diff --git a/docs/dev/daemon-process-tree.plantuml b/docs/dev/daemon-process-tree.plantuml
index c2c9462..4e1c38d 100644
--- a/docs/dev/daemon-process-tree.plantuml
+++ b/docs/dev/daemon-process-tree.plantuml
@@ -17,6 +17,7 @@ state AppDir {
         entrypoint : * Merge given and default daemon.yml files
         entrypoint : * Copy bootstrap.tgz into $_DATA_DIR_PATH, if it's not there
         entrypoint : * Merge daemon.yml config into bootstrap.tgz
+        entrypoint : * Create $_RUNTIME_DIR_PATH/garage-N.toml\n  (one per storage allocation)
         entrypoint : * Run child processes
     }
 
@@ -41,20 +42,17 @@ state AppDir {
     entrypoint --> nebulaEntrypoint : child
     nebulaEntrypoint --> nebula : exec
 
-    state "./bin/cryptic-net-main garage-entrypoint" as garageEntrypoint {
-        garageEntrypoint : * Create $_RUNTIME_DIR_PATH/garage-N.toml\n  (one per storage allocation)
-        garageEntrypoint : * Run child processes
+    state "Garage processes (only if any storage allocs are defined)" as garageChildren {
+
+        state "./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server" as garage
+        state "./bin/garage-apply-layout-diff" as garageApplyLayoutDiff {
+            garageApplyLayoutDiff : * Runs once then exits
+            garageApplyLayoutDiff : * Updates cluster topo
+        }
     }
 
-    state "./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server" as garage
-    state "./bin/garage-apply-layout-diff" as garageApplyLayoutDiff {
-        garageApplyLayoutDiff : * Runs once then exits
-        garageApplyLayoutDiff : * Updates cluster topo
-    }
-
-    entrypoint --> garageEntrypoint : child (only if >1 storage allocation defined in daemon.yml)
-    garageEntrypoint --> garage : child (one per storage allocation)
-    garageEntrypoint --> garageApplyLayoutDiff : child
+    entrypoint --> garage : child (one per storage allocation)
+    entrypoint --> garageApplyLayoutDiff : child
 
