
+        return self._snap.services["ratings-svc"]["active"]
+
+    @property
+    def _snap(self):
+        """Return a representation of the Ratings snap."""
+        cache = snap.SnapCache()
+        return cache["ratings"]
diff --git a/vm_operator/templates/ratings-service.j2 b/vm_operator/templates/ratings-service.j2
deleted file mode 100644
index a3d990b..0000000
--- a/vm_operator/templates/ratings-service.j2
+++ /dev/null
@@ -1,22 +0,0 @@
-[Unit]
-Description=App Center Ratings Service
-After=network.target
-
-[Service]
-Environment="APP_ENV={{ app_env }}"
-Environment="APP_JWT_SECRET={{ app_jwt_secret }}"
-Environment="APP_LOG_LEVEL={{ app_log_level }}"
-Environment="APP_POSTGRES_URI={{ app_postgres_uri }}"
-Environment="APP_MIGRATION_POSTGRES_URI={{ app_migration_postgres_uri }}"
-WorkingDirectory = {{ project_root }}
-Restart = always
-RestartSec = 5
-ExecStart={{ project_root }}/target/release/ratings
-ExecReload = /bin/kill -s HUP $MAINPID
-ExecStop = /bin/kill -s TERM $MAINPID
-ExecStartPre = /bin/mkdir {{ project_root }}/run
-PIDFile = {{ project_root }}/run/hello-juju.pid
-ExecStopPost = /bin/rm -rf {{ project_root }}/run
-
-[Install]
-WantedBy = multi-user.target
diff --git a/vm_operator/tests/functional/test_ratings.py b/vm_operator/tests/functional/test_ratings.py
new file mode 100644
index 0000000..b95f5c3
--- /dev/null
+++ b/vm_operator/tests/functional/test_ratings.py
@@ -0,0 +1,49 @@
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from ratings import Ratings
+
+
+class TestRatings(unittest.TestCase):
+    def setUp(self):
+        self.ratings = Ratings()
+        if not self.ratings.installed:
+            self.ratings.install()
+
+    def test_install(self):
+        self.assertTrue(Path("/snap/ratings/current/bin/ratings").exists())
+        self.assertTrue(self.ratings.installed)
+
+    def test_start(self):
+        self.ratings.start()
+        self.assertTrue(self.ratings.running)
+        self.ratings.remove()
+
+    def test_stop(self):
+        self.ratings.stop()
+        self.assertFalse(self.ratings.running)
+        self.ratings.remove()
+
+    def test_remove(self):
+        self.ratings.remove()
+        self.assertFalse(self.ratings.installed)
+
+    @mock.patch("charms.operator_libs_linux.v1.snap.Snap.restart")
+    def test_configure_ratings(self, _restart):
+        self.ratings.configure(
+            jwt_secret="foo",
+            log_level="bar",
+            postgres_uri="foobar",
+            migration_postgres_uri="barfoo",
+            env="testenv",
+        )
+
+        # Test have been updated
+        self.assertEqual(self.ratings._snap.get("app-jwt-secret"), "foo")
+        self.assertEqual(self.ratings._snap.get("app-log-level"), "bar")
+        self.assertEqual(self.ratings._snap.get("app-migration-postgres-uri"), "barfoo")
+        self.assertEqual(self.ratings._snap.get("app-postgres-uri"), "foobar")
+        self.assertEqual(self.ratings._snap.get("app-env"), "testenv")
+
+        _restart.assert_called_once()
diff --git a/vm_operator/tests/functional/test_setup.yaml b/vm_operator/tests/functional/test_setup.yaml
new file mode 100644
index 0000000..4a8e995
--- /dev/null
+++ b/vm_operator/tests/functional/test_setup.yaml
@@ -0,0 +1,6 @@
+#cloud-config
+package_update: true
+packages:
+  - python3-pip
+runcmd:
+  - pip3 install tox
diff --git a/vm_operator/tests/integration/conftest.py b/vm_operator/tests/integration/conftest.py
new file mode 100644
index 0000000..3314655
--- /dev/null
+++ b/vm_operator/tests/integration/conftest.py
@@ -0,0 +1,12 @@
+# Copyright 2021 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+from pytest import fixture
+from pytest_operator.plugin import OpsTest
+
+
+@fixture(scope="module")
+async def ratings_charm(ops_test: OpsTest):
+    """Ratings charm used for integration testing."""
+    charm = await ops_test.build_charm(".")
+    return charm
diff --git a/vm_operator/tests/integration/test_charm.py b/vm_operator/tests/integration/test_charm.py
new file mode 100644
index 0000000..3075ecf
--- /dev/null
+++ b/vm_operator/tests/integration/test_charm.py
@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+# Copyright 2022 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+import asyncio
+import secrets
+
+import grpc
+import ratings_api.ratings_features_user_pb2 as pb2
+import ratings_api.ratings_features_user_pb2_grpc as pb2_grpc
+from pytest import mark
+from pytest_operator.plugin import OpsTest
+
+RATINGS = "ratings"
+UNIT_0 = f"{RATINGS}/0"
+DB = "db"
+
+
+@mark.abort_on_fail
+@mark.skip_if_deployed
+async def test_deploy(ops_test: OpsTest, ratings_charm):
+    await ops_test.model.deploy(await ratings_charm, application_name=RATINGS)
+    # issuing dummy update_status just to trigger an event
+    async with ops_test.fast_forward():
+        await ops_test.model.wait_for_idle(apps=[RATINGS], status="active", timeout=1000)
+        assert ops_test.model.applications[RATINGS].units[0].workload_status == "active"
+
+
+@mark.abort_on_fail
+async def test_database_relation(ops_test: OpsTest):
+    """Test that the charm can be successfully related to PostgreSQL."""
+    await asyncio.gather(
+        ops_test.model.deploy("postgresql", channel="edge", application_name=DB, trust=True),
+        ops_test.model.wait_for_idle(
+            apps=[DB], status="active", raise_on_blocked=True, timeout=1000
+        ),
+    )
+
+    await asyncio.gather(
+        ops_test.model.integrate(RATINGS, DB),
+        ops_test.model.wait_for_idle(
+            apps=[RATINGS], status="active", raise_on_blocked=True, timeout=1000
+        ),
+    )
+
+
+@mark.abort_on_fail
+async def test_ratings_register_user(ops_test: OpsTest):
+    """End-to-end test to ensure the app can interact with the database."""
+    status = await ops_test.model.get_status()  # noqa: F821
+    unit = list(status.applications[RATINGS].units)[0]
+    print(f"Connecting to address: {status}")
+    address = status["applications"][RATINGS]["units"][unit]["public-address"]
+    print(f"Connecting to address: {address}")
+    connection_string = f"{address}:443"
+
+    channel = grpc.insecure_channel(connection_string)
+    stub = pb2_grpc.UserStub(channel)
+    message = pb2.AuthenticateRequest(id=secrets.token_hex(32))
+    print(f"Message sent: {message}")
+    response = stub.Authenticate(message)
+    assert response.token
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
index 71029f8..209bcce 100644
--- a/vm_operator/tests/unit/test_charm.py
+++ b/vm_operator/tests/unit/test_charm.py
@@ -1,13 +1,11 @@
 import os
 import unittest
-from pathlib import Path
 from unittest import mock
-from unittest.mock import call, mock_open, patch
+from unittest.mock import patch
 
