From a26c76b41e77591c2c550439dfdca2a9a610e62a Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Fri, 22 Sep 2023 16:06:59 +0200
Subject: [PATCH 01/11] feat(charm): add vm charm

---
 {operator => k8s_operator}/CONTRIBUTING.md    |    0
 {operator => k8s_operator}/LICENSE            |    0
 {operator => k8s_operator}/README.md          |    2 +-
 {operator => k8s_operator}/charmcraft.yaml    |    0
 .../data_platform_libs/v0/data_interfaces.py  |    0
 .../lib/charms/traefik_k8s/v2/ingress.py      |    0
 .../ratings_api/ratings_features_app_pb2.py   |    0
 .../ratings_features_app_pb2_grpc.py          |    0
 .../ratings_api/ratings_features_chart_pb2.py |    0
 .../ratings_features_chart_pb2_grpc.py        |    0
 .../ratings_api/ratings_features_user_pb2.py  |    0
 .../ratings_features_user_pb2_grpc.py         |    0
 {operator => k8s_operator}/metadata.yaml      |    0
 {operator => k8s_operator}/pyproject.toml     |    0
 {operator => k8s_operator}/requirements.txt   |    0
 {operator => k8s_operator}/src/charm.py       |    0
 {operator => k8s_operator}/src/database.py    |    0
 {operator => k8s_operator}/src/ratings.py     |    0
 .../tests/integration/test_charm.py           |    0
 .../tests/unit/test_charm.py                  |    0
 .../tests/unit/test_ratings.py                |    0
 {operator => k8s_operator}/tox.ini            |    0
 .../20230829085908_ratings_init.down.sql      |   10 +-
 .../20230829085908_ratings_init.up.sql        |   11 +-
 src/main.rs                                   |    3 +
 vm_operator/CONTRIBUTING.md                   |   33 +
 vm_operator/LICENSE                           |  202 +++
 vm_operator/README.md                         |   23 +
 vm_operator/actions.yaml                      |    2 +
 vm_operator/charmcraft.yaml                   |   17 +
 vm_operator/config.yaml                       |   29 +
 .../data_platform_libs/v0/data_interfaces.py  | 1484 +++++++++++++++++
 .../lib/charms/operator_libs_linux/v0/apt.py  | 1321 +++++++++++++++
 .../charms/operator_libs_linux/v0/systemd.py  |  186 +++
 .../lib/charms/traefik_k8s/v2/ingress.py      |  696 ++++++++
 .../ratings_api/ratings_features_app_pb2.py   |   30 +
 .../ratings_features_app_pb2_grpc.py          |   66 +
 .../ratings_api/ratings_features_chart_pb2.py |   36 +
 .../ratings_features_chart_pb2_grpc.py        |   66 +
 .../ratings_api/ratings_features_user_pb2.py  |   41 +
 .../ratings_features_user_pb2_grpc.py         |  199 +++
 vm_operator/metadata.yaml                     |   22 +
 vm_operator/pyproject.toml                    |   43 +
 vm_operator/requirements.txt                  |    3 +
 vm_operator/src/charm.py                      |  228 +++
 vm_operator/templates/ratings-service.j2      |   25 +
 vm_operator/tests/integration/test_charm.py   |  142 ++
 vm_operator/tests/unit/test_charm.py          |  153 ++
 vm_operator/tests/unit/test_ratings.py        |   57 +
 vm_operator/tox.ini                           |  105 ++
 50 files changed, 5224 insertions(+), 11 deletions(-)
 rename {operator => k8s_operator}/CONTRIBUTING.md (100%)
 rename {operator => k8s_operator}/LICENSE (100%)
 rename {operator => k8s_operator}/README.md (91%)
 rename {operator => k8s_operator}/charmcraft.yaml (100%)
 rename {operator => k8s_operator}/lib/charms/data_platform_libs/v0/data_interfaces.py (100%)
 rename {operator => k8s_operator}/lib/charms/traefik_k8s/v2/ingress.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_app_pb2.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_app_pb2_grpc.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_chart_pb2.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_chart_pb2_grpc.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_user_pb2.py (100%)
 rename {operator => k8s_operator}/lib/ratings_api/ratings_features_user_pb2_grpc.py (100%)
 rename {operator => k8s_operator}/metadata.yaml (100%)
 rename {operator => k8s_operator}/pyproject.toml (100%)
 rename {operator => k8s_operator}/requirements.txt (100%)
 rename {operator => k8s_operator}/src/charm.py (100%)
 rename {operator => k8s_operator}/src/database.py (100%)
 rename {operator => k8s_operator}/src/ratings.py (100%)
 rename {operator => k8s_operator}/tests/integration/test_charm.py (100%)
 rename {operator => k8s_operator}/tests/unit/test_charm.py (100%)
 rename {operator => k8s_operator}/tests/unit/test_ratings.py (100%)
 rename {operator => k8s_operator}/tox.ini (100%)
 create mode 100644 vm_operator/CONTRIBUTING.md
 create mode 100644 vm_operator/LICENSE
 create mode 100644 vm_operator/README.md
 create mode 100644 vm_operator/actions.yaml
 create mode 100644 vm_operator/charmcraft.yaml
 create mode 100644 vm_operator/config.yaml
 create mode 100644 vm_operator/lib/charms/data_platform_libs/v0/data_interfaces.py
 create mode 100644 vm_operator/lib/charms/operator_libs_linux/v0/apt.py
 create mode 100644 vm_operator/lib/charms/operator_libs_linux/v0/systemd.py
 create mode 100644 vm_operator/lib/charms/traefik_k8s/v2/ingress.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_app_pb2.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_user_pb2.py
 create mode 100644 vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
 create mode 100644 vm_operator/metadata.yaml
 create mode 100644 vm_operator/pyproject.toml
 create mode 100644 vm_operator/requirements.txt
 create mode 100755 vm_operator/src/charm.py
 create mode 100644 vm_operator/templates/ratings-service.j2
 create mode 100644 vm_operator/tests/integration/test_charm.py
 create mode 100644 vm_operator/tests/unit/test_charm.py
 create mode 100644 vm_operator/tests/unit/test_ratings.py
 create mode 100644 vm_operator/tox.ini

diff --git a/operator/CONTRIBUTING.md b/k8s_operator/CONTRIBUTING.md
similarity index 100%
rename from operator/CONTRIBUTING.md
rename to k8s_operator/CONTRIBUTING.md
diff --git a/operator/LICENSE b/k8s_operator/LICENSE
similarity index 100%
rename from operator/LICENSE
rename to k8s_operator/LICENSE
diff --git a/operator/README.md b/k8s_operator/README.md
similarity index 91%
rename from operator/README.md
rename to k8s_operator/README.md
index 33fa1bf..042471a 100644
--- a/operator/README.md
+++ b/k8s_operator/README.md
@@ -17,7 +17,7 @@ image="$(yq '.resources."ratings-image"."upstream-source"' metadata.yaml)"
 juju deploy ./ubuntu-software-ratings_ubuntu-22.04-amd64.charm ratings \
     --resource ratings-image="$image"
 
-juju deploy postgresql-k8s postgres --channel latest/edge
+juju deploy postgresql --channel edge 
 
