CubePath

View saved version →

---
name: cdn
description: Set up and run CubePath CDN zones, including plans and pricing, origins (web servers, external S3 buckets or CubePath Object Storage buckets), custom domains and SSL, cache and redirect rules, WAF blocking and rate limits, cache purges, signed URLs and traffic analytics. Use when the user wants to put a site or bucket behind the CDN, change what is cached or blocked, purge content, or understand CDN traffic.
---

# CubePath CDN

`cubepath_cdn_zone_list` is the entry point: with no arguments it lists the zones, with `zone_uuid` it gives one zone in detail (origins with their health, rules, price per GB), and with `include_plans` it adds the plan catalog. Every other CDN tool takes the zone UUID.

## Put a site or bucket behind the CDN

1. Plans: `cubepath_cdn_zone_list` with `include_plans: true`. A zone is billed by the hour for its plan plus the traffic served: confirm the plan and the price.
2. `cubepath_cdn_zone_create` with `name`. The zone is published at `<name>.cubecdn.io` with SSL already in place. Pass `custom_domain` to serve it under the user's own domain.
3. Add an origin with `cubepath_cdn_origin_set`. The zone serves nothing until it has one. The easiest way is the full `origin_url` (for example `https://origin.example.com/`).
   - Private S3 bucket at another provider (AWS, Wasabi, R2, Backblaze): enable `s3_auth_enabled` and pass the credentials the user gives you; the edge signs every request.
   - CubePath Object Storage bucket: pass only `name` and `object_storage_bucket_uuid`. This is the only way to serve a CubePath bucket publicly.
4. Custom domain: the user creates a CNAME from their domain to the zone's `cubecdn.io` domain. If the domain is hosted in CubePath DNS, offer to create it with `cubepath_dns_record_create`. The certificate is issued automatically once the CNAME resolves. If issuing failed on DNS and the user has fixed it, call `cubepath_cdn_zone_update` with `retry_ssl` once: Let's Encrypt allows only 5 failed validations per hour.
5. `cubepath_wait_for_status` with `resource_type` `cdn_zone`.

## Rules

Read the current rules with `cubepath_cdn_rule_list` first. There are two families:

- `edge`: `cache`, `cache_bypass`, `redirect`, `header_request`, `header_response`.
- `waf`: `firewall_ip`, `firewall_country`, `firewall_ua`, `rate_limit`, `js_challenge`, and limits on speed, requests, connections and monthly bandwidth.

`cubepath_cdn_rule_set` without `rule_uuid` creates a rule (`rule_type` and `action_config` required); with `rule_uuid` it updates only what is sent (the type is fixed). `match_conditions` limits which requests it applies to and a lower `priority` runs first. To pause a rule set `enabled: false` instead of deleting it with `cubepath_cdn_rule_delete`.

Typical cases:

- Cache static files longer: a `cache` rule on the path or extension with a TTL.
- Never cache an admin area or an API: `cache_bypass`.
- Block a country or abusive IPs: `firewall_country`, `firewall_ip`.
- Bot or scraper traffic: look at `cubepath_cdn_metrics` with `top_user_agents`, `top_asn` and `top_urls` first, then add a `rate_limit` or a `js_challenge`.

Before a blocking rule, confirm its scope with the user so they do not lock out their own visitors or themselves.

## Purge the cache

After the user changes files at the origin: `cubepath_cdn_purge_cache` with `paths` (up to 100; a trailing `*` purges a prefix). Prefer paths over `everything: true`, which sends all traffic back to the origin until the cache fills again. It is asynchronous: check it with `cubepath_cdn_purge_list`. Each organization can request 300 purges per hour, at most 60 of them whole zone or prefix purges.

## Traffic analytics

`cubepath_cdn_metrics` over the last `minutes`, with `metric`: `summary` (requests, bytes, cache hit rate, error rate), `requests`, `bandwidth`, `cache`, `status_codes`, `top_urls`, `top_countries`, `top_asn`, `top_user_agents`, `blocked` (what the WAF stopped and why), `pops`, `file_extensions`. Filters such as `country`, `status`, `cache_status` or `path_prefix` narrow it down.

- Low cache hit rate: check `cache` and `top_urls`, then the rules.
- 5xx errors: check the origin health in the zone detail.

