diff --git a/Makefile b/Makefile
index 41fa053..ab23e41 100644
--- a/Makefile
+++ b/Makefile
@@ -1,49 +1,3 @@
-#########################
-# Environment Variables #
-#########################
-
-# Source configuration file
-#
-include config.env
-
-
-# Set branch defaults
-#
-ifeq ($(BUILD_MODE), dev)
-	BRANCH_DEFAULT = dev
-else ifeq ($(BUILD_MODE), master)
-	BRANCH_DEFAULT = master
-else
-	BRANCH_DEFAULT = $(RELEASE_VERSION)
-endif
-
-
-# Append Docker run commands for non-production modes
-#
-ifneq ($(BUILD_MODE), prod)
-	DOCKER_AUTH_PRODUCTION += $(DOCKER_AUTH_DEV_APPEND)
-	DOCKER_DCLAPI_PRODUCTION += $(DOCKER_DCLAPI_DEV_APPEND)
-	DOCKER_ENDPOINT_PRODUCTION += $(DOCKER_ENDPOINT_DEV_APPEND)
-	DOCKER_HAPI_PRODUCTION += $(DOCKER_HAPI_DEV_APPEND)
-	DOCKER_HUB_PRODUCTION += $(DOCKER_HUB_DEV_APPEND)
-	DOCKER_HUBDB_PRODUCTION += $(DOCKER_HUBDB_DEV_APPEND)
-	DOCKER_QI_PRODUCTION += $(DOCKER_QI_DEV_APPEND)
-	DOCKER_VIZ_PRODUCTION += $(DOCKER_VIZ_DEV_APPEND)
-endif
-
-
-# Use branch defaults where overrides are not provided
-#
-BRANCH_AUTH ?= $(BRANCH_DEFAULT)
-BRANCH_DCLAPI ?= $(BRANCH_DEFAULT)
-BRANCH_ENDPOINT ?= $(BRANCH_DEFAULT)
-BRANCH_HAPI ?= $(BRANCH_DEFAULT)
-BRANCH_HUB ?= $(BRANCH_DEFAULT)
-BRANCH_HUBDB ?= $(BRANCH_DEFAULT)
-BRANCH_QI ?= $(BRANCH_DEFAULT)
-BRANCH_VIZ ?= $(BRANCH_DEFAULT)
-
-
 ################
 # General Jobs #
 ################
@@ -54,7 +8,7 @@ configure: config-packages config-mongodb config-bash config-img-pull
 
 clone: clone-auth clone-dclapi clone-hubdb clone-hub clone-hapi clone-viz clone-queries clone-endpoint
 
-containers: clone hubdb hub auth ep-sample dclapi hapi viz mode-inform
+containers: clone hubdb hub auth dclapi hapi viz queries ep-sample mode-inform
 
 clone-update: say-goodbye clone-remove clone
 
@@ -102,11 +56,6 @@ hubdb:
 hub:
 	@	sudo mkdir -p $(PATH_HUB_SSH_HOST) $(PATH_HUB_SSH_AUTOSSH)
 	@	$(call dockerize,hub,$(DOCKER_HUB_PRODUCTION))
-	@	if [ $(BUILD_MODE) != prod ]; \
-		then \
-			$(MAKE) ep-sample; \
-			$(MAKE) queries; \
-		fi
 
 
 auth:
@@ -116,8 +65,6 @@ auth:
 
 dclapi:
 	@	sudo mkdir -p $(PATH_DRUGREF)
-	@	sudo test -s $(PATH_DRUGREF)/dcl.sqlite || \
-		sudo cp build/dclapi/drugref/dcl.sqlite $(PATH_DRUGREF)
 	@	$(call dockerize,dclapi,$(DOCKER_DCLAPI_PRODUCTION))
 