 juju relate ratings postgresql
 ```
diff --git a/operator/charmcraft.yaml b/k8s_operator/charmcraft.yaml
similarity index 100%
rename from operator/charmcraft.yaml
rename to k8s_operator/charmcraft.yaml
diff --git a/operator/lib/charms/data_platform_libs/v0/data_interfaces.py b/k8s_operator/lib/charms/data_platform_libs/v0/data_interfaces.py
similarity index 100%
rename from operator/lib/charms/data_platform_libs/v0/data_interfaces.py
rename to k8s_operator/lib/charms/data_platform_libs/v0/data_interfaces.py
diff --git a/operator/lib/charms/traefik_k8s/v2/ingress.py b/k8s_operator/lib/charms/traefik_k8s/v2/ingress.py
similarity index 100%
rename from operator/lib/charms/traefik_k8s/v2/ingress.py
rename to k8s_operator/lib/charms/traefik_k8s/v2/ingress.py
diff --git a/operator/lib/ratings_api/ratings_features_app_pb2.py b/k8s_operator/lib/ratings_api/ratings_features_app_pb2.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_app_pb2.py
rename to k8s_operator/lib/ratings_api/ratings_features_app_pb2.py
diff --git a/operator/lib/ratings_api/ratings_features_app_pb2_grpc.py b/k8s_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
rename to k8s_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
diff --git a/operator/lib/ratings_api/ratings_features_chart_pb2.py b/k8s_operator/lib/ratings_api/ratings_features_chart_pb2.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_chart_pb2.py
rename to k8s_operator/lib/ratings_api/ratings_features_chart_pb2.py
diff --git a/operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py b/k8s_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
rename to k8s_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
diff --git a/operator/lib/ratings_api/ratings_features_user_pb2.py b/k8s_operator/lib/ratings_api/ratings_features_user_pb2.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_user_pb2.py
rename to k8s_operator/lib/ratings_api/ratings_features_user_pb2.py
diff --git a/operator/lib/ratings_api/ratings_features_user_pb2_grpc.py b/k8s_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
similarity index 100%
rename from operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
rename to k8s_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
diff --git a/operator/metadata.yaml b/k8s_operator/metadata.yaml
similarity index 100%
rename from operator/metadata.yaml
rename to k8s_operator/metadata.yaml
diff --git a/operator/pyproject.toml b/k8s_operator/pyproject.toml
similarity index 100%
rename from operator/pyproject.toml
rename to k8s_operator/pyproject.toml
diff --git a/operator/requirements.txt b/k8s_operator/requirements.txt
similarity index 100%
rename from operator/requirements.txt
rename to k8s_operator/requirements.txt
diff --git a/operator/src/charm.py b/k8s_operator/src/charm.py
similarity index 100%
rename from operator/src/charm.py
rename to k8s_operator/src/charm.py
diff --git a/operator/src/database.py b/k8s_operator/src/database.py
similarity index 100%
rename from operator/src/database.py
rename to k8s_operator/src/database.py
diff --git a/operator/src/ratings.py b/k8s_operator/src/ratings.py
similarity index 100%
rename from operator/src/ratings.py
rename to k8s_operator/src/ratings.py
diff --git a/operator/tests/integration/test_charm.py b/k8s_operator/tests/integration/test_charm.py
similarity index 100%
rename from operator/tests/integration/test_charm.py
rename to k8s_operator/tests/integration/test_charm.py
diff --git a/operator/tests/unit/test_charm.py b/k8s_operator/tests/unit/test_charm.py
similarity index 100%
rename from operator/tests/unit/test_charm.py
rename to k8s_operator/tests/unit/test_charm.py
diff --git a/operator/tests/unit/test_ratings.py b/k8s_operator/tests/unit/test_ratings.py
similarity index 100%
rename from operator/tests/unit/test_ratings.py
rename to k8s_operator/tests/unit/test_ratings.py
diff --git a/operator/tox.ini b/k8s_operator/tox.ini
similarity index 100%
rename from operator/tox.ini
rename to k8s_operator/tox.ini
diff --git a/sql/migrations/20230829085908_ratings_init.down.sql b/sql/migrations/20230829085908_ratings_init.down.sql
index a2ba528..7274c21 100644
--- a/sql/migrations/20230829085908_ratings_init.down.sql
+++ b/sql/migrations/20230829085908_ratings_init.down.sql
@@ -1,8 +1,8 @@
-REVOKE ALL PRIVILEGES ON TABLE users FROM service;
-REVOKE USAGE, SELECT ON SEQUENCE users_id_seq FROM service;
-REVOKE ALL PRIVILEGES ON TABLE votes FROM service;
-REVOKE USAGE, SELECT ON SEQUENCE votes_id_seq FROM service;
-REVOKE CONNECT ON DATABASE ratings FROM service;
+REVOKE ALL PRIVILEGES ON TABLE users FROM CURRENT_USER;
+REVOKE USAGE, SELECT ON SEQUENCE users_id_seq FROM CURRENT_USER;
+REVOKE ALL PRIVILEGES ON TABLE votes FROM CURRENT_USER;
+REVOKE USAGE, SELECT ON SEQUENCE votes_id_seq FROM CURRENT_USER;
+REVOKE CONNECT ON DATABASE ratings FROM CURRENT_USER;
 
 DROP TABLE IF EXISTS votes;
 DROP TABLE IF EXISTS users;
diff --git a/sql/migrations/20230829085908_ratings_init.up.sql b/sql/migrations/20230829085908_ratings_init.up.sql
index e780526..2f1f695 100644
--- a/sql/migrations/20230829085908_ratings_init.up.sql
+++ b/sql/migrations/20230829085908_ratings_init.up.sql
@@ -31,8 +31,9 @@ CREATE TABLE votes (
 -- can't vote more than once for the same snap revision.
 CREATE UNIQUE INDEX idx_votes_unique_user_snap ON votes (user_id_fk, snap_id, snap_revision);
 
-GRANT ALL PRIVILEGES ON TABLE users TO service;
-GRANT USAGE, SELECT ON SEQUENCE users_id_seq TO service;
-GRANT ALL PRIVILEGES ON TABLE votes TO service;
-GRANT USAGE, SELECT ON SEQUENCE votes_id_seq TO service;
-GRANT CONNECT ON DATABASE ratings TO service;
+-- Grant privileges to the user currently running the script
+GRANT ALL PRIVILEGES ON TABLE users TO CURRENT_USER;
+GRANT USAGE, SELECT ON SEQUENCE users_id_seq TO CURRENT_USER;
+GRANT ALL PRIVILEGES ON TABLE votes TO CURRENT_USER;
+GRANT USAGE, SELECT ON SEQUENCE votes_id_seq TO CURRENT_USER;
+GRANT CONNECT ON DATABASE ratings TO CURRENT_USER;
diff --git a/src/main.rs b/src/main.rs
index ba84b6a..b0d6fd5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -13,6 +13,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     tracing::info!("Starting Ubuntu App Rating Service");
 
+    tracing::info!("Config I have: {:?}", config);
+    tracing::info!("I have been update again, yippie!");
+
     app::run(config).await?;
 
     Ok(())
diff --git a/vm_operator/CONTRIBUTING.md b/vm_operator/CONTRIBUTING.md
new file mode 100644
index 0000000..288f021
--- /dev/null
+++ b/vm_operator/CONTRIBUTING.md
@@ -0,0 +1,33 @@
+# Contributing
+
+To make contributions to this charm, you'll need a working [development setup](https://juju.is/docs/sdk/dev-setup).
+
+You can create an environment for development with `tox`:
+
+```shell
+tox devenv -e integration
+source venv/bin/activate
+```
+
+## Testing
+
+This project uses `tox` for managing test environments. There are some pre-configured environments
+that can be used for linting and formatting code when you're preparing contributions to the charm:
+
+```shell
+tox run -e format        # update your code according to linting rules
+tox run -e lint          # code style
+tox run -e unit          # unit tests
+tox run -e integration   # integration tests
+tox                      # runs 'format', 'lint', and 'unit' environments
+```
+
+## Build the charm
+
+Build the charm in this git repository using:
+
+```shell
+charmcraft pack
+```
+
+<!-- You may want to include any contribution/style guidelines in this document>
diff --git a/vm_operator/LICENSE b/vm_operator/LICENSE
new file mode 100644
index 0000000..eefc45f
--- /dev/null
+++ b/vm_operator/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2023 Canonical
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vm_operator/README.md b/vm_operator/README.md
new file mode 100644
index 0000000..bb74857
--- /dev/null
+++ b/vm_operator/README.md
@@ -0,0 +1,23 @@
+# Ubuntu Ratings Service Operator
+
+This is an operator that enables the Ubuntu Software Centre backend ratings service to run on
+Kubernetes with Juju, integrating with PostgreSQL for its database, and Traefik to provide ingress.
+
+## Getting Started
+
+First ensure that you have an appropriate [development setup](https://juju.is/docs/sdk/dev-setup) for Juju.
+
+```shell
+charmcraft pack
+
+juju add-model ratings
+
+image="$(yq '.resources."ratings-image"."upstream-source"' metadata.yaml)"
+
+juju deploy ./ubuntu-software-ratings_ubuntu-22.04-amd64.charm ratings \
+    --resource ratings-image="$image"
+
+juju deploy postgresql --channel 14/stable
+
+juju relate ratings postgresql
+```
diff --git a/vm_operator/actions.yaml b/vm_operator/actions.yaml
new file mode 100644
index 0000000..095ca1b
--- /dev/null
+++ b/vm_operator/actions.yaml
@@ -0,0 +1,2 @@
+pull-and-rebuild:
+  description: "Pull the latest code from GitHub and rebuild the application"
diff --git a/vm_operator/charmcraft.yaml b/vm_operator/charmcraft.yaml
new file mode 100644
index 0000000..d7d03e0
--- /dev/null
+++ b/vm_operator/charmcraft.yaml
@@ -0,0 +1,17 @@
+# This file configures Charmcraft.
+# See https://juju.is/docs/sdk/charmcraft-config for guidance.
+
+type: charm
+bases:
+  - build-on:
+    - name: ubuntu
+      channel: "22.04"
+    run-on:
+    - name: ubuntu
+      channel: "22.04"
+
+parts:
+  charm:
+    charm-binary-python-packages:
+      - psycopg[binary]
+      - PyYAML
diff --git a/vm_operator/config.yaml b/vm_operator/config.yaml
new file mode 100644
index 0000000..69a664c
--- /dev/null
+++ b/vm_operator/config.yaml
@@ -0,0 +1,29 @@
+options:
+  app-env:
+    type: string
+    default: "dev"
+    description: "Application environment."
+  app-host:
+    type: string
+    default: "0.0.0.0"
+  app-jwt-secret:
+    type: string
+    default: "deadbeef"
+  app-log-level:
+    type: string
+    default: "info"
+  app-name:
+    type: string
+    default: "ratings"
+  app-port:
+    type: int
+    default: 443
+  app-repo:
+    type: string
+    default: "https://github.com/matthew-hagemann/app-center-ratings"
+  app-postgres-uri:
+    type: string
+    default: "postgresql://service:covfefe!1@localhost:5433/ratings"
+  app-migration-postgres-uri:
+    type: string
+    default: "postgresql://migration_user:strongpassword@localhost:5433/ratings"
diff --git a/vm_operator/lib/charms/data_platform_libs/v0/data_interfaces.py b/vm_operator/lib/charms/data_platform_libs/v0/data_interfaces.py
new file mode 100644
index 0000000..74db75d
--- /dev/null
+++ b/vm_operator/lib/charms/data_platform_libs/v0/data_interfaces.py
@@ -0,0 +1,1484 @@
+# Copyright 2023 Canonical Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+r"""Library to manage the relation for the data-platform products.
+
+This library contains the Requires and Provides classes for handling the relation
+between an application and multiple managed application supported by the data-team:
+MySQL, Postgresql, MongoDB, Redis, and Kafka.
+
+### Database (MySQL, Postgresql, MongoDB, and Redis)
+
+#### Requires Charm
+This library is a uniform interface to a selection of common database
+metadata, with added custom events that add convenience to database management,
+and methods to consume the application related data.
+
+
+Following an example of using the DatabaseCreatedEvent, in the context of the
+application charm code:
+
+```python
+
+from charms.data_platform_libs.v0.data_interfaces import (
+    DatabaseCreatedEvent,
+    DatabaseRequires,
+)
+
+class ApplicationCharm(CharmBase):
+    # Application charm that connects to database charms.
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+        # Charm events defined in the database requires charm library.
+        self.database = DatabaseRequires(self, relation_name="database", database_name="database")
+        self.framework.observe(self.database.on.database_created, self._on_database_created)
+
+    def _on_database_created(self, event: DatabaseCreatedEvent) -> None:
+        # Handle the created database
+
+        # Create configuration file for app
+        config_file = self._render_app_config_file(
+            event.username,
+            event.password,
+            event.endpoints,
+        )
+
+        # Start application with rendered configuration
+        self._start_application(config_file)
+
+        # Set active status
+        self.unit.status = ActiveStatus("received database credentials")
+```
+
+As shown above, the library provides some custom events to handle specific situations,
+which are listed below:
+
+-  database_created: event emitted when the requested database is created.
+-  endpoints_changed: event emitted when the read/write endpoints of the database have changed.
+-  read_only_endpoints_changed: event emitted when the read-only endpoints of the database
+  have changed. Event is not triggered if read/write endpoints changed too.
+
+If it is needed to connect multiple database clusters to the same relation endpoint
+the application charm can implement the same code as if it would connect to only
+one database cluster (like the above code example).
+
+To differentiate multiple clusters connected to the same relation endpoint
+the application charm can use the name of the remote application:
+
+```python
+
+def _on_database_created(self, event: DatabaseCreatedEvent) -> None:
+    # Get the remote app name of the cluster that triggered this event
+    cluster = event.relation.app.name
+```
+
+It is also possible to provide an alias for each different database cluster/relation.
+
+So, it is possible to differentiate the clusters in two ways.
+The first is to use the remote application name, i.e., `event.relation.app.name`, as above.
+
+The second way is to use different event handlers to handle each cluster events.
+The implementation would be something like the following code:
+
+```python
+
+from charms.data_platform_libs.v0.data_interfaces import (
+    DatabaseCreatedEvent,
+    DatabaseRequires,
+)
+
+class ApplicationCharm(CharmBase):
+    # Application charm that connects to database charms.
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+        # Define the cluster aliases and one handler for each cluster database created event.
+        self.database = DatabaseRequires(
+            self,
+            relation_name="database",
+            database_name="database",
+            relations_aliases = ["cluster1", "cluster2"],
+        )
+        self.framework.observe(
+            self.database.on.cluster1_database_created, self._on_cluster1_database_created
+        )
+        self.framework.observe(
+            self.database.on.cluster2_database_created, self._on_cluster2_database_created
+        )
+
+    def _on_cluster1_database_created(self, event: DatabaseCreatedEvent) -> None:
+        # Handle the created database on the cluster named cluster1
+
+        # Create configuration file for app
+        config_file = self._render_app_config_file(
+            event.username,
+            event.password,
+            event.endpoints,
+        )
+        ...
+
+    def _on_cluster2_database_created(self, event: DatabaseCreatedEvent) -> None:
+        # Handle the created database on the cluster named cluster2
+
+        # Create configuration file for app
+        config_file = self._render_app_config_file(
+            event.username,
+            event.password,
+            event.endpoints,
+        )
+        ...
+
+```
+
+When it's needed to check whether a plugin (extension) is enabled on the PostgreSQL
+charm, you can use the is_postgresql_plugin_enabled method. To use that, you need to
+add the following dependency to your charmcraft.yaml file:
+
+```yaml
+
+parts:
+  charm:
+    charm-binary-python-packages:
+      - psycopg[binary]
+
+```
+
+### Provider Charm
+
+Following an example of using the DatabaseRequestedEvent, in the context of the
+database charm code:
+
+```python
+from charms.data_platform_libs.v0.data_interfaces import DatabaseProvides
+
+class SampleCharm(CharmBase):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+        # Charm events defined in the database provides charm library.
+        self.provided_database = DatabaseProvides(self, relation_name="database")
+        self.framework.observe(self.provided_database.on.database_requested,
+            self._on_database_requested)
+        # Database generic helper
+        self.database = DatabaseHelper()
+
+    def _on_database_requested(self, event: DatabaseRequestedEvent) -> None:
+        # Handle the event triggered by a new database requested in the relation
+        # Retrieve the database name using the charm library.
+        db_name = event.database
+        # generate a new user credential
+        username = self.database.generate_user()
+        password = self.database.generate_password()
+        # set the credentials for the relation
+        self.provided_database.set_credentials(event.relation.id, username, password)
+        # set other variables for the relation event.set_tls("False")
+```
+As shown above, the library provides a custom event (database_requested) to handle
+the situation when an application charm requests a new database to be created.
+It's preferred to subscribe to this event instead of relation changed event to avoid
+creating a new database when other information other than a database name is
+exchanged in the relation databag.
+
+### Kafka
+
+This library is the interface to use and interact with the Kafka charm. This library contains
+custom events that add convenience to manage Kafka, and provides methods to consume the
+application related data.
+
+#### Requirer Charm
+
+```python
+
+from charms.data_platform_libs.v0.data_interfaces import (
+    BootstrapServerChangedEvent,
+    KafkaRequires,
+    TopicCreatedEvent,
+)
+
+class ApplicationCharm(CharmBase):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+        self.kafka = KafkaRequires(self, "kafka_client", "test-topic")
+        self.framework.observe(
+            self.kafka.on.bootstrap_server_changed, self._on_kafka_bootstrap_server_changed
+        )
+        self.framework.observe(
+            self.kafka.on.topic_created, self._on_kafka_topic_created
+        )
+
+    def _on_kafka_bootstrap_server_changed(self, event: BootstrapServerChangedEvent):
+        # Event triggered when a bootstrap server was changed for this application
+
+        new_bootstrap_server = event.bootstrap_server
+        ...
+
+    def _on_kafka_topic_created(self, event: TopicCreatedEvent):
+        # Event triggered when a topic was created for this application
+        username = event.username
+        password = event.password
+        tls = event.tls
+        tls_ca= event.tls_ca
+        bootstrap_server event.bootstrap_server
+        consumer_group_prefic = event.consumer_group_prefix
+        zookeeper_uris = event.zookeeper_uris
+        ...
+
+```
+
+As shown above, the library provides some custom events to handle specific situations,
+which are listed below:
+
+- topic_created: event emitted when the requested topic is created.
+- bootstrap_server_changed: event emitted when the bootstrap server have changed.
+- credential_changed: event emitted when the credentials of Kafka changed.
+
+### Provider Charm
+
+Following the previous example, this is an example of the provider charm.
+
+```python
+class SampleCharm(CharmBase):
+
+from charms.data_platform_libs.v0.data_interfaces import (
+    KafkaProvides,
+    TopicRequestedEvent,
+)
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+        # Default charm events.
+        self.framework.observe(self.on.start, self._on_start)
+
+        # Charm events defined in the Kafka Provides charm library.
+        self.kafka_provider = KafkaProvides(self, relation_name="kafka_client")
+        self.framework.observe(self.kafka_provider.on.topic_requested, self._on_topic_requested)
+        # Kafka generic helper
+        self.kafka = KafkaHelper()
+
+    def _on_topic_requested(self, event: TopicRequestedEvent):
+        # Handle the on_topic_requested event.
+
+        topic = event.topic
+        relation_id = event.relation.id
+        # set connection info in the databag relation
+        self.kafka_provider.set_bootstrap_server(relation_id, self.kafka.get_bootstrap_server())
+        self.kafka_provider.set_credentials(relation_id, username=username, password=password)
+        self.kafka_provider.set_consumer_group_prefix(relation_id, ...)
+        self.kafka_provider.set_tls(relation_id, "False")
+        self.kafka_provider.set_zookeeper_uris(relation_id, ...)
+
+```
+As shown above, the library provides a custom event (topic_requested) to handle
+the situation when an application charm requests a new topic to be created.
+It is preferred to subscribe to this event instead of relation changed event to avoid
+creating a new topic when other information other than a topic name is
+exchanged in the relation databag.
+"""
+
+import json
+import logging
+from abc import ABC, abstractmethod
+from collections import namedtuple
+from datetime import datetime
+from typing import List, Optional, Union
+
+from ops.charm import (
+    CharmBase,
+    CharmEvents,
+    RelationChangedEvent,
+    RelationCreatedEvent,
+    RelationEvent,
+)
+from ops.framework import EventSource, Object
+from ops.model import Application, ModelError, Relation, Unit
+
+# The unique Charmhub library identifier, never change it
+LIBID = "6c3e6b6680d64e9c89e611d1a15f65be"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 0
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 16
+
+PYDEPS = ["ops>=2.0.0"]
+
+logger = logging.getLogger(__name__)
+
+Diff = namedtuple("Diff", "added changed deleted")
+Diff.__doc__ = """
+A tuple for storing the diff between two data mappings.
+
+added - keys that were added
+changed - keys that still exist but have new values
+deleted - key that were deleted"""
+
+
+def diff(event: RelationChangedEvent, bucket: Union[Unit, Application]) -> Diff:
+    """Retrieves the diff of the data in the relation changed databag.
+
+    Args:
+        event: relation changed event.
+        bucket: bucket of the databag (app or unit)
+
+    Returns:
+        a Diff instance containing the added, deleted and changed
+            keys from the event relation databag.
+    """
+    # Retrieve the old data from the data key in the application relation databag.
+    old_data = json.loads(event.relation.data[bucket].get("data", "{}"))
+    # Retrieve the new data from the event relation databag.
+    new_data = (
+        {key: value for key, value in event.relation.data[event.app].items() if key != "data"}
+        if event.app
+        else {}
+    )
+
+    # These are the keys that were added to the databag and triggered this event.
+    added = new_data.keys() - old_data.keys()
+    # These are the keys that were removed from the databag and triggered this event.
+    deleted = old_data.keys() - new_data.keys()
+    # These are the keys that already existed in the databag,
+    # but had their values changed.
+    changed = {key for key in old_data.keys() & new_data.keys() if old_data[key] != new_data[key]}
+    # Convert the new_data to a serializable format and save it for a next diff check.
+    event.relation.data[bucket].update({"data": json.dumps(new_data)})
+
+    # Return the diff with all possible changes.
+    return Diff(added, changed, deleted)
+
+
+# Base DataProvides and DataRequires
+
+
+class DataProvides(Object, ABC):
+    """Base provides-side of the data products relation."""
+
+    def __init__(self, charm: CharmBase, relation_name: str) -> None:
+        super().__init__(charm, relation_name)
+        self.charm = charm
+        self.local_app = self.charm.model.app
+        self.local_unit = self.charm.unit
+        self.relation_name = relation_name
+        self.framework.observe(
+            charm.on[relation_name].relation_changed,
+            self._on_relation_changed,
+        )
+
+    def _diff(self, event: RelationChangedEvent) -> Diff:
+        """Retrieves the diff of the data in the relation changed databag.
+
+        Args:
+            event: relation changed event.
+
+        Returns:
+            a Diff instance containing the added, deleted and changed
+                keys from the event relation databag.
+        """
+        return diff(event, self.local_app)
+
+    @abstractmethod
+    def _on_relation_changed(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the relation data has changed."""
+        raise NotImplementedError
+
+    def fetch_relation_data(self) -> dict:
+        """Retrieves data from relation.
+
+        This function can be used to retrieve data from a relation
+        in the charm code when outside an event callback.
+
+        Returns:
+            a dict of the values stored in the relation data bag
+                for all relation instances (indexed by the relation id).
+        """
+        data = {}
+        for relation in self.relations:
+            data[relation.id] = (
+                {key: value for key, value in relation.data[relation.app].items() if key != "data"}
+                if relation.app
+                else {}
+            )
+        return data
+
+    def _update_relation_data(self, relation_id: int, data: dict) -> None:
+        """Updates a set of key-value pairs in the relation.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            data: dict containing the key-value pairs
+                that should be updated in the relation.
+        """
+        if self.local_unit.is_leader():
+            if relation := self.charm.model.get_relation(self.relation_name, relation_id):
+                relation.data[self.local_app].update(data)
+
+    @property
+    def relations(self) -> List[Relation]:
+        """The list of Relation instances associated with this relation_name."""
+        return list(self.charm.model.relations[self.relation_name])
+
+    def set_credentials(self, relation_id: int, username: str, password: str) -> None:
+        """Set credentials.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            username: user that was created.
+            password: password of the created user.
+        """
+        self._update_relation_data(
+            relation_id,
+            {
+                "username": username,
+                "password": password,
+            },
+        )
+
+    def set_tls(self, relation_id: int, tls: str) -> None:
+        """Set whether TLS is enabled.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            tls: whether tls is enabled (True or False).
+        """
+        self._update_relation_data(relation_id, {"tls": tls})
+
+    def set_tls_ca(self, relation_id: int, tls_ca: str) -> None:
+        """Set the TLS CA in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            tls_ca: TLS certification authority.
+        """
+        self._update_relation_data(relation_id, {"tls-ca": tls_ca})
+
+
+class DataRequires(Object, ABC):
+    """Requires-side of the relation."""
+
+    def __init__(
+        self,
+        charm,
+        relation_name: str,
+        extra_user_roles: Optional[str] = None,
+    ):
+        """Manager of base client relations."""
+        super().__init__(charm, relation_name)
+        self.charm = charm
+        self.extra_user_roles = extra_user_roles
+        self.local_app = self.charm.model.app
+        self.local_unit = self.charm.unit
+        self.relation_name = relation_name
+        self.framework.observe(
+            self.charm.on[relation_name].relation_created, self._on_relation_created_event
+        )
+        self.framework.observe(
+            self.charm.on[relation_name].relation_changed, self._on_relation_changed_event
+        )
+
+    @abstractmethod
+    def _on_relation_created_event(self, event: RelationCreatedEvent) -> None:
+        """Event emitted when the relation is created."""
+        raise NotImplementedError
+
+    @abstractmethod
+    def _on_relation_changed_event(self, event: RelationChangedEvent) -> None:
+        raise NotImplementedError
+
+    def fetch_relation_data(self) -> dict:
+        """Retrieves data from relation.
+
+        This function can be used to retrieve data from a relation
+        in the charm code when outside an event callback.
+        Function cannot be used in `*-relation-broken` events and will raise an exception.
+
+        Returns:
+            a dict of the values stored in the relation data bag
+                for all relation instances (indexed by the relation ID).
+        """
+        data = {}
+        for relation in self.relations:
+            data[relation.id] = (
+                {key: value for key, value in relation.data[relation.app].items() if key != "data"}
+                if relation.app
+                else {}
+            )
+        return data
+
+    def _update_relation_data(self, relation_id: int, data: dict) -> None:
+        """Updates a set of key-value pairs in the relation.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            data: dict containing the key-value pairs
+                that should be updated in the relation.
+        """
+        if self.local_unit.is_leader():
+            relation = self.charm.model.get_relation(self.relation_name, relation_id)
+            relation.data[self.local_app].update(data)
+
+    def _diff(self, event: RelationChangedEvent) -> Diff:
+        """Retrieves the diff of the data in the relation changed databag.
+
+        Args:
+            event: relation changed event.
+
+        Returns:
+            a Diff instance containing the added, deleted and changed
+                keys from the event relation databag.
+        """
+        return diff(event, self.local_unit)
+
+    @property
+    def relations(self) -> List[Relation]:
+        """The list of Relation instances associated with this relation_name."""
+        return [
+            relation
+            for relation in self.charm.model.relations[self.relation_name]
+            if self._is_relation_active(relation)
+        ]
+
+    @staticmethod
+    def _is_relation_active(relation: Relation):
+        try:
+            _ = repr(relation.data)
+            return True
+        except (RuntimeError, ModelError):
+            return False
+
+    @staticmethod
+    def _is_resource_created_for_relation(relation: Relation) -> bool:
+        if not relation.app:
+            return False
+
+        return (
+            "username" in relation.data[relation.app] and "password" in relation.data[relation.app]
+        )
+
+    def is_resource_created(self, relation_id: Optional[int] = None) -> bool:
+        """Check if the resource has been created.
+
+        This function can be used to check if the Provider answered with data in the charm code
+        when outside an event callback.
+
+        Args:
+            relation_id (int, optional): When provided the check is done only for the relation id
+                provided, otherwise the check is done for all relations
+
+        Returns:
+            True or False
+
+        Raises:
+            IndexError: If relation_id is provided but that relation does not exist
+        """
+        if relation_id is not None:
+            try:
+                relation = [relation for relation in self.relations if relation.id == relation_id][
+                    0
+                ]
+                return self._is_resource_created_for_relation(relation)
+            except IndexError:
+                raise IndexError(f"relation id {relation_id} cannot be accessed")
+        else:
+            return (
+                all(
+                    self._is_resource_created_for_relation(relation) for relation in self.relations
+                )
+                if self.relations
+                else False
+            )
+
+
+# General events
+
+
+class ExtraRoleEvent(RelationEvent):
+    """Base class for data events."""
+
+    @property
+    def extra_user_roles(self) -> Optional[str]:
+        """Returns the extra user roles that were requested."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("extra-user-roles")
+
+
+class AuthenticationEvent(RelationEvent):
+    """Base class for authentication fields for events."""
+
+    @property
+    def username(self) -> Optional[str]:
+        """Returns the created username."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("username")
+
+    @property
+    def password(self) -> Optional[str]:
+        """Returns the password for the created user."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("password")
+
+    @property
+    def tls(self) -> Optional[str]:
+        """Returns whether TLS is configured."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("tls")
+
+    @property
+    def tls_ca(self) -> Optional[str]:
+        """Returns TLS CA."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("tls-ca")
+
+
+# Database related events and fields
+
+
+class DatabaseProvidesEvent(RelationEvent):
+    """Base class for database events."""
+
+    @property
+    def database(self) -> Optional[str]:
+        """Returns the database that was requested."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("database")
+
+
+class DatabaseRequestedEvent(DatabaseProvidesEvent, ExtraRoleEvent):
+    """Event emitted when a new database is requested for use on this relation."""
+
+
+class DatabaseProvidesEvents(CharmEvents):
+    """Database events.
+
+    This class defines the events that the database can emit.
+    """
+
+    database_requested = EventSource(DatabaseRequestedEvent)
+
+
+class DatabaseRequiresEvent(RelationEvent):
+    """Base class for database events."""
+
+    @property
+    def database(self) -> Optional[str]:
+        """Returns the database name."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("database")
+
+    @property
+    def endpoints(self) -> Optional[str]:
+        """Returns a comma separated list of read/write endpoints.
+
+        In VM charms, this is the primary's address.
+        In kubernetes charms, this is the service to the primary pod.
+        """
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("endpoints")
+
+    @property
+    def read_only_endpoints(self) -> Optional[str]:
+        """Returns a comma separated list of read only endpoints.
+
+        In VM charms, this is the address of all the secondary instances.
+        In kubernetes charms, this is the service to all replica pod instances.
+        """
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("read-only-endpoints")
+
+    @property
+    def replset(self) -> Optional[str]:
+        """Returns the replicaset name.
+
+        MongoDB only.
+        """
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("replset")
+
+    @property
+    def uris(self) -> Optional[str]:
+        """Returns the connection URIs.
+
+        MongoDB, Redis, OpenSearch.
+        """
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("uris")
+
+    @property
+    def version(self) -> Optional[str]:
+        """Returns the version of the database.
+
+        Version as informed by the database daemon.
+        """
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("version")
+
+
+class DatabaseCreatedEvent(AuthenticationEvent, DatabaseRequiresEvent):
+    """Event emitted when a new database is created for use on this relation."""
+
+
+class DatabaseEndpointsChangedEvent(AuthenticationEvent, DatabaseRequiresEvent):
+    """Event emitted when the read/write endpoints are changed."""
+
+
+class DatabaseReadOnlyEndpointsChangedEvent(AuthenticationEvent, DatabaseRequiresEvent):
+    """Event emitted when the read only endpoints are changed."""
+
+
+class DatabaseRequiresEvents(CharmEvents):
+    """Database events.
+
+    This class defines the events that the database can emit.
+    """
+
+    database_created = EventSource(DatabaseCreatedEvent)
+    endpoints_changed = EventSource(DatabaseEndpointsChangedEvent)
+    read_only_endpoints_changed = EventSource(DatabaseReadOnlyEndpointsChangedEvent)
+
+
+# Database Provider and Requires
+
+
+class DatabaseProvides(DataProvides):
+    """Provider-side of the database relations."""
+
+    on = DatabaseProvidesEvents()  # pyright: ignore [reportGeneralTypeIssues]
+
+    def __init__(self, charm: CharmBase, relation_name: str) -> None:
+        super().__init__(charm, relation_name)
+
+    def _on_relation_changed(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the relation has changed."""
+        # Only the leader should handle this event.
+        if not self.local_unit.is_leader():
+            return
+
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Emit a database requested event if the setup key (database name and optional
+        # extra user roles) was added to the relation databag by the application.
+        if "database" in diff.added:
+            getattr(self.on, "database_requested").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+    def set_database(self, relation_id: int, database_name: str) -> None:
+        """Set database name.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            database_name: database name.
+        """
+        self._update_relation_data(relation_id, {"database": database_name})
+
+    def set_endpoints(self, relation_id: int, connection_strings: str) -> None:
+        """Set database primary connections.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        In VM charms, only the primary's address should be passed as an endpoint.
+        In kubernetes charms, the service endpoint to the primary pod should be
+        passed as an endpoint.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            connection_strings: database hosts and ports comma separated list.
+        """
+        self._update_relation_data(relation_id, {"endpoints": connection_strings})
+
+    def set_read_only_endpoints(self, relation_id: int, connection_strings: str) -> None:
+        """Set database replicas connection strings.
+
+        This function writes in the application data bag, therefore,
+        only the leader unit can call it.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            connection_strings: database hosts and ports comma separated list.
+        """
+        self._update_relation_data(relation_id, {"read-only-endpoints": connection_strings})
+
+    def set_replset(self, relation_id: int, replset: str) -> None:
+        """Set replica set name in the application relation databag.
+
+        MongoDB only.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            replset: replica set name.
+        """
+        self._update_relation_data(relation_id, {"replset": replset})
+
+    def set_uris(self, relation_id: int, uris: str) -> None:
+        """Set the database connection URIs in the application relation databag.
+
+        MongoDB, Redis, and OpenSearch only.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            uris: connection URIs.
+        """
+        self._update_relation_data(relation_id, {"uris": uris})
+
+    def set_version(self, relation_id: int, version: str) -> None:
+        """Set the database version in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            version: database version.
+        """
+        self._update_relation_data(relation_id, {"version": version})
+
+
+class DatabaseRequires(DataRequires):
+    """Requires-side of the database relation."""
+
+    on = DatabaseRequiresEvents()  # pyright: ignore [reportGeneralTypeIssues]
+
+    def __init__(
+        self,
+        charm,
+        relation_name: str,
+        database_name: str,
+        extra_user_roles: Optional[str] = None,
+        relations_aliases: Optional[List[str]] = None,
+    ):
+        """Manager of database client relations."""
+        super().__init__(charm, relation_name, extra_user_roles)
+        self.database = database_name
+        self.relations_aliases = relations_aliases
+
+        # Define custom event names for each alias.
+        if relations_aliases:
+            # Ensure the number of aliases does not exceed the maximum
+            # of connections allowed in the specific relation.
+            relation_connection_limit = self.charm.meta.requires[relation_name].limit
+            if len(relations_aliases) != relation_connection_limit:
+                raise ValueError(
+                    f"The number of aliases must match the maximum number of connections allowed in the relation. "
+                    f"Expected {relation_connection_limit}, got {len(relations_aliases)}"
+                )
+
+            for relation_alias in relations_aliases:
+                self.on.define_event(f"{relation_alias}_database_created", DatabaseCreatedEvent)
+                self.on.define_event(
+                    f"{relation_alias}_endpoints_changed", DatabaseEndpointsChangedEvent
+                )
+                self.on.define_event(
+                    f"{relation_alias}_read_only_endpoints_changed",
+                    DatabaseReadOnlyEndpointsChangedEvent,
+                )
+
+    def _assign_relation_alias(self, relation_id: int) -> None:
+        """Assigns an alias to a relation.
+
+        This function writes in the unit data bag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+        """
+        # If no aliases were provided, return immediately.
+        if not self.relations_aliases:
+            return
+
+        # Return if an alias was already assigned to this relation
+        # (like when there are more than one unit joining the relation).
+        if (
+            self.charm.model.get_relation(self.relation_name, relation_id)
+            .data[self.local_unit]
+            .get("alias")
+        ):
+            return
+
+        # Retrieve the available aliases (the ones that weren't assigned to any relation).
+        available_aliases = self.relations_aliases[:]
+        for relation in self.charm.model.relations[self.relation_name]:
+            alias = relation.data[self.local_unit].get("alias")
+            if alias:
+                logger.debug("Alias %s was already assigned to relation %d", alias, relation.id)
+                available_aliases.remove(alias)
+
+        # Set the alias in the unit relation databag of the specific relation.
+        relation = self.charm.model.get_relation(self.relation_name, relation_id)
+        relation.data[self.local_unit].update({"alias": available_aliases[0]})
+
+    def _emit_aliased_event(self, event: RelationChangedEvent, event_name: str) -> None:
+        """Emit an aliased event to a particular relation if it has an alias.
+
+        Args:
+            event: the relation changed event that was received.
+            event_name: the name of the event to emit.
+        """
+        alias = self._get_relation_alias(event.relation.id)
+        if alias:
+            getattr(self.on, f"{alias}_{event_name}").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+    def _get_relation_alias(self, relation_id: int) -> Optional[str]:
+        """Returns the relation alias.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+
+        Returns:
+            the relation alias or None if the relation was not found.
+        """
+        for relation in self.charm.model.relations[self.relation_name]:
+            if relation.id == relation_id:
+                return relation.data[self.local_unit].get("alias")
+        return None
+
+    def is_postgresql_plugin_enabled(self, plugin: str, relation_index: int = 0) -> bool:
+        """Returns whether a plugin is enabled in the database.
+
+        Args:
+            plugin: name of the plugin to check.
+            relation_index: optional relation index to check the database
+                (default: 0 - first relation).
+
+        PostgreSQL only.
+        """
+        # Psycopg 3 is imported locally to avoid the need of its package installation
+        # when relating to a database charm other than PostgreSQL.
+        import psycopg
+
+        # Return False if no relation is established.
+        if len(self.relations) == 0:
+            return False
+
+        relation_data = self.fetch_relation_data()[self.relations[relation_index].id]
+        host = relation_data.get("endpoints")
+
+        # Return False if there is no endpoint available.
+        if host is None:
+            return False
+
+        host = host.split(":")[0]
+        user = relation_data.get("username")
+        password = relation_data.get("password")
+        connection_string = (
+            f"host='{host}' dbname='{self.database}' user='{user}' password='{password}'"
+        )
+        try:
+            with psycopg.connect(connection_string) as connection:
+                with connection.cursor() as cursor:
+                    cursor.execute(
+                        "SELECT TRUE FROM pg_extension WHERE extname=%s::text;", (plugin,)
+                    )
+                    return cursor.fetchone() is not None
+        except psycopg.Error as e:
+            logger.exception(
+                f"failed to check whether {plugin} plugin is enabled in the database: %s", str(e)
+            )
+            return False
+
+    def _on_relation_created_event(self, event: RelationCreatedEvent) -> None:
+        """Event emitted when the database relation is created."""
+        # If relations aliases were provided, assign one to the relation.
+        self._assign_relation_alias(event.relation.id)
+
+        # Sets both database and extra user roles in the relation
+        # if the roles are provided. Otherwise, sets only the database.
+        if self.extra_user_roles:
+            self._update_relation_data(
+                event.relation.id,
+                {
+                    "database": self.database,
+                    "extra-user-roles": self.extra_user_roles,
+                },
+            )
+        else:
+            self._update_relation_data(event.relation.id, {"database": self.database})
+
+    def _on_relation_changed_event(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the database relation has changed."""
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Check if the database is created
+        # (the database charm shared the credentials).
+        if "username" in diff.added and "password" in diff.added:
+            # Emit the default event (the one without an alias).
+            logger.info("database created at %s", datetime.now())
+            getattr(self.on, "database_created").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+            # Emit the aliased event (if any).
+            self._emit_aliased_event(event, "database_created")
+
+            # To avoid unnecessary application restarts do not trigger
+            # “endpoints_changed“ event if “database_created“ is triggered.
+            return
+
+        # Emit an endpoints changed event if the database
+        # added or changed this info in the relation databag.
+        if "endpoints" in diff.added or "endpoints" in diff.changed:
+            # Emit the default event (the one without an alias).
+            logger.info("endpoints changed on %s", datetime.now())
+            getattr(self.on, "endpoints_changed").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+            # Emit the aliased event (if any).
+            self._emit_aliased_event(event, "endpoints_changed")
+
+            # To avoid unnecessary application restarts do not trigger
+            # “read_only_endpoints_changed“ event if “endpoints_changed“ is triggered.
+            return
+
+        # Emit a read only endpoints changed event if the database
+        # added or changed this info in the relation databag.
+        if "read-only-endpoints" in diff.added or "read-only-endpoints" in diff.changed:
+            # Emit the default event (the one without an alias).
+            logger.info("read-only-endpoints changed on %s", datetime.now())
+            getattr(self.on, "read_only_endpoints_changed").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+            # Emit the aliased event (if any).
+            self._emit_aliased_event(event, "read_only_endpoints_changed")
+
+
+# Kafka related events
+
+
+class KafkaProvidesEvent(RelationEvent):
+    """Base class for Kafka events."""
+
+    @property
+    def topic(self) -> Optional[str]:
+        """Returns the topic that was requested."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("topic")
+
+    @property
+    def consumer_group_prefix(self) -> Optional[str]:
+        """Returns the consumer-group-prefix that was requested."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("consumer-group-prefix")
+
+
+class TopicRequestedEvent(KafkaProvidesEvent, ExtraRoleEvent):
+    """Event emitted when a new topic is requested for use on this relation."""
+
+
+class KafkaProvidesEvents(CharmEvents):
+    """Kafka events.
+
+    This class defines the events that the Kafka can emit.
+    """
+
+    topic_requested = EventSource(TopicRequestedEvent)
+
+
+class KafkaRequiresEvent(RelationEvent):
+    """Base class for Kafka events."""
+
+    @property
+    def topic(self) -> Optional[str]:
+        """Returns the topic."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("topic")
+
+    @property
+    def bootstrap_server(self) -> Optional[str]:
+        """Returns a comma-separated list of broker uris."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("endpoints")
+
+    @property
+    def consumer_group_prefix(self) -> Optional[str]:
+        """Returns the consumer-group-prefix."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("consumer-group-prefix")
+
+    @property
+    def zookeeper_uris(self) -> Optional[str]:
+        """Returns a comma separated list of Zookeeper uris."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("zookeeper-uris")
+
+
+class TopicCreatedEvent(AuthenticationEvent, KafkaRequiresEvent):
+    """Event emitted when a new topic is created for use on this relation."""
+
+
+class BootstrapServerChangedEvent(AuthenticationEvent, KafkaRequiresEvent):
+    """Event emitted when the bootstrap server is changed."""
+
+
+class KafkaRequiresEvents(CharmEvents):
+    """Kafka events.
+
+    This class defines the events that the Kafka can emit.
+    """
+
+    topic_created = EventSource(TopicCreatedEvent)
+    bootstrap_server_changed = EventSource(BootstrapServerChangedEvent)
+
+
+# Kafka Provides and Requires
+
+
+class KafkaProvides(DataProvides):
+    """Provider-side of the Kafka relation."""
+
+    on = KafkaProvidesEvents()  # pyright: ignore [reportGeneralTypeIssues]
+
+    def __init__(self, charm: CharmBase, relation_name: str) -> None:
+        super().__init__(charm, relation_name)
+
+    def _on_relation_changed(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the relation has changed."""
+        # Only the leader should handle this event.
+        if not self.local_unit.is_leader():
+            return
+
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Emit a topic requested event if the setup key (topic name and optional
+        # extra user roles) was added to the relation databag by the application.
+        if "topic" in diff.added:
+            getattr(self.on, "topic_requested").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+    def set_topic(self, relation_id: int, topic: str) -> None:
+        """Set topic name in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            topic: the topic name.
+        """
+        self._update_relation_data(relation_id, {"topic": topic})
+
+    def set_bootstrap_server(self, relation_id: int, bootstrap_server: str) -> None:
+        """Set the bootstrap server in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            bootstrap_server: the bootstrap server address.
+        """
+        self._update_relation_data(relation_id, {"endpoints": bootstrap_server})
+
+    def set_consumer_group_prefix(self, relation_id: int, consumer_group_prefix: str) -> None:
+        """Set the consumer group prefix in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            consumer_group_prefix: the consumer group prefix string.
+        """
+        self._update_relation_data(relation_id, {"consumer-group-prefix": consumer_group_prefix})
+
+    def set_zookeeper_uris(self, relation_id: int, zookeeper_uris: str) -> None:
+        """Set the zookeeper uris in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            zookeeper_uris: comma-separated list of ZooKeeper server uris.
+        """
+        self._update_relation_data(relation_id, {"zookeeper-uris": zookeeper_uris})
+
+
+class KafkaRequires(DataRequires):
+    """Requires-side of the Kafka relation."""
+
+    on = KafkaRequiresEvents()  # pyright: ignore [reportGeneralTypeIssues]
+
+    def __init__(
+        self,
+        charm,
+        relation_name: str,
+        topic: str,
+        extra_user_roles: Optional[str] = None,
+        consumer_group_prefix: Optional[str] = None,
+    ):
+        """Manager of Kafka client relations."""
+        # super().__init__(charm, relation_name)
+        super().__init__(charm, relation_name, extra_user_roles)
+        self.charm = charm
+        self.topic = topic
+        self.consumer_group_prefix = consumer_group_prefix or ""
+
+    @property
+    def topic(self):
+        """Topic to use in Kafka."""
+        return self._topic
+
+    @topic.setter
+    def topic(self, value):
+        # Avoid wildcards
+        if value == "*":
+            raise ValueError(f"Error on topic '{value}', cannot be a wildcard.")
+        self._topic = value
+
+    def _on_relation_created_event(self, event: RelationCreatedEvent) -> None:
+        """Event emitted when the Kafka relation is created."""
+        # Sets topic, extra user roles, and "consumer-group-prefix" in the relation
+        relation_data = {
+            f: getattr(self, f.replace("-", "_"), "")
+            for f in ["consumer-group-prefix", "extra-user-roles", "topic"]
+        }
+
+        self._update_relation_data(event.relation.id, relation_data)
+
+    def _on_relation_changed_event(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the Kafka relation has changed."""
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Check if the topic is created
+        # (the Kafka charm shared the credentials).
+        if "username" in diff.added and "password" in diff.added:
+            # Emit the default event (the one without an alias).
+            logger.info("topic created at %s", datetime.now())
+            getattr(self.on, "topic_created").emit(event.relation, app=event.app, unit=event.unit)
+
+            # To avoid unnecessary application restarts do not trigger
+            # “endpoints_changed“ event if “topic_created“ is triggered.
+            return
+
+        # Emit an endpoints (bootstrap-server) changed event if the Kafka endpoints
+        # added or changed this info in the relation databag.
+        if "endpoints" in diff.added or "endpoints" in diff.changed:
+            # Emit the default event (the one without an alias).
+            logger.info("endpoints changed on %s", datetime.now())
+            getattr(self.on, "bootstrap_server_changed").emit(
+                event.relation, app=event.app, unit=event.unit
+            )  # here check if this is the right design
+            return
+
+
+# Opensearch related events
+
+
+class OpenSearchProvidesEvent(RelationEvent):
+    """Base class for OpenSearch events."""
+
+    @property
+    def index(self) -> Optional[str]:
+        """Returns the index that was requested."""
+        if not self.relation.app:
+            return None
+
+        return self.relation.data[self.relation.app].get("index")
+
+
+class IndexRequestedEvent(OpenSearchProvidesEvent, ExtraRoleEvent):
+    """Event emitted when a new index is requested for use on this relation."""
+
+
+class OpenSearchProvidesEvents(CharmEvents):
+    """OpenSearch events.
+
+    This class defines the events that OpenSearch can emit.
+    """
+
+    index_requested = EventSource(IndexRequestedEvent)
+
+
+class OpenSearchRequiresEvent(DatabaseRequiresEvent):
+    """Base class for OpenSearch requirer events."""
+
+
+class IndexCreatedEvent(AuthenticationEvent, OpenSearchRequiresEvent):
+    """Event emitted when a new index is created for use on this relation."""
+
+
+class OpenSearchRequiresEvents(CharmEvents):
+    """OpenSearch events.
+
+    This class defines the events that the opensearch requirer can emit.
+    """
+
+    index_created = EventSource(IndexCreatedEvent)
+    endpoints_changed = EventSource(DatabaseEndpointsChangedEvent)
+    authentication_updated = EventSource(AuthenticationEvent)
+
+
+# OpenSearch Provides and Requires Objects
+
+
+class OpenSearchProvides(DataProvides):
+    """Provider-side of the OpenSearch relation."""
+
+    on = OpenSearchProvidesEvents()  # pyright: ignore[reportGeneralTypeIssues]
+
+    def __init__(self, charm: CharmBase, relation_name: str) -> None:
+        super().__init__(charm, relation_name)
+
+    def _on_relation_changed(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the relation has changed."""
+        # Only the leader should handle this event.
+        if not self.local_unit.is_leader():
+            return
+
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Emit an index requested event if the setup key (index name and optional extra user roles)
+        # have been added to the relation databag by the application.
+        if "index" in diff.added:
+            getattr(self.on, "index_requested").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+    def set_index(self, relation_id: int, index: str) -> None:
+        """Set the index in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            index: the index as it is _created_ on the provider charm. This needn't match the
+                requested index, and can be used to present a different index name if, for example,
+                the requested index is invalid.
+        """
+        self._update_relation_data(relation_id, {"index": index})
+
+    def set_endpoints(self, relation_id: int, endpoints: str) -> None:
+        """Set the endpoints in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            endpoints: the endpoint addresses for opensearch nodes.
+        """
+        self._update_relation_data(relation_id, {"endpoints": endpoints})
+
+    def set_version(self, relation_id: int, version: str) -> None:
+        """Set the opensearch version in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+            version: database version.
+        """
+        self._update_relation_data(relation_id, {"version": version})
+
+
+class OpenSearchRequires(DataRequires):
+    """Requires-side of the OpenSearch relation."""
+
+    on = OpenSearchRequiresEvents()  # pyright: ignore[reportGeneralTypeIssues]
+
+    def __init__(
+        self, charm, relation_name: str, index: str, extra_user_roles: Optional[str] = None
+    ):
+        """Manager of OpenSearch client relations."""
+        super().__init__(charm, relation_name, extra_user_roles)
+        self.charm = charm
+        self.index = index
+
+    def _on_relation_created_event(self, event: RelationCreatedEvent) -> None:
+        """Event emitted when the OpenSearch relation is created."""
+        # Sets both index and extra user roles in the relation if the roles are provided.
+        # Otherwise, sets only the index.
+        data = {"index": self.index}
+        if self.extra_user_roles:
+            data["extra-user-roles"] = self.extra_user_roles
+
+        self._update_relation_data(event.relation.id, data)
+
+    def _on_relation_changed_event(self, event: RelationChangedEvent) -> None:
+        """Event emitted when the OpenSearch relation has changed.
+
+        This event triggers individual custom events depending on the changing relation.
+        """
+        # Check which data has changed to emit customs events.
+        diff = self._diff(event)
+
+        # Check if authentication has updated, emit event if so
+        updates = {"username", "password", "tls", "tls-ca"}
+        if len(set(diff._asdict().keys()) - updates) < len(diff):
+            logger.info("authentication updated at: %s", datetime.now())
+            getattr(self.on, "authentication_updated").emit(
+                event.relation, app=event.app, unit=event.unit
+            )
+
+        # Check if the index is created
+        # (the OpenSearch charm shares the credentials).
+        if "username" in diff.added and "password" in diff.added:
+            # Emit the default event (the one without an alias).
+            logger.info("index created at: %s", datetime.now())
+            getattr(self.on, "index_created").emit(event.relation, app=event.app, unit=event.unit)
+
+            # To avoid unnecessary application restarts do not trigger
+            # “endpoints_changed“ event if “index_created“ is triggered.
+            return
+
+        # Emit a endpoints changed event if the OpenSearch application added or changed this info
+        # in the relation databag.
+        if "endpoints" in diff.added or "endpoints" in diff.changed:
+            # Emit the default event (the one without an alias).
+            logger.info("endpoints changed on %s", datetime.now())
+            getattr(self.on, "endpoints_changed").emit(
+                event.relation, app=event.app, unit=event.unit
+            )  # here check if this is the right design
+            return
diff --git a/vm_operator/lib/charms/operator_libs_linux/v0/apt.py b/vm_operator/lib/charms/operator_libs_linux/v0/apt.py
new file mode 100644
index 0000000..d888b22
--- /dev/null
+++ b/vm_operator/lib/charms/operator_libs_linux/v0/apt.py
@@ -0,0 +1,1321 @@
+# Copyright 2021 Canonical Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Abstractions for the system's Debian/Ubuntu package information and repositories.
+
+This module contains abstractions and wrappers around Debian/Ubuntu-style repositories and
+packages, in order to easily provide an idiomatic and Pythonic mechanism for adding packages and/or
+repositories to systems for use in machine charms.
+
+A sane default configuration is attainable through nothing more than instantiation of the
+appropriate classes. `DebianPackage` objects provide information about the architecture, version,
+name, and status of a package.
+
+`DebianPackage` will try to look up a package either from `dpkg -L` or from `apt-cache` when
+provided with a string indicating the package name. If it cannot be located, `PackageNotFoundError`
+will be returned, as `apt` and `dpkg` otherwise return `100` for all errors, and a meaningful error
+message if the package is not known is desirable.
+
+To install packages with convenience methods:
+
+```python
+try:
+    # Run `apt-get update`
+    apt.update()
+    apt.add_package("zsh")
+    apt.add_package(["vim", "htop", "wget"])
+except PackageNotFoundError:
+    logger.error("a specified package not found in package cache or on system")
+except PackageError as e:
+    logger.error("could not install package. Reason: %s", e.message)
+````
+
+To find details of a specific package:
+
+```python
+try:
+    vim = apt.DebianPackage.from_system("vim")
+
+    # To find from the apt cache only
+    # apt.DebianPackage.from_apt_cache("vim")
+
+    # To find from installed packages only
+    # apt.DebianPackage.from_installed_package("vim")
+
+    vim.ensure(PackageState.Latest)
+    logger.info("updated vim to version: %s", vim.fullversion)
+except PackageNotFoundError:
+    logger.error("a specified package not found in package cache or on system")
+except PackageError as e:
+    logger.error("could not install package. Reason: %s", e.message)
+```
+
+
+`RepositoryMapping` will return a dict-like object containing enabled system repositories
+and their properties (available groups, baseuri. gpg key). This class can add, disable, or
+manipulate repositories. Items can be retrieved as `DebianRepository` objects.
+
+In order add a new repository with explicit details for fields, a new `DebianRepository` can
+be added to `RepositoryMapping`
+
+`RepositoryMapping` provides an abstraction around the existing repositories on the system,
+and can be accessed and iterated over like any `Mapping` object, to retrieve values by key,
+iterate, or perform other operations.
+
+Keys are constructed as `{repo_type}-{}-{release}` in order to uniquely identify a repository.
+
+Repositories can be added with explicit values through a Python constructor.
+
+Example:
+
+```python
+repositories = apt.RepositoryMapping()
+
+if "deb-example.com-focal" not in repositories:
+    repositories.add(DebianRepository(enabled=True, repotype="deb",
+                     uri="https://example.com", release="focal", groups=["universe"]))
+```
+
+Alternatively, any valid `sources.list` line may be used to construct a new
+`DebianRepository`.
+
+Example:
+
+```python
+repositories = apt.RepositoryMapping()
+
+if "deb-us.archive.ubuntu.com-xenial" not in repositories:
+    line = "deb http://us.archive.ubuntu.com/ubuntu xenial main restricted"
+    repo = DebianRepository.from_repo_line(line)
+    repositories.add(repo)
+```
+"""
+
+import fileinput
+import glob
+import logging
+import os
+import re
+import subprocess
+from collections.abc import Mapping
+from enum import Enum
+from subprocess import PIPE, CalledProcessError, check_call, check_output
+from typing import Iterable, List, Optional, Tuple, Union
+from urllib.parse import urlparse
+
+logger = logging.getLogger(__name__)
+
+# The unique Charmhub library identifier, never change it
+LIBID = "7c3dbc9c2ad44a47bd6fcb25caa270e5"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 0
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 6
+
+
+VALID_SOURCE_TYPES = ("deb", "deb-src")
+OPTIONS_MATCHER = re.compile(r"\[.*?\]")
+
+
+class Error(Exception):
+    """Base class of most errors raised by this library."""
+
+    def __repr__(self):
+        """String representation of Error."""
+        return "<{}.{} {}>".format(type(self).__module__, type(self).__name__, self.args)
+
+    @property
+    def name(self):
+        """Return a string representation of the model plus class."""
+        return "<{}.{}>".format(type(self).__module__, type(self).__name__)
+
+    @property
+    def message(self):
+        """Return the message passed as an argument."""
+        return self.args[0]
+
+
+class PackageError(Error):
+    """Raised when there's an error installing or removing a package."""
+
+
+class PackageNotFoundError(Error):
+    """Raised when a requested package is not known to the system."""
+
+
+class PackageState(Enum):
+    """A class to represent possible package states."""
+
+    Present = "present"
+    Absent = "absent"
+    Latest = "latest"
+    Available = "available"
+
+
+class DebianPackage:
+    """Represents a traditional Debian package and its utility functions.
+
+    `DebianPackage` wraps information and functionality around a known package, whether installed
+    or available. The version, epoch, name, and architecture can be easily queried and compared
+    against other `DebianPackage` objects to determine the latest version or to install a specific
+    version.
+
+    The representation of this object as a string mimics the output from `dpkg` for familiarity.
+
+    Installation and removal of packages is handled through the `state` property or `ensure`
+    method, with the following options:
+
+        apt.PackageState.Absent
+        apt.PackageState.Available
+        apt.PackageState.Present
+        apt.PackageState.Latest
+
+    When `DebianPackage` is initialized, the state of a given `DebianPackage` object will be set to
+    `Available`, `Present`, or `Latest`, with `Absent` implemented as a convenience for removal
+    (though it operates essentially the same as `Available`).
+    """
+
+    def __init__(
+        self, name: str, version: str, epoch: str, arch: str, state: PackageState
+    ) -> None:
+        self._name = name
+        self._arch = arch
+        self._state = state
+        self._version = Version(version, epoch)
+
+    def __eq__(self, other) -> bool:
+        """Equality for comparison.
+
+        Args:
+          other: a `DebianPackage` object for comparison
+
+        Returns:
+          A boolean reflecting equality
+        """
+        return (
+            isinstance(other, self.__class__)
+            and (
+                self._name,
+                self._version.number,
+            )
+            == (other._name, other._version.number)
+        )
+
+    def __hash__(self):
+        """A basic hash so this class can be used in Mappings and dicts."""
+        return hash((self._name, self._version.number))
+
+    def __repr__(self):
+        """A representation of the package."""
+        return "<{}.{}: {}>".format(self.__module__, self.__class__.__name__, self.__dict__)
+
+    def __str__(self):
+        """A human-readable representation of the package."""
+        return "<{}: {}-{}.{} -- {}>".format(
+            self.__class__.__name__,
+            self._name,
+            self._version,
+            self._arch,
+            str(self._state),
+        )
+
+    @staticmethod
+    def _apt(
+        command: str,
+        package_names: Union[str, List],
+        optargs: Optional[List[str]] = None,
+    ) -> None:
+        """Wrap package management commands for Debian/Ubuntu systems.
+
+        Args:
+          command: the command given to `apt-get`
+          package_names: a package name or list of package names to operate on
+          optargs: an (Optional) list of additioanl arguments
+
+        Raises:
+          PackageError if an error is encountered
+        """
+        optargs = optargs if optargs is not None else []
+        if isinstance(package_names, str):
+            package_names = [package_names]
+        _cmd = ["apt-get", "-y", *optargs, command, *package_names]
+        try:
+            check_call(_cmd, stderr=PIPE, stdout=PIPE)
+        except CalledProcessError as e:
+            raise PackageError(
+                "Could not {} package(s) [{}]: {}".format(command, [*package_names], e.output)
+            ) from None
+
+    def _add(self) -> None:
+        """Add a package to the system."""
+        self._apt(
+            "install",
+            "{}={}".format(self.name, self.version),
+            optargs=["--option=Dpkg::Options::=--force-confold"],
+        )
+
+    def _remove(self) -> None:
+        """Removes a package from the system. Implementation-specific."""
+        return self._apt("remove", "{}={}".format(self.name, self.version))
+
+    @property
+    def name(self) -> str:
+        """Returns the name of the package."""
+        return self._name
+
+    def ensure(self, state: PackageState):
+        """Ensures that a package is in a given state.
+
+        Args:
+          state: a `PackageState` to reconcile the package to
+
+        Raises:
+          PackageError from the underlying call to apt
+        """
+        if self._state is not state:
+            if state not in (PackageState.Present, PackageState.Latest):
+                self._remove()