## Maintenance

- Take an origin out of rotation without losing it: `cubepath_cdn_origin_set` with `enabled: false`. A zone can have several origins with weights, priorities and a backup origin.
- `cubepath_cdn_origin_delete` on the only origin leaves the zone returning errors; on a bucket origin it also stops serving the bucket.
- Signed URLs: `cubepath_cdn_token_sign_url` on a zone with Token Auth. Turning Token Auth on for the first time creates a secret that is shown only once, so that is done in the CubePath dashboard.
- Uploaded custom certificates are managed in the CubePath dashboard.
- `cubepath_cdn_zone_delete` removes the zone with its origins and rules and cannot be undone: the domains pointing at it stop responding.

View saved version →

---
name: databases
description: Create and operate CubePath managed databases (MySQL, PostgreSQL and Valkey), including plans and prices, replicas, logical databases and users, engine parameters, backup policy, metrics and deletion. Use when the user wants a managed database on CubePath, needs to give an application database access, or asks about the performance, size or cost of an existing database.
---

# CubePath managed databases

CubePath operates the whole instance: high availability, automatic failover, backups and a public connection endpoint.

## Read

- `cubepath_mdb_list` lists the instances with engine, version, status, replicas, and the host and port to connect to. With `md_uuid` it adds plan, location, backup policy, protection, and the logical databases and users.
- The admin password is only in the CubePath dashboard. This channel never returns passwords or connection strings that contain one.

## Create an instance

1. `cubepath_mdb_plan_list` narrowed with `engine` and `location`. Prices are USD per hour PER NODE: the monthly cost is the hourly price x replicas x 730.
2. Confirm engine, version, plan, number of replicas and the monthly estimate. There are no major version upgrades later, so pick the version carefully.
3. `cubepath_mdb_create` with `project_id`, `name`, `engine`, `version`, `plan_uuid` and `replicas` (and, if the user wants, `backup_schedule_cron` and `backup_retention_days`).
4. `cubepath_wait_for_status` with `resource_type` `managed_database`. It takes several minutes: if the wait times out, call it again; never create the instance twice.

## Give an application access

1. `cubepath_mdb_object_create` with `object_type: database` and its `name` (Valkey has no logical databases).
2. `cubepath_mdb_object_create` with `object_type: user`, `name` and a `password` the user chooses. Ask for it: a password generated by the server would never be shown, and the user would be unusable.
3. Give the user the host and port from `cubepath_mdb_list`, plus the database and user names.

Suggest a dedicated user per application instead of sharing the admin account.

## Performance and tuning

- `cubepath_mdb_inspect` with `view: metrics`: connections, CPU, memory and replication lag over a time window. Use it to decide whether to scale.
- Engine parameters: read `cubepath_mdb_inspect` with `view: config` FIRST (valid parameters, ranges, and which ones restart the instance), then `cubepath_mdb_reconfigure` with `params`.
- `cubepath_mdb_reconfigure` takes EXACTLY ONE of `replicas` (more or fewer nodes), `plan_uuid` (bigger or smaller plan, same location and engine) or `params`. More replicas or a bigger plan raise the bill: confirm first. Follow it with `cubepath_wait_for_status`.
- Name, label, backup policy and delete protection: `cubepath_mdb_update`. Suggest protection for production databases.

Backups run on the instance's backup policy. There is no tool to take or restore a backup on demand; for that, send the user to the CubePath dashboard or support.

## Delete

- `cubepath_mdb_object_delete` removes one logical database with ALL its data, or one user, who can no longer connect. Confirm first.
- `cubepath_mdb_delete` destroys the instance with all its data, databases, users and backups. It cannot be undone: ask whether the user has an export and get an explicit yes. A protected instance is refused; turn protection off with `cubepath_mdb_update` only if the user asks.

View saved version →

---
name: dns
description: Host and manage domains in CubePath DNS, including creating or importing zones, verifying nameservers, adding, changing or deleting records (A, AAAA, CNAME, MX, TXT, SRV...), GeoDNS, SOA timers and health check failover. Use when the user wants to point a domain or subdomain somewhere, set up email records, move a domain's DNS to CubePath, or find out why a name does not resolve.
---

# CubePath DNS

Hosting zones is free. Every DNS tool takes the zone UUID: start with `cubepath_dns_zone_list` to translate the domain into its UUID, and use `cubepath_dns_record_list` to get a record UUID. Never pass a domain name where a UUID is expected.

CubePath does not register domains: the user buys them at a registrar and points the nameservers here.

## Host a domain

1. `cubepath_project_list` for the `project_id`.
2. Moving from another DNS provider: `cubepath_dns_zone_scan` with `domain` and `project_id` creates the zone and imports what public DNS answers today. It only adds records, never overwrites. For a new domain, `cubepath_dns_zone_create`.
3. Review the result with `cubepath_dns_record_list`. The scan only sees what public DNS answers, so ask the user about anything that may be missing (for example DKIM selectors or names nobody queries).
4. `cubepath_dns_zone_get` gives the nameservers. The user sets them at their registrar.
5. `cubepath_dns_zone_verify`. It is asynchronous: check `cubepath_dns_zone_get` later to see the zone turn `active`. Do not call it in a loop; after a failed verification it can only be retried once per hour.