 
@@ -127,16 +74,11 @@ hapi:
 
 viz:
 	@	sudo mkdir -p $(PATH_CERT)
-	@	[ -f ./cert/server.crt -a ! -f $(PATH_CERT)/server.crt ]&& \
-			sudo cp ./cert/server.crt $(PATH_CERT) || \
-			true
-	@	[ -f ./cert/server.key -a ! -f $(PATH_CERT)/server.crt ]|| \
-			sudo cp ./cert/server.key $(PATH_CERT) || \
-			true
 	@	$(call dockerize,viz,$(DOCKER_VIZ_PRODUCTION))
 
 
 ep-sample:
+	@	sudo mkdir -p $(PATH_EPX_AUTOSSH)
 	@	$(call dockerize,endpoint,$(DOCKER_ENDPOINT_PRODUCTION),0)
 	@	$(call config_ep,0,cpsid,cpsid,admin,TEST,sample)
 
@@ -157,6 +99,7 @@ containers-remove:
 ################################
 
 ep:
+	@	sudo mkdir -p $(PATH_EPX_AUTOSSH)
 	@	if [ -z "$(gID)" ] || [ -z "$(DOCTOR)" ]; \
 		then \
 			echo; \
@@ -184,19 +127,12 @@ ep-rm:
 
 
 ep-cloud:
-	@	sudo mkdir -p $(PATH_HUB_SSH_AUTOSSH)
-	@	if [ ! -e $(PATH_HUB_SSH_AUTOSSH) ]; \
-		then \
-			sudo cp id_rsa.pub id_rsa known_hosts $(PATH_HUB_SSH_AUTOSSH); \
-			sudo chown root $(PATH_HUB_SSH_AUTOSSH)/*; \
-			fi
 	@	echo
-	@	echo "Please enter a gatewayID (####) to run: "; \
-		read gID; \
+	@	echo "Please enter a gatewayID (####) to run: "
+	@	read gID; \
 		NAME=pdc-$${gID}; \
 		PORT=`expr 40000 + $${gID}`; \
-		sudo docker run -dt --name $${NAME} -h $${NAME} -e gID=$${gID} --env-file=config.env --restart='always' -p $${PORT}:3001 -v $(PATH_HUB_SSH_AUTOSSH):/root/.ssh/:ro pdc.io/endpoint; \
-		sudo docker exec $${NAME} /app/key_exchange.sh
+		sudo docker run -dt --name $${NAME} -h $${NAME} -e gID=$${gID} --env-file=config.env --restart='always' -p $${PORT}:3001 -v $(PATH_EPX_AUTOSSH):/root/.ssh/:ro pdc.io/endpoint; \
 
 
 ep-cloud-rm:
@@ -224,7 +160,7 @@ cadvisor:
 say-goodbye:
 	@	echo
 	@	echo "DESTROY WARNING: Backup any changes before continuing!"
-	@	echo
+	@	sudo -k echo
 	@	echo "Please type 'goodbye' to confirm"
 	@	read CONFIRM; \
 		[ "$${CONFIRM}" = "goodbye" ] || ( echo "Not confirmed"; exit )
@@ -291,11 +227,12 @@ clone-remove:
 
 config-packages:
 	@	sudo apt-get update
-	@	( which docker )||( \
-			sudo apt-get install -y linux-image-extra-$$(uname -r); \
-			sudo modprobe aufs; \
-			wget -qO- https://get.docker.com/ | sh; \
-		 )
+	@	( which docker )|| \
+			( \
+				sudo apt-get install -y linux-image-extra-$$(uname -r); \
+				sudo modprobe aufs; \
+				wget -qO- https://get.docker.com/ | sh; \
+			)
 
 
 config-mongodb:
@@ -385,7 +322,7 @@ config-oc:
 				echo 'PASSWORD=$\${OWNCLOUD_PW}'; \
 				echo 'OWNCLOUD=$\${OWNCLOUD_URL}'; \
 				echo '#'; \
-				echo 'OC_PATH=$${OWNCLOUD}/remote.php/webdav'; \
+				echo 'OC_PATH=$${OWNCLOUD}/owncloud/remote.php/webdav/stack'; \
 				echo '#'; \
 				echo 'for DIR in \\'; \
 				echo '	cert \\'; \
@@ -403,10 +340,6 @@ config-oc:
 		fi
 