+            else:
+                self._add()
+        self._state = state
+
+    @property
+    def present(self) -> bool:
+        """Returns whether or not a package is present."""
+        return self._state in (PackageState.Present, PackageState.Latest)
+
+    @property
+    def latest(self) -> bool:
+        """Returns whether the package is the most recent version."""
+        return self._state is PackageState.Latest
+
+    @property
+    def state(self) -> PackageState:
+        """Returns the current package state."""
+        return self._state
+
+    @state.setter
+    def state(self, state: PackageState) -> None:
+        """Sets the package state to a given value.
+
+        Args:
+          state: a `PackageState` to reconcile the package to
+
+        Raises:
+          PackageError from the underlying call to apt
+        """
+        if state in (PackageState.Latest, PackageState.Present):
+            self._add()
+        else:
+            self._remove()
+        self._state = state
+
+    @property
+    def version(self) -> "Version":
+        """Returns the version for a package."""
+        return self._version
+
+    @property
+    def epoch(self) -> str:
+        """Returns the epoch for a package. May be unset."""
+        return self._version.epoch
+
+    @property
+    def arch(self) -> str:
+        """Returns the architecture for a package."""
+        return self._arch
+
+    @property
+    def fullversion(self) -> str:
+        """Returns the name+epoch for a package."""
+        return "{}.{}".format(self._version, self._arch)
+
+    @staticmethod
+    def _get_epoch_from_version(version: str) -> Tuple[str, str]:
+        """Pull the epoch, if any, out of a version string."""
+        epoch_matcher = re.compile(r"^((?P<epoch>\d+):)?(?P<version>.*)")
+        matches = epoch_matcher.search(version).groupdict()
+        return matches.get("epoch", ""), matches.get("version")
+
+    @classmethod
+    def from_system(
+        cls, package: str, version: Optional[str] = "", arch: Optional[str] = ""
+    ) -> "DebianPackage":
+        """Locates a package, either on the system or known to apt, and serializes the information.
+
+        Args:
+            package: a string representing the package
+            version: an optional string if a specific version isr equested
+            arch: an optional architecture, defaulting to `dpkg --print-architecture`. If an
+                architecture is not specified, this will be used for selection.
+
+        """
+        try:
+            return DebianPackage.from_installed_package(package, version, arch)
+        except PackageNotFoundError:
+            logger.debug(
+                "package '%s' is not currently installed or has the wrong architecture.", package
+            )
+
+        # Ok, try `apt-cache ...`
+        try:
+            return DebianPackage.from_apt_cache(package, version, arch)
+        except (PackageNotFoundError, PackageError):
+            # If we get here, it's not known to the systems.
+            # This seems unnecessary, but virtually all `apt` commands have a return code of `100`,
+            # and providing meaningful error messages without this is ugly.
+            raise PackageNotFoundError(
+                "Package '{}{}' could not be found on the system or in the apt cache!".format(
+                    package, ".{}".format(arch) if arch else ""
+                )
+            ) from None
+
+    @classmethod
+    def from_installed_package(
+        cls, package: str, version: Optional[str] = "", arch: Optional[str] = ""
+    ) -> "DebianPackage":
+        """Check whether the package is already installed and return an instance.
+
+        Args:
+            package: a string representing the package
+            version: an optional string if a specific version isr equested
+            arch: an optional architecture, defaulting to `dpkg --print-architecture`.
+                If an architecture is not specified, this will be used for selection.
+        """
+        system_arch = check_output(
+            ["dpkg", "--print-architecture"], universal_newlines=True
+        ).strip()
+        arch = arch if arch else system_arch
+
+        # Regexps are a really terrible way to do this. Thanks dpkg
+        output = ""
+        try:
+            output = check_output(["dpkg", "-l", package], stderr=PIPE, universal_newlines=True)
+        except CalledProcessError:
+            raise PackageNotFoundError("Package is not installed: {}".format(package)) from None
+
+        # Pop off the output from `dpkg -l' because there's no flag to
+        # omit it`
+        lines = str(output).splitlines()[5:]
+
+        dpkg_matcher = re.compile(
+            r"""
+        ^(?P<package_status>\w+?)\s+
+        (?P<package_name>.*?)(?P<throwaway_arch>:\w+?)?\s+
+        (?P<version>.*?)\s+
+        (?P<arch>\w+?)\s+
+        (?P<description>.*)
+        """,
+            re.VERBOSE,
+        )
+
+        for line in lines:
+            try:
+                matches = dpkg_matcher.search(line).groupdict()
+                epoch, split_version = DebianPackage._get_epoch_from_version(matches["version"])
+                pkg = DebianPackage(
+                    matches["package_name"],
+                    split_version,
+                    epoch,
+                    matches["arch"],
+                    PackageState.Present,
+                )
+                if (pkg.arch == "all" or pkg.arch == arch) and (
+                    version == "" or str(pkg.version) == version
+                ):
+                    return pkg
+            except AttributeError:
+                logger.warning("dpkg matcher could not parse line: %s", line)
+
+        # If we didn't find it, fail through
+        raise PackageNotFoundError("Package {}.{} is not installed!".format(package, arch))
+
+    @classmethod
+    def from_apt_cache(
+        cls, package: str, version: Optional[str] = "", arch: Optional[str] = ""
+    ) -> "DebianPackage":
+        """Check whether the package is already installed and return an instance.
+
+        Args:
+            package: a string representing the package
+            version: an optional string if a specific version isr equested
+            arch: an optional architecture, defaulting to `dpkg --print-architecture`.
+                If an architecture is not specified, this will be used for selection.
+        """
+        system_arch = check_output(
+            ["dpkg", "--print-architecture"], universal_newlines=True
+        ).strip()
+        arch = arch if arch else system_arch
+
+        # Regexps are a really terrible way to do this. Thanks dpkg
+        keys = ("Package", "Architecture", "Version")
+
+        try:
+            output = check_output(
+                ["apt-cache", "show", package], stderr=PIPE, universal_newlines=True
+            )
+        except CalledProcessError as e:
+            raise PackageError(
+                "Could not list packages in apt-cache: {}".format(e.output)
+            ) from None
+
+        pkg_groups = output.strip().split("\n\n")
+        keys = ("Package", "Architecture", "Version")
+
+        for pkg_raw in pkg_groups:
+            lines = str(pkg_raw).splitlines()
+            vals = {}
+            for line in lines:
+                if line.startswith(keys):
+                    items = line.split(":", 1)
+                    vals[items[0]] = items[1].strip()
+                else:
+                    continue
+
+            epoch, split_version = DebianPackage._get_epoch_from_version(vals["Version"])
+            pkg = DebianPackage(
+                vals["Package"],
+                split_version,
+                epoch,
+                vals["Architecture"],
+                PackageState.Available,
+            )
+
+            if (pkg.arch == "all" or pkg.arch == arch) and (
+                version == "" or str(pkg.version) == version
+            ):
+                return pkg
+
+        # If we didn't find it, fail through
+        raise PackageNotFoundError("Package {}.{} is not in the apt cache!".format(package, arch))
+
+
+class Version:
+    """An abstraction around package versions.
+
+    This seems like it should be strictly unnecessary, except that `apt_pkg` is not usable inside a
+    venv, and wedging version comparisions into `DebianPackage` would overcomplicate it.
+
+    This class implements the algorithm found here:
+    https://www.debian.org/doc/debian-policy/ch-controlfields.html#version
+    """
+
+    def __init__(self, version: str, epoch: str):
+        self._version = version
+        self._epoch = epoch or ""
+
+    def __repr__(self):
+        """A representation of the package."""
+        return "<{}.{}: {}>".format(self.__module__, self.__class__.__name__, self.__dict__)
+
+    def __str__(self):
+        """A human-readable representation of the package."""
+        return "{}{}".format("{}:".format(self._epoch) if self._epoch else "", self._version)
+
+    @property
+    def epoch(self):
+        """Returns the epoch for a package. May be empty."""
+        return self._epoch
+
+    @property
+    def number(self) -> str:
+        """Returns the version number for a package."""
+        return self._version
+
+    def _get_parts(self, version: str) -> Tuple[str, str]:
+        """Separate the version into component upstream and Debian pieces."""
+        try:
+            version.rindex("-")
+        except ValueError:
+            # No hyphens means no Debian version
+            return version, "0"
+
+        upstream, debian = version.rsplit("-", 1)
+        return upstream, debian
+
+    def _listify(self, revision: str) -> List[str]:
+        """Split a revision string into a listself.
+
+        This list is comprised of  alternating between strings and numbers,
+        padded on either end to always be "str, int, str, int..." and
+        always be of even length.  This allows us to trivially implement the
+        comparison algorithm described.
+        """
+        result = []
+        while revision:
+            rev_1, remains = self._get_alphas(revision)
+            rev_2, remains = self._get_digits(remains)
+            result.extend([rev_1, rev_2])
+            revision = remains
+        return result
+
+    def _get_alphas(self, revision: str) -> Tuple[str, str]:
+        """Return a tuple of the first non-digit characters of a revision."""
+        # get the index of the first digit
+        for i, char in enumerate(revision):
+            if char.isdigit():
+                if i == 0:
+                    return "", revision
+                return revision[0:i], revision[i:]
+        # string is entirely alphas
+        return revision, ""
+
+    def _get_digits(self, revision: str) -> Tuple[int, str]:
+        """Return a tuple of the first integer characters of a revision."""
+        # If the string is empty, return (0,'')
+        if not revision:
+            return 0, ""
+        # get the index of the first non-digit
+        for i, char in enumerate(revision):
+            if not char.isdigit():
+                if i == 0:
+                    return 0, revision
+                return int(revision[0:i]), revision[i:]
+        # string is entirely digits
+        return int(revision), ""
+
+    def _dstringcmp(self, a, b):  # noqa: C901
+        """Debian package version string section lexical sort algorithm.
+
+        The lexical comparison is a comparison of ASCII values modified so
+        that all the letters sort earlier than all the non-letters and so that
+        a tilde sorts before anything, even the end of a part.
+        """
+        if a == b:
+            return 0
+        try:
+            for i, char in enumerate(a):
+                if char == b[i]:
+                    continue
+                # "a tilde sorts before anything, even the end of a part"
+                # (emptyness)
+                if char == "~":
+                    return -1
+                if b[i] == "~":
+                    return 1
+                # "all the letters sort earlier than all the non-letters"
+                if char.isalpha() and not b[i].isalpha():
+                    return -1
+                if not char.isalpha() and b[i].isalpha():
+                    return 1
+                # otherwise lexical sort
+                if ord(char) > ord(b[i]):
+                    return 1
+                if ord(char) < ord(b[i]):
+                    return -1
+        except IndexError:
+            # a is longer than b but otherwise equal, greater unless there are tildes
+            if char == "~":
+                return -1
+            return 1
+        # if we get here, a is shorter than b but otherwise equal, so check for tildes...
+        if b[len(a)] == "~":
+            return 1
+        return -1
+
+    def _compare_revision_strings(self, first: str, second: str):  # noqa: C901
+        """Compare two debian revision strings."""
+        if first == second:
+            return 0
+
+        # listify pads results so that we will always be comparing ints to ints
+        # and strings to strings (at least until we fall off the end of a list)
+        first_list = self._listify(first)
+        second_list = self._listify(second)
+        if first_list == second_list:
+            return 0
+        try:
+            for i, item in enumerate(first_list):
+                # explicitly raise IndexError if we've fallen off the edge of list2
+                if i >= len(second_list):
+                    raise IndexError
+                # if the items are equal, next
+                if item == second_list[i]:
+                    continue
+                # numeric comparison
+                if isinstance(item, int):
+                    if item > second_list[i]:
+                        return 1
+                    if item < second_list[i]:
+                        return -1
+                else:
+                    # string comparison
+                    return self._dstringcmp(item, second_list[i])
+        except IndexError:
+            # rev1 is longer than rev2 but otherwise equal, hence greater
+            # ...except for goddamn tildes
+            if first_list[len(second_list)][0][0] == "~":
+                return 1
+            return 1
+        # rev1 is shorter than rev2 but otherwise equal, hence lesser
+        # ...except for goddamn tildes
+        if second_list[len(first_list)][0][0] == "~":
+            return -1
+        return -1
+
+    def _compare_version(self, other) -> int:
+        if (self.number, self.epoch) == (other.number, other.epoch):
+            return 0
+
+        if self.epoch < other.epoch:
+            return -1
+        if self.epoch > other.epoch:
+            return 1
+
+        # If none of these are true, follow the algorithm
+        upstream_version, debian_version = self._get_parts(self.number)
+        other_upstream_version, other_debian_version = self._get_parts(other.number)
+
+        upstream_cmp = self._compare_revision_strings(upstream_version, other_upstream_version)
+        if upstream_cmp != 0:
+            return upstream_cmp
+
+        debian_cmp = self._compare_revision_strings(debian_version, other_debian_version)
+        if debian_cmp != 0:
+            return debian_cmp
+
+        return 0
+
+    def __lt__(self, other) -> bool:
+        """Less than magic method impl."""
+        return self._compare_version(other) < 0
+
+    def __eq__(self, other) -> bool:
+        """Equality magic method impl."""
+        return self._compare_version(other) == 0
+
+    def __gt__(self, other) -> bool:
+        """Greater than magic method impl."""
+        return self._compare_version(other) > 0
+
+    def __le__(self, other) -> bool:
+        """Less than or equal to magic method impl."""
+        return self.__eq__(other) or self.__lt__(other)
+
+    def __ge__(self, other) -> bool:
+        """Greater than or equal to magic method impl."""
+        return self.__gt__(other) or self.__eq__(other)
+
+    def __ne__(self, other) -> bool:
+        """Not equal to magic method impl."""
+        return not self.__eq__(other)
+
+
+def add_package(
+    package_names: Union[str, List[str]],
+    version: Optional[str] = "",
+    arch: Optional[str] = "",
+    update_cache: Optional[bool] = False,
+) -> Union[DebianPackage, List[DebianPackage]]:
+    """Add a package or list of packages to the system.
+
+    Args:
+        name: the name(s) of the package(s)
+        version: an (Optional) version as a string. Defaults to the latest known
+        arch: an optional architecture for the package
+        update_cache: whether or not to run `apt-get update` prior to operating
+
+    Raises:
+        PackageNotFoundError if the package is not in the cache.
+    """
+    cache_refreshed = False
+    if update_cache:
+        update()
+        cache_refreshed = True
+
+    packages = {"success": [], "retry": [], "failed": []}
+
+    package_names = [package_names] if type(package_names) is str else package_names
+    if not package_names:
+        raise TypeError("Expected at least one package name to add, received zero!")
+
+    if len(package_names) != 1 and version:
+        raise TypeError(
+            "Explicit version should not be set if more than one package is being added!"
+        )
+
+    for p in package_names:
+        pkg, success = _add(p, version, arch)
+        if success:
+            packages["success"].append(pkg)
+        else:
+            logger.warning("failed to locate and install/update '%s'", pkg)
+            packages["retry"].append(p)
+
+    if packages["retry"] and not cache_refreshed:
+        logger.info("updating the apt-cache and retrying installation of failed packages.")
+        update()
+
+        for p in packages["retry"]:
+            pkg, success = _add(p, version, arch)
+            if success:
+                packages["success"].append(pkg)
+            else:
+                packages["failed"].append(p)
+
+    if packages["failed"]:
+        raise PackageError("Failed to install packages: {}".format(", ".join(packages["failed"])))
+
+    return packages["success"] if len(packages["success"]) > 1 else packages["success"][0]
+
+
+def _add(
+    name: str,
+    version: Optional[str] = "",
+    arch: Optional[str] = "",
+) -> Tuple[Union[DebianPackage, str], bool]:
+    """Adds a package.
+
+    Args:
+        name: the name(s) of the package(s)
+        version: an (Optional) version as a string. Defaults to the latest known
+        arch: an optional architecture for the package
+
+    Returns: a tuple of `DebianPackage` if found, or a :str: if it is not, and
+        a boolean indicating success
+    """
+    try:
+        pkg = DebianPackage.from_system(name, version, arch)
+        pkg.ensure(state=PackageState.Present)
+        return pkg, True
+    except PackageNotFoundError:
+        return name, False
+
+
+def remove_package(
+    package_names: Union[str, List[str]]
+) -> Union[DebianPackage, List[DebianPackage]]:
+    """Removes a package from the system.
+
+    Args:
+        package_names: the name of a package
+
+    Raises:
+        PackageNotFoundError if the package is not found.
+    """
+    packages = []
+
+    package_names = [package_names] if type(package_names) is str else package_names
+    if not package_names:
+        raise TypeError("Expected at least one package name to add, received zero!")
+
+    for p in package_names:
+        try:
+            pkg = DebianPackage.from_installed_package(p)
+            pkg.ensure(state=PackageState.Absent)
+            packages.append(pkg)
+        except PackageNotFoundError:
+            logger.info("package '%s' was requested for removal, but it was not installed.", p)
+
+    return packages if len(packages) > 1 else packages[0]
+
+
+def update() -> None:
+    """Updates the apt cache via `apt-get update`."""
+    check_call(["apt-get", "update"], stderr=PIPE, stdout=PIPE)
+
+
+class InvalidSourceError(Error):
+    """Exceptions for invalid source entries."""
+
+
+class GPGKeyError(Error):
+    """Exceptions for GPG keys."""
+
+
+class DebianRepository:
+    """An abstraction to represent a repository."""
+
+    def __init__(
+        self,
+        enabled: bool,
+        repotype: str,
+        uri: str,
+        release: str,
+        groups: List[str],
+        filename: Optional[str] = "",
+        gpg_key_filename: Optional[str] = "",
+        options: Optional[dict] = None,
+    ):
+        self._enabled = enabled
+        self._repotype = repotype
+        self._uri = uri
+        self._release = release
+        self._groups = groups
+        self._filename = filename
+        self._gpg_key_filename = gpg_key_filename
+        self._options = options
+
+    @property
+    def enabled(self):
+        """Return whether or not the repository is enabled."""
+        return self._enabled
+
+    @property
+    def repotype(self):
+        """Return whether it is binary or source."""
+        return self._repotype
+
+    @property
+    def uri(self):
+        """Return the URI."""
+        return self._uri
+
+    @property
+    def release(self):
+        """Return which Debian/Ubuntu releases it is valid for."""
+        return self._release
+
+    @property
+    def groups(self):
+        """Return the enabled package groups."""
+        return self._groups
+
+    @property
+    def filename(self):
+        """Returns the filename for a repository."""
+        return self._filename
+
+    @filename.setter
+    def filename(self, fname: str) -> None:
+        """Sets the filename used when a repo is written back to diskself.
+
+        Args:
+            fname: a filename to write the repository information to.
+        """
+        if not fname.endswith(".list"):
+            raise InvalidSourceError("apt source filenames should end in .list!")
+
+        self._filename = fname
+
+    @property
+    def gpg_key(self):
+        """Returns the path to the GPG key for this repository."""
+        return self._gpg_key_filename
+
+    @property
+    def options(self):
+        """Returns any additional repo options which are set."""
+        return self._options
+
+    def make_options_string(self) -> str:
+        """Generate the complete options string for a a repository.
+
+        Combining `gpg_key`, if set, and the rest of the options to find
+        a complex repo string.
+        """
+        options = self._options if self._options else {}
+        if self._gpg_key_filename:
+            options["signed-by"] = self._gpg_key_filename
+
+        return (
+            "[{}] ".format(" ".join(["{}={}".format(k, v) for k, v in options.items()]))
+            if options
+            else ""
+        )
+
+    @staticmethod
+    def prefix_from_uri(uri: str) -> str:
+        """Get a repo list prefix from the uri, depending on whether a path is set."""
+        uridetails = urlparse(uri)
+        path = (
+            uridetails.path.lstrip("/").replace("/", "-") if uridetails.path else uridetails.netloc
+        )
+        return "/etc/apt/sources.list.d/{}".format(path)
+
+    @staticmethod
+    def from_repo_line(repo_line: str, write_file: Optional[bool] = True) -> "DebianRepository":
+        """Instantiate a new `DebianRepository` a `sources.list` entry line.
+
+        Args:
+            repo_line: a string representing a repository entry
+            write_file: boolean to enable writing the new repo to disk
+        """
+        repo = RepositoryMapping._parse(repo_line, "UserInput")
+        fname = "{}-{}.list".format(
+            DebianRepository.prefix_from_uri(repo.uri), repo.release.replace("/", "-")
+        )
+        repo.filename = fname
+
+        options = repo.options if repo.options else {}
+        if repo.gpg_key:
+            options["signed-by"] = repo.gpg_key
+
+        # For Python 3.5 it's required to use sorted in the options dict in order to not have
+        # different results in the order of the options between executions.
+        options_str = (
+            "[{}] ".format(" ".join(["{}={}".format(k, v) for k, v in sorted(options.items())]))
+            if options
+            else ""
+        )
+
+        if write_file:
+            with open(fname, "wb") as f:
+                f.write(
+                    (
+                        "{}".format("#" if not repo.enabled else "")
+                        + "{} {}{} ".format(repo.repotype, options_str, repo.uri)
+                        + "{} {}\n".format(repo.release, " ".join(repo.groups))
+                    ).encode("utf-8")
+                )
+
+        return repo
+
+    def disable(self) -> None:
+        """Remove this repository from consideration.
+
+        Disable it instead of removing from the repository file.
+        """
+        searcher = "{} {}{} {}".format(
+            self.repotype, self.make_options_string(), self.uri, self.release
+        )
+        for line in fileinput.input(self._filename, inplace=True):
+            if re.match(r"^{}\s".format(re.escape(searcher)), line):
+                print("# {}".format(line), end="")
+            else:
+                print(line, end="")
+
+    def import_key(self, key: str) -> None:
+        """Import an ASCII Armor key.
+
+        A Radix64 format keyid is also supported for backwards
+        compatibility. In this case Ubuntu keyserver will be
+        queried for a key via HTTPS by its keyid. This method
+        is less preferrable because https proxy servers may
+        require traffic decryption which is equivalent to a
+        man-in-the-middle attack (a proxy server impersonates
+        keyserver TLS certificates and has to be explicitly
+        trusted by the system).
+
+        Args:
+          key: A GPG key in ASCII armor format,
+                      including BEGIN and END markers or a keyid.
+
+        Raises:
+          GPGKeyError if the key could not be imported
+        """
+        key = key.strip()
+        if "-" in key or "\n" in key:
+            # Send everything not obviously a keyid to GPG to import, as
+            # we trust its validation better than our own. eg. handling
+            # comments before the key.
+            logger.debug("PGP key found (looks like ASCII Armor format)")
+            if (
+                "-----BEGIN PGP PUBLIC KEY BLOCK-----" in key
+                and "-----END PGP PUBLIC KEY BLOCK-----" in key
+            ):
+                logger.debug("Writing provided PGP key in the binary format")
+                key_bytes = key.encode("utf-8")
+                key_name = self._get_keyid_by_gpg_key(key_bytes)
+                key_gpg = self._dearmor_gpg_key(key_bytes)
+                self._gpg_key_filename = "/etc/apt/trusted.gpg.d/{}.gpg".format(key_name)
+                self._write_apt_gpg_keyfile(key_name=self._gpg_key_filename, key_material=key_gpg)
+            else:
+                raise GPGKeyError("ASCII armor markers missing from GPG key")
+        else:
+            logger.warning(
+                "PGP key found (looks like Radix64 format). "
+                "SECURELY importing PGP key from keyserver; "
+                "full key not provided."
+            )
+            # as of bionic add-apt-repository uses curl with an HTTPS keyserver URL
+            # to retrieve GPG keys. `apt-key adv` command is deprecated as is
+            # apt-key in general as noted in its manpage. See lp:1433761 for more
+            # history. Instead, /etc/apt/trusted.gpg.d is used directly to drop
+            # gpg
+            key_asc = self._get_key_by_keyid(key)
+            # write the key in GPG format so that apt-key list shows it
+            key_gpg = self._dearmor_gpg_key(key_asc.encode("utf-8"))
+            self._gpg_key_filename = "/etc/apt/trusted.gpg.d/{}.gpg".format(key)
+            self._write_apt_gpg_keyfile(key_name=key, key_material=key_gpg)
+
+    @staticmethod
+    def _get_keyid_by_gpg_key(key_material: bytes) -> str:
+        """Get a GPG key fingerprint by GPG key material.
+
+        Gets a GPG key fingerprint (40-digit, 160-bit) by the ASCII armor-encoded
+        or binary GPG key material. Can be used, for example, to generate file
+        names for keys passed via charm options.
+        """
+        # Use the same gpg command for both Xenial and Bionic
+        cmd = ["gpg", "--with-colons", "--with-fingerprint"]
+        ps = subprocess.run(
+            cmd,
+            stdout=PIPE,
+            stderr=PIPE,
+            input=key_material,
+        )
+        out, err = ps.stdout.decode(), ps.stderr.decode()
+        if "gpg: no valid OpenPGP data found." in err:
+            raise GPGKeyError("Invalid GPG key material provided")
+        # from gnupg2 docs: fpr :: Fingerprint (fingerprint is in field 10)
+        return re.search(r"^fpr:{9}([0-9A-F]{40}):$", out, re.MULTILINE).group(1)
+
+    @staticmethod
+    def _get_key_by_keyid(keyid: str) -> str:
+        """Get a key via HTTPS from the Ubuntu keyserver.
+
+        Different key ID formats are supported by SKS keyservers (the longer ones
+        are more secure, see "dead beef attack" and https://evil32.com/). Since
+        HTTPS is used, if SSLBump-like HTTPS proxies are in place, they will
+        impersonate keyserver.ubuntu.com and generate a certificate with
+        keyserver.ubuntu.com in the CN field or in SubjAltName fields of a
+        certificate. If such proxy behavior is expected it is necessary to add the
+        CA certificate chain containing the intermediate CA of the SSLBump proxy to
+        every machine that this code runs on via ca-certs cloud-init directive (via
+        cloudinit-userdata model-config) or via other means (such as through a
+        custom charm option). Also note that DNS resolution for the hostname in a
+        URL is done at a proxy server - not at the client side.
+        8-digit (32 bit) key ID
+        https://keyserver.ubuntu.com/pks/lookup?search=0x4652B4E6
+        16-digit (64 bit) key ID
+        https://keyserver.ubuntu.com/pks/lookup?search=0x6E85A86E4652B4E6
+        40-digit key ID:
+        https://keyserver.ubuntu.com/pks/lookup?search=0x35F77D63B5CEC106C577ED856E85A86E4652B4E6
+
+        Args:
+          keyid: An 8, 16 or 40 hex digit keyid to find a key for
+
+        Returns:
+          A string contining key material for the specified GPG key id
+
+
+        Raises:
+          subprocess.CalledProcessError
+        """
+        # options=mr - machine-readable output (disables html wrappers)
+        keyserver_url = (
+            "https://keyserver.ubuntu.com" "/pks/lookup?op=get&options=mr&exact=on&search=0x{}"
+        )
+        curl_cmd = ["curl", keyserver_url.format(keyid)]
+        # use proxy server settings in order to retrieve the key
+        return check_output(curl_cmd).decode()
+
+    @staticmethod
+    def _dearmor_gpg_key(key_asc: bytes) -> bytes:
+        """Converts a GPG key in the ASCII armor format to the binary format.
+
+        Args:
+          key_asc: A GPG key in ASCII armor format.
+
+        Returns:
+          A GPG key in binary format as a string
+
+        Raises:
+          GPGKeyError
+        """
+        ps = subprocess.run(["gpg", "--dearmor"], stdout=PIPE, stderr=PIPE, input=key_asc)
+        out, err = ps.stdout, ps.stderr.decode()
+        if "gpg: no valid OpenPGP data found." in err:
+            raise GPGKeyError(
+                "Invalid GPG key material. Check your network setup"
+                " (MTU, routing, DNS) and/or proxy server settings"
+                " as well as destination keyserver status."
+            )
+        else:
+            return out
+
+    @staticmethod
+    def _write_apt_gpg_keyfile(key_name: str, key_material: bytes) -> None:
+        """Writes GPG key material into a file at a provided path.
+
+        Args:
+          key_name: A key name to use for a key file (could be a fingerprint)
+          key_material: A GPG key material (binary)
+        """
+        with open(key_name, "wb") as keyf:
+            keyf.write(key_material)
+
+
+class RepositoryMapping(Mapping):
+    """An representation of known repositories.
+
+    Instantiation of `RepositoryMapping` will iterate through the
+    filesystem, parse out repository files in `/etc/apt/...`, and create
+    `DebianRepository` objects in this list.
+
+    Typical usage:
+
+        repositories = apt.RepositoryMapping()
+        repositories.add(DebianRepository(
+            enabled=True, repotype="deb", uri="https://example.com", release="focal",
+            groups=["universe"]
+        ))
+    """
+
+    def __init__(self):
+        self._repository_map = {}
+        # Repositories that we're adding -- used to implement mode param
+        self.default_file = "/etc/apt/sources.list"
+
+        # read sources.list if it exists
+        if os.path.isfile(self.default_file):
+            self.load(self.default_file)
+
+        # read sources.list.d
+        for file in glob.iglob("/etc/apt/sources.list.d/*.list"):
+            self.load(file)
+
+    def __contains__(self, key: str) -> bool:
+        """Magic method for checking presence of repo in mapping."""
+        return key in self._repository_map
+
+    def __len__(self) -> int:
+        """Return number of repositories in map."""
+        return len(self._repository_map)
+
+    def __iter__(self) -> Iterable[DebianRepository]:
+        """Iterator magic method for RepositoryMapping."""
+        return iter(self._repository_map.values())
+
+    def __getitem__(self, repository_uri: str) -> DebianRepository:
+        """Return a given `DebianRepository`."""
+        return self._repository_map[repository_uri]
+
+    def __setitem__(self, repository_uri: str, repository: DebianRepository) -> None:
+        """Add a `DebianRepository` to the cache."""
+        self._repository_map[repository_uri] = repository
+
+    def load(self, filename: str):
+        """Load a repository source file into the cache.
+
+        Args:
+          filename: the path to the repository file
+        """
+        parsed = []
+        skipped = []
+        with open(filename, "r") as f:
+            for n, line in enumerate(f):
+                try:
+                    repo = self._parse(line, filename)
+                except InvalidSourceError:
+                    skipped.append(n)
+                else:
+                    repo_identifier = "{}-{}-{}".format(repo.repotype, repo.uri, repo.release)
+                    self._repository_map[repo_identifier] = repo
+                    parsed.append(n)
+                    logger.debug("parsed repo: '%s'", repo_identifier)
+
+        if skipped:
+            skip_list = ", ".join(str(s) for s in skipped)
+            logger.debug("skipped the following lines in file '%s': %s", filename, skip_list)
+
+        if parsed:
+            logger.info("parsed %d apt package repositories", len(parsed))
+        else:
+            raise InvalidSourceError("all repository lines in '{}' were invalid!".format(filename))
+
+    @staticmethod
+    def _parse(line: str, filename: str) -> DebianRepository:
+        """Parse a line in a sources.list file.
+
+        Args:
+          line: a single line from `load` to parse
+          filename: the filename being read
+
+        Raises:
+          InvalidSourceError if the source type is unknown
+        """
+        enabled = True
+        repotype = uri = release = gpg_key = ""
+        options = {}
+        groups = []
+
+        line = line.strip()
+        if line.startswith("#"):
+            enabled = False
+            line = line[1:]
+
+        # Check for "#" in the line and treat a part after it as a comment then strip it off.
+        i = line.find("#")
+        if i > 0:
+            line = line[:i]
+
+        # Split a source into substrings to initialize a new repo.
+        source = line.strip()
+        if source:
+            # Match any repo options, and get a dict representation.
+            for v in re.findall(OPTIONS_MATCHER, source):
+                opts = dict(o.split("=") for o in v.strip("[]").split())
+                # Extract the 'signed-by' option for the gpg_key
+                gpg_key = opts.pop("signed-by", "")
+                options = opts
+
+            # Remove any options from the source string and split the string into chunks
+            source = re.sub(OPTIONS_MATCHER, "", source)
+            chunks = source.split()
+
+            # Check we've got a valid list of chunks
+            if len(chunks) < 3 or chunks[0] not in VALID_SOURCE_TYPES:
+                raise InvalidSourceError("An invalid sources line was found in %s!", filename)
+
+            repotype = chunks[0]
+            uri = chunks[1]
+            release = chunks[2]
+            groups = chunks[3:]
+
+            return DebianRepository(
+                enabled, repotype, uri, release, groups, filename, gpg_key, options
+            )
+        else:
+            raise InvalidSourceError("An invalid sources line was found in %s!", filename)
+
+    def add(self, repo: DebianRepository, default_filename: Optional[bool] = False) -> None:
+        """Add a new repository to the system.
+
+        Args:
+          repo: a `DebianRepository` object
+          default_filename: an (Optional) filename if the default is not desirable
+        """
+        new_filename = "{}-{}.list".format(
+            DebianRepository.prefix_from_uri(repo.uri), repo.release.replace("/", "-")
+        )
+
+        fname = repo.filename or new_filename
+
+        options = repo.options if repo.options else {}
+        if repo.gpg_key:
+            options["signed-by"] = repo.gpg_key
+
+        with open(fname, "wb") as f:
+            f.write(
+                (
+                    "{}".format("#" if not repo.enabled else "")
+                    + "{} {}{} ".format(repo.repotype, repo.make_options_string(), repo.uri)
+                    + "{} {}\n".format(repo.release, " ".join(repo.groups))
+                ).encode("utf-8")
+            )
+
+        self._repository_map["{}-{}-{}".format(repo.repotype, repo.uri, repo.release)] = repo
+
+    def disable(self, repo: DebianRepository) -> None:
+        """Remove a repository. Disable by default.
+
+        Args:
+          repo: a `DebianRepository` to disable
+        """
+        searcher = "{} {}{} {}".format(
+            repo.repotype, repo.make_options_string(), repo.uri, repo.release
+        )
+
+        for line in fileinput.input(repo.filename, inplace=True):
+            if re.match(r"^{}\s".format(re.escape(searcher)), line):
+                print("# {}".format(line), end="")
+            else:
+                print(line, end="")
+
+        self._repository_map["{}-{}-{}".format(repo.repotype, repo.uri, repo.release)] = repo
diff --git a/vm_operator/lib/charms/operator_libs_linux/v0/systemd.py b/vm_operator/lib/charms/operator_libs_linux/v0/systemd.py
new file mode 100644
index 0000000..ecf0d4e
--- /dev/null
+++ b/vm_operator/lib/charms/operator_libs_linux/v0/systemd.py
@@ -0,0 +1,186 @@
+# Copyright 2021 Canonical Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+"""Abstractions for stopping, starting and managing system services via systemd.
+
+This library assumes that your charm is running on a platform that uses systemd. E.g.,
+Centos 7 or later, Ubuntu Xenial (16.04) or later.
+
+For the most part, we transparently provide an interface to a commonly used selection of
+systemd commands, with a few shortcuts baked in. For example, service_pause and
+service_resume with run the mask/unmask and enable/disable invocations.
+
+Example usage:
+```python
+from charms.operator_libs_linux.v0.systemd import service_running, service_reload
+
+# Start a service
+if not service_running("mysql"):
+    success = service_start("mysql")
+
+# Attempt to reload a service, restarting if necessary
+success = service_reload("nginx", restart_on_failure=True)
+```
+
+"""
+
+import logging
+import subprocess
+
+__all__ = [  # Don't export `_systemctl`. (It's not the intended way of using this lib.)
+    "service_pause",
+    "service_reload",
+    "service_restart",
+    "service_resume",
+    "service_running",
+    "service_start",
+    "service_stop",
+    "daemon_reload",
+]
+
+logger = logging.getLogger(__name__)
+
+# The unique Charmhub library identifier, never change it
+LIBID = "045b0d179f6b4514a8bb9b48aee9ebaf"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 0
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 3
+
+
+def _popen_kwargs():
+    return dict(
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        bufsize=1,
+        universal_newlines=True,
+        encoding="utf-8",
+    )
+
+
+def _systemctl(
+    sub_cmd: str, service_name: str = None, now: bool = None, quiet: bool = None
+) -> bool:
+    """Control a system service.
+
+    Args:
+        sub_cmd: the systemctl subcommand to issue
+        service_name: the name of the service to perform the action on
+        now: passes the --now flag to the shell invocation.
+        quiet: passes the --quiet flag to the shell invocation.
+    """
+    cmd = ["systemctl", sub_cmd]
+
+    if service_name is not None:
+        cmd.append(service_name)
+    if now is not None:
+        cmd.append("--now")
+    if quiet is not None:
+        cmd.append("--quiet")
+    if sub_cmd != "is-active":
+        logger.debug("Attempting to {} '{}' with command {}.".format(cmd, service_name, cmd))
+    else:
+        logger.debug("Checking if '{}' is active".format(service_name))
+
+    proc = subprocess.Popen(cmd, **_popen_kwargs())
+    for line in iter(proc.stdout.readline, ""):
+        logger.debug(line)
+
+    proc.wait()
+    return proc.returncode == 0
+
+
+def service_running(service_name: str) -> bool:
+    """Determine whether a system service is running.
+
+    Args:
+        service_name: the name of the service
+    """
+    return _systemctl("is-active", service_name, quiet=True)
+
+
+def service_start(service_name: str) -> bool:
+    """Start a system service.
+
+    Args:
+        service_name: the name of the service to stop
+    """
+    return _systemctl("start", service_name)
+
+
+def service_stop(service_name: str) -> bool:
+    """Stop a system service.
+
+    Args:
+        service_name: the name of the service to stop
+    """
+    return _systemctl("stop", service_name)
+
+
+def service_restart(service_name: str) -> bool:
+    """Restart a system service.
+
+    Args:
+        service_name: the name of the service to restart
+    """
+    return _systemctl("restart", service_name)
+
+
+def service_reload(service_name: str, restart_on_failure: bool = False) -> bool:
+    """Reload a system service, optionally falling back to restart if reload fails.
+
+    Args:
+        service_name: the name of the service to reload
+        restart_on_failure: boolean indicating whether to fallback to a restart if the
+          reload fails.
+    """
+    service_result = _systemctl("reload", service_name)
+    if not service_result and restart_on_failure:
+        service_result = _systemctl("restart", service_name)
+    return service_result
+
+
+def service_pause(service_name: str) -> bool:
+    """Pause a system service.
+
+    Stop it, and prevent it from starting again at boot.
+
+    Args:
+        service_name: the name of the service to pause
+    """
+    _systemctl("disable", service_name, now=True)
+    _systemctl("mask", service_name)
+    return not service_running(service_name)
+
+
+def service_resume(service_name: str) -> bool:
+    """Resume a system service.
+
+    Re-enable starting again at boot. Start the service.
+
+    Args:
+        service_name: the name of the service to resume
+    """
+    _systemctl("unmask", service_name)
+    _systemctl("enable", service_name, now=True)
+    return service_running(service_name)
+
+
+def daemon_reload() -> bool:
+    """Reload systemd manager configuration."""
+    return _systemctl("daemon-reload")
diff --git a/vm_operator/lib/charms/traefik_k8s/v2/ingress.py b/vm_operator/lib/charms/traefik_k8s/v2/ingress.py
new file mode 100644
index 0000000..532e831
--- /dev/null
+++ b/vm_operator/lib/charms/traefik_k8s/v2/ingress.py
@@ -0,0 +1,696 @@
+# Copyright 2023 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+r"""# Interface Library for ingress.
+
+This library wraps relation endpoints using the `ingress` interface
+and provides a Python API for both requesting and providing per-application
+ingress, with load-balancing occurring across all units.
+
+## Getting Started
+
+To get started using the library, you just need to fetch the library using `charmcraft`.
+
+```shell
+cd some-charm
+charmcraft fetch-lib charms.traefik_k8s.v1.ingress
+```
+
+In the `metadata.yaml` of the charm, add the following:
+
+```yaml
+requires:
+    ingress:
+        interface: ingress
+        limit: 1
+```
+
+Then, to initialise the library:
+
+```python
+from charms.traefik_k8s.v2.ingress import (IngressPerAppRequirer,
+  IngressPerAppReadyEvent, IngressPerAppRevokedEvent)
+
+class SomeCharm(CharmBase):
+  def __init__(self, *args):
+    # ...
+    self.ingress = IngressPerAppRequirer(self, port=80)
+    # The following event is triggered when the ingress URL to be used
+    # by this deployment of the `SomeCharm` is ready (or changes).
+    self.framework.observe(
+        self.ingress.on.ready, self._on_ingress_ready
+    )
+    self.framework.observe(
+        self.ingress.on.revoked, self._on_ingress_revoked
+    )
+
+    def _on_ingress_ready(self, event: IngressPerAppReadyEvent):
+        logger.info("This app's ingress URL: %s", event.url)
+
+    def _on_ingress_revoked(self, event: IngressPerAppRevokedEvent):
+        logger.info("This app no longer has ingress")
+"""
+import json
+import logging
+import socket
+import typing
+from dataclasses import dataclass
+from typing import (
+    Any,
+    Dict,
+    List,
+    MutableMapping,
+    Optional,
+    Sequence,
+    Tuple,
+)
+
+import pydantic
+from ops.charm import CharmBase, RelationBrokenEvent, RelationEvent
+from ops.framework import EventSource, Object, ObjectEvents, StoredState
+from ops.model import ModelError, Relation, Unit
+from pydantic import AnyHttpUrl, BaseModel, Field, validator
+
+# The unique Charmhub library identifier, never change it
+LIBID = "e6de2a5cd5b34422a204668f3b8f90d2"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 2
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 3
+
+PYDEPS = ["pydantic<2.0"]
+
+DEFAULT_RELATION_NAME = "ingress"
+RELATION_INTERFACE = "ingress"
+
+log = logging.getLogger(__name__)
+BUILTIN_JUJU_KEYS = {"ingress-address", "private-address", "egress-subnets"}
+
+
+class DatabagModel(BaseModel):
+    """Base databag model."""
+
+    class Config:
+        """Pydantic config."""
+
+        allow_population_by_field_name = True
+        """Allow instantiating this class by field name (instead of forcing alias)."""
+        extra = "forbid"
+        """Raise if unknown fields are added to the databag."""
+
+    _NEST_UNDER = None
+
+    @classmethod
+    def load(cls, databag: MutableMapping):
+        """Load this model from a Juju databag."""
+        if cls._NEST_UNDER:
+            return cls.parse_obj(json.loads(databag[cls._NEST_UNDER]))
+
+        try:
+            data = {k: json.loads(v) for k, v in databag.items() if k not in BUILTIN_JUJU_KEYS}
+        except json.JSONDecodeError:
+            log.error(f"invalid databag contents: expecting json. {databag}")
+            raise
+
+        try:
+            return cls.parse_raw(json.dumps(data))  # type: ignore
+        except pydantic.ValidationError as e:
+            msg = f"failed to validate databag: {databag}"
+            log.error(msg, exc_info=True)
+            raise DataValidationError(msg) from e
+
+    def dump(self, databag: Optional[MutableMapping] = None):
+        """Write the contents of this model to Juju databag."""
+        if databag is None:
+            databag = {}
+
+        if self._NEST_UNDER:
+            databag[self._NEST_UNDER] = self.json()
+
+        dct = self.dict()
+        for key, field in self.__fields__.items():  # type: ignore
+            value = dct[key]
+            databag[field.alias or key] = json.dumps(value)
+
+        return databag
+
+
+# todo: import these models from charm-relation-interfaces/ingress/v2 instead of redeclaring them
+class IngressUrl(BaseModel):
+    """Ingress url schema."""
+
+    url: AnyHttpUrl
+
+
+class IngressProviderAppData(DatabagModel):
+    """Ingress application databag schema."""
+
+    ingress: IngressUrl
+
+
+class ProviderSchema(BaseModel):
+    """Provider schema for Ingress."""
+
+    app: IngressProviderAppData
+
+
+class IngressRequirerAppData(DatabagModel):
+    """Ingress requirer application databag model."""
+
+    model: str = Field(description="The model the application is in.")
+    name: str = Field(description="the name of the app requesting ingress.")
+    port: int = Field(description="The port the app wishes to be exposed.")
+
+    # fields on top of vanilla 'ingress' interface:
+    strip_prefix: Optional[bool] = Field(
+        description="Whether to strip the prefix from the ingress url.", alias="strip-prefix"
+    )
+    redirect_https: Optional[bool] = Field(
+        description="Whether to redirect http traffic to https.", alias="redirect-https"
+    )
+
+    scheme: Optional[str] = Field(
+        default="http", description="What scheme to use in the generated ingress url"
+    )
+
+    @validator("scheme", pre=True)
+    def validate_scheme(cls, scheme):  # noqa: N805  # pydantic wants 'cls' as first arg
+        """Validate scheme arg."""
+        if scheme not in {"http", "https", "h2c"}:
+            raise ValueError("invalid scheme: should be one of `http|https|h2c`")
+        return scheme
+
+    @validator("port", pre=True)
+    def validate_port(cls, port):  # noqa: N805  # pydantic wants 'cls' as first arg
+        """Validate port."""
+        assert isinstance(port, int), type(port)
+        assert 0 < port < 65535, "port out of TCP range"
+        return port
+
+
+class IngressRequirerUnitData(DatabagModel):
+    """Ingress requirer unit databag model."""
+
+    host: str = Field(description="Hostname the unit wishes to be exposed.")
+
+    @validator("host", pre=True)
+    def validate_host(cls, host):  # noqa: N805  # pydantic wants 'cls' as first arg
+        """Validate host."""
+        assert isinstance(host, str), type(host)
+        return host
+
+
+class RequirerSchema(BaseModel):
+    """Requirer schema for Ingress."""
+
+    app: IngressRequirerAppData
+    unit: IngressRequirerUnitData
+
+
+class IngressError(RuntimeError):
+    """Base class for custom errors raised by this library."""
+
+
+class NotReadyError(IngressError):
+    """Raised when a relation is not ready."""
+
+
+class DataValidationError(IngressError):
+    """Raised when data validation fails on IPU relation data."""
+
+
+class _IngressPerAppBase(Object):
+    """Base class for IngressPerUnit interface classes."""
+
+    def __init__(self, charm: CharmBase, relation_name: str = DEFAULT_RELATION_NAME):
+        super().__init__(charm, relation_name)
+
+        self.charm: CharmBase = charm
+        self.relation_name = relation_name
+        self.app = self.charm.app
+        self.unit = self.charm.unit
+
+        observe = self.framework.observe
+        rel_events = charm.on[relation_name]
+        observe(rel_events.relation_created, self._handle_relation)
+        observe(rel_events.relation_joined, self._handle_relation)
+        observe(rel_events.relation_changed, self._handle_relation)
+        observe(rel_events.relation_broken, self._handle_relation_broken)
+        observe(charm.on.leader_elected, self._handle_upgrade_or_leader)  # type: ignore
+        observe(charm.on.upgrade_charm, self._handle_upgrade_or_leader)  # type: ignore
+
+    @property
+    def relations(self):
+        """The list of Relation instances associated with this endpoint."""
+        return list(self.charm.model.relations[self.relation_name])
+
+    def _handle_relation(self, event):
+        """Subclasses should implement this method to handle a relation update."""
+        pass
+
+    def _handle_relation_broken(self, event):
+        """Subclasses should implement this method to handle a relation breaking."""
+        pass
+
+    def _handle_upgrade_or_leader(self, event):
+        """Subclasses should implement this method to handle upgrades or leadership change."""
+        pass
+
+
+class _IPAEvent(RelationEvent):
+    __args__: Tuple[str, ...] = ()
+    __optional_kwargs__: Dict[str, Any] = {}
+
+    @classmethod
+    def __attrs__(cls):
+        return cls.__args__ + tuple(cls.__optional_kwargs__.keys())
+
+    def __init__(self, handle, relation, *args, **kwargs):
+        super().__init__(handle, relation)
+
+        if not len(self.__args__) == len(args):
+            raise TypeError("expected {} args, got {}".format(len(self.__args__), len(args)))
+
+        for attr, obj in zip(self.__args__, args):
+            setattr(self, attr, obj)
+        for attr, default in self.__optional_kwargs__.items():
+            obj = kwargs.get(attr, default)
+            setattr(self, attr, obj)
+
+    def snapshot(self):
+        dct = super().snapshot()
+        for attr in self.__attrs__():
+            obj = getattr(self, attr)
+            try:
+                dct[attr] = obj
+            except ValueError as e:
+                raise ValueError(
+                    "cannot automagically serialize {}: "
+                    "override this method and do it "
+                    "manually.".format(obj)
+                ) from e
+
+        return dct
+
+    def restore(self, snapshot) -> None:
+        super().restore(snapshot)
+        for attr, obj in snapshot.items():
+            setattr(self, attr, obj)
+
+
+class IngressPerAppDataProvidedEvent(_IPAEvent):
+    """Event representing that ingress data has been provided for an app."""
+
+    __args__ = ("name", "model", "hosts", "strip_prefix", "redirect_https")
+
+    if typing.TYPE_CHECKING:
+        name: Optional[str] = None
+        model: Optional[str] = None
+        # sequence of hostname, port dicts
+        hosts: Sequence["IngressRequirerUnitData"] = ()
+        strip_prefix: bool = False
+        redirect_https: bool = False
+
+
+class IngressPerAppDataRemovedEvent(RelationEvent):
+    """Event representing that ingress data has been removed for an app."""
+
+
+class IngressPerAppProviderEvents(ObjectEvents):
+    """Container for IPA Provider events."""
+
+    data_provided = EventSource(IngressPerAppDataProvidedEvent)
+    data_removed = EventSource(IngressPerAppDataRemovedEvent)
+
+
+@dataclass
+class IngressRequirerData:
+    """Data exposed by the ingress requirer to the provider."""
+
+    app: "IngressRequirerAppData"
+    units: List["IngressRequirerUnitData"]
+
+
+class TlsProviderType(typing.Protocol):
+    """Placeholder."""
+
+    @property
+    def enabled(self) -> bool:  # type: ignore
+        """Placeholder."""
+
+
+class IngressPerAppProvider(_IngressPerAppBase):
+    """Implementation of the provider of ingress."""
+
+    on = IngressPerAppProviderEvents()  # type: ignore
+
+    def __init__(
+        self,
+        charm: CharmBase,
+        relation_name: str = DEFAULT_RELATION_NAME,
+    ):
+        """Constructor for IngressPerAppProvider.
+
+        Args:
+            charm: The charm that is instantiating the instance.
+            relation_name: The name of the relation endpoint to bind to
+                (defaults to "ingress").
+        """
+        super().__init__(charm, relation_name)
+
+    def _handle_relation(self, event):
+        # created, joined or changed: if remote side has sent the required data:
+        # notify listeners.
+        if self.is_ready(event.relation):
+            data = self.get_data(event.relation)
+            self.on.data_provided.emit(  # type: ignore
+                event.relation,
+                data.app.name,
+                data.app.model,
+                [unit.dict() for unit in data.units],
+                data.app.strip_prefix or False,
+                data.app.redirect_https or False,
+            )
+
+    def _handle_relation_broken(self, event):
+        self.on.data_removed.emit(event.relation)  # type: ignore
+
+    def wipe_ingress_data(self, relation: Relation):
+        """Clear ingress data from relation."""
+        assert self.unit.is_leader(), "only leaders can do this"
+        try:
+            relation.data
+        except ModelError as e:
+            log.warning(
+                "error {} accessing relation data for {!r}. "
+                "Probably a ghost of a dead relation is still "
+                "lingering around.".format(e, relation.name)
+            )
+            return
+        del relation.data[self.app]["ingress"]
+
+    def _get_requirer_units_data(self, relation: Relation) -> List["IngressRequirerUnitData"]:
+        """Fetch and validate the requirer's app databag."""
+        out: List["IngressRequirerUnitData"] = []
+
+        unit: Unit
+        for unit in relation.units:
+            databag = relation.data[unit]
+            try:
+                data = IngressRequirerUnitData.load(databag)
+                out.append(data)
+            except pydantic.ValidationError:
+                log.info(f"failed to validate remote unit data for {unit}")
+                raise
+        return out
+
+    @staticmethod
+    def _get_requirer_app_data(relation: Relation) -> "IngressRequirerAppData":
+        """Fetch and validate the requirer's app databag."""
+        app = relation.app
+        if app is None:
+            raise NotReadyError(relation)
+
+        databag = relation.data[app]
+        return IngressRequirerAppData.load(databag)
+
+    def get_data(self, relation: Relation) -> IngressRequirerData:
+        """Fetch the remote (requirer) app and units' databags."""
+        try:
+            return IngressRequirerData(
+                self._get_requirer_app_data(relation), self._get_requirer_units_data(relation)
+            )
+        except (pydantic.ValidationError, DataValidationError, json.JSONDecodeError) as e:
+            raise DataValidationError("failed to validate ingress requirer data") from e
+
+    def is_ready(self, relation: Optional[Relation] = None):
+        """The Provider is ready if the requirer has sent valid data."""
+        if not relation:
+            return any(map(self.is_ready, self.relations))
+
+        try:
+            self.get_data(relation)
+        except (DataValidationError, NotReadyError) as e:
+            log.debug("Provider not ready; validation error encountered: %s" % str(e))
+            return False
+        return True
+
+    def _published_url(self, relation: Relation) -> Optional["IngressProviderAppData"]:
+        """Fetch and validate this app databag; return the ingress url."""
+        if not self.is_ready(relation) or not self.unit.is_leader():
+            # Handle edge case where remote app name can be missing, e.g.,
+            # relation_broken events.
+            # Also, only leader units can read own app databags.
+            # FIXME https://github.com/canonical/traefik-k8s-operator/issues/34
+            return None
+
+        # fetch the provider's app databag
+        databag = relation.data[self.app]
+        if not databag.get("ingress"):
+            raise NotReadyError("This application did not `publish_url` yet.")
+
+        return IngressProviderAppData.load(databag)
+
+    def publish_url(self, relation: Relation, url: str):
+        """Publish to the app databag the ingress url."""
+        ingress_url = {"url": url}
+        IngressProviderAppData.parse_obj({"ingress": ingress_url}).dump(relation.data[self.app])
+
+    @property
+    def proxied_endpoints(self) -> Dict[str, str]:
+        """Returns the ingress settings provided to applications by this IngressPerAppProvider.
+
+        For example, when this IngressPerAppProvider has provided the
+        `http://foo.bar/my-model.my-app` URL to the my-app application, the returned dictionary
+        will be:
+
+        ```
+        {
+            "my-app": {
+                "url": "http://foo.bar/my-model.my-app"
+            }
+        }
+        ```
+        """
+        results = {}
+
+        for ingress_relation in self.relations:
+            if not ingress_relation.app:
+                log.warning(
+                    f"no app in relation {ingress_relation} when fetching proxied endpoints: skipping"
+                )
+                continue
+            try:
+                ingress_data = self._published_url(ingress_relation)
+            except NotReadyError:
+                log.warning(
+                    f"no published url found in {ingress_relation}: "
+                    f"traefik didn't publish_url yet to this relation."
+                )
+                continue
+
+            if not ingress_data:
+                log.warning(f"relation {ingress_relation} not ready yet: try again in some time.")
+                continue
+
+            results[ingress_relation.app.name] = ingress_data.ingress.dict()
+        return results
+
+
+class IngressPerAppReadyEvent(_IPAEvent):
+    """Event representing that ingress for an app is ready."""
+
+    __args__ = ("url",)
+    if typing.TYPE_CHECKING:
+        url: Optional[str] = None
+
+
+class IngressPerAppRevokedEvent(RelationEvent):
+    """Event representing that ingress for an app has been revoked."""
+
+
+class IngressPerAppRequirerEvents(ObjectEvents):
+    """Container for IPA Requirer events."""
+
+    ready = EventSource(IngressPerAppReadyEvent)
+    revoked = EventSource(IngressPerAppRevokedEvent)
+
+
+class IngressPerAppRequirer(_IngressPerAppBase):
+    """Implementation of the requirer of the ingress relation."""
+
+    on = IngressPerAppRequirerEvents()  # type: ignore
+
+    # used to prevent spurious urls to be sent out if the event we're currently
+    # handling is a relation-broken one.
+    _stored = StoredState()
+
+    def __init__(
+        self,
+        charm: CharmBase,
+        relation_name: str = DEFAULT_RELATION_NAME,
+        *,
+        host: Optional[str] = None,
+        port: Optional[int] = None,
+        strip_prefix: bool = False,
+        redirect_https: bool = False,
+        # fixme: this is horrible UX.
+        #  shall we switch to manually calling provide_ingress_requirements with all args when ready?
+        scheme: typing.Callable[[], str] = lambda: "http",
+    ):
+        """Constructor for IngressRequirer.
+
+        The request args can be used to specify the ingress properties when the
+        instance is created. If any are set, at least `port` is required, and
+        they will be sent to the ingress provider as soon as it is available.
+        All request args must be given as keyword args.
+
+        Args:
+            charm: the charm that is instantiating the library.
+            relation_name: the name of the relation endpoint to bind to (defaults to `ingress`);
+                relation must be of interface type `ingress` and have "limit: 1")
+            host: Hostname to be used by the ingress provider to address the requiring
+                application; if unspecified, the default Kubernetes service name will be used.
+            strip_prefix: configure Traefik to strip the path prefix.
+            redirect_https: redirect incoming requests to HTTPS.
+            scheme: callable returning the scheme to use when constructing the ingress url.
+
+        Request Args:
+            port: the port of the service
+        """
+        super().__init__(charm, relation_name)
+        self.charm: CharmBase = charm
+        self.relation_name = relation_name
+        self._strip_prefix = strip_prefix
+        self._redirect_https = redirect_https
+        self._get_scheme = scheme
+
+        self._stored.set_default(current_url=None)  # type: ignore
+
+        # if instantiated with a port, and we are related, then
+        # we immediately publish our ingress data  to speed up the process.
+        if port:
+            self._auto_data = host, port
+        else:
+            self._auto_data = None
+
+    def _handle_relation(self, event):
+        # created, joined or changed: if we have auto data: publish it
+        self._publish_auto_data(event.relation)
+
+        if self.is_ready():
+            # Avoid spurious events, emit only when there is a NEW URL available
+            new_url = (
+                None
+                if isinstance(event, RelationBrokenEvent)
+                else self._get_url_from_relation_data()
+            )
+            if self._stored.current_url != new_url:  # type: ignore
+                self._stored.current_url = new_url  # type: ignore
+                self.on.ready.emit(event.relation, new_url)  # type: ignore
+
+    def _handle_relation_broken(self, event):
+        self._stored.current_url = None  # type: ignore
+        self.on.revoked.emit(event.relation)  # type: ignore
+
+    def _handle_upgrade_or_leader(self, event):
+        """On upgrade/leadership change: ensure we publish the data we have."""
+        for relation in self.relations:
+            self._publish_auto_data(relation)
+
+    def is_ready(self):
+        """The Requirer is ready if the Provider has sent valid data."""
+        try:
+            return bool(self._get_url_from_relation_data())
+        except DataValidationError as e:
+            log.debug("Requirer not ready; validation error encountered: %s" % str(e))
+            return False
+
+    def _publish_auto_data(self, relation: Relation):
+        if self._auto_data:
+            host, port = self._auto_data
+            self.provide_ingress_requirements(host=host, port=port)
+
+    def provide_ingress_requirements(self, *, host: Optional[str] = None, port: int):
+        """Publishes the data that Traefik needs to provide ingress.
+
+        Args:
+            host: Hostname to be used by the ingress provider to address the
+             requirer unit; if unspecified, FQDN will be used instead
+            port: the port of the service (required)
+        """
+        # get only the leader to publish the data since we only
+        # require one unit to publish it -- it will not differ between units,
+        # unlike in ingress-per-unit.
+        assert self.relation, "no relation"
+
+        if self.unit.is_leader():
+            app_databag = self.relation.data[self.app]
+            try:
+                IngressRequirerAppData(  # type: ignore  # pyright does not like aliases
+                    model=self.model.name,
+                    name=self.app.name,
+                    scheme=self._get_scheme(),
+                    port=port,
+                    strip_prefix=self._strip_prefix,  # type: ignore  # pyright does not like aliases
+                    redirect_https=self._redirect_https,  # type: ignore  # pyright does not like aliases
+                ).dump(app_databag)
+            except pydantic.ValidationError as e:
+                msg = "failed to validate app data"
+                log.info(msg, exc_info=True)  # log to INFO because this might be expected
+                raise DataValidationError(msg) from e
+
+        if not host:
+            host = socket.getfqdn()
+
+        unit_databag = self.relation.data[self.unit]
+        try:
+            IngressRequirerUnitData(host=host).dump(unit_databag)
+        except pydantic.ValidationError as e:
+            msg = "failed to validate unit data"
+            log.info(msg, exc_info=True)  # log to INFO because this might be expected
+            raise DataValidationError(msg) from e
+
+    @property
+    def relation(self):
+        """The established Relation instance, or None."""
+        return self.relations[0] if self.relations else None
+
+    def _get_url_from_relation_data(self) -> Optional[str]:
+        """The full ingress URL to reach the current unit.
+
+        Returns None if the URL isn't available yet.
+        """
+        relation = self.relation
+        if not relation or not relation.app:
+            return None
+
+        # fetch the provider's app databag
+        try:
+            databag = relation.data[relation.app]
+        except ModelError as e:
+            log.debug(
+                f"Error {e} attempting to read remote app data; "
+                f"probably we are in a relation_departed hook"
+            )
+            return None
+
+        if not databag:  # not ready yet
+            return None
+
+        return str(IngressProviderAppData.load(databag).ingress.url)
+
+    @property
+    def url(self) -> Optional[str]:
+        """The full ingress URL to reach the current unit.
+
+        Returns None if the URL isn't available yet.
+        """
+        data = (
+            typing.cast(Optional[str], self._stored.current_url)  # type: ignore
+            or self._get_url_from_relation_data()
+        )
+        return data
diff --git a/vm_operator/lib/ratings_api/ratings_features_app_pb2.py b/vm_operator/lib/ratings_api/ratings_features_app_pb2.py
new file mode 100644
index 0000000..87f4427
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_app_pb2.py
@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: ratings_features_app.proto
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1aratings_features_app.proto\x12\x14ratings.features.app\"\x1e\n\x0fGetVotesRequest\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\"Q\n\x10GetVotesResponse\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\x12\x16\n\x0etotal_up_votes\x18\x02 \x01(\x04\x12\x18\n\x10total_down_votes\x18\x03 \x01(\x04\x32\x62\n\x03\x41pp\x12[\n\x08GetVotes\x12%.ratings.features.app.GetVotesRequest\x1a&.ratings.features.app.GetVotesResponse\"\x00\x62\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_app_pb2', _globals)
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+  DESCRIPTOR._options = None
+  _globals['_GETVOTESREQUEST']._serialized_start=52
+  _globals['_GETVOTESREQUEST']._serialized_end=82
+  _globals['_GETVOTESRESPONSE']._serialized_start=84
+  _globals['_GETVOTESRESPONSE']._serialized_end=165
+  _globals['_APP']._serialized_start=167
+  _globals['_APP']._serialized_end=265
+# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
new file mode 100644
index 0000000..10013ef
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
@@ -0,0 +1,66 @@
+# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
+"""Client and server classes corresponding to protobuf-defined services."""
+import grpc
+
+import ratings_features_app_pb2 as ratings__features__app__pb2
+
+
+class AppStub(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def __init__(self, channel):
+        """Constructor.
+
+        Args:
+            channel: A grpc.Channel.
+        """
+        self.GetVotes = channel.unary_unary(
+                '/ratings.features.app.App/GetVotes',