     state "./bin/cryptic-net-main update-global-bucket" as updateGlobalBucket {
         updateGlobalBucket : * Runs once then exits
diff --git a/docs/dev/daemon-process-tree.svg b/docs/dev/daemon-process-tree.svg
index d5974a3..f673f0d 100644
--- a/docs/dev/daemon-process-tree.svg
+++ b/docs/dev/daemon-process-tree.svg
@@ -1,15 +1,15 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="739px" preserveAspectRatio="none" style="width:1695px;height:739px;background:#FFFFFF;" version="1.1" viewBox="0 0 1695 739" width="1695px" zoomAndPan="magnify"><defs/><g><!--MD5=[94d69829b8642ebae4272c0fe4460dd1]
-cluster AppDir--><g id="cluster_AppDir"><path d="M19.5,110 L1669.5,110 A12.5,12.5 0 0 1 1682,122.5 L1682,136.2969 L7,136.2969 L7,122.5 A12.5,12.5 0 0 1 19.5,110 " fill="#F1F1F1" style="stroke:#F1F1F1;stroke-width:1.0;"/><rect height="623" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;fill:none;" width="1675" x="7" y="110"/><line style="stroke:#181818;stroke-width:0.5;fill:none;" x1="7" x2="1682" y1="136.2969" y2="136.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="46" x="821.5" y="126.9951">AppDir</text></g><g id="elem_N1"><path d="M1156.5,159 L1156.5,184.1328 L1519.5,184.1328 L1519.5,169 L1509.5,159 L1156.5,159 " fill="#FEFFDD" style="stroke:#181818;stroke-width:0.5;"/><path d="M1509.5,159 L1509.5,169 L1519.5,169 L1509.5,159 " fill="#FEFFDD" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="342" x="1162.5" y="176.0669">All relative paths are relative to the root of the AppDir</text></g><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="407" x="23.5" y="662.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="397" x="28.5" y="687.3467">./bin/dnsmasq -d -C $_RUNTIME_DIR_PATH/dnsmasq.conf</text><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="380" x="466" y="662.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="370" x="471" y="687.3467">./bin/nebula -config $_RUNTIME_DIR_PATH/nebula.yml</text><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="417" x="881.5" y="662.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="407" x="886.5" y="687.3467">./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server</text><g id="AppDir.AppRun"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="196" x="618" y="145"/><line style="stroke:#181818;stroke-width:0.5;" x1="618" x2="814" y1="171.2969" y2="171.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="64" x="684" y="162.9951">./AppRun</text><ellipse cx="628.5" cy="185.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="163" x="636" y="189.292">Set PATH to APPDIR/bin</text></g><g id="AppDir.entrypoint"><rect fill="#F1F1F1" height="134.0781" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="434" x="499" y="275"/><line style="stroke:#181818;stroke-width:0.5;" x1="499" x2="933" y1="301.2969" y2="301.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="395" x="518.5" y="292.9951">./bin/cryptic-net-main entrypoint daemon -c ./daemon.yml</text><ellipse cx="509.5" cy="315.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="299" x="517" y="319.292">Create runtime dir at $_RUNTIME_DIR_PATH</text><ellipse cx="509.5" cy="331.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="110" x="517" y="335.5889">Lock runtime dir</text><ellipse cx="509.5" cy="347.6875" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="285" x="517" y="351.8857">Merge given and default daemon.yml files</text><ellipse cx="509.5" cy="363.9844" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="401" x="517" y="368.1826">Copy bootstrap.tgz into $_DATA_DIR_PATH, if it's not there</text><ellipse cx="509.5" cy="380.2813" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="305" x="517" y="384.4795">Merge daemon.yml config into bootstrap.tgz</text><ellipse cx="509.5" cy="396.5781" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="141" x="517" y="400.7764">Run child processes</text></g><g id="AppDir.dnsmasqEntrypoint"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="340" x="23" y="502"/><line style="stroke:#181818;stroke-width:0.5;" x1="23" x2="363" y1="528.2969" y2="528.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="174" x="106" y="519.9951">./bin/dnsmasq-entrypoint</text><ellipse cx="33.5" cy="542.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="307" x="41" y="546.292">Create $_RUNTIME_DIR_PATH/dnsmasq.conf</text></g><g id="AppDir.nebulaEntrypoint"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="316" x="398" y="502"/><line style="stroke:#181818;stroke-width:0.5;" x1="398" x2="714" y1="528.2969" y2="528.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="272" x="420" y="519.9951">./bin/cryptic-net-main nebula-entrypoint</text><ellipse cx="408.5" cy="542.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="283" x="416" y="546.292">Create $_RUNTIME_DIR_PATH/nebula.yml</text></g><g id="AppDir.garageEntrypoint"><rect fill="#F1F1F1" height="85.1875" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="339" x="749.5" y="486"/><line style="stroke:#181818;stroke-width:0.5;" x1="749.5" x2="1088.5" y1="512.2969" y2="512.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="273" x="782.5" y="503.9951">./bin/cryptic-net-main garage-entrypoint</text><ellipse cx="760" cy="526.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="306" x="767.5" y="530.292">Create $_RUNTIME_DIR_PATH/garage-N.toml</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="190" x="762.5" y="546.5889">(one per storage allocation)</text><ellipse cx="760" cy="558.6875" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="141" x="767.5" y="562.8857">Run child processes</text></g><g id="AppDir.garageApplyLayoutDiff"><rect fill="#F1F1F1" height="68.8906" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="215" x="1333.5" y="648"/><line style="stroke:#181818;stroke-width:0.5;" x1="1333.5" x2="1548.5" y1="674.2969" y2="674.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="195" x="1343.5" y="665.9951">./bin/garage-apply-layout-diff</text><ellipse cx="1344" cy="688.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="147" x="1351.5" y="692.292">Runs once then exits</text><ellipse cx="1344" cy="704.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="145" x="1351.5" y="708.5889">Updates cluster topo</text></g><g id="AppDir.updateGlobalBucket"><rect fill="#F1F1F1" height="68.8906" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="542" x="1124" y="494"/><line style="stroke:#181818;stroke-width:0.5;" x1="1124" x2="1666" y1="520.2969" y2="520.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="298" x="1246" y="511.9951">./bin/cryptic-net-main update-global-bucket</text><ellipse cx="1134.5" cy="534.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="147" x="1142" y="538.292">Runs once then exits</text><ellipse cx="1134.5" cy="550.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="509" x="1142" y="554.5889">Updates the bootstrap data for the host in garage for other hosts to query</text></g><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="267" x="582.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="257" x="587.5" y="31.8467">./cryptic-net daemon -c ./daemon.yml</text><!--MD5=[99e1226540a30c5125aeac95dc2932fd]
-link init to AppRun--><g id="link_init_AppRun"><path d="M716,47.22 C716,70.96 716,111.66 716,139.76 " fill="none" id="init-to-AppRun" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="716,144.85,720,135.85,716,139.85,712,135.85,716,144.85" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="717" y="90.0669">exec</text></g><!--MD5=[973be3d7ea581194d5ee3fc39a24a200]
