diff --git a/Makefile b/Makefile
index bc14b0a..4690275 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,10 @@
-.PHONY: build test vet clean docker all devserver metacrypt metacrypt-web proto
+.PHONY: build test vet lint proto-lint clean docker all devserver metacrypt metacrypt-web proto
 
 LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)"
 
 proto:
-	protoc --go_out=. --go_opt=paths=source_relative \
-		--go-grpc_out=. --go-grpc_opt=paths=source_relative \
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/metacrypt \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/metacrypt \
 		proto/metacrypt/v1/*.proto
 
 metacrypt:
@@ -22,6 +22,13 @@ test:
 vet:
 	go vet ./...
 
+lint:
+	golangci-lint run ./...
+
+proto-lint:
+	buf lint
+	buf breaking --against '.git#branch=master,subdir=proto'
+
 clean:
 	rm -f metacrypt metacrypt-web
 
@@ -35,4 +42,4 @@ devserver: metacrypt metacrypt-web
 	./metacrypt server --config srv/metacrypt.toml &
 	./metacrypt-web --config srv/metacrypt.toml
 
-all: vet test metacrypt metacrypt-web
+all: vet lint test metacrypt metacrypt-web
diff --git a/buf.yaml b/buf.yaml
new file mode 100644
index 0000000..d7358e0
--- /dev/null
+++ b/buf.yaml
@@ -0,0 +1,17 @@
+version: v2
+
+modules:
+  # Setting path to proto/ means buf sees files at metacrypt/v1/*.proto,
+  # which matches the package name metacrypt.v1 as required by PACKAGE_DIRECTORY_MATCH.
+  - path: proto
+
+lint:
+  use:
+    - STANDARD
+
+breaking:
+  use:
+    # FILE mode is the strictest: catches wire-breaking changes (removed/renumbered
+    # fields, changed field types) as well as source-breaking changes (removed RPCs,
+    # renamed messages). Appropriate for a service with external gRPC clients.
+    - FILE
diff --git a/gen/metacrypt/v1/acme.pb.go b/gen/metacrypt/v1/acme.pb.go
index 1fee433..2cc94c9 100644
--- a/gen/metacrypt/v1/acme.pb.go
+++ b/gen/metacrypt/v1/acme.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/acme.proto
+// source: proto/metacrypt/v1/acme.proto
 
 package metacryptv1
 
@@ -30,7 +30,7 @@ type CreateEABRequest struct {
 
 func (x *CreateEABRequest) Reset() {
 	*x = CreateEABRequest{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -42,7 +42,7 @@ func (x *CreateEABRequest) String() string {
 func (*CreateEABRequest) ProtoMessage() {}
 
 func (x *CreateEABRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -55,7 +55,7 @@ func (x *CreateEABRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateEABRequest.ProtoReflect.Descriptor instead.
 func (*CreateEABRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *CreateEABRequest) GetMount() string {
@@ -78,7 +78,7 @@ type CreateEABResponse struct {
 
 func (x *CreateEABResponse) Reset() {
 	*x = CreateEABResponse{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -90,7 +90,7 @@ func (x *CreateEABResponse) String() string {
 func (*CreateEABResponse) ProtoMessage() {}
 
 func (x *CreateEABResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -103,7 +103,7 @@ func (x *CreateEABResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateEABResponse.ProtoReflect.Descriptor instead.
 func (*CreateEABResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *CreateEABResponse) GetKid() string {
@@ -120,7 +120,7 @@ func (x *CreateEABResponse) GetHmacKey() []byte {
 	return nil
 }
 
-type SetACMEConfigRequest struct {
+type SetConfigRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	Mount string                 `protobuf:"bytes,1,opt,name=mount,proto3" json:"mount,omitempty"`
 	// default_issuer is the name of the CA issuer to use for ACME certificates.
@@ -130,21 +130,21 @@ type SetACMEConfigRequest struct {
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *SetACMEConfigRequest) Reset() {
-	*x = SetACMEConfigRequest{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[2]
+func (x *SetConfigRequest) Reset() {
+	*x = SetConfigRequest{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *SetACMEConfigRequest) String() string {
+func (x *SetConfigRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SetACMEConfigRequest) ProtoMessage() {}
+func (*SetConfigRequest) ProtoMessage() {}
 
-func (x *SetACMEConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[2]
+func (x *SetConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -155,47 +155,47 @@ func (x *SetACMEConfigRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SetACMEConfigRequest.ProtoReflect.Descriptor instead.
-func (*SetACMEConfigRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{2}
+// Deprecated: Use SetConfigRequest.ProtoReflect.Descriptor instead.
+func (*SetConfigRequest) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *SetACMEConfigRequest) GetMount() string {
+func (x *SetConfigRequest) GetMount() string {
 	if x != nil {
 		return x.Mount
 	}
 	return ""
 }
 
-func (x *SetACMEConfigRequest) GetDefaultIssuer() string {
+func (x *SetConfigRequest) GetDefaultIssuer() string {
 	if x != nil {
 		return x.DefaultIssuer
 	}
 	return ""
 }
 
-type SetACMEConfigResponse struct {
+type SetConfigResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Ok            bool                   `protobuf:"varint,1,opt,name=ok,proto3" json:"ok,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *SetACMEConfigResponse) Reset() {
-	*x = SetACMEConfigResponse{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[3]
+func (x *SetConfigResponse) Reset() {
+	*x = SetConfigResponse{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *SetACMEConfigResponse) String() string {
+func (x *SetConfigResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SetACMEConfigResponse) ProtoMessage() {}
+func (*SetConfigResponse) ProtoMessage() {}
 
-func (x *SetACMEConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[3]
+func (x *SetConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -206,40 +206,40 @@ func (x *SetACMEConfigResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SetACMEConfigResponse.ProtoReflect.Descriptor instead.
-func (*SetACMEConfigResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{3}
+// Deprecated: Use SetConfigResponse.ProtoReflect.Descriptor instead.
+func (*SetConfigResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *SetACMEConfigResponse) GetOk() bool {
+func (x *SetConfigResponse) GetOk() bool {
 	if x != nil {
 		return x.Ok
 	}
 	return false
 }
 
-type ListACMEAccountsRequest struct {
+type ListAccountsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Mount         string                 `protobuf:"bytes,1,opt,name=mount,proto3" json:"mount,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListACMEAccountsRequest) Reset() {
-	*x = ListACMEAccountsRequest{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[4]
+func (x *ListAccountsRequest) Reset() {
+	*x = ListAccountsRequest{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListACMEAccountsRequest) String() string {
+func (x *ListAccountsRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListACMEAccountsRequest) ProtoMessage() {}
+func (*ListAccountsRequest) ProtoMessage() {}
 
-func (x *ListACMEAccountsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[4]
+func (x *ListAccountsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -250,40 +250,40 @@ func (x *ListACMEAccountsRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListACMEAccountsRequest.ProtoReflect.Descriptor instead.
-func (*ListACMEAccountsRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{4}
+// Deprecated: Use ListAccountsRequest.ProtoReflect.Descriptor instead.
+func (*ListAccountsRequest) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *ListACMEAccountsRequest) GetMount() string {
+func (x *ListAccountsRequest) GetMount() string {
 	if x != nil {
 		return x.Mount
 	}
 	return ""
 }
 
-type ListACMEAccountsResponse struct {
+type ListAccountsResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Accounts      []*ACMEAccount         `protobuf:"bytes,1,rep,name=accounts,proto3" json:"accounts,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListACMEAccountsResponse) Reset() {
-	*x = ListACMEAccountsResponse{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[5]
+func (x *ListAccountsResponse) Reset() {
+	*x = ListAccountsResponse{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListACMEAccountsResponse) String() string {
+func (x *ListAccountsResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListACMEAccountsResponse) ProtoMessage() {}
+func (*ListAccountsResponse) ProtoMessage() {}
 
-func (x *ListACMEAccountsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[5]
+func (x *ListAccountsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -294,12 +294,12 @@ func (x *ListACMEAccountsResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListACMEAccountsResponse.ProtoReflect.Descriptor instead.
-func (*ListACMEAccountsResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{5}
+// Deprecated: Use ListAccountsResponse.ProtoReflect.Descriptor instead.
+func (*ListAccountsResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *ListACMEAccountsResponse) GetAccounts() []*ACMEAccount {
+func (x *ListAccountsResponse) GetAccounts() []*ACMEAccount {
 	if x != nil {
 		return x.Accounts
 	}
@@ -319,7 +319,7 @@ type ACMEAccount struct {
 
 func (x *ACMEAccount) Reset() {
 	*x = ACMEAccount{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -331,7 +331,7 @@ func (x *ACMEAccount) String() string {
 func (*ACMEAccount) ProtoMessage() {}
 
 func (x *ACMEAccount) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -344,7 +344,7 @@ func (x *ACMEAccount) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ACMEAccount.ProtoReflect.Descriptor instead.
 func (*ACMEAccount) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{6}
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *ACMEAccount) GetId() string {
@@ -382,28 +382,28 @@ func (x *ACMEAccount) GetCreatedAt() string {
 	return ""
 }
 
-type ListACMEOrdersRequest struct {
+type ListOrdersRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Mount         string                 `protobuf:"bytes,1,opt,name=mount,proto3" json:"mount,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListACMEOrdersRequest) Reset() {
-	*x = ListACMEOrdersRequest{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[7]
+func (x *ListOrdersRequest) Reset() {
+	*x = ListOrdersRequest{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListACMEOrdersRequest) String() string {
+func (x *ListOrdersRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListACMEOrdersRequest) ProtoMessage() {}
+func (*ListOrdersRequest) ProtoMessage() {}
 
-func (x *ListACMEOrdersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[7]
+func (x *ListOrdersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -414,40 +414,40 @@ func (x *ListACMEOrdersRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListACMEOrdersRequest.ProtoReflect.Descriptor instead.
-func (*ListACMEOrdersRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{7}
+// Deprecated: Use ListOrdersRequest.ProtoReflect.Descriptor instead.
+func (*ListOrdersRequest) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{7}
 }
 
-func (x *ListACMEOrdersRequest) GetMount() string {
+func (x *ListOrdersRequest) GetMount() string {
 	if x != nil {
 		return x.Mount
 	}
 	return ""
 }
 
-type ListACMEOrdersResponse struct {
+type ListOrdersResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Orders        []*ACMEOrder           `protobuf:"bytes,1,rep,name=orders,proto3" json:"orders,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListACMEOrdersResponse) Reset() {
-	*x = ListACMEOrdersResponse{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[8]
+func (x *ListOrdersResponse) Reset() {
+	*x = ListOrdersResponse{}
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListACMEOrdersResponse) String() string {
+func (x *ListOrdersResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListACMEOrdersResponse) ProtoMessage() {}
+func (*ListOrdersResponse) ProtoMessage() {}
 
-func (x *ListACMEOrdersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[8]
+func (x *ListOrdersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -458,12 +458,12 @@ func (x *ListACMEOrdersResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListACMEOrdersResponse.ProtoReflect.Descriptor instead.
-func (*ListACMEOrdersResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{8}
+// Deprecated: Use ListOrdersResponse.ProtoReflect.Descriptor instead.
+func (*ListOrdersResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *ListACMEOrdersResponse) GetOrders() []*ACMEOrder {
+func (x *ListOrdersResponse) GetOrders() []*ACMEOrder {
 	if x != nil {
 		return x.Orders
 	}
@@ -485,7 +485,7 @@ type ACMEOrder struct {
 
 func (x *ACMEOrder) Reset() {
 	*x = ACMEOrder{}
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[9]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -497,7 +497,7 @@ func (x *ACMEOrder) String() string {
 func (*ACMEOrder) ProtoMessage() {}
 
 func (x *ACMEOrder) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_acme_proto_msgTypes[9]
+	mi := &file_proto_metacrypt_v1_acme_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -510,7 +510,7 @@ func (x *ACMEOrder) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ACMEOrder.ProtoReflect.Descriptor instead.
 func (*ACMEOrder) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_acme_proto_rawDescGZIP(), []int{9}
+	return file_proto_metacrypt_v1_acme_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *ACMEOrder) GetId() string {
@@ -555,24 +555,24 @@ func (x *ACMEOrder) GetExpiresAt() string {
 	return ""
 }
 
