Myprod Control

Hosted control surface for Oracle, DigitalOcean, Nomad, and Traefik. Awaiting live data

Loading sign-in…
Open API ↗
agent locked

Personal compute pool

Run backend services across the Oracle control plane and temporary worker VPS capacity without leaving the hosted dashboard.

Public APIchecking
Controlchecking
Workerschecking
Operator console

Email OTP sessions are short-lived. Recovery tokens stay in this browser.

locked
Need pool state?

Sign in with your invited email to load live nodes, apps, system status, and actions.

System Status

Nomadlocked
Traefiklocked
WireGuardlocked

Endpoint Health

RouteStatusLatency
Checking Oracle ingress...

Traffic Shape

Smoke latency

Resource Utilization

Live Nomad client stats
Sign in to load node resources.

Managed Apps

locked
NameImageDomainDNSNodeReservationStatusAction
Sign in to load live apps.

Project Reservations

Exclusive worker workspaces that are isolated from shared Nomad scheduling.

ProjectWorkerIsolationStatus
Sign in to load project reservations.

Nodes

locked
Sign in to load live nodes.

Node Actions

Sign in to load node controls.

Agent Output

Sign in with your invited email to enable hosted operations. Recovery token remains available.

Sign in to Myprod

Passwordless access for the invited operator.

Are you sure?

Add application

Register a public container image. Deployment remains a separate action.

Myprod will ensure an A record points this hostname to Oracle ingress. Conflicting records are never overwritten.

Uses the root-managed file for this exact app under /etc/poolctl/apps. Secret values never pass through this dashboard.

Public images only. Runtime secret values must be installed separately on the target node; this form stores only the fixed mount policy.

CI deploy tokens

Myprod-issued credentials can update only this application's existing image repository.

Application runtime secrets remain SSH-installed and are never accepted here. Deploy-token plaintext is shown once and is not saved by the dashboard.
Loading deploy tokens...

Myprod operator FAQ

How applications, nodes, reservations, telemetry, and locked access work.

What is sample-api?

sample-api is a tiny Traefik whoami workload used to verify the complete production path: Nomad scheduling, container networking, Oracle ingress, DNS, TLS, and HTTP/HTTPS smoke checks. It is operational evidence, not a dependency of new applications.

What is the difference between a managed app and a project reservation?

A managed app is a container scheduled by Nomad with an explicit CPU and memory reservation. Several apps can share a node. A project reservation removes an entire worker from shared scheduling for privileged host-level work such as package installation, kernel or network changes, Mininet, or hardware-model toolchains.

What must exist before I add an application?
  • An immutable public container image for the target CPU architecture.
  • A service listening on 0.0.0.0 at the declared container port.
  • An unauthenticated health path returning HTTP 2xx.
  • A hostname under the configured Netlify zone, or an externally managed hostname already pointing to Oracle ingress at 140.245.5.201.
  • A joined, eligible, non-draining target node with enough capacity.
What do the Add application fields mean?
  • Name: stable Myprod/Nomad identifier.
  • Domain: public hostname without scheme, path, or port.
  • Container image: public registry reference, preferably pinned to a commit or digest.
  • Target node: exact machine where Nomad should place the workload.
  • Container port: port exposed by the process inside its container.
  • CPU and memory: scheduler reservations, not usage measurements.
  • Health path: HTTP path used to decide whether deployment is healthy.
  • Automatic DNS: create and verify the exact Netlify A record; disable it for externally managed DNS.
Does Register application deploy anything?

Register never starts a workload. It validates and persists configuration and, when automatic DNS is selected, may create or verify the external A record after a separate confirmation. Deploy renders and submits the live Nomad job, waits for a healthy allocation, and requires its own confirmation because it can replace a running workload.

What does Resource Utilization show?

The combined Oracle circle summarizes live CPU, memory, and root-disk utilization across reporting Oracle nodes. Click it to split the view into one circle per node. Each node then lists its managed backends and their Nomad CPU and memory reservations; those reservation values are scheduler capacity promised to an app, not its current process usage.

What can node actions change?
  • Freeze: stops new scheduling while existing allocations continue.
  • Unfreeze: makes a clean, non-draining, unreserved node eligible.
  • Drain: migrates or stops allocations and blocks new placement.
  • Reserve: assigns an empty worker exclusively to one project.
  • Release: clears ownership but leaves the node frozen for inspection.

Every powerful action requires a specific confirmation.

How do I add more compute capacity?

Create and firewall the VPS at the cloud provider, prepare SSH access, then use the SSH-capable local Myprod operator flow to register and join it to WireGuard and Nomad. Vercel cannot perform the first join because private SSH keys must remain on the operator machine. After joining and synchronization, the hosted dashboard can monitor and control it.

What remains visible while the dashboard is locked?

The browser keeps the last successful pool status snapshot and its capture time. Locked views are explicitly labeled cached and all mutation controls remain disabled. The public ingress smoke checks can still refresh without an agent token. Cached state can be stale and must never be treated as proof of current scheduler state.

How are CI deploy tokens different from application secrets?

Myprod generates app-scoped CI tokens, displays each plaintext once, and persists only its digest. Use the app's CI tokens control to create, inspect last-used metadata, rotate, or revoke one without restarting the agent. Application-consumed secrets remain SSH-installed on the exact target node and must never be entered into the token dialog or app form.

What is intentionally unsupported?

The app form stores bounded non-secret environment variables but never accepts secret values. It can request only a fixed app-specific environment file installed directly on the target node. Private-registry credentials, persistent volumes, arbitrary Nomad configuration, and cloud-instance creation remain unsupported. App deletion preserves external DNS records for separate review.

Read the complete operator FAQ