Durantic / Platform

One control plane. Your machines.

You declare the state your fleet should be in. On each machine, an agent installs the operating system, applies the configuration, and builds the network to match.

Capabilities

01 / PROVISIONING

Machines, from bare hardware

A machine installs itself and can be rebuilt at any time without losing what makes it that machine.

Zero-touch install over network boot, a bootable ISO, or one command on a running Linux host
OCI images as the OS, streamed from any registry straight to disk
Reprovision in place: identity, keys, roles, and mesh membership survive a full OS reinstall

02 / CONFIGURATION

Configuration as reusable units

Roles are defined once and combined per machine, and templates can see the rest of the fleet.

Machine roles: reusable units, assigned in any combination
Templates rendered with the machine's mesh peers in scope, which is how clustered services template their own membership
Secrets and variables per account, available to templates, with secrets encrypted and write-only

03 / NETWORKING

A private network that builds and repairs itself

Every machine joins a full mesh with no tunnel configuration, and every machine is a router. This is the part teams normally build as a second project after provisioning.

Full-mesh WireGuard with no peer lists to maintain, connecting straight through NAT and firewalls
Continuous path measurement, moving traffic to a better path (or relaying through a healthy machine) when a link degrades
Embedded BGP on every machine: within a mesh, between meshes, and out to your own switches and routers
Health-checked virtual IPs, and isolated networks per team or environment

04 / CLUSTERS

Clusters from one recipe

The pieces a cluster needs (nodes, a flat network, a service address) are platform primitives, so a recipe can compose them.

The Cluster Wizard composes node roles, a network, a virtual IP, and the secrets a cluster needs
Start from a shipped recipe or write your own; you provision the nodes and the cluster assembles itself
Declare the same cluster in Terraform, so growing or rebuilding it is a pull request
One cluster can span providers and your own hardware

05 / OPERATIONS

Day-to-day access and visibility

Everything reaches a machine over the connection it already holds, so there is nothing to expose and no keys to distribute.

Browser terminal and remote command execution, including to machines with no public address
Live health per machine: hardware, link counters, and mesh path state
Agent updates over the air, with a health check and automatic rollback

06 / INTERFACES

Choose the interface that fits the task

A cloud-like dashboard, and code for everything you would rather automate.

REST API across the whole product surface
Terraform provider on the public registry
MCP server for AI agents, with confirmation gates and a log of every tool call

07 / SECURITY

Minimal trust by design

A platform that installs operating systems should require as little trust as possible.

A certificate authority per account; every agent authenticates with mutual TLS
Private keys are generated on the machine and never transmitted
Sensitive operations, such as opening a remote terminal, require an additional authentication step
Data traffic flows machine to machine; the control plane never carries it, so an outage on our side cannot take your network down
No lock-in: remove the agent and the machine and its workload keep running

As code

Machines that live in a repository.

A machine enrolls once. From then on its roles, network, and routing are declared, reviewed, and applied like any other resource.

Terraform

Roles, mesh networks, routes, route policies, virtual IPs, secrets, and registry credentials are ordinary resources. Changing the roles on a machine triggers a real reprovision, and the apply blocks until it reaches a terminal state, so a plan that says the fleet changed means the fleet changed.

REST API

Every object in the product, with a published OpenAPI schema and bearer tokens. Bulk endpoints exist for the operations you would otherwise loop over.

MCP

Connect Claude or ChatGPT and it can inspect machines and their rendered configuration, write roles, run commands, provision, and bring up a multi-node cluster: provision the first node, take the join token, bring up the rest. Destructive steps need explicit confirmation and a machine that has checked in recently, and every call is logged.

main.tf

resource "durantic_mesh_network" "prod" {
  name         = "prod"
  network_cidr = "10.42.0.0/16"
  is_default   = true
}

resource "durantic_machine_role" "pg" {
  name           = "postgres-primary"
  image_uuid     = data.durantic_image.base.uuid
  template_data  = file("roles/pg.yaml")
  merge_priority = 200
  requires_mesh  = true
}

resource "durantic_vip" "db" {
  name                = "postgres"
  address             = "10.42.0.10"
  health_check_type   = "tcp"
  health_check_target = ":5432"
}

resource "durantic_machine_deployment" "db01" {
  machine_uuid = data.durantic_machine.db01.uuid
  role_names   = ["postgres-primary"]
  # changing roles reprovisions, and apply waits
}