Live state
Overview
Control-operator authority only
Fleet lifecycle & measured SLOs
Bind a ready customer service
Attach one exact tenant, project, customer, instance, and approved release. This does not grant tenant administrators host, provider, backup, or release authority.
Exact ownership
Services & SLO evidence
Canary then staged waves
Release rollouts
One customer · one VPS
Deploy a mail platform
Canary before customers
Immutable releases
Isolated runtimes
Customer platforms
Secret-safe OAuth device authorization
Infrastructure providers
Connect a Netcup account
Authorize Mail Control once. Refresh tokens remain in private server-side files; access tokens, refresh tokens, and device codes are never returned to this browser or stored in PostgreSQL.
Dedicated security boundaries
VPS targets
Register a purchased VPS
Register the customer boundary and public IP first. The one-time enrollment credential is shown only after creation and is never stored in recoverable form.
Save the enrollment credential now
Download the credential file, transfer it to the new VPS as root with mode 600, then run the command below. Replace the three uppercase placeholders.