diff --git a/bundles/bind/metadata.py b/bundles/bind/metadata.py
index f82c174..a885db7 100644
--- a/bundles/bind/metadata.py
+++ b/bundles/bind/metadata.py
@@ -1,52 +1,33 @@
 from bundlewrap.metadata import atomic
 
 
-@metadata_processor
-def backups(metadata):
-    if metadata.get('bind', {}).get('zones_primary_dynamic', {}):
-        metadata.setdefault('backups', {}).setdefault('paths', set()).add(
-            '/var/lib/bind/primary.dynamic',
-        )
-    return metadata, RUN_ME_AGAIN
-
-
-@metadata_processor
-def monitoring(metadata):
-    icinga2_api = metadata.setdefault('icinga2_api', {})
-    node_metadata = icinga2_api.setdefault('bind', {})
-
-    services = node_metadata.setdefault('services', {})
-    services.setdefault('BIND PROCESS', {}).update({
-        'check_command': 'nrpe',
-        'vars.nrpe_command': 'check_bind_procs',
-    })
-    for interface in metadata.get('bind', {}).get('listen', []):
-        services.setdefault('BIND PORT {}'.format(interface), {}).update({
-            'check_command': 'tcp',
-            'vars.tcp_address': metadata['interfaces'][interface]['ip_addresses'][0],
-            'vars.tcp_port': 53,
-        })
-
-    nrpe_checks = metadata.setdefault('nrpe', {}).setdefault('custom_nrpe_checks', {})
-    nrpe_checks['check_bind_procs'] = '/usr/lib/nagios/plugins/check_procs -C named -c 1:1'
-
-    return metadata, DONE
-
-
-@metadata_processor
-def sperrfix(metadata):
-    per_bundle = metadata.get('bind', {}).get('sperrfix', {})
-
-    if per_bundle.get('ignore'):
-        return metadata, DONE
-
-    sources = per_bundle.get('sources', {'*'})
-
-    return {
-        'sperrfix': {
-            'bundle_rules': {
-                '53': atomic({'sources': sources}),
-                '53/udp': atomic({'sources': sources}),
+defaults = {
+    'icinga2_api': {
+        'bind': {
+            'services': {
+                'BIND PROCESS': {
+                    'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C named -c 1:1',
+                },
             },
         },
-    }, OVERWRITE, RUN_ME_AGAIN
+    },
+}
+
+@metadata_reactor
+def port_checks(metadata):
+    services = {}
+
+    for interface in metadata.get('bind/listen', set()):
+        services[f'BIND PORT {interface}'] = {
+            'check_command': 'tcp',
+            'vars.tcp_address': metadata.get(f'interfaces/{interface}/ip_addresses')[0],
+            'vars.tcp_port': 53,
+        }
+
+    return {
+        'icinga2_api': {
+            'bind': {
+                'services': services,
+            },
+        },
+    }
diff --git a/bundles/jenkins-ci/metadata.py b/bundles/jenkins-ci/metadata.py
index a9afbd3..1640573 100644
--- a/bundles/jenkins-ci/metadata.py
+++ b/bundles/jenkins-ci/metadata.py
@@ -1,27 +1,25 @@
-@metadata_processor
-def jenkins_apt_repos(metadata):
-    return {
-        'apt': {
-            'repos': {
-                'jenkins': {
-                    'key': '150FDE3F7787E7D11EF4E12A9B7D32F2D50582E6',
-                    'items': [
-                        'deb https://pkg.jenkins.io/debian-stable binary/',
-                    ],
-                },
+defaults = {
+    'apt': {
+        'repos': {
+            'jenkins': {
+                'key': '150FDE3F7787E7D11EF4E12A9B7D32F2D50582E6',
+                'items': [
+                    'deb https://pkg.jenkins.io/debian-stable binary/',
+                ],
             },
-            'unattended-upgrades': {
-                'origins': {
-                    'o=jenkins.io,a=binary',
-                },
+        },
+        'unattended-upgrades': {
+            'origins': {
+                'o=jenkins.io,a=binary',
             },
-            'packages': {
-                'openjdk-11-jre': {},
-                'jenkins': {
-                    'needs': {
-                        'pkg_apt:openjdk-11-jre',
-                    },
+        },
+        'packages': {
+            'openjdk-11-jre': {},
+            'jenkins': {
+                'needs': {
+                    'pkg_apt:openjdk-11-jre',
                 },
             },
         },
-    }, DEFAULTS, DONE
+    },
+}