-from charm import APP_PATH, CARGO_PATH, UNIT_PATH, RatingsCharm
+from charm import RatingsCharm
 from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent
-from charms.operator_libs_linux.v0 import apt
-from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus, WaitingStatus
+from ops.model import ActiveStatus, MaintenanceStatus, WaitingStatus
 from ops.testing import Harness
 
 
@@ -25,29 +23,6 @@ def __init__(self, id, name="database"):
     "version": "14.8",
 }
 
-RENDERED_SYSTEMD_UNIT = """[Unit]
-Description=App Center Ratings Service
-After=network.target
-
-[Service]
-Environment="APP_ENV=dev"
-Environment="APP_JWT_SECRET="
-Environment="APP_LOG_LEVEL=info"
-Environment="APP_POSTGRES_URI="
-Environment="APP_MIGRATION_POSTGRES_URI="
-WorkingDirectory = /srv/app
-Restart = always
-RestartSec = 5
-ExecStart=/srv/app/target/release/ratings
-ExecReload = /bin/kill -s HUP $MAINPID
-ExecStop = /bin/kill -s TERM $MAINPID
-ExecStartPre = /bin/mkdir /srv/app/run
-PIDFile = /srv/app/run/hello-juju.pid
-ExecStopPost = /bin/rm -rf /srv/app/run
-
-[Install]
-WantedBy = multi-user.target"""
-
 
 class TestCharm(unittest.TestCase):
     def setUp(self):
@@ -55,168 +30,36 @@ def setUp(self):
         self.addCleanup(self.harness.cleanup)
         self.harness.begin()
 
-    @mock.patch("charm.RatingsCharm._install_apt_packages")
+    @mock.patch("charm.Ratings.install")
     def test_on_install(self, _install):
         self.harness.charm.on.install.emit()
         self.assertEqual(
             self.harness.charm.unit.status,
             MaintenanceStatus("Installation complete, waiting for database."),
         )
-        _install.assert_called_with(
-            ["curl", "git", "gcc", "libssl-dev", "pkg-config", "protobuf-compiler"]
-        )
 
-    @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
+    @patch("charm.Ratings.refresh", lambda _: True)
+    def test_upgrade_charm(self):
+        self.harness.charm.on.upgrade_charm.emit()
+        self.assertEqual(self.harness.charm.unit.status, MaintenanceStatus("refreshing Ratings"))
+
+    @mock.patch("charm.Ratings.start")
     def test_on_start(self, _resume):
         # Run the handler
         self.harness.charm.on.start.emit()
         # Ensure we set an ActiveStatus for the charm
         self.assertEqual(self.harness.charm.unit.status, ActiveStatus())
-        _resume.assert_called_with("ratings")
-
-    @mock.patch("charms.operator_libs_linux.v0.systemd.daemon_reload")
-    @mock.patch("os.chmod")
-    def test_render_systemd_unit(self, _chmod, _reload):
-        # Create a mock for the `open` method, set the return value of `read` to
-        # the contents of the systemd unit template
-        with open("templates/ratings-service.j2", "r") as f:
-            m = mock_open(read_data=f.read())
-
-        # Patch the `open` method with our mock
-        with patch("builtins.open", m, create=True):
-            # Ensure the stored value is clear to test it's set properly
-            self.harness.charm._stored.port = ""
-            # Mock the return value of the `check_call`
-            _reload.return_value = 0
-            # Call the method
-            self.harness.charm._render_systemd_unit()
-
-        # Check the unit path is correct
-        self.assertEqual(UNIT_PATH, Path("/etc/systemd/system/ratings.service"))
-        # Check the template is opened read-only in the first call to open
-        self.assertEqual(m.call_args_list[0][0], ("templates/ratings-service.j2", "r"))
-        # Check the systemd unit file is opened with "w+" mode in the second call to open
-        self.assertEqual(m.call_args_list[1][0], (UNIT_PATH, "w+"))
-        # Ensure the correct rendered template is written to file
-        m.return_value.write.assert_called_with(RENDERED_SYSTEMD_UNIT)
-        # Check the file permissions are set correctly
-        _chmod.assert_called_with(UNIT_PATH, 0o755)
-        # Check that systemd is reloaded to register the changes to the unit
-        _reload.assert_called_once()
-
-    @mock.patch.dict(os.environ, {}, clear=True)
-    @mock.patch("charm.check_output")
-    @mock.patch("charm.Repo.clone_from")
-    @mock.patch("charm.Path")
-    @mock.patch("shutil.rmtree")
-    def test_setup_application(self, _rmtree, _path, _clone, _check):
-        # Check that the app path was cleared/deleted
-        _path.return_value.is_dir.return_value = True
-
-        # Call the method
-        self.harness.charm._setup_application()
-
-        # Check that app-repo is set correctly
-        self.assertEqual(self.harness.charm._stored.repo, self.harness.charm.config["app-repo"])
-
-        self.assertEqual(APP_PATH, Path("/srv/app"))
-
-        # Check squid proxy is set correctly
-        self.assertEqual(os.environ.get("HTTP_PROXY"), "http://proxy.example.com")
-        self.assertEqual(os.environ.get("HTTPS_PROXY"), "http://proxy.example.com")
-
-        # Ensure we set the charm status correctly
-        self.assertEqual(
-            self.harness.charm.unit.status, MaintenanceStatus("Code fetched, building now.")
-        )
-        # Check we try to remove the directory
-        _rmtree.assert_called_with("/srv/app")
-
-        # Check we set the stored repository where none exists
-        self.assertEqual(
-            self.harness.charm._stored.repo,
-            "https://github.com/matthew-hagemann/app-center-ratings",
-        )
-
-        # Ensure we clone the repo
-        _clone.assert_called_with(
-            "https://github.com/matthew-hagemann/app-center-ratings", APP_PATH, branch="vm-charm"
-        )
-
-        # Check that cargo build was called correctly
-        self.assertEqual(
-            _check.call_args_list,
-            [
-                call([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH),
-            ],
-        )
-
-        # Make sure we don't try to remove the directory
-        _path.return_value.is_dir.return_value = False
-        self.harness.charm._stored.repo = "https://myrepo"
-        _rmtree.reset_mock()
 