Until the zone is verified, records are stored but not published.

## Records

- Create: `cubepath_dns_record_create`. `name` is `@` for the root domain or the subdomain (`www`, `app`).
- Pointing at a CubePath server: take its public IP from `cubepath_vps_list`, `cubepath_baremetal_list` or `cubepath_floating_ip_list`.
- Change: `cubepath_dns_record_update` touches only the fields sent. The type cannot change: delete the record and create a new one. Before moving a site to another IP, suggest lowering the TTL first.
- Delete: `cubepath_dns_record_delete`. Confirm first and, when several records share the name, show which one by its content.
- SOA records and the NS records of the root domain are managed by CubePath and get rejected.
- A zone holds up to 1000 records: filter `cubepath_dns_record_list` with `record_type` or `name_contains`, or page with `limit` and `offset`.

Email records (MX, SPF, DKIM, DMARC) come from the user's email provider. Ask for the exact values; never invent them.

## GeoDNS and failover

- GeoDNS: `cubepath_dns_region_list` gives the region codes to set in a record's `region`. Any region other than `global` needs the DNS Pro or Business plan.
- Health checks: `cubepath_dns_health_check_set` on an A or AAAA record withdraws that value from the answers while its target is down, which gives automatic failover between several IPs of the same name. It needs DNS Pro or Business and costs 10 USD per month per check: confirm before creating one. It replaces the whole check configuration, so send the unchanged fields too.
- State and uptime: `cubepath_dns_health_check_list`. Incidents over a period: `cubepath_dns_health_check_history`.

## "My domain does not resolve"

1. `cubepath_dns_zone_get`: if the zone is not `active`, the nameservers at the registrar are wrong or have not propagated yet.
2. `cubepath_dns_record_list` filtered by the name: does the record exist with the expected content?
3. `cubepath_dns_health_check_list`: a failing check removes its value from the answers.
4. Caches: resolvers keep answers for the TTL, and negative answers for the SOA `minimum` (`cubepath_dns_soa_get`).

## Other

- Reverse DNS (PTR) is not part of the zone: it is set on the IP with `cubepath_floating_ip_reverse_dns_set`.
- `cubepath_dns_soa_update` changes SOA timers; the defaults are right for almost everything, so only change them if the user asks.
- `cubepath_dns_zone_move_project` only regroups the zone.
- `cubepath_dns_zone_delete` removes the domain with ALL its records and cannot be undone. To stop serving a single name, delete only that record.

View saved version →

---
name: get-started
description: First steps with the CubePath plugin. Use when the user connects CubePath for the first time or asks what they can do with their CubePath account.
---

# Getting started with CubePath

CubePath is a cloud provider: VPS and baremetal servers, DNS, CDN, private networks, floating IPs, firewalls, load balancers, NAT gateways, managed Kubernetes, managed databases and object storage.

## First conversation

1. Call `cubepath_project_list` to see what the user already has. Projects group every resource, and this tool is also the way to read a server's details (there is no separate "get server" tool).
2. Summarize it briefly: number of projects, servers and their status, and any other resources present.
3. Suggest two or three next steps that fit what you found, for example checking the metrics of a busy server, adding a DNS record or reviewing firewall rules.

If the account is empty, explain what CubePath offers and point to the plans with `cubepath_vps_plan_list`. Do not create resources unless the user asks for it.

## Rules

- Only the tools the user granted when connecting are available. If a tool is missing, the user did not grant that permission: tell them they can reconnect CubePath and grant it, instead of trying another route.
- Creating servers, load balancers, clusters or databases is billed to the user's CubePath account. State the plan and monthly price before creating anything and wait for an explicit yes.
- Stopping, restarting, resizing, detaching, deleting or overwriting interrupts a service or loses data. Name the exact resource and ask for confirmation first.
- Long operations are queued and return at once. Follow them with `cubepath_wait_for_status` or the list tools; never repeat the call.
- Payments, balance top ups, invoices and account settings are handled in the CubePath dashboard at https://my.cubepath.com, not here.

