PowerCloud

Documentation

Run your own encrypted cloud

How to plan a PowerCloud deployment, install nodes, store data, run apps, and keep it all current and locked down. Every page describes what PowerCloud does today.

Get started

ConceptsWhat PowerCloud is and the ideas every other page builds on - trusted and untrusted nodes, the cluster and its storage locations, the passphrase and recovery key, the cluster CA, nodes, pcctl, the mesh and apps - with a glossary.QuickstartTry PowerCloud on one computer with no hardware - create a cluster over three local directories, store and read a file, lose a provider and repair it, then run the node daemon locally and enroll it.Install a nodeHow to run PowerCloud OS on a physical machine, a QEMU, libvirt or Proxmox VM, AWS, Google Cloud or Azure - the image files, writing and booting them, cloud upload scripts, firewall ports, supported hardware and Secure Boot.Enroll a nodeHow to bring a freshly booted node into a PowerCloud cluster - from its console with an enrollment code, or unattended with a join bundle given as cloud user data or a QEMU fw_cfg file - and what the node does on its first boot and when it joins the mesh.

Plan

Deployment designsThe architectures you can build with PowerCloud, from storage-only to multi-site clusters on confidential VMs, what each protects against, how it unlocks, and how to choose between them.Costs and sizingHow to size PowerCloud nodes, storage and network, what confidential cloud VMs and object storage cost, worked monthly estimates for common designs, and how to spend less.Use cases with the Unidatum Data EngineHow the Unidatum Data Engine (document collections, SQL over parquet, content-addressed files) could run on PowerCloud nodes and keep its data in PowerCloud's encrypted storage, what works today, what is untested, and designs for concrete use cases.

Storage

StorageHow PowerCloud's encrypted store works, how to set up storage locations on directories, S3-compatible buckets and your own nodes, and how to keep them in step with check, repair and gc.S3 gatewayHow to serve the cluster's encrypted, replicated storage as an S3-compatible HTTPS endpoint from your nodes, manage its access keys, and use it from the AWS CLI and boto3.

Apps

Apps on a nodeHow to deploy, inspect and remove sandboxed apps (static binaries or container images) on one PowerCloud node, with their limits, ports, links, egress and microVMs.Cluster appsHow to publish apps for the whole PowerCloud cluster, how the nodes place them and fail them over, and how to use exclusive apps, app storage, app volumes, the nodes' consensus and the kv commands.

Operate

Managing nodesDay-to-day operation of PowerCloud nodes with pcctl, including status, node info, the web console, power, storage sync, changing addresses, the mesh, NAT traversal, relays and how pcctl finds and authenticates to nodes.Upgrades and releasesHow to keep PowerCloud nodes and pcctl current, from checking a release's files to rolling it out to every node one at a time, upgrading a single node by hand, and what happens when an image fails to boot.Unlocking nodes after a rebootHow a PowerCloud node's encrypted state volume is unlocked after a reboot, by an admin, by the node's TPM under Secure Boot, by key shares held by its peers, or with AMD SEV-SNP attestation on confidential VMs, and how to choose between them.Admins, keys and revocationWho can manage a PowerCloud cluster and how, from the passphrase and recovery key to admin certificates, revoking admins, renewing node certificates, removing nodes and rotating the cluster keys after a leak.TroubleshootingCommon PowerCloud problems by symptom - pcctl errors about passphrases, storage locations, certificates and key rotation, nodes that won't boot, join, unlock or mesh - with the cause and the fix for each.

Reference

pcctl command referenceEvery pcctl command, flag, default, environment variable and local file, with what each command needs (the admin certificate, --repo, or --repo or --via) and an example.Using PowerCloud with an AI assistantHow an AI coding assistant such as Claude Code should read these docs, run pcctl safely, handle secrets, and which commands need a person's go-ahead.

For AI assistants

Every page is also published as plain Markdown, so an assistant such as Claude Code can read the whole manual and operate a cluster with pcctl. Start with Using PowerCloud with an AI assistant: which commands are safe, which need your go-ahead, and how to keep the passphrase out of the chat.