diff --git a/default.nix b/default.nix
index d37449d..8b09f79 100644
--- a/default.nix
+++ b/default.nix
@@ -65,7 +65,7 @@ in rec {
       '';
     };
 
-    vendorHash = "sha256-xAm2DqgXpZEErjASSZQoEH9GPwFbBh4h2cY4FWzPVZM=";
+    vendorHash = "sha256-CYnZNk1wTw/88L6SxNJTUojWartbGdL44c4GKFc8s2k=";
 
     subPackages = [
       "./cmd/entrypoint"
@@ -79,11 +79,8 @@ in rec {
   nebula = pkgs.callPackage ./nix/nebula.nix {};
 
   garage = let
-
     hostPlatform = pkgs.stdenv.hostPlatform.parsed;
-
   in pkgs.callPackage garageNix.package {
-
     inherit buildSystem;
     hostSystem = "${hostPlatform.cpu.name}-unknown-${hostPlatform.kernel.name}-musl";
     pkgsSrc = pkgsNix.src;
@@ -124,6 +121,7 @@ in rec {
       pkgs.golangci-lint
       pkgs.gopls
       (pkgs.callPackage ./nix/gowrap.nix {})
+      pkgs.go-mockery
     ];
     shellHook = ''
       true # placeholder
diff --git a/go/daemon/network/network.go b/go/daemon/network/network.go
index 5c85b48..5088660 100644
--- a/go/daemon/network/network.go
+++ b/go/daemon/network/network.go
@@ -1,3 +1,5 @@
+//go:generate mockery --name Network --inpackage --filename network_mock.go
+
 // Package network implements the Network type, which manages the daemon's
 // membership in a single network.
 package network
diff --git a/go/daemon/network/network_mock.go b/go/daemon/network/network_mock.go
new file mode 100644
index 0000000..341dd4b
--- /dev/null
+++ b/go/daemon/network/network_mock.go
@@ -0,0 +1,285 @@
+// Code generated by mockery v2.43.1. DO NOT EDIT.
+
+package network
+
+import (
+	context "context"
+	bootstrap "isle/bootstrap"
+
+	daecommon "isle/daemon/daecommon"
+
+	mock "github.com/stretchr/testify/mock"
+
+	nebula "isle/nebula"
+)
+
+// MockNetwork is an autogenerated mock type for the Network type
+type MockNetwork struct {
+	mock.Mock
+}
+
+// CreateHost provides a mock function with given fields: _a0, _a1, _a2
+func (_m *MockNetwork) CreateHost(_a0 context.Context, _a1 nebula.HostName, _a2 CreateHostOpts) (JoiningBootstrap, error) {
+	ret := _m.Called(_a0, _a1, _a2)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateHost")
+	}
+
+	var r0 JoiningBootstrap
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, nebula.HostName, CreateHostOpts) (JoiningBootstrap, error)); ok {
+		return rf(_a0, _a1, _a2)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, nebula.HostName, CreateHostOpts) JoiningBootstrap); ok {
+		r0 = rf(_a0, _a1, _a2)
+	} else {
+		r0 = ret.Get(0).(JoiningBootstrap)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, nebula.HostName, CreateHostOpts) error); ok {
+		r1 = rf(_a0, _a1, _a2)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// CreateNebulaCertificate provides a mock function with given fields: _a0, _a1, _a2
+func (_m *MockNetwork) CreateNebulaCertificate(_a0 context.Context, _a1 nebula.HostName, _a2 nebula.EncryptingPublicKey) (nebula.Certificate, error) {
+	ret := _m.Called(_a0, _a1, _a2)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateNebulaCertificate")
+	}
+
+	var r0 nebula.Certificate
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, nebula.HostName, nebula.EncryptingPublicKey) (nebula.Certificate, error)); ok {
+		return rf(_a0, _a1, _a2)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, nebula.HostName, nebula.EncryptingPublicKey) nebula.Certificate); ok {
+		r0 = rf(_a0, _a1, _a2)
+	} else {
+		r0 = ret.Get(0).(nebula.Certificate)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, nebula.HostName, nebula.EncryptingPublicKey) error); ok {
+		r1 = rf(_a0, _a1, _a2)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetConfig provides a mock function with given fields: _a0
+func (_m *MockNetwork) GetConfig(_a0 context.Context) (daecommon.NetworkConfig, error) {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetConfig")
+	}
+
+	var r0 daecommon.NetworkConfig
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (daecommon.NetworkConfig, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) daecommon.NetworkConfig); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(daecommon.NetworkConfig)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetGarageClientParams provides a mock function with given fields: _a0
+func (_m *MockNetwork) GetGarageClientParams(_a0 context.Context) (GarageClientParams, error) {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetGarageClientParams")
+	}
+
+	var r0 GarageClientParams