 
-		PATH_EPX_SSH_AUTOSSH=${PATH_HOST}/epx/cloud_shared
-
-
-
 	@	# Add script to cron
 	@	#
 	@	if((! sudo test -e /var/spool/cron/crontabs/root )||(! sudo grep --quiet 'oc_backup.sh' /var/spool/cron/crontabs/root )); \
@@ -536,3 +469,51 @@ define mode_change
 		$(MAKE) clone-update; \
 	fi
 endef
+
+
+#########################
+# Environment Variables #
+#########################
+
+# Source configuration file
+#
+include config.env
+
+
+# Set branch defaults
+#
+ifeq ($(BUILD_MODE), dev)
+	BRANCH_DEFAULT = dev
+else ifeq ($(BUILD_MODE), master)
+	BRANCH_DEFAULT = master
+else
+	BRANCH_DEFAULT = $(RELEASE_VERSION)
+endif
+
+
+# Append Docker run commands for non-production modes
+#
+ifneq ($(BUILD_MODE), prod)
+	DOCKER_AUTH_PRODUCTION += $(DOCKER_AUTH_DEV_APPEND)
+	DOCKER_DCLAPI_PRODUCTION += $(DOCKER_DCLAPI_DEV_APPEND)
+	DOCKER_ENDPOINT_PRODUCTION += $(DOCKER_ENDPOINT_DEV_APPEND)
+	DOCKER_EPXCLOUD_PRODUCTION += $(DOCKER_ENDPOINT_DEV_APPEND)
+	DOCKER_HAPI_PRODUCTION += $(DOCKER_HAPI_DEV_APPEND)
+	DOCKER_HUB_PRODUCTION += $(DOCKER_HUB_DEV_APPEND)
+	DOCKER_HUBDB_PRODUCTION += $(DOCKER_HUBDB_DEV_APPEND)
+	DOCKER_QI_PRODUCTION += $(DOCKER_QI_DEV_APPEND)
+	DOCKER_VIZ_PRODUCTION += $(DOCKER_VIZ_DEV_APPEND)
+endif
+
+
+# Use branch defaults where overrides are not provided
+#
+BRANCH_AUTH ?= $(BRANCH_DEFAULT)
+BRANCH_DCLAPI ?= $(BRANCH_DEFAULT)
+BRANCH_ENDPOINT ?= $(BRANCH_DEFAULT)
+BRANCH_EPXCLOUD ?= $(BRANCH_DEFAULT)
+BRANCH_HAPI ?= $(BRANCH_DEFAULT)
+BRANCH_HUB ?= $(BRANCH_DEFAULT)
+BRANCH_HUBDB ?= $(BRANCH_DEFAULT)
+BRANCH_QI ?= $(BRANCH_DEFAULT)
+BRANCH_VIZ ?= $(BRANCH_DEFAULT)
diff --git a/README.md b/README.md
index 4ae524a..70493cc 100644
--- a/README.md
+++ b/README.md
@@ -243,3 +243,307 @@ sudo rm -rf /var/lib/docker/devicemapper/mnt/05aea00a321b91d34b2c81a2c4b524fd2ed
 ```
 
 If you have errors removing this folder, particularly an input/output error, try restarting the virtual machine.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+# API
+
+The hubapi component acts as a data access and processing layer around the mongodb. It has the following routes of interest:
+
+
+- `GET /retro/:title`
+    + This route will return a JSON object that contains data for the query identified by `:title`.
+    + This route is used for *ratio* type queries.
+    + It will return data that is almost identical to the `/api/processed_result` route, the only difference being that it look for many executions over time instead of just the most recent.
+    + This route requires that cookie be passed via the query string of the URL
+        *  it must be accessible via: `request.query.cookie`
+    + During normal execution, the route will return a JSON string/object of the following structure:
+
+    ```JavaScript
+    {
+        "processed_result" : {
+            "clinician" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+            "group" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+            "network" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+        },
+        "provider_id" : STRING,
+        "network_id" : STRING,
+        "title" : STRING,
+        "description" : STRING
+    }
+    ```
+    + The status codes are as follows, in the event of an error code (status > 399) or no content (status == 204) the data object will be `null` or an empty object `{}` :
+        * `200` - Processing completed successfully, the resulting data will be in the returned object.
+        * `204` - The request was correctly processed, but no executions for this query exist!
