diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a5e6d58..1cdfa31 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,9 +1,13 @@
-name: Release
+name: main
 on:
   push:
     branches:
       - main
+  pull_request:
+    branches:
+      - main
 jobs:
+  # start tailscale
   release:
     name: Release
     runs-on: ubuntu-latest
diff --git a/jenkins.nomad b/jenkins.nomad
deleted file mode 100644
index 20ad06d..0000000
--- a/jenkins.nomad
+++ /dev/null
@@ -1,169 +0,0 @@
-job "jenkins-java" {
-  datacenters = ["dc1"]
-  priority    = 100
-  type        = "service"
-
-  constraint {
-    attribute = "${attr.cpu.arch}"
-    value     = "arm"
-  }
-
-  update {
-    max_parallel      = 1
-    min_healthy_time  = "20m"
-    healthy_deadline  = "30m"
-    progress_deadline = "40m"
-    auto_revert       = false
-    canary            = 1
-  }
-
-  migrate {
-    max_parallel = 2
-  }
-
-  group "jenkins" {
-    count = 1
-
-    network {
-      port "server" {
-        static = 8080
-      }
-    }
-
-    ephemeral_disk {
-      sticky  = true
-      migrate = true
-      size    = 1000
-    }
-
-    task "prepare-plugin-ref" {
-      lifecycle {
-        hook    = "prestart"
-        sidecar = false
-      }
-
-      resources {
-        cores  = 1
-        memory = 1024
-      }
-
-      artifact {
-        source      = "https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.9.0/jenkins-plugin-manager-2.9.0.jar"
-        destination = "local/jenkins-plugin-manager.jar"
-        mode        = "file"
-      }
-
-      artifact {
-        source      = "https://get.jenkins.io/war-stable/2.289.1/jenkins.war"
-        destination = "local/jenkins.war"
-        mode        = "file"
-      }
-
-      driver = "raw_exec"
-
-      config {
-        command = "java"
-        args    = ["-jar", "local/jenkins-plugin-manager.jar", "--verbose", "--war", "local/jenkins.war", "-p", "blueocean blueocean-commons blueocean-config blueocean-core-js blueocean-dashboard blueocean-display-url blueocean-events blueocean-git-pipeline blueocean-github-pipeline blueocean-i18n blueocean-jwt blueocean-personalization blueocean-pipeline-api-impl blueocean-pipeline-editor blueocean-pipeline-scm-api blueocean-rest blueocean-rest-impl blueocean-web branch-api configuration-as-code credentials  credentials-binding dashboard-view display-url-api durable-task github github-api github-autostatus github-branch-source greenballs hashicorp-vault-pipeline hashicorp-vault-plugin job-dsl metrics monitoring pipeline-build-step pipeline-github pipeline-github-lib pipeline-githubnotify-step pipeline-graph-analysis pipeline-milestone-step pipeline-model-api pipeline-model-definition pipeline-model-extensions pipeline-rest-api pipeline-stage-step pipeline-stage-tags-metadata pipeline-stage-view pipeline-utility-steps trilead-api workflow-api workflow-basic-steps workflow-cps workflow-cps-global-lib workflow-durable-task-step workflow-job workflow-multibranch workflow-scm-step workflow-step-api workflow-support", "-d", "local/plugins"]
-      }
-    }
-
-    task "jenkins-controller" {
-      driver = "raw_exec"
-
-      service {
-        name = "jenkins-java-controller"
-        tags = ["jenkins", "ci"]
-        port = "server"
-
-        check {
-          path     = "/login"
-          name     = "alive"
-          type     = "tcp"
-          interval = "60s"
-          timeout  = "10s"
-          port     = "server"
-        }
-      }
-
-      config {
-        command = "java"
-
-        args = [
-          "-jar",
-          "local/jenkins.war",
-          "-Xmx2048m",
-          "-Xms256m",
-          "-Dhudson.footerURL=https://hashiatho.me",
-          "-Dhudson.model.WorkspaceCleanupThread.disabled=true",
-          "-Dhudson.slaves.ConnectionActivityMonitor.timeToPing=30000",
-          "-Djenkins.install.runSetupWizard=false",
-          "-Djenkins.security.SystemReadPermission=true",
-          "-Djenkins.ui.refresh=true",
-        ]
-      }
-
-      artifact {
-        source      = "https://get.jenkins.io/war-stable/2.289.1/jenkins.war"
-        destination = "local/jenkins.war"
-      }
-
-      logs {
-        max_files     = 10
-        max_file_size = 15
-      }
-
-      // volume_mount {
-      //   volume      = "casc"
-      //   destination = "/jenkins_casc"
-      //   read_only   = true
-      // }
-      template {
-        data = <<EOH
----
-jenkins:
-  systemMessage: "This the best ever message"
-  authorizationStrategy:
-    roleBased:
-      roles:
-        global:
-          - name: "admin"
-            description: "Jenkins administrators"
-            permissions:
-              - "Overall/Administer"
-            assignments:
-              - "admin"
-  securityRealm:
-    local:
-      allowsSignup: false
-      users:
-        - id: "admin"
-          password: "1234"
-EOH
-
-        destination = "local/jenkins_casc/jenkins.yml"
-      }
-
-      env {
-        CASC_JENKINS_CONFIG = "local/jenkins_casc/jenkins.yml"
-        JENKINS_HOME        = "local"
-      }
-
-      // csi_plugin {
-      //   id = "jenkins_home"