-var File_metacrypt_v1_acme_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_acme_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_acme_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_acme_proto_rawDesc = "" +
 	"\n" +
-	"\x17metacrypt/v1/acme.proto\x12\fmetacrypt.v1\"(\n" +
+	"\x1dproto/metacrypt/v1/acme.proto\x12\fmetacrypt.v1\"(\n" +
 	"\x10CreateEABRequest\x12\x14\n" +
 	"\x05mount\x18\x01 \x01(\tR\x05mount\"@\n" +
 	"\x11CreateEABResponse\x12\x10\n" +
 	"\x03kid\x18\x01 \x01(\tR\x03kid\x12\x19\n" +
-	"\bhmac_key\x18\x02 \x01(\fR\ahmacKey\"S\n" +
-	"\x14SetACMEConfigRequest\x12\x14\n" +
+	"\bhmac_key\x18\x02 \x01(\fR\ahmacKey\"O\n" +
+	"\x10SetConfigRequest\x12\x14\n" +
 	"\x05mount\x18\x01 \x01(\tR\x05mount\x12%\n" +
-	"\x0edefault_issuer\x18\x02 \x01(\tR\rdefaultIssuer\"'\n" +
-	"\x15SetACMEConfigResponse\x12\x0e\n" +
-	"\x02ok\x18\x01 \x01(\bR\x02ok\"/\n" +
-	"\x17ListACMEAccountsRequest\x12\x14\n" +
-	"\x05mount\x18\x01 \x01(\tR\x05mount\"Q\n" +
-	"\x18ListACMEAccountsResponse\x125\n" +
+	"\x0edefault_issuer\x18\x02 \x01(\tR\rdefaultIssuer\"#\n" +
+	"\x11SetConfigResponse\x12\x0e\n" +
+	"\x02ok\x18\x01 \x01(\bR\x02ok\"+\n" +
+	"\x13ListAccountsRequest\x12\x14\n" +
+	"\x05mount\x18\x01 \x01(\tR\x05mount\"M\n" +
+	"\x14ListAccountsResponse\x125\n" +
 	"\baccounts\x18\x01 \x03(\v2\x19.metacrypt.v1.ACMEAccountR\baccounts\"\x95\x01\n" +
 	"\vACMEAccount\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" +
@@ -580,10 +580,10 @@ const file_metacrypt_v1_acme_proto_rawDesc = "" +
 	"\acontact\x18\x03 \x03(\tR\acontact\x12%\n" +
 	"\x0emcias_username\x18\x04 \x01(\tR\rmciasUsername\x12\x1d\n" +
 	"\n" +
-	"created_at\x18\x05 \x01(\tR\tcreatedAt\"-\n" +
-	"\x15ListACMEOrdersRequest\x12\x14\n" +
-	"\x05mount\x18\x01 \x01(\tR\x05mount\"I\n" +
-	"\x16ListACMEOrdersResponse\x12/\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\")\n" +
+	"\x11ListOrdersRequest\x12\x14\n" +
+	"\x05mount\x18\x01 \x01(\tR\x05mount\"E\n" +
+	"\x12ListOrdersResponse\x12/\n" +
 	"\x06orders\x18\x01 \x03(\v2\x17.metacrypt.v1.ACMEOrderR\x06orders\"\xb2\x01\n" +
 	"\tACMEOrder\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" +
@@ -594,50 +594,50 @@ const file_metacrypt_v1_acme_proto_rawDesc = "" +
 	"\n" +
 	"created_at\x18\x05 \x01(\tR\tcreatedAt\x12\x1d\n" +
 	"\n" +
-	"expires_at\x18\x06 \x01(\tR\texpiresAt2\xe9\x02\n" +
+	"expires_at\x18\x06 \x01(\tR\texpiresAt2\xd1\x02\n" +
 	"\vACMEService\x12L\n" +
-	"\tCreateEAB\x12\x1e.metacrypt.v1.CreateEABRequest\x1a\x1f.metacrypt.v1.CreateEABResponse\x12T\n" +
-	"\tSetConfig\x12\".metacrypt.v1.SetACMEConfigRequest\x1a#.metacrypt.v1.SetACMEConfigResponse\x12]\n" +
-	"\fListAccounts\x12%.metacrypt.v1.ListACMEAccountsRequest\x1a&.metacrypt.v1.ListACMEAccountsResponse\x12W\n" +
+	"\tCreateEAB\x12\x1e.metacrypt.v1.CreateEABRequest\x1a\x1f.metacrypt.v1.CreateEABResponse\x12L\n" +
+	"\tSetConfig\x12\x1e.metacrypt.v1.SetConfigRequest\x1a\x1f.metacrypt.v1.SetConfigResponse\x12U\n" +
+	"\fListAccounts\x12!.metacrypt.v1.ListAccountsRequest\x1a\".metacrypt.v1.ListAccountsResponse\x12O\n" +
 	"\n" +
-	"ListOrders\x12#.metacrypt.v1.ListACMEOrdersRequest\x1a$.metacrypt.v1.ListACMEOrdersResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
+	"ListOrders\x12\x1f.metacrypt.v1.ListOrdersRequest\x1a .metacrypt.v1.ListOrdersResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_acme_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_acme_proto_rawDescData []byte
+	file_proto_metacrypt_v1_acme_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_acme_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_acme_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_acme_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_acme_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_acme_proto_rawDesc), len(file_metacrypt_v1_acme_proto_rawDesc)))
+func file_proto_metacrypt_v1_acme_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_acme_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_acme_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_acme_proto_rawDesc), len(file_proto_metacrypt_v1_acme_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_acme_proto_rawDescData
+	return file_proto_metacrypt_v1_acme_proto_rawDescData
 }
 
-var file_metacrypt_v1_acme_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
-var file_metacrypt_v1_acme_proto_goTypes = []any{
-	(*CreateEABRequest)(nil),         // 0: metacrypt.v1.CreateEABRequest
-	(*CreateEABResponse)(nil),        // 1: metacrypt.v1.CreateEABResponse
-	(*SetACMEConfigRequest)(nil),     // 2: metacrypt.v1.SetACMEConfigRequest
-	(*SetACMEConfigResponse)(nil),    // 3: metacrypt.v1.SetACMEConfigResponse
-	(*ListACMEAccountsRequest)(nil),  // 4: metacrypt.v1.ListACMEAccountsRequest
-	(*ListACMEAccountsResponse)(nil), // 5: metacrypt.v1.ListACMEAccountsResponse
-	(*ACMEAccount)(nil),              // 6: metacrypt.v1.ACMEAccount
-	(*ListACMEOrdersRequest)(nil),    // 7: metacrypt.v1.ListACMEOrdersRequest
-	(*ListACMEOrdersResponse)(nil),   // 8: metacrypt.v1.ListACMEOrdersResponse
-	(*ACMEOrder)(nil),                // 9: metacrypt.v1.ACMEOrder
+var file_proto_metacrypt_v1_acme_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_proto_metacrypt_v1_acme_proto_goTypes = []any{
+	(*CreateEABRequest)(nil),     // 0: metacrypt.v1.CreateEABRequest
+	(*CreateEABResponse)(nil),    // 1: metacrypt.v1.CreateEABResponse
+	(*SetConfigRequest)(nil),     // 2: metacrypt.v1.SetConfigRequest
+	(*SetConfigResponse)(nil),    // 3: metacrypt.v1.SetConfigResponse
+	(*ListAccountsRequest)(nil),  // 4: metacrypt.v1.ListAccountsRequest
+	(*ListAccountsResponse)(nil), // 5: metacrypt.v1.ListAccountsResponse
+	(*ACMEAccount)(nil),          // 6: metacrypt.v1.ACMEAccount
+	(*ListOrdersRequest)(nil),    // 7: metacrypt.v1.ListOrdersRequest
+	(*ListOrdersResponse)(nil),   // 8: metacrypt.v1.ListOrdersResponse
+	(*ACMEOrder)(nil),            // 9: metacrypt.v1.ACMEOrder
 }
-var file_metacrypt_v1_acme_proto_depIdxs = []int32{
-	6, // 0: metacrypt.v1.ListACMEAccountsResponse.accounts:type_name -> metacrypt.v1.ACMEAccount
-	9, // 1: metacrypt.v1.ListACMEOrdersResponse.orders:type_name -> metacrypt.v1.ACMEOrder
+var file_proto_metacrypt_v1_acme_proto_depIdxs = []int32{
+	6, // 0: metacrypt.v1.ListAccountsResponse.accounts:type_name -> metacrypt.v1.ACMEAccount
+	9, // 1: metacrypt.v1.ListOrdersResponse.orders:type_name -> metacrypt.v1.ACMEOrder
 	0, // 2: metacrypt.v1.ACMEService.CreateEAB:input_type -> metacrypt.v1.CreateEABRequest
-	2, // 3: metacrypt.v1.ACMEService.SetConfig:input_type -> metacrypt.v1.SetACMEConfigRequest
-	4, // 4: metacrypt.v1.ACMEService.ListAccounts:input_type -> metacrypt.v1.ListACMEAccountsRequest
-	7, // 5: metacrypt.v1.ACMEService.ListOrders:input_type -> metacrypt.v1.ListACMEOrdersRequest
+	2, // 3: metacrypt.v1.ACMEService.SetConfig:input_type -> metacrypt.v1.SetConfigRequest
+	4, // 4: metacrypt.v1.ACMEService.ListAccounts:input_type -> metacrypt.v1.ListAccountsRequest
+	7, // 5: metacrypt.v1.ACMEService.ListOrders:input_type -> metacrypt.v1.ListOrdersRequest
 	1, // 6: metacrypt.v1.ACMEService.CreateEAB:output_type -> metacrypt.v1.CreateEABResponse
-	3, // 7: metacrypt.v1.ACMEService.SetConfig:output_type -> metacrypt.v1.SetACMEConfigResponse
-	5, // 8: metacrypt.v1.ACMEService.ListAccounts:output_type -> metacrypt.v1.ListACMEAccountsResponse
-	8, // 9: metacrypt.v1.ACMEService.ListOrders:output_type -> metacrypt.v1.ListACMEOrdersResponse
+	3, // 7: metacrypt.v1.ACMEService.SetConfig:output_type -> metacrypt.v1.SetConfigResponse
+	5, // 8: metacrypt.v1.ACMEService.ListAccounts:output_type -> metacrypt.v1.ListAccountsResponse
+	8, // 9: metacrypt.v1.ACMEService.ListOrders:output_type -> metacrypt.v1.ListOrdersResponse
 	6, // [6:10] is the sub-list for method output_type
 	2, // [2:6] is the sub-list for method input_type
 	2, // [2:2] is the sub-list for extension type_name
@@ -645,26 +645,26 @@ var file_metacrypt_v1_acme_proto_depIdxs = []int32{
 	0, // [0:2] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_acme_proto_init() }
-func file_metacrypt_v1_acme_proto_init() {
-	if File_metacrypt_v1_acme_proto != nil {
+func init() { file_proto_metacrypt_v1_acme_proto_init() }
+func file_proto_metacrypt_v1_acme_proto_init() {
+	if File_proto_metacrypt_v1_acme_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_acme_proto_rawDesc), len(file_metacrypt_v1_acme_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_acme_proto_rawDesc), len(file_proto_metacrypt_v1_acme_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_acme_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_acme_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_acme_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_acme_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_acme_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_acme_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_acme_proto = out.File
-	file_metacrypt_v1_acme_proto_goTypes = nil
-	file_metacrypt_v1_acme_proto_depIdxs = nil
+	File_proto_metacrypt_v1_acme_proto = out.File
+	file_proto_metacrypt_v1_acme_proto_goTypes = nil
+	file_proto_metacrypt_v1_acme_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/acme_grpc.pb.go b/gen/metacrypt/v1/acme_grpc.pb.go
index d1c50f6..0e261f3 100644
--- a/gen/metacrypt/v1/acme_grpc.pb.go
+++ b/gen/metacrypt/v1/acme_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/acme.proto
+// source: proto/metacrypt/v1/acme.proto
 
 package metacryptv1
 
@@ -40,11 +40,11 @@ type ACMEServiceClient interface {
 	CreateEAB(ctx context.Context, in *CreateEABRequest, opts ...grpc.CallOption) (*CreateEABResponse, error)
 	// SetConfig sets the ACME configuration for a CA mount.
 	// Currently configures the default issuer used for ACME certificate issuance.
-	SetConfig(ctx context.Context, in *SetACMEConfigRequest, opts ...grpc.CallOption) (*SetACMEConfigResponse, error)
+	SetConfig(ctx context.Context, in *SetConfigRequest, opts ...grpc.CallOption) (*SetConfigResponse, error)
 	// ListAccounts returns all ACME accounts for a CA mount. Admin only.
-	ListAccounts(ctx context.Context, in *ListACMEAccountsRequest, opts ...grpc.CallOption) (*ListACMEAccountsResponse, error)
+	ListAccounts(ctx context.Context, in *ListAccountsRequest, opts ...grpc.CallOption) (*ListAccountsResponse, error)
 	// ListOrders returns all ACME orders for a CA mount. Admin only.
-	ListOrders(ctx context.Context, in *ListACMEOrdersRequest, opts ...grpc.CallOption) (*ListACMEOrdersResponse, error)
+	ListOrders(ctx context.Context, in *ListOrdersRequest, opts ...grpc.CallOption) (*ListOrdersResponse, error)
 }
 
 type aCMEServiceClient struct {
@@ -65,9 +65,9 @@ func (c *aCMEServiceClient) CreateEAB(ctx context.Context, in *CreateEABRequest,
 	return out, nil
 }
 
-func (c *aCMEServiceClient) SetConfig(ctx context.Context, in *SetACMEConfigRequest, opts ...grpc.CallOption) (*SetACMEConfigResponse, error) {
+func (c *aCMEServiceClient) SetConfig(ctx context.Context, in *SetConfigRequest, opts ...grpc.CallOption) (*SetConfigResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(SetACMEConfigResponse)
+	out := new(SetConfigResponse)
 	err := c.cc.Invoke(ctx, ACMEService_SetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
@@ -75,9 +75,9 @@ func (c *aCMEServiceClient) SetConfig(ctx context.Context, in *SetACMEConfigRequ
 	return out, nil
 }
 
-func (c *aCMEServiceClient) ListAccounts(ctx context.Context, in *ListACMEAccountsRequest, opts ...grpc.CallOption) (*ListACMEAccountsResponse, error) {
+func (c *aCMEServiceClient) ListAccounts(ctx context.Context, in *ListAccountsRequest, opts ...grpc.CallOption) (*ListAccountsResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListACMEAccountsResponse)
+	out := new(ListAccountsResponse)
 	err := c.cc.Invoke(ctx, ACMEService_ListAccounts_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
@@ -85,9 +85,9 @@ func (c *aCMEServiceClient) ListAccounts(ctx context.Context, in *ListACMEAccoun
 	return out, nil
 }
 
