diff --git a/core/proto/api/BUILD.bazel b/core/proto/api/BUILD.bazel
new file mode 100644
index 0000000..88569f3
--- /dev/null
+++ b/core/proto/api/BUILD.bazel
@@ -0,0 +1,28 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "api_proto",
+    srcs = [
+        "debug.proto",
+        "enrolment.proto",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "api_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    #compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/api",
+    proto = ":api_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "go_default_library",
+    embed = [":api_go_proto"],
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/api",
+    visibility = ["//visibility:public"],
+)
diff --git a/core/proto/api/debug.proto b/core/proto/api/debug.proto
new file mode 100644
index 0000000..b036989
--- /dev/null
+++ b/core/proto/api/debug.proto
@@ -0,0 +1,61 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+package smalltown.core.proto.api;
+option go_package = "git.monogon.dev/source/nexantic.git/core/proto/api";
+
+import "core/proto/api/enrolment.proto";
+
+// NodeDebugService exposes debug and testing endpoints that allow introspection into a running Smalltown instance.
+// It is not authenticated and will be disabled in production. It is currently consumed by core/cmd/dbg and
+// by tests. For exact documentation of the available parameters please look at core/internal/node/debug.go.
+service NodeDebugService {
+    // GetDebugKubeconfig issues kubeconfigs with arbitrary identities and groups for debugging
+    rpc GetDebugKubeconfig(GetDebugKubeconfigRequest) returns (GetDebugKubeconfigResponse);
+    // GetComponentLogs dumps various log ringbuffers for binaries that we run.
+    rpc GetComponentLogs(GetComponentLogsRequest) returns (GetComponentLogsResponse);
+    // GetCondition gives the current status of various conditions inside Smalltown. Mainly used for testing.
+    rpc GetCondition(GetConditionRequest) returns (GetConditionResponse);
+}
+
+
+message GetDebugKubeconfigRequest {
+    string id = 1; // Kubernetes identity (user)
+    repeated string groups = 2; // Kubernetes groups
+}
+
+message GetDebugKubeconfigResponse {
+    string debug_kubeconfig = 1;
+}
+
+message GetComponentLogsRequest {
+    // For supported paths see core/internal/node/debug.go
+    repeated string component_path = 1;
+    uint32 tail_lines = 2; // 0 = whole ring buffer
+}
+
+message GetComponentLogsResponse {
+    repeated string line = 1;
+}
+
+message GetConditionRequest {
+    string name = 1;
+}
+
+message GetConditionResponse {
+    bool ok = 1;
+}
diff --git a/core/proto/api/enrolment.proto b/core/proto/api/enrolment.proto
new file mode 100644
index 0000000..cf109ad
--- /dev/null
+++ b/core/proto/api/enrolment.proto
@@ -0,0 +1,25 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+package smalltown.core.proto.api;
+option go_package = "git.monogon.dev/source/nexantic.git/core/proto/api";
+
+// The EnrolmentConfig is one of the inputs for the integrity mechanism.
+message EnrolmentConfig {
+    // Filled in by node after it is enrolled
+    string node_id = 1;
+}
diff --git a/core/proto/common/BUILD.bazel b/core/proto/common/BUILD.bazel
new file mode 100644
index 0000000..69b93af
--- /dev/null
+++ b/core/proto/common/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "common_proto",
+    srcs = ["common.proto"],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "common_go_proto",
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/common",
+    proto = ":common_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "go_default_library",
+    embed = [":common_go_proto"],
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/common",
+    visibility = ["//visibility:public"],
+)
diff --git a/core/proto/common/common.proto b/core/proto/common/common.proto
new file mode 100644
index 0000000..5616103
--- /dev/null
+++ b/core/proto/common/common.proto
@@ -0,0 +1,24 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+package smalltown.core.proto.common;
+option go_package = "git.monogon.dev/source/nexantic.git/core/proto/common";
+
+enum TrustBackend {
+    DUMMY = 0;
+    TPM = 1;
+}
diff --git a/core/proto/internal/BUILD.bazel b/core/proto/internal/BUILD.bazel
new file mode 100644
index 0000000..aa16e97
--- /dev/null
+++ b/core/proto/internal/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "internal_proto",
+    srcs = ["internal.proto"],
+    visibility = ["//core:__subpackages__"],
+)
+
+go_proto_library(
+    name = "internal_go_proto",
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/internal",
+    proto = ":internal_proto",
+    visibility = ["//core:__subpackages__"],
+)
+
+go_library(
+    name = "go_default_library",
+    embed = [":internal_go_proto"],
+    importpath = "git.monogon.dev/source/nexantic.git/core/proto/internal",
+    visibility = ["//core:__subpackages__"],
+)
diff --git a/core/proto/internal/internal.proto b/core/proto/internal/internal.proto
new file mode 100644
index 0000000..6811017
--- /dev/null
+++ b/core/proto/internal/internal.proto
@@ -0,0 +1,43 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+option go_package = "git.monogon.dev/source/nexantic.git/core/proto/internal";
+package smalltown.core.proto.internal;
+
+// Node describes a single node's state in etcd
+message Node {
+    // Individual node service certificate.
+    bytes certificate = 1;
+    // Node's individual cluster part of the disk encryption key.
+    bytes cluster_unlock_key = 2;
+    // Node address. This is currently an IPv4 address because that is what the
+    // network service uses, but would also support IPv6. See EnrolmentConfig for a
+    // discussion on why we use IP addresses rather than some kind of resolver.
+    string address = 3;
+
+    message Roles {
+        message ConsensusMember {
+            string etcd_member_name = 1;
+        }
+        ConsensusMember consensus_member = 1;
+        message KubernetesWorker {
+            string node_name = 1;
+        }
+        KubernetesWorker kubernetes_worker = 2;
+    }
+    Roles roles = 4;
+}