-link AppRun to entrypoint--><g id="link_AppRun_entrypoint"><path d="M716,198.09 C716,217.17 716,244.2 716,269.64 " fill="none" id="AppRun-to-entrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="716,274.7,720,265.7,716,269.7,712,265.7,716,274.7" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="717" y="241.0669">exec</text></g><!--MD5=[083a25c5b19d53ca66969ca5947a1cf6]
-link entrypoint to dnsmasqEntrypoint--><g id="link_entrypoint_dnsmasqEntrypoint"><path d="M528.66,409.09 C439.64,440.49 338.12,476.3 270.26,500.25 " fill="none" id="entrypoint-to-dnsmasqEntrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="265.43,501.95,275.2486,502.7219,270.1442,500.2837,272.5824,495.1793,265.43,501.95" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="439" y="452.0669">child</text></g><!--MD5=[c7ea69d4ff6721f817d13683540cf18f]
-link dnsmasqEntrypoint to dnsmasq--><g id="link_dnsmasqEntrypoint_dnsmasq"><path d="M198.77,555.28 C205.15,583.83 215.36,629.48 221.6,657.35 " fill="none" id="dnsmasqEntrypoint-to-dnsmasq" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="222.71,662.34,224.6294,652.68,221.6087,657.4628,216.8259,654.4421,222.71,662.34" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="213" y="614.0669">exec</text></g><!--MD5=[e57db689e698a4cac2a90f0a38fcb110]
-link entrypoint to nebulaEntrypoint--><g id="link_entrypoint_nebulaEntrypoint"><path d="M658.69,409.09 C632.41,439.39 602.57,473.79 581.86,497.68 " fill="none" id="entrypoint-to-nebulaEntrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="578.36,501.72,587.2801,497.5449,581.6374,497.9439,581.2384,492.3011,578.36,501.72" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="632" y="452.0669">child</text></g><!--MD5=[b8917cf0c8fa712950e6c2e129fc0a6a]
-link nebulaEntrypoint to nebula--><g id="link_nebulaEntrypoint_nebula"><path d="M572.96,555.28 C591.9,584.07 622.28,630.24 640.57,658.04 " fill="none" id="nebulaEntrypoint-to-nebula" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="643.4,662.34,641.7744,652.6262,640.643,658.1688,635.1004,657.0374,643.4,662.34" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="612" y="614.0669">exec</text></g><!--MD5=[b16f4e4f6f0194775e8cc00ba594229f]
-link entrypoint to garageEntrypoint--><g id="link_entrypoint_garageEntrypoint"><path d="M788.71,409.09 C815.5,433.43 845.19,460.42 869.46,482.48 " fill="none" id="entrypoint-to-garageEntrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="873.31,485.97,869.3516,476.9516,869.6142,482.6024,863.9634,482.8649,873.31,485.97" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="371" x="836" y="452.0669">child (only if &gt;1 storage allocation defined in daemon.yml)</text></g><!--MD5=[7604ba225da9a0d6f108d03d7e486e8b]
-link garageEntrypoint to garage--><g id="link_garageEntrypoint_garage"><path d="M965.73,571.03 C997.45,599.24 1038.22,635.47 1064.23,658.6 " fill="none" id="garageEntrypoint-to-garage" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1068.28,662.19,1064.1938,653.2288,1064.5367,658.8753,1058.8902,659.2182,1068.28,662.19" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="210" x="1015" y="614.0669">child (one per storage allocation)</text></g><!--MD5=[7472d79ac569d4db6634ba16e8ae6010]
-link garageEntrypoint to garageApplyLayoutDiff--><g id="link_garageEntrypoint_garageApplyLayoutDiff"><path d="M1088.57,566.87 C1154.86,581.7 1218.75,596.33 1234,601 C1275.46,613.69 1320.44,630.77 1357.84,645.92 " fill="none" id="garageEntrypoint-to-garageApplyLayoutDiff" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1362.83,647.95,1356.0044,640.85,1358.1995,646.0635,1352.986,648.2587,1362.83,647.95" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="1281" y="614.0669">child</text></g><!--MD5=[4233354f179cceff861e35de62bdca51]
-link entrypoint to updateGlobalBucket--><g id="link_entrypoint_updateGlobalBucket"><path d="M933.08,371.59 C1022.15,386.68 1125.41,408.53 1216,439 C1256.25,452.54 1298.97,473.38 1332.57,491.44 " fill="none" id="entrypoint-to-updateGlobalBucket" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1337.04,493.86,1331.0348,486.0538,1332.6445,491.4767,1327.2216,493.0865,1337.04,493.86" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="1257" y="452.0669">child</text></g><!--MD5=[282cac2ac98d05852bae94f25970d56b]
+<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="750px" preserveAspectRatio="none" style="width:2047px;height:750px;background:#FFFFFF;" version="1.1" viewBox="0 0 2047 750" width="2047px" zoomAndPan="magnify"><defs/><g><!--MD5=[94d69829b8642ebae4272c0fe4460dd1]
+cluster AppDir--><g id="cluster_AppDir"><path d="M19.5,110 L2021.5,110 A12.5,12.5 0 0 1 2034,122.5 L2034,136.2969 L7,136.2969 L7,122.5 A12.5,12.5 0 0 1 19.5,110 " fill="#F1F1F1" style="stroke:#F1F1F1;stroke-width:1.0;"/><rect height="634" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;fill:none;" width="2027" x="7" y="110"/><line style="stroke:#181818;stroke-width:0.5;fill:none;" x1="7" x2="2034" y1="136.2969" y2="136.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="46" x="997.5" y="126.9951">AppDir</text></g><!--MD5=[08fd51992b07af842a340419e4e827c0]
+cluster garageChildren--><g id="cluster_garageChildren"><path d="M1323.5,505 L1997.5,505 A12.5,12.5 0 0 1 2010,517.5 L2010,531.2969 L1311,531.2969 L1311,517.5 A12.5,12.5 0 0 1 1323.5,505 " fill="#F1F1F1" style="stroke:#F1F1F1;stroke-width:1.0;"/><rect height="120" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;fill:none;" width="699" x="1311" y="505"/><line style="stroke:#181818;stroke-width:0.5;fill:none;" x1="1311" x2="2010" y1="531.2969" y2="531.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="390" x="1465.5" y="521.9951">Garage processes (only if any storage allocs are defined)</text></g><g id="elem_N1"><path d="M1404.5,159 L1404.5,184.1328 L1767.5,184.1328 L1767.5,169 L1757.5,159 L1404.5,159 " fill="#FEFFDD" style="stroke:#181818;stroke-width:0.5;"/><path d="M1757.5,159 L1757.5,169 L1767.5,169 L1757.5,159 " fill="#FEFFDD" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="342" x="1410.5" y="176.0669">All relative paths are relative to the root of the AppDir</text></g><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="407" x="23.5" y="688"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="397" x="28.5" y="712.8467">./bin/dnsmasq -d -C $_RUNTIME_DIR_PATH/dnsmasq.conf</text><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="380" x="466" y="688"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="370" x="471" y="712.8467">./bin/nebula -config $_RUNTIME_DIR_PATH/nebula.yml</text><g id="AppDir.AppRun"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="196" x="922" y="145"/><line style="stroke:#181818;stroke-width:0.5;" x1="922" x2="1118" y1="171.2969" y2="171.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="64" x="988" y="162.9951">./AppRun</text><ellipse cx="932.5" cy="185.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="163" x="940" y="189.292">Set PATH to APPDIR/bin</text></g><g id="AppDir.entrypoint"><rect fill="#F1F1F1" height="166.6719" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="434" x="803" y="275"/><line style="stroke:#181818;stroke-width:0.5;" x1="803" x2="1237" y1="301.2969" y2="301.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="395" x="822.5" y="292.9951">./bin/cryptic-net-main entrypoint daemon -c ./daemon.yml</text><ellipse cx="813.5" cy="315.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="299" x="821" y="319.292">Create runtime dir at $_RUNTIME_DIR_PATH</text><ellipse cx="813.5" cy="331.