-func (c *aCMEServiceClient) ListOrders(ctx context.Context, in *ListACMEOrdersRequest, opts ...grpc.CallOption) (*ListACMEOrdersResponse, error) {
+func (c *aCMEServiceClient) ListOrders(ctx context.Context, in *ListOrdersRequest, opts ...grpc.CallOption) (*ListOrdersResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListACMEOrdersResponse)
+	out := new(ListOrdersResponse)
 	err := c.cc.Invoke(ctx, ACMEService_ListOrders_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
@@ -110,11 +110,11 @@ type ACMEServiceServer interface {
 	CreateEAB(context.Context, *CreateEABRequest) (*CreateEABResponse, error)
 	// SetConfig sets the ACME configuration for a CA mount.
 	// Currently configures the default issuer used for ACME certificate issuance.
-	SetConfig(context.Context, *SetACMEConfigRequest) (*SetACMEConfigResponse, error)
+	SetConfig(context.Context, *SetConfigRequest) (*SetConfigResponse, error)
 	// ListAccounts returns all ACME accounts for a CA mount. Admin only.
-	ListAccounts(context.Context, *ListACMEAccountsRequest) (*ListACMEAccountsResponse, error)
+	ListAccounts(context.Context, *ListAccountsRequest) (*ListAccountsResponse, error)
 	// ListOrders returns all ACME orders for a CA mount. Admin only.
-	ListOrders(context.Context, *ListACMEOrdersRequest) (*ListACMEOrdersResponse, error)
+	ListOrders(context.Context, *ListOrdersRequest) (*ListOrdersResponse, error)
 	mustEmbedUnimplementedACMEServiceServer()
 }
 
@@ -128,13 +128,13 @@ type UnimplementedACMEServiceServer struct{}
 func (UnimplementedACMEServiceServer) CreateEAB(context.Context, *CreateEABRequest) (*CreateEABResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method CreateEAB not implemented")
 }
-func (UnimplementedACMEServiceServer) SetConfig(context.Context, *SetACMEConfigRequest) (*SetACMEConfigResponse, error) {
+func (UnimplementedACMEServiceServer) SetConfig(context.Context, *SetConfigRequest) (*SetConfigResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method SetConfig not implemented")
 }
-func (UnimplementedACMEServiceServer) ListAccounts(context.Context, *ListACMEAccountsRequest) (*ListACMEAccountsResponse, error) {
+func (UnimplementedACMEServiceServer) ListAccounts(context.Context, *ListAccountsRequest) (*ListAccountsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ListAccounts not implemented")
 }
-func (UnimplementedACMEServiceServer) ListOrders(context.Context, *ListACMEOrdersRequest) (*ListACMEOrdersResponse, error) {
+func (UnimplementedACMEServiceServer) ListOrders(context.Context, *ListOrdersRequest) (*ListOrdersResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ListOrders not implemented")
 }
 func (UnimplementedACMEServiceServer) mustEmbedUnimplementedACMEServiceServer() {}
@@ -177,7 +177,7 @@ func _ACMEService_CreateEAB_Handler(srv interface{}, ctx context.Context, dec fu
 }
 
 func _ACMEService_SetConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SetACMEConfigRequest)
+	in := new(SetConfigRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -189,13 +189,13 @@ func _ACMEService_SetConfig_Handler(srv interface{}, ctx context.Context, dec fu
 		FullMethod: ACMEService_SetConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ACMEServiceServer).SetConfig(ctx, req.(*SetACMEConfigRequest))
+		return srv.(ACMEServiceServer).SetConfig(ctx, req.(*SetConfigRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
 func _ACMEService_ListAccounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListACMEAccountsRequest)
+	in := new(ListAccountsRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -207,13 +207,13 @@ func _ACMEService_ListAccounts_Handler(srv interface{}, ctx context.Context, dec
 		FullMethod: ACMEService_ListAccounts_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ACMEServiceServer).ListAccounts(ctx, req.(*ListACMEAccountsRequest))
+		return srv.(ACMEServiceServer).ListAccounts(ctx, req.(*ListAccountsRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
 func _ACMEService_ListOrders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListACMEOrdersRequest)
+	in := new(ListOrdersRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -225,7 +225,7 @@ func _ACMEService_ListOrders_Handler(srv interface{}, ctx context.Context, dec f
 		FullMethod: ACMEService_ListOrders_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ACMEServiceServer).ListOrders(ctx, req.(*ListACMEOrdersRequest))
+		return srv.(ACMEServiceServer).ListOrders(ctx, req.(*ListOrdersRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -255,5 +255,5 @@ var ACMEService_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/acme.proto",
+	Metadata: "proto/metacrypt/v1/acme.proto",
 }
diff --git a/gen/metacrypt/v1/auth.pb.go b/gen/metacrypt/v1/auth.pb.go
index 3a1fddb..5880729 100644
--- a/gen/metacrypt/v1/auth.pb.go
+++ b/gen/metacrypt/v1/auth.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/auth.proto
+// source: proto/metacrypt/v1/auth.proto
 
 package metacryptv1
 
@@ -32,7 +32,7 @@ type LoginRequest struct {
 
 func (x *LoginRequest) Reset() {
 	*x = LoginRequest{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -44,7 +44,7 @@ func (x *LoginRequest) String() string {
 func (*LoginRequest) ProtoMessage() {}
 
 func (x *LoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -57,7 +57,7 @@ func (x *LoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginRequest.ProtoReflect.Descriptor instead.
 func (*LoginRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *LoginRequest) GetUsername() string {
@@ -91,7 +91,7 @@ type LoginResponse struct {
 
 func (x *LoginResponse) Reset() {
 	*x = LoginResponse{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -103,7 +103,7 @@ func (x *LoginResponse) String() string {
 func (*LoginResponse) ProtoMessage() {}
 
 func (x *LoginResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -116,7 +116,7 @@ func (x *LoginResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginResponse.ProtoReflect.Descriptor instead.
 func (*LoginResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *LoginResponse) GetToken() string {
@@ -141,7 +141,7 @@ type LogoutRequest struct {
 
 func (x *LogoutRequest) Reset() {
 	*x = LogoutRequest{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -153,7 +153,7 @@ func (x *LogoutRequest) String() string {
 func (*LogoutRequest) ProtoMessage() {}
 
 func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -166,7 +166,7 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
 func (*LogoutRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{2}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{2}
 }
 
 type LogoutResponse struct {
@@ -177,7 +177,7 @@ type LogoutResponse struct {
 
 func (x *LogoutResponse) Reset() {
 	*x = LogoutResponse{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -189,7 +189,7 @@ func (x *LogoutResponse) String() string {
 func (*LogoutResponse) ProtoMessage() {}
 
 func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -202,7 +202,7 @@ func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutResponse.ProtoReflect.Descriptor instead.
 func (*LogoutResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{3}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{3}
 }
 
 type TokenInfoRequest struct {
@@ -213,7 +213,7 @@ type TokenInfoRequest struct {
 
 func (x *TokenInfoRequest) Reset() {
 	*x = TokenInfoRequest{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -225,7 +225,7 @@ func (x *TokenInfoRequest) String() string {
 func (*TokenInfoRequest) ProtoMessage() {}
 
 func (x *TokenInfoRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -238,7 +238,7 @@ func (x *TokenInfoRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenInfoRequest.ProtoReflect.Descriptor instead.
 func (*TokenInfoRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{4}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{4}
 }
 
 type TokenInfoResponse struct {
@@ -252,7 +252,7 @@ type TokenInfoResponse struct {
 
 func (x *TokenInfoResponse) Reset() {
 	*x = TokenInfoResponse{}
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -264,7 +264,7 @@ func (x *TokenInfoResponse) String() string {
 func (*TokenInfoResponse) ProtoMessage() {}
 
 func (x *TokenInfoResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_auth_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_auth_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -277,7 +277,7 @@ func (x *TokenInfoResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenInfoResponse.ProtoReflect.Descriptor instead.
 func (*TokenInfoResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_auth_proto_rawDescGZIP(), []int{5}
+	return file_proto_metacrypt_v1_auth_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *TokenInfoResponse) GetUsername() string {
@@ -301,11 +301,11 @@ func (x *TokenInfoResponse) GetIsAdmin() bool {
 	return false
 }
 
-var File_metacrypt_v1_auth_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_auth_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_auth_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_auth_proto_rawDesc = "" +
 	"\n" +
-	"\x17metacrypt/v1/auth.proto\x12\fmetacrypt.v1\"c\n" +
+	"\x1dproto/metacrypt/v1/auth.proto\x12\fmetacrypt.v1\"c\n" +
 	"\fLoginRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12\x1a\n" +
 	"\bpassword\x18\x02 \x01(\tR\bpassword\x12\x1b\n" +
@@ -327,19 +327,19 @@ const file_metacrypt_v1_auth_proto_rawDesc = "" +
 	"\tTokenInfo\x12\x1e.metacrypt.v1.TokenInfoRequest\x1a\x1f.metacrypt.v1.TokenInfoResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_auth_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_auth_proto_rawDescData []byte
+	file_proto_metacrypt_v1_auth_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_auth_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_auth_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_auth_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_auth_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_auth_proto_rawDesc), len(file_metacrypt_v1_auth_proto_rawDesc)))
+func file_proto_metacrypt_v1_auth_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_auth_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_auth_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_auth_proto_rawDesc), len(file_proto_metacrypt_v1_auth_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_auth_proto_rawDescData
+	return file_proto_metacrypt_v1_auth_proto_rawDescData
 }
 
-var file_metacrypt_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_metacrypt_v1_auth_proto_goTypes = []any{
+var file_proto_metacrypt_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_proto_metacrypt_v1_auth_proto_goTypes = []any{
 	(*LoginRequest)(nil),      // 0: metacrypt.v1.LoginRequest
 	(*LoginResponse)(nil),     // 1: metacrypt.v1.LoginResponse
 	(*LogoutRequest)(nil),     // 2: metacrypt.v1.LogoutRequest
@@ -347,7 +347,7 @@ var file_metacrypt_v1_auth_proto_goTypes = []any{
 	(*TokenInfoRequest)(nil),  // 4: metacrypt.v1.TokenInfoRequest
 	(*TokenInfoResponse)(nil), // 5: metacrypt.v1.TokenInfoResponse
 }
-var file_metacrypt_v1_auth_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_auth_proto_depIdxs = []int32{
 	0, // 0: metacrypt.v1.AuthService.Login:input_type -> metacrypt.v1.LoginRequest
 	2, // 1: metacrypt.v1.AuthService.Logout:input_type -> metacrypt.v1.LogoutRequest
 	4, // 2: metacrypt.v1.AuthService.TokenInfo:input_type -> metacrypt.v1.TokenInfoRequest
@@ -361,26 +361,26 @@ var file_metacrypt_v1_auth_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_auth_proto_init() }
-func file_metacrypt_v1_auth_proto_init() {
-	if File_metacrypt_v1_auth_proto != nil {
+func init() { file_proto_metacrypt_v1_auth_proto_init() }
+func file_proto_metacrypt_v1_auth_proto_init() {
+	if File_proto_metacrypt_v1_auth_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_auth_proto_rawDesc), len(file_metacrypt_v1_auth_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_auth_proto_rawDesc), len(file_proto_metacrypt_v1_auth_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_auth_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_auth_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_auth_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_auth_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_auth_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_auth_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_auth_proto = out.File
-	file_metacrypt_v1_auth_proto_goTypes = nil
-	file_metacrypt_v1_auth_proto_depIdxs = nil
+	File_proto_metacrypt_v1_auth_proto = out.File
+	file_proto_metacrypt_v1_auth_proto_goTypes = nil
+	file_proto_metacrypt_v1_auth_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/auth_grpc.pb.go b/gen/metacrypt/v1/auth_grpc.pb.go
index f653178..ce4cce4 100644
--- a/gen/metacrypt/v1/auth_grpc.pb.go
+++ b/gen/metacrypt/v1/auth_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/auth.proto
+// source: proto/metacrypt/v1/auth.proto
 
 package metacryptv1
 
@@ -193,5 +193,5 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/auth.proto",
+	Metadata: "proto/metacrypt/v1/auth.proto",
 }
diff --git a/gen/metacrypt/v1/common.pb.go b/gen/metacrypt/v1/common.pb.go
index 4af8d5a..1e5cabc 100644
--- a/gen/metacrypt/v1/common.pb.go
+++ b/gen/metacrypt/v1/common.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/common.proto
+// source: proto/metacrypt/v1/common.proto
 
 package metacryptv1
 
@@ -20,14 +20,14 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-var File_metacrypt_v1_common_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_common_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_common_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_common_proto_rawDesc = "" +
 	"\n" +
-	"\x19metacrypt/v1/common.proto\x12\fmetacrypt.v1B>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
+	"\x1fproto/metacrypt/v1/common.proto\x12\fmetacrypt.v1B>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
-var file_metacrypt_v1_common_proto_goTypes = []any{}
-var file_metacrypt_v1_common_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_common_proto_goTypes = []any{}
+var file_proto_metacrypt_v1_common_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for method output_type
 	0, // [0:0] is the sub-list for method input_type
 	0, // [0:0] is the sub-list for extension type_name
@@ -35,25 +35,25 @@ var file_metacrypt_v1_common_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_common_proto_init() }
-func file_metacrypt_v1_common_proto_init() {
-	if File_metacrypt_v1_common_proto != nil {
+func init() { file_proto_metacrypt_v1_common_proto_init() }
+func file_proto_metacrypt_v1_common_proto_init() {
+	if File_proto_metacrypt_v1_common_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_common_proto_rawDesc), len(file_metacrypt_v1_common_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_common_proto_rawDesc), len(file_proto_metacrypt_v1_common_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   0,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
-		GoTypes:           file_metacrypt_v1_common_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_common_proto_depIdxs,
+		GoTypes:           file_proto_metacrypt_v1_common_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_common_proto_depIdxs,
 	}.Build()
-	File_metacrypt_v1_common_proto = out.File
-	file_metacrypt_v1_common_proto_goTypes = nil
-	file_metacrypt_v1_common_proto_depIdxs = nil
+	File_proto_metacrypt_v1_common_proto = out.File
+	file_proto_metacrypt_v1_common_proto_goTypes = nil
+	file_proto_metacrypt_v1_common_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/engine.pb.go b/gen/metacrypt/v1/engine.pb.go
index cd41dd8..835baea 100644
--- a/gen/metacrypt/v1/engine.pb.go
+++ b/gen/metacrypt/v1/engine.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/engine.proto
+// source: proto/metacrypt/v1/engine.proto
 