+                request_serializer=ratings__features__app__pb2.GetVotesRequest.SerializeToString,
+                response_deserializer=ratings__features__app__pb2.GetVotesResponse.FromString,
+                )
+
+
+class AppServicer(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def GetVotes(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+
+def add_AppServicer_to_server(servicer, server):
+    rpc_method_handlers = {
+            'GetVotes': grpc.unary_unary_rpc_method_handler(
+                    servicer.GetVotes,
+                    request_deserializer=ratings__features__app__pb2.GetVotesRequest.FromString,
+                    response_serializer=ratings__features__app__pb2.GetVotesResponse.SerializeToString,
+            ),
+    }
+    generic_handler = grpc.method_handlers_generic_handler(
+            'ratings.features.app.App', rpc_method_handlers)
+    server.add_generic_rpc_handlers((generic_handler,))
+
+
+ # This class is part of an EXPERIMENTAL API.
+class App(object):
+    """Missing associated documentation comment in .proto file."""
+
+    @staticmethod
+    def GetVotes(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.app.App/GetVotes',
+            ratings__features__app__pb2.GetVotesRequest.SerializeToString,
+            ratings__features__app__pb2.GetVotesResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py b/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
new file mode 100644
index 0000000..7f64359
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: ratings_features_chart.proto
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1cratings_features_chart.proto\x12\x16ratings.features.chart\"x\n\x0fGetChartRequest\x12\x34\n\ttimeframe\x18\x01 \x01(\x0e\x32!.ratings.features.chart.Timeframe\x12/\n\x04type\x18\x02 \x01(\x0e\x32!.ratings.features.chart.ChartType\"\xb8\x01\n\x10GetChartResponse\x12\x34\n\ttimeframe\x18\x01 \x01(\x0e\x32!.ratings.features.chart.Timeframe\x12/\n\x04type\x18\x02 \x01(\x0e\x32!.ratings.features.chart.ChartType\x12=\n\x12ordered_chart_data\x18\x03 \x03(\x0b\x32!.ratings.features.chart.ChartData\"J\n\tChartData\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\x12\x16\n\x0etotal_up_votes\x18\x02 \x01(\x04\x12\x18\n\x10total_down_votes\x18\x03 \x01(\x04*?\n\tChartType\x12\x1e\n\x1a\x43HART_TYPE_TOP_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x43HART_TYPE_TOP\x10\x01*O\n\tTimeframe\x12\x19\n\x15TIMEFRAME_UNSPECIFIED\x10\x00\x12\x12\n\x0eTIMEFRAME_WEEK\x10\x01\x12\x13\n\x0fTIMEFRAME_MONTH\x10\x02\x32h\n\x05\x43hart\x12_\n\x08GetChart\x12\'.ratings.features.chart.GetChartRequest\x1a(.ratings.features.chart.GetChartResponse\"\x00\x62\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_chart_pb2', _globals)
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+  DESCRIPTOR._options = None
+  _globals['_CHARTTYPE']._serialized_start=441
+  _globals['_CHARTTYPE']._serialized_end=504
+  _globals['_TIMEFRAME']._serialized_start=506
+  _globals['_TIMEFRAME']._serialized_end=585
+  _globals['_GETCHARTREQUEST']._serialized_start=56
+  _globals['_GETCHARTREQUEST']._serialized_end=176
+  _globals['_GETCHARTRESPONSE']._serialized_start=179
+  _globals['_GETCHARTRESPONSE']._serialized_end=363
+  _globals['_CHARTDATA']._serialized_start=365
+  _globals['_CHARTDATA']._serialized_end=439
+  _globals['_CHART']._serialized_start=587
+  _globals['_CHART']._serialized_end=691
+# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
new file mode 100644
index 0000000..d606c52
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
@@ -0,0 +1,66 @@
+# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
+"""Client and server classes corresponding to protobuf-defined services."""
+import grpc
+
+import ratings_features_chart_pb2 as ratings__features__chart__pb2
+
+
+class ChartStub(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def __init__(self, channel):
+        """Constructor.
+
+        Args:
+            channel: A grpc.Channel.
+        """
+        self.GetChart = channel.unary_unary(
+                '/ratings.features.chart.Chart/GetChart',
+                request_serializer=ratings__features__chart__pb2.GetChartRequest.SerializeToString,
+                response_deserializer=ratings__features__chart__pb2.GetChartResponse.FromString,
+                )
+
+
+class ChartServicer(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def GetChart(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+
+def add_ChartServicer_to_server(servicer, server):
+    rpc_method_handlers = {
+            'GetChart': grpc.unary_unary_rpc_method_handler(
+                    servicer.GetChart,
+                    request_deserializer=ratings__features__chart__pb2.GetChartRequest.FromString,
+                    response_serializer=ratings__features__chart__pb2.GetChartResponse.SerializeToString,
+            ),
+    }
+    generic_handler = grpc.method_handlers_generic_handler(
+            'ratings.features.chart.Chart', rpc_method_handlers)
+    server.add_generic_rpc_handlers((generic_handler,))
+
+
+ # This class is part of an EXPERIMENTAL API.
+class Chart(object):
+    """Missing associated documentation comment in .proto file."""
+
+    @staticmethod
+    def GetChart(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.chart.Chart/GetChart',
+            ratings__features__chart__pb2.GetChartRequest.SerializeToString,
+            ratings__features__chart__pb2.GetChartResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
new file mode 100644
index 0000000..3d29a11
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: ratings_features_user.proto
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1bratings_features_user.proto\x12\x15ratings.features.user\x1a\x1bgoogle/protobuf/empty.proto\"\x1d\n\x0fRegisterRequest\x12\n\n\x02id\x18\x01 \x01(\t\"!\n\x10RegisterResponse\x12\r\n\x05token\x18\x01 \x01(\t\"!\n\x13\x41uthenticateRequest\x12\n\n\x02id\x18\x01 \x01(\t\"%\n\x14\x41uthenticateResponse\x12\r\n\x05token\x18\x01 \x01(\t\"\x1f\n\x10ListVotesRequest\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\"_\n\x11ListVotesResponse\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\t\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x12\x11\n\ttimestamp\x18\x04 \x01(\x03\"F\n\x0bVoteRequest\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\x05\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x32\xb4\x03\n\x04User\x12]\n\x08Register\x12&.ratings.features.user.RegisterRequest\x1a\'.ratings.features.user.RegisterResponse\"\x00\x12i\n\x0c\x41uthenticate\x12*.ratings.features.user.AuthenticateRequest\x1a+.ratings.features.user.AuthenticateResponse\"\x00\x12:\n\x06\x44\x65lete\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\"\x00\x12\x44\n\x04Vote\x12\".ratings.features.user.VoteRequest\x1a\x16.google.protobuf.Empty\"\x00\x12`\n\tListVotes\x12\'.ratings.features.user.ListVotesRequest\x1a(.ratings.features.user.ListVotesResponse\"\x00\x62\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_user_pb2', _globals)
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+  DESCRIPTOR._options = None
+  _globals['_REGISTERREQUEST']._serialized_start=83
+  _globals['_REGISTERREQUEST']._serialized_end=112
+  _globals['_REGISTERRESPONSE']._serialized_start=114
+  _globals['_REGISTERRESPONSE']._serialized_end=147
+  _globals['_AUTHENTICATEREQUEST']._serialized_start=149
+  _globals['_AUTHENTICATEREQUEST']._serialized_end=182
+  _globals['_AUTHENTICATERESPONSE']._serialized_start=184
+  _globals['_AUTHENTICATERESPONSE']._serialized_end=221
+  _globals['_LISTVOTESREQUEST']._serialized_start=223
+  _globals['_LISTVOTESREQUEST']._serialized_end=254
+  _globals['_LISTVOTESRESPONSE']._serialized_start=256
+  _globals['_LISTVOTESRESPONSE']._serialized_end=351
+  _globals['_VOTEREQUEST']._serialized_start=353
+  _globals['_VOTEREQUEST']._serialized_end=423
+  _globals['_USER']._serialized_start=426
+  _globals['_USER']._serialized_end=862
+# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
new file mode 100644
index 0000000..bdb5ae7
--- /dev/null
+++ b/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
@@ -0,0 +1,199 @@
+# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
+"""Client and server classes corresponding to protobuf-defined services."""
+import grpc
+
+from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
+import ratings_features_user_pb2 as ratings__features__user__pb2
+
+
+class UserStub(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def __init__(self, channel):
+        """Constructor.
+
+        Args:
+            channel: A grpc.Channel.
+        """
+        self.Register = channel.unary_unary(
+                '/ratings.features.user.User/Register',
+                request_serializer=ratings__features__user__pb2.RegisterRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.RegisterResponse.FromString,
+                )
+        self.Authenticate = channel.unary_unary(
+                '/ratings.features.user.User/Authenticate',
+                request_serializer=ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.AuthenticateResponse.FromString,
+                )
+        self.Delete = channel.unary_unary(
+                '/ratings.features.user.User/Delete',
+                request_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                )
+        self.Vote = channel.unary_unary(
+                '/ratings.features.user.User/Vote',
+                request_serializer=ratings__features__user__pb2.VoteRequest.SerializeToString,
+                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                )
+        self.ListVotes = channel.unary_unary(
+                '/ratings.features.user.User/ListVotes',
+                request_serializer=ratings__features__user__pb2.ListVotesRequest.SerializeToString,
+                response_deserializer=ratings__features__user__pb2.ListVotesResponse.FromString,
+                )
+
+
+class UserServicer(object):
+    """Missing associated documentation comment in .proto file."""
+
+    def Register(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def Authenticate(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def Delete(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def Vote(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def ListVotes(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+
+def add_UserServicer_to_server(servicer, server):
+    rpc_method_handlers = {
+            'Register': grpc.unary_unary_rpc_method_handler(
+                    servicer.Register,
+                    request_deserializer=ratings__features__user__pb2.RegisterRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.RegisterResponse.SerializeToString,
+            ),
+            'Authenticate': grpc.unary_unary_rpc_method_handler(
+                    servicer.Authenticate,
+                    request_deserializer=ratings__features__user__pb2.AuthenticateRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.AuthenticateResponse.SerializeToString,
+            ),
+            'Delete': grpc.unary_unary_rpc_method_handler(
+                    servicer.Delete,
+                    request_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            ),
+            'Vote': grpc.unary_unary_rpc_method_handler(
+                    servicer.Vote,
+                    request_deserializer=ratings__features__user__pb2.VoteRequest.FromString,
+                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            ),
+            'ListVotes': grpc.unary_unary_rpc_method_handler(
+                    servicer.ListVotes,
+                    request_deserializer=ratings__features__user__pb2.ListVotesRequest.FromString,
+                    response_serializer=ratings__features__user__pb2.ListVotesResponse.SerializeToString,
+            ),
+    }
+    generic_handler = grpc.method_handlers_generic_handler(
+            'ratings.features.user.User', rpc_method_handlers)
+    server.add_generic_rpc_handlers((generic_handler,))
+
+
+ # This class is part of an EXPERIMENTAL API.
+class User(object):
+    """Missing associated documentation comment in .proto file."""
+
+    @staticmethod
+    def Register(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Register',
+            ratings__features__user__pb2.RegisterRequest.SerializeToString,
+            ratings__features__user__pb2.RegisterResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def Authenticate(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Authenticate',
+            ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
+            ratings__features__user__pb2.AuthenticateResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def Delete(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Delete',
+            google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
+            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def Vote(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Vote',
+            ratings__features__user__pb2.VoteRequest.SerializeToString,
+            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
+    @staticmethod
+    def ListVotes(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/ListVotes',
+            ratings__features__user__pb2.ListVotesRequest.SerializeToString,
+            ratings__features__user__pb2.ListVotesResponse.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/metadata.yaml b/vm_operator/metadata.yaml
new file mode 100644
index 0000000..e3e66fe
--- /dev/null
+++ b/vm_operator/metadata.yaml
@@ -0,0 +1,22 @@
+# This file populates the Overview on Charmhub.
+# See https://juju.is/docs/sdk/metadata-reference for a checklist and guidance.
+
+name: ubuntu-software-ratings
+display-name: Ubuntu Software Ratings
+
+summary: Ubuntu App Ratings Service
+
+description: |
+  Backend service to support application ratings in the new Ubuntu Software Centre.
+
+assumes:
+  - juju >= 3.1
+
+requires:
+  database:
+    interface: postgresql_client
+    limit: 1
+
+peers:
+  ratings-peers:
+    interface: ratings_peers
diff --git a/vm_operator/pyproject.toml b/vm_operator/pyproject.toml
new file mode 100644
index 0000000..d352535
--- /dev/null
+++ b/vm_operator/pyproject.toml
@@ -0,0 +1,43 @@
+# Testing tools configuration
+[tool.coverage.run]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+
+[tool.pytest.ini_options]
+minversion = "6.0"
+log_cli_level = "INFO"
+pythonpath = [ ".", "src", "lib/ratings_api" ]
+
+# Formatting tools configuration
+[tool.black]
+line-length = 99
+target-version = ["py38"]
+
+# Linting tools configuration
+[tool.ruff]
+line-length = 99
+select = ["E", "W", "F", "C", "N", "D", "I001"]
+extend-ignore = [
+    "D203",
+    "D204",
+    "D213",
+    "D215",
+    "D400",
+    "D404",
+    "D406",
+    "D407",
+    "D408",
+    "D409",
+    "D413",
+]
+ignore = ["E501", "D107"]
+extend-exclude = ["__pycache__", "*.egg_info", "*pb2.py", "*pb2_grpc.py"]
+per-file-ignores = {"tests/*" = ["D100","D101","D102","D103","D104"]}
+
+[tool.ruff.mccabe]
+max-complexity = 10
+
+[tool.codespell]
+skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage"
diff --git a/vm_operator/requirements.txt b/vm_operator/requirements.txt
new file mode 100644
index 0000000..d289e4e
--- /dev/null
+++ b/vm_operator/requirements.txt
@@ -0,0 +1,3 @@
+ops == 2.6.0
+psycopg[binary] >= 3.1.10
+GitPython==3.1.14
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
new file mode 100755
index 0000000..8176512
--- /dev/null
+++ b/vm_operator/src/charm.py
@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+# Copyright 2023 Canonical
+# See LICENSE file for licensing details.
+
+"""Ubuntu Software Centre ratings service.
+
+A backend service to support application ratings in the new Ubuntu Software Centre.
+"""
+
+import logging
+import secrets
+
+import ops
+
+from pathlib import Path
+from git import Repo
+import shutil
+from charms.operator_libs_linux.v0 import apt, systemd
+from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent, DatabaseRequires
+from ops.model import MaintenanceStatus, BlockedStatus, ActiveStatus
+from ops.framework import StoredState
+from subprocess import check_output, CalledProcessError
+import os
+from os import environ
+from jinja2 import Template
+
+logger = logging.getLogger(__name__)
+
+
+APP_PATH = Path("/srv/app")
+UNIT_PATH = Path("/etc/systemd/system/ratings.service")
+CARGO_PATH = Path(environ.get("HOME", "/root")) / ".cargo/bin/cargo"
+
+
+class RatingsCharm(ops.CharmBase):
+    """Main operator class for ratings service."""
+
+    _stored = StoredState()
+
+    def __init__(self, *args):
+        super().__init__(*args)
+        self._ratings_svc = None
+
+        # Initialise the integration with PostgreSQL
+        self._database = DatabaseRequires(self, relation_name="database", database_name="ratings")
+
+        self.framework.observe(self._database.on.database_created, self._on_database_created)
+        self.framework.observe(self.on.install, self._on_install)
+        self._stored.set_default(repo="", port="", conn_str="")
+        self.framework.observe(self.on.start, self._on_start)
+        self.framework.observe(self.on.pull_and_rebuild_action, self._on_pull_and_rebuild)
+
+        # self.framework.observe(self.on.config_changed, self._on_config_changed)
+    def _on_start(self, _):
+        """Start the workload"""
+        # Enable and start the "ratings" systemd unit
+        systemd.service_resume("ratings")
+        self.unit.status = ActiveStatus()
+
+    def _on_install(self, _):
+        """Install prerequisites for the application"""
+
+        self.unit.status = MaintenanceStatus("Installing rustc, cargo and other dependencies")
+
+        # Install what is avalible via apt
+        self._install_apt_packages(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
+
+        # curl minial rust toolchain
+        try:
+            check_output("curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal", shell=True)
+        except CalledProcessError as e:
+            logger.error(f"Curl command failed with error code {e.returncode}")
+            self.unit.status = BlockedStatus("Curl command failed")
+            return
+
+
+    def _render_systemd_unit(self):
+        with open("templates/ratings-service.j2", "r") as t:
+            template = Template(t.read())
+
+        # Get connection string from Juju relation to db
+        connection_string = self._db_connection_string()
+
+        # Generate jwt secret
+        jwt_secret = self._jwt_secret()
+        rendered = template.render(
+            project_root=APP_PATH,
+            app_env=self.config["app-env"],
+            app_host=self.config["app-host"],
+            app_jwt_secret=jwt_secret,
+            app_log_level=self.config["app-log-level"],
+            app_name=self.config["app-name"],
+            app_port=self.config["app-port"],
+            app_postgres_uri=connection_string,
+            app_migration_postgres_uri=connection_string
+        )
+        with open(UNIT_PATH, "w+") as t:
+            t.write(rendered)
+
+        os.chmod(UNIT_PATH, 0o755)
+        systemd.daemon_reload()
+
+    def _setup_application(self, _=None):
+        """Clone Rust application into place and setup it's dependencies"""
+        self.unit.status = MaintenanceStatus("fetching application code")
+
+        # Delete the application directory if it exists already
+        if Path(APP_PATH).is_dir():
+            shutil.rmtree("/srv/app")
+
+        # If this is the first time, set the repo in the stored state
+        if not self._stored.repo:
+            self._stored.repo = self.config["app-repo"]
+
+        # Fetch the code using git
+        Repo.clone_from(self._stored.repo, APP_PATH, branch='vm-charm')
+
+        try:
+            check_output([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH)
+        except CalledProcessError as e:
+            logger.error(f"Cargo build failed with error code {e.returncode}")
+            self.unit.status = BlockedStatus("Cargo build failed")
+            return
+
+    def _on_database_created(self, _: DatabaseCreatedEvent):
+        """Handle the database creation event."""
+        logger.info("Database created event triggered.")
+        logger.info("Starting ratings service.")
+        self._setup_application()
+        self._render_systemd_unit()
+        self._start_ratings()
+
+    def _start_ratings(self):
+        """Start the ratings service using systemd."""
+        logger.info("Attempting to start ratings service.")
+
+        if self.model.get_relation("database") is None:
+            logger.warning("No database relation found. Waiting.")
+            self.unit.status = ops.WaitingStatus("Waiting for database relation")
+            return
+
+        try:
+            logger.info("Resuming systemd service for ratings.")
+            systemd.service_resume("ratings")
+            self.unit.open_port(protocol="tcp", port=443)
+            self.unit.status = ops.ActiveStatus()
+            logger.info("Ratings service started successfully.")
+        except Exception as e:
+            logger.error(f"Failed to start ratings service: {str(e)}")
+            self.unit.status = ops.BlockedStatus(f"Failed to start ratings service: {str(e)}")
+
+    def _db_connection_string(self) -> str:
+        """Report database connection string using info from relation databag."""
+        logger.info("Attempting to generate database connection string.")
+
+        relation = self.model.get_relation("database")
+
+        if not relation:
+            logger.warning("Database relation not found. Returning empty connection string.")
+            return ""
+
+        data = self._database.fetch_relation_data()[relation.id]
+        username = data.get("username")
+        password = data.get("password")
+        endpoints = data.get("endpoints")
+
+        if username and password and endpoints:
+            connection_string = f"postgres://{username}:{password}@{endpoints}/ratings"
+            logger.info(f"Generated database connection string with endpoints: {endpoints}.")
+            return connection_string
+        else:
+            logger.warning("Missing database relation data. Cannot generate connection string.")
+            return ""
+
+    def _jwt_secret(self) -> str:
+        """Report the apps JWT secret; create one if it doesn't exist."""
+        # If the peer relation is not ready, just return an empty string
+        relation = self.model.get_relation("ratings-peers")
+        if not relation:
+            return ""
+
+        # If the secret already exists, grab its content and return it
+        secret_id = relation.data[self.app].get("jwt-secret-id", None)
+        if secret_id:
+            secret = self.model.get_secret(id=secret_id)
+            return secret.peek_content().get("jwt-secret")
+
+        if self.unit.is_leader():
+            logger.info("Creating a new JWT secret")
+            content = {"jwt-secret": secrets.token_hex(24)}
+            secret = self.app.add_secret(content)
+            # Store the secret id in the peer relation for other units if required
+            relation.data[self.app]["jwt-secret-id"] = secret.id
+            return content["jwt-secret"]
+        else:
+            return ""
+
+    def _install_apt_packages(self, packages: list):
+        """Simple wrapper around 'apt-get install -y"""
+        try:
+            apt.update()
+            apt.add_package(packages)
+        except apt.PackageNotFoundError:
+            logger.error("a specified package not found in package cache or on system")
+            self.unit.status = BlockedStatus("Failed to install packages")
+        except apt.PackageError:
+            logger.error("could not install package")
+            self.unit.status = BlockedStatus("Failed to install packages")
+
+    def _on_pull_and_rebuild(self, event):
+        event.set_results({"status": "pulling and rebuilding"})
+        try:
+            # Pull new code
+            repo = Repo(APP_PATH)
+            repo.remotes.origin.pull()
+
+            # Rebuild the application
+            check_output([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH)
+            systemd.service_restart("ratings")
+
+            event.set_results({"status": "successful"})
+        except Exception as e:
+            event.fail(f"Failed: {str(e)}")
+            self.unit.status = BlockedStatus(f"Pull and rebuild failed: {str(e)}")
+
+
+if __name__ == "__main__":  # pragma: nocover
+    ops.main(RatingsCharm)
diff --git a/vm_operator/templates/ratings-service.j2 b/vm_operator/templates/ratings-service.j2
new file mode 100644
index 0000000..6e88987
--- /dev/null
+++ b/vm_operator/templates/ratings-service.j2
@@ -0,0 +1,25 @@
+[Unit]
+Description=App Center Ratings Service
+After=network.target
+
+[Service]
+Environment="APP_ENV={{ app_env }}"
+Environment="APP_HOST={{ app_host }}"
+Environment="APP_JWT_SECRET={{ app_jwt_secret }}"
+Environment="APP_LOG_LEVEL={{ app_log_level }}"
+Environment="APP_NAME={{ app_name }}"
+Environment="APP_PORT={{ app_port }}"
+Environment="APP_POSTGRES_URI={{ app_postgres_uri }}"
+Environment="APP_MIGRATION_POSTGRES_URI={{ app_migration_postgres_uri }}"
+WorkingDirectory = {{ project_root }}
+Restart = always
+RestartSec = 5
+ExecStart={{ project_root }}/target/release/ratings
+ExecReload = /bin/kill -s HUP $MAINPID
+ExecStop = /bin/kill -s TERM $MAINPID
+ExecStartPre = /bin/mkdir {{ project_root }}/run
+PIDFile = {{ project_root }}/run/hello-juju.pid
+ExecStopPost = /bin/rm -rf {{ project_root }}/run
+
+[Install]
+WantedBy = multi-user.target
diff --git a/vm_operator/tests/integration/test_charm.py b/vm_operator/tests/integration/test_charm.py
new file mode 100644
index 0000000..e13a320
--- /dev/null
+++ b/vm_operator/tests/integration/test_charm.py
@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+# Copyright 2023 Canonical
+# See LICENSE file for licensing details.
+
+import asyncio
+import json
+import logging
+import os
+import secrets
+from pathlib import Path
+
+import grpc
+import pytest
+import ratings_api.ratings_features_user_pb2 as pb2
+import ratings_api.ratings_features_user_pb2_grpc as pb2_grpc
+import yaml
+from pytest import mark
+from pytest_operator.plugin import OpsTest
+
+logger = logging.getLogger(__name__)
+
+METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
+RATINGS = "ratings"
+DB = "db"
+TRAEFIK = "traefik"
+
+
+@pytest.mark.abort_on_fail
+async def test_build_and_deploy(ops_test: OpsTest):
+    """Build the charm-under-test and deploy it together with related charms.
+
+    Assert on the unit status before any relations/configurations take place.
+    """
+    # Build and deploy charm from local source folder
+    charm = await ops_test.build_charm(".")
+    resources = {"ratings-image": METADATA["resources"]["ratings-image"]["upstream-source"]}
+
+    # Deploy the charm and wait for active/idle status
+    await asyncio.gather(
+        ops_test.model.deploy(charm, resources=resources, application_name=RATINGS, trust=True),
+        ops_test.model.wait_for_idle(
+            apps=[RATINGS], status="waiting", raise_on_blocked=True, timeout=1000
+        ),
+    )
+
+
+@mark.abort_on_fail
+async def test_database_relation(ops_test: OpsTest):
+    """Test that the charm can be successfully related to PostgreSQL."""
+    await asyncio.gather(
+        ops_test.model.deploy(
+            "postgresql-k8s", channel="14/edge", application_name=DB, trust=True
+        ),
+        ops_test.model.wait_for_idle(
+            apps=[DB], status="active", raise_on_blocked=True, timeout=1000
+        ),
+    )
+
+    await asyncio.gather(
+        ops_test.model.integrate(RATINGS, DB),
+        ops_test.model.wait_for_idle(
+            apps=[RATINGS], status="active", raise_on_blocked=True, timeout=1000
+        ),
+    )
+
+
+@mark.abort_on_fail
+async def test_ratings_scale(ops_test: OpsTest):
+    """Test that the charm can be scaled out and still talk to the database."""
+    await asyncio.gather(
+        ops_test.model.applications[RATINGS].scale(2),
+        ops_test.model.wait_for_idle(
+            apps=[RATINGS],
+            status="active",
+            timeout=1000,
+            wait_for_exact_units=2,
+        ),
+    )
+
+
+@mark.abort_on_fail
+async def test_ratings_register_user(ops_test: OpsTest):
+    """End-to-end test to ensure the app can interact with the database."""
+    status = await ops_test.model.get_status()  # noqa: F821
+    address = status["applications"][RATINGS]["public-address"]
+
+    channel = grpc.insecure_channel(f"{address}:18080")
+    stub = pb2_grpc.UserStub(channel)
+    message = pb2.RegisterRequest(id=secrets.token_hex(32))
+    response = stub.Register(message)
+    assert response.token
+
+
+@pytest.mark.abort_on_fail
+async def test_ingress_traefik_k8s(ops_test):
+    """Test that the charm can be integrated with the Traefik ingress."""
+    await asyncio.gather(
+        ops_test.model.deploy(
+            "traefik-k8s",
+            application_name=TRAEFIK,
+            channel="edge",
+            config={"routing_mode": "subdomain", "external_hostname": "foo.bar"},
+            trust=True,
+        ),
+        ops_test.model.wait_for_idle(apps=[TRAEFIK], status="active", timeout=1000),
+    )
+
+    # Create the relation
+    await ops_test.model.integrate(f"{RATINGS}:ingress", TRAEFIK)
+    # Wait for the two apps to quiesce
+    await ops_test.model.wait_for_idle(apps=[RATINGS, TRAEFIK], status="active", timeout=1000)
+
+    result = await _retrieve_proxied_endpoints(ops_test, TRAEFIK)
+    assert result.get(RATINGS, None) == {"url": f"http://{ops_test.model_name}-{RATINGS}.foo.bar/"}
+
+
+@pytest.mark.skipif(
+    (not os.environ.get("GITHUB_ACTION", "")),
+    reason="""This test requires host configuration which might not be present on your machine.
+
+    If you know what you're doing, run `export GITHUB_ACTION=Foo` or similar prior to running
+    `tox -e integration`.
+    """,
+)
+async def test_ratings_register_user_through_ingress(ops_test: OpsTest):
+    """End-to-end test to ensure the app can be interacted with from behind Traefik."""
+    address = f"{ops_test.model_name}-{RATINGS}.foo.bar:80"
+    channel = grpc.insecure_channel(address)
+    stub = pb2_grpc.UserStub(channel)
+    message = pb2.RegisterRequest(id=secrets.token_hex(32))
+    response = stub.Register(message)
+    assert response.token
+
+
+async def _retrieve_proxied_endpoints(ops_test, traefik_application_name):
+    traefik_application = ops_test.model.applications[traefik_application_name]
+    traefik_first_unit = next(iter(traefik_application.units))
+    action = await traefik_first_unit.run_action("show-proxied-endpoints")
+    await action.wait()
+    result = await ops_test.model.get_action_output(action.id)
+
+    return json.loads(result["proxied-endpoints"])
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
new file mode 100644
index 0000000..b156da1
--- /dev/null
+++ b/vm_operator/tests/unit/test_charm.py
@@ -0,0 +1,153 @@
+# Copyright 2023 Canonical
+# See LICENSE file for licensing details.
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import ops
+import ops.testing
+from charm import RatingsCharm
+from database import DatabaseInitialisationError
+from ratings import Ratings
+
+DB_RELATION_DATA = {
+    "database": "ratings",
+    "endpoints": "postgres:5432",
+    "password": "password",
+    "username": "username",
+    "version": "14.8",
+}
+
+MOCK_RATINGS = Ratings("postgres://username:password@postgres:5432/ratings", "deadbeef")
+
+
+class MockDatabaseEvent:
+    def __init__(self, id, name="database"):
+        self.name = name
+        self.id = id
+
+
+class TestCharm(unittest.TestCase):
+    def setUp(self):
+        self.harness = ops.testing.Harness(RatingsCharm)
+        self.addCleanup(self.harness.cleanup)
+        self.harness.set_leader(True)
+        self.harness.begin()
+
+    def test_ratings_pebble_ready_no_relation(self):
+        expected_plan = {}
+        self.harness.container_pebble_ready("ratings")
+        updated_plan = self.harness.get_container_pebble_plan("ratings").to_dict()
+        self.assertEqual(expected_plan, updated_plan)
+        self.assertEqual(
+            self.harness.model.unit.status, ops.WaitingStatus("Waiting for database relation")
+        )
+
+    def test_ratings_sets_database_name_on_database_relation(self):
+        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.container_pebble_ready("ratings")
+        app_data = self.harness.get_relation_data(rel_id, self.harness.charm.app.name)
+        self.assertEqual(app_data, {"database": "ratings"})
+
+    def test_ratings_pebble_ready_waits_for_db_initialisation(self):
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.container_pebble_ready("ratings")
+        self.assertEqual(
+            self.harness.model.unit.status, ops.WaitingStatus("Ratings not yet initialised")
+        )
+
+    @patch("charm.RatingsCharm._ratings", MOCK_RATINGS)
+    @patch("ratings.Ratings.ready", lambda x: True)
+    def test_ratings_pebble_ready_sets_correct_plan(self):
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.container_pebble_ready("ratings")
+        self.assertEqual(self.harness.model.unit.status, ops.ActiveStatus())
+        expected = {
+            "services": {
+                "ratings": {
+                    "override": "replace",
+                    "summary": "ratings",
+                    "command": "/bin/ratings",
+                    "startup": "enabled",
+                    "environment": {
+                        "APP_POSTGRES_URI": "postgres://username:password@postgres:5432/ratings",
+                        "APP_JWT_SECRET": "deadbeef",
+                        "APP_LOG_LEVEL": "info",
+                        "APP_ENV": "dev",
+                    },
+                }
+            },
+        }
+        self.assertEqual(self.harness.get_container_pebble_plan("ratings").to_dict(), expected)
+
+    @patch("charm.RatingsCharm._ratings", MOCK_RATINGS)
+    @patch("ratings.Ratings.ready", lambda x: True)
+    def test_ratings_pebble_ready_waits_for_container(self):
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.set_can_connect("ratings", False)
+        self.harness.charm.on.ratings_pebble_ready.emit(SimpleNamespace(workload="foo"))
+        self.assertEqual(
+            self.harness.model.unit.status, ops.WaitingStatus("Waiting for ratings container")
+        )
+
+    def test_ratings_database_created_ratings_not_initialised(self):
+        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
+        self.harness.set_can_connect("ratings", True)
+        plan = self.harness.get_container_pebble_plan("ratings").to_dict()
+        self.assertEqual(plan, {})
+
+    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
+    @patch("ratings.Ratings.ready")
+    def test_ratings_database_created_database_not_initialised_fail_create_tables(self, db_init):
+        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        db_init.side_effect = DatabaseInitialisationError
+        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
+        self.assertEqual(
+            self.harness.model.unit.status, ops.BlockedStatus("Failed to create database tables")
+        )
+
+    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
+    @patch("ratings.Ratings.ready", lambda x: True)
+    def test_ratings_database_created_database_success(self):
+        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.set_can_connect("ratings", True)
+        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
+        self.assertEqual(self.harness.model.unit.status, ops.ActiveStatus())
+
+    def test_ratings_db_connection_string_no_relation(self):
+        self.assertEqual(self.harness.charm._db_connection_string(), "")
+
+    @patch("charm.DatabaseRequires.fetch_relation_data", lambda x: {0: DB_RELATION_DATA})
+    def test_ratings_db_connection_string(self):
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        expected = "postgres://username:password@postgres:5432/ratings"
+        self.assertEqual(self.harness.charm._db_connection_string(), expected)
+
+    def test_ratings_jwt_secret_no_relation(self):
+        new_secret = self.harness.charm._jwt_secret()
+        self.assertEqual(new_secret, "")
+
+    def test_ratings_jwt_secret_create(self):
+        self.harness.add_relation("ratings-peers", "ubuntu-software-ratings")
+        new_secret = self.harness.charm._jwt_secret()
+        self.assertEqual(len(new_secret), 48)
+
+    def test_ratings_jwt_secret_from_peer_data(self):
+        content = {"jwt-secret": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"}
+        secret_id = self.harness.add_model_secret(owner=self.harness.charm.app, content=content)
+        self.harness.add_relation(
+            "ratings-peers", "ubuntu-software-ratings", app_data={"jwt-secret-id": secret_id}
+        )
+        secret = self.harness.charm._jwt_secret()
+        self.assertEqual(secret, content["jwt-secret"])
+
+    def test_ratings_property_already_initialised(self):
+        self.harness.charm._ratings_svc = "foobar"
+        self.assertEqual(self.harness.charm._ratings, "foobar")
+
+    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
+    @patch("charm.DatabaseRequires.fetch_relation_data", lambda x: {0: DB_RELATION_DATA})
+    def test_ratings_property_not_initialised(self):
+        self.assertIsInstance(self.harness.charm._ratings, Ratings)
diff --git a/vm_operator/tests/unit/test_ratings.py b/vm_operator/tests/unit/test_ratings.py
new file mode 100644
index 0000000..af1ee35
--- /dev/null
+++ b/vm_operator/tests/unit/test_ratings.py
@@ -0,0 +1,57 @@
+# Copyright 2023 Canonical
+# See LICENSE file for licensing details.
+
+import unittest
+from unittest.mock import patch
+
+from ratings import Ratings
+
+
+class TestRatings(unittest.TestCase):
+    def setUp(self):
+        pass
+
+    def test_ratings_constructor_props(self):
+        r = Ratings("foobar", "deadbeef")
+        self.assertEqual(r.connection_string, "foobar")
+        self.assertEqual(r.jwt_secret, "deadbeef")
+
+    @patch("database.RatingsDatabase.ready", lambda x: False)
+    @patch("database.RatingsDatabase.create_tables", lambda x: True)
+    def test_ratings_ready_db_not_initialised_jwt_not_present(self):
+        r = Ratings("foobar", "")
+        self.assertFalse(r.ready())
+
+    @patch("database.RatingsDatabase.ready", lambda x: True)
+    def test_ratings_ready_db_initialised_jwt_not_present(self):
+        r = Ratings("foobar", "")
+        self.assertFalse(r.ready())
+
+    @patch("database.RatingsDatabase.ready", lambda x: True)
+    def test_ratings_ready_db_initialised_jwt_present(self):
+        r = Ratings("foobar", "deadbeef")
+        self.assertTrue(r.ready())
+
+    def test_ratings_pebble_layer(self):
+        r = Ratings("foobar", "deadbeef")
+        self.assertEqual(
+            r.pebble_layer(),
+            {
+                "summary": "ratings layer",
+                "description": "pebble config layer for ratings",
+                "services": {
+                    "ratings": {
+                        "override": "replace",
+                        "summary": "ratings",
+                        "command": "/bin/ratings",
+                        "startup": "enabled",
+                        "environment": {
+                            "APP_ENV": "dev",
+                            "APP_JWT_SECRET": "deadbeef",
+                            "APP_POSTGRES_URI": "foobar",
+                            "APP_LOG_LEVEL": "info",
+                        },
+                    }
+                },
+            },
+        )
diff --git a/vm_operator/tox.ini b/vm_operator/tox.ini
new file mode 100644
index 0000000..8ad173f
--- /dev/null
+++ b/vm_operator/tox.ini
@@ -0,0 +1,105 @@
+# Copyright 2023 Canonical
+# See LICENSE file for licensing details.
+
+[tox]
+no_package = True
+skip_missing_interpreters = True
+env_list = format, lint, unit
+min_version = 4.0.0
+
+[vars]
+src_path = {tox_root}/src
+tests_path = {tox_root}/tests
+;lib_path = {tox_root}/lib/charms/operator_name_with_underscores
+all_path = {[vars]src_path} {[vars]tests_path}
+
+[testenv]
+set_env =
+    PYTHONPATH = {tox_root}/lib:{[vars]src_path}
+    PYTHONBREAKPOINT=pdb.set_trace
+    PY_COLORS=1
+pass_env =
+    PYTHONPATH
+    CHARM_BUILD_DIR
+    MODEL_SETTINGS
+    GITHUB_ACTION
+
+[testenv:format]
+description = Apply coding style standards to code
+deps =
+    black
+    ruff
+commands =
+    black {[vars]all_path}
+    ruff --fix {[vars]all_path}
+
+[testenv:lint]
+description = Check code against coding style standards
+deps =
+    black
+    ruff
+    codespell
+commands =
+    # if this charm owns a lib, uncomment "lib_path" variable
+    # and uncomment the following line
+    # codespell {[vars]lib_path}
+    codespell {tox_root}
+    ruff {[vars]all_path}
+    black --check --diff {[vars]all_path}
+
+[testenv:unit]
+description = Run unit tests
+deps =
+    pytest
+    coverage[toml]
+    pydantic
+    -r {tox_root}/requirements.txt
+commands =
+    coverage run --source={[vars]src_path} \
+                 -m pytest \
+                 --tb native \
+                 -v \
+                 -s \
+                 {posargs} \
+                 {[vars]tests_path}/unit
+    coverage report
+
+[testenv:integration]
+description = Run integration tests
+deps =
+    pytest
+    juju
+    pytest-operator
+    grpcio
+    -r {tox_root}/requirements.txt
+commands =
+    pytest -v \
+           -s \
+           --tb native \
+           --log-cli-level=INFO \
+           {posargs} \
+           {[vars]tests_path}/integration
+
+[testenv:grpc]
+description = Regenerate gRPC stubs
+deps = 
+    grpcio
+    grpcio-tools
+commands =
+    python3 -m grpc_tools.protoc \
+        --proto_path={tox_root}/../proto \
+        --python_out={tox_root}/lib/ratings_api \
+        --grpc_python_out={tox_root}/lib/ratings_api \
+        {tox_root}/../proto/ratings_features_app.proto
+    
+    python3 -m grpc_tools.protoc \
+        --proto_path={tox_root}/../proto \
+        --python_out={tox_root}/lib/ratings_api \
+        --grpc_python_out={tox_root}/lib/ratings_api \
+        {tox_root}/../proto/ratings_features_chart.proto
+    
+    python3 -m grpc_tools.protoc \
+        --proto_path={tox_root}/../proto \
+        --python_out={tox_root}/lib/ratings_api \
+        --grpc_python_out={tox_root}/lib/ratings_api \
+        {tox_root}/../proto/ratings_features_user.proto

From 0b780448c25a2f47b91e0aa7a4698225afa77253 Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Tue, 26 Sep 2023 12:14:51 +0200
Subject: [PATCH 02/11] refactor(worflows): rename operator to k8s_operator

---
 .github/workflows/build-charm.yaml        | 6 +++---
 .github/workflows/pull-request-charm.yaml | 2 +-
 .github/workflows/pull-request.yaml       | 2 +-
 .github/workflows/push-charm.yaml         | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-charm.yaml b/.github/workflows/build-charm.yaml
index 4d8ace8..6a25eae 100644
--- a/.github/workflows/build-charm.yaml
+++ b/.github/workflows/build-charm.yaml
@@ -14,7 +14,7 @@ jobs:
         run: python3 -m pip install tox
       - name: Run linters
         run: |
-          cd operator
+          cd k8s_operator
           tox -e lint
 
   unit-test:
@@ -27,7 +27,7 @@ jobs:
         run: python -m pip install tox
       - name: Run tests
         run: |
-          cd operator
+          cd k8s_operator
           tox -e unit
 
   integration-test:
@@ -54,5 +54,5 @@ jobs:
           microk8s-addons: "hostpath-storage dns metallb:10.64.140.43-10.64.140.43"
       - name: Run integration tests
         run: |
-          cd operator
+          cd k8s_operator
           tox -e integration -- --model=testing
diff --git a/.github/workflows/pull-request-charm.yaml b/.github/workflows/pull-request-charm.yaml
index d910634..2d50c43 100644
--- a/.github/workflows/pull-request-charm.yaml
+++ b/.github/workflows/pull-request-charm.yaml
@@ -3,7 +3,7 @@ name: Pull Request (Charm)
 on:
   pull_request:
     paths:
-      - operator/**
+      - k8s_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 84f7b5a..8eb819c 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -3,7 +3,7 @@ name: Pull Request
 on:
   pull_request:
     paths-ignore:
-      - operator/**
+      - k8s_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/push-charm.yaml b/.github/workflows/push-charm.yaml
index b8f499f..2de4950 100644
--- a/.github/workflows/push-charm.yaml
+++ b/.github/workflows/push-charm.yaml
@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths:
-      - operator/**
+      - k8s_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

From d4c268ca96958ddeefc0717544d673594ba9601b Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Tue, 26 Sep 2023 18:54:47 +0200
Subject: [PATCH 03/11] feat(charm): inject squid proxy url via config

---
 vm_operator/config.yaml  |  3 +++
 vm_operator/src/charm.py | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/vm_operator/config.yaml b/vm_operator/config.yaml
index 69a664c..3d57b65 100644
--- a/vm_operator/config.yaml
+++ b/vm_operator/config.yaml
@@ -27,3 +27,6 @@ options:
   app-migration-postgres-uri:
     type: string
     default: "postgresql://migration_user:strongpassword@localhost:5433/ratings"
+  squid-proxy-url:
+    type: string
+    default: ""
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 8176512..21e2ac0 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -65,9 +65,17 @@ def _on_install(self, _):
         # Install what is avalible via apt
         self._install_apt_packages(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
 
+        # Ensure squid proxy, done after apt to not interfere
+        proxy_url = self.config["squid-proxy-url"]
+        if proxy_url:
+            os.environ['HTTP_PROXY'] = proxy_url
+            os.environ['HTTPS_PROXY'] = proxy_url
+
+
         # curl minial rust toolchain
         try:
             check_output("curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal", shell=True)
+
         except CalledProcessError as e:
             logger.error(f"Curl command failed with error code {e.returncode}")
             self.unit.status = BlockedStatus("Curl command failed")
@@ -112,6 +120,12 @@ def _setup_application(self, _=None):
         if not self._stored.repo:
             self._stored.repo = self.config["app-repo"]
 
+        # Ensure squid proxy
+        proxy_url = self.config["squid-proxy-url"]
+        if proxy_url:
+            os.environ['HTTP_PROXY'] = proxy_url
+            os.environ['HTTPS_PROXY'] = proxy_url
+
         # Fetch the code using git
         Repo.clone_from(self._stored.repo, APP_PATH, branch='vm-charm')
 
@@ -125,7 +139,6 @@ def _setup_application(self, _=None):
     def _on_database_created(self, _: DatabaseCreatedEvent):
         """Handle the database creation event."""
         logger.info("Database created event triggered.")
-        logger.info("Starting ratings service.")
         self._setup_application()
         self._render_systemd_unit()
         self._start_ratings()

From 5d9d9b919e3daa289d928f04dc2b2137ceb71a48 Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Thu, 28 Sep 2023 09:29:39 +0200
Subject: [PATCH 04/11] feat(charm): better logging/status'

---
 vm_operator/src/charm.py | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 21e2ac0..72b9b21 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -46,20 +46,19 @@ def __init__(self, *args):
 
         self.framework.observe(self._database.on.database_created, self._on_database_created)
         self.framework.observe(self.on.install, self._on_install)
-        self._stored.set_default(repo="", port="", conn_str="")
+        self._stored.set_default(repo="", port="", conn_str="", install_completed=False)
         self.framework.observe(self.on.start, self._on_start)
         self.framework.observe(self.on.pull_and_rebuild_action, self._on_pull_and_rebuild)
 
         # self.framework.observe(self.on.config_changed, self._on_config_changed)
     def _on_start(self, _):
-        """Start the workload"""
+        """Start the workload."""
         # Enable and start the "ratings" systemd unit
         systemd.service_resume("ratings")
         self.unit.status = ActiveStatus()
 
     def _on_install(self, _):
-        """Install prerequisites for the application"""
-
+        """Install prerequisites for the application."""
         self.unit.status = MaintenanceStatus("Installing rustc, cargo and other dependencies")
 
         # Install what is avalible via apt
@@ -71,18 +70,19 @@ def _on_install(self, _):
             os.environ['HTTP_PROXY'] = proxy_url
             os.environ['HTTPS_PROXY'] = proxy_url
 
-
-        # curl minial rust toolchain
+        # Curl minial rust toolchain
         try:
             check_output("curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal", shell=True)
+            self._stored.install_completed = True
+            self.unit.status = MaintenanceStatus("Installation complete, waiting for database.")
 
         except CalledProcessError as e:
             logger.error(f"Curl command failed with error code {e.returncode}")
             self.unit.status = BlockedStatus("Curl command failed")
             return
 
-
     def _render_systemd_unit(self):
+        """Render the systemd unit file for the application."""
         with open("templates/ratings-service.j2", "r") as t:
             template = Template(t.read())
 
@@ -104,13 +104,12 @@ def _render_systemd_unit(self):
         )
         with open(UNIT_PATH, "w+") as t:
             t.write(rendered)
-
         os.chmod(UNIT_PATH, 0o755)
         systemd.daemon_reload()
 
     def _setup_application(self, _=None):
-        """Clone Rust application into place and setup it's dependencies"""
-        self.unit.status = MaintenanceStatus("fetching application code")
+        """Clone Rust application into place and setup its dependencies."""
+        self.unit.status = MaintenanceStatus("Preparing to fetch application code")
 
         # Delete the application directory if it exists already
         if Path(APP_PATH).is_dir():
@@ -127,8 +126,15 @@ def _setup_application(self, _=None):
             os.environ['HTTPS_PROXY'] = proxy_url
 
         # Fetch the code using git
-        Repo.clone_from(self._stored.repo, APP_PATH, branch='vm-charm')
+        try:
+            Repo.clone_from(self._stored.repo, APP_PATH, branch='vm-charm')
+            self.unit.status = MaintenanceStatus("Code fetched, building now.")
+        except Exception as e:
+            logger.error(f"Git clone failed: {str(e)}")
+            self.unit.status = BlockedStatus("Git clone failed")
+            return
 
+        # Build the binary
         try:
             check_output([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH)
         except CalledProcessError as e:
@@ -139,6 +145,10 @@ def _setup_application(self, _=None):
     def _on_database_created(self, _: DatabaseCreatedEvent):
         """Handle the database creation event."""
         logger.info("Database created event triggered.")
+        if not self._stored.install_completed:
+            logger.warning("Skipping _on_database_created, install not completed yet.")
+            self.unit.status = ops.WaitingStatus("Waiting for install to complete.")
+            return
         self._setup_application()
         self._render_systemd_unit()
         self._start_ratings()
@@ -152,6 +162,8 @@ def _start_ratings(self):
             self.unit.status = ops.WaitingStatus("Waiting for database relation")
             return
 
+        self.unit.status = ops.MaintenanceStatus("Attempting to start ratings service.")
+
         try:
             logger.info("Resuming systemd service for ratings.")
             systemd.service_resume("ratings")
@@ -209,7 +221,8 @@ def _jwt_secret(self) -> str:
             return ""
 
     def _install_apt_packages(self, packages: list):
-        """Simple wrapper around 'apt-get install -y"""
+        """Install the specified apt packages."""
+        self.unit.status = MaintenanceStatus("Installing apt packages.")
         try:
             apt.update()
             apt.add_package(packages)
@@ -221,6 +234,7 @@ def _install_apt_packages(self, packages: list):
             self.unit.status = BlockedStatus("Failed to install packages")
 
     def _on_pull_and_rebuild(self, event):
+        """Pull new code and rebuild the application."""
         event.set_results({"status": "pulling and rebuilding"})
         try:
             # Pull new code
@@ -232,6 +246,8 @@ def _on_pull_and_rebuild(self, event):
             systemd.service_restart("ratings")
 
             event.set_results({"status": "successful"})
+            self.unit.status = ActiveStatus("Successfully pulled and rebuilt.")
+
         except Exception as e:
             event.fail(f"Failed: {str(e)}")
             self.unit.status = BlockedStatus(f"Pull and rebuild failed: {str(e)}")

From a75eedf98564c61674476bd6a727d094d1c2b2d7 Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Thu, 28 Sep 2023 11:39:01 +0200
Subject: [PATCH 05/11] chore(charm): unused code cleanup

---
 .../lib/charms/traefik_k8s/v2/ingress.py      | 696 ------------------
 .../ratings_api/ratings_features_app_pb2.py   |  30 -
 .../ratings_features_app_pb2_grpc.py          |  66 --
 .../ratings_api/ratings_features_chart_pb2.py |  36 -
 .../ratings_features_chart_pb2_grpc.py        |  66 --
 .../ratings_api/ratings_features_user_pb2.py  |  41 --
 .../ratings_features_user_pb2_grpc.py         | 199 -----
 vm_operator/tests/integration/test_charm.py   | 142 ----
 vm_operator/tests/unit/test_charm.py          | 153 ----
 vm_operator/tests/unit/test_ratings.py        |  57 --
 10 files changed, 1486 deletions(-)
 delete mode 100644 vm_operator/lib/charms/traefik_k8s/v2/ingress.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_app_pb2.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_user_pb2.py
 delete mode 100644 vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
 delete mode 100644 vm_operator/tests/integration/test_charm.py
 delete mode 100644 vm_operator/tests/unit/test_charm.py
 delete mode 100644 vm_operator/tests/unit/test_ratings.py

diff --git a/vm_operator/lib/charms/traefik_k8s/v2/ingress.py b/vm_operator/lib/charms/traefik_k8s/v2/ingress.py
deleted file mode 100644
index 532e831..0000000
--- a/vm_operator/lib/charms/traefik_k8s/v2/ingress.py
+++ /dev/null
@@ -1,696 +0,0 @@
-# Copyright 2023 Canonical Ltd.
-# See LICENSE file for licensing details.
-
-r"""# Interface Library for ingress.
-
-This library wraps relation endpoints using the `ingress` interface
-and provides a Python API for both requesting and providing per-application
-ingress, with load-balancing occurring across all units.
-
-## Getting Started
-
-To get started using the library, you just need to fetch the library using `charmcraft`.
-
-```shell
-cd some-charm
-charmcraft fetch-lib charms.traefik_k8s.v1.ingress
-```
-
-In the `metadata.yaml` of the charm, add the following:
-
-```yaml
-requires:
-    ingress:
-        interface: ingress
-        limit: 1
-```
-
-Then, to initialise the library:
-
-```python
-from charms.traefik_k8s.v2.ingress import (IngressPerAppRequirer,
-  IngressPerAppReadyEvent, IngressPerAppRevokedEvent)
-
-class SomeCharm(CharmBase):
-  def __init__(self, *args):
-    # ...
-    self.ingress = IngressPerAppRequirer(self, port=80)
-    # The following event is triggered when the ingress URL to be used
-    # by this deployment of the `SomeCharm` is ready (or changes).
-    self.framework.observe(
-        self.ingress.on.ready, self._on_ingress_ready
-    )
-    self.framework.observe(
-        self.ingress.on.revoked, self._on_ingress_revoked
-    )
-
-    def _on_ingress_ready(self, event: IngressPerAppReadyEvent):
-        logger.info("This app's ingress URL: %s", event.url)
-
-    def _on_ingress_revoked(self, event: IngressPerAppRevokedEvent):
-        logger.info("This app no longer has ingress")
-"""
-import json
-import logging
-import socket
-import typing
-from dataclasses import dataclass
-from typing import (
-    Any,
-    Dict,
-    List,
-    MutableMapping,
-    Optional,
-    Sequence,
-    Tuple,
-)
-
-import pydantic
-from ops.charm import CharmBase, RelationBrokenEvent, RelationEvent
-from ops.framework import EventSource, Object, ObjectEvents, StoredState
-from ops.model import ModelError, Relation, Unit
-from pydantic import AnyHttpUrl, BaseModel, Field, validator
-
-# The unique Charmhub library identifier, never change it
-LIBID = "e6de2a5cd5b34422a204668f3b8f90d2"
-
-# Increment this major API version when introducing breaking changes
-LIBAPI = 2
-
-# Increment this PATCH version before using `charmcraft publish-lib` or reset
-# to 0 if you are raising the major API version
-LIBPATCH = 3
-
-PYDEPS = ["pydantic<2.0"]
-
-DEFAULT_RELATION_NAME = "ingress"
-RELATION_INTERFACE = "ingress"
-
-log = logging.getLogger(__name__)
-BUILTIN_JUJU_KEYS = {"ingress-address", "private-address", "egress-subnets"}
-
-
-class DatabagModel(BaseModel):
-    """Base databag model."""
-
-    class Config:
-        """Pydantic config."""
-
-        allow_population_by_field_name = True
-        """Allow instantiating this class by field name (instead of forcing alias)."""
-        extra = "forbid"
-        """Raise if unknown fields are added to the databag."""
-
-    _NEST_UNDER = None
-
-    @classmethod
-    def load(cls, databag: MutableMapping):
-        """Load this model from a Juju databag."""
-        if cls._NEST_UNDER:
-            return cls.parse_obj(json.loads(databag[cls._NEST_UNDER]))
-
-        try:
-            data = {k: json.loads(v) for k, v in databag.items() if k not in BUILTIN_JUJU_KEYS}
-        except json.JSONDecodeError:
-            log.error(f"invalid databag contents: expecting json. {databag}")
-            raise
-
-        try:
-            return cls.parse_raw(json.dumps(data))  # type: ignore
-        except pydantic.ValidationError as e:
-            msg = f"failed to validate databag: {databag}"
-            log.error(msg, exc_info=True)
-            raise DataValidationError(msg) from e
-
-    def dump(self, databag: Optional[MutableMapping] = None):
-        """Write the contents of this model to Juju databag."""
-        if databag is None:
-            databag = {}
-
-        if self._NEST_UNDER:
-            databag[self._NEST_UNDER] = self.json()
-
-        dct = self.dict()
-        for key, field in self.__fields__.items():  # type: ignore
-            value = dct[key]
-            databag[field.alias or key] = json.dumps(value)
-
-        return databag
-
-
-# todo: import these models from charm-relation-interfaces/ingress/v2 instead of redeclaring them
-class IngressUrl(BaseModel):
-    """Ingress url schema."""
-
-    url: AnyHttpUrl
-
-
-class IngressProviderAppData(DatabagModel):
-    """Ingress application databag schema."""
-
-    ingress: IngressUrl
-
-
-class ProviderSchema(BaseModel):
-    """Provider schema for Ingress."""
-
-    app: IngressProviderAppData
-
-
-class IngressRequirerAppData(DatabagModel):
-    """Ingress requirer application databag model."""
-
-    model: str = Field(description="The model the application is in.")
-    name: str = Field(description="the name of the app requesting ingress.")
-    port: int = Field(description="The port the app wishes to be exposed.")
-
-    # fields on top of vanilla 'ingress' interface:
-    strip_prefix: Optional[bool] = Field(
-        description="Whether to strip the prefix from the ingress url.", alias="strip-prefix"
-    )
-    redirect_https: Optional[bool] = Field(
-        description="Whether to redirect http traffic to https.", alias="redirect-https"
-    )
-
-    scheme: Optional[str] = Field(
-        default="http", description="What scheme to use in the generated ingress url"
-    )
-
-    @validator("scheme", pre=True)
-    def validate_scheme(cls, scheme):  # noqa: N805  # pydantic wants 'cls' as first arg
-        """Validate scheme arg."""
-        if scheme not in {"http", "https", "h2c"}:
-            raise ValueError("invalid scheme: should be one of `http|https|h2c`")
-        return scheme
-
-    @validator("port", pre=True)
-    def validate_port(cls, port):  # noqa: N805  # pydantic wants 'cls' as first arg
-        """Validate port."""
-        assert isinstance(port, int), type(port)
-        assert 0 < port < 65535, "port out of TCP range"
-        return port
-
-
-class IngressRequirerUnitData(DatabagModel):
-    """Ingress requirer unit databag model."""
-
-    host: str = Field(description="Hostname the unit wishes to be exposed.")
-
-    @validator("host", pre=True)
-    def validate_host(cls, host):  # noqa: N805  # pydantic wants 'cls' as first arg
-        """Validate host."""
-        assert isinstance(host, str), type(host)
-        return host
-
-
-class RequirerSchema(BaseModel):
-    """Requirer schema for Ingress."""
-
-    app: IngressRequirerAppData
-    unit: IngressRequirerUnitData
-
-
-class IngressError(RuntimeError):
-    """Base class for custom errors raised by this library."""
-
-
-class NotReadyError(IngressError):
-    """Raised when a relation is not ready."""
-
-
-class DataValidationError(IngressError):
-    """Raised when data validation fails on IPU relation data."""
-
-
-class _IngressPerAppBase(Object):
-    """Base class for IngressPerUnit interface classes."""
-
-    def __init__(self, charm: CharmBase, relation_name: str = DEFAULT_RELATION_NAME):
-        super().__init__(charm, relation_name)
-
-        self.charm: CharmBase = charm
-        self.relation_name = relation_name
-        self.app = self.charm.app
-        self.unit = self.charm.unit
-
-        observe = self.framework.observe
-        rel_events = charm.on[relation_name]
-        observe(rel_events.relation_created, self._handle_relation)
-        observe(rel_events.relation_joined, self._handle_relation)
-        observe(rel_events.relation_changed, self._handle_relation)
-        observe(rel_events.relation_broken, self._handle_relation_broken)
-        observe(charm.on.leader_elected, self._handle_upgrade_or_leader)  # type: ignore
-        observe(charm.on.upgrade_charm, self._handle_upgrade_or_leader)  # type: ignore
-
-    @property
-    def relations(self):
-        """The list of Relation instances associated with this endpoint."""
-        return list(self.charm.model.relations[self.relation_name])
-
-    def _handle_relation(self, event):
-        """Subclasses should implement this method to handle a relation update."""
-        pass
-
-    def _handle_relation_broken(self, event):
-        """Subclasses should implement this method to handle a relation breaking."""
-        pass
-
-    def _handle_upgrade_or_leader(self, event):
-        """Subclasses should implement this method to handle upgrades or leadership change."""
-        pass
-
-
-class _IPAEvent(RelationEvent):
-    __args__: Tuple[str, ...] = ()
-    __optional_kwargs__: Dict[str, Any] = {}
-
-    @classmethod
-    def __attrs__(cls):
-        return cls.__args__ + tuple(cls.__optional_kwargs__.keys())
-
-    def __init__(self, handle, relation, *args, **kwargs):
-        super().__init__(handle, relation)
-
-        if not len(self.__args__) == len(args):
-            raise TypeError("expected {} args, got {}".format(len(self.__args__), len(args)))
-
-        for attr, obj in zip(self.__args__, args):
-            setattr(self, attr, obj)
-        for attr, default in self.__optional_kwargs__.items():
-            obj = kwargs.get(attr, default)
-            setattr(self, attr, obj)
-
-    def snapshot(self):
-        dct = super().snapshot()
-        for attr in self.__attrs__():
-            obj = getattr(self, attr)
-            try:
-                dct[attr] = obj
-            except ValueError as e:
-                raise ValueError(
-                    "cannot automagically serialize {}: "
-                    "override this method and do it "
-                    "manually.".format(obj)
-                ) from e
-
-        return dct
-
-    def restore(self, snapshot) -> None:
-        super().restore(snapshot)
-        for attr, obj in snapshot.items():
-            setattr(self, attr, obj)
-
-
-class IngressPerAppDataProvidedEvent(_IPAEvent):
-    """Event representing that ingress data has been provided for an app."""
-
-    __args__ = ("name", "model", "hosts", "strip_prefix", "redirect_https")
-
-    if typing.TYPE_CHECKING:
-        name: Optional[str] = None
-        model: Optional[str] = None
-        # sequence of hostname, port dicts
-        hosts: Sequence["IngressRequirerUnitData"] = ()
-        strip_prefix: bool = False
-        redirect_https: bool = False
-
-
-class IngressPerAppDataRemovedEvent(RelationEvent):
-    """Event representing that ingress data has been removed for an app."""
-
-
-class IngressPerAppProviderEvents(ObjectEvents):
-    """Container for IPA Provider events."""
-
-    data_provided = EventSource(IngressPerAppDataProvidedEvent)
-    data_removed = EventSource(IngressPerAppDataRemovedEvent)
-
-
-@dataclass
-class IngressRequirerData:
-    """Data exposed by the ingress requirer to the provider."""
-
-    app: "IngressRequirerAppData"
-    units: List["IngressRequirerUnitData"]
-
-
-class TlsProviderType(typing.Protocol):
-    """Placeholder."""
-
-    @property
-    def enabled(self) -> bool:  # type: ignore
-        """Placeholder."""
-
-
-class IngressPerAppProvider(_IngressPerAppBase):
-    """Implementation of the provider of ingress."""
-
-    on = IngressPerAppProviderEvents()  # type: ignore
-
-    def __init__(
-        self,
-        charm: CharmBase,
-        relation_name: str = DEFAULT_RELATION_NAME,
-    ):
-        """Constructor for IngressPerAppProvider.
-
-        Args:
-            charm: The charm that is instantiating the instance.
-            relation_name: The name of the relation endpoint to bind to
-                (defaults to "ingress").
-        """
-        super().__init__(charm, relation_name)
-
-    def _handle_relation(self, event):
-        # created, joined or changed: if remote side has sent the required data:
-        # notify listeners.
-        if self.is_ready(event.relation):
-            data = self.get_data(event.relation)
-            self.on.data_provided.emit(  # type: ignore
-                event.relation,
-                data.app.name,
-                data.app.model,
-                [unit.dict() for unit in data.units],
-                data.app.strip_prefix or False,
-                data.app.redirect_https or False,
-            )
-
-    def _handle_relation_broken(self, event):
-        self.on.data_removed.emit(event.relation)  # type: ignore
-
-    def wipe_ingress_data(self, relation: Relation):
-        """Clear ingress data from relation."""
-        assert self.unit.is_leader(), "only leaders can do this"
-        try:
-            relation.data
-        except ModelError as e:
-            log.warning(
-                "error {} accessing relation data for {!r}. "
-                "Probably a ghost of a dead relation is still "
-                "lingering around.".format(e, relation.name)
-            )
-            return
-        del relation.data[self.app]["ingress"]
-
-    def _get_requirer_units_data(self, relation: Relation) -> List["IngressRequirerUnitData"]:
-        """Fetch and validate the requirer's app databag."""
-        out: List["IngressRequirerUnitData"] = []
-
-        unit: Unit
-        for unit in relation.units:
-            databag = relation.data[unit]
-            try:
-                data = IngressRequirerUnitData.load(databag)
-                out.append(data)
-            except pydantic.ValidationError:
-                log.info(f"failed to validate remote unit data for {unit}")
-                raise
-        return out
-
-    @staticmethod
-    def _get_requirer_app_data(relation: Relation) -> "IngressRequirerAppData":
-        """Fetch and validate the requirer's app databag."""
-        app = relation.app
-        if app is None:
-            raise NotReadyError(relation)
-
-        databag = relation.data[app]
-        return IngressRequirerAppData.load(databag)
-
-    def get_data(self, relation: Relation) -> IngressRequirerData:
-        """Fetch the remote (requirer) app and units' databags."""
-        try:
-            return IngressRequirerData(
-                self._get_requirer_app_data(relation), self._get_requirer_units_data(relation)
-            )
-        except (pydantic.ValidationError, DataValidationError, json.JSONDecodeError) as e:
-            raise DataValidationError("failed to validate ingress requirer data") from e
-
-    def is_ready(self, relation: Optional[Relation] = None):
-        """The Provider is ready if the requirer has sent valid data."""
-        if not relation:
-            return any(map(self.is_ready, self.relations))
-
-        try:
-            self.get_data(relation)
-        except (DataValidationError, NotReadyError) as e:
-            log.debug("Provider not ready; validation error encountered: %s" % str(e))
-            return False
-        return True
-
-    def _published_url(self, relation: Relation) -> Optional["IngressProviderAppData"]:
-        """Fetch and validate this app databag; return the ingress url."""
-        if not self.is_ready(relation) or not self.unit.is_leader():
-            # Handle edge case where remote app name can be missing, e.g.,
-            # relation_broken events.
-            # Also, only leader units can read own app databags.
-            # FIXME https://github.com/canonical/traefik-k8s-operator/issues/34
-            return None
-
-        # fetch the provider's app databag
-        databag = relation.data[self.app]
-        if not databag.get("ingress"):
-            raise NotReadyError("This application did not `publish_url` yet.")
-
-        return IngressProviderAppData.load(databag)
-
-    def publish_url(self, relation: Relation, url: str):
-        """Publish to the app databag the ingress url."""
-        ingress_url = {"url": url}
-        IngressProviderAppData.parse_obj({"ingress": ingress_url}).dump(relation.data[self.app])
-
-    @property
-    def proxied_endpoints(self) -> Dict[str, str]:
-        """Returns the ingress settings provided to applications by this IngressPerAppProvider.
-
-        For example, when this IngressPerAppProvider has provided the
-        `http://foo.bar/my-model.my-app` URL to the my-app application, the returned dictionary
-        will be:
-
-        ```
-        {
-            "my-app": {
-                "url": "http://foo.bar/my-model.my-app"
-            }
-        }
-        ```
-        """
-        results = {}
-
-        for ingress_relation in self.relations:
-            if not ingress_relation.app:
-                log.warning(
-                    f"no app in relation {ingress_relation} when fetching proxied endpoints: skipping"
-                )
-                continue