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="110" x="821" y="335.5889">Lock runtime dir</text><ellipse cx="813.5" cy="347.6875" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="285" x="821" y="351.8857">Merge given and default daemon.yml files</text><ellipse cx="813.5" cy="363.9844" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="401" x="821" y="368.1826">Copy bootstrap.tgz into $_DATA_DIR_PATH, if it's not there</text><ellipse cx="813.5" cy="380.2813" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="305" x="821" y="384.4795">Merge daemon.yml config into bootstrap.tgz</text><ellipse cx="813.5" cy="396.5781" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="306" x="821" y="400.7764">Create $_RUNTIME_DIR_PATH/garage-N.toml</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="190" x="816" y="417.0732">(one per storage allocation)</text><ellipse cx="813.5" cy="429.1719" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="141" x="821" y="433.3701">Run child processes</text></g><g id="AppDir.dnsmasqEntrypoint"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="340" x="23" y="548"/><line style="stroke:#181818;stroke-width:0.5;" x1="23" x2="363" y1="574.2969" y2="574.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="174" x="106" y="565.9951">./bin/dnsmasq-entrypoint</text><ellipse cx="33.5" cy="588.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="307" x="41" y="592.292">Create $_RUNTIME_DIR_PATH/dnsmasq.conf</text></g><g id="AppDir.nebulaEntrypoint"><rect fill="#F1F1F1" height="52.5938" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="316" x="398" y="548"/><line style="stroke:#181818;stroke-width:0.5;" x1="398" x2="714" y1="574.2969" y2="574.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="272" x="420" y="565.9951">./bin/cryptic-net-main nebula-entrypoint</text><ellipse cx="408.5" cy="588.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="283" x="416" y="592.292">Create $_RUNTIME_DIR_PATH/nebula.yml</text></g><g id="AppDir.updateGlobalBucket"><rect fill="#F1F1F1" height="68.8906" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="542" x="749" y="540"/><line style="stroke:#181818;stroke-width:0.5;" x1="749" x2="1291" y1="566.2969" y2="566.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="298" x="871" y="557.9951">./bin/cryptic-net-main update-global-bucket</text><ellipse cx="759.5" cy="580.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="147" x="767" y="584.292">Runs once then exits</text><ellipse cx="759.5" cy="596.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="509" x="767" y="600.5889">Updates the bootstrap data for the host in garage for other hosts to query</text></g><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="417" x="1326.5" y="554.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="407" x="1331.5" y="579.3467">./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server</text><g id="AppDir.garageChildren.garageApplyLayoutDiff"><rect fill="#F1F1F1" height="68.8906" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="215" x="1778.5" y="540"/><line style="stroke:#181818;stroke-width:0.5;" x1="1778.5" x2="1993.5" y1="566.2969" y2="566.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="195" x="1788.5" y="557.9951">./bin/garage-apply-layout-diff</text><ellipse cx="1789" cy="580.0938" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="147" x="1796.5" y="584.292">Runs once then exits</text><ellipse cx="1789" cy="596.3906" fill="#000000" rx="2.5" ry="2.5" style="stroke:#000000;stroke-width:0.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="145" x="1796.5" y="600.5889">Updates cluster topo</text></g><rect fill="#F1F1F1" height="40" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="267" x="886.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="257" x="891.5" y="31.8467">./cryptic-net daemon -c ./daemon.yml</text><!--MD5=[99e1226540a30c5125aeac95dc2932fd]
+link init to AppRun--><g id="link_init_AppRun"><path d="M1020,47.22 C1020,70.96 1020,111.66 1020,139.76 " fill="none" id="init-to-AppRun" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1020,144.85,1024,135.85,1020,139.85,1016,135.85,1020,144.85" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="1021" y="90.0669">exec</text></g><!--MD5=[973be3d7ea581194d5ee3fc39a24a200]
+link AppRun to entrypoint--><g id="link_AppRun_entrypoint"><path d="M1020,198.22 C1020,216.93 1020,243.44 1020,269.48 " fill="none" id="AppRun-to-entrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1020,274.68,1024,265.68,1020,269.68,1016,265.68,1020,274.68" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="1021" y="241.0669">exec</text></g><!--MD5=[083a25c5b19d53ca66969ca5947a1cf6]
+link entrypoint to dnsmasqEntrypoint--><g id="link_entrypoint_dnsmasqEntrypoint"><path d="M802.76,396.49 C677.99,420.15 519.12,454.4 381,497 C337.33,510.47 289.67,529.92 253.26,545.84 " fill="none" id="entrypoint-to-dnsmasqEntrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="248.42,547.96,258.2686,548.0285,253.0031,545.9612,255.0705,540.6956,248.42,547.96" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="467" y="485.0669">child</text></g><!--MD5=[c7ea69d4ff6721f817d13683540cf18f]
+link dnsmasqEntrypoint to dnsmasq--><g id="link_dnsmasqEntrypoint_dnsmasq"><path d="M199.64,601.17 C205.74,624.79 214.74,659.58 220.73,682.75 " fill="none" id="dnsmasqEntrypoint-to-dnsmasq" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="222.04,687.8,223.6772,678.0882,220.7971,682.9569,215.9283,680.0768,222.04,687.8" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="215" y="654.0669">exec</text></g><!--MD5=[e57db689e698a4cac2a90f0a38fcb110]
+link entrypoint to nebulaEntrypoint--><g id="link_entrypoint_nebulaEntrypoint"><path d="M840.94,442.08 C761.4,478.77 673.08,519.5 616.17,545.75 " fill="none" id="entrypoint-to-nebulaEntrypoint" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="611.44,547.93,621.2876,547.7726,615.976,545.8265,617.9221,540.515,611.44,547.93" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="775" y="485.0669">child</text></g><!--MD5=[b8917cf0c8fa712950e6c2e129fc0a6a]
+link nebulaEntrypoint to nebula--><g id="link_nebulaEntrypoint_nebula"><path d="M575.52,601.17 C593.71,625.09 620.61,660.46 638.22,683.62 " fill="none" id="nebulaEntrypoint-to-nebula" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="641.4,687.8,639.1232,678.2179,638.3681,683.8242,632.7618,683.069,641.4,687.8" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="618" y="654.0669">exec</text></g><!--MD5=[dfc682edd6f75b156d1c4e2d31fc76ae]
+link entrypoint to garage--><g id="link_entrypoint_garage"><path d="M1218.74,442.08 C1314.93,482.06 1422.68,526.83 1484.32,552.44 " fill="none" id="entrypoint-to-garage" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1489.04,554.4,1482.2598,547.2566,1484.4217,552.484,1479.1942,554.6459,1489.04,554.4" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="210" x="1324" y="485.0669">child (one per storage allocation)</text></g><!--MD5=[acaf0598dc7a7d048b3826b328f66e81]
+link entrypoint to garageApplyLayoutDiff--><g id="link_entrypoint_garageApplyLayoutDiff"><path d="M1237.27,378.69 C1388.07,397.04 1591.5,431.97 1761,497 C1787.17,507.04 1813.96,522.6 1835.99,537.08 " fill="none" id="entrypoint-to-garageApplyLayoutDiff" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1840.34,539.96,1835.0703,531.6395,1836.1797,537.1865,1830.6327,538.2959,1840.34,539.96" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="1723" y="485.0669">child</text></g><!--MD5=[4233354f179cceff861e35de62bdca51]
+link entrypoint to updateGlobalBucket--><g id="link_entrypoint_updateGlobalBucket"><path d="M1020,442.24 C1020,474.1 1020,509 1020,534.8 " fill="none" id="entrypoint-to-updateGlobalBucket" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1020,539.83,1024,530.83,1020,534.83,1016,530.83,1020,539.83" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="29" x="1021" y="485.0669">child</text></g><!--MD5=[e9a8e0e5ac3aebd4696d0254464dfa86]
 @startuml
 hide empty description
 
