One control plane for every
cloud you provision on.
hostess spins up VMs across Hetzner, DigitalOcean, Linode and GCE, configures them with ansible, and tracks every action as a streamed async operation. Anything with an OpenTofu provider works too, no Go code required.
Native Go drivers for Hetzner, DigitalOcean, Linode and GCE give you a real catalog and power-cycle. The long tail runs through one generic OpenTofu driver. A new provider you care about is a driver file. Any other is a connection row.
Every mutation is an operation. A Postgres-backed worker pool claims it, runs the handler, and reports ordered steps with live output. Poll one endpoint to watch a provision land, step by step.
Provider creds and SSH private keys sit in an Argon2id + AES-GCM envelope vault. Nothing cleartext touches Postgres or disk. The passphrase lives in a secretStore, fetched at boot, fail-closed.
Six system playbooks ship embedded: harden, base packages, Docker, Compose, Podman, k3s. Every script keeps version history. Run a set on a fresh node and the output streams into the operation log.
Nothing is exposed unencrypted or unauthenticated. A non-loopback bind refuses to start without TLS and an API key. mTLS is one env var away, and dev mode stays loopback-only.
Consumers import hostess2/client, a typed Go client with
bearer auth and an injectable mTLS *http.Client. No
handwritten request plumbing.
Provision a node in one call
Create returns an operation id. Poll it to watch the five steps run.
curl -X POST https://hostess2.lab.stratus5.net/v1/nodes \
-H "Authorization: Bearer $HOSTESS_API_KEY" \
-d '{"name":"web-1","connectionId":"","region":"nbg1","size":"cx22","image":"ubuntu-24.04"}'
# => 202 {"nodeId":"...","operationId":"..."}
curl https://hostess2.lab.stratus5.net/v1/operations/<operationId> \
-H "Authorization: Bearer $HOSTESS_API_KEY"