diff --git a/bundles/letsencrypt/metadata.py b/bundles/letsencrypt/metadata.py
index e346ae8..8e8d99d 100644
--- a/bundles/letsencrypt/metadata.py
+++ b/bundles/letsencrypt/metadata.py
@@ -1,8 +1,6 @@
-@metadata_processor
-def crontab(metadata):
-    return {
-        'cron': {
-            'letsencrypt_renew': '20 4 * * *    root    /usr/bin/dehydrated --cron --accept-terms --challenge http-01 > /dev/null',
-            'letsencrypt_cleanup': '42 23 * * 0    root    /usr/bin/dehydrated --cleanup > /dev/null',
-        },
-    }, DEFAULTS, DONE
+defaults = {
+    'cron': {
+        'letsencrypt_renew': '20 4 * * *    root    /usr/bin/dehydrated --cron --accept-terms --challenge http-01 > /dev/null',
+        'letsencrypt_cleanup': '42 23 * * 0    root    /usr/bin/dehydrated --cleanup > /dev/null',
+    },
+}
diff --git a/bundles/matrix-synapse/metadata.py b/bundles/matrix-synapse/metadata.py
index 6526fa4..b5697a6 100644
--- a/bundles/matrix-synapse/metadata.py
+++ b/bundles/matrix-synapse/metadata.py
@@ -1,47 +1,40 @@
-@metadata_processor
-def nodejs_apt_repos(metadata):
-    return {
-        'apt': {
-            'repos': {
-                'matrix': {
-                    'key': 'AAF9AE843A7584B5A3E4CD2BCF45A512DE2DA058',
-                    'items': [
-                        'deb https://packages.matrix.org/debian buster main',
-                    ],
-                },
-            },
-            'unattended-upgrades': {
-                'origins': {
-                    'o=matrix.org,n=buster,c=main',
-                },
-            },
-            'packages': {
-                'matrix-synapse-py3': {},
+defaults = {
+    'apt': {
+        'repos': {
+            'matrix': {
+                'key': 'AAF9AE843A7584B5A3E4CD2BCF45A512DE2DA058',
+                'items': [
+                    'deb https://packages.matrix.org/debian buster main',
+                ],
             },
         },
-    }, DEFAULTS, DONE
-
-@metadata_processor
-def synapse_defaults(metadata):
-    return {
-        'matrix-synapse': {
-            'registration_shared_secret': repo.vault.human_password_for('{} matrix-synapse registration_shared_secret'.format(node.name)),
-            'database': {
-                'user': 'synapse_user',
+        'unattended-upgrades': {
+            'origins': {
+                'o=matrix.org,n=buster,c=main',
+            },
+        },
+        'packages': {
+            'matrix-synapse-py3': {},
+        },
+    },
+   'matrix-synapse': {
+        'registration_shared_secret': repo.vault.human_password_for('{} matrix-synapse registration_shared_secret'.format(node.name)),
+        'database': {
+            'user': 'synapse_user',
+            'password': repo.vault.password_for('{} postgresql synapse_user'.format(node.name)),
+            'database': 'synapse',
+        },
+    },
+    'postgresql': {
+        'users': {
+            'synapse_user': {
                 'password': repo.vault.password_for('{} postgresql synapse_user'.format(node.name)),
-                'database': 'synapse',
             },
         },
-        'postgresql': {
-            'users': {
-                'synapse_user': {
-                    'password': repo.vault.password_for('{} postgresql synapse_user'.format(node.name)),
-                },
+        'databases': {
+            'synapse': {
+                'owner': 'synapse_user',
             },
-            'databases': {
-                'synapse': {
-                    'owner': 'synapse_user',
-                },
-            },
-        }
-    }, DEFAULTS, DONE
+        },
+    }
+}
diff --git a/bundles/mx-puppet-discord/items.py b/bundles/mx-puppet-discord/items.py
index 05e3e5f..71d105a 100644
--- a/bundles/mx-puppet-discord/items.py
+++ b/bundles/mx-puppet-discord/items.py
@@ -31,9 +31,6 @@ git_deploy = {
     '/opt/mx-puppet-discord': {
         'repo': 'https://github.com/matrix-discord/mx-puppet-discord.git',
         'rev': 'master',
-        'needs': {
-            'directory:/opt/mx-puppet-discord',
-        },
         'triggers': {
             'action:mx-puppet-discord_chown',
             'action:mx-puppet-discord_npm_install',