View saved version →

---
name: kubernetes
description: Create and operate CubePath managed Kubernetes clusters, including versions, worker plans and prices, node pools and autoscaling, marketplace addons (ingress, monitoring, storage...), cluster health and node metrics, and deletion. Use when the user wants a Kubernetes (k8s) cluster on CubePath, needs more or fewer nodes, wants to install an addon, or asks why a cluster or node is unhealthy.
---

# CubePath managed Kubernetes

CubePath runs the control plane (standard or high availability). The workers are VPS billed to the organization, so every node added costs money.

## Read

- `cubepath_k8s_cluster_list` lists the clusters and gives the UUID every other tool needs.
- `cubepath_k8s_cluster_get` with `view`:
  - `overview` (default): API endpoint, CIDRs, private network, node pools with their workers, and the latest health.
  - `node_pools`: pools with their scaling, labels and taints.
  - `addons`: installed addons and the state of each installation.
  - `load_balancers`: the load balancers pointing at the workers.
  - `metrics`: ready nodes, pending and failed pods, API latency; with `node_name`, the series of one worker.

## Create a cluster

1. `cubepath_k8s_catalog` with `catalog: versions` for the version and the control plane price, then `catalog: plans` for the worker plans that version accepts. Never make up a version or a plan.
2. `cubepath_project_list` for the `project_id` (and the `network_id` if the user wants an existing private network).
3. Summarize and get a yes: location, version, high availability control plane or not, each node pool (plan x number of workers), and the monthly estimate (control plane plus the workers as VPS).
4. `cubepath_k8s_cluster_create` with `project_id`, `name`, `location_name`, `version`, `node_pools` and `ha_control_plane`.
5. `cubepath_wait_for_status` with `resource_type` `kubernetes`. Creating a cluster can outlast one wait: call it again, never create the cluster twice.

The kubeconfig is downloaded from the CubePath dashboard (or with cubecli). This channel never returns it, because it is a full admin credential.

## Scale

- More workers in an existing pool: `cubepath_k8s_node_pool_update` with `add_nodes`, or `desired_nodes` for the total. Lowering `desired_nodes` DESTROYS the newest workers: confirm first.
- Autoscaling: `auto_scale` with `min_nodes` and `max_nodes`. A `min_nodes` above the current count creates workers right away, which adds cost.
- A different worker size, or workloads kept apart: `cubepath_k8s_node_pool_create` with its own plan (from `catalog: plans`), labels and taints.
- Do not send `add_nodes` together with `desired_nodes` in one call. The cluster has to be active with no other operation running.

## Addons

1. `cubepath_k8s_catalog` with `catalog: addons` to turn the addon name into its `slug`.
2. `cubepath_k8s_addon_install`. It installs in the background.
3. Check the outcome with `cubepath_k8s_cluster_get` and `view: addons`.

`cubepath_k8s_addon_uninstall` takes the `addon.uuid` shown in `view: addons`. Removing an ingress controller or monitoring stack can cut traffic or alerts: confirm first.

## Troubleshoot

1. `view: overview` for the API server and worker health.
2. `view: metrics` for not ready nodes, pending or failed pods and API latency.
3. `view: metrics` with `node_name` for one worker (Ready, kubelet CPU and memory, and its server's usage).
4. To remove a broken worker: `cubepath_k8s_delete` with `target: worker` and its `vps_id` drains and destroys it. Then check the pool size in `view: node_pools` and add a worker with `add_nodes` if needed.

## Delete

`cubepath_k8s_delete` with `target`:
- `cluster`: removes the control plane and ALL workers, and the workloads with them.
- `node_pool`: removes a pool and its workers (not the last pool of a cluster).
- `worker`: drains and removes one node.

It cannot be undone: always confirm, naming the cluster. A protected cluster is refused; turn protection off with `cubepath_k8s_cluster_update` only if the user asks. Suggest protection for production clusters.

View saved version →

---
name: networking
description: Manage CubePath networking, including private networks with static routes and BGP, public and floating IPs with reverse DNS, firewall groups for VPS and dedicated servers, load balancers (listeners, targets, health checks) and NAT gateways. Use when the user wants servers to talk privately, open or close ports, put servers behind a load balancer, give private servers Internet access, get another public IP or set a PTR record.
---

# CubePath networking

## Private networks

- Read: `cubepath_project_list` is the only way to see the private networks and the servers attached to them.
- Create: `cubepath_network_create` with `name`, `location_name`, `ip_range` and `prefix` (for example `10.10.0.0` and `24`) and `project_id`. Each organization has a network limit (3 by default). The network starts empty.
- Attach servers: `cubepath_vps_network_attach` (the VPS needs a restart) or `cubepath_baremetal_network` (the interface has to be configured inside the OS). One network per server, in the same location.
- Traffic between servers over a private network is free and is not filtered by the firewall.
- Static routes: `cubepath_network_route_list`, `cubepath_network_route_create` (30 per network), `cubepath_network_route_delete`.
- BGP: `cubepath_network_bgp_peer_list`, `cubepath_network_bgp_peer_create` (8 per network; the network needs an attached server first), `cubepath_network_bgp_peer_update` (`enabled: false` brings a session down and keeps it), `cubepath_network_bgp_peer_delete`.
- `cubepath_network_delete` only works when no server or NAT gateway is attached.