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (GarageClientParams, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) GarageClientParams); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(GarageClientParams)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetHosts provides a mock function with given fields: _a0
+func (_m *MockNetwork) GetHosts(_a0 context.Context) ([]bootstrap.Host, error) {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetHosts")
+	}
+
+	var r0 []bootstrap.Host
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]bootstrap.Host, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) []bootstrap.Host); ok {
+		r0 = rf(_a0)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]bootstrap.Host)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetNebulaCAPublicCredentials provides a mock function with given fields: _a0
+func (_m *MockNetwork) GetNebulaCAPublicCredentials(_a0 context.Context) (nebula.CAPublicCredentials, error) {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetNebulaCAPublicCredentials")
+	}
+
+	var r0 nebula.CAPublicCredentials
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (nebula.CAPublicCredentials, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) nebula.CAPublicCredentials); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(nebula.CAPublicCredentials)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetNetworkCreationParams provides a mock function with given fields: _a0
+func (_m *MockNetwork) GetNetworkCreationParams(_a0 context.Context) (bootstrap.CreationParams, error) {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetNetworkCreationParams")
+	}
+
+	var r0 bootstrap.CreationParams
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (bootstrap.CreationParams, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) bootstrap.CreationParams); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(bootstrap.CreationParams)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// RemoveHost provides a mock function with given fields: ctx, hostName
+func (_m *MockNetwork) RemoveHost(ctx context.Context, hostName nebula.HostName) error {
+	ret := _m.Called(ctx, hostName)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RemoveHost")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, nebula.HostName) error); ok {
+		r0 = rf(ctx, hostName)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SetConfig provides a mock function with given fields: _a0, _a1
+func (_m *MockNetwork) SetConfig(_a0 context.Context, _a1 daecommon.NetworkConfig) error {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SetConfig")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, daecommon.NetworkConfig) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Shutdown provides a mock function with given fields:
+func (_m *MockNetwork) Shutdown() error {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Shutdown")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// NewMockNetwork creates a new instance of MockNetwork. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockNetwork(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockNetwork {
+	mock := &MockNetwork{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/go/go.mod b/go/go.mod
index 6a8ffa7..5f4463e 100644
--- a/go/go.mod
+++ b/go/go.mod
@@ -35,6 +35,7 @@ require (
 	github.com/rs/xid v1.2.1 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/smartystreets/assertions v1.13.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 // indirect
 	golang.org/x/net v0.0.0-20220403103023-749bd193bc2b // indirect
 	golang.org/x/sys v0.0.0-20220406155245-289d7a0edf71 // indirect
diff --git a/go/go.sum b/go/go.sum
index 8ae7ce7..d2ca37e 100644
--- a/go/go.sum
+++ b/go/go.sum
@@ -1,5 +1,3 @@
-code.betamike.com/micropelago/pmux v0.0.0-20240719134913-f5fce902e8c4 h1:n4pGP12kgdH5kCTF4TZYpOjWuAR/zZLpM9j3neeVMEk=
-code.betamike.com/micropelago/pmux v0.0.0-20240719134913-f5fce902e8c4/go.mod h1:WlEWacLREVfIQl1IlBjKzuDgL56DFRvyl7YiL5gGP4w=
 code.betamike.com/micropelago/pmux v0.0.0-20241029124408-55bc7097f7b8 h1:DTAMr60/y9ZtpMORg50LYGpxyvA9+3UFKVW4mb4CwAE=
 code.betamike.com/micropelago/pmux v0.0.0-20241029124408-55bc7097f7b8/go.mod h1:WlEWacLREVfIQl1IlBjKzuDgL56DFRvyl7YiL5gGP4w=
 dev.mediocregopher.com/mediocre-go-lib.git v0.0.0-20241023182613-55984cdf5233 h1:Ea4HixNfDNDPh7zMngPpEeDf8gpociSPEROBFBedqIY=
@@ -67,6 +65,8 @@ github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=