diff --git a/bundles/mx-puppet-discord/metadata.py b/bundles/mx-puppet-discord/metadata.py
index 1a83e79..2734468 100644
--- a/bundles/mx-puppet-discord/metadata.py
+++ b/bundles/mx-puppet-discord/metadata.py
@@ -1,46 +1,33 @@
-@metadata_processor
-def mx_puppet_discord_user(metadata):
-    return {
+defaults = {
+    'users': {
+        'mx-puppet-discord': {
+            'home': '/opt/mx-puppet-discord',
+            'deploy_configs': False,
+            'home-mode': '0755',
+        },
+    },
+    'matrix-synapse': {
+        'appservice_configs': {
+            '/opt/mx-puppet-discord/registration.yaml',
+        },
+    },
+    'mx-puppet-discord': {
+        'database': {
+            'user': 'mx-puppet-discord',
+            'password': repo.vault.password_for('{} postgresql mx-puppet-discord'.format(node.name)),
+            'database': 'mx-puppet-discord',
+        },
+    },
+    'postgres': {
         'users': {
             'mx-puppet-discord': {
-                'home': '/opt/mx-puppet-discord',
-                'deploy_configs': False,
-                'home-mode': '0755',
-            },
-        },
-    }, DEFAULTS, DONE
-
-@metadata_processor
-def add_mx_puppet_discord_to_synapse(metadata):
-    return {
-        'matrix-synapse': {
-            'appservice_configs': {
-                '/opt/mx-puppet-discord/registration.yaml',
-            },
-        },
-    }, DEFAULTS, DONE
-
-@metadata_processor
-def postgres(metadata):
-    return {
-        'mx-puppet-discord': {
-            'database': {
-                'user': 'mx-puppet-discord',
                 'password': repo.vault.password_for('{} postgresql mx-puppet-discord'.format(node.name)),
-                'database': 'mx-puppet-discord',
             },
         },
-        'postgres': {
-            'users': {
-                'mx-puppet-discord': {
-                    'password': repo.vault.password_for('{} postgresql mx-puppet-discord'.format(node.name)),
-                },
-            },
-            'databases': {
-                'mx-puppet-discord': {
-                    'owner': 'mx-puppet-discord',
-                },
+        'databases': {
+            'mx-puppet-discord': {
+                'owner': 'mx-puppet-discord',
             },
         },
-    }, DEFAULTS, DONE
-
+    },
+}
diff --git a/bundles/nginx/metadata.py b/bundles/nginx/metadata.py
index 20b609c..6fd28f4 100644
--- a/bundles/nginx/metadata.py
+++ b/bundles/nginx/metadata.py
@@ -1,39 +1,37 @@
-@metadata_processor
-def defaults(metadata):
-    return {
-        'apt': {
-            'repos': {
-                'nginx': {
-                    'key': '573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62',
-                    'items': [
-                        'deb http://nginx.org/packages/debian buster nginx',
-                    ],
-                },
-            },
-            'unattended-upgrades': {
-                'origins': {
-                    'o=nginx,a=stable,n=buster,l=nginx,c=nginx',
-                },
-            },
-            'packages': {
-                'nginx': {},
+defaults = {
+    'apt': {
+        'repos': {
+            'nginx': {
+                'key': '573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62',
+                'items': [
+                    'deb http://nginx.org/packages/debian buster nginx',
+                ],
             },
         },
-        'nginx': {
-            'worker_processes': 4,
-            'worker_connections': 1000,
+        'unattended-upgrades': {
+            'origins': {
+                'o=nginx,a=stable,n=buster,l=nginx,c=nginx',
+            },
         },
-    }, DEFAULTS, DONE
+        'packages': {
+            'nginx': {},
+        },
+    },
+    'nginx': {
+        'worker_processes': 4,
+        'worker_connections': 1000,
+    },
+}
 
 
-@metadata_processor
+@metadata_reactor
 def letsencrypt(metadata):
     if not node.has_bundle('letsencrypt'):
-        return metadata, DONE
+        raise DoNotRunAgain
 
     domains = {}
 
-    for domain in metadata.get('nginx', {}).get('vhosts', {}).keys():
+    for domain in metadata.get('nginx/vhosts', {}).keys():
         domains[domain] = set()
 