## Firewalls

Rules are allow rules grouped in firewall groups, and groups are applied to servers. Once a server has an enabled rule, any inbound traffic to its public IPs that no rule allows is dropped. Outbound traffic from a VPS is allowed.

1. `cubepath_firewall_group_list` to see the groups and their rules.
2. `cubepath_firewall_group_set`. Without `group_id` it creates a group (`project_id`, `name`, `rules`); with `group_id` it edits one. `rules` REPLACES the whole list: always send the unchanged rules too. A rule is `direction` (`in`/`out`), `protocol`, optional `port` (`443`, `8000-8100`, `80,443`) and optional `source` (IP or CIDR; omitted means anyone).
3. Keep SSH reachable: include an inbound tcp rule for port 22 (or the user's SSH port) unless the user explicitly says otherwise.
4. `cubepath_firewall_server_set` with `server_type` (`vps` or `baremetal`), `server_id` and `firewall_group_ids` in evaluation order. It REPLACES the assignment; an empty list turns the firewall off and leaves the server open, so confirm that. Groups must be in the server's project.
5. Confirm it applied with `cubepath_firewall_server_list` (`last_sync.status` `completed`).

On dedicated servers the rules are enforced on the switch without connection state: only `in` rules apply, ICMP is always allowed, and replies are let in for TCP and for UDP from ports 53 and 123.

To pause a group set `enabled: false`. `cubepath_firewall_group_delete` only works on a group that is not applied anywhere.

## Public IPs

- `cubepath_floating_ip_list`: the organization's IPs, the server each one is assigned to, whether it is the primary IP, and its PTR. `view: history` answers questions about the past.
- An extra IP: look for an unassigned one in the list first. `cubepath_floating_ip_acquire` (`ip_type`, `location_name`) starts a monthly charge right away, even while the IP is unassigned: confirm first. The platform picks the address.
- Assigning an IP to a server or unassigning it is done in the CubePath dashboard; there is no tool for it here.
- Reverse DNS: `cubepath_floating_ip_reverse_dns_set` with `address` and `hostname` (omit `hostname` to clear it). The IP has to be assigned to a server. For a mail server, the hostname should also have an A record pointing back to the same IP.
- `cubepath_floating_ip_release` gives the IP back for good: it cannot be recovered and it cannot be a server's primary IP. At most 3 releases per 24 hours. Confirm first.

## Load balancers

1. `cubepath_lb_plan_list`: plans per location with hourly price in USD, maximum listeners, maximum targets and connections per second. Confirm the plan and its monthly price (hourly x 730; public IPs are billed apart).
2. `cubepath_lb_create` with `name`, `plan_name`, `location_name` and `project_id`. Wait with `cubepath_wait_for_status` (`load_balancer`).
3. `cubepath_lb_listener` with `action: create`: `name`, `protocol` (`http`, `https` or `tcp`), `source_port`, `target_port`, `algorithm`. An `https` listener needs `ssl_certificate_uuid`, a certificate uploaded in the CubePath dashboard: there is no tool to list or upload certificates, so ask the user for it.
4. `cubepath_lb_listener` with `action: set_health_check`, so failing servers stop receiving traffic.
5. `cubepath_lb_target` with `action: add`: VPS, dedicated servers or a whole availability group, up to 50 per call.
6. `cubepath_lb_list` shows everything, including the health of each target. `cubepath_lb_metrics` shows connections and traffic.

Maintenance: `drain` a target before working on that server (no new requests, current ones finish); `remove` cuts its connections at once. Resize with `cubepath_lb_update` and `plan_name`, in a call of its own (it reboots the balancer). `cubepath_lb_delete` releases its IPs and cannot be undone.

## NAT gateways

They give Internet access to servers that only have a private IP.

1. The servers must be in a private network (see above).
2. `cubepath_nat_list` with `include_plans: true`. Billed hourly, and it uses one public IPv4 and one IPv6: confirm the plan and the price.
3. `cubepath_nat_create` with `name`, `plan_name` and `network_id`. One gateway per network; the default route is managed for you.
4. `cubepath_wait_for_status` with `nat_gateway`.

