diff --git a/cli/docker-compose.override.yml b/cli/docker-compose.override.yml
new file mode 100644
index 00000000..3b4eb13e
--- /dev/null
+++ b/cli/docker-compose.override.yml
@@ -0,0 +1,6 @@
+services:
+  aquila:
+    environment:
+      AQUILA_SERVICE_CONFIG_PATH: /codezero/service.configuration.json
+    volumes:
+      - ./service.configuration.json:/codezero/service.configuration.json:ro
diff --git a/cli/manifest.json b/cli/manifest.json
new file mode 100644
index 00000000..5af05213
--- /dev/null
+++ b/cli/manifest.json
@@ -0,0 +1,122 @@
+{
+  "version": "0.1.0",
+  "steps": [
+    {
+      "id": "initial_root_mail",
+      "type": "input",
+      "section": "Admin account",
+      "prompt": "Root email",
+      "default": "root@code0.tech"
+    },
+    {
+      "id": "initial_root_password",
+      "type": "password",
+      "section": "Admin account",
+      "prompt": "Root password",
+      "confirm": true,
+      "default": "root"
+    },
+    {
+      "id": "compose_profiles",
+      "type": "multiselect",
+      "section": "Runtime profiles",
+      "prompt": "Choose profiles",
+      "join": ",",
+      "options": [
+        { "label": "ide", "value": "ide", "default": true },
+        { "label": "runtime", "value": "runtime", "default": true },
+        { "label": "ai", "value": "ide_velorum", "default": false }
+      ]
+    },
+    {
+      "id": "image_registry",
+      "type": "select",
+      "section": "Runtime artifacts",
+      "prompt": "Choose artifact registry",
+      "allow_custom": true,
+      "custom_prompt": "Custom image registry",
+      "options": [
+        { "label": "github", "value": "ghcr.io/code0-tech/reticulum/ci-builds" },
+        { "label": "gitlab", "value": "registry.gitlab.com/code0-tech/packages" }
+      ]
+    },
+    {
+      "id": "image_edition",
+      "type": "select",
+      "section": "Runtime artifacts",
+      "prompt": "Choose edition",
+      "options": [
+        { "label": "Community Edition (ce)", "value": "ce", "default": true },
+        { "label": "Cloud / Commercial (cc)", "value": "cc" }
+      ]
+    },
+    {
+      "id": "image_tag",
+      "type": "input",
+      "section": "Runtime artifacts",
+      "prompt": "Version",
+      "default": "latest"
+    },
+    {
+      "id": "action_image_tag",
+      "type": "input",
+      "section": "Runtime artifacts",
+      "prompt": "Built-in actions version (rest-action, cron-action)",
+      "default": "0.0.0-experimental-2758971679-6d488c639d742bd4443e093c66c7d4cb54c5b0da"
+    }
+  ],
+  "secrets": [
+    {
+      "id": ["initial_runtime_token", "aquila_backend_token"],
+      "label": "shared Sagittarius <-> Aquila token"
+    },
+    {
+      "id": "taurus_aquila_token",
+      "label": "Taurus Aquila token"
+    },
+    {
+      "id": "aquila_action_rest_token",
+      "label": "REST action Aquila token"
+    },
+    {
+      "id": "aquila_action_cron_token",
+      "label": "Cron action Aquila token"
+    },
+    {
+      "id": "velorum_jwt_secret",
+      "length": 32,
+      "label": "Velorum JWT secret"
+    },
+    {
+      "id": "sagittarius_gateway_jwt_secret",
+      "length": 32,
+      "label": "Sagittarius gateway JWT secret"
+    },
+    {
+      "id": "sagittarius_db_encryption_primary_key",
+      "length": 32,
+      "label": "Sagittarius DB encryption primary key"
+    },
+    {
+      "id": "sagittarius_db_encryption_deterministic_key",
+      "length": 32,
+      "label": "Sagittarius DB encryption deterministic key"
+    },
+    {
+      "id": "sagittarius_db_encryption_key_derivation_salt",
+      "length": 32,
+      "label": "Sagittarius DB encryption key derivation salt"
+    },
+    {
+      "id": "sagittarius_rails_secret_key_base",
+      "length": 32,
+      "label": "Sagittarius Rails secret key base"
+    }
+  ],
+  "templates": [
+    { "template": ".env", "output": ".env" },
+    { "template": "docker-compose.yml", "output": "docker-compose.yml" },
+    { "template": "service.configuration.json.tera", "output": "service.configuration.json" },
+    { "template": "docker-compose.override.yml", "output": "docker-compose.override.yml", "required": false }
+  ]
+}
diff --git a/cli/service.configuration.json.tera b/cli/service.configuration.json.tera
new file mode 100644
index 00000000..b5dba6c1
--- /dev/null
+++ b/cli/service.configuration.json.tera
@@ -0,0 +1,9 @@
+{
+  "actions": [
+    { "identifier": "rest-action", "token": "{{ aquila_action_rest_token }}" },
+    { "identifier": "cron-action", "token": "{{ aquila_action_cron_token }}" }
+  ],
+  "runtimes": [
+    { "identifier": "taurus", "token": "{{ taurus_aquila_token }}" }
+  ]
+}
diff --git a/docker-compose/.env b/docker-compose/.env
index 3944a41e..e6d661d4 100644
--- a/docker-compose/.env
+++ b/docker-compose/.env
@@ -22,6 +22,7 @@ AQUILA_BACKEND_TOKEN=runtime
 AQUILA_BACKEND_UNARY_TIMEOUT_SECS=10
 AQUILA_GRPC_HOST=0.0.0.0
 AQUILA_GRPC_PORT=8081
+AQUILA_GRPC_EXTERNAL_PORT=8081
 AQUILA_GRPC_HEALTH_SERVICE=false
 REST_ACTION_PORT=8084
 
diff --git a/docker-compose/docker-compose.yml b/docker-compose/docker-compose.yml
index aef48e6c..ab21a0da 100644
--- a/docker-compose/docker-compose.yml
+++ b/docker-compose/docker-compose.yml
@@ -213,6 +213,8 @@ services:
     volumes:
       - generated-configs:/tmp/generated-configs:ro
     restart: unless-stopped
+    ports:
+      - "${AQUILA_GRPC_PORT}:8081"
     profiles:
       - runtime
     networks: