certificates
TLS certificates on a provider account (DigitalOcean first), for the tenant's [load balancers](/docs/reference/api/load-balancers). Every call records what the tenant wants and returns at once; the `vps.provider-resources` reconciler converges the provider through `ProviderImpl.certificates`. Reading takes `compute:certificates:read`, everything else `compute:certificates:manage`, on `provider-certificate/{id}`. Certificates book no quota (at most 100 per tenant) and do not bill.
TLS certificates on a provider account (DigitalOcean first), for the tenant's load balancers. Every call records what the tenant wants and returns at once; the vps.provider-resources reconciler converges the provider through ProviderImpl.certificates. Reading takes compute:certificates:read, everything else compute:certificates:manage, on provider-certificate/{id}. Certificates book no quota (at most 100 per tenant) and do not bill.
All 4 methods are served by @better-compute/server 0.3.0.
| Method | Kind | Authorization | Phase | Status |
|---|---|---|---|---|
create | mutation | compute:certificates:manage @ compute-provider-certificate | v1.0 | registered |
list | read | compute:certificates:read @ compute-tenant + items | v1.0 | registered |
get | read | compute:certificates:read @ compute-provider-certificate | v1.0 | registered |
delete | mutation | compute:certificates:manage @ compute-provider-certificate | v1.0 | registered |
create
POST /api/compute/certificates/create
Makes a certificate and returns it pending. kind: 'managed' has the provider issue and renew it for domains, each of which must be in one of the tenant's own DNS zones on the same provider account (INVALID_INPUT, reason domainNotOwned): the provider issues certificates for any domain the account hosts, which may be another tenant's. kind: 'custom' uploads the tenant's own PEMs: certificate, privateKey and optionally chain are references to the tenant's own secrets, secret://<tenantId>/<id>, and any other scheme or tenant is INVALID_INPUT. The row keeps only the references; they are resolved in the call that uploads the PEMs, by a resolver that refuses every reference the certificate does not name, and never appear in a view, event or log. The name is unique in the tenant (CONFLICT); the same idempotencyKey returns the same certificate. Publishes providerCertificate.created, then providerCertificate.ready or providerCertificate.error.
- Kind: mutation
- Authorization:
compute:certificates:manage@compute-provider-certificate - Module:
vps - Phase: v1.0 (registered)
Input
| Field | Type | Required | Constraints |
|---|---|---|---|
tenantId | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
projectId | string | at most 56 characters; matches ^prj_[0-9a-hjkmnp-tv-z]{26,52}$ | |
poolId | string | yes | at most 57 characters; matches ^pool_[0-9a-hjkmnp-tv-z]{26,52}$ |
name | string | yes | at most 42 characters; matches ^[a-z]([-a-z0-9]{0,40}[a-z0-9])?$ |
kind | one of managed, custom | yes | |
domains | list of string | 1-100 items | |
certificate | string | at most 270 characters; matches ^secret:\/\/([A-Za-z0-9._:-]{1,128})\/[A-Za-z0-9._-]{1,128}$ | |
privateKey | string | at most 270 characters; matches ^secret:\/\/([A-Za-z0-9._:-]{1,128})\/[A-Za-z0-9._-]{1,128}$ | |
chain | string | at most 270 characters; matches ^secret:\/\/([A-Za-z0-9._:-]{1,128})\/[A-Za-z0-9._-]{1,128}$ | |
idempotencyKey | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
list
POST /api/compute/certificates/list
Returns the tenant's certificates in the order they were made (at most 1000), optionally of one pool or project. Deleted ones only with includeDeleted.
- Kind: read
- Authorization:
compute:certificates:read@compute-tenant+ items - Module:
vps - Phase: v1.0 (registered)
Input
| Field | Type | Required | Constraints |
|---|---|---|---|
tenantId | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
poolId | string | at most 57 characters; matches ^pool_[0-9a-hjkmnp-tv-z]{26,52}$ | |
projectId | string | at most 56 characters; matches ^prj_[0-9a-hjkmnp-tv-z]{26,52}$ | |
includeDeleted | boolean | default false |
get
POST /api/compute/certificates/get
Returns one certificate: its kind, names, state and, once issued or uploaded, notAfter and fingerprint.
- Kind: read
- Authorization:
compute:certificates:read@compute-provider-certificate - Module:
vps - Phase: v1.0 (registered)
Input
| Field | Type | Required | Constraints |
|---|---|---|---|
tenantId | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
certificateId | string | yes | at most 58 characters; matches ^pcert_[0-9a-hjkmnp-tv-z]{26,52}$ |
delete
POST /api/compute/certificates/delete
Marks the certificate for deletion and returns it deleting; the reconciler deletes it at the provider and publishes providerCertificate.deleted. A certificate a load balancer of the tenant still names is INVALID_STATE (reason inUse): change or delete that load balancer first. A certificate is immutable; to change one, make another and point the load balancer at it.
- Kind: mutation
- Authorization:
compute:certificates:manage@compute-provider-certificate - Module:
vps - Phase: v1.0 (registered)
Input
| Field | Type | Required | Constraints |
|---|---|---|---|
tenantId | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
certificateId | string | yes | at most 58 characters; matches ^pcert_[0-9a-hjkmnp-tv-z]{26,52}$ |
Better Compute is created by Sean Filimon
Last updated
capacity
The capacity methods report what the pools a tenant can see hold, book and have free, without booking anything. `summary` and `byPool` read the per-pool rollup, which the booking transactions update and a periodic rebuild corrects. `preview` asks the placer whether a request fits, and `timeline` counts booked GPUs over time. All four are decided as `compute:capacity:read`. See [Capacity](/docs/guides/capacity).
cloudResources
Cloud resources are a provider's managed data and platform services (managed databases and what lives in them, App Platform apps, Functions, Marketplace add-ons, partner attachments), served by the `@better-compute/cloud-resources` module through the provider-neutral `ProviderResources` contract. One table, one reconciler and these calls serve every kind a provider lists: DigitalOcean today (`do.database.pg`, `do.app`, …), AWS and GCP kinds later under their own prefixes. A resource belongs to one provider pool, so to that pool's account. Two hosting models use the same calls: a platform account's pool offered to the tenant (the resource lives on the platform's account, which other tenants share), or a pool on the tenant's own account. The calls record what the tenant wants and return at once; the `cloud.resources` reconciler then creates the resource at the provider, applies changes in place and deletes what the tenant deleted. `state` shows where it is: `pending`, `provisioning`, `ready`, `updating`, `deleting`, `deleted`, `released` or `error` (with a `message`). Resources still converging are looked at every 30 seconds; ready and failed ones are refreshed every five minutes, which retries an error and picks up what changed at the provider.