diff --git a/html/ui/Cluster-703dcdca97841304.js b/html/ui/Cluster-ddf1029883a9a21d.js
similarity index 74%
rename from html/ui/Cluster-703dcdca97841304.js
rename to html/ui/Cluster-ddf1029883a9a21d.js
index 2436c51..827a01f 100644
--- a/html/ui/Cluster-703dcdca97841304.js
+++ b/html/ui/Cluster-ddf1029883a9a21d.js
@@ -15,6 +15,7 @@ const Cluster = {
                 Group:  "system:masters",
             },
             kubeUserCert: null,
+            downloadSet: null,
         };
     },
     methods: {
@@ -66,6 +67,28 @@ const Cluster = {
                 this.kubeSignReq.CSR = v;
             });
         },
+        generateDownloadSet() {
+            event.preventDefault()
+
+            const hosts = (this.state.Hosts||[]).filter(h => h.Cluster == this.cluster.Name)
+            const items = hosts.map(h => ({
+                Kind: "host",
+                Name: h.Name,
+                Assets: ["kernel", "initrd", "uki", "bootstrap.tar", "boot.img.gz", "boot.img", "boot.qcow2", "boot.iso", "boot.tar", "bootstrap-config", "config", "config.json", "ipxe"],
+            }))
+
+            fetch('/sign-download-set', {
+                method: 'POST',
+                body: JSON.stringify({Expiry: this.signReqValidity, Items: items}),
+                headers: { 'Authorization': 'Bearer ' + this.token, 'Content-Type': 'application/json' },
+            }).then((resp) => {
+                if (resp.ok) {
+                    resp.json().then((set) => { this.downloadSet = set })
+                } else {
+                    resp.json().then((resp) => alert('failed to generate: '+resp.message))
+                }
+            }).catch((e) => { alert('failed to generate: '+e) })
+        },
     },
     template: `
   <h3>Access</h3>
@@ -116,6 +139,15 @@ const Cluster = {
   <h3>Downloads</h3>
   <Downloads :token="token" :state="state" kind="cluster" :name="cluster.Name" />
 
+  <h3>Download set</h3>
+  <p>Validity: <input type="text" v-model="signReqValidity"/> <small>time range, ie: -5m:1w, 5m, 1M, 1y, 1d-1s, etc.</small></p>
+  <p><button @click="generateDownloadSet">Generate download set ({{ (state.Hosts||[]).filter(h => h.Cluster == cluster.Name).length }} hosts)</button></p>
+  <p v-if="downloadSet" style="word-break:break-all">
+    <a :href="'/public/download-set?set='+downloadSet" target="_blank">Open download set page</a>
+    <br/>
+    <button @click="navigator.clipboard.writeText(window.location.origin+'/public/download-set?set='+downloadSet)">Copy URL</button>
+  </p>
+
   <h3>CAs</h3>
   <table><tr><th>Name</th><th>Certificate</th><th>Signed certificates</th></tr>
   <tr v-for="ca in cluster.CAs">
diff --git a/html/ui/index.html b/html/ui/index.html
index 042e2c9..2b5b9c7 100644
--- a/html/ui/index.html
+++ b/html/ui/index.html
@@ -13,7 +13,7 @@
 <script src="/ui/app-e7fb26679b9aa0f2.js" defer integrity="sha384-4oRQalb7IIBcqQzfDkeCj53qYOP6dLsTwqcjnm3EiBa92oNDD3chUw38W2gEC+3p" type="module"></script>
 <script src="/ui/Downloads-29497c61f1fe9bf0.js" integrity="sha384-xwn49JflUBaZlQCHCn55Q9qSGqsw01Job+TXk53HLhvNhKAALN18+gNCdF0bUJW0"></script>
 <script src="/ui/GetCopy-7e3c9678f9647d40.js" integrity="sha384-LzxUXylxE/t25HyTch8y2qvKcehvP2nqCo37swIBGEKZZUzHVJVQrS5UJDWNskTA"></script>
-<script src="/ui/Cluster-703dcdca97841304.js" integrity="sha384-ifGpq/GB1nDfqczm5clTRtcfnc9UMkT+SptMyS3UG9Di3xoKORtOGGjmK5RnJx+v"></script>
+<script src="/ui/Cluster-ddf1029883a9a21d.js" integrity="sha384-369vhOXJjTUPEtaedTqqk4D092uKIbU6r7cHj7HQMwkhlBCxuYH2uHMyRzKes6HS"></script>
 <script src="/ui/Host-61916516a854adff.js" integrity="sha384-/wh3KrC0sb4MT7ekO2U84rswxI42WSH/0jB4dbDaaGaGhX60xTEZHFsdQAf7UgTG"></script>
 <body>
 
diff --git a/ui/js/Cluster.js b/ui/js/Cluster.js
index 2436c51..827a01f 100644
--- a/ui/js/Cluster.js
+++ b/ui/js/Cluster.js
@@ -15,6 +15,7 @@ const Cluster = {
                 Group:  "system:masters",
             },
             kubeUserCert: null,
+            downloadSet: null,
         };
     },
     methods: {
@@ -66,6 +67,28 @@ const Cluster = {
                 this.kubeSignReq.CSR = v;
             });
         },
+        generateDownloadSet() {
+            event.preventDefault()
+
+            const hosts = (this.state.Hosts||[]).filter(h => h.Cluster == this.cluster.Name)
+            const items = hosts.map(h => ({
+                Kind: "host",
+                Name: h.Name,
+                Assets: ["kernel", "initrd", "uki", "bootstrap.tar", "boot.img.gz", "boot.img", "boot.qcow2", "boot.iso", "boot.tar", "bootstrap-config", "config", "config.json", "ipxe"],
+            }))
+
+            fetch('/sign-download-set', {
+                method: 'POST',
+                body: JSON.stringify({Expiry: this.signReqValidity, Items: items}),
+                headers: { 'Authorization': 'Bearer ' + this.token, 'Content-Type': 'application/json' },
+            }).then((resp) => {
+                if (resp.ok) {
+                    resp.json().then((set) => { this.downloadSet = set })
+                } else {
+                    resp.json().then((resp) => alert('failed to generate: '+resp.message))
+                }
+            }).catch((e) => { alert('failed to generate: '+e) })
+        },
     },
     template: `
   <h3>Access</h3>
@@ -116,6 +139,15 @@ const Cluster = {
   <h3>Downloads</h3>
   <Downloads :token="token" :state="state" kind="cluster" :name="cluster.Name" />
 
+  <h3>Download set</h3>
+  <p>Validity: <input type="text" v-model="signReqValidity"/> <small>time range, ie: -5m:1w, 5m, 1M, 1y, 1d-1s, etc.</small></p>
+  <p><button @click="generateDownloadSet">Generate download set ({{ (state.Hosts||[]).filter(h => h.Cluster == cluster.Name).length }} hosts)</button></p>
+  <p v-if="downloadSet" style="word-break:break-all">
+    <a :href="'/public/download-set?set='+downloadSet" target="_blank">Open download set page</a>
+    <br/>
+    <button @click="navigator.clipboard.writeText(window.location.origin+'/public/download-set?set='+downloadSet)">Copy URL</button>
+  </p>
+
   <h3>CAs</h3>
   <table><tr><th>Name</th><th>Certificate</th><th>Signed certificates</th></tr>
   <tr v-for="ca in cluster.CAs">