@@ -29,6 +29,7 @@ state AppDir {
         entrypoint : * Merge given and default daemon.yml files
         entrypoint : * Copy bootstrap.tgz into $_DATA_DIR_PATH, if it's not there
         entrypoint : * Merge daemon.yml config into bootstrap.tgz
+        entrypoint : * Create $_RUNTIME_DIR_PATH/garage-N.toml\n  (one per storage allocation)
         entrypoint : * Run child processes
     }
 
@@ -53,20 +54,17 @@ state AppDir {
     entrypoint - -> nebulaEntrypoint : child
     nebulaEntrypoint - -> nebula : exec
 
-    state "./bin/cryptic-net-main garage-entrypoint" as garageEntrypoint {
-        garageEntrypoint : * Create $_RUNTIME_DIR_PATH/garage-N.toml\n  (one per storage allocation)
-        garageEntrypoint : * Run child processes
+    state "Garage processes (only if any storage allocs are defined)" as garageChildren {
+
+        state "./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server" as garage
+        state "./bin/garage-apply-layout-diff" as garageApplyLayoutDiff {
+            garageApplyLayoutDiff : * Runs once then exits
+            garageApplyLayoutDiff : * Updates cluster topo
+        }
     }
 
-    state "./bin/garage -c $_RUNTIME_DIR_PATH/garage-N.toml server" as garage
-    state "./bin/garage-apply-layout-diff" as garageApplyLayoutDiff {
-        garageApplyLayoutDiff : * Runs once then exits
-        garageApplyLayoutDiff : * Updates cluster topo
-    }
-
-    entrypoint - -> garageEntrypoint : child (only if >1 storage allocation defined in daemon.yml)
-    garageEntrypoint - -> garage : child (one per storage allocation)
-    garageEntrypoint - -> garageApplyLayoutDiff : child
+    entrypoint - -> garage : child (one per storage allocation)
+    entrypoint - -> garageApplyLayoutDiff : child
 
     state "./bin/cryptic-net-main update-global-bucket" as updateGlobalBucket {
         updateGlobalBucket : * Runs once then exits
diff --git a/go-workspace/src/cmd/cryptic-net-main/main.go b/go-workspace/src/cmd/cryptic-net-main/main.go
index 613294b..0220e8a 100644
--- a/go-workspace/src/cmd/cryptic-net-main/main.go
+++ b/go-workspace/src/cmd/cryptic-net-main/main.go
@@ -16,7 +16,6 @@ package main
 
 import (
 	"cryptic-net/cmd/entrypoint"
-	garage_entrypoint "cryptic-net/cmd/garage-entrypoint"
 	garage_layout_diff "cryptic-net/cmd/garage-layout-diff"
 	garage_peer_keygen "cryptic-net/cmd/garage-peer-keygen"
 	nebula_entrypoint "cryptic-net/cmd/nebula-entrypoint"
@@ -32,7 +31,6 @@ type mainFn struct {
 
 var mainFns = []mainFn{
 	{"entrypoint", entrypoint.Main},
-	{"garage-entrypoint", garage_entrypoint.Main},
 	{"garage-layout-diff", garage_layout_diff.Main},
 	{"garage-peer-keygen", garage_peer_keygen.Main},
 	{"nebula-entrypoint", nebula_entrypoint.Main},
diff --git a/go-workspace/src/cmd/entrypoint/daemon.go b/go-workspace/src/cmd/entrypoint/daemon.go
index 2f1702a..b25af6a 100644
--- a/go-workspace/src/cmd/entrypoint/daemon.go
+++ b/go-workspace/src/cmd/entrypoint/daemon.go
@@ -5,23 +5,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
 	"os"
 	"path/filepath"
-	"strconv"
 	"sync"
 	"time"
 
 	crypticnet "cryptic-net"
 	"cryptic-net/bootstrap"
 	"cryptic-net/garage"
-	"cryptic-net/yamlutil"
 
 	"github.com/cryptic-io/pmux/pmuxlib"
-	"github.com/imdario/mergo"
-	"gopkg.in/yaml.v3"
 )
 
 // The daemon sub-command deals with starting an actual cryptic-net daemon
@@ -46,70 +39,6 @@ import (
 //
 // * (On exit) cleans up the runtime directory.
 
-func writeDaemonYml(userDaemonYmlPath, builtinDaemonYmlPath, runtimeDirPath string) error {
-
-	var fullDaemonYml map[string]interface{}
-
-	if err := yamlutil.LoadYamlFile(&fullDaemonYml, builtinDaemonYmlPath); err != nil {
-		return fmt.Errorf("parsing builtin daemon.yml file: %w", err)
-	}
-
-	if userDaemonYmlPath != "" {
-
-		var daemonYml map[string]interface{}
-		if err := yamlutil.LoadYamlFile(&daemonYml, userDaemonYmlPath); err != nil {
-			return fmt.Errorf("parsing %q: %w", userDaemonYmlPath, err)
-		}
-
-		err := mergo.Merge(&fullDaemonYml, daemonYml, mergo.WithOverride)
-		if err != nil {
-			return fmt.Errorf("merging contents of file %q: %w", userDaemonYmlPath, err)
-		}
-	}
-
-	fullDaemonYmlB, err := yaml.Marshal(fullDaemonYml)
-
-	if err != nil {
-		return fmt.Errorf("yaml marshaling daemon config: %w", err)
-	}
-
-	daemonYmlPath := filepath.Join(runtimeDirPath, "daemon.yml")
-
-	if err := ioutil.WriteFile(daemonYmlPath, fullDaemonYmlB, 0400); err != nil {
-		return fmt.Errorf("writing daemon.yml file to %q: %w", daemonYmlPath, err)
-	}
-
-	return nil
-}
-
-func copyBootstrapToDataDir(env *crypticnet.Env, r io.Reader) error {
-
-	path := env.DataDirBootstrapPath()
-	dirPath := filepath.Dir(path)
-
-	if err := os.MkdirAll(dirPath, 0700); err != nil {
-		return fmt.Errorf("creating directory %q: %w", dirPath, err)
-	}
-
-	f, err := os.Create(path)
-	if err != nil {
-		return fmt.Errorf("creating file %q: %w", path, err)
-	}
-
-	_, err = io.Copy(f, r)
-	f.Close()
-
-	if err != nil {
-		return fmt.Errorf("copying bootstrap file to %q: %w", path, err)
-	}
-
-	if err := env.LoadBootstrap(path); err != nil {
-		return fmt.Errorf("loading bootstrap from %q: %w", path, err)
-	}
-
-	return nil
-}
-
 // creates a new bootstrap file using available information from the network. If
 // the new bootstrap file is different than the existing one, the existing one
 // is overwritten, ReloadBootstrap is called on env, true is returned.
@@ -156,65 +85,31 @@ func runDaemonPmuxOnce(env *crypticnet.Env, s3Client garage.S3APIClient) error {
 	fmt.Fprintf(os.Stderr, "host name is %q, ip is %q\n", thisHost.Name, thisHost.Nebula.IP)
 
 	pmuxProcConfigs := []pmuxlib.ProcessConfig{
-		{
-			Name: "nebula",
-			Cmd:  "cryptic-net-main",
-			Args: []string{
-				"nebula-entrypoint",
-			},
-		},
+		nebulaEntrypointPmuxProcConfig(),
 		{
 			Name: "dnsmasq",
 			Cmd:  "bash",
-			Args: []string{
-				"wait-for-ip",
-				thisHost.Nebula.IP,
-				"dnsmasq-entrypoint",
-			},
+			Args: waitForNebulaArgs(env, "dnsmasq-entrypoint"),
 		},
 	}
 