     return {
@@ -43,4 +41,4 @@ def letsencrypt(metadata):
                 'nginx',
             },
         },
-    }, DEFAULTS, RUN_ME_AGAIN
+    }
diff --git a/bundles/nodejs/metadata.py b/bundles/nodejs/metadata.py
index 7906b86..fc23e87 100644
--- a/bundles/nodejs/metadata.py
+++ b/bundles/nodejs/metadata.py
@@ -1,31 +1,29 @@
-@metadata_processor
-def nodejs_apt_repos(metadata):
-    return {
-        'apt': {
-            'repos': {
-                'yarn': {
-                    'key': '72ECF46A56B4AD39C907BBB71646B01B86E50310',
-                    'items': [
-                        'deb https://dl.yarnpkg.com/debian/ stable main',
-                    ],
-                },
-                'node': {
-                    'key': '9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280',
-                    'items': [
-                        'deb https://deb.nodesource.com/node_10.x buster main',
-                        'deb-src https://deb.nodesource.com/node_10.x buster main',
-                    ],
-                },
+defaults = {
+    'apt': {
+        'repos': {
+            'yarn': {
+                'key': '72ECF46A56B4AD39C907BBB71646B01B86E50310',
+                'items': [
+                    'deb https://dl.yarnpkg.com/debian/ stable main',
+                ],
             },
-            'unattended-upgrades': {
-                'origins': {
-                    'o=Node Source,n=buster,l=Node Source,c=main',
-                    'o=yarn,a=stable,n=stable,l=yarn-stable,c=main',
-                },
-            },
-            'packages': {
-                'nodejs': {},
-                'yarn': {},
+            'node': {
+                'key': '9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280',
+                'items': [
+                    'deb https://deb.nodesource.com/node_10.x buster main',
+                    'deb-src https://deb.nodesource.com/node_10.x buster main',
+                ],
             },
         },
-    }, DEFAULTS, DONE
+        'unattended-upgrades': {
+            'origins': {
+                'o=Node Source,n=buster,l=Node Source,c=main',
+                'o=yarn,a=stable,n=stable,l=yarn-stable,c=main',
+            },
+        },
+        'packages': {
+            'nodejs': {},
+            'yarn': {},
+        },
+    },
+}
diff --git a/bundles/riot-web/items.py b/bundles/riot-web/items.py
index f92eb9c..783802b 100644
--- a/bundles/riot-web/items.py
+++ b/bundles/riot-web/items.py
@@ -10,9 +10,6 @@ directories = {
 
 git_deploy = {
     riot_web_root: {
-        'needs': {
-            'directory:' + riot_web_root,
-        },
         'rev': 'master',
         'repo': 'https://github.com/vector-im/riot-web.git',
         'triggers': {
diff --git a/bundles/riot-web/metadata.py b/bundles/riot-web/metadata.py
index 85ec9fb..5d7dcaa 100644
--- a/bundles/riot-web/metadata.py
+++ b/bundles/riot-web/metadata.py
@@ -1,12 +1,12 @@
-@metadata_processor
+@metadata_reactor
 def nginx_config(metadata):
     return {
         'nginx': {
             'vhosts': {
-                metadata['riot-web']['url']: {
-                    'webroot': '/var/www/chat.franzi.business/webapp/',
+                metadata.get('riot-web/url', None): {
+                    'webroot': '/var/www/{}/webapp/'.format(metadata.get('riot-web/url', None)),
                     'extras': True,
                 },
             },
         },
-    }, DEFAULTS, DONE
+    }
diff --git a/bundles/seafile/metadata.py b/bundles/seafile/metadata.py
index 484df9f..f431139 100644
--- a/bundles/seafile/metadata.py
+++ b/bundles/seafile/metadata.py
@@ -1,19 +1,17 @@
-@metadata_processor
-def defaults(metadata):
-    return {
-        'apt': {
-            'packages': {
-                'mariadb-server': {},
-                'python3': {},
-                'python3-setuptools': {},
-                'python3-pip': {},
-            },
+defaults = {
+    'apt': {
+        'packages': {
+            'mariadb-server': {},
+            'python3': {},
+            'python3-setuptools': {},
+            'python3-pip': {},
         },
-        'users': {
-            'seafile': {