-      //   type = "node"
-      //   mount_dir = "/csi"
-      // }
-      resources {
-        cores  = 3
-        memory = 2048 # 256MB
-      }
-
-      restart {
-        interval = "30m"
-        attempts = 5
-        delay    = "10m"
-        mode     = "fail"
-      }
-    }
-  }
-}
diff --git a/jenkins/jenkins.nomad b/jenkins/jenkins.nomad
new file mode 100644
index 0000000..fc84bc6
--- /dev/null
+++ b/jenkins/jenkins.nomad
@@ -0,0 +1,187 @@
+job "jenkins" {
+
+  update {
+    max_parallel = 1
+    health_check = "checks"
+    auto_revert = true
+    auto_promote = true
+    canary = 1
+  }
+
+  constraint {
+    attribute  = "${attr.unique.hostname}"
+    operator = "regexp"
+    value = "^turing.*"
+  }
+
+  datacenters = ["dc1"]
+  type = "service"
+  group "main" {
+    count = 1
+    network {
+      port "ui" {
+        static = "8080"
+      }
+      mode = "host"
+    }
+
+    volume "casc" {
+      type      = "host"
+      read_only = false
+      source    = "jenkins_casc"
+    }
+
+    task "controller" {
+      driver = "exec"
+      volume_mount {
+        volume      = "casc"
+        destination = "/usr/share/jenkins"
+        read_only   = false
+      }
+
+      artifact {
+        source = "https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.12.8/jenkins-plugin-manager-2.12.8.jar"
+        destination = "alloc/data/jenkins-plugin-manager.jar"
+        mode = "file"
+      }
+
+      artifact {
+        source = "https://get.jenkins.io/war-stable/2.346.1/jenkins.war"
+        destination = "alloc/data/jenkins.war"
+        mode = "file"
+        options {
+          checksum = "sha256:176e2ce5c23d3c0b439befe0461e7ed1f53ac3091db05980198c23c7fde53b27"
+        }
+      }
+      template {
+        data = "{{ key \"jenkins/plugins\" }}"
+        destination = "local/plugins.txt"
+        change_mode = "restart"
+      }
+      env {
+        CASC_JENKINS_CONFIG = "alloc/data/jenkins.yml"
+        JENKINS_HOME        = "/usr/share/jenkins"
+        CACHE_DIR = "local/"
+      }
+      template {
+        data = <<EOF
+#!/bin/bash
+pwd
+set -eou pipefail
+mkdir -vp /usr/share/jenkins/plugins
+java -jar alloc/data/jenkins-plugin-manager.jar \
+     --war alloc/data/jenkins.war \
+     --plugin-file local/plugins.txt \
+     --skip-failed-plugins \
+     --verbose \
+     -d /usr/share/jenkins/plugins/
+echo "plugins installed"
+
+java \
+  -Xmx1024m \
+  -Xms256m \
+  -Dhudson.footerURL=https://hashiatho.me \
+  -Dhudson.model.WorkspaceCleanupThread.disabled=true \
+  -Dhudson.slaves.ConnectionActivityMonitor.timeToPing=30000 \
+  -Djenkins.install.runSetupWizard=false \
+  -Djenkins.security.SystemReadPermission=true \
+  -Djenkins.ui.refresh=true \
+  -jar alloc/data/jenkins.war \
+  --httpPort=${NOMAD_PORT_ui}
+EOF
+        destination = "local/script.sh"
+        perms = "0777"
+      }
+
+      config {
+        command = "/bin/bash"
+        args = ["local/script.sh"]
+      }
+
+      service {
+        port = "ui"
+
+        check {
+          type = "http"
+          port = "ui"
+          path = "/prometheus/"
+          interval = "10s"
+          timeout = "5s"
+        }
+
+        on_update = "require_healthy"
+
+        tags = ["urlprefix-/jenkins"]
+      }
+      template {
+        data = <<EOH
+---
+jenkins:
+  agentprotocols:
+    - "JNLP4-connect"
+    - "Ping"
+  numExecutors: 0
+  authorizationStrategy:
+    globalMatrix:
+      permissions:
+        - "Overall/Administer:admin"
+  crumbIssuer:
+    strict:
+      checkSessionMatch: false
+  remotingSecurity:
+    enabled: true
+  systemMessage: "This the best ever message"
+  securityRealm:
+    local:
+      allowsSignup: false
+      users:
+        - id: "admin"
+          password: "1234"
+  clouds:
+    - nomad:
+        clientPassword: ""
+        name: "nomad"
+        nomadUrl: "http://nomad.service.consul:4646"
+        prune: false
+        serverPassword: ""
+        tlsEnabled: false
+        workerTimeout: 1
+
+security:
+  apiToken:
+    creationOfLegacyTokenEnabled: false
+    tokenGenerationOnCreationEnabled: false
+    usageStatisticsEnabled: true
+  globalJobDslSecurityConfiguration:
+    useScriptSecurity: true
+  sSHD:
+    port: -1
+unclassified:
+  prometheusConfiguration:
+    appendParamLabel: true
+    appendStatusLabel: true
+    collectDiskUsage: true
+    collectingMetricsPeriodInSeconds: 60
+    countAbortedBuilds: true
+    countFailedBuilds: true
+    countNotBuiltBuilds: true
+    countSuccessfulBuilds: true
+    countUnstableBuilds: true
+    defaultNamespace: "default"
+    fetchTestResults: true
+    jobAttributeName: "jenkins_job"
+    path: "prometheus"
+    processingDisabledBuilds: false
+    useAuthenticatedEndpoint: false
+EOH
+        destination = "alloc/data/jenkins.yml"
+      }
+
+      resources {
+        cores = 3
+        memory = "500"
+        memory_max = "1000"
+      }
+    }
+  }
+}
diff --git a/jenkins/plugins.txt.tpl b/jenkins/plugins.txt.tpl
new file mode 100644
index 0000000..6ef2faa
--- /dev/null
+++ b/jenkins/plugins.txt.tpl
@@ -0,0 +1 @@
+[ for p in range(var.jenkins_plugins) : p ]