Compute & PaaS — Nexocloud

Run anything — a git repo, a backend, a fleet of demo stacks — on governed compute.

The compute plane of the sovereign cloud: push code and get a routable, autoscaled, admission-gated app; stand up a full backend (auth, data, functions) declaratively; or spin ephemeral environments with cost guardrails and TTL teardown. One tenancy model, one audit chain, no bolt-ons.

Auth is one model across every service here — an SS-01 bearer token plus X-Tenant-Id on every /api/v1 route. Public base https://api.nexocloud.io/api/v1.

3 real backends, 108 operations.

Every path below is a real route from services/<svc>/openapi.json. Each service lists a representative slice of its full contract.

SkyForge SS-47

61 operations

PaaS app plane — build, admit, roll out and route apps from a git push, with crash-safe deploy sagas, previews, autoscaling and crons.

POST/api/v1/appsCreate an app from a git repo or image.
POST/api/v1/apps/{app}/deploy/sagaStart a crash-safe build → gate → admit → roll → route deploy saga.
POST/api/v1/apps/{app}/rollout/healthReport rollout health; an unhealthy signal triggers auto-rollback.
PUT/api/v1/apps/{app}/scaleSet autoscaling min/max against cpu, memory or http_rate.
POST/api/v1/apps/{app}/previewsOpen a per-PR preview environment on a TTL lease.
GET/api/v1/apps/{app}/exportEmit the app's full portable desired state for sovereign exit.

BaaS Platform SS-11

21 operations

Backend-as-a-service — declarative apps with collections, functions, realtime feeds and DB engines, applied as revisions.

POST/api/v1/apps/{app}/applyApply a declarative backend revision (collections, functions, engines).
POST/api/v1/apps/{app}/collectionsDefine a data collection with a schema and access rules.
POST/api/v1/apps/{app}/collections/{coll}/recordsCreate a record in a collection.
POST/api/v1/apps/{app}/functions/{fn}/invokeInvoke a backend function synchronously.
GET/api/v1/apps/{app}/collections/{coll}/feedSubscribe to a collection's realtime change feed.

Ephemeral Environments SS-52

26 operations

Ephemeral environments — PR previews, seeded sandboxes and demo stacks with cost estimates, lease extension and policy-driven teardown.

POST/api/v1/environmentsProvision a full ephemeral environment from a blueprint.
GET/api/v1/environments/{id}/costGet a live cost estimate for a running environment.
POST/api/v1/environments/{id}/lease/extendExtend an environment's TTL lease before teardown.
POST/api/v1/guardrailsDefine a cost guardrail that breaches into teardown.
POST/api/v1/sandboxesCreate a seeded sandbox with a reproducible dataset.

From git push to a routable, autoscaled app

A commit lands; SkyForge builds it, admission gates the image, the rollout goes live behind a TLS URL, and the autoscaler holds it to policy — all under your tenant token.

Create the appPOST/api/v1/apps

Point SkyForge at a repo; it detects the buildpack and provisions the app record.

Run the deploy sagaPOST/api/v1/apps/{app}/deploy/saga

Build → quality gate → supply-chain admission → rollout → route, resumable per step.

Set autoscalingPUT/api/v1/apps/{app}/scale

min 2 / max 20 on http_rate at a target; the autoscaler observes and adjusts behind a quota ledger.

Guard healthPOST/api/v1/apps/{app}/rollout/health

An unhealthy signal returns serving to the last-good revision automatically.

Where it sits in the platform.

Compute & PaaS does not reimplement the platform — it composes it. These are the services it leans on and the seams between them.

SkyForge (SS-47)

Owns the app record, deploy saga and rollout spine; composes the rest of the platform rather than reimplementing it.

Registry (SS-04)

Supply-chain admission inside the saga — Cosign signature, SBOM and vuln scan before any image serves.

DBaaS (SS-02) + Vault (SS-05)

Backing databases are claims; credentials live only as Vault secret refs, never in the app API.

VRQGO (SS-06)

Deploy events, logs and SLOs stream to observability; DORA is computed from the rollout spine.