-                'home': '/opt/seafile',
-                'deploy_configs': False,
-                'home-mode': '0755',
-            },
+    },
+    'users': {
+        'seafile': {
+            'home': '/opt/seafile',
+            'deploy_configs': False,
+            'home-mode': '0755',
         },
-    }, DEFAULTS, DONE
+    },
+}
diff --git a/bundles/sudo/files/sudoers b/bundles/sudo/files/sudoers
index c884851..450f5ba 100644
--- a/bundles/sudo/files/sudoers
+++ b/bundles/sudo/files/sudoers
@@ -6,6 +6,6 @@ Defaults secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bi
 
 root ALL=(ALL) ALL
 
-% for user in node.metadata['sudo']:
+% for user in sorted(node.metadata['sudo']):
 ${user} ALL=(ALL) NOPASSWD:ALL
 % endfor
diff --git a/bundles/sudo/metadata.py b/bundles/sudo/metadata.py
index 73e2f5a..b516e61 100644
--- a/bundles/sudo/metadata.py
+++ b/bundles/sudo/metadata.py
@@ -1,11 +1,11 @@
-@metadata_processor
+@metadata_reactor
 def sudo_users(metadata):
-    sudoers = []
+    sudoers = set()
 
     for username, config in metadata.get('users', {}).items():
         if 'sudo' in config and config['sudo']:
-            sudoers.append(username)
+            sudoers.add(username)
 
-    metadata['sudo'] = sudoers
-
-    return metadata, RUN_ME_AGAIN
+    return {
+        'sudo': sudoers,
+    }
diff --git a/bundles/users/metadata.py b/bundles/users/metadata.py
index 46e9de0..2db2aaa 100644
--- a/bundles/users/metadata.py
+++ b/bundles/users/metadata.py
@@ -1,11 +1,9 @@
-@metadata_processor
-def apt(metadata):
-    return {
-        'apt': {
-            'packages': {
-                'fish': {},
-                'tmux': {},
-                'vim': {},
-            },
+defaults = {
+    'apt': {
+        'packages': {
+            'fish': {},
+            'tmux': {},
+            'vim': {},
         },
-    }, DEFAULTS, DONE
+    },
+}
diff --git a/bundles/vmhost/metadata.py b/bundles/vmhost/metadata.py
index f9850b4..ca00ff6 100644
--- a/bundles/vmhost/metadata.py
+++ b/bundles/vmhost/metadata.py
@@ -1,11 +1,9 @@
-@metadata_processor
-def apt(metadata):
-    return {
-        'apt': {
-            'packages': {
-                'qemu-kvm': {},
-                'libvirt-clients': {},
-                'libvirt-daemon-system': {},
-            },
+defaults = {
+    'apt': {
+        'packages': {
+            'qemu-kvm': {},
+            'libvirt-clients': {},
+            'libvirt-daemon-system': {},
         },
-    }, DEFAULTS, DONE
+    },
+}
diff --git a/bundles/voc-loudness-monitor/metadata.py b/bundles/voc-loudness-monitor/metadata.py
index 82e4a2b..7132cd9 100644
--- a/bundles/voc-loudness-monitor/metadata.py
+++ b/bundles/voc-loudness-monitor/metadata.py
@@ -1,14 +1,12 @@
-@metadata_processor
-def add_voc_user(metadata):
-    return {
-        'apt': {
-            'packages': {
-                'ffmpeg': {},
-            },
+defaults = {
+    'apt': {
+        'packages': {
+            'ffmpeg': {},
         },
-        'users': {
-            'voc': {
-                'home': '/opt/voc-loudness-monitor',
-            },
+    },
+    'users': {
+        'voc': {
+            'home': '/opt/voc-loudness-monitor',
         },
-    }, DEFAULTS, DONE
+    },
+}
diff --git a/items/git_deploy.py b/items/git_deploy.py
deleted file mode 100644
index 020009c..0000000
--- a/items/git_deploy.py
+++ /dev/null
@@ -1,208 +0,0 @@
-# -*- coding: utf-8 -*-
-from __future__ import unicode_literals
-
-from atexit import register as at_exit
-from os import remove, setpgrp
-from os.path import isfile, join
-from pipes import quote
-from shutil import rmtree
-from subprocess import PIPE, Popen
-from tempfile import mkdtemp, NamedTemporaryFile
-
-from bundlewrap.exceptions import RepositoryError
-from bundlewrap.items import Item
-from bundlewrap.utils import cached_property
-from bundlewrap.utils.text import mark_for_translation as _, randstr
-from bundlewrap.utils.ui import io
-
-
-REPO_MAP_FILENAME = "git_deploy_repos"
-REMOTE_STATE_FILENAME = ".bundlewrap_git_deploy"
-
-
-def is_ref(rev):
-    """
-    Braindead check to see if our rev is a branch or tag name. False
-    negatives are OK since this is only used for optimization.