-	{
-		var args []string
+	if len(thisDaemon.Storage.Allocations) > 0 {
 
-		if allocs := thisDaemon.Storage.Allocations; len(allocs) > 0 {
-			for _, alloc := range allocs {
-				args = append(
-					args,
-					"wait-for",
-					net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.RPCPort)),
-					"--",
-				)
-			}
-		} else {
-			args = []string{
-				"wait-for-ip",
-				thisHost.Nebula.IP,
-			}
+		garageChildrenPmuxProcConfigs, err := garageChildrenPmuxProcConfigs(env)
+		if err != nil {
+			return fmt.Errorf("generating garage children configs: %w", err)
 		}
 
-		pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
-			Name:        "update-global-bucket",
-			Cmd:         "bash",
-			Args:        append(args, "update-global-bucket"),
-			NoRestartOn: []int{0},
-		})
+		pmuxProcConfigs = append(pmuxProcConfigs, garageChildrenPmuxProcConfigs...)
+		pmuxProcConfigs = append(pmuxProcConfigs, garageApplyLayoutDiffPmuxProcConfig(env))
 	}
 
-	if len(thisDaemon.Storage.Allocations) > 0 {
-		pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
-			Name: "garage",
-			Cmd:  "bash",
-			Args: []string{
-				"wait-for-ip",
-				thisHost.Nebula.IP,
-				"cryptic-net-main", "garage-entrypoint",
-			},
-
-			// garage can take a while to clean up
-			SigKillWait: (1 * time.Minute) + (10 * time.Second),
-		})
-	}
+	pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
+		Name:        "update-global-bucket",
+		Cmd:         "bash",
+		Args:        waitForGarageArgs(env, "update-global-bucket"),
+		NoRestartOn: []int{0},
+	})
 
 	pmuxConfig := pmuxlib.Config{Processes: pmuxProcConfigs}
 
@@ -360,48 +255,17 @@ var subCmdDaemon = subCmd{
 			}
 		}
 
-		if err := writeDaemonYml(*daemonYmlPath, builtinDaemonYmlPath, runtimeDirPath); err != nil {
+		if err := writeMergedDaemonYml(env, *daemonYmlPath); err != nil {
 			return fmt.Errorf("generating daemon.yml file: %w", err)
 		}
 
-		{
-			// we update this Host's data using whatever configuration has been
-			// provided by daemon.yml. This way the daemon has the most
-			// up-to-date possible bootstrap. This updated bootstrap will later
-			// get updated in garage using update-global-bucket, so other hosts
-			// will see it as well.
-
-			// ThisDaemon can only be called after writeDaemonYml.
-			daemon := env.ThisDaemon()
-			host := env.Bootstrap.ThisHost()
-
-			host.Nebula.PublicAddr = daemon.VPN.PublicAddr
-
-			host.Garage = nil
-
-			if allocs := daemon.Storage.Allocations; len(allocs) > 0 {
-
-				host.Garage = new(bootstrap.GarageHost)
-
-				for _, alloc := range allocs {
-					host.Garage.Instances = append(host.Garage.Instances, bootstrap.GarageHostInstance{
-						RPCPort:   alloc.RPCPort,
-						S3APIPort: alloc.S3APIPort,
-						WebPort:   alloc.WebPort,
-					})
-				}
-			}
-
-			env.Bootstrap.Hosts[host.Name] = host
-
-			buf := new(bytes.Buffer)
-			if err := env.Bootstrap.WithHosts(env.Bootstrap.Hosts).WriteTo(buf); err != nil {
-				return fmt.Errorf("writing new bootstrap file to buffer: %w", err)
-			}
-
-			if err := copyBootstrapToDataDir(env, buf); err != nil {
-				return fmt.Errorf("copying new bootstrap file to data dir: %w", err)
-			}
+		// we update this Host's data using whatever configuration has been
+		// provided by daemon.yml. This way the daemon has the most
+		// up-to-date possible bootstrap. This updated bootstrap will later
+		// get updated in garage using update-global-bucket, so other hosts
+		// will see it as well.
+		if err := mergeDaemonIntoBootstrap(env); err != nil {
+			return fmt.Errorf("merging daemon.yml into bootstrap data: %w", err)
 		}
 