Traffic: `cubepath_nat_metrics`. Resize: `cubepath_nat_update` with `plan_name` alone (outbound traffic stops for a moment). `cubepath_nat_delete` leaves the network's servers without Internet access and the outbound IP is not recovered: confirm first.

View saved version →

---
name: object-storage
description: Manage CubePath Object Storage (S3 compatible), including tiers and pricing, buckets, versioning, Object Lock, lifecycle expiration, replication, bucket event notifications (webhooks, Slack, Discord), access keys, usage and costs, and serving a bucket through the CDN. Use when the user asks about S3 buckets, storing files or backups on CubePath, storage costs, or bucket events.
---

# CubePath Object Storage

## Read

- `cubepath_object_storage_bucket_list`: buckets with tier, status, size, object count, versioning, protection, tags, CDN connection and month to date cost. It gives the UUID every other tool needs.
- `cubepath_object_storage_bucket_get`: how to connect an S3 client (endpoint, region, path style and virtual host URLs) and this month's usage and cost.
- `cubepath_object_storage_tiers_list`: tiers with location, endpoint, prices per GiB stored, per GiB of egress and per 1,000 requests, and the monthly free allowance.

This plugin does not list, upload or download objects. The user does that with any S3 client (AWS CLI, rclone, an SDK) and an access key.

## Create a bucket

1. `cubepath_object_storage_tiers_list` and explain the prices and the free allowance.
2. Agree on a name: names are global across all CubePath customers, 3 to 63 lowercase letters, digits and hyphens.
3. Decide on Object Lock now: it can only be turned on at creation. In compliance mode nobody can delete the protected data or shorten its retention, and it stays billed until it expires. Explain that before passing `object_lock` and `accept_object_lock_terms: true`.
4. Confirm and call `cubepath_object_storage_bucket_create` with `name`, `tier` and `project_id` (optionally `versioning`, `tags`).
5. `cubepath_wait_for_status` with `resource_type` `object_storage_bucket` (10 to 20 seconds).
6. Access key: the user creates it in the CubePath dashboard, the API or cubecli, because its secret is shown only once and never passes through this conversation. Then give them the endpoint, region and URL from `cubepath_object_storage_bucket_get` for their S3 client.

## Access keys

`cubepath_object_storage_key_list` shows the keys, their permission (`read_write` or `read_only`) and the buckets they are limited to; secrets are never shown. `cubepath_object_storage_key_delete` revokes a key and every application using it loses access within seconds: confirm first.

## Bucket settings

- `cubepath_object_storage_bucket_update`: versioning (`enabled` or `suspended`; once enabled it can never go back to off), deletion protection, and `tags` (replaces every tag; send the full set).
- Lifecycle: read `cubepath_object_storage_bucket_lifecycle_get` first, because `cubepath_object_storage_bucket_lifecycle_set` replaces ALL the rules. Expiration permanently deletes objects in the background, usually within 48 hours of the due date: confirm the bucket, prefix and days. The rules are applied when `applied_generation` equals `generation`. `cubepath_object_storage_bucket_lifecycle_delete` removes all of them.
- Object Lock default retention: `cubepath_object_storage_bucket_object_lock_set`.

## Serve a bucket publicly

Buckets are private. The way to publish one is a CDN zone with the bucket as its origin: `cubepath_cdn_origin_set` with `name` and `object_storage_bucket_uuid` (see the `cdn` skill).

## Replication

- The source bucket needs versioning on and no Object Lock.
- `cubepath_object_storage_replication_create` to ONE destination: another CubePath bucket of the same tier (same cluster, so it is NOT a disaster recovery copy), or an external S3 bucket over HTTPS (billed as egress, including the initial copy of existing objects). Confirm the destination and the cost.
- Follow it with `cubepath_wait_for_status` (`object_storage_replication`) and check health with `cubepath_object_storage_replication_list` or `cubepath_object_storage_replication_get`.
- `cubepath_object_storage_replication_update` pauses, resumes, changes filters or rotates the external key. `cubepath_object_storage_replication_resync` copies existing objects again. `cubepath_object_storage_replication_delete` stops it.
- Replicating into a bucket of another organization needs a grant token, created in the dashboard, the API or cubecli. `cubepath_object_storage_replication_grant_list`, `cubepath_object_storage_replication_grant_delete` and `cubepath_object_storage_replication_revoke` manage incoming replication.