-        # Call the method
-        self.harness.charm._setup_application()
-        _rmtree.assert_not_called()
-        self.assertEqual(self.harness.charm._stored.repo, "https://myrepo")
-
-    @mock.patch("charm.RatingsCharm._setup_application")
-    @mock.patch("charm.RatingsCharm._render_systemd_unit")
-    @mock.patch("charm.RatingsCharm._start_ratings")
-    def test_on_database_created(self, _start, _render, _setup):
-        self.harness.charm._stored.install_completed = True
+    @mock.patch("charm.RatingsCharm._update_service_config")
+    def test_on_database_created(self, _update):
         # Create a mock DatabaseCreatedEvent
         mock_event = mock.MagicMock(spec=DatabaseCreatedEvent)
 
         # Simulate database created event
         self.harness.charm._on_database_created(mock_event)
 
-        # Check _render_systemd_unit was called
-        _render.assert_called_once()
-        # Check _start_ratings was called
-        _start.assert_called_once()
-        # Check _setup_application was called
-        _setup.assert_called_once()
-
-        # If not installed, don't call functions
-        _render.reset_mock()
-        _start.reset_mock()
-        _setup.reset_mock()
-
-        self.harness.charm._stored.install_completed = False
-
-        # Simulate database created event
-        self.harness.charm._on_database_created(mock_event)
-
-        _render.assert_not_called()
-        _start.assert_not_called()
-        _setup.assert_not_called()
-
-    @mock.patch("charms.operator_libs_linux.v0.apt.update")
-    @mock.patch("charms.operator_libs_linux.v0.apt.add_package")
-    def test_install_apt_packages(self, _add_package, _update):
-        # Call the method with some packages to install
-        self.harness.charm._install_apt_packages(["curl", "vim"])
-        # Check that apt is called with the correct arguments
+        # Check _update_service_config was called
         _update.assert_called_once()
-        _add_package.assert_called_with(["curl", "vim"])
-        # Now check that if an exception is raised we do the right logging
-        _add_package.reset_mock()
-        _add_package.return_value = 1
-        _add_package.side_effect = apt.PackageNotFoundError
-        self.harness.charm._install_apt_packages(["curl", "vim"])
-        self.assertEqual(
-            self.harness.charm.unit.status, BlockedStatus("Failed to install packages")
-        )
-        # Now check that if an exception is raised we do the right logging
-        _add_package.reset_mock()
-        _add_package.return_value = 1
-        _add_package.side_effect = apt.PackageError
-        self.harness.charm._install_apt_packages(["curl", "vim"])
-        self.assertEqual(
-            self.harness.charm.unit.status, BlockedStatus("Failed to install packages")
-        )
 
