Accounts, not a switcher
Ops opens a customer from Accounts. The sidebar never lists every tenant. Exit returns to WPIO ops.
DigitalOcean · Docker · WordPress
WPIO is two consoles. Operators run the DigitalOcean Docker fleet. Customers buy a plan and manage their WordPress sites, teams, and billing — they never see a droplet.
job_deploy · nyc3-wpio-02
› Scoring host pool for atlas.studio…
› Selected nyc3-wpio-02 (nyc3) — score 0.81
› POST /v1/apply wpio-a1b2c3d4 → agent agt_7k2m
› docker compose up -d — project atlas-studio
› apply_result ok wpio-a1b2c3d4
› Agent heartbeat OK — site ready
Placement
tor1-wpio-01 · score 0.81
Lowest RAM reservation, idle CPU, empty site slots. nyc3-wpio-01 skipped — 78% RAM reserved.
CPU idle
91%
RAM free
7.6 GB
Disk
153 GB
Sites
0 / 6
Ops opens a customer from Accounts. The sidebar never lists every tenant. Exit returns to WPIO ops.
Ops looks up people and teams by customer instead of dumping every seat. Hygiene filters catch empty teams, open invites, and sites with no team.
Customers see only their sites, team, and billing. Fleet, agents, compose, and other tenants stay with WPIO ops.
Name, domain, PHP, region. WPIO scores the droplet pool. Customers never pick a host.
v1 enroll, heartbeat, desired, apply. The plane publishes a hashed compose file; the droplet agent applies. Never SSH.
SSH has no hostname routing. Each berth on a shared IP binds its own high port — 22 and 2222 stay blocked.
8.1 through 8.4, gated by plan. Recreates the WordPress Apache container in place.
Drain, stop, remove volumes, free the host reservation.
Harbor, Channel, Fleet — versioned. Edit entitlements without moving accounts already on a version.
Connect Stripe so customers pay open invoices with a card. Connect Amazon SES so issue and payment send mail. The mail log is its own searchable page.
Past grace: no new sites. Past double grace: running sites suspend.
RAM, CPU idle, disk, density, region. Maintenance, unenrolled, and offline agents are skipped.
Snapshot to Spaces, restore on the destination droplet, flip DNS, retire the source stack.
Create an administrator from the site panel. Password shown once.
The agent tails compose json-file logs per berth. Filter Caddy, Apache, MariaDB, SFTP. Capped on the host so disk does not fill.
ns1 and ns2 are dedicated nameservers, not WordPress droplets. WPIO publishes the zone first so ns1 already answers; the customer then delegates NS. Apex A, www CNAME, SOA, NOTIFY to ns2.
json-file max-size on every compose project. Hosts can inherit the workspace default or override. Unbounded logs raise an alert.
Included on Fleet, add-on otherwise. Manual and restore jobs.
You. Fleet, agents, PowerDNS nameservers, placement, host policy, every customer. Open an account from Customers — not a dropdown of every tenant. Lookup teams across tenants. Publishes desired compose. Never SSHs.
Their sites, PHP, SFTP, domains, staging, teams, invoices. No droplets, no IPs on the overview, no other tenants. Ops can view as a team member from Teams.
Shared Caddy on the droplet for TLS. Per-site WordPress Apache, MariaDB, optional sftpgo. Backups to Spaces.
Unpaid balance past grace blocks new sites. Double grace suspends the customer’s running sites.