Cloud integrations

This page lists, per cloud, what Levelrail does today and what is only planned. If an item is under Planned, nothing for it exists in the product yet. For the per-app tools catalog (Sentry, PostHog and similar), see Integrations. ADR 031 records how these fit together. The short version: integrations run outside the control plane, through API tokens and events. There is no plugin runtime.

​

Summary

​

AWS

Works today:

• EC2 nodes. Provision a server and enroll it as a node, with a static key, an assumable role, or the control plane’s own AWS identity. Needs a default VPC in the target region. Sizes are a short curated t3.* list. See Node provisioning. Status: exercised against test doubles only, not yet against a real AWS account.
• Route53. Zones, records, weighted, failover and multivalue routing, health checks, DNS-01 for wildcards, and automatic records when adding a domain. See DNS zones and records.
• S3. Backup targets and storage destinations for database backups, app volume backups, log archive, build cache and audit export. See Backup targets and Object storage.
• Private images. Registry credentials take a host, username and password, so any registry that accepts those works.

Planned:

• ECR token refresh preset. ECR passwords expire after 12 hours, so a static registry credential stops working until it is updated by hand.
• EC2 user-data install script snippet for installing the control plane on a fresh instance.
• Terraform snippets.

​

Google Cloud

Works today:

• Compute Engine nodes. Service account JSON key with the Compute Instance Admin role, and a default VPC network. No workload identity federation. This path has not been run against a real project, see what was not tested.

Planned:

• Google Cloud DNS as a DNS provider.
• GCS backups and storage destinations through its S3 interoperability API.
• Artifact Registry preset for registry credentials.
• GCE startup script snippet for installing the control plane.
• Terraform snippets.

​

Cloudflare

Works today:

• DNS. Zones, records, import and export, delegation checks and DNS-01 for wildcard certificates, with an API token. Cloudflare wins when both it and Route53 are connected. See DNS zones and records.
• Proxy flag. proxied on A, AAAA and CNAME records, and automatic records with --dns-proxied. Set the zone’s SSL/TLS mode to Full (strict) when it is on.
• R2. Backup targets and storage destinations, with the endpoint filled in from the account id.

Not supported: Cloudflare Tunnel, Workers, and Cloudflare load balancing (routing policies are refused on Cloudflare).

​

DigitalOcean

Works today:

• Droplet nodes. Personal access token with read and write scope. The size picker shows live monthly prices. See Node provisioning.

Not verified:

• Spaces is S3 compatible, so the custom provider with a Spaces endpoint is expected to work, but it has not been tested and is not listed as supported.
• DigitalOcean DNS is not a supported DNS provider.

​

Hetzner

Works today:

• Cloud server nodes. Project API token with Read and Write access, live monthly prices in the size picker. See Node provisioning.

Not verified:

• Object Storage is S3 compatible, with the same caveat as Spaces above.
• Hetzner DNS is not a supported DNS provider.

​

Not tied to one cloud

​

Planned, in one list

None of these exist yet.

• Google Cloud DNS provider
• GCS backups through S3 interoperability
• Artifact Registry preset
• ECR token refresh preset
• EC2 user-data and GCE startup install scripts
• Terraform snippets
• Community template repository, reviewed by pull request

Not planned until there is demand: AWS Marketplace listing, a plugin runtime, Kubernetes CRDs.