-    """
-    for char in rev:
-        if char not in "0123456789abcdef":
-            return True
-    return False
-
-
-def clone_to_dir(remote_url, rev):
-    """
-    Clones the given URL to a temporary directory, using a shallow clone
-    if the given revision is definitely not a commit hash.
-
-    Returns the path to the directory.
-    """
-    tmpdir = mkdtemp()
-    if is_ref(rev):
-        git_cmdline = ["clone", "--bare", "--depth", "1", "--no-single-branch", remote_url, "."]
-    else:
-        git_cmdline = ["clone", "--bare", remote_url, "."]
-    git_command(git_cmdline, tmpdir)
-    return tmpdir
-
-
-def get_local_repo_path(bw_repo_path, repo_name):
-    """
-    From the given BundleWrap repo, get the filesystem path to the git
-    repo associated with the given internal repo name.
-    """
-    repo_map_path = join(bw_repo_path, REPO_MAP_FILENAME)
-    if not isfile(repo_map_path):
-        io.stderr(_("missing repo map for git_deploy at {}").format(repo_map_path))
-        io.stderr(_("you must create this file with the following format:"))
-        io.stderr(_("  <value of repo attribute on git_deploy item>: "
-                    "<absolute path to local git repo>"))
-        io.stderr(_("since the path is local, you should also add the "
-                    "{} file to your gitignore").format(REPO_MAP_FILENAME))
-        raise RepositoryError(_("missing repo map for git_deploy"))
-
-    with open(join(bw_repo_path, REPO_MAP_FILENAME)) as f:
-        repo_map = f.readlines()
-
-    for line in repo_map:
-        if not line.strip() or line.startswith("#"):
-            continue
-        try:
-            repo, path = line.split(":", 1)
-        except:
-            raise RepositoryError(_("unable to parse line from {path}: '{line}'").format(
-                line=line,
-                path=repo_map_path,
-            ))
-        if repo_name == repo:
-            return path.strip()
-
-    raise RepositoryError(_("no path found for repo '{repo}' in {path}").format(
-        path=repo_map_path,
-        repo=repo_name,
-    ))
-
-
-def git_command(cmdline, repo_dir):
-    """
-    Runs the given git command line in the given directory.
-
-    Returns stdout of the command.
-    """
-    cmdline = ["git"] + cmdline
-    io.debug(_("running '{}' in {}").format(
-        " ".join(cmdline),
-        repo_dir,
-    ))
-    git_process = Popen(
-        cmdline,
-        cwd=repo_dir,
-        preexec_fn=setpgrp,
-        stderr=PIPE,
-        stdout=PIPE,
-    )
-    stdout, stderr = git_process.communicate()
-    if git_process.returncode != 0:
-        io.stderr(_("failed command: {}").format(" ".join(cmdline)))
-        io.stderr(_("stdout:\n{}").format(stdout))
-        io.stderr(_("stderr:\n{}").format(stderr))
-        raise RuntimeError(_("`git {command}` failed in {dir}").format(
-            command=cmdline[1],
-            dir=repo_dir,
-        ))
-    return stdout.decode('utf-8').strip()
-
-
-class GitDeploy(Item):
-    """
-    Facilitates deployment of a given rev from a local git repo to a
-    node.