+        * `400` - Request for data was not well formed, i.e. there was not `request.body.bakedCookie` field
+        * `404` - The query requested does not exist
+        * `401` - Request failed due to invalid credential
+        * `500` - Request failed due to unknown server error.
+
+- `GET /api/processed_result/:title`
+    + Returns data for the query identified by the `:title` input
+    + This route is used for *ratio* type queries.
+    + This route requires that cookie be passed via the query string of the URL
+        *  it must be accessible via: `request.query.cookie`
+    + During normal execution, the route will return a JSON string/object of the following structure:
+
+    ```JavaScript
+    {
+        "processed_result" : {
+            "clinician" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+            "group" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+            "network" : [
+                { "aggregate_result" : { "numerator" : INT , "denominator" : INT }, "time": TIMESTAMP, "display_name" : STRING },
+                ...
+            ],
+        },
+        "provider_id" : STRING,
+        "network_id" : STRING,
+        "title" : STRING,
+        "description" : STRING
+    }
+    ```
+    + The status codes are as follows, in the event of an error code (status > 399) or no content (status == 204) the data object will be `null` or an empty object `{}` :
+        * `200` - Processing completed successfully, the resulting data will be in the returned object.
+        * `204` - The request was correctly processed, but no executions for this query exist!
+        * `400` - Request for data was not well formed, i.e. there was not `request.body.bakedCookie` field
+        * `404` - The query requested does not exist
+        * `401` - Request failed due to invalid credential
+        * `500` - Request failed due to unknown server error.
+
+- `GET /demographics`
+    + Returns data for the demographics query.
+    + This route requires that cookie be passed via the query string of the URL
+        *  it must be accessible via: `request.query.cookie`
+    + During normal execution, the route will return a JSON string/object of the following structure:
+    + Returns data for **single** (most recent) execution. For all executions see `/retro/demographics` route.
+
+    ```JavaScript
+    {
+        "clinician" : [ { "gender" : { "age-range" : NUMBER, ... }, ... } ],
+        "group" : [ { "gender" : { "age-range" : NUMBER, ... }, ... } ],
+        "network" : [ { "gender" : { "age-range" : NUMBER, ... }, ... } ],
+        "provider_id" : STRING
+    }
+    ```
+    + The status codes are as follows, in the event of an error code (status > 399) or no content (status == 204) the data object will be `null` or an empty object `{}` :
+        * `200` - Processing completed successfully, the resulting data will be in the returned object.
+        * `204` - The request was correctly processed, but no executions for this query exist!
+        * `400` - Request for data was not well formed, i.e. there was not `request.body.bakedCookie` field
+        * `404` - The query requested does not exist
+        * `401` - Request failed due to invalid credential
+        * `500` - Request failed due to unknown server error.
+
+- `GET /api/queries`
+    + Returns a list of all of the queries and their executions
+    + This route requires that cookie be provided that is accessible via the Node Express: `request.query.cookie` object.
+    + During normal operation, the route will return a JSON string of the following format:
+
+    ```JavaScript
+    {
+        "queries" : [
+            { "_id" : STRING, "title" : STRING, "user_id" : STRING, "description" : STRING, "executions" : [ ... ] },
+            ...
+        ]
+    }
+    ```
+    + This route should be used to determine which queries exist within the hub.
+    + The status codes are as follows, in the event of an error code (status > 399) or no content (status == 204) the data object will be null or an empty object {} :
+        * `200` - Completed successfully, the resulting data will be in the returned object.
+        * `204` - The request was executed correctly, but no queries were found.
+        * `400` - Request for data was not well formed, i.e. there was not `request.body.bakedCookie` field
+        * `404` - The query requested does not exist
+        * `401` - Request failed due to invalid credential
+        * `500` - Request failed due to unknown server error.
+
+- `GET /reports/`
+    + This route will return a list of reports that can requested. It is analogous to the `/api/queries` route but for reports instead of queries.  
+    + This report requires that a cookie be passed via the request GET query string, it must be accessible via Express' `request.query.cookie` object. The cookie must contain user information and will be used to authenticate the user.
+    + During normal (non-error) operation, the following object structure will be returned:
+
+    ```JavaScript
+    [
+        { "shortTitle" : STRING, "title" : STRING},
+        ...
+    ]
+    ```
+        * Where the `shortTitle` field is a name used to reference the report by HAPI. All subsequent requests to `/reports/title` should use the `shortTitle`. The `title` field of the returned object is a human readable string that can be presented in the user interface.  
+    + The status codes are as follows, in the event of an error code (status > 399) or no content (status == 204) the data object will be an empty array `[]`.
+        * `200` - Completed successfully, data will be as described above.
+        * `204` - Completed successfully, but no reports were found, data will be an empty array.
+        * `400` - Request for data was not well formed, i.e. there was not `request.body.bakedCookie` field
+        * `401` - Request failed due to invalid credentials
+        * `500` - Failed due to a server failure.
+
+- `GET /reports/:title`
+    + This route requires that the cookie be sent in the request query string.
+    + This route will return a CSV data in a buffer that can be consumed by a client.
+    + During normal operation (non-error), a `STRING` will be returned that is the report CSV string.
+    + Under normal operation (non-error), the route will return HTTP status code `200`, in other cases the following will be returned and the `STRING` will be `null`:  
+        * `204` - The request was successful, but no content was found.
+        * `400` - The request was poorly formatted, perhaps the cookie was not there.
+        * `401` - The request failed to authenticate via the auth component, i.e. the cookie was invalid
+        * `404` - Report does not exist.
+        * `500` - Server error occurred
+
+- `GET /medclass`
+    + This route will return a JSON object that shows the 10 most commonly prescribed medication classes for the user of interest.
+    + The route requires that user information be in a cookie sent via the GET query string.
+    + Under normal operation (non-error, status code 200) the route will return the following JSON string as a response:
+
+    ```JavaScript