 package metacryptv1
 
@@ -33,7 +33,7 @@ type MountRequest struct {
 
 func (x *MountRequest) Reset() {
 	*x = MountRequest{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -45,7 +45,7 @@ func (x *MountRequest) String() string {
 func (*MountRequest) ProtoMessage() {}
 
 func (x *MountRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -58,7 +58,7 @@ func (x *MountRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MountRequest.ProtoReflect.Descriptor instead.
 func (*MountRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *MountRequest) GetName() string {
@@ -90,7 +90,7 @@ type MountResponse struct {
 
 func (x *MountResponse) Reset() {
 	*x = MountResponse{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -102,7 +102,7 @@ func (x *MountResponse) String() string {
 func (*MountResponse) ProtoMessage() {}
 
 func (x *MountResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -115,7 +115,7 @@ func (x *MountResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MountResponse.ProtoReflect.Descriptor instead.
 func (*MountResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{1}
 }
 
 type UnmountRequest struct {
@@ -127,7 +127,7 @@ type UnmountRequest struct {
 
 func (x *UnmountRequest) Reset() {
 	*x = UnmountRequest{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -139,7 +139,7 @@ func (x *UnmountRequest) String() string {
 func (*UnmountRequest) ProtoMessage() {}
 
 func (x *UnmountRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -152,7 +152,7 @@ func (x *UnmountRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnmountRequest.ProtoReflect.Descriptor instead.
 func (*UnmountRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{2}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *UnmountRequest) GetName() string {
@@ -170,7 +170,7 @@ type UnmountResponse struct {
 
 func (x *UnmountResponse) Reset() {
 	*x = UnmountResponse{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -182,7 +182,7 @@ func (x *UnmountResponse) String() string {
 func (*UnmountResponse) ProtoMessage() {}
 
 func (x *UnmountResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -195,7 +195,7 @@ func (x *UnmountResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnmountResponse.ProtoReflect.Descriptor instead.
 func (*UnmountResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{3}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{3}
 }
 
 type ListMountsRequest struct {
@@ -206,7 +206,7 @@ type ListMountsRequest struct {
 
 func (x *ListMountsRequest) Reset() {
 	*x = ListMountsRequest{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -218,7 +218,7 @@ func (x *ListMountsRequest) String() string {
 func (*ListMountsRequest) ProtoMessage() {}
 
 func (x *ListMountsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -231,7 +231,7 @@ func (x *ListMountsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListMountsRequest.ProtoReflect.Descriptor instead.
 func (*ListMountsRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{4}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{4}
 }
 
 type ListMountsResponse struct {
@@ -243,7 +243,7 @@ type ListMountsResponse struct {
 
 func (x *ListMountsResponse) Reset() {
 	*x = ListMountsResponse{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -255,7 +255,7 @@ func (x *ListMountsResponse) String() string {
 func (*ListMountsResponse) ProtoMessage() {}
 
 func (x *ListMountsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -268,7 +268,7 @@ func (x *ListMountsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListMountsResponse.ProtoReflect.Descriptor instead.
 func (*ListMountsResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{5}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ListMountsResponse) GetMounts() []*MountInfo {
@@ -289,7 +289,7 @@ type MountInfo struct {
 
 func (x *MountInfo) Reset() {
 	*x = MountInfo{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -301,7 +301,7 @@ func (x *MountInfo) String() string {
 func (*MountInfo) ProtoMessage() {}
 
 func (x *MountInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -314,7 +314,7 @@ func (x *MountInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MountInfo.ProtoReflect.Descriptor instead.
 func (*MountInfo) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{6}
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *MountInfo) GetName() string {
@@ -338,7 +338,7 @@ func (x *MountInfo) GetMountPath() string {
 	return ""
 }
 
-type EngineRequest struct {
+type ExecuteRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Mount         string                 `protobuf:"bytes,1,opt,name=mount,proto3" json:"mount,omitempty"`
 	Operation     string                 `protobuf:"bytes,2,opt,name=operation,proto3" json:"operation,omitempty"`
@@ -348,21 +348,21 @@ type EngineRequest struct {
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *EngineRequest) Reset() {
-	*x = EngineRequest{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[7]
+func (x *ExecuteRequest) Reset() {
+	*x = ExecuteRequest{}
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *EngineRequest) String() string {
+func (x *ExecuteRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*EngineRequest) ProtoMessage() {}
+func (*ExecuteRequest) ProtoMessage() {}
 
-func (x *EngineRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[7]
+func (x *ExecuteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -373,61 +373,61 @@ func (x *EngineRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use EngineRequest.ProtoReflect.Descriptor instead.
-func (*EngineRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{7}
+// Deprecated: Use ExecuteRequest.ProtoReflect.Descriptor instead.
+func (*ExecuteRequest) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{7}
 }
 
-func (x *EngineRequest) GetMount() string {
+func (x *ExecuteRequest) GetMount() string {
 	if x != nil {
 		return x.Mount
 	}
 	return ""
 }
 
-func (x *EngineRequest) GetOperation() string {
+func (x *ExecuteRequest) GetOperation() string {
 	if x != nil {
 		return x.Operation
 	}
 	return ""
 }
 
-func (x *EngineRequest) GetPath() string {
+func (x *ExecuteRequest) GetPath() string {
 	if x != nil {
 		return x.Path
 	}
 	return ""
 }
 
-func (x *EngineRequest) GetData() *structpb.Struct {
+func (x *ExecuteRequest) GetData() *structpb.Struct {
 	if x != nil {
 		return x.Data
 	}
 	return nil
 }
 
-type EngineResponse struct {
+type ExecuteResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Data          *structpb.Struct       `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *EngineResponse) Reset() {
-	*x = EngineResponse{}
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[8]
+func (x *ExecuteResponse) Reset() {
+	*x = ExecuteResponse{}
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *EngineResponse) String() string {
+func (x *ExecuteResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*EngineResponse) ProtoMessage() {}
+func (*ExecuteResponse) ProtoMessage() {}
 
-func (x *EngineResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_engine_proto_msgTypes[8]
+func (x *ExecuteResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_engine_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -438,23 +438,23 @@ func (x *EngineResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use EngineResponse.ProtoReflect.Descriptor instead.
-func (*EngineResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_engine_proto_rawDescGZIP(), []int{8}
+// Deprecated: Use ExecuteResponse.ProtoReflect.Descriptor instead.
+func (*ExecuteResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_engine_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *EngineResponse) GetData() *structpb.Struct {
+func (x *ExecuteResponse) GetData() *structpb.Struct {
 	if x != nil {
 		return x.Data
 	}
 	return nil
 }
 
-var File_metacrypt_v1_engine_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_engine_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_engine_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_engine_proto_rawDesc = "" +
 	"\n" +
-	"\x19metacrypt/v1/engine.proto\x12\fmetacrypt.v1\x1a\x1cgoogle/protobuf/struct.proto\"g\n" +
+	"\x1fproto/metacrypt/v1/engine.proto\x12\fmetacrypt.v1\x1a\x1cgoogle/protobuf/struct.proto\"g\n" +
 	"\fMountRequest\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
 	"\x04type\x18\x02 \x01(\tR\x04type\x12/\n" +
@@ -470,35 +470,35 @@ const file_metacrypt_v1_engine_proto_rawDesc = "" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
 	"\x04type\x18\x02 \x01(\tR\x04type\x12\x1d\n" +
 	"\n" +
-	"mount_path\x18\x03 \x01(\tR\tmountPath\"\x84\x01\n" +
-	"\rEngineRequest\x12\x14\n" +
+	"mount_path\x18\x03 \x01(\tR\tmountPath\"\x85\x01\n" +
+	"\x0eExecuteRequest\x12\x14\n" +
 	"\x05mount\x18\x01 \x01(\tR\x05mount\x12\x1c\n" +
 	"\toperation\x18\x02 \x01(\tR\toperation\x12\x12\n" +
 	"\x04path\x18\x03 \x01(\tR\x04path\x12+\n" +
-	"\x04data\x18\x04 \x01(\v2\x17.google.protobuf.StructR\x04data\"=\n" +
-	"\x0eEngineResponse\x12+\n" +
-	"\x04data\x18\x01 \x01(\v2\x17.google.protobuf.StructR\x04data2\xb0\x02\n" +
+	"\x04data\x18\x04 \x01(\v2\x17.google.protobuf.StructR\x04data\">\n" +
+	"\x0fExecuteResponse\x12+\n" +
+	"\x04data\x18\x01 \x01(\v2\x17.google.protobuf.StructR\x04data2\xb2\x02\n" +
 	"\rEngineService\x12@\n" +
 	"\x05Mount\x12\x1a.metacrypt.v1.MountRequest\x1a\x1b.metacrypt.v1.MountResponse\x12F\n" +
 	"\aUnmount\x12\x1c.metacrypt.v1.UnmountRequest\x1a\x1d.metacrypt.v1.UnmountResponse\x12O\n" +
 	"\n" +
-	"ListMounts\x12\x1f.metacrypt.v1.ListMountsRequest\x1a .metacrypt.v1.ListMountsResponse\x12D\n" +
-	"\aRequest\x12\x1b.metacrypt.v1.EngineRequest\x1a\x1c.metacrypt.v1.EngineResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
+	"ListMounts\x12\x1f.metacrypt.v1.ListMountsRequest\x1a .metacrypt.v1.ListMountsResponse\x12F\n" +
+	"\aExecute\x12\x1c.metacrypt.v1.ExecuteRequest\x1a\x1d.metacrypt.v1.ExecuteResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_engine_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_engine_proto_rawDescData []byte
+	file_proto_metacrypt_v1_engine_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_engine_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_engine_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_engine_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_engine_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_engine_proto_rawDesc), len(file_metacrypt_v1_engine_proto_rawDesc)))
+func file_proto_metacrypt_v1_engine_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_engine_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_engine_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_engine_proto_rawDesc), len(file_proto_metacrypt_v1_engine_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_engine_proto_rawDescData
+	return file_proto_metacrypt_v1_engine_proto_rawDescData
 }
 
-var file_metacrypt_v1_engine_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
-var file_metacrypt_v1_engine_proto_goTypes = []any{
+var file_proto_metacrypt_v1_engine_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_proto_metacrypt_v1_engine_proto_goTypes = []any{
 	(*MountRequest)(nil),       // 0: metacrypt.v1.MountRequest
 	(*MountResponse)(nil),      // 1: metacrypt.v1.MountResponse
 	(*UnmountRequest)(nil),     // 2: metacrypt.v1.UnmountRequest
@@ -506,23 +506,23 @@ var file_metacrypt_v1_engine_proto_goTypes = []any{
 	(*ListMountsRequest)(nil),  // 4: metacrypt.v1.ListMountsRequest
 	(*ListMountsResponse)(nil), // 5: metacrypt.v1.ListMountsResponse
 	(*MountInfo)(nil),          // 6: metacrypt.v1.MountInfo
-	(*EngineRequest)(nil),      // 7: metacrypt.v1.EngineRequest
-	(*EngineResponse)(nil),     // 8: metacrypt.v1.EngineResponse
+	(*ExecuteRequest)(nil),     // 7: metacrypt.v1.ExecuteRequest
+	(*ExecuteResponse)(nil),    // 8: metacrypt.v1.ExecuteResponse
 	(*structpb.Struct)(nil),    // 9: google.protobuf.Struct
 }
-var file_metacrypt_v1_engine_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_engine_proto_depIdxs = []int32{
 	9, // 0: metacrypt.v1.MountRequest.config:type_name -> google.protobuf.Struct
 	6, // 1: metacrypt.v1.ListMountsResponse.mounts:type_name -> metacrypt.v1.MountInfo
-	9, // 2: metacrypt.v1.EngineRequest.data:type_name -> google.protobuf.Struct
-	9, // 3: metacrypt.v1.EngineResponse.data:type_name -> google.protobuf.Struct
+	9, // 2: metacrypt.v1.ExecuteRequest.data:type_name -> google.protobuf.Struct
+	9, // 3: metacrypt.v1.ExecuteResponse.data:type_name -> google.protobuf.Struct
 	0, // 4: metacrypt.v1.EngineService.Mount:input_type -> metacrypt.v1.MountRequest
 	2, // 5: metacrypt.v1.EngineService.Unmount:input_type -> metacrypt.v1.UnmountRequest
 	4, // 6: metacrypt.v1.EngineService.ListMounts:input_type -> metacrypt.v1.ListMountsRequest
-	7, // 7: metacrypt.v1.EngineService.Request:input_type -> metacrypt.v1.EngineRequest
+	7, // 7: metacrypt.v1.EngineService.Execute:input_type -> metacrypt.v1.ExecuteRequest
 	1, // 8: metacrypt.v1.EngineService.Mount:output_type -> metacrypt.v1.MountResponse
 	3, // 9: metacrypt.v1.EngineService.Unmount:output_type -> metacrypt.v1.UnmountResponse
 	5, // 10: metacrypt.v1.EngineService.ListMounts:output_type -> metacrypt.v1.ListMountsResponse
-	8, // 11: metacrypt.v1.EngineService.Request:output_type -> metacrypt.v1.EngineResponse
+	8, // 11: metacrypt.v1.EngineService.Execute:output_type -> metacrypt.v1.ExecuteResponse
 	8, // [8:12] is the sub-list for method output_type
 	4, // [4:8] is the sub-list for method input_type
 	4, // [4:4] is the sub-list for extension type_name
@@ -530,26 +530,26 @@ var file_metacrypt_v1_engine_proto_depIdxs = []int32{
 	0, // [0:4] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_engine_proto_init() }
-func file_metacrypt_v1_engine_proto_init() {
-	if File_metacrypt_v1_engine_proto != nil {
+func init() { file_proto_metacrypt_v1_engine_proto_init() }
+func file_proto_metacrypt_v1_engine_proto_init() {
+	if File_proto_metacrypt_v1_engine_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_engine_proto_rawDesc), len(file_metacrypt_v1_engine_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_engine_proto_rawDesc), len(file_proto_metacrypt_v1_engine_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_engine_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_engine_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_engine_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_engine_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_engine_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_engine_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_engine_proto = out.File
-	file_metacrypt_v1_engine_proto_goTypes = nil
-	file_metacrypt_v1_engine_proto_depIdxs = nil
+	File_proto_metacrypt_v1_engine_proto = out.File
+	file_proto_metacrypt_v1_engine_proto_goTypes = nil
+	file_proto_metacrypt_v1_engine_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/engine_grpc.pb.go b/gen/metacrypt/v1/engine_grpc.pb.go
index 8d5ec66..97341ed 100644
--- a/gen/metacrypt/v1/engine_grpc.pb.go
+++ b/gen/metacrypt/v1/engine_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/engine.proto
+// source: proto/metacrypt/v1/engine.proto
 