-            try:
-                ingress_data = self._published_url(ingress_relation)
-            except NotReadyError:
-                log.warning(
-                    f"no published url found in {ingress_relation}: "
-                    f"traefik didn't publish_url yet to this relation."
-                )
-                continue
-
-            if not ingress_data:
-                log.warning(f"relation {ingress_relation} not ready yet: try again in some time.")
-                continue
-
-            results[ingress_relation.app.name] = ingress_data.ingress.dict()
-        return results
-
-
-class IngressPerAppReadyEvent(_IPAEvent):
-    """Event representing that ingress for an app is ready."""
-
-    __args__ = ("url",)
-    if typing.TYPE_CHECKING:
-        url: Optional[str] = None
-
-
-class IngressPerAppRevokedEvent(RelationEvent):
-    """Event representing that ingress for an app has been revoked."""
-
-
-class IngressPerAppRequirerEvents(ObjectEvents):
-    """Container for IPA Requirer events."""
-
-    ready = EventSource(IngressPerAppReadyEvent)
-    revoked = EventSource(IngressPerAppRevokedEvent)
-
-
-class IngressPerAppRequirer(_IngressPerAppBase):
-    """Implementation of the requirer of the ingress relation."""
-
-    on = IngressPerAppRequirerEvents()  # type: ignore
-
-    # used to prevent spurious urls to be sent out if the event we're currently
-    # handling is a relation-broken one.
-    _stored = StoredState()
-
-    def __init__(
-        self,
-        charm: CharmBase,
-        relation_name: str = DEFAULT_RELATION_NAME,
-        *,
-        host: Optional[str] = None,
-        port: Optional[int] = None,
-        strip_prefix: bool = False,
-        redirect_https: bool = False,
-        # fixme: this is horrible UX.
-        #  shall we switch to manually calling provide_ingress_requirements with all args when ready?
-        scheme: typing.Callable[[], str] = lambda: "http",
-    ):
-        """Constructor for IngressRequirer.
-
-        The request args can be used to specify the ingress properties when the
-        instance is created. If any are set, at least `port` is required, and
-        they will be sent to the ingress provider as soon as it is available.
-        All request args must be given as keyword args.
-
-        Args:
-            charm: the charm that is instantiating the library.
-            relation_name: the name of the relation endpoint to bind to (defaults to `ingress`);
-                relation must be of interface type `ingress` and have "limit: 1")
-            host: Hostname to be used by the ingress provider to address the requiring
-                application; if unspecified, the default Kubernetes service name will be used.
-            strip_prefix: configure Traefik to strip the path prefix.
-            redirect_https: redirect incoming requests to HTTPS.
-            scheme: callable returning the scheme to use when constructing the ingress url.
-
-        Request Args:
-            port: the port of the service
-        """
-        super().__init__(charm, relation_name)
-        self.charm: CharmBase = charm
-        self.relation_name = relation_name
-        self._strip_prefix = strip_prefix
-        self._redirect_https = redirect_https
-        self._get_scheme = scheme
-
-        self._stored.set_default(current_url=None)  # type: ignore
-
-        # if instantiated with a port, and we are related, then
-        # we immediately publish our ingress data  to speed up the process.
-        if port:
-            self._auto_data = host, port
-        else:
-            self._auto_data = None
-
-    def _handle_relation(self, event):
-        # created, joined or changed: if we have auto data: publish it
-        self._publish_auto_data(event.relation)
-
-        if self.is_ready():
-            # Avoid spurious events, emit only when there is a NEW URL available
-            new_url = (
-                None
-                if isinstance(event, RelationBrokenEvent)
-                else self._get_url_from_relation_data()
-            )
-            if self._stored.current_url != new_url:  # type: ignore
-                self._stored.current_url = new_url  # type: ignore
-                self.on.ready.emit(event.relation, new_url)  # type: ignore
-
-    def _handle_relation_broken(self, event):
-        self._stored.current_url = None  # type: ignore
-        self.on.revoked.emit(event.relation)  # type: ignore
-
-    def _handle_upgrade_or_leader(self, event):
-        """On upgrade/leadership change: ensure we publish the data we have."""
-        for relation in self.relations:
-            self._publish_auto_data(relation)
-
-    def is_ready(self):
-        """The Requirer is ready if the Provider has sent valid data."""
-        try:
-            return bool(self._get_url_from_relation_data())
-        except DataValidationError as e:
-            log.debug("Requirer not ready; validation error encountered: %s" % str(e))
-            return False
-
-    def _publish_auto_data(self, relation: Relation):
-        if self._auto_data:
-            host, port = self._auto_data
-            self.provide_ingress_requirements(host=host, port=port)
-
-    def provide_ingress_requirements(self, *, host: Optional[str] = None, port: int):
-        """Publishes the data that Traefik needs to provide ingress.
-
-        Args:
-            host: Hostname to be used by the ingress provider to address the
-             requirer unit; if unspecified, FQDN will be used instead
-            port: the port of the service (required)
-        """
-        # get only the leader to publish the data since we only
-        # require one unit to publish it -- it will not differ between units,
-        # unlike in ingress-per-unit.
-        assert self.relation, "no relation"
-
-        if self.unit.is_leader():
-            app_databag = self.relation.data[self.app]
-            try:
-                IngressRequirerAppData(  # type: ignore  # pyright does not like aliases
-                    model=self.model.name,
-                    name=self.app.name,
-                    scheme=self._get_scheme(),
-                    port=port,
-                    strip_prefix=self._strip_prefix,  # type: ignore  # pyright does not like aliases
-                    redirect_https=self._redirect_https,  # type: ignore  # pyright does not like aliases
-                ).dump(app_databag)
-            except pydantic.ValidationError as e:
-                msg = "failed to validate app data"
-                log.info(msg, exc_info=True)  # log to INFO because this might be expected
-                raise DataValidationError(msg) from e
-
-        if not host:
-            host = socket.getfqdn()
-
-        unit_databag = self.relation.data[self.unit]
-        try:
-            IngressRequirerUnitData(host=host).dump(unit_databag)
-        except pydantic.ValidationError as e:
-            msg = "failed to validate unit data"
-            log.info(msg, exc_info=True)  # log to INFO because this might be expected
-            raise DataValidationError(msg) from e
-
-    @property
-    def relation(self):
-        """The established Relation instance, or None."""
-        return self.relations[0] if self.relations else None
-
-    def _get_url_from_relation_data(self) -> Optional[str]:
-        """The full ingress URL to reach the current unit.
-
-        Returns None if the URL isn't available yet.
-        """
-        relation = self.relation
-        if not relation or not relation.app:
-            return None
-
-        # fetch the provider's app databag
-        try:
-            databag = relation.data[relation.app]
-        except ModelError as e:
-            log.debug(
-                f"Error {e} attempting to read remote app data; "
-                f"probably we are in a relation_departed hook"
-            )
-            return None
-
-        if not databag:  # not ready yet
-            return None
-
-        return str(IngressProviderAppData.load(databag).ingress.url)
-
-    @property
-    def url(self) -> Optional[str]:
-        """The full ingress URL to reach the current unit.
-
-        Returns None if the URL isn't available yet.
-        """
-        data = (
-            typing.cast(Optional[str], self._stored.current_url)  # type: ignore
-            or self._get_url_from_relation_data()
-        )
-        return data
diff --git a/vm_operator/lib/ratings_api/ratings_features_app_pb2.py b/vm_operator/lib/ratings_api/ratings_features_app_pb2.py
deleted file mode 100644
index 87f4427..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_app_pb2.py
+++ /dev/null
@@ -1,30 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: ratings_features_app.proto
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import symbol_database as _symbol_database
-from google.protobuf.internal import builder as _builder
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1aratings_features_app.proto\x12\x14ratings.features.app\"\x1e\n\x0fGetVotesRequest\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\"Q\n\x10GetVotesResponse\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\x12\x16\n\x0etotal_up_votes\x18\x02 \x01(\x04\x12\x18\n\x10total_down_votes\x18\x03 \x01(\x04\x32\x62\n\x03\x41pp\x12[\n\x08GetVotes\x12%.ratings.features.app.GetVotesRequest\x1a&.ratings.features.app.GetVotesResponse\"\x00\x62\x06proto3')
-
-_globals = globals()
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_app_pb2', _globals)
-if _descriptor._USE_C_DESCRIPTORS == False:
-
-  DESCRIPTOR._options = None
-  _globals['_GETVOTESREQUEST']._serialized_start=52
-  _globals['_GETVOTESREQUEST']._serialized_end=82
-  _globals['_GETVOTESRESPONSE']._serialized_start=84
-  _globals['_GETVOTESRESPONSE']._serialized_end=165
-  _globals['_APP']._serialized_start=167
-  _globals['_APP']._serialized_end=265
-# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
deleted file mode 100644
index 10013ef..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_app_pb2_grpc.py
+++ /dev/null
@@ -1,66 +0,0 @@
-# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
-"""Client and server classes corresponding to protobuf-defined services."""
-import grpc
-
-import ratings_features_app_pb2 as ratings__features__app__pb2
-
-
-class AppStub(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def __init__(self, channel):
-        """Constructor.
-
-        Args:
-            channel: A grpc.Channel.
-        """
-        self.GetVotes = channel.unary_unary(
-                '/ratings.features.app.App/GetVotes',
-                request_serializer=ratings__features__app__pb2.GetVotesRequest.SerializeToString,
-                response_deserializer=ratings__features__app__pb2.GetVotesResponse.FromString,
-                )
-
-
-class AppServicer(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def GetVotes(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-
-def add_AppServicer_to_server(servicer, server):
-    rpc_method_handlers = {
-            'GetVotes': grpc.unary_unary_rpc_method_handler(
-                    servicer.GetVotes,
-                    request_deserializer=ratings__features__app__pb2.GetVotesRequest.FromString,
-                    response_serializer=ratings__features__app__pb2.GetVotesResponse.SerializeToString,
-            ),
-    }
-    generic_handler = grpc.method_handlers_generic_handler(
-            'ratings.features.app.App', rpc_method_handlers)
-    server.add_generic_rpc_handlers((generic_handler,))
-
-
- # This class is part of an EXPERIMENTAL API.
-class App(object):
-    """Missing associated documentation comment in .proto file."""
-
-    @staticmethod
-    def GetVotes(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.app.App/GetVotes',
-            ratings__features__app__pb2.GetVotesRequest.SerializeToString,
-            ratings__features__app__pb2.GetVotesResponse.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py b/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
deleted file mode 100644
index 7f64359..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_chart_pb2.py
+++ /dev/null
@@ -1,36 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: ratings_features_chart.proto
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import symbol_database as _symbol_database
-from google.protobuf.internal import builder as _builder
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1cratings_features_chart.proto\x12\x16ratings.features.chart\"x\n\x0fGetChartRequest\x12\x34\n\ttimeframe\x18\x01 \x01(\x0e\x32!.ratings.features.chart.Timeframe\x12/\n\x04type\x18\x02 \x01(\x0e\x32!.ratings.features.chart.ChartType\"\xb8\x01\n\x10GetChartResponse\x12\x34\n\ttimeframe\x18\x01 \x01(\x0e\x32!.ratings.features.chart.Timeframe\x12/\n\x04type\x18\x02 \x01(\x0e\x32!.ratings.features.chart.ChartType\x12=\n\x12ordered_chart_data\x18\x03 \x03(\x0b\x32!.ratings.features.chart.ChartData\"J\n\tChartData\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\x12\x16\n\x0etotal_up_votes\x18\x02 \x01(\x04\x12\x18\n\x10total_down_votes\x18\x03 \x01(\x04*?\n\tChartType\x12\x1e\n\x1a\x43HART_TYPE_TOP_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x43HART_TYPE_TOP\x10\x01*O\n\tTimeframe\x12\x19\n\x15TIMEFRAME_UNSPECIFIED\x10\x00\x12\x12\n\x0eTIMEFRAME_WEEK\x10\x01\x12\x13\n\x0fTIMEFRAME_MONTH\x10\x02\x32h\n\x05\x43hart\x12_\n\x08GetChart\x12\'.ratings.features.chart.GetChartRequest\x1a(.ratings.features.chart.GetChartResponse\"\x00\x62\x06proto3')
-
-_globals = globals()
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_chart_pb2', _globals)
-if _descriptor._USE_C_DESCRIPTORS == False:
-
-  DESCRIPTOR._options = None
-  _globals['_CHARTTYPE']._serialized_start=441
-  _globals['_CHARTTYPE']._serialized_end=504
-  _globals['_TIMEFRAME']._serialized_start=506
-  _globals['_TIMEFRAME']._serialized_end=585
-  _globals['_GETCHARTREQUEST']._serialized_start=56
-  _globals['_GETCHARTREQUEST']._serialized_end=176
-  _globals['_GETCHARTRESPONSE']._serialized_start=179
-  _globals['_GETCHARTRESPONSE']._serialized_end=363
-  _globals['_CHARTDATA']._serialized_start=365
-  _globals['_CHARTDATA']._serialized_end=439
-  _globals['_CHART']._serialized_start=587
-  _globals['_CHART']._serialized_end=691
-# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
deleted file mode 100644
index d606c52..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_chart_pb2_grpc.py
+++ /dev/null
@@ -1,66 +0,0 @@
-# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
-"""Client and server classes corresponding to protobuf-defined services."""
-import grpc
-
-import ratings_features_chart_pb2 as ratings__features__chart__pb2
-
-
-class ChartStub(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def __init__(self, channel):
-        """Constructor.
-
-        Args:
-            channel: A grpc.Channel.
-        """
-        self.GetChart = channel.unary_unary(
-                '/ratings.features.chart.Chart/GetChart',
-                request_serializer=ratings__features__chart__pb2.GetChartRequest.SerializeToString,
-                response_deserializer=ratings__features__chart__pb2.GetChartResponse.FromString,
-                )
-
-
-class ChartServicer(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def GetChart(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-
-def add_ChartServicer_to_server(servicer, server):
-    rpc_method_handlers = {
-            'GetChart': grpc.unary_unary_rpc_method_handler(
-                    servicer.GetChart,
-                    request_deserializer=ratings__features__chart__pb2.GetChartRequest.FromString,
-                    response_serializer=ratings__features__chart__pb2.GetChartResponse.SerializeToString,
-            ),
-    }
-    generic_handler = grpc.method_handlers_generic_handler(
-            'ratings.features.chart.Chart', rpc_method_handlers)
-    server.add_generic_rpc_handlers((generic_handler,))
-
-
- # This class is part of an EXPERIMENTAL API.
-class Chart(object):
-    """Missing associated documentation comment in .proto file."""
-
-    @staticmethod
-    def GetChart(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.chart.Chart/GetChart',
-            ratings__features__chart__pb2.GetChartRequest.SerializeToString,
-            ratings__features__chart__pb2.GetChartResponse.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
deleted file mode 100644
index 3d29a11..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_user_pb2.py
+++ /dev/null
@@ -1,41 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: ratings_features_user.proto
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import symbol_database as _symbol_database
-from google.protobuf.internal import builder as _builder
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
-
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1bratings_features_user.proto\x12\x15ratings.features.user\x1a\x1bgoogle/protobuf/empty.proto\"\x1d\n\x0fRegisterRequest\x12\n\n\x02id\x18\x01 \x01(\t\"!\n\x10RegisterResponse\x12\r\n\x05token\x18\x01 \x01(\t\"!\n\x13\x41uthenticateRequest\x12\n\n\x02id\x18\x01 \x01(\t\"%\n\x14\x41uthenticateResponse\x12\r\n\x05token\x18\x01 \x01(\t\"\x1f\n\x10ListVotesRequest\x12\x0b\n\x03\x61pp\x18\x01 \x01(\t\"_\n\x11ListVotesResponse\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\t\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x12\x11\n\ttimestamp\x18\x04 \x01(\x03\"F\n\x0bVoteRequest\x12\x0f\n\x07snap_id\x18\x01 \x01(\t\x12\x15\n\rsnap_revision\x18\x02 \x01(\x05\x12\x0f\n\x07vote_up\x18\x03 \x01(\x08\x32\xb4\x03\n\x04User\x12]\n\x08Register\x12&.ratings.features.user.RegisterRequest\x1a\'.ratings.features.user.RegisterResponse\"\x00\x12i\n\x0c\x41uthenticate\x12*.ratings.features.user.AuthenticateRequest\x1a+.ratings.features.user.AuthenticateResponse\"\x00\x12:\n\x06\x44\x65lete\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\"\x00\x12\x44\n\x04Vote\x12\".ratings.features.user.VoteRequest\x1a\x16.google.protobuf.Empty\"\x00\x12`\n\tListVotes\x12\'.ratings.features.user.ListVotesRequest\x1a(.ratings.features.user.ListVotesResponse\"\x00\x62\x06proto3')
-
-_globals = globals()
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'ratings_features_user_pb2', _globals)
-if _descriptor._USE_C_DESCRIPTORS == False:
-
-  DESCRIPTOR._options = None
-  _globals['_REGISTERREQUEST']._serialized_start=83
-  _globals['_REGISTERREQUEST']._serialized_end=112
-  _globals['_REGISTERRESPONSE']._serialized_start=114
-  _globals['_REGISTERRESPONSE']._serialized_end=147
-  _globals['_AUTHENTICATEREQUEST']._serialized_start=149
-  _globals['_AUTHENTICATEREQUEST']._serialized_end=182
-  _globals['_AUTHENTICATERESPONSE']._serialized_start=184
-  _globals['_AUTHENTICATERESPONSE']._serialized_end=221
-  _globals['_LISTVOTESREQUEST']._serialized_start=223
-  _globals['_LISTVOTESREQUEST']._serialized_end=254
-  _globals['_LISTVOTESRESPONSE']._serialized_start=256
-  _globals['_LISTVOTESRESPONSE']._serialized_end=351
-  _globals['_VOTEREQUEST']._serialized_start=353
-  _globals['_VOTEREQUEST']._serialized_end=423
-  _globals['_USER']._serialized_start=426
-  _globals['_USER']._serialized_end=862
-# @@protoc_insertion_point(module_scope)
diff --git a/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py b/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
deleted file mode 100644
index bdb5ae7..0000000
--- a/vm_operator/lib/ratings_api/ratings_features_user_pb2_grpc.py
+++ /dev/null
@@ -1,199 +0,0 @@
-# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
-"""Client and server classes corresponding to protobuf-defined services."""
-import grpc
-
-from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
-import ratings_features_user_pb2 as ratings__features__user__pb2
-
-
-class UserStub(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def __init__(self, channel):
-        """Constructor.
-
-        Args:
-            channel: A grpc.Channel.
-        """
-        self.Register = channel.unary_unary(
-                '/ratings.features.user.User/Register',
-                request_serializer=ratings__features__user__pb2.RegisterRequest.SerializeToString,
-                response_deserializer=ratings__features__user__pb2.RegisterResponse.FromString,
-                )
-        self.Authenticate = channel.unary_unary(
-                '/ratings.features.user.User/Authenticate',
-                request_serializer=ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
-                response_deserializer=ratings__features__user__pb2.AuthenticateResponse.FromString,
-                )
-        self.Delete = channel.unary_unary(
-                '/ratings.features.user.User/Delete',
-                request_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
-                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
-                )
-        self.Vote = channel.unary_unary(
-                '/ratings.features.user.User/Vote',
-                request_serializer=ratings__features__user__pb2.VoteRequest.SerializeToString,
-                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
-                )
-        self.ListVotes = channel.unary_unary(
-                '/ratings.features.user.User/ListVotes',
-                request_serializer=ratings__features__user__pb2.ListVotesRequest.SerializeToString,
-                response_deserializer=ratings__features__user__pb2.ListVotesResponse.FromString,
-                )
-
-
-class UserServicer(object):
-    """Missing associated documentation comment in .proto file."""
-
-    def Register(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-    def Authenticate(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-    def Delete(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-    def Vote(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-    def ListVotes(self, request, context):
-        """Missing associated documentation comment in .proto file."""
-        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
-        context.set_details('Method not implemented!')
-        raise NotImplementedError('Method not implemented!')
-
-
-def add_UserServicer_to_server(servicer, server):
-    rpc_method_handlers = {
-            'Register': grpc.unary_unary_rpc_method_handler(
-                    servicer.Register,
-                    request_deserializer=ratings__features__user__pb2.RegisterRequest.FromString,
-                    response_serializer=ratings__features__user__pb2.RegisterResponse.SerializeToString,
-            ),
-            'Authenticate': grpc.unary_unary_rpc_method_handler(
-                    servicer.Authenticate,
-                    request_deserializer=ratings__features__user__pb2.AuthenticateRequest.FromString,
-                    response_serializer=ratings__features__user__pb2.AuthenticateResponse.SerializeToString,
-            ),
-            'Delete': grpc.unary_unary_rpc_method_handler(
-                    servicer.Delete,
-                    request_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
-                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
-            ),
-            'Vote': grpc.unary_unary_rpc_method_handler(
-                    servicer.Vote,
-                    request_deserializer=ratings__features__user__pb2.VoteRequest.FromString,
-                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
-            ),
-            'ListVotes': grpc.unary_unary_rpc_method_handler(
-                    servicer.ListVotes,
-                    request_deserializer=ratings__features__user__pb2.ListVotesRequest.FromString,
-                    response_serializer=ratings__features__user__pb2.ListVotesResponse.SerializeToString,
-            ),
-    }
-    generic_handler = grpc.method_handlers_generic_handler(
-            'ratings.features.user.User', rpc_method_handlers)
-    server.add_generic_rpc_handlers((generic_handler,))
-
-
- # This class is part of an EXPERIMENTAL API.
-class User(object):
-    """Missing associated documentation comment in .proto file."""
-
-    @staticmethod
-    def Register(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Register',
-            ratings__features__user__pb2.RegisterRequest.SerializeToString,
-            ratings__features__user__pb2.RegisterResponse.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
-
-    @staticmethod
-    def Authenticate(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Authenticate',
-            ratings__features__user__pb2.AuthenticateRequest.SerializeToString,
-            ratings__features__user__pb2.AuthenticateResponse.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
-
-    @staticmethod
-    def Delete(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Delete',
-            google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
-            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
-
-    @staticmethod
-    def Vote(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/Vote',
-            ratings__features__user__pb2.VoteRequest.SerializeToString,
-            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
-
-    @staticmethod
-    def ListVotes(request,
-            target,
-            options=(),
-            channel_credentials=None,
-            call_credentials=None,
-            insecure=False,
-            compression=None,
-            wait_for_ready=None,
-            timeout=None,
-            metadata=None):
-        return grpc.experimental.unary_unary(request, target, '/ratings.features.user.User/ListVotes',
-            ratings__features__user__pb2.ListVotesRequest.SerializeToString,
-            ratings__features__user__pb2.ListVotesResponse.FromString,
-            options, channel_credentials,
-            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
diff --git a/vm_operator/tests/integration/test_charm.py b/vm_operator/tests/integration/test_charm.py
deleted file mode 100644
index e13a320..0000000
--- a/vm_operator/tests/integration/test_charm.py
+++ /dev/null
@@ -1,142 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2023 Canonical
-# See LICENSE file for licensing details.
-
-import asyncio
-import json
-import logging
-import os
-import secrets
-from pathlib import Path
-
-import grpc
-import pytest
-import ratings_api.ratings_features_user_pb2 as pb2
-import ratings_api.ratings_features_user_pb2_grpc as pb2_grpc
-import yaml
-from pytest import mark
-from pytest_operator.plugin import OpsTest
-
-logger = logging.getLogger(__name__)
-
-METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
-RATINGS = "ratings"
-DB = "db"
-TRAEFIK = "traefik"
-
-
-@pytest.mark.abort_on_fail
-async def test_build_and_deploy(ops_test: OpsTest):
-    """Build the charm-under-test and deploy it together with related charms.
-
-    Assert on the unit status before any relations/configurations take place.
-    """
-    # Build and deploy charm from local source folder
-    charm = await ops_test.build_charm(".")
-    resources = {"ratings-image": METADATA["resources"]["ratings-image"]["upstream-source"]}
-
-    # Deploy the charm and wait for active/idle status
-    await asyncio.gather(
-        ops_test.model.deploy(charm, resources=resources, application_name=RATINGS, trust=True),
-        ops_test.model.wait_for_idle(
-            apps=[RATINGS], status="waiting", raise_on_blocked=True, timeout=1000
-        ),
-    )
-
-
-@mark.abort_on_fail
-async def test_database_relation(ops_test: OpsTest):
-    """Test that the charm can be successfully related to PostgreSQL."""
-    await asyncio.gather(
-        ops_test.model.deploy(
-            "postgresql-k8s", channel="14/edge", application_name=DB, trust=True
-        ),
-        ops_test.model.wait_for_idle(
-            apps=[DB], status="active", raise_on_blocked=True, timeout=1000
-        ),
-    )
-
-    await asyncio.gather(
-        ops_test.model.integrate(RATINGS, DB),
-        ops_test.model.wait_for_idle(
-            apps=[RATINGS], status="active", raise_on_blocked=True, timeout=1000
-        ),
-    )
-
-
-@mark.abort_on_fail
-async def test_ratings_scale(ops_test: OpsTest):
-    """Test that the charm can be scaled out and still talk to the database."""
-    await asyncio.gather(
-        ops_test.model.applications[RATINGS].scale(2),
-        ops_test.model.wait_for_idle(
-            apps=[RATINGS],
-            status="active",
-            timeout=1000,
-            wait_for_exact_units=2,
-        ),
-    )
-
-
-@mark.abort_on_fail
-async def test_ratings_register_user(ops_test: OpsTest):
-    """End-to-end test to ensure the app can interact with the database."""
-    status = await ops_test.model.get_status()  # noqa: F821
-    address = status["applications"][RATINGS]["public-address"]
-
-    channel = grpc.insecure_channel(f"{address}:18080")
-    stub = pb2_grpc.UserStub(channel)
-    message = pb2.RegisterRequest(id=secrets.token_hex(32))
-    response = stub.Register(message)
-    assert response.token
-
-
-@pytest.mark.abort_on_fail
-async def test_ingress_traefik_k8s(ops_test):
-    """Test that the charm can be integrated with the Traefik ingress."""
-    await asyncio.gather(
-        ops_test.model.deploy(
-            "traefik-k8s",
-            application_name=TRAEFIK,
-            channel="edge",
-            config={"routing_mode": "subdomain", "external_hostname": "foo.bar"},
-            trust=True,
-        ),
-        ops_test.model.wait_for_idle(apps=[TRAEFIK], status="active", timeout=1000),
-    )
-
-    # Create the relation
-    await ops_test.model.integrate(f"{RATINGS}:ingress", TRAEFIK)
-    # Wait for the two apps to quiesce
-    await ops_test.model.wait_for_idle(apps=[RATINGS, TRAEFIK], status="active", timeout=1000)
-
-    result = await _retrieve_proxied_endpoints(ops_test, TRAEFIK)
-    assert result.get(RATINGS, None) == {"url": f"http://{ops_test.model_name}-{RATINGS}.foo.bar/"}
-
-
-@pytest.mark.skipif(
-    (not os.environ.get("GITHUB_ACTION", "")),
-    reason="""This test requires host configuration which might not be present on your machine.
-
-    If you know what you're doing, run `export GITHUB_ACTION=Foo` or similar prior to running
-    `tox -e integration`.
-    """,
-)
-async def test_ratings_register_user_through_ingress(ops_test: OpsTest):
-    """End-to-end test to ensure the app can be interacted with from behind Traefik."""
-    address = f"{ops_test.model_name}-{RATINGS}.foo.bar:80"
-    channel = grpc.insecure_channel(address)
-    stub = pb2_grpc.UserStub(channel)
-    message = pb2.RegisterRequest(id=secrets.token_hex(32))
-    response = stub.Register(message)
-    assert response.token
-
-
-async def _retrieve_proxied_endpoints(ops_test, traefik_application_name):
-    traefik_application = ops_test.model.applications[traefik_application_name]
-    traefik_first_unit = next(iter(traefik_application.units))
-    action = await traefik_first_unit.run_action("show-proxied-endpoints")
-    await action.wait()
-    result = await ops_test.model.get_action_output(action.id)
-
-    return json.loads(result["proxied-endpoints"])
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
deleted file mode 100644
index b156da1..0000000
--- a/vm_operator/tests/unit/test_charm.py
+++ /dev/null
@@ -1,153 +0,0 @@
-# Copyright 2023 Canonical
-# See LICENSE file for licensing details.
-
-import unittest
-from types import SimpleNamespace
-from unittest.mock import patch
-
-import ops
-import ops.testing
-from charm import RatingsCharm
-from database import DatabaseInitialisationError
-from ratings import Ratings
-
-DB_RELATION_DATA = {
-    "database": "ratings",
-    "endpoints": "postgres:5432",
-    "password": "password",
-    "username": "username",
-    "version": "14.8",
-}
-
-MOCK_RATINGS = Ratings("postgres://username:password@postgres:5432/ratings", "deadbeef")
-
-
-class MockDatabaseEvent:
-    def __init__(self, id, name="database"):
-        self.name = name
-        self.id = id
-
-
-class TestCharm(unittest.TestCase):
-    def setUp(self):
-        self.harness = ops.testing.Harness(RatingsCharm)
-        self.addCleanup(self.harness.cleanup)
-        self.harness.set_leader(True)
-        self.harness.begin()
-
-    def test_ratings_pebble_ready_no_relation(self):
-        expected_plan = {}
-        self.harness.container_pebble_ready("ratings")
-        updated_plan = self.harness.get_container_pebble_plan("ratings").to_dict()
-        self.assertEqual(expected_plan, updated_plan)
-        self.assertEqual(
-            self.harness.model.unit.status, ops.WaitingStatus("Waiting for database relation")
-        )
-
-    def test_ratings_sets_database_name_on_database_relation(self):
-        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.container_pebble_ready("ratings")
-        app_data = self.harness.get_relation_data(rel_id, self.harness.charm.app.name)
-        self.assertEqual(app_data, {"database": "ratings"})
-
-    def test_ratings_pebble_ready_waits_for_db_initialisation(self):
-        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.container_pebble_ready("ratings")
-        self.assertEqual(
-            self.harness.model.unit.status, ops.WaitingStatus("Ratings not yet initialised")
-        )
-
-    @patch("charm.RatingsCharm._ratings", MOCK_RATINGS)
-    @patch("ratings.Ratings.ready", lambda x: True)
-    def test_ratings_pebble_ready_sets_correct_plan(self):
-        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.container_pebble_ready("ratings")
-        self.assertEqual(self.harness.model.unit.status, ops.ActiveStatus())
-        expected = {
-            "services": {
-                "ratings": {
-                    "override": "replace",
-                    "summary": "ratings",
-                    "command": "/bin/ratings",
-                    "startup": "enabled",
-                    "environment": {
-                        "APP_POSTGRES_URI": "postgres://username:password@postgres:5432/ratings",
-                        "APP_JWT_SECRET": "deadbeef",
-                        "APP_LOG_LEVEL": "info",
-                        "APP_ENV": "dev",
-                    },
-                }
-            },
-        }
-        self.assertEqual(self.harness.get_container_pebble_plan("ratings").to_dict(), expected)
-
-    @patch("charm.RatingsCharm._ratings", MOCK_RATINGS)
-    @patch("ratings.Ratings.ready", lambda x: True)
-    def test_ratings_pebble_ready_waits_for_container(self):
-        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.set_can_connect("ratings", False)
-        self.harness.charm.on.ratings_pebble_ready.emit(SimpleNamespace(workload="foo"))
-        self.assertEqual(
-            self.harness.model.unit.status, ops.WaitingStatus("Waiting for ratings container")
-        )
-
-    def test_ratings_database_created_ratings_not_initialised(self):
-        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
-        self.harness.set_can_connect("ratings", True)
-        plan = self.harness.get_container_pebble_plan("ratings").to_dict()
-        self.assertEqual(plan, {})
-
-    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
-    @patch("ratings.Ratings.ready")
-    def test_ratings_database_created_database_not_initialised_fail_create_tables(self, db_init):
-        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        db_init.side_effect = DatabaseInitialisationError
-        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
-        self.assertEqual(
-            self.harness.model.unit.status, ops.BlockedStatus("Failed to create database tables")
-        )
-
-    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
-    @patch("ratings.Ratings.ready", lambda x: True)
-    def test_ratings_database_created_database_success(self):
-        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        self.harness.set_can_connect("ratings", True)
-        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
-        self.assertEqual(self.harness.model.unit.status, ops.ActiveStatus())
-
-    def test_ratings_db_connection_string_no_relation(self):
-        self.assertEqual(self.harness.charm._db_connection_string(), "")
-
-    @patch("charm.DatabaseRequires.fetch_relation_data", lambda x: {0: DB_RELATION_DATA})
-    def test_ratings_db_connection_string(self):
-        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
-        expected = "postgres://username:password@postgres:5432/ratings"
-        self.assertEqual(self.harness.charm._db_connection_string(), expected)
-
-    def test_ratings_jwt_secret_no_relation(self):
-        new_secret = self.harness.charm._jwt_secret()
-        self.assertEqual(new_secret, "")
-
-    def test_ratings_jwt_secret_create(self):
-        self.harness.add_relation("ratings-peers", "ubuntu-software-ratings")
-        new_secret = self.harness.charm._jwt_secret()
-        self.assertEqual(len(new_secret), 48)
-
-    def test_ratings_jwt_secret_from_peer_data(self):
-        content = {"jwt-secret": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"}
-        secret_id = self.harness.add_model_secret(owner=self.harness.charm.app, content=content)
-        self.harness.add_relation(
-            "ratings-peers", "ubuntu-software-ratings", app_data={"jwt-secret-id": secret_id}
-        )
-        secret = self.harness.charm._jwt_secret()
-        self.assertEqual(secret, content["jwt-secret"])
-
-    def test_ratings_property_already_initialised(self):
-        self.harness.charm._ratings_svc = "foobar"
-        self.assertEqual(self.harness.charm._ratings, "foobar")
-
-    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
-    @patch("charm.DatabaseRequires.fetch_relation_data", lambda x: {0: DB_RELATION_DATA})
-    def test_ratings_property_not_initialised(self):
-        self.assertIsInstance(self.harness.charm._ratings, Ratings)
diff --git a/vm_operator/tests/unit/test_ratings.py b/vm_operator/tests/unit/test_ratings.py
deleted file mode 100644
index af1ee35..0000000
--- a/vm_operator/tests/unit/test_ratings.py
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 2023 Canonical
-# See LICENSE file for licensing details.
-
-import unittest
-from unittest.mock import patch
-
-from ratings import Ratings
-
-
-class TestRatings(unittest.TestCase):
-    def setUp(self):
-        pass
-
-    def test_ratings_constructor_props(self):
-        r = Ratings("foobar", "deadbeef")
-        self.assertEqual(r.connection_string, "foobar")
-        self.assertEqual(r.jwt_secret, "deadbeef")
-
-    @patch("database.RatingsDatabase.ready", lambda x: False)
-    @patch("database.RatingsDatabase.create_tables", lambda x: True)
-    def test_ratings_ready_db_not_initialised_jwt_not_present(self):
-        r = Ratings("foobar", "")
-        self.assertFalse(r.ready())
-
-    @patch("database.RatingsDatabase.ready", lambda x: True)
-    def test_ratings_ready_db_initialised_jwt_not_present(self):
-        r = Ratings("foobar", "")
-        self.assertFalse(r.ready())
-
-    @patch("database.RatingsDatabase.ready", lambda x: True)
-    def test_ratings_ready_db_initialised_jwt_present(self):
-        r = Ratings("foobar", "deadbeef")
-        self.assertTrue(r.ready())
-
-    def test_ratings_pebble_layer(self):
-        r = Ratings("foobar", "deadbeef")
-        self.assertEqual(
-            r.pebble_layer(),
-            {
-                "summary": "ratings layer",
-                "description": "pebble config layer for ratings",
-                "services": {
-                    "ratings": {
-                        "override": "replace",
-                        "summary": "ratings",
-                        "command": "/bin/ratings",
-                        "startup": "enabled",
-                        "environment": {
-                            "APP_ENV": "dev",
-                            "APP_JWT_SECRET": "deadbeef",
-                            "APP_POSTGRES_URI": "foobar",
-                            "APP_LOG_LEVEL": "info",
-                        },
-                    }
-                },
-            },
-        )

From 071b48bcf242e4d182598766bd945f21cf3b19b4 Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Thu, 28 Sep 2023 11:49:53 +0200
Subject: [PATCH 06/11] style: rust fmt, remove debug logs

---
 src/main.rs                               | 3 ---
 tests/user_tests/simple_lifecycle_test.rs | 5 ++++-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index b0d6fd5..ba84b6a 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -13,9 +13,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     tracing::info!("Starting Ubuntu App Rating Service");
 
-    tracing::info!("Config I have: {:?}", config);
-    tracing::info!("I have been update again, yippie!");
-
     app::run(config).await?;
 
     Ok(())
diff --git a/tests/user_tests/simple_lifecycle_test.rs b/tests/user_tests/simple_lifecycle_test.rs
index 976f8f4..dde156c 100644
--- a/tests/user_tests/simple_lifecycle_test.rs
+++ b/tests/user_tests/simple_lifecycle_test.rs
@@ -127,7 +127,10 @@ async fn delete(data: TestData) -> TestData {
         .await;
 
     let Err(sqlx::Error::RowNotFound) = result else {
-        panic!("The user {} still exists in the database or there was a database error", id);
+        panic!(
+            "The user {} still exists in the database or there was a database error",
+            id
+        );
     };
 
     data

From 1184b3125fe5ddc02c6d865616f0a7e8a996a81c Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Thu, 28 Sep 2023 15:54:21 +0200
Subject: [PATCH 07/11] refactor(charm): method to ensure squid proxy

---
 vm_operator/src/charm.py | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 72b9b21..78261fc 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -65,10 +65,7 @@ def _on_install(self, _):
         self._install_apt_packages(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
 
         # Ensure squid proxy, done after apt to not interfere
-        proxy_url = self.config["squid-proxy-url"]
-        if proxy_url:
-            os.environ['HTTP_PROXY'] = proxy_url
-            os.environ['HTTPS_PROXY'] = proxy_url
+        self._set_squid_proxy()
 
         # Curl minial rust toolchain
         try:
@@ -120,10 +117,7 @@ def _setup_application(self, _=None):
             self._stored.repo = self.config["app-repo"]
 
         # Ensure squid proxy
-        proxy_url = self.config["squid-proxy-url"]
-        if proxy_url:
-            os.environ['HTTP_PROXY'] = proxy_url
-            os.environ['HTTPS_PROXY'] = proxy_url
+        self._set_squid_proxy()
 
         # Fetch the code using git
         try:
@@ -237,6 +231,9 @@ def _on_pull_and_rebuild(self, event):
         """Pull new code and rebuild the application."""
         event.set_results({"status": "pulling and rebuilding"})
         try:
+
+            self._set_squid_proxy()
+
             # Pull new code
             repo = Repo(APP_PATH)
             repo.remotes.origin.pull()
@@ -252,6 +249,14 @@ def _on_pull_and_rebuild(self, event):
             event.fail(f"Failed: {str(e)}")
             self.unit.status = BlockedStatus(f"Pull and rebuild failed: {str(e)}")
 
+    def _set_squid_proxy(self):
+        """Set Squid proxy environment variables if configured."""
+        proxy_url = self.config["squid-proxy-url"]
+        if proxy_url:
+            os.environ['HTTP_PROXY'] = proxy_url
+            os.environ['HTTPS_PROXY'] = proxy_url
+
+
 
 if __name__ == "__main__":  # pragma: nocover
     ops.main(RatingsCharm)

From 8ebe2c425a1956d46bf76e595a5c1225b1d1bbff Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Mon, 2 Oct 2023 22:20:56 +0200
Subject: [PATCH 08/11] test(charm): unit tests for vm charm

---
 vm_operator/config.yaml              |   2 +-
 vm_operator/src/charm.py             |   9 +-
 vm_operator/tests/unit/test_charm.py | 321 +++++++++++++++++++++++++++
 3 files changed, 327 insertions(+), 5 deletions(-)
 create mode 100644 vm_operator/tests/unit/test_charm.py

diff --git a/vm_operator/config.yaml b/vm_operator/config.yaml
index 3d57b65..ca0f3a2 100644
--- a/vm_operator/config.yaml
+++ b/vm_operator/config.yaml
@@ -29,4 +29,4 @@ options:
     default: "postgresql://migration_user:strongpassword@localhost:5433/ratings"
   squid-proxy-url:
     type: string
-    default: ""
+    default: "http://proxy.example.com"
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 78261fc..9dcf307 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -43,14 +43,12 @@ def __init__(self, *args):
 
         # Initialise the integration with PostgreSQL
         self._database = DatabaseRequires(self, relation_name="database", database_name="ratings")
-
         self.framework.observe(self._database.on.database_created, self._on_database_created)
         self.framework.observe(self.on.install, self._on_install)
         self._stored.set_default(repo="", port="", conn_str="", install_completed=False)
         self.framework.observe(self.on.start, self._on_start)
         self.framework.observe(self.on.pull_and_rebuild_action, self._on_pull_and_rebuild)
 
-        # self.framework.observe(self.on.config_changed, self._on_config_changed)
     def _on_start(self, _):
         """Start the workload."""
         # Enable and start the "ratings" systemd unit
@@ -80,6 +78,9 @@ def _on_install(self, _):
 
     def _render_systemd_unit(self):
         """Render the systemd unit file for the application."""
+        if not self._stored.port:
+            self._stored.port = self.config["app-port"]
+
         with open("templates/ratings-service.j2", "r") as t:
             template = Template(t.read())
 
@@ -95,7 +96,7 @@ def _render_systemd_unit(self):
             app_jwt_secret=jwt_secret,
             app_log_level=self.config["app-log-level"],
             app_name=self.config["app-name"],
-            app_port=self.config["app-port"],
+            app_port=self._stored.port,
             app_postgres_uri=connection_string,
             app_migration_postgres_uri=connection_string
         )
@@ -161,7 +162,7 @@ def _start_ratings(self):
         try:
             logger.info("Resuming systemd service for ratings.")
             systemd.service_resume("ratings")
-            self.unit.open_port(protocol="tcp", port=443)
+            self.unit.open_port(protocol="tcp", port=self.config["app-port"])
             self.unit.status = ops.ActiveStatus()
             logger.info("Ratings service started successfully.")
         except Exception as e:
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
new file mode 100644
index 0000000..8ae4404
--- /dev/null
+++ b/vm_operator/tests/unit/test_charm.py
@@ -0,0 +1,321 @@
+import unittest
+
+import logging
+from pathlib import Path
+from unittest import mock
+from unittest.mock import Mock, call, mock_open, patch
+from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent
+from charm import RatingsCharm, UNIT_PATH, APP_PATH, CARGO_PATH
+from charms.operator_libs_linux.v0 import apt, systemd
+from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus, WaitingStatus
+import os
+from os import environ
+from ops.testing import Harness
+
+class MockDatabaseEvent:
+    def __init__(self, id, name="database"):
+        self.name = name
+        self.id = id
+
+DB_RELATION_DATA = {
+    "database": "ratings",
+    "endpoints": "postgres:5432",
+    "password": "password",
+    "username": "username",
+    "version": "14.8",
+}
+
+RENDERED_SYSTEMD_UNIT = """[Unit]
+Description=App Center Ratings Service
+After=network.target
+
+[Service]
+Environment="APP_ENV=dev"
+Environment="APP_HOST=0.0.0.0"
+Environment="APP_JWT_SECRET="
+Environment="APP_LOG_LEVEL=info"
+Environment="APP_NAME=ratings"
+Environment="APP_PORT=443"
+Environment="APP_POSTGRES_URI="
+Environment="APP_MIGRATION_POSTGRES_URI="
+WorkingDirectory = /srv/app
+Restart = always
+RestartSec = 5
+ExecStart=/srv/app/target/release/ratings
+ExecReload = /bin/kill -s HUP $MAINPID
+ExecStop = /bin/kill -s TERM $MAINPID
+ExecStartPre = /bin/mkdir /srv/app/run
+PIDFile = /srv/app/run/hello-juju.pid
+ExecStopPost = /bin/rm -rf /srv/app/run
+
+[Install]
+WantedBy = multi-user.target"""
+
+class TestCharm(unittest.TestCase):
+    def setUp(self):
+        self.harness = Harness(RatingsCharm)
+        self.addCleanup(self.harness.cleanup)
+        self.harness.begin()
+
+    @mock.patch("charm.RatingsCharm._install_apt_packages")
+    def test_on_install(self, _install):
+        self.harness.charm.on.install.emit()
+        self.assertEqual(
+            self.harness.charm.unit.status, MaintenanceStatus("Installation complete, waiting for database.")
+        )
+        _install.assert_called_with(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
+
+    @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
+    def test_on_start(self, _resume):
+        # Run the handler
+        self.harness.charm.on.start.emit()
+        # Ensure we set an ActiveStatus for the charm
+        self.assertEqual(self.harness.charm.unit.status, ActiveStatus())
+        _resume.assert_called_with("ratings")
+
+    @mock.patch("charms.operator_libs_linux.v0.systemd.daemon_reload")
+    @mock.patch("os.chmod")
+    def test_render_systemd_unit(self, _chmod, _reload):
+        # Create a mock for the `open` method, set the return value of `read` to
+        # the contents of the systemd unit template
+        with open("../../templates/ratings-service.j2", "r") as f:
+            m = mock_open(read_data=f.read())
+
+        # Patch the `open` method with our mock
+        with patch("builtins.open", m, create=True):
+            # Ensure the stored value is clear to test it's set properly
+            self.harness.charm._stored.port = ""
+            # Mock the return value of the `check_call`
+            _reload.return_value = 0
+            # Call the method
+            self.harness.charm._render_systemd_unit()
+
+        # Check the unit path is correct
+        self.assertEqual(UNIT_PATH, Path("/etc/systemd/system/ratings.service"))
+        # Check the state was updated with the port from the config
+        self.assertEqual(self.harness.charm._stored.port, self.harness.charm.config["app-port"])
+        # Check the template is opened read-only in the first call to open
+        self.assertEqual(m.call_args_list[0][0], ("templates/ratings-service.j2", "r"))
+        # Check the systemd unit file is opened with "w+" mode in the second call to open
+        self.assertEqual(m.call_args_list[1][0], (UNIT_PATH, "w+"))
+        # Ensure the correct rendered template is written to file
+        m.return_value.write.assert_called_with(RENDERED_SYSTEMD_UNIT)
+        # Check the file permissions are set correctly
+        _chmod.assert_called_with(UNIT_PATH, 0o755)
+        # Check that systemd is reloaded to register the changes to the unit
+        _reload.assert_called_once()
+
+        # Now check that any existing port in state is respected
+        # Patch the `open` method with our mock
+        with patch("builtins.open", m, create=True):
+            # Ensure the stored value is clear to test it's set properly
+            self.harness.charm._stored.port = 8080
+            # Mock the return value of the `check_call`
+            _reload.return_value = 0
+            # Call the method
+            self.harness.charm._render_systemd_unit()
+        # Ensure the rendered template is adjusted to take into consideration the port
+        m.return_value.write.assert_called_with(RENDERED_SYSTEMD_UNIT.replace("APP_PORT=443", "APP_PORT=8080"))
+        self.assertEqual(self.harness.charm._stored.port, 8080)
+
+    @mock.patch.dict(os.environ, {}, clear=True)
+    @mock.patch("charm.check_output")
+    @mock.patch("charm.Repo.clone_from")
+    @mock.patch("charm.Path")
+    @mock.patch("shutil.rmtree")
+    def test_setup_application(self, _rmtree, _path, _clone, _check):
+        # Check that the app path was cleared/deleted
+        _path.return_value.is_dir.return_value = True
+
+        # Call the method
+        self.harness.charm._setup_application()
+
+        # Check that app-repo is set correctly
+        self.assertEqual(self.harness.charm._stored.repo, self.harness.charm.config["app-repo"])
+
+        self.assertEqual(APP_PATH, Path("/srv/app"))
+
+        # Check squid proxy is set correctly
+        self.assertEqual(os.environ.get("HTTP_PROXY"), "http://proxy.example.com")
+        self.assertEqual(os.environ.get("HTTPS_PROXY"), "http://proxy.example.com")
+
+        # Ensure we set the charm status correctly
+        self.assertEqual(
+            self.harness.charm.unit.status, MaintenanceStatus("Code fetched, building now.")
+        )
+        # Check we try to remove the directory
+        _rmtree.assert_called_with("/srv/app")
+
+        # Check we set the stored repository where none exists
+        self.assertEqual(self.harness.charm._stored.repo, "https://github.com/matthew-hagemann/app-center-ratings")
+
+        # Ensure we clone the repo
+        _clone.assert_called_with("https://github.com/matthew-hagemann/app-center-ratings", APP_PATH,branch='vm-charm')
+
+        # Check that cargo build was called correctly
+        self.assertEqual(
+            _check.call_args_list,
+            [
+                call([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH),
+            ],
+        )
+
+        # Make sure we don't try to remove the directory
+        _path.return_value.is_dir.return_value = False
+        self.harness.charm._stored.repo = "https://myrepo"
+        _rmtree.reset_mock()
+
+        # Call the method
+        self.harness.charm._setup_application()
+        _rmtree.assert_not_called()
+        self.assertEqual(self.harness.charm._stored.repo, "https://myrepo")
+
+    @mock.patch("charm.RatingsCharm._setup_application")
+    @mock.patch("charm.RatingsCharm._render_systemd_unit")
+    @mock.patch("charm.RatingsCharm._start_ratings")
+    def test_on_database_created(self, _start, _render, _setup):
+        self.harness.charm._stored.install_completed = True
+        # Create a mock DatabaseCreatedEvent
+        mock_event = mock.MagicMock(spec=DatabaseCreatedEvent)
+
+        # Simulate database created event
+        self.harness.charm._on_database_created(mock_event)
+
+        # Check _render_systemd_unit was called
+        _render.assert_called_once()
+        # Check _start_ratings was called
+        _start.assert_called_once()
+        # Check _setup_application was called
+        _setup.assert_called_once()
+
+        # If not installed, don't call functions
+        _render.reset_mock()
+        _start.reset_mock()
+        _setup.reset_mock()
+
+        self.harness.charm._stored.install_completed = False
+
+        # Simulate database created event
+        self.harness.charm._on_database_created(mock_event)
+
+        _render.assert_not_called()
+        _start.assert_not_called()
+        _setup.assert_not_called()
+
+    @mock.patch("charms.operator_libs_linux.v0.apt.update")
+    @mock.patch("charms.operator_libs_linux.v0.apt.add_package")
+    def test_install_apt_packages(self, _add_package, _update):
+        # Call the method with some packages to install
+        self.harness.charm._install_apt_packages(["curl", "vim"])
+        # Check that apt is called with the correct arguments
+        _update.assert_called_once()
+        _add_package.assert_called_with(["curl", "vim"])
+        # Now check that if an exception is raised we do the right logging
+        _add_package.reset_mock()
+        _add_package.return_value = 1
+        _add_package.side_effect = apt.PackageNotFoundError
+        self.harness.charm._install_apt_packages(["curl", "vim"])
+        self.assertEqual(
+            self.harness.charm.unit.status, BlockedStatus("Failed to install packages")
+        )
+        # Now check that if an exception is raised we do the right logging
+        _add_package.reset_mock()
+        _add_package.return_value = 1
+        _add_package.side_effect = apt.PackageError
+        self.harness.charm._install_apt_packages(["curl", "vim"])
+        self.assertEqual(
+            self.harness.charm.unit.status, BlockedStatus("Failed to install packages")
+        )
+
+    def test_ratings_db_connection_string_no_relation(self):
+        self.assertEqual(self.harness.charm._db_connection_string(), "")
+
+    @patch("charm.DatabaseRequires.fetch_relation_data", lambda x: {0: DB_RELATION_DATA})
+    def test_ratings_db_connection_string(self):
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        expected = "postgres://username:password@postgres:5432/ratings"
+        self.assertEqual(self.harness.charm._db_connection_string(), expected)
+
+    @patch("charm.DatabaseRequires.is_resource_created", lambda x: True)
+    def test_ratings_database_created_database_success(self):
+        rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
+        self.assertEqual(self.harness.model.unit.status, WaitingStatus("Waiting for install to complete."))
+
+    @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
+    def test_start_ratings(self, _resume):
+        # If no relation, wait on relation
+        self.harness.charm._start_ratings()
+        self.assertEqual(self.harness.charm.unit.status, WaitingStatus('Waiting for database relation'))
+
+        # If the relation is set, open the ports and restart the service
+        self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
+        self.harness.charm._start_ratings()
+
+        # Check the service was resumed
+        _resume.assert_called_with("ratings")
+
+        # Check the ports have been opened
+        opened_ports = {(p.protocol, p.port) for p in self.harness.charm.unit.opened_ports()}
+        self.assertEqual(opened_ports, {('tcp', 443)})
+
+        # Check status is active
+        self.assertEqual(self.harness.charm.unit.status, ActiveStatus())
+
+    def test_ratings_jwt_secret_from_peer_data(self):
+        content = {"jwt-secret": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"}
+        secret_id = self.harness.add_model_secret(owner=self.harness.charm.app, content=content)
+        self.harness.add_relation(
+            "ratings-peers", "ubuntu-software-ratings", app_data={"jwt-secret-id": secret_id}
+        )
+        secret = self.harness.charm._jwt_secret()
+        self.assertEqual(secret, content["jwt-secret"])
+
+    def test_ratings_jwt_secret_no_relation(self):
+        new_secret = self.harness.charm._jwt_secret()
+        self.assertEqual(new_secret, "")
+
+    def test_ratings_jwt_secret_create(self):
+        self.harness.add_relation("ratings-peers", "ubuntu-software-ratings")
+        self.harness.set_leader(True)
+        new_secret = self.harness.charm._jwt_secret()
+        self.assertEqual(len(new_secret), 48)
+
+    @mock.patch("charms.operator_libs_linux.v0.systemd.service_restart")
+    @mock.patch("charm.check_output")
+    @mock.patch("charm.Repo")
+    def test_on_pull_and_rebuild(self, _MockRepo, _check, _restart):
+
+        # Can't mock chain in the @mock.patch, so set up chaining manually for pull
+        mock_pull = mock.Mock()
+        mock_origin = mock.Mock(pull=mock_pull)
+        mock_remotes = mock.Mock(origin=mock_origin)
+
+        _MockRepo.return_value.remotes = mock_remotes  # Set up mock chaining
+
+        # Create event mock
+        mock_event = mock.Mock()
+        mock_event.set_results = mock.Mock()
+        mock_event.fail = mock.Mock()
+
+        # Run the handler
+        self.harness.charm._on_pull_and_rebuild(mock_event)
+
+        # Check squid proxy is set correctly
+        self.assertEqual(os.environ.get("HTTP_PROXY"), "http://proxy.example.com")
+        self.assertEqual(os.environ.get("HTTPS_PROXY"), "http://proxy.example.com")
+
+        # Ensure we clone the repo
+        mock_pull.assert_called()
+
+        # Check that cargo build was called correctly
+        self.assertEqual(
+            _check.call_args_list,
+            [
+                call([str(CARGO_PATH), "build", "--release"], cwd=APP_PATH),
+            ],
+        )
+
+        _restart.assert_called_with("ratings")
+
+        self.assertEqual(self.harness.charm.unit.status, ActiveStatus("Successfully pulled and rebuilt."))

From 16e34fc9fb3ddd4405fbf33bf94c4a099d37b21a Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Tue, 3 Oct 2023 08:48:59 +0200
Subject: [PATCH 09/11] ci(charm): update workflows for vm charm

---
 .github/workflows/build-charm.yaml        | 31 ++----------------
 .github/workflows/build-rock.yaml         | 22 -------------
 .github/workflows/pull-request-charm.yaml |  2 +-
 .github/workflows/pull-request.yaml       |  5 +--
 .github/workflows/push-charm.yaml         |  2 +-
 .github/workflows/push.yaml               | 33 -------------------
 vm_operator/requirements.txt              |  1 +
 vm_operator/src/charm.py                  |  2 +-
 vm_operator/tests/unit/test_charm.py      |  2 +-
 vm_operator/tox.ini                       | 40 -----------------------
 10 files changed, 8 insertions(+), 132 deletions(-)
 delete mode 100644 .github/workflows/build-rock.yaml

diff --git a/.github/workflows/build-charm.yaml b/.github/workflows/build-charm.yaml
index 6a25eae..ce1fdeb 100644
--- a/.github/workflows/build-charm.yaml
+++ b/.github/workflows/build-charm.yaml
@@ -14,7 +14,7 @@ jobs:
         run: python3 -m pip install tox
       - name: Run linters
         run: |
-          cd k8s_operator
+          cd vm_operator
           tox -e lint
 
   unit-test:
@@ -27,32 +27,5 @@ jobs:
         run: python -m pip install tox
       - name: Run tests
         run: |
-          cd k8s_operator
+          cd vm_operator
           tox -e unit
-
-  integration-test:
-    name: Integration tests (microk8s)
-    runs-on: ubuntu-22.04
-    needs:
-      - lint
-      - unit-test
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      # Do some preemptive setup for the ingress integration test so that our
-      # bogus dns name resolves properly.
-      - name: Setup hosts for tests
-        run: |
-          echo "10.64.140.43 testing-ratings.foo.bar" | sudo tee -a /etc/hosts
-      - name: Setup operator environment
-        uses: charmed-kubernetes/actions-operator@main
-        with:
-          provider: microk8s
-          channel: 1.27-strict/stable
-          juju-channel: 3.2/stable
-          microk8s-group: snap_microk8s
-          microk8s-addons: "hostpath-storage dns metallb:10.64.140.43-10.64.140.43"
-      - name: Run integration tests
-        run: |
-          cd k8s_operator
-          tox -e integration -- --model=testing
diff --git a/.github/workflows/build-rock.yaml b/.github/workflows/build-rock.yaml
deleted file mode 100644
index a7f2e78..0000000
--- a/.github/workflows/build-rock.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Build ROCK
-
-on:
-  workflow_call:
-
-jobs:
-  build:
-    name: Build ROCK
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-
-      - id: rockcraft
-        name: Build ROCK
-        uses: canonical/craft-actions/rockcraft-pack@main
-      
-      - name: Upload ROCK artifact
-        uses: actions/upload-artifact@v3
-        with:
-            name: ratings-rock
-            path: ${{ steps.rockcraft.outputs.rock }}
diff --git a/.github/workflows/pull-request-charm.yaml b/.github/workflows/pull-request-charm.yaml
index 2d50c43..d632ab5 100644
--- a/.github/workflows/pull-request-charm.yaml
+++ b/.github/workflows/pull-request-charm.yaml
@@ -3,7 +3,7 @@ name: Pull Request (Charm)
 on:
   pull_request:
     paths:
-      - k8s_operator/**
+      - vm_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 8eb819c..2e47e48 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -3,7 +3,7 @@ name: Pull Request
 on:
   pull_request:
     paths-ignore:
-      - k8s_operator/**
+      - vm_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -12,6 +12,3 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/build.yaml
-
-  build-rock:
-    uses: ./.github/workflows/build-rock.yaml
diff --git a/.github/workflows/push-charm.yaml b/.github/workflows/push-charm.yaml
index 2de4950..4acb5d6 100644
--- a/.github/workflows/push-charm.yaml
+++ b/.github/workflows/push-charm.yaml
@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths:
-      - k8s_operator/**
+      - vm_operator/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 3fb097b..068e26b 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -12,36 +12,3 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/build.yaml
-
-  build-rock:
-    uses: ./.github/workflows/build-rock.yaml
-
-  publish-rock:
-    name: Publish ROCK to GHCR
-    runs-on: ubuntu-latest
-    needs:
-      - build-rock
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Fetch ROCK artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: ratings-rock
-
-      - name: Upload ROCK to ghcr.io
-        run: |
-          commit="$(git rev-parse --short HEAD)"
-
-          # Upload ROCK to ghcr.io/tim-hm/ratings:main-<commit>
-          sudo skopeo --insecure-policy copy \
-            "oci-archive:$(realpath ./ratings_*.rock)" \
-            "docker://ghcr.io/tim-hm/ratings:main-${commit}" \
-            --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
-
-          # Upload ROCK to ghcr.io/tim-hm/ratings:latest
-          sudo skopeo --insecure-policy copy \
-            "oci-archive:$(realpath ./ratings_*.rock)" \
-            "docker://ghcr.io/tim-hm/ratings:latest" \
-            --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
diff --git a/vm_operator/requirements.txt b/vm_operator/requirements.txt
index d289e4e..b39bdd4 100644
--- a/vm_operator/requirements.txt
+++ b/vm_operator/requirements.txt
@@ -1,3 +1,4 @@
 ops == 2.6.0
 psycopg[binary] >= 3.1.10
 GitPython==3.1.14
+jinja2
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 9dcf307..d2dfacc 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -59,7 +59,7 @@ def _on_install(self, _):
         """Install prerequisites for the application."""
         self.unit.status = MaintenanceStatus("Installing rustc, cargo and other dependencies")
 
-        # Install what is avalible via apt
+        # Install via apt
         self._install_apt_packages(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
 
         # Ensure squid proxy, done after apt to not interfere
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
index 8ae4404..942b908 100644
--- a/vm_operator/tests/unit/test_charm.py
+++ b/vm_operator/tests/unit/test_charm.py
@@ -78,7 +78,7 @@ def test_on_start(self, _resume):
     def test_render_systemd_unit(self, _chmod, _reload):
         # Create a mock for the `open` method, set the return value of `read` to
         # the contents of the systemd unit template
-        with open("../../templates/ratings-service.j2", "r") as f:
+        with open("templates/ratings-service.j2", "r") as f:
             m = mock_open(read_data=f.read())
 
         # Patch the `open` method with our mock
diff --git a/vm_operator/tox.ini b/vm_operator/tox.ini
index 8ad173f..8f40f5c 100644
--- a/vm_operator/tox.ini
+++ b/vm_operator/tox.ini
@@ -63,43 +63,3 @@ commands =
                  {posargs} \
                  {[vars]tests_path}/unit
     coverage report
-
-[testenv:integration]
-description = Run integration tests
-deps =
-    pytest
-    juju
-    pytest-operator
-    grpcio
-    -r {tox_root}/requirements.txt
-commands =
-    pytest -v \
-           -s \
-           --tb native \
-           --log-cli-level=INFO \
-           {posargs} \
-           {[vars]tests_path}/integration
-
-[testenv:grpc]
-description = Regenerate gRPC stubs
-deps = 
-    grpcio
-    grpcio-tools
-commands =
-    python3 -m grpc_tools.protoc \
-        --proto_path={tox_root}/../proto \
-        --python_out={tox_root}/lib/ratings_api \
-        --grpc_python_out={tox_root}/lib/ratings_api \
-        {tox_root}/../proto/ratings_features_app.proto
-    
-    python3 -m grpc_tools.protoc \
-        --proto_path={tox_root}/../proto \
-        --python_out={tox_root}/lib/ratings_api \
-        --grpc_python_out={tox_root}/lib/ratings_api \
-        {tox_root}/../proto/ratings_features_chart.proto
-    
-    python3 -m grpc_tools.protoc \
-        --proto_path={tox_root}/../proto \
-        --python_out={tox_root}/lib/ratings_api \
-        --grpc_python_out={tox_root}/lib/ratings_api \
-        {tox_root}/../proto/ratings_features_user.proto

From bbf6675a60bace01e2e1971b9b3024b99f9b4eef Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Tue, 3 Oct 2023 16:32:49 +0200
Subject: [PATCH 10/11] refactor(charm): remove unnecessary config values

---
 vm_operator/README.md                    |  7 ++-----
 vm_operator/charmcraft.yaml              |  1 -
 vm_operator/config.yaml                  | 18 ------------------
 vm_operator/src/charm.py                 |  9 ++-------
 vm_operator/templates/ratings-service.j2 |  3 ---
 vm_operator/tests/unit/test_charm.py     | 18 ------------------
 6 files changed, 4 insertions(+), 52 deletions(-)

diff --git a/vm_operator/README.md b/vm_operator/README.md
index bb74857..05f26d3 100644
--- a/vm_operator/README.md
+++ b/vm_operator/README.md
@@ -12,12 +12,9 @@ charmcraft pack
 
 juju add-model ratings
 
-image="$(yq '.resources."ratings-image"."upstream-source"' metadata.yaml)"
+juju deploy ./ubuntu-software-ratings_ubuntu-22.04-amd64.charm ratings
 
-juju deploy ./ubuntu-software-ratings_ubuntu-22.04-amd64.charm ratings \
-    --resource ratings-image="$image"
-
-juju deploy postgresql --channel 14/stable
+juju deploy postgresql --channel edge 
 
 juju relate ratings postgresql
 ```
diff --git a/vm_operator/charmcraft.yaml b/vm_operator/charmcraft.yaml
index d7d03e0..6c7da6b 100644
--- a/vm_operator/charmcraft.yaml
+++ b/vm_operator/charmcraft.yaml
@@ -14,4 +14,3 @@ parts:
   charm:
     charm-binary-python-packages:
       - psycopg[binary]
-      - PyYAML
diff --git a/vm_operator/config.yaml b/vm_operator/config.yaml
index ca0f3a2..ec4af4b 100644
--- a/vm_operator/config.yaml
+++ b/vm_operator/config.yaml
@@ -3,30 +3,12 @@ options:
     type: string
     default: "dev"
     description: "Application environment."
-  app-host:
-    type: string
-    default: "0.0.0.0"
-  app-jwt-secret:
-    type: string
-    default: "deadbeef"
   app-log-level:
     type: string
     default: "info"
-  app-name:
-    type: string
-    default: "ratings"
-  app-port:
-    type: int
-    default: 443
   app-repo:
     type: string
     default: "https://github.com/matthew-hagemann/app-center-ratings"
-  app-postgres-uri:
-    type: string
-    default: "postgresql://service:covfefe!1@localhost:5433/ratings"
-  app-migration-postgres-uri:
-    type: string
-    default: "postgresql://migration_user:strongpassword@localhost:5433/ratings"
   squid-proxy-url:
     type: string
     default: "http://proxy.example.com"
diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index d2dfacc..36e2a1f 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -30,6 +30,7 @@
 APP_PATH = Path("/srv/app")
 UNIT_PATH = Path("/etc/systemd/system/ratings.service")
 CARGO_PATH = Path(environ.get("HOME", "/root")) / ".cargo/bin/cargo"
+APP_PORT = 443
 
 
 class RatingsCharm(ops.CharmBase):
@@ -78,9 +79,6 @@ def _on_install(self, _):
 
     def _render_systemd_unit(self):
         """Render the systemd unit file for the application."""
-        if not self._stored.port:
-            self._stored.port = self.config["app-port"]
-
         with open("templates/ratings-service.j2", "r") as t:
             template = Template(t.read())
 
@@ -92,11 +90,8 @@ def _render_systemd_unit(self):
         rendered = template.render(
             project_root=APP_PATH,
             app_env=self.config["app-env"],
-            app_host=self.config["app-host"],
             app_jwt_secret=jwt_secret,
             app_log_level=self.config["app-log-level"],
-            app_name=self.config["app-name"],
-            app_port=self._stored.port,
             app_postgres_uri=connection_string,
             app_migration_postgres_uri=connection_string
         )
@@ -162,7 +157,7 @@ def _start_ratings(self):
         try:
             logger.info("Resuming systemd service for ratings.")
             systemd.service_resume("ratings")
-            self.unit.open_port(protocol="tcp", port=self.config["app-port"])
+            self.unit.open_port(protocol="tcp", port=APP_PORT)
             self.unit.status = ops.ActiveStatus()
             logger.info("Ratings service started successfully.")
         except Exception as e:
diff --git a/vm_operator/templates/ratings-service.j2 b/vm_operator/templates/ratings-service.j2
index 6e88987..a3d990b 100644
--- a/vm_operator/templates/ratings-service.j2
+++ b/vm_operator/templates/ratings-service.j2
@@ -4,11 +4,8 @@ After=network.target
 