+    {
+        provider_id : STRING
+        processed_result : {
+
+            display_names : {
+
+                clinician : STRING,
+                group : STRING,
+                network: STRING
+
+            },
+
+            drugs : [
+                {
+                    drug_name : STRING,
+                    agg_data : [
+                        { set: "clinician", numerator : NUMBER, denominator: NUMBER, time: TIMESTAMP },
+                        { set: "group", numerator : NUMBER, denominator: NUMBER, time: TIMESTAMP },
+                        { set: "network", numerator : NUMBER, denominator: NUMBER, time: TIMESTAMP }
+                    ]
+                },
+                ...
+            ]
+        }
+    }
+    ```
+
+    + If an error occurs the data returned by this route will be `null` and the status code will be one of:
+        * `204` - The request was successful, but no data or executions of this query were found.
+        * `400` - The request was poorly formatted, perhaps the cookie was not sent?
+        * `401` - The request failed to authenticate via the auth component, i.e. the cookie was invalid
+        * `404` - The requested query does not exist.
+        * `500` - Server error occurred.
+
+
+# Tests
+
+## Unit Tests
+
+Unit tests reside in the `test/` directory. They are using the [MochaJs](http://mochajs.org/) unit test framework. Code coverage is provided by [Blanket](https://github.com/alex-seville/blanket) The directory is structured to mirror the `lib/` directory, please keep it organized! To run tests use the following:
+
+`npm test` - this runs a suite of mocha tests and a code coverage by running `sh runtests.sh`.
+
+Alternatively, code coverage can be run independently of the regular mocha reporter: `npm run test-coverage` and tests can be run without coverage: `npm run test-no-coverage`.  
+
+Note: the coverage and normal coverage unit tests are coupled together in `npm test` because the mocha does not currently support multiple reporter types (html-cov AND command line) at the same time.  
+
+# Setup
+
+## Dependencies
+
+Before starting, you should ensure you have the following available on your machine:
+
+* An active MongoDB instance.
+* Node.js
+
+On Mac OS X or a RHEL/Fedora derivative you can install it like so:
+
+```bash
+cd $PROJECT_DIRECTORY
+./setup.sh
+```
+
+If you're on Windows, or feel like having a VM to work on, install [Vagrant](https://www.vagrantup.com/) try using our `Vagrantfile`:
+
+```bash
+cd $PROJECT_DIRECTORY
+vagrant up  # Start the VM.
+vagrant ssh # Shell into the VM.
+```
+
+## Starting
+
+```bash
+cd $PROJECT_DIRECTORY
+npm install # Install Dependencies into `.node_modules/`.
+npm start   # Start the application.
+```
+
+### Starting for Development
+
+During development it can desirable to set URLs of other components (MongoDB, Visualizer, Auth, DCLAPI etc...)
+to something other than default. Do this by setting environment variables for the process, for example:
+
+```bash
+MONGO_URI=mongodb://localhost:27019/query_composer_development AUTH_CONTROL=https://localhost:3006 DCLAPI_URI=http://localhost:3007 npm start
+```
+
+Note that the components at the URLs given must be running, if you are having issues consider the following:
+    - Are all the right ports open on the various machines?
+    - Are you on the right network?
+    - Is the host you are trying to connect to reachable?
+
+# Deploy
+
+There is a `Dockerfile` for use in deployment, however your mileage may vary.
+
+# Troubleshooting
+
+## Making certificates