 package metacryptv1
 
@@ -22,7 +22,7 @@ const (
 	EngineService_Mount_FullMethodName      = "/metacrypt.v1.EngineService/Mount"
 	EngineService_Unmount_FullMethodName    = "/metacrypt.v1.EngineService/Unmount"
 	EngineService_ListMounts_FullMethodName = "/metacrypt.v1.EngineService/ListMounts"
-	EngineService_Request_FullMethodName    = "/metacrypt.v1.EngineService/Request"
+	EngineService_Execute_FullMethodName    = "/metacrypt.v1.EngineService/Execute"
 )
 
 // EngineServiceClient is the client API for EngineService service.
@@ -32,7 +32,7 @@ type EngineServiceClient interface {
 	Mount(ctx context.Context, in *MountRequest, opts ...grpc.CallOption) (*MountResponse, error)
 	Unmount(ctx context.Context, in *UnmountRequest, opts ...grpc.CallOption) (*UnmountResponse, error)
 	ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error)
-	Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error)
+	Execute(ctx context.Context, in *ExecuteRequest, opts ...grpc.CallOption) (*ExecuteResponse, error)
 }
 
 type engineServiceClient struct {
@@ -73,10 +73,10 @@ func (c *engineServiceClient) ListMounts(ctx context.Context, in *ListMountsRequ
 	return out, nil
 }
 
-func (c *engineServiceClient) Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error) {
+func (c *engineServiceClient) Execute(ctx context.Context, in *ExecuteRequest, opts ...grpc.CallOption) (*ExecuteResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(EngineResponse)
-	err := c.cc.Invoke(ctx, EngineService_Request_FullMethodName, in, out, cOpts...)
+	out := new(ExecuteResponse)
+	err := c.cc.Invoke(ctx, EngineService_Execute_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -90,7 +90,7 @@ type EngineServiceServer interface {
 	Mount(context.Context, *MountRequest) (*MountResponse, error)
 	Unmount(context.Context, *UnmountRequest) (*UnmountResponse, error)
 	ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error)
-	Request(context.Context, *EngineRequest) (*EngineResponse, error)
+	Execute(context.Context, *ExecuteRequest) (*ExecuteResponse, error)
 	mustEmbedUnimplementedEngineServiceServer()
 }
 
@@ -110,8 +110,8 @@ func (UnimplementedEngineServiceServer) Unmount(context.Context, *UnmountRequest
 func (UnimplementedEngineServiceServer) ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ListMounts not implemented")
 }
-func (UnimplementedEngineServiceServer) Request(context.Context, *EngineRequest) (*EngineResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method Request not implemented")
+func (UnimplementedEngineServiceServer) Execute(context.Context, *ExecuteRequest) (*ExecuteResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Execute not implemented")
 }
 func (UnimplementedEngineServiceServer) mustEmbedUnimplementedEngineServiceServer() {}
 func (UnimplementedEngineServiceServer) testEmbeddedByValue()                       {}
@@ -188,20 +188,20 @@ func _EngineService_ListMounts_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
-func _EngineService_Request_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(EngineRequest)
+func _EngineService_Execute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExecuteRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(EngineServiceServer).Request(ctx, in)
+		return srv.(EngineServiceServer).Execute(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: EngineService_Request_FullMethodName,
+		FullMethod: EngineService_Execute_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(EngineServiceServer).Request(ctx, req.(*EngineRequest))
+		return srv.(EngineServiceServer).Execute(ctx, req.(*ExecuteRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -226,10 +226,10 @@ var EngineService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _EngineService_ListMounts_Handler,
 		},
 		{
-			MethodName: "Request",
-			Handler:    _EngineService_Request_Handler,
+			MethodName: "Execute",
+			Handler:    _EngineService_Execute_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/engine.proto",
+	Metadata: "proto/metacrypt/v1/engine.proto",
 }
diff --git a/gen/metacrypt/v1/pki.pb.go b/gen/metacrypt/v1/pki.pb.go
index eaabfa6..7e78648 100644
--- a/gen/metacrypt/v1/pki.pb.go
+++ b/gen/metacrypt/v1/pki.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/pki.proto
+// source: proto/metacrypt/v1/pki.proto
 
 package metacryptv1
 
@@ -30,7 +30,7 @@ type GetRootCertRequest struct {
 
 func (x *GetRootCertRequest) Reset() {
 	*x = GetRootCertRequest{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -42,7 +42,7 @@ func (x *GetRootCertRequest) String() string {
 func (*GetRootCertRequest) ProtoMessage() {}
 
 func (x *GetRootCertRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -55,7 +55,7 @@ func (x *GetRootCertRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetRootCertRequest.ProtoReflect.Descriptor instead.
 func (*GetRootCertRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *GetRootCertRequest) GetMount() string {
@@ -74,7 +74,7 @@ type GetRootCertResponse struct {
 
 func (x *GetRootCertResponse) Reset() {
 	*x = GetRootCertResponse{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -86,7 +86,7 @@ func (x *GetRootCertResponse) String() string {
 func (*GetRootCertResponse) ProtoMessage() {}
 
 func (x *GetRootCertResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -99,7 +99,7 @@ func (x *GetRootCertResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetRootCertResponse.ProtoReflect.Descriptor instead.
 func (*GetRootCertResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *GetRootCertResponse) GetCertPem() []byte {
@@ -119,7 +119,7 @@ type GetChainRequest struct {
 
 func (x *GetChainRequest) Reset() {
 	*x = GetChainRequest{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -131,7 +131,7 @@ func (x *GetChainRequest) String() string {
 func (*GetChainRequest) ProtoMessage() {}
 
 func (x *GetChainRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -144,7 +144,7 @@ func (x *GetChainRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetChainRequest.ProtoReflect.Descriptor instead.
 func (*GetChainRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{2}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *GetChainRequest) GetMount() string {
@@ -170,7 +170,7 @@ type GetChainResponse struct {
 
 func (x *GetChainResponse) Reset() {
 	*x = GetChainResponse{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -182,7 +182,7 @@ func (x *GetChainResponse) String() string {
 func (*GetChainResponse) ProtoMessage() {}
 
 func (x *GetChainResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -195,7 +195,7 @@ func (x *GetChainResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetChainResponse.ProtoReflect.Descriptor instead.
 func (*GetChainResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{3}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *GetChainResponse) GetChainPem() []byte {
@@ -215,7 +215,7 @@ type GetIssuerCertRequest struct {
 
 func (x *GetIssuerCertRequest) Reset() {
 	*x = GetIssuerCertRequest{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -227,7 +227,7 @@ func (x *GetIssuerCertRequest) String() string {
 func (*GetIssuerCertRequest) ProtoMessage() {}
 
 func (x *GetIssuerCertRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -240,7 +240,7 @@ func (x *GetIssuerCertRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetIssuerCertRequest.ProtoReflect.Descriptor instead.
 func (*GetIssuerCertRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{4}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *GetIssuerCertRequest) GetMount() string {
@@ -266,7 +266,7 @@ type GetIssuerCertResponse struct {
 
 func (x *GetIssuerCertResponse) Reset() {
 	*x = GetIssuerCertResponse{}
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -278,7 +278,7 @@ func (x *GetIssuerCertResponse) String() string {
 func (*GetIssuerCertResponse) ProtoMessage() {}
 
 func (x *GetIssuerCertResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_pki_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_pki_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -291,7 +291,7 @@ func (x *GetIssuerCertResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetIssuerCertResponse.ProtoReflect.Descriptor instead.
 func (*GetIssuerCertResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_pki_proto_rawDescGZIP(), []int{5}
+	return file_proto_metacrypt_v1_pki_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GetIssuerCertResponse) GetCertPem() []byte {
@@ -301,11 +301,11 @@ func (x *GetIssuerCertResponse) GetCertPem() []byte {
 	return nil
 }
 
-var File_metacrypt_v1_pki_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_pki_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_pki_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_pki_proto_rawDesc = "" +
 	"\n" +
-	"\x16metacrypt/v1/pki.proto\x12\fmetacrypt.v1\"*\n" +
+	"\x1cproto/metacrypt/v1/pki.proto\x12\fmetacrypt.v1\"*\n" +
 	"\x12GetRootCertRequest\x12\x14\n" +
 	"\x05mount\x18\x01 \x01(\tR\x05mount\"0\n" +
 	"\x13GetRootCertResponse\x12\x19\n" +
@@ -327,19 +327,19 @@ const file_metacrypt_v1_pki_proto_rawDesc = "" +
 	"\rGetIssuerCert\x12\".metacrypt.v1.GetIssuerCertRequest\x1a#.metacrypt.v1.GetIssuerCertResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_pki_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_pki_proto_rawDescData []byte
+	file_proto_metacrypt_v1_pki_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_pki_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_pki_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_pki_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_pki_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_pki_proto_rawDesc), len(file_metacrypt_v1_pki_proto_rawDesc)))
+func file_proto_metacrypt_v1_pki_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_pki_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_pki_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_pki_proto_rawDesc), len(file_proto_metacrypt_v1_pki_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_pki_proto_rawDescData
+	return file_proto_metacrypt_v1_pki_proto_rawDescData
 }
 
-var file_metacrypt_v1_pki_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_metacrypt_v1_pki_proto_goTypes = []any{
+var file_proto_metacrypt_v1_pki_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_proto_metacrypt_v1_pki_proto_goTypes = []any{
 	(*GetRootCertRequest)(nil),    // 0: metacrypt.v1.GetRootCertRequest
 	(*GetRootCertResponse)(nil),   // 1: metacrypt.v1.GetRootCertResponse
 	(*GetChainRequest)(nil),       // 2: metacrypt.v1.GetChainRequest
@@ -347,7 +347,7 @@ var file_metacrypt_v1_pki_proto_goTypes = []any{
 	(*GetIssuerCertRequest)(nil),  // 4: metacrypt.v1.GetIssuerCertRequest
 	(*GetIssuerCertResponse)(nil), // 5: metacrypt.v1.GetIssuerCertResponse
 }
-var file_metacrypt_v1_pki_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_pki_proto_depIdxs = []int32{
 	0, // 0: metacrypt.v1.PKIService.GetRootCert:input_type -> metacrypt.v1.GetRootCertRequest
 	2, // 1: metacrypt.v1.PKIService.GetChain:input_type -> metacrypt.v1.GetChainRequest
 	4, // 2: metacrypt.v1.PKIService.GetIssuerCert:input_type -> metacrypt.v1.GetIssuerCertRequest
@@ -361,26 +361,26 @@ var file_metacrypt_v1_pki_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_pki_proto_init() }
-func file_metacrypt_v1_pki_proto_init() {
-	if File_metacrypt_v1_pki_proto != nil {
+func init() { file_proto_metacrypt_v1_pki_proto_init() }
+func file_proto_metacrypt_v1_pki_proto_init() {
+	if File_proto_metacrypt_v1_pki_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_pki_proto_rawDesc), len(file_metacrypt_v1_pki_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_pki_proto_rawDesc), len(file_proto_metacrypt_v1_pki_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_pki_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_pki_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_pki_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_pki_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_pki_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_pki_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_pki_proto = out.File
-	file_metacrypt_v1_pki_proto_goTypes = nil
-	file_metacrypt_v1_pki_proto_depIdxs = nil
+	File_proto_metacrypt_v1_pki_proto = out.File
+	file_proto_metacrypt_v1_pki_proto_goTypes = nil
+	file_proto_metacrypt_v1_pki_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/pki_grpc.pb.go b/gen/metacrypt/v1/pki_grpc.pb.go
index fdec00b..0c67149 100644
--- a/gen/metacrypt/v1/pki_grpc.pb.go
+++ b/gen/metacrypt/v1/pki_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/pki.proto
+// source: proto/metacrypt/v1/pki.proto
 
 package metacryptv1
 
@@ -199,5 +199,5 @@ var PKIService_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/pki.proto",
+	Metadata: "proto/metacrypt/v1/pki.proto",
 }
diff --git a/gen/metacrypt/v1/policy.pb.go b/gen/metacrypt/v1/policy.pb.go
index 429b319..f582d99 100644
--- a/gen/metacrypt/v1/policy.pb.go
+++ b/gen/metacrypt/v1/policy.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/policy.proto
+// source: proto/metacrypt/v1/policy.proto
 
 package metacryptv1
 
@@ -36,7 +36,7 @@ type PolicyRule struct {
 
 func (x *PolicyRule) Reset() {
 	*x = PolicyRule{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -48,7 +48,7 @@ func (x *PolicyRule) String() string {
 func (*PolicyRule) ProtoMessage() {}
 
 func (x *PolicyRule) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -61,7 +61,7 @@ func (x *PolicyRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyRule.ProtoReflect.Descriptor instead.
 func (*PolicyRule) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *PolicyRule) GetId() string {
@@ -122,7 +122,7 @@ type CreatePolicyRequest struct {
 
 func (x *CreatePolicyRequest) Reset() {
 	*x = CreatePolicyRequest{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -134,7 +134,7 @@ func (x *CreatePolicyRequest) String() string {
 func (*CreatePolicyRequest) ProtoMessage() {}
 
 func (x *CreatePolicyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -147,7 +147,7 @@ func (x *CreatePolicyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreatePolicyRequest.ProtoReflect.Descriptor instead.
 func (*CreatePolicyRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *CreatePolicyRequest) GetRule() *PolicyRule {
@@ -157,6 +157,94 @@ func (x *CreatePolicyRequest) GetRule() *PolicyRule {
 	return nil
 }
 