     def test_ratings_db_connection_string_no_relation(self):
         self.assertEqual(self.harness.charm._db_connection_string(), "")
@@ -227,28 +70,49 @@ def test_ratings_db_connection_string(self):
         expected = "postgres://username:password@postgres:5432/ratings"
         self.assertEqual(self.harness.charm._db_connection_string(), expected)
 
+    @patch("charm.RatingsCharm._update_service_config")
     @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
-    def test_ratings_database_created_database_success(self):
+    def test_ratings_database_created_database_success(self, _update):
         rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
         self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
-        self.assertEqual(
-            self.harness.model.unit.status, WaitingStatus("Waiting for install to complete.")
-        )
 
-    @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
-    def test_start_ratings(self, _resume):
+        _update.assert_called_once()
+
+    @patch("charm.RatingsCharm._set_proxy")
+    @patch("charm.RatingsCharm._db_connection_string", return_value="bar")
+    @patch("charm.RatingsCharm._jwt_secret", return_value="foo")
+    @mock.patch("charm.Ratings.configure")
+    def test_update_service_config(self, _conf, _jwt, _db_string, _proxy):
+        # Set env and log-level
+        self.harness.update_config({"env": "test-env", "log-level": "debug"})
+
         # If no relation, wait on relation
-        self.harness.charm._start_ratings()
+        self.harness.charm._update_service_config()
         self.assertEqual(
             self.harness.charm.unit.status, WaitingStatus("Waiting for database relation")
         )
 
         # If the relation is set, open the ports and restart the service
         self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.charm._start_ratings()
+        self.harness.charm._update_service_config()
+
+        # JWT was generated
+        _jwt.assert_called_once()
+
+        # Connection string retrieved
+        _db_string.assert_called_once()
 
-        # Check the service was resumed
-        _resume.assert_called_with("ratings")
+        # Proxy set
+        _proxy.assert_called_once()
+
+        # Configure is called with the correct values
+        _conf.assert_called_with(
+            jwt_secret="foo",
+            postgres_uri="bar",
+            migration_postgres_uri="bar",
+            log_level="debug",
+            env="test-env",
+        )
 
         # Check the ports have been opened
         opened_ports = {(p.protocol, p.port) for p in self.harness.charm.unit.opened_ports()}
@@ -276,42 +140,18 @@ def test_ratings_jwt_secret_create(self):
         new_secret = self.harness.charm._jwt_secret()
         self.assertEqual(len(new_secret), 48)
 
-    @mock.patch("charms.operator_libs_linux.v0.systemd.service_restart")
-    @mock.patch("charm.check_output")
-    @mock.patch("charm.Repo")
-    def test_on_pull_and_rebuild(self, _mock_repo, _check, _restart):
-        # Can't mock chain in the @mock.patch, so set up chaining manually for pull
-        mock_pull = mock.Mock()
-        mock_origin = mock.Mock(pull=mock_pull)
-        mock_remotes = mock.Mock(origin=mock_origin)
-
-        _mock_repo.return_value.remotes = mock_remotes  # Set up mock chaining
-
-        # Create event mock
-        mock_event = mock.Mock()
-        mock_event.set_results = mock.Mock()
-        mock_event.fail = mock.Mock()
-
-        # Run the handler
-        self.harness.charm._on_pull_and_rebuild(mock_event)
-
-        # Check squid proxy is set correctly
-        self.assertEqual(os.environ.get("HTTP_PROXY"), "http://proxy.example.com")
-        self.assertEqual(os.environ.get("HTTPS_PROXY"), "http://proxy.example.com")
-
-        # Ensure we clone the repo
-        mock_pull.assert_called()
+    @mock.patch.dict(os.environ, {"JUJU_CHARM_HTTP_PROXY": "http://example.com:3128"}, clear=True)
+    def test_set_proxy(self):
+        # Call the method
+        self.harness.charm._set_proxy()
 