 		for key, val := range env.ToMap() {
diff --git a/go-workspace/src/cmd/entrypoint/daemon_util.go b/go-workspace/src/cmd/entrypoint/daemon_util.go
new file mode 100644
index 0000000..5e01e1b
--- /dev/null
+++ b/go-workspace/src/cmd/entrypoint/daemon_util.go
@@ -0,0 +1,205 @@
+package entrypoint
+
+import (
+	"bytes"
+	crypticnet "cryptic-net"
+	"cryptic-net/bootstrap"
+	"cryptic-net/garage"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	"github.com/cryptic-io/pmux/pmuxlib"
+)
+
+func copyBootstrapToDataDir(env *crypticnet.Env, r io.Reader) error {
+
+	path := env.DataDirBootstrapPath()
+	dirPath := filepath.Dir(path)
+
+	if err := os.MkdirAll(dirPath, 0700); err != nil {
+		return fmt.Errorf("creating directory %q: %w", dirPath, err)
+	}
+
+	f, err := os.Create(path)
+	if err != nil {
+		return fmt.Errorf("creating file %q: %w", path, err)
+	}
+
+	_, err = io.Copy(f, r)
+	f.Close()
+
+	if err != nil {
+		return fmt.Errorf("copying bootstrap file to %q: %w", path, err)
+	}
+
+	if err := env.LoadBootstrap(path); err != nil {
+		return fmt.Errorf("loading bootstrap from %q: %w", path, err)
+	}
+
+	return nil
+}
+
+func mergeDaemonIntoBootstrap(env *crypticnet.Env) error {
+	daemon := env.ThisDaemon()
+	host := env.Bootstrap.ThisHost()
+
+	host.Nebula.PublicAddr = daemon.VPN.PublicAddr
+
+	host.Garage = nil
+
+	if allocs := daemon.Storage.Allocations; len(allocs) > 0 {
+
+		host.Garage = new(bootstrap.GarageHost)
+
+		for _, alloc := range allocs {
+			host.Garage.Instances = append(host.Garage.Instances, bootstrap.GarageHostInstance{
+				RPCPort:   alloc.RPCPort,
+				S3APIPort: alloc.S3APIPort,
+				WebPort:   alloc.WebPort,
+			})
+		}
+	}
+
+	env.Bootstrap.Hosts[host.Name] = host
+
+	buf := new(bytes.Buffer)
+	if err := env.Bootstrap.WithHosts(env.Bootstrap.Hosts).WriteTo(buf); err != nil {
+		return fmt.Errorf("writing new bootstrap file to buffer: %w", err)
+	}
+
+	if err := copyBootstrapToDataDir(env, buf); err != nil {
+		return fmt.Errorf("copying new bootstrap file to data dir: %w", err)
+	}
+
+	return nil
+}
+
+func waitForNebulaArgs(env *crypticnet.Env, args ...string) []string {
+	thisHost := env.Bootstrap.ThisHost()
+	return append([]string{"wait-for-ip", thisHost.Nebula.IP}, args...)
+}
+
+func waitForGarageArgs(env *crypticnet.Env, args ...string) []string {
+
+	thisHost := env.Bootstrap.ThisHost()
+	allocs := env.ThisDaemon().Storage.Allocations
+
+	if len(allocs) == 0 {
+		return waitForNebulaArgs(env, args...)
+	}
+
+	var preArgs []string
+
+	for _, alloc := range allocs {
+		preArgs = append(
+			preArgs,
+			"wait-for",
+			net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.RPCPort)),
+			"--",
+		)
+	}
+
+	return append(preArgs, args...)
+}
+
+func nebulaEntrypointPmuxProcConfig() pmuxlib.ProcessConfig {
+	return pmuxlib.ProcessConfig{
+		Name: "nebula",
+		Cmd:  "cryptic-net-main",
+		Args: []string{
+			"nebula-entrypoint",
+		},
+	}
+}
+
+func garageWriteChildConf(
+	env *crypticnet.Env,
+	alloc crypticnet.DaemonYmlStorageAllocation,
+) (
+	string, error,
+) {
+
+	if err := os.MkdirAll(alloc.MetaPath, 0750); err != nil {
+		return "", fmt.Errorf("making directory %q: %w", alloc.MetaPath, err)
+	}
+
+	thisHost := env.Bootstrap.ThisHost()
+
+	peer := garage.Peer{
+		IP:        thisHost.Nebula.IP,
+		RPCPort:   alloc.RPCPort,
+		S3APIPort: alloc.S3APIPort,
+	}
+
+	pubKey, privKey := peer.RPCPeerKey()
+
+	nodeKeyPath := filepath.Join(alloc.MetaPath, "node_key")
+	nodeKeyPubPath := filepath.Join(alloc.MetaPath, "node_keypub")
+
+	if err := os.WriteFile(nodeKeyPath, privKey, 0400); err != nil {
+		return "", fmt.Errorf("writing private key to %q: %w", nodeKeyPath, err)
+
+	} else if err := os.WriteFile(nodeKeyPubPath, pubKey, 0440); err != nil {
+		return "", fmt.Errorf("writing public key to %q: %w", nodeKeyPubPath, err)
+	}
+
+	garageTomlPath := filepath.Join(
+		env.RuntimeDirPath, fmt.Sprintf("garage-%d.toml", alloc.RPCPort),
+	)
+
+	err := garage.WriteGarageTomlFile(garageTomlPath, garage.GarageTomlData{
+		MetaPath: alloc.MetaPath,
+		DataPath: alloc.DataPath,
+
+		RPCSecret: env.Bootstrap.GarageRPCSecret,
+
+		RPCAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.RPCPort)),
+		APIAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.S3APIPort)),
+		WebAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.WebPort)),
+
+		BootstrapPeers: env.Bootstrap.GarageRPCPeerAddrs(),
+	})
+
+	if err != nil {
+		return "", fmt.Errorf("creating garage.toml file at %q: %w", garageTomlPath, err)
+	}
+
+	return garageTomlPath, nil
+}
+
+func garageChildrenPmuxProcConfigs(env *crypticnet.Env) ([]pmuxlib.ProcessConfig, error) {
+
+	var pmuxProcConfigs []pmuxlib.ProcessConfig
+
+	for _, alloc := range env.ThisDaemon().Storage.Allocations {
+
+		childConfPath, err := garageWriteChildConf(env, alloc)
+
+		if err != nil {
+			return nil, fmt.Errorf("writing child config file for alloc %+v: %w", alloc, err)
+		}
+
+		pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
+			Name:        fmt.Sprintf("garage-%d", alloc.RPCPort),
+			Cmd:         "garage",
+			Args:        []string{"-c", childConfPath, "server"},
+			SigKillWait: 1 * time.Minute,
+		})
+	}
+
+	return pmuxProcConfigs, nil
+}
+
+func garageApplyLayoutDiffPmuxProcConfig(env *crypticnet.Env) pmuxlib.ProcessConfig {
+	return pmuxlib.ProcessConfig{
+		Name:        "garage-apply-layout-diff",
+		Cmd:         "bash",
+		Args:        waitForGarageArgs(env, "bash", "garage-apply-layout-diff"),
+		NoRestartOn: []int{0},
+	}
+}