 [Service]
 Environment="APP_ENV={{ app_env }}"
-Environment="APP_HOST={{ app_host }}"
 Environment="APP_JWT_SECRET={{ app_jwt_secret }}"
 Environment="APP_LOG_LEVEL={{ app_log_level }}"
-Environment="APP_NAME={{ app_name }}"
-Environment="APP_PORT={{ app_port }}"
 Environment="APP_POSTGRES_URI={{ app_postgres_uri }}"
 Environment="APP_MIGRATION_POSTGRES_URI={{ app_migration_postgres_uri }}"
 WorkingDirectory = {{ project_root }}
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
index 942b908..a007f5e 100644
--- a/vm_operator/tests/unit/test_charm.py
+++ b/vm_operator/tests/unit/test_charm.py
@@ -31,11 +31,8 @@ def __init__(self, id, name="database"):
 
 [Service]
 Environment="APP_ENV=dev"
-Environment="APP_HOST=0.0.0.0"
 Environment="APP_JWT_SECRET="
 Environment="APP_LOG_LEVEL=info"
-Environment="APP_NAME=ratings"
-Environment="APP_PORT=443"
 Environment="APP_POSTGRES_URI="
 Environment="APP_MIGRATION_POSTGRES_URI="
 WorkingDirectory = /srv/app
@@ -92,8 +89,6 @@ def test_render_systemd_unit(self, _chmod, _reload):
 