+type CreatePolicyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Rule          *PolicyRule            `protobuf:"bytes,1,opt,name=rule,proto3" json:"rule,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePolicyResponse) Reset() {
+	*x = CreatePolicyResponse{}
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePolicyResponse) ProtoMessage() {}
+
+func (x *CreatePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePolicyResponse.ProtoReflect.Descriptor instead.
+func (*CreatePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CreatePolicyResponse) GetRule() *PolicyRule {
+	if x != nil {
+		return x.Rule
+	}
+	return nil
+}
+
+type GetPolicyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Rule          *PolicyRule            `protobuf:"bytes,1,opt,name=rule,proto3" json:"rule,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetPolicyResponse) Reset() {
+	*x = GetPolicyResponse{}
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetPolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPolicyResponse) ProtoMessage() {}
+
+func (x *GetPolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPolicyResponse.ProtoReflect.Descriptor instead.
+func (*GetPolicyResponse) Descriptor() ([]byte, []int) {
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetPolicyResponse) GetRule() *PolicyRule {
+	if x != nil {
+		return x.Rule
+	}
+	return nil
+}
+
 type ListPoliciesRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -165,7 +253,7 @@ type ListPoliciesRequest struct {
 
 func (x *ListPoliciesRequest) Reset() {
 	*x = ListPoliciesRequest{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -177,7 +265,7 @@ func (x *ListPoliciesRequest) String() string {
 func (*ListPoliciesRequest) ProtoMessage() {}
 
 func (x *ListPoliciesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -190,7 +278,7 @@ func (x *ListPoliciesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPoliciesRequest.ProtoReflect.Descriptor instead.
 func (*ListPoliciesRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{2}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{4}
 }
 
 type ListPoliciesResponse struct {
@@ -202,7 +290,7 @@ type ListPoliciesResponse struct {
 
 func (x *ListPoliciesResponse) Reset() {
 	*x = ListPoliciesResponse{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -214,7 +302,7 @@ func (x *ListPoliciesResponse) String() string {
 func (*ListPoliciesResponse) ProtoMessage() {}
 
 func (x *ListPoliciesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -227,7 +315,7 @@ func (x *ListPoliciesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPoliciesResponse.ProtoReflect.Descriptor instead.
 func (*ListPoliciesResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{3}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ListPoliciesResponse) GetRules() []*PolicyRule {
@@ -246,7 +334,7 @@ type GetPolicyRequest struct {
 
 func (x *GetPolicyRequest) Reset() {
 	*x = GetPolicyRequest{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -258,7 +346,7 @@ func (x *GetPolicyRequest) String() string {
 func (*GetPolicyRequest) ProtoMessage() {}
 
 func (x *GetPolicyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -271,7 +359,7 @@ func (x *GetPolicyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPolicyRequest.ProtoReflect.Descriptor instead.
 func (*GetPolicyRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{4}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *GetPolicyRequest) GetId() string {
@@ -290,7 +378,7 @@ type DeletePolicyRequest struct {
 
 func (x *DeletePolicyRequest) Reset() {
 	*x = DeletePolicyRequest{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -302,7 +390,7 @@ func (x *DeletePolicyRequest) String() string {
 func (*DeletePolicyRequest) ProtoMessage() {}
 
 func (x *DeletePolicyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -315,7 +403,7 @@ func (x *DeletePolicyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeletePolicyRequest.ProtoReflect.Descriptor instead.
 func (*DeletePolicyRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{5}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *DeletePolicyRequest) GetId() string {
@@ -333,7 +421,7 @@ type DeletePolicyResponse struct {
 
 func (x *DeletePolicyResponse) Reset() {
 	*x = DeletePolicyResponse{}
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -345,7 +433,7 @@ func (x *DeletePolicyResponse) String() string {
 func (*DeletePolicyResponse) ProtoMessage() {}
 
 func (x *DeletePolicyResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_policy_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_policy_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -358,14 +446,14 @@ func (x *DeletePolicyResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeletePolicyResponse.ProtoReflect.Descriptor instead.
 func (*DeletePolicyResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_policy_proto_rawDescGZIP(), []int{6}
+	return file_proto_metacrypt_v1_policy_proto_rawDescGZIP(), []int{8}
 }
 
-var File_metacrypt_v1_policy_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_policy_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_policy_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_policy_proto_rawDesc = "" +
 	"\n" +
-	"\x19metacrypt/v1/policy.proto\x12\fmetacrypt.v1\"\xbc\x01\n" +
+	"\x1fproto/metacrypt/v1/policy.proto\x12\fmetacrypt.v1\"\xbc\x01\n" +
 	"\n" +
 	"PolicyRule\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1a\n" +
@@ -376,6 +464,10 @@ const file_metacrypt_v1_policy_proto_rawDesc = "" +
 	"\tresources\x18\x06 \x03(\tR\tresources\x12\x18\n" +
 	"\aactions\x18\a \x03(\tR\aactions\"C\n" +
 	"\x13CreatePolicyRequest\x12,\n" +
+	"\x04rule\x18\x01 \x01(\v2\x18.metacrypt.v1.PolicyRuleR\x04rule\"D\n" +
+	"\x14CreatePolicyResponse\x12,\n" +
+	"\x04rule\x18\x01 \x01(\v2\x18.metacrypt.v1.PolicyRuleR\x04rule\"A\n" +
+	"\x11GetPolicyResponse\x12,\n" +
 	"\x04rule\x18\x01 \x01(\v2\x18.metacrypt.v1.PolicyRuleR\x04rule\"\x15\n" +
 	"\x13ListPoliciesRequest\"F\n" +
 	"\x14ListPoliciesResponse\x12.\n" +
@@ -384,73 +476,77 @@ const file_metacrypt_v1_policy_proto_rawDesc = "" +
 	"\x02id\x18\x01 \x01(\tR\x02id\"%\n" +
 	"\x13DeletePolicyRequest\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\"\x16\n" +
-	"\x14DeletePolicyResponse2\xd1\x02\n" +
-	"\rPolicyService\x12K\n" +
-	"\fCreatePolicy\x12!.metacrypt.v1.CreatePolicyRequest\x1a\x18.metacrypt.v1.PolicyRule\x12U\n" +
-	"\fListPolicies\x12!.metacrypt.v1.ListPoliciesRequest\x1a\".metacrypt.v1.ListPoliciesResponse\x12E\n" +
-	"\tGetPolicy\x12\x1e.metacrypt.v1.GetPolicyRequest\x1a\x18.metacrypt.v1.PolicyRule\x12U\n" +
+	"\x14DeletePolicyResponse2\xe2\x02\n" +
+	"\rPolicyService\x12U\n" +
+	"\fCreatePolicy\x12!.metacrypt.v1.CreatePolicyRequest\x1a\".metacrypt.v1.CreatePolicyResponse\x12U\n" +
+	"\fListPolicies\x12!.metacrypt.v1.ListPoliciesRequest\x1a\".metacrypt.v1.ListPoliciesResponse\x12L\n" +
+	"\tGetPolicy\x12\x1e.metacrypt.v1.GetPolicyRequest\x1a\x1f.metacrypt.v1.GetPolicyResponse\x12U\n" +
 	"\fDeletePolicy\x12!.metacrypt.v1.DeletePolicyRequest\x1a\".metacrypt.v1.DeletePolicyResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_policy_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_policy_proto_rawDescData []byte
+	file_proto_metacrypt_v1_policy_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_policy_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_policy_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_policy_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_policy_proto_rawDesc), len(file_metacrypt_v1_policy_proto_rawDesc)))
+func file_proto_metacrypt_v1_policy_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_policy_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_policy_proto_rawDesc), len(file_proto_metacrypt_v1_policy_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_policy_proto_rawDescData
+	return file_proto_metacrypt_v1_policy_proto_rawDescData
 }
 
-var file_metacrypt_v1_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
-var file_metacrypt_v1_policy_proto_goTypes = []any{
+var file_proto_metacrypt_v1_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_proto_metacrypt_v1_policy_proto_goTypes = []any{
 	(*PolicyRule)(nil),           // 0: metacrypt.v1.PolicyRule
 	(*CreatePolicyRequest)(nil),  // 1: metacrypt.v1.CreatePolicyRequest
-	(*ListPoliciesRequest)(nil),  // 2: metacrypt.v1.ListPoliciesRequest
-	(*ListPoliciesResponse)(nil), // 3: metacrypt.v1.ListPoliciesResponse
-	(*GetPolicyRequest)(nil),     // 4: metacrypt.v1.GetPolicyRequest
-	(*DeletePolicyRequest)(nil),  // 5: metacrypt.v1.DeletePolicyRequest
-	(*DeletePolicyResponse)(nil), // 6: metacrypt.v1.DeletePolicyResponse
+	(*CreatePolicyResponse)(nil), // 2: metacrypt.v1.CreatePolicyResponse
+	(*GetPolicyResponse)(nil),    // 3: metacrypt.v1.GetPolicyResponse
+	(*ListPoliciesRequest)(nil),  // 4: metacrypt.v1.ListPoliciesRequest
+	(*ListPoliciesResponse)(nil), // 5: metacrypt.v1.ListPoliciesResponse
+	(*GetPolicyRequest)(nil),     // 6: metacrypt.v1.GetPolicyRequest
+	(*DeletePolicyRequest)(nil),  // 7: metacrypt.v1.DeletePolicyRequest
+	(*DeletePolicyResponse)(nil), // 8: metacrypt.v1.DeletePolicyResponse
 }
-var file_metacrypt_v1_policy_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_policy_proto_depIdxs = []int32{
 	0, // 0: metacrypt.v1.CreatePolicyRequest.rule:type_name -> metacrypt.v1.PolicyRule
-	0, // 1: metacrypt.v1.ListPoliciesResponse.rules:type_name -> metacrypt.v1.PolicyRule
-	1, // 2: metacrypt.v1.PolicyService.CreatePolicy:input_type -> metacrypt.v1.CreatePolicyRequest
-	2, // 3: metacrypt.v1.PolicyService.ListPolicies:input_type -> metacrypt.v1.ListPoliciesRequest
-	4, // 4: metacrypt.v1.PolicyService.GetPolicy:input_type -> metacrypt.v1.GetPolicyRequest
-	5, // 5: metacrypt.v1.PolicyService.DeletePolicy:input_type -> metacrypt.v1.DeletePolicyRequest
-	0, // 6: metacrypt.v1.PolicyService.CreatePolicy:output_type -> metacrypt.v1.PolicyRule
-	3, // 7: metacrypt.v1.PolicyService.ListPolicies:output_type -> metacrypt.v1.ListPoliciesResponse
-	0, // 8: metacrypt.v1.PolicyService.GetPolicy:output_type -> metacrypt.v1.PolicyRule
-	6, // 9: metacrypt.v1.PolicyService.DeletePolicy:output_type -> metacrypt.v1.DeletePolicyResponse
-	6, // [6:10] is the sub-list for method output_type
-	2, // [2:6] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	0, // 1: metacrypt.v1.CreatePolicyResponse.rule:type_name -> metacrypt.v1.PolicyRule
+	0, // 2: metacrypt.v1.GetPolicyResponse.rule:type_name -> metacrypt.v1.PolicyRule
+	0, // 3: metacrypt.v1.ListPoliciesResponse.rules:type_name -> metacrypt.v1.PolicyRule
+	1, // 4: metacrypt.v1.PolicyService.CreatePolicy:input_type -> metacrypt.v1.CreatePolicyRequest
+	4, // 5: metacrypt.v1.PolicyService.ListPolicies:input_type -> metacrypt.v1.ListPoliciesRequest
+	6, // 6: metacrypt.v1.PolicyService.GetPolicy:input_type -> metacrypt.v1.GetPolicyRequest
+	7, // 7: metacrypt.v1.PolicyService.DeletePolicy:input_type -> metacrypt.v1.DeletePolicyRequest
+	2, // 8: metacrypt.v1.PolicyService.CreatePolicy:output_type -> metacrypt.v1.CreatePolicyResponse
+	5, // 9: metacrypt.v1.PolicyService.ListPolicies:output_type -> metacrypt.v1.ListPoliciesResponse
+	3, // 10: metacrypt.v1.PolicyService.GetPolicy:output_type -> metacrypt.v1.GetPolicyResponse
+	8, // 11: metacrypt.v1.PolicyService.DeletePolicy:output_type -> metacrypt.v1.DeletePolicyResponse
+	8, // [8:12] is the sub-list for method output_type
+	4, // [4:8] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_policy_proto_init() }
-func file_metacrypt_v1_policy_proto_init() {
-	if File_metacrypt_v1_policy_proto != nil {
+func init() { file_proto_metacrypt_v1_policy_proto_init() }
+func file_proto_metacrypt_v1_policy_proto_init() {
+	if File_proto_metacrypt_v1_policy_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_policy_proto_rawDesc), len(file_metacrypt_v1_policy_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_policy_proto_rawDesc), len(file_proto_metacrypt_v1_policy_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   7,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_policy_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_policy_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_policy_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_policy_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_policy_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_policy_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_policy_proto = out.File
-	file_metacrypt_v1_policy_proto_goTypes = nil
-	file_metacrypt_v1_policy_proto_depIdxs = nil
+	File_proto_metacrypt_v1_policy_proto = out.File
+	file_proto_metacrypt_v1_policy_proto_goTypes = nil
+	file_proto_metacrypt_v1_policy_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/policy_grpc.pb.go b/gen/metacrypt/v1/policy_grpc.pb.go
index 24bd2a3..fa0e3f9 100644
--- a/gen/metacrypt/v1/policy_grpc.pb.go
+++ b/gen/metacrypt/v1/policy_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/policy.proto
+// source: proto/metacrypt/v1/policy.proto
 