-        # Check that cargo build was called correctly
-        self.assertEqual(
-            _check.call_args_list,
-            [
-                call([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH),
-            ],
-        )
+        # Assert that the environment variables were set
+        self.assertEqual(os.environ["HTTP_PROXY"], "http://example.com:3128")
+        self.assertEqual(os.environ["HTTPS_PROXY"], "http://example.com:3128")
 
-        _restart.assert_called_with("ratings")
+        with mock.patch.dict(os.environ, {}, clear=True):
+            self.harness.charm._set_proxy()
 
-        self.assertEqual(
-            self.harness.charm.unit.status, ActiveStatus("Successfully pulled and rebuilt.")
-        )
+            # Assert that the environment variables were not set
+            self.assertNotIn("HTTP_PROXY", os.environ)
+            self.assertNotIn("HTTPS_PROXY", os.environ)
diff --git a/vm_operator/tox.ini b/vm_operator/tox.ini
index 8f40f5c..78f20f6 100644
--- a/vm_operator/tox.ini
+++ b/vm_operator/tox.ini
@@ -12,6 +12,8 @@ src_path = {tox_root}/src
 tests_path = {tox_root}/tests
 ;lib_path = {tox_root}/lib/charms/operator_name_with_underscores
 all_path = {[vars]src_path} {[vars]tests_path}
+lxd_name = ratings-func-test
+ftest_path = {tox_root}/tests/functional
 
 [testenv]
 set_env =
@@ -63,3 +65,55 @@ commands =
                  {posargs} \
                  {[vars]tests_path}/unit
     coverage report
+
+[testenv:functional]
+description = Build a LXD container for functional tests then run the tests
+allowlist_externals =
+    lxc
+    bash
+commands =
+    # Create a LXC container with the relevant packages installed
+    bash -c 'lxc launch -qe ubuntu:jammy {[vars]lxd_name} -c=user.user-data="$(<{[vars]ftest_path}/test_setup.yaml)"'
+    # Wait for the cloud-init process to finish
+    lxc exec {[vars]lxd_name} -- bash -c "cloud-init status -w >/dev/null 2>&1"
+    # Copy all the files needed for integration testing
+    lxc file push -qp {toxinidir}/tox.ini {[vars]lxd_name}/{[vars]lxd_name}/
+    lxc file push -qp {toxinidir}/pyproject.toml {[vars]lxd_name}/{[vars]lxd_name}/
+    lxc file push -qp {toxinidir}/config.yaml {[vars]lxd_name}/{[vars]lxd_name}/
+    lxc file push -qpr {toxinidir}/lib {[vars]lxd_name}/{[vars]lxd_name}/
+    lxc file push -qpr {toxinidir}/src {[vars]lxd_name}/{[vars]lxd_name}/
+    lxc file push -qpr {[vars]tests_path} {[vars]lxd_name}/{[vars]lxd_name}/
+    # Run the tests
+    lxc exec {[vars]lxd_name} -- tox -c /{[vars]lxd_name}/tox.ini -e functional-tests {posargs}
+commands_post =
+    -lxc stop {[vars]lxd_name}
+
+[testenv:functional-tests]
+description = Run functional tests
+deps =
+    ops==2.7.0
+    pytest==7.4.2
+commands =
+    pytest -v \
+           -s \
+           --tb native \
+           --log-cli-level=INFO \
+           {posargs} \
+           {[vars]tests_path}/functional/test_ratings.py
+
+[testenv:integration]
+description = Run integration tests
+deps =
+    pytest
+    tenacity
+    juju
+    pytest-operator
+    grpcio
+    -r {tox_root}/requirements.txt
+commands =
+    pytest -v \
+           -s \
+           --tb native \
+           --log-cli-level=INFO \
+           {posargs} \
+           {[vars]tests_path}/integration/test_charm.py