         # Check the unit path is correct
         self.assertEqual(UNIT_PATH, Path("/etc/systemd/system/ratings.service"))
-        # Check the state was updated with the port from the config
-        self.assertEqual(self.harness.charm._stored.port, self.harness.charm.config["app-port"])
         # Check the template is opened read-only in the first call to open
         self.assertEqual(m.call_args_list[0][0], ("templates/ratings-service.j2", "r"))
         # Check the systemd unit file is opened with "w+" mode in the second call to open
@@ -105,19 +100,6 @@ def test_render_systemd_unit(self, _chmod, _reload):
         # Check that systemd is reloaded to register the changes to the unit
         _reload.assert_called_once()
 
-        # Now check that any existing port in state is respected
-        # Patch the `open` method with our mock
-        with patch("builtins.open", m, create=True):
-            # Ensure the stored value is clear to test it's set properly
-            self.harness.charm._stored.port = 8080
-            # Mock the return value of the `check_call`
-            _reload.return_value = 0
-            # Call the method
-            self.harness.charm._render_systemd_unit()
-        # Ensure the rendered template is adjusted to take into consideration the port
-        m.return_value.write.assert_called_with(RENDERED_SYSTEMD_UNIT.replace("APP_PORT=443", "APP_PORT=8080"))
-        self.assertEqual(self.harness.charm._stored.port, 8080)
-
     @mock.patch.dict(os.environ, {}, clear=True)
     @mock.patch("charm.check_output")
     @mock.patch("charm.Repo.clone_from")

From 9f655419eee1e9358f1079f108411096d1ceda54 Mon Sep 17 00:00:00 2001
From: matt-hagemann <matt.hagemann@canonical.com>
Date: Tue, 3 Oct 2023 16:34:22 +0200
Subject: [PATCH 11/11] style(charm): run the linter

---
 vm_operator/src/charm.py             | 38 +++++++++++----------
 vm_operator/tests/unit/test_charm.py | 50 ++++++++++++++++++----------
 2 files changed, 52 insertions(+), 36 deletions(-)

diff --git a/vm_operator/src/charm.py b/vm_operator/src/charm.py
index 36e2a1f..d7cd399 100755
--- a/vm_operator/src/charm.py
+++ b/vm_operator/src/charm.py
@@ -8,21 +8,20 @@
 """
 
 import logging
+import os
 import secrets
+import shutil
+from os import environ
+from pathlib import Path
+from subprocess import CalledProcessError, check_output
 
 import ops
-
-from pathlib import Path
-from git import Repo
-import shutil
-from charms.operator_libs_linux.v0 import apt, systemd
 from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent, DatabaseRequires
-from ops.model import MaintenanceStatus, BlockedStatus, ActiveStatus
-from ops.framework import StoredState
-from subprocess import check_output, CalledProcessError
-import os
-from os import environ
+from charms.operator_libs_linux.v0 import apt, systemd
+from git import Repo
 from jinja2 import Template
+from ops.framework import StoredState
+from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus
 
 logger = logging.getLogger(__name__)
 
@@ -61,14 +60,19 @@ def _on_install(self, _):
         self.unit.status = MaintenanceStatus("Installing rustc, cargo and other dependencies")
 
         # Install via apt
-        self._install_apt_packages(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
+        self._install_apt_packages(
+            ["curl", "git", "gcc", "libssl-dev", "pkg-config", "protobuf-compiler"]
+        )
 
         # Ensure squid proxy, done after apt to not interfere
         self._set_squid_proxy()
 
         # Curl minial rust toolchain
         try:
-            check_output("curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal", shell=True)
+            check_output(
+                "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal",
+                shell=True,
+            )
             self._stored.install_completed = True
             self.unit.status = MaintenanceStatus("Installation complete, waiting for database.")
 
@@ -93,7 +97,7 @@ def _render_systemd_unit(self):
             app_jwt_secret=jwt_secret,
             app_log_level=self.config["app-log-level"],
             app_postgres_uri=connection_string,
-            app_migration_postgres_uri=connection_string
+            app_migration_postgres_uri=connection_string,
         )
         with open(UNIT_PATH, "w+") as t:
             t.write(rendered)
@@ -117,7 +121,7 @@ def _setup_application(self, _=None):
 
         # Fetch the code using git
         try:
-            Repo.clone_from(self._stored.repo, APP_PATH, branch='vm-charm')
+            Repo.clone_from(self._stored.repo, APP_PATH, branch="vm-charm")
             self.unit.status = MaintenanceStatus("Code fetched, building now.")
         except Exception as e:
             logger.error(f"Git clone failed: {str(e)}")
@@ -227,7 +231,6 @@ def _on_pull_and_rebuild(self, event):
         """Pull new code and rebuild the application."""
         event.set_results({"status": "pulling and rebuilding"})
         try:
-
             self._set_squid_proxy()
 
             # Pull new code
@@ -249,9 +252,8 @@ def _set_squid_proxy(self):
         """Set Squid proxy environment variables if configured."""
         proxy_url = self.config["squid-proxy-url"]
         if proxy_url:
-            os.environ['HTTP_PROXY'] = proxy_url
-            os.environ['HTTPS_PROXY'] = proxy_url
-
+            os.environ["HTTP_PROXY"] = proxy_url
+            os.environ["HTTPS_PROXY"] = proxy_url
 
 
 if __name__ == "__main__":  # pragma: nocover
diff --git a/vm_operator/tests/unit/test_charm.py b/vm_operator/tests/unit/test_charm.py
index a007f5e..71029f8 100644
--- a/vm_operator/tests/unit/test_charm.py
+++ b/vm_operator/tests/unit/test_charm.py
@@ -1,22 +1,22 @@
+import os
 import unittest
-
-import logging
 from pathlib import Path
 from unittest import mock
-from unittest.mock import Mock, call, mock_open, patch
+from unittest.mock import call, mock_open, patch
+
+from charm import APP_PATH, CARGO_PATH, UNIT_PATH, RatingsCharm
 from charms.data_platform_libs.v0.data_interfaces import DatabaseCreatedEvent
-from charm import RatingsCharm, UNIT_PATH, APP_PATH, CARGO_PATH
-from charms.operator_libs_linux.v0 import apt, systemd
+from charms.operator_libs_linux.v0 import apt
 from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus, WaitingStatus
-import os
-from os import environ
 from ops.testing import Harness
 
+
 class MockDatabaseEvent:
     def __init__(self, id, name="database"):
         self.name = name
         self.id = id
 
+
 DB_RELATION_DATA = {
     "database": "ratings",
     "endpoints": "postgres:5432",
@@ -48,6 +48,7 @@ def __init__(self, id, name="database"):
 [Install]
 WantedBy = multi-user.target"""
 
+
 class TestCharm(unittest.TestCase):
     def setUp(self):
         self.harness = Harness(RatingsCharm)
@@ -58,9 +59,12 @@ def setUp(self):
     def test_on_install(self, _install):
         self.harness.charm.on.install.emit()
         self.assertEqual(
-            self.harness.charm.unit.status, MaintenanceStatus("Installation complete, waiting for database.")
+            self.harness.charm.unit.status,
+            MaintenanceStatus("Installation complete, waiting for database."),
+        )
+        _install.assert_called_with(
+            ["curl", "git", "gcc", "libssl-dev", "pkg-config", "protobuf-compiler"]
         )
-        _install.assert_called_with(["curl", "git", "gcc", "libssl-dev", "pkg-config","protobuf-compiler"])
 
     @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
     def test_on_start(self, _resume):
@@ -129,10 +133,15 @@ def test_setup_application(self, _rmtree, _path, _clone, _check):
         _rmtree.assert_called_with("/srv/app")
 
         # Check we set the stored repository where none exists
-        self.assertEqual(self.harness.charm._stored.repo, "https://github.com/matthew-hagemann/app-center-ratings")
+        self.assertEqual(
+            self.harness.charm._stored.repo,
+            "https://github.com/matthew-hagemann/app-center-ratings",
+        )
 
         # Ensure we clone the repo
-        _clone.assert_called_with("https://github.com/matthew-hagemann/app-center-ratings", APP_PATH,branch='vm-charm')
+        _clone.assert_called_with(
+            "https://github.com/matthew-hagemann/app-center-ratings", APP_PATH, branch="vm-charm"
+        )
 
         # Check that cargo build was called correctly
         self.assertEqual(
@@ -222,13 +231,17 @@ def test_ratings_db_connection_string(self):
     def test_ratings_database_created_database_success(self):
         rel_id = self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
         self.harness.charm._database.on.database_created.emit(MockDatabaseEvent(id=rel_id))
-        self.assertEqual(self.harness.model.unit.status, WaitingStatus("Waiting for install to complete."))
+        self.assertEqual(
+            self.harness.model.unit.status, WaitingStatus("Waiting for install to complete.")
+        )
 
     @mock.patch("charms.operator_libs_linux.v0.systemd.service_resume")
     def test_start_ratings(self, _resume):
         # If no relation, wait on relation
         self.harness.charm._start_ratings()
-        self.assertEqual(self.harness.charm.unit.status, WaitingStatus('Waiting for database relation'))
+        self.assertEqual(
+            self.harness.charm.unit.status, WaitingStatus("Waiting for database relation")
+        )
 
         # If the relation is set, open the ports and restart the service
         self.harness.add_relation("database", "postgresql", unit_data=DB_RELATION_DATA)
@@ -239,7 +252,7 @@ def test_start_ratings(self, _resume):
 
         # Check the ports have been opened
         opened_ports = {(p.protocol, p.port) for p in self.harness.charm.unit.opened_ports()}
-        self.assertEqual(opened_ports, {('tcp', 443)})
+        self.assertEqual(opened_ports, {("tcp", 443)})
 
         # Check status is active
         self.assertEqual(self.harness.charm.unit.status, ActiveStatus())
@@ -266,14 +279,13 @@ def test_ratings_jwt_secret_create(self):
     @mock.patch("charms.operator_libs_linux.v0.systemd.service_restart")
     @mock.patch("charm.check_output")
     @mock.patch("charm.Repo")
-    def test_on_pull_and_rebuild(self, _MockRepo, _check, _restart):
-
+    def test_on_pull_and_rebuild(self, _mock_repo, _check, _restart):
         # Can't mock chain in the @mock.patch, so set up chaining manually for pull
         mock_pull = mock.Mock()
         mock_origin = mock.Mock(pull=mock_pull)
         mock_remotes = mock.Mock(origin=mock_origin)
 
-        _MockRepo.return_value.remotes = mock_remotes  # Set up mock chaining
+        _mock_repo.return_value.remotes = mock_remotes  # Set up mock chaining
 
         # Create event mock
         mock_event = mock.Mock()
@@ -300,4 +312,6 @@ def test_on_pull_and_rebuild(self, _MockRepo, _check, _restart):
 
         _restart.assert_called_with("ratings")
 
-        self.assertEqual(self.harness.charm.unit.status, ActiveStatus("Successfully pulled and rebuilt."))
+        self.assertEqual(
+            self.harness.charm.unit.status, ActiveStatus("Successfully pulled and rebuilt.")
+        )