+
+In order to not have to accept a new cert every time, bake your own. [Source](https://library.linode.com/security/ssl-certificates/self-signed).
+
+```bash
+mkdir ./cert
+openssl req -new -x509 -days 365 -nodes -out ./cert/server.crt -keyout ./cert/server.key
+chmod 600 ./cert/*
+```
diff --git a/cert/README.md b/cert/README.md
deleted file mode 100644
index 4f4ae8f..0000000
--- a/cert/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-SSL Certificates for the Visualizer
-=======
-
-If using SSL certificates copy the certificate and key here as server.crt and
-server.key.  Omitting them results in SSL warnings, but no loss of function.
-
diff --git a/config.env b/config.env
index 4081858..36250e3 100644
--- a/config.env
+++ b/config.env
@@ -6,7 +6,7 @@
 
 # Build Mode (dev, master or prod)
 #
-BUILD_MODE=dev
+BUILD_MODE=prod
 
 
 # Release
@@ -16,7 +16,7 @@ RELEASE_VERSION=0.1.1
 
 # Hub external IP/Address (10.0.2.2 for Vagrant/VirtualBox)
 #
-URL_HUB=10.0.2.2
+URL_HUB=hub.pdc.io
 
 
 # Notification addresses
@@ -27,8 +27,8 @@ EMAIL_ERRORS=errors@pdc.io
 # ownCloud backup details
 #
 OWNCLOUD_ID=hub.pdc.io
-OWNCLOUD_PW=<password>
-OWNCLOUD_URL=<https://...>
+OWNCLOUD_PW=
+OWNCLOUD_URL=
 
 
 # GitHub branch overrides
@@ -50,6 +50,7 @@ OWNCLOUD_URL=<https://...>
 
 # DACS
 #
+DACS_STOREDIR=/etc/dacs
 DACS_FEDERATION=pdc.dev
 DACS_JURISDICTION=TEST
 
@@ -117,9 +118,9 @@ URL_DCLAPI=http://dclapi:3007
 
 # Host data folders
 #
-PATH_HUB_SSH_HOST=${PATH_HOST}/hub/etc/ssh
-PATH_HUB_SSH_AUTOSSH=${PATH_HOST}/hub/home/autossh/DOTssh
-PATH_EPX_SSH_AUTOSSH=${PATH_HOST}/epx/cloud_shared
+PATH_HUB_AUTHKEYS=${PATH_HOST}/hub/etc/ssh
+PATH_HUB_AUTOSSH=${PATH_HOST}/hub/home/autossh/DOTssh
+PATH_EPX_AUTOSSH=${PATH_HOST}/epx/root/DOTssh/
 PATH_CERT=${PATH_HOST}/cert
 PATH_DACS=${PATH_HOST}/dacs
 PATH_MONGO=${PATH_HOST}/mongo
@@ -128,9 +129,8 @@ PATH_DRUGREF=${PATH_HOST}/drugref
 
 # DACS
 #
-DACS_KEYFILE=/etc/dacs/federations/pdc.dev/federation_keyfile
-DACS_ROLEFILE=/etc/dacs/federations/pdc.dev/roles
-DACS_STOREDIR=/etc/dacs
+DACS_KEYFILE=${DACS_STOREDIR}/federations/pdc.dev/federation_keyfile
+DACS_ROLEFILE=${DACS_STOREDIR}/federations/pdc.dev/roles
 
 
 # Containers
@@ -141,13 +141,16 @@ DOCKER_AUTH_DEV_APPEND=-p ${PORT_AUTH_M}:${PORT_AUTH_M} -p ${PORT_AUTH_C}:${PORT
 DOCKER_DCLAPI_PRODUCTION=-v ${PATH_DRUGREF}:/app/drugref/
 DOCKER_DCLAPI_DEV_APPEND=-p ${PORT_DACS}:${PORT_DACS}
 #
-DOCKER_ENDPOINT_PRODUCTION=
+DOCKER_ENDPOINT_PRODUCTION=-v $(PATH_EPX_AUTOSSH):/root/.ssh/:rw
 DOCKER_ENDPOINT_DEV_APPEND=
 #
+DOCKER_EPXCLOUD_PRODUCTION=-v $(PATH_EPX_AUTOSSH):/root/.ssh/:ro
+DOCKER_EPXCLOUD_DEV_APPEND=
+#
 DOCKER_HAPI_PRODUCTION=--link auth:auth --link hubdb:hubdb --link dclapi:dclapi
 DOCKER_HAPI_DEV_APPEND=-p ${PORT_HAPI}:${PORT_HAPI}
 #
-DOCKER_HUB_PRODUCTION=--link hubdb:hubdb -v ${PATH_HUB_SSH_AUTOSSH}:/home/autossh/.ssh/:rw -v ${PATH_HUB_SSH_HOST}:/etc/ssh/:rw -p ${PORT_AUTOSSH}:22 -p ${PORT_HUB_WEB}:3002
+DOCKER_HUB_PRODUCTION=--link hubdb:hubdb -v ${PATH_HUB_AUTOSSH}:/home/autossh/.ssh/:rw -v ${PATH_HUB_AUTHKEYS}:/etc/ssh/:rw -p ${PORT_AUTOSSH}:22 -p ${PORT_HUB_WEB}:3002
 DOCKER_HUB_DEV_APPEND=
 #
 DOCKER_HUBDB_PRODUCTION=-v ${PATH_MONGO}:/data/:rw
diff --git a/ssh/README.md b/ssh/README.md
deleted file mode 100644
index 5238dc5..0000000
--- a/ssh/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-ssh keys for cloud endpoints
-=======
-
-If using cloud endpoints copy id_rsa.pub, id_rsa and known hosts here.  They can be copied from the default endpoint, ep0.  This is suitable for testing/development only.