diff --git a/core/installer/app_configs/dodo_app.cue b/core/installer/app_configs/dodo_app.cue
index b3da1ea..ff1a8ed 100644
--- a/core/installer/app_configs/dodo_app.cue
+++ b/core/installer/app_configs/dodo_app.cue
@@ -12,8 +12,9 @@
 	// VM uses this endpoint to load env variables from dodo-app server.
 	// app-runner registers itself as worker, which later is used by dodo-app server
 	// to ping runners on git push.
-	managerAddr: string
-	appId: string
+	// TODO(gio): Rethink these variables together with flags in app-runner
+	managerAddr: string | *""
+	appId: string | *""
 	sshPrivateKey: string
 	// TODO(gio): this should not be necessary as app.dev.username is autogenerated
 	username?: string
@@ -55,10 +56,6 @@
 		}
 	}
 
-	if input.cluster != _|_ {
-		appVPNAuthKey: string @role(VPNAuthKey) @username(private-network-proxy)
-	}
-
 	for svc in service {
 		if svc.dev.enabled {
 			username: string | *svc.dev.username
@@ -67,8 +64,6 @@
 	}
 }
 
-_appIdSanitized: strings.Replace(input.appId, "/", "-", -1)
-
 _devVM: {}
 
 volume: [...#VolumeInput] | *[]
@@ -495,22 +490,6 @@
 									if input.cluster == _|_ {
 										runtimeClassName: "untrusted-external" // TODO(gio): make this part of the infra config
 									}
-									if input.cluster != _|_ {
-										extraContainers: [{
-											name: "proxy"
-											image: images["tailscale-proxy"].fullNameWithTag
-											env: [{
-												name: "TS_AUTHKEY"
-												value: input.appVPNAuthKey
-											}, {
-												name: "TS_HOSTNAME"
-												value: "dodo-app-\(_appIdSanitized)-\(svc.name)"
-											}, {
-												name: "TS_EXTRA_ARGS"
-												value: "--login-server=https://headscale.\(global.domain)"
-											}]
-										}]
-									}
 									name: svc.name
 									apiPort: svc.apiPort
 									appPorts: [for p in svc.ports {
@@ -541,9 +520,13 @@
 				}
 			}
 
-			if svc.dev.enabled {
-				{
-					_vmName: "\(_appIdSanitized)-\(svc.name)-\(svc.source.branch)"
+		if svc.dev.enabled {
+			// TODO(gio): reuse envProfile from above
+			_envProfile: strings.Join(list.Concat([
+														 svc.vm.env,
+				[for e in svc.lastCmdEnv { "export \(e)" }]
+												 ]), "\n")
+			{
 					"\(svc.name)": #WithOut & {
 						ingress: {
 							if svc.ingress != _|_ {
@@ -554,19 +537,24 @@
 										subdomain: ingress.subdomain
 										auth: ingress.auth
 										service: {
-											name: _vmName
-											port: name: "web" // TODO(gio): why is this hardcoded?
+											name: svc.name
+											if ingress.port.name != _|_ {
+												port: name: ingress.port.name
+											}
+											if ingress.port.value != _|_ {
+												port: number: ingress.port.value
+											}
 										}
 									}
 									// TODO(gio): code should work even without svc ingress
-									"code-\(i)": {
+									"\(svc.name)-\(i)-code": {
 										label: "VS Code"
 										home: "/?folder=/home/\(svc.dev.username)/code"
 										network: networks[strings.ToLower(ingress.network)]
 										subdomain: "code-\(ingress.subdomain)"
 										auth: enabled: false
 										service: {
-											name: _vmName
+											name: svc.name
 											port: name: _codeServerPortName
 										}
 									}
@@ -574,7 +562,7 @@
 							}
 						}
 						vm: {
-							"\(_vmName)": {
+							"\(svc.name)": {
 								username: svc.dev.username
 								domain: global.domain
 								vpn: {
@@ -589,8 +577,9 @@
 								cloudInit: {
 									_loadEnvFile: "/home/\(username)/.dodo_env.sh"
 									writeFiles: [{
+										// TODO(gio): create configmap instead
 										path: _loadEnvFile
-										content: "source <(curl -fsSL \(input.managerAddr)/api/apps/\(input.appId)/branch/\(svc.source.branch)/env-profile)"
+										content: _envProfile // "source <(curl -fsSL \(input.managerAddr)/api/apps/\(input.appId)/branch/\(svc.source.branch)/env-profile)"
 										owner: "\(username):\(username)"
 										permissions: "0700"
 									},
diff --git a/core/installer/canvas-app.cue b/core/installer/canvas-app.cue
index 4abee5e..3f41047 100644
--- a/core/installer/canvas-app.cue
+++ b/core/installer/canvas-app.cue
@@ -6,39 +6,47 @@
   "sshPrivateKey": "",
   "config": {
 	"service": [{
-		"name": "app",
+		"name": "c1",
 		"type": "golang:1.24.0",
 		"source": {
 			"repository": "https://code.v1.dodo.cloud/pcloud",
 			"branch": "main",
-			"rootDir": "apps/echo"
+			"rootDir": "apps/canvas/server"
 		},
 		"ports": [{
-				 "name": "echo",
-				 "value": 9090
+				 "name": "web",
+				 "value": 8080
 		}],
-		"expose": [{
-			"network": "Public",
-			"subdomain": "echo",
-			"port": { "name": "echo" }
-		}]
-	}],
-	"postgresql": [{
-				  "name": "pg",
-				  "size": "1Gi",
-				  "expose": [{
-				  			"network": "Public",
-							"subdomain": "pg"
-				}]
-	}],
-	"mongodb": [{
-				  "name": "mo",
-				  "size": "1Gi",
-				  "expose": [{
-				  			"network": "Public",
-							"subdomain": "mo"
-				}]
-	}],
-	"cluster": "zxczxc"
+		"ingress": [{
+			"network": "private",
+			"subdomain": "c1",
+			"port": { "name": "web" }
+		}],
+		"dev": {
+			"enabled": true,
+			"username": "gio"
+		}
+	}, {
+		"name": "c2",
+		"type": "golang:1.24.0",
+		"source": {
+			"repository": "https://code.v1.dodo.cloud/pcloud",
+			"branch": "main",
+			"rootDir": "apps/canvas/server"
+		},
+		"ports": [{
+				 "name": "web",
+				 "value": 8080
+		}],
+		"ingress": [{
+			"network": "private",
+			"subdomain": "c2",
+			"port": { "name": "web" }
+		}],
+		"dev": {
+			"enabled": true,
+			"username": "gio"
+		}
+	}]
   }
 }