diff --git a/go-workspace/src/cmd/entrypoint/daemon_yml.go b/go-workspace/src/cmd/entrypoint/daemon_yml.go
new file mode 100644
index 0000000..2be5d0d
--- /dev/null
+++ b/go-workspace/src/cmd/entrypoint/daemon_yml.go
@@ -0,0 +1,72 @@
+package entrypoint
+
+import (
+	crypticnet "cryptic-net"
+	"cryptic-net/yamlutil"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/imdario/mergo"
+	"gopkg.in/yaml.v3"
+)
+
+func builtinDaemonYmlPath(env *crypticnet.Env) string {
+	return filepath.Join(env.AppDirPath, "etc", "daemon.yml")
+}
+
+func writeBuiltinDaemonYml(env *crypticnet.Env, w io.Writer) error {
+
+	builtinDaemonYmlPath := builtinDaemonYmlPath(env)
+
+	builtinDaemonYml, err := os.ReadFile(builtinDaemonYmlPath)
+	if err != nil {
+		return fmt.Errorf("reading default daemon.yml at %q: %w", builtinDaemonYmlPath, err)
+	}
+
+	if _, err := w.Write(builtinDaemonYml); err != nil {
+		return fmt.Errorf("writing default daemon.yml: %w", err)
+	}
+
+	return nil
+}
+
+func writeMergedDaemonYml(env *crypticnet.Env, userDaemonYmlPath string) error {
+
+	builtinDaemonYmlPath := builtinDaemonYmlPath(env)
+
+	var fullDaemonYml map[string]interface{}
+
+	if err := yamlutil.LoadYamlFile(&fullDaemonYml, builtinDaemonYmlPath); err != nil {
+		return fmt.Errorf("parsing builtin daemon.yml file: %w", err)
+	}
+
+	if userDaemonYmlPath != "" {
+
+		var daemonYml map[string]interface{}
+		if err := yamlutil.LoadYamlFile(&daemonYml, userDaemonYmlPath); err != nil {
+			return fmt.Errorf("parsing %q: %w", userDaemonYmlPath, err)
+		}
+
+		err := mergo.Merge(&fullDaemonYml, daemonYml, mergo.WithOverride)
+		if err != nil {
+			return fmt.Errorf("merging contents of file %q: %w", userDaemonYmlPath, err)
+		}
+	}
+
+	fullDaemonYmlB, err := yaml.Marshal(fullDaemonYml)
+
+	if err != nil {
+		return fmt.Errorf("yaml marshaling daemon config: %w", err)
+	}
+
+	daemonYmlPath := filepath.Join(env.RuntimeDirPath, "daemon.yml")
+
+	if err := ioutil.WriteFile(daemonYmlPath, fullDaemonYmlB, 0400); err != nil {
+		return fmt.Errorf("writing daemon.yml file to %q: %w", daemonYmlPath, err)
+	}
+
+	return nil
+}
diff --git a/go-workspace/src/cmd/garage-entrypoint/main.go b/go-workspace/src/cmd/garage-entrypoint/main.go
deleted file mode 100644
index 87228a7..0000000
--- a/go-workspace/src/cmd/garage-entrypoint/main.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package garage_entrypoint
-
-import (
-	"fmt"
-	"log"
-	"net"
-	"os"
-	"path/filepath"
-	"strconv"
-	"time"
-
-	crypticnet "cryptic-net"
-	"cryptic-net/garage"
-
-	"github.com/cryptic-io/pmux/pmuxlib"
-)
-
-func writeChildConf(
-	env *crypticnet.Env,
-	alloc crypticnet.DaemonYmlStorageAllocation,
-) (string, error) {
-
-	if err := os.MkdirAll(alloc.MetaPath, 0750); err != nil {
-		return "", fmt.Errorf("making directory %q: %w", alloc.MetaPath, err)
-	}
-
-	thisHost := env.Bootstrap.ThisHost()
-
-	peer := garage.Peer{
-		IP:        thisHost.Nebula.IP,
-		RPCPort:   alloc.RPCPort,
-		S3APIPort: alloc.S3APIPort,
-	}
-
-	pubKey, privKey := peer.RPCPeerKey()
-
-	nodeKeyPath := filepath.Join(alloc.MetaPath, "node_key")
-	nodeKeyPubPath := filepath.Join(alloc.MetaPath, "node_keypub")
-
-	if err := os.WriteFile(nodeKeyPath, privKey, 0400); err != nil {
-		return "", fmt.Errorf("writing private key to %q: %w", nodeKeyPath, err)
-
-	} else if err := os.WriteFile(nodeKeyPubPath, pubKey, 0440); err != nil {
-		return "", fmt.Errorf("writing public key to %q: %w", nodeKeyPubPath, err)
-	}
-
-	garageTomlPath := filepath.Join(
-		env.RuntimeDirPath, fmt.Sprintf("garage-%d.toml", alloc.RPCPort),
-	)
-
-	err := garage.WriteGarageTomlFile(garageTomlPath, garage.GarageTomlData{
-		MetaPath: alloc.MetaPath,
-		DataPath: alloc.DataPath,
-
-		RPCSecret: env.Bootstrap.GarageRPCSecret,
-
-		RPCAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.RPCPort)),
-		APIAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.S3APIPort)),
-		WebAddr: net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.WebPort)),
-
-		BootstrapPeers: env.Bootstrap.GarageRPCPeerAddrs(),
-	})
-
-	if err != nil {
-		return "", fmt.Errorf("creating garage.toml file at %q: %w", garageTomlPath, err)
-	}
-
-	return garageTomlPath, nil
-}
-
-func waitForArgs(env *crypticnet.Env, bin string, binArgs ...string) []string {
-
-	thisHost := env.Bootstrap.ThisHost()
-
-	var args []string
-
-	for _, alloc := range env.ThisDaemon().Storage.Allocations {
-		args = append(
-			args,
-			"wait-for",
-			net.JoinHostPort(thisHost.Nebula.IP, strconv.Itoa(alloc.RPCPort)),
-			"--",
-		)
-	}
-
-	args = append(args, bin)
-	args = append(args, binArgs...)
-
-	return args
-}
-
-func Main() {
-
-	env, err := crypticnet.ReadEnv()
-
-	if err != nil {
-		log.Fatalf("reading envvars: %v", err)
-	}
-
-	var pmuxProcConfigs []pmuxlib.ProcessConfig
-
-	for _, alloc := range env.ThisDaemon().Storage.Allocations {
-
-		childConfPath, err := writeChildConf(env, alloc)
-
-		if err != nil {
-			log.Fatalf("writing child config file for alloc %+v: %v", alloc, err)
-		}
-
-		log.Printf("wrote config file %q", childConfPath)
-
-		pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
-			Name:        fmt.Sprintf("garage-%d", alloc.RPCPort),
-			Cmd:         "garage",
-			Args:        []string{"-c", childConfPath, "server"},
-			SigKillWait: 1 * time.Minute,
-		})
-
-	}
-
-	pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
-		Name:        "garage-apply-layout-diff",
-		Cmd:         "bash",
-		Args:        waitForArgs(env, "bash", "garage-apply-layout-diff"),
-		NoRestartOn: []int{0},
-	})
-
-	pmuxlib.Run(env.Context, pmuxlib.Config{Processes: pmuxProcConfigs})
-}