## Event notifications

- Destinations (signed webhooks, Slack or Discord) are created in the dashboard, the API or cubecli. Here they are read with `cubepath_object_storage_event_destination_list` and `cubepath_object_storage_event_destination_get`, changed or disabled with `cubepath_object_storage_event_destination_update`, removed with `cubepath_object_storage_event_destination_delete`, and `cubepath_object_storage_event_destination_test` sends a test event.
- Rules decide which events (created, removed, tagging) under which prefix and suffix go to which destination: `cubepath_object_storage_event_rule_list`, `cubepath_object_storage_event_rule_create`, `cubepath_object_storage_event_rule_update`, `cubepath_object_storage_event_rule_delete`. Deliveries may be billed per million: confirm before creating a rule.
- Events not arriving: check the destination status (`auto_disabled` after repeated failures) and `cubepath_object_storage_event_deliveries_list` for the HTTP status and error of each attempt.

## Usage and costs

- `cubepath_object_storage_usage_get`: the month per tier and per bucket (GiB-month stored, egress, CDN traffic, requests), cost so far and projected cost. Filter or group by `tags` for cost per team or customer.
- `cubepath_object_storage_bucket_metrics`: storage, traffic and responses (2xx to 5xx, 429) of one bucket over time.

## Delete a bucket

`cubepath_object_storage_bucket_delete` only works on an empty bucket. With `force` it first deletes EVERY object and version permanently: get an explicit yes. It is refused while the bucket is protected or served by a CDN origin; remove the origin with `cubepath_cdn_origin_delete` first.

View saved version →

---
name: servers
description: Deploy, inspect and operate CubePath VPS and dedicated (baremetal) servers, including plans and prices, OS images, power actions, CPU/memory/traffic metrics, resize, reinstall, backups, snapshots, rescue mode, SSH keys and availability groups. Use when the user asks about a server, VM, VPS or dedicated machine on CubePath, wants a new one, or wants to change, repair or delete one.
---

# CubePath servers

## Find the server first

- VPS: `cubepath_vps_list`. There is no "get one server" tool: the listing already carries status, plan, image, public IPs, SSH keys, private network, firewall groups and project. Resolve the `vps_id` from the name there, never guess it.
- Dedicated servers: `cubepath_baremetal_list`, and resolve the `baremetal_id` from the hostname.
- `cubepath_project_list` shows both kinds together with the private networks, grouped by project.
- If two servers have similar names, show both and ask which one.

## Look at a server

| Question | Tool |
|---|---|
| CPU, memory, disk and network over time | `cubepath_vps_metrics` (`time_range`: 30m, 1h, 6h, 24h, 7d) |
| Internet traffic vs private network traffic | `cubepath_vps_metrics` with the `network_public_*` and `network_private_*` metrics |
| Traffic used this month vs included | `cubepath_vps_bandwidth_usage`, compared with the plan's `bandwidth` (TB) from `cubepath_vps_plan_list` |
| Backups and their schedule | `cubepath_vps_backup_list` |
| A whole availability group | `cubepath_vps_availability_group_metrics` |
| Dedicated server traffic | `cubepath_baremetal_metrics` (no CPU or memory on baremetal) |
| Dedicated server temperatures, fans, power state | `cubepath_baremetal_bmc_sensors` |

Report what the tools return. An empty series means there is no data yet (new or powered off server), not zero usage. To advise on a plan change, compare average and peak CPU and memory with the current plan.

## Create a VPS

1. `cubepath_project_list` for the `project_id`. Create a project with `cubepath_project_create` only if the user asks for one.
2. `cubepath_vps_plan_list` narrowed with `location` and, when it helps, `min_ram_gb` or `in_stock_only`. Prices are USD; `price_per_month` is the hourly price x 730. The primary IPv4 and backups are billed apart.
3. `cubepath_vps_template_list` for the `template_name`. Suggest the latest Ubuntu LTS or Debian unless the user wants something else. To deploy a copy of an existing disk, pass `snapshot_id` from `cubepath_vps_snapshot_list` instead.
4. Access: `cubepath_ssh_key_list`. Prefer SSH keys. If the user has none, offer to store their public key with `cubepath_ssh_key_set`: ask them to paste it, never generate one. Never make up a password; ask the user for it.
5. Confirm with the user: name (a valid hostname such as `web-01`), location, plan with its monthly price, image, project, and automatic backups if they want them (extra monthly cost).
6. `cubepath_vps_create`, then `cubepath_wait_for_status` with `resource_type` `vps`. When it is active, give the user the public IP and the SSH command (`ssh root@<ip>`).

Without public IPv4 and IPv6 the server needs a private network (`network_id`). Billing addons only work in projects billed hourly.