-    """
-    BUNDLE_ATTRIBUTE_NAME = "git_deploy"
-    ITEM_ATTRIBUTES = {
-        'repo': None,
-        'rev': None,
-        'use_xattrs': False,
-    }
-    ITEM_TYPE_NAME = "git_deploy"
-    REQUIRED_ATTRIBUTES = ['repo', 'rev']
-
-    def __repr__(self):
-        return "<GitDeploy path:{} repo:{} rev:{}>".format(
-            self.name,
-            self.attributes['repo'],
-            self.attributes['rev'],
-        )
-
-    @cached_property
-    def _expanded_rev(self):
-        git_cmdline = ["rev-parse", self.attributes['rev']]
-        return git_command(
-            git_cmdline,
-            self._repo_dir,
-        )
-
-    @cached_property
-    def _repo_dir(self):
-        if "://" in self.attributes['repo']:
-            repo_dir = clone_to_dir(self.attributes['repo'], self.attributes['rev'])
-            io.debug(_("registering {} for deletion on exit").format(repo_dir))
-            at_exit(rmtree, repo_dir)
-        else:
-            repo_dir = get_local_repo_path(self.node.repo.path, self.attributes['repo'])
-        return repo_dir
-
-    def cdict(self):
-        return {'rev': self._expanded_rev}
-
-    def fix(self, status):
-        archive_local = NamedTemporaryFile(delete=False)
-        try:
-            archive_local.close()
-            git_command(
-                ["archive", "-o", archive_local.name, self._expanded_rev],
-                self._repo_dir,
-            )
-            temp_filename = ".bundlewrap_tmp_git_deploy_" + randstr()
-
-            try:
-                self.node.upload(
-                    archive_local.name,
-                    temp_filename,
-                )
-                self.node.run("find {} -mindepth 1 -delete".format(quote(self.name)))
-                self.node.run("tar -xf {} -C {}".format(temp_filename, quote(self.name)))
-                if self.attributes['use_xattrs']:
-                    self.node.run("attr -q -s bw_git_deploy_rev -V {} {}".format(
-                        self._expanded_rev,
-                        quote(self.name),
-                    ))
-                else:
-                    self.node.run("echo {} > {}".format(
-                        self._expanded_rev,
-                        quote(join(self.name, REMOTE_STATE_FILENAME)),
-                    ))
-                    self.node.run("chmod 400 {}".format(
-                        quote(join(self.name, REMOTE_STATE_FILENAME)),
-                    ))
-            finally:
-                self.node.run("rm -f {}".format(temp_filename))
-        finally:
-            remove(archive_local.name)
-
-    def sdict(self):
-        if self.attributes['use_xattrs']:
-            status_result = self.node.run(
-                "attr -q -g bw_git_deploy_rev {}".format(quote(self.name)),
-                may_fail=True,
-            )
-        else:
-            status_result = self.node.run(
-                "cat {}".format(quote(join(self.name, REMOTE_STATE_FILENAME))),
-                may_fail=True,
-            )
-        if status_result.return_code != 0:
-            return None
-        else:
-            return {'rev': status_result.stdout.decode('utf-8').strip()}
diff --git a/nodes/htz-cloud/pirmasens.py b/nodes/htz-cloud/pirmasens.py
index 7042cd6..40cd0bc 100644
--- a/nodes/htz-cloud/pirmasens.py
+++ b/nodes/htz-cloud/pirmasens.py
@@ -1,6 +1,5 @@
 nodes['htz-cloud.pirmasens'] = {
-    'bundles': {
-    },
+    'bundles': set(),
     'groups': {
         'webserver',
     },
diff --git a/nodes/htz-cloud/sewfile.py b/nodes/htz-cloud/sewfile.py
index 6c10e92..022c274 100644
--- a/nodes/htz-cloud/sewfile.py
+++ b/nodes/htz-cloud/sewfile.py
@@ -2,9 +2,9 @@
 # managed by bundlewrap.
 
 nodes['htz-cloud.sewfile'] = {
-    'bundles': [
+    'bundles': {
         'seafile',
-    ],
+    },
     'groups': {
         'webserver',
     },
diff --git a/nodes/htz/ex42-1048908.py b/nodes/htz/ex42-1048908.py
index 03b3ac9..3b315ca 100644
--- a/nodes/htz/ex42-1048908.py
+++ b/nodes/htz/ex42-1048908.py
@@ -1,5 +1,5 @@
 nodes['htz.ex42-1048908'] = {
-    'bundles': [
+    'bundles': {
         'jenkins-ci',
         'matrix-synapse',
         'mx-puppet-discord',
@@ -8,7 +8,7 @@ nodes['htz.ex42-1048908'] = {
         'postgresql',
         'vmhost',
         'voc-loudness-monitor',
-    ],
+    },
     'groups': {
         'webserver',
     },
diff --git a/plugins.json b/plugins.json
deleted file mode 100644
index 39e6bc0..0000000
--- a/plugins.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "item_git_deploy": {
-        "files": {
-            "items/git_deploy.py": "111c81fe88c3e97168251fccf59e1aeb36af3d02"
-        },
-        "version": 6
-    }
-}
diff --git a/requirements.txt b/requirements.txt
index 5d89110..226cb18 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-bundlewrap<4.0.0
+bundlewrap>=4.0.0