 package metacryptv1
 
@@ -29,9 +29,9 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type PolicyServiceClient interface {
-	CreatePolicy(ctx context.Context, in *CreatePolicyRequest, opts ...grpc.CallOption) (*PolicyRule, error)
+	CreatePolicy(ctx context.Context, in *CreatePolicyRequest, opts ...grpc.CallOption) (*CreatePolicyResponse, error)
 	ListPolicies(ctx context.Context, in *ListPoliciesRequest, opts ...grpc.CallOption) (*ListPoliciesResponse, error)
-	GetPolicy(ctx context.Context, in *GetPolicyRequest, opts ...grpc.CallOption) (*PolicyRule, error)
+	GetPolicy(ctx context.Context, in *GetPolicyRequest, opts ...grpc.CallOption) (*GetPolicyResponse, error)
 	DeletePolicy(ctx context.Context, in *DeletePolicyRequest, opts ...grpc.CallOption) (*DeletePolicyResponse, error)
 }
 
@@ -43,9 +43,9 @@ func NewPolicyServiceClient(cc grpc.ClientConnInterface) PolicyServiceClient {
 	return &policyServiceClient{cc}
 }
 
-func (c *policyServiceClient) CreatePolicy(ctx context.Context, in *CreatePolicyRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+func (c *policyServiceClient) CreatePolicy(ctx context.Context, in *CreatePolicyRequest, opts ...grpc.CallOption) (*CreatePolicyResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(PolicyRule)
+	out := new(CreatePolicyResponse)
 	err := c.cc.Invoke(ctx, PolicyService_CreatePolicy_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
@@ -63,9 +63,9 @@ func (c *policyServiceClient) ListPolicies(ctx context.Context, in *ListPolicies
 	return out, nil
 }
 
-func (c *policyServiceClient) GetPolicy(ctx context.Context, in *GetPolicyRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+func (c *policyServiceClient) GetPolicy(ctx context.Context, in *GetPolicyRequest, opts ...grpc.CallOption) (*GetPolicyResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(PolicyRule)
+	out := new(GetPolicyResponse)
 	err := c.cc.Invoke(ctx, PolicyService_GetPolicy_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
@@ -87,9 +87,9 @@ func (c *policyServiceClient) DeletePolicy(ctx context.Context, in *DeletePolicy
 // All implementations must embed UnimplementedPolicyServiceServer
 // for forward compatibility.
 type PolicyServiceServer interface {
-	CreatePolicy(context.Context, *CreatePolicyRequest) (*PolicyRule, error)
+	CreatePolicy(context.Context, *CreatePolicyRequest) (*CreatePolicyResponse, error)
 	ListPolicies(context.Context, *ListPoliciesRequest) (*ListPoliciesResponse, error)
-	GetPolicy(context.Context, *GetPolicyRequest) (*PolicyRule, error)
+	GetPolicy(context.Context, *GetPolicyRequest) (*GetPolicyResponse, error)
 	DeletePolicy(context.Context, *DeletePolicyRequest) (*DeletePolicyResponse, error)
 	mustEmbedUnimplementedPolicyServiceServer()
 }
@@ -101,13 +101,13 @@ type PolicyServiceServer interface {
 // pointer dereference when methods are called.
 type UnimplementedPolicyServiceServer struct{}
 
-func (UnimplementedPolicyServiceServer) CreatePolicy(context.Context, *CreatePolicyRequest) (*PolicyRule, error) {
+func (UnimplementedPolicyServiceServer) CreatePolicy(context.Context, *CreatePolicyRequest) (*CreatePolicyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method CreatePolicy not implemented")
 }
 func (UnimplementedPolicyServiceServer) ListPolicies(context.Context, *ListPoliciesRequest) (*ListPoliciesResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ListPolicies not implemented")
 }
-func (UnimplementedPolicyServiceServer) GetPolicy(context.Context, *GetPolicyRequest) (*PolicyRule, error) {
+func (UnimplementedPolicyServiceServer) GetPolicy(context.Context, *GetPolicyRequest) (*GetPolicyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetPolicy not implemented")
 }
 func (UnimplementedPolicyServiceServer) DeletePolicy(context.Context, *DeletePolicyRequest) (*DeletePolicyResponse, error) {
@@ -231,5 +231,5 @@ var PolicyService_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/policy.proto",
+	Metadata: "proto/metacrypt/v1/policy.proto",
 }
diff --git a/gen/metacrypt/v1/system.pb.go b/gen/metacrypt/v1/system.pb.go
index fee8366..85a66c6 100644
--- a/gen/metacrypt/v1/system.pb.go
+++ b/gen/metacrypt/v1/system.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.36.11
 // 	protoc        v3.20.3
-// source: metacrypt/v1/system.proto
+// source: proto/metacrypt/v1/system.proto
 
 package metacryptv1
 
@@ -29,7 +29,7 @@ type StatusRequest struct {
 
 func (x *StatusRequest) Reset() {
 	*x = StatusRequest{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -41,7 +41,7 @@ func (x *StatusRequest) String() string {
 func (*StatusRequest) ProtoMessage() {}
 
 func (x *StatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[0]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -54,7 +54,7 @@ func (x *StatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatusRequest.ProtoReflect.Descriptor instead.
 func (*StatusRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{0}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{0}
 }
 
 type StatusResponse struct {
@@ -66,7 +66,7 @@ type StatusResponse struct {
 
 func (x *StatusResponse) Reset() {
 	*x = StatusResponse{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -78,7 +78,7 @@ func (x *StatusResponse) String() string {
 func (*StatusResponse) ProtoMessage() {}
 
 func (x *StatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[1]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -91,7 +91,7 @@ func (x *StatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatusResponse.ProtoReflect.Descriptor instead.
 func (*StatusResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{1}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *StatusResponse) GetState() string {
@@ -110,7 +110,7 @@ type InitRequest struct {
 
 func (x *InitRequest) Reset() {
 	*x = InitRequest{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -122,7 +122,7 @@ func (x *InitRequest) String() string {
 func (*InitRequest) ProtoMessage() {}
 
 func (x *InitRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[2]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -135,7 +135,7 @@ func (x *InitRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitRequest.ProtoReflect.Descriptor instead.
 func (*InitRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{2}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *InitRequest) GetPassword() string {
@@ -154,7 +154,7 @@ type InitResponse struct {
 
 func (x *InitResponse) Reset() {
 	*x = InitResponse{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -166,7 +166,7 @@ func (x *InitResponse) String() string {
 func (*InitResponse) ProtoMessage() {}
 
 func (x *InitResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[3]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -179,7 +179,7 @@ func (x *InitResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitResponse.ProtoReflect.Descriptor instead.
 func (*InitResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{3}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *InitResponse) GetState() string {
@@ -198,7 +198,7 @@ type UnsealRequest struct {
 
 func (x *UnsealRequest) Reset() {
 	*x = UnsealRequest{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -210,7 +210,7 @@ func (x *UnsealRequest) String() string {
 func (*UnsealRequest) ProtoMessage() {}
 
 func (x *UnsealRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[4]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -223,7 +223,7 @@ func (x *UnsealRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnsealRequest.ProtoReflect.Descriptor instead.
 func (*UnsealRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{4}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *UnsealRequest) GetPassword() string {
@@ -242,7 +242,7 @@ type UnsealResponse struct {
 
 func (x *UnsealResponse) Reset() {
 	*x = UnsealResponse{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -254,7 +254,7 @@ func (x *UnsealResponse) String() string {
 func (*UnsealResponse) ProtoMessage() {}
 
 func (x *UnsealResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[5]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -267,7 +267,7 @@ func (x *UnsealResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnsealResponse.ProtoReflect.Descriptor instead.
 func (*UnsealResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{5}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *UnsealResponse) GetState() string {
@@ -285,7 +285,7 @@ type SealRequest struct {
 
 func (x *SealRequest) Reset() {
 	*x = SealRequest{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -297,7 +297,7 @@ func (x *SealRequest) String() string {
 func (*SealRequest) ProtoMessage() {}
 
 func (x *SealRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[6]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -310,7 +310,7 @@ func (x *SealRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SealRequest.ProtoReflect.Descriptor instead.
 func (*SealRequest) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{6}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{6}
 }
 
 type SealResponse struct {
@@ -322,7 +322,7 @@ type SealResponse struct {
 
 func (x *SealResponse) Reset() {
 	*x = SealResponse{}
-	mi := &file_metacrypt_v1_system_proto_msgTypes[7]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -334,7 +334,7 @@ func (x *SealResponse) String() string {
 func (*SealResponse) ProtoMessage() {}
 
 func (x *SealResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metacrypt_v1_system_proto_msgTypes[7]
+	mi := &file_proto_metacrypt_v1_system_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -347,7 +347,7 @@ func (x *SealResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SealResponse.ProtoReflect.Descriptor instead.
 func (*SealResponse) Descriptor() ([]byte, []int) {
-	return file_metacrypt_v1_system_proto_rawDescGZIP(), []int{7}
+	return file_proto_metacrypt_v1_system_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *SealResponse) GetState() string {
@@ -357,11 +357,11 @@ func (x *SealResponse) GetState() string {
 	return ""
 }
 
-var File_metacrypt_v1_system_proto protoreflect.FileDescriptor
+var File_proto_metacrypt_v1_system_proto protoreflect.FileDescriptor
 
-const file_metacrypt_v1_system_proto_rawDesc = "" +
+const file_proto_metacrypt_v1_system_proto_rawDesc = "" +
 	"\n" +
-	"\x19metacrypt/v1/system.proto\x12\fmetacrypt.v1\"\x0f\n" +
+	"\x1fproto/metacrypt/v1/system.proto\x12\fmetacrypt.v1\"\x0f\n" +
 	"\rStatusRequest\"&\n" +
 	"\x0eStatusResponse\x12\x14\n" +
 	"\x05state\x18\x01 \x01(\tR\x05state\")\n" +
@@ -383,19 +383,19 @@ const file_metacrypt_v1_system_proto_rawDesc = "" +
 	"\x04Seal\x12\x19.metacrypt.v1.SealRequest\x1a\x1a.metacrypt.v1.SealResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
 
 var (
-	file_metacrypt_v1_system_proto_rawDescOnce sync.Once
-	file_metacrypt_v1_system_proto_rawDescData []byte
+	file_proto_metacrypt_v1_system_proto_rawDescOnce sync.Once
+	file_proto_metacrypt_v1_system_proto_rawDescData []byte
 )
 
-func file_metacrypt_v1_system_proto_rawDescGZIP() []byte {
-	file_metacrypt_v1_system_proto_rawDescOnce.Do(func() {
-		file_metacrypt_v1_system_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metacrypt_v1_system_proto_rawDesc), len(file_metacrypt_v1_system_proto_rawDesc)))
+func file_proto_metacrypt_v1_system_proto_rawDescGZIP() []byte {
+	file_proto_metacrypt_v1_system_proto_rawDescOnce.Do(func() {
+		file_proto_metacrypt_v1_system_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_system_proto_rawDesc), len(file_proto_metacrypt_v1_system_proto_rawDesc)))
 	})
-	return file_metacrypt_v1_system_proto_rawDescData
+	return file_proto_metacrypt_v1_system_proto_rawDescData
 }
 
-var file_metacrypt_v1_system_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_metacrypt_v1_system_proto_goTypes = []any{
+var file_proto_metacrypt_v1_system_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_proto_metacrypt_v1_system_proto_goTypes = []any{
 	(*StatusRequest)(nil),  // 0: metacrypt.v1.StatusRequest
 	(*StatusResponse)(nil), // 1: metacrypt.v1.StatusResponse
 	(*InitRequest)(nil),    // 2: metacrypt.v1.InitRequest
@@ -405,7 +405,7 @@ var file_metacrypt_v1_system_proto_goTypes = []any{
 	(*SealRequest)(nil),    // 6: metacrypt.v1.SealRequest
 	(*SealResponse)(nil),   // 7: metacrypt.v1.SealResponse
 }
-var file_metacrypt_v1_system_proto_depIdxs = []int32{
+var file_proto_metacrypt_v1_system_proto_depIdxs = []int32{
 	0, // 0: metacrypt.v1.SystemService.Status:input_type -> metacrypt.v1.StatusRequest
 	2, // 1: metacrypt.v1.SystemService.Init:input_type -> metacrypt.v1.InitRequest
 	4, // 2: metacrypt.v1.SystemService.Unseal:input_type -> metacrypt.v1.UnsealRequest
@@ -421,26 +421,26 @@ var file_metacrypt_v1_system_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for field type_name
 }
 
-func init() { file_metacrypt_v1_system_proto_init() }
-func file_metacrypt_v1_system_proto_init() {
-	if File_metacrypt_v1_system_proto != nil {
+func init() { file_proto_metacrypt_v1_system_proto_init() }
+func file_proto_metacrypt_v1_system_proto_init() {
+	if File_proto_metacrypt_v1_system_proto != nil {
 		return
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metacrypt_v1_system_proto_rawDesc), len(file_metacrypt_v1_system_proto_rawDesc)),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_system_proto_rawDesc), len(file_proto_metacrypt_v1_system_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_metacrypt_v1_system_proto_goTypes,
-		DependencyIndexes: file_metacrypt_v1_system_proto_depIdxs,
-		MessageInfos:      file_metacrypt_v1_system_proto_msgTypes,
+		GoTypes:           file_proto_metacrypt_v1_system_proto_goTypes,
+		DependencyIndexes: file_proto_metacrypt_v1_system_proto_depIdxs,
+		MessageInfos:      file_proto_metacrypt_v1_system_proto_msgTypes,
 	}.Build()
-	File_metacrypt_v1_system_proto = out.File
-	file_metacrypt_v1_system_proto_goTypes = nil
-	file_metacrypt_v1_system_proto_depIdxs = nil
+	File_proto_metacrypt_v1_system_proto = out.File
+	file_proto_metacrypt_v1_system_proto_goTypes = nil
+	file_proto_metacrypt_v1_system_proto_depIdxs = nil
 }
diff --git a/gen/metacrypt/v1/system_grpc.pb.go b/gen/metacrypt/v1/system_grpc.pb.go
index a9c8f3a..7c61b2b 100644
--- a/gen/metacrypt/v1/system_grpc.pb.go
+++ b/gen/metacrypt/v1/system_grpc.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.6.1
 // - protoc             v3.20.3
-// source: metacrypt/v1/system.proto
+// source: proto/metacrypt/v1/system.proto
 
 package metacryptv1
 
@@ -231,5 +231,5 @@ var SystemService_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "metacrypt/v1/system.proto",
+	Metadata: "proto/metacrypt/v1/system.proto",
 }
diff --git a/internal/grpcserver/acme.go b/internal/grpcserver/acme.go
index cc467e8..4d88da2 100644
--- a/internal/grpcserver/acme.go
+++ b/internal/grpcserver/acme.go
@@ -31,7 +31,7 @@ func (as *acmeServer) CreateEAB(ctx context.Context, req *pb.CreateEABRequest) (
 	return &pb.CreateEABResponse{Kid: cred.KID, HmacKey: cred.HMACKey}, nil
 }
 
-func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetACMEConfigRequest) (*pb.SetACMEConfigResponse, error) {
+func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetConfigRequest) (*pb.SetConfigResponse, error) {
 	if req.DefaultIssuer == "" {
 		return nil, status.Error(codes.InvalidArgument, "default_issuer is required")
 	}
@@ -46,10 +46,10 @@ func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetACMEConfigReques
 		as.s.logger.Error("grpc: acme set config", "error", err)
 		return nil, status.Error(codes.Internal, "failed to save config")
 	}
-	return &pb.SetACMEConfigResponse{Ok: true}, nil
+	return &pb.SetConfigResponse{Ok: true}, nil
 }
 
-func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListACMEAccountsRequest) (*pb.ListACMEAccountsResponse, error) {
+func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListAccountsRequest) (*pb.ListAccountsResponse, error) {
 	h, err := as.getOrCreateHandler(req.Mount)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "mount not found")
@@ -71,10 +71,10 @@ func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListACMEAccounts
 			CreatedAt:     a.CreatedAt.String(),
 		})
 	}
-	return &pb.ListACMEAccountsResponse{Accounts: pbAccounts}, nil
+	return &pb.ListAccountsResponse{Accounts: pbAccounts}, nil
 }
 
-func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListACMEOrdersRequest) (*pb.ListACMEOrdersResponse, error) {
+func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListOrdersRequest) (*pb.ListOrdersResponse, error) {
 	h, err := as.getOrCreateHandler(req.Mount)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "mount not found")
@@ -99,7 +99,7 @@ func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListACMEOrdersRequ
 			ExpiresAt:   o.ExpiresAt.String(),
 		})
 	}
-	return &pb.ListACMEOrdersResponse{Orders: pbOrders}, nil
+	return &pb.ListOrdersResponse{Orders: pbOrders}, nil
 }
 
 func (as *acmeServer) getOrCreateHandler(mountName string) (*internacme.Handler, error) {
diff --git a/internal/grpcserver/engine.go b/internal/grpcserver/engine.go
index 20f5153..f98c999 100644
--- a/internal/grpcserver/engine.go
+++ b/internal/grpcserver/engine.go
@@ -68,7 +68,7 @@ func (es *engineServer) ListMounts(_ context.Context, _ *pb.ListMountsRequest) (
 	return &pb.ListMountsResponse{Mounts: pbMounts}, nil
 }
 
-func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb.EngineResponse, error) {
+func (es *engineServer) Execute(ctx context.Context, req *pb.ExecuteRequest) (*pb.ExecuteResponse, error) {
 	if req.Mount == "" || req.Operation == "" {
 		return nil, status.Error(codes.InvalidArgument, "mount and operation are required")
 	}
@@ -108,5 +108,5 @@ func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb
 	if err != nil {
 		return nil, status.Error(codes.Internal, "failed to encode response")
 	}
-	return &pb.EngineResponse{Data: pbData}, nil
+	return &pb.ExecuteResponse{Data: pbData}, nil
 }
diff --git a/internal/grpcserver/policy.go b/internal/grpcserver/policy.go
index 6b0b75a..94437cf 100644
--- a/internal/grpcserver/policy.go
+++ b/internal/grpcserver/policy.go
@@ -15,7 +15,7 @@ type policyServer struct {
 	s *GRPCServer
 }
 
-func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRequest) (*pb.PolicyRule, error) {
+func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRequest) (*pb.CreatePolicyResponse, error) {
 	if req.Rule == nil || req.Rule.Id == "" {
 		return nil, status.Error(codes.InvalidArgument, "rule.id is required")
 	}
@@ -24,7 +24,7 @@ func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRe
 		ps.s.logger.Error("grpc: create policy", "error", err)
 		return nil, status.Error(codes.Internal, "internal error")
 	}
-	return ruleToPB(rule), nil
+	return &pb.CreatePolicyResponse{Rule: ruleToPB(rule)}, nil
 }
 
 func (ps *policyServer) ListPolicies(ctx context.Context, _ *pb.ListPoliciesRequest) (*pb.ListPoliciesResponse, error) {
@@ -40,7 +40,7 @@ func (ps *policyServer) ListPolicies(ctx context.Context, _ *pb.ListPoliciesRequ
 	return &pb.ListPoliciesResponse{Rules: pbRules}, nil
 }
 
-func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest) (*pb.PolicyRule, error) {
+func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest) (*pb.GetPolicyResponse, error) {
 	if req.Id == "" {
 		return nil, status.Error(codes.InvalidArgument, "id is required")
 	}
@@ -48,7 +48,7 @@ func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "not found")
 	}
-	return ruleToPB(rule), nil
+	return &pb.GetPolicyResponse{Rule: ruleToPB(rule)}, nil
 }
 
 func (ps *policyServer) DeletePolicy(ctx context.Context, req *pb.DeletePolicyRequest) (*pb.DeletePolicyResponse, error) {
diff --git a/internal/webserver/client.go b/internal/webserver/client.go
index b9fe574..8bb5f78 100644
--- a/internal/webserver/client.go
+++ b/internal/webserver/client.go
@@ -159,7 +159,7 @@ func (c *VaultClient) Mount(ctx context.Context, token, name, engineType string,
 
 // EngineRequest sends a generic engine operation to the vault.
 func (c *VaultClient) EngineRequest(ctx context.Context, token, mount, operation string, data map[string]interface{}) (map[string]interface{}, error) {
-	req := &pb.EngineRequest{
+	req := &pb.ExecuteRequest{
 		Mount:     mount,
 		Operation: operation,
 	}
@@ -170,7 +170,7 @@ func (c *VaultClient) EngineRequest(ctx context.Context, token, mount, operation
 		}
 		req.Data = s
 	}
-	resp, err := c.engine.Request(withToken(ctx, token), req)
+	resp, err := c.engine.Execute(withToken(ctx, token), req)
 	if err != nil {
 		return nil, err
 	}
diff --git a/proto/metacrypt/v1/acme.proto b/proto/metacrypt/v1/acme.proto
index 94f2aee..092badf 100644
--- a/proto/metacrypt/v1/acme.proto
+++ b/proto/metacrypt/v1/acme.proto
@@ -16,13 +16,13 @@ service ACMEService {
 
   // SetConfig sets the ACME configuration for a CA mount.
   // Currently configures the default issuer used for ACME certificate issuance.
-  rpc SetConfig(SetACMEConfigRequest) returns (SetACMEConfigResponse);
+  rpc SetConfig(SetConfigRequest) returns (SetConfigResponse);
 
   // ListAccounts returns all ACME accounts for a CA mount. Admin only.
-  rpc ListAccounts(ListACMEAccountsRequest) returns (ListACMEAccountsResponse);
+  rpc ListAccounts(ListAccountsRequest) returns (ListAccountsResponse);
 
   // ListOrders returns all ACME orders for a CA mount. Admin only.
-  rpc ListOrders(ListACMEOrdersRequest) returns (ListACMEOrdersResponse);
+  rpc ListOrders(ListOrdersRequest) returns (ListOrdersResponse);
 }
 
 message CreateEABRequest {
@@ -37,22 +37,22 @@ message CreateEABResponse {
   bytes hmac_key = 2;
 }
 
-message SetACMEConfigRequest {
+message SetConfigRequest {
   string mount = 1;
   // default_issuer is the name of the CA issuer to use for ACME certificates.
   // The issuer must already exist on the CA mount.
   string default_issuer = 2;
 }
 
-message SetACMEConfigResponse {
+message SetConfigResponse {
   bool ok = 1;
 }
 
-message ListACMEAccountsRequest {
+message ListAccountsRequest {
   string mount = 1;
 }
 
-message ListACMEAccountsResponse {
+message ListAccountsResponse {
   repeated ACMEAccount accounts = 1;
 }
 
@@ -64,11 +64,11 @@ message ACMEAccount {
   string created_at = 5;
 }
 
-message ListACMEOrdersRequest {
+message ListOrdersRequest {
   string mount = 1;
 }
 
-message ListACMEOrdersResponse {
+message ListOrdersResponse {
   repeated ACMEOrder orders = 1;
 }
 
diff --git a/proto/metacrypt/v1/engine.proto b/proto/metacrypt/v1/engine.proto
index a8c4e4c..aa05ef5 100644
--- a/proto/metacrypt/v1/engine.proto
+++ b/proto/metacrypt/v1/engine.proto
@@ -10,7 +10,7 @@ service EngineService {
   rpc Mount(MountRequest) returns (MountResponse);
   rpc Unmount(UnmountRequest) returns (UnmountResponse);
   rpc ListMounts(ListMountsRequest) returns (ListMountsResponse);
-  rpc Request(EngineRequest) returns (EngineResponse);
+  rpc Execute(ExecuteRequest) returns (ExecuteResponse);
 }
 
 message MountRequest {
@@ -36,13 +36,13 @@ message MountInfo {
   string mount_path = 3;
 }
 
-message EngineRequest {
+message ExecuteRequest {
   string mount = 1;
   string operation = 2;
   string path = 3;
   google.protobuf.Struct data = 4;
 }
 
-message EngineResponse {
+message ExecuteResponse {
   google.protobuf.Struct data = 1;
 }
diff --git a/proto/metacrypt/v1/policy.proto b/proto/metacrypt/v1/policy.proto
index b4deebd..64b3c4f 100644
--- a/proto/metacrypt/v1/policy.proto
+++ b/proto/metacrypt/v1/policy.proto
@@ -5,9 +5,9 @@ package metacrypt.v1;
 option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
 
 service PolicyService {
-  rpc CreatePolicy(CreatePolicyRequest) returns (PolicyRule);
+  rpc CreatePolicy(CreatePolicyRequest) returns (CreatePolicyResponse);
   rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse);
-  rpc GetPolicy(GetPolicyRequest) returns (PolicyRule);
+  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
   rpc DeletePolicy(DeletePolicyRequest) returns (DeletePolicyResponse);
 }
 
@@ -25,6 +25,14 @@ message CreatePolicyRequest {
   PolicyRule rule = 1;
 }
 
+message CreatePolicyResponse {
+  PolicyRule rule = 1;
+}
+
+message GetPolicyResponse {
+  PolicyRule rule = 1;
+}
+
 message ListPoliciesRequest {}
 message ListPoliciesResponse {
   repeated PolicyRule rules = 1;