## Change a VPS

| Goal | Tool | Before calling it |
|---|---|---|
| Start, stop, restart | `cubepath_vps_power` (`start_vps`, `stop_vps`, `restart_vps`) | Warn that stop and restart interrupt the service |
| Bigger or smaller plan | `cubepath_vps_resize` | Confirm the new price. The disk cannot shrink. The server restarts |
| New OS from scratch | `cubepath_vps_reinstall` | It wipes the disk: explicit yes, and offer a backup first |
| New root password | `cubepath_vps_change_password` | Ask the user for the password |
| Rename, labels | `cubepath_vps_update` | No interruption |
| Move to another project | `cubepath_vps_move_project` | No interruption |
| Authorize or revoke an SSH key | `cubepath_vps_ssh_key_add`, `cubepath_vps_ssh_key_remove` | Confirm which key and which server |
| Private network | `cubepath_vps_network_attach`, `cubepath_vps_network_detach` | Needs a restart to apply. One network per server |
| Boot from an ISO | `cubepath_vps_iso_list`, `cubepath_vps_iso_attach`, restart, later `cubepath_vps_iso_detach` | |
| Lock against destroy and reinstall | `cubepath_vps_protection` | Unlock only when the user explicitly asks |

A server runs one operation at a time: a conflict error means another one is in flight. Follow it with `cubepath_wait_for_status`; never repeat the call.

## Backups and snapshots

- Before anything risky (reinstall, resize, a big upgrade) offer `cubepath_vps_backup_create` and wait until it shows as completed in `cubepath_vps_backup_list`.
- Automatic backups: `cubepath_vps_backup_settings`. Turning them on has a monthly cost; turning them off requires deleting the existing backups first with `cubepath_vps_backup_delete`.
- `cubepath_vps_backup_restore` overwrites the whole disk. Tell the user the date of the backup and get a clear yes.
- Snapshots are permanent copies owned by the organization that survive the server, billed per GB stored each month. Check `cubepath_vps_snapshot_quota`, then `cubepath_vps_snapshot_create`, and follow it with `cubepath_vps_snapshot_get` until it is `available`.

## A server that does not boot, or the user is locked out

1. Check its status in `cubepath_vps_list` and recent `cubepath_vps_metrics`.
2. If the server works and only the password is lost, `cubepath_vps_change_password` is enough.
3. To repair the system: `cubepath_vps_rescue_enable` (it shuts the server down: confirm first). The temporary root password is emailed to the organization and never shown here; SSH keys from `cubepath_ssh_key_list` can be added. Follow it with `cubepath_vps_rescue_get`, which gives the SSH address and warns if the firewall blocks SSH.
4. When the repair is done, `cubepath_vps_rescue_disable` boots the server from its disk again.

## Destroy a VPS

1. Name the exact server (name, IP, project) and ask for explicit confirmation: its data and backups are lost for good. Snapshots are kept.
2. Ask whether to keep its public IPs in the organization (`release_ips: false`, they stay billed) or release them.
3. A protected server is refused. Remove protection with `cubepath_vps_protection` only if the user asks for it.
4. `cubepath_vps_destroy`, then `cubepath_wait_for_status`.

## Availability groups

They spread servers across different physical hosts so a host failure does not take them all down. Create one with `cubepath_vps_availability_group_create` (free, tied to one location), then deploy servers with `availability_group_uuid` or add existing ones with `cubepath_vps_availability_group_member`. `cubepath_vps_availability_group_list` shows the groups of a project. Good fit for servers behind a load balancer.

## Dedicated (baremetal) servers

- Models, stock and prices: `cubepath_baremetal_catalog` with `location`, `model_name` or `in_stock_only`. USD per month plus a setup fee.
- `cubepath_baremetal_deploy` charges the user's card at once (setup fee plus the first month, not prorated, not reversible). Always state the model, location and exact amount and wait for a clear yes. If the bank asks for 3D Secure, the user completes it in the CubePath dashboard.
- Reinstall: `cubepath_baremetal_catalog` with `baremetal_id` for a compatible `os_name` and `disk_layout_name`, then `cubepath_baremetal_reinstall` with `install`. It wipes every disk and baremetal has no automatic backups.
- Power: `cubepath_baremetal_power` (`start_metal`, `stop_metal`, `restart_metal`) cuts power abruptly, with no clean shutdown. Check the result with `cubepath_baremetal_bmc_sensors`.
- Recovery: `cubepath_baremetal_recovery` with `rescue` (credentials are emailed) or `reset_bmc` when the management controller hangs.
- Hostname, tags, protection, project and SSH keys: `cubepath_baremetal_update`. Private network: `cubepath_baremetal_network`.
- The remote console (KVM) is only